@xenon-device-management/xenon 2.12.0 → 2.13.0

package/lib/src/app/routers/control.js

@@ -75,6 +75,7 @@ const iosStreamPort_1 = require("./iosStreamPort");
 const androidH264Config_1 = require("./androidH264Config");
 const recording_store_1 = require("../../services/recording/recording-store");
 const clipboardErrors_1 = require("../../device-managers/clipboardErrors");
+const WDAClient_1 = require("../../device-managers/ios/WDAClient");
 const scopeGuard_1 = require("../../middleware/scopeGuard");
 const roleGuard_1 = require("../../middleware/roleGuard");
 const deviceAccessGuard_1 = require("../../middleware/deviceAccessGuard");
@@ -87,6 +88,12 @@ const streamLeave_1 = require("./streamLeave");
 const SessionOwnerResolver_1 = require("../../services/device-access/SessionOwnerResolver");
 const actor_1 = require("../../services/device-access/actor");
 const deviceAccessPolicy_1 = require("../../services/device-access/deviceAccessPolicy");
+/**
+ * The answer for an unknown udid, and for another team's phone (see
+ * deviceTeamGuard): the same JSON on every route. Most routes used to send
+ * this as plain text, which a JSON client couldn't read.
+ */
+const DEVICE_NOT_FOUND = { error: 'not_found', message: 'Device not found' };
 const router = (0, express_1.Router)();
 /** True when an in-memory iOS/Android (MJPEG or H.264) stream session exists. */
 function hasActiveManualStream(udid) {
@@ -152,7 +159,7 @@ router.post('/:udid/tap', (req, res) => __awaiter(void 0, void 0, void 0, functi
     const { x, y } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const manager = yield getDeviceManagerForPlatform(device.platform);
     if (manager && manager.tap) {
         try {
@@ -175,14 +182,16 @@ router.post('/:udid/tap', (req, res) => __awaiter(void 0, void 0, void 0, functi
             return res.status(500).send({ error: err.message });
         }
     }
-    res.status(400).send('Manager not found or tap not supported');
+    res
+        .status(400)
+        .json({ error: 'not_supported', message: 'Manager not found or tap not supported' });
 }));
 router.post('/:udid/swipe', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
     const { udid } = req.params;
     const { x, y, endX, endY, duration = 1000 } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const manager = yield getDeviceManagerForPlatform(device.platform);
     if (manager && manager.swipe) {
         try {
@@ -194,14 +203,16 @@ router.post('/:udid/swipe', (req, res) => __awaiter(void 0, void 0, void 0, func
             return res.status(500).send({ error: err.message });
         }
     }
-    res.status(400).send('Manager not found or swipe not supported');
+    res
+        .status(400)
+        .json({ error: 'not_supported', message: 'Manager not found or swipe not supported' });
 }));
 router.post('/:udid/text', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
     const { udid } = req.params;
     const { text } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const manager = yield getDeviceManagerForPlatform(device.platform);
     if (manager && manager.typeText) {
         try {
@@ -213,14 +224,16 @@ router.post('/:udid/text', (req, res) => __awaiter(void 0, void 0, void 0, funct
             return res.status(500).send({ error: err.message });
         }
     }
-    res.status(400).send('Manager not found or typeText not supported');
+    res
+        .status(400)
+        .json({ error: 'not_supported', message: 'Manager not found or typeText not supported' });
 }));
 router.post('/:udid/keyevent', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
     const { udid } = req.params;
     const { keyCode } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const manager = yield getDeviceManagerForPlatform(device.platform);
     if (manager && manager.pressKey) {
         try {
@@ -228,18 +241,24 @@ router.post('/:udid/keyevent', (req, res) => __awaiter(void 0, void 0, void 0, f
             return res.status(200).send({ success: true });
         }
         catch (err) {
+            // A key the phone doesn't have is the caller's mistake, not a failure.
+            if (err instanceof WDAClient_1.UnsupportedKeyError) {
+                return res.status(400).send({ error: 'unsupported_key', message: err.message });
+            }
             logger_1.default.error(`❌ pressKey failed for ${udid}: ${err.message}`);
             return res.status(500).send({ error: err.message });
         }
     }
-    res.status(400).send('Manager not found or pressKey not supported');
+    res
+        .status(400)
+        .json({ error: 'not_supported', message: 'Manager not found or pressKey not supported' });
 }));
 router.get('/:udid/screenshot', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
     var _a, _b;
     const { udid } = req.params;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     // Principal Engineer Optimization: If a high-speed stream is already running for Android,
     // we should grab the latest frame instead of triggering a heavy ADB screencap.
     if (device.platform === 'android') {
@@ -270,13 +289,15 @@ router.get('/:udid/screenshot', (req, res) => __awaiter(void 0, void 0, void 0,
             error: 'Screenshot capture failed. Device may be busy or WDA is unresponsive. Try again.',
         });
     }
-    res.status(400).send('Manager not found or screenshot not supported');
+    res
+        .status(400)
+        .json({ error: 'not_supported', message: 'Manager not found or screenshot not supported' });
 }));
 router.get('/:udid/clipboard', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
     const { udid } = req.params;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const manager = yield getDeviceManagerForPlatform(device.platform);
     if (manager && manager.getClipboard) {
         try {
@@ -289,14 +310,16 @@ router.get('/:udid/clipboard', (req, res) => __awaiter(void 0, void 0, void 0, f
             return res.status(500).send({ error: err.message });
         }
     }
-    res.status(400).send('Manager not found or getClipboard not supported');
+    res
+        .status(400)
+        .json({ error: 'not_supported', message: 'Manager not found or getClipboard not supported' });
 }));
 router.post('/:udid/clipboard', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
     const { udid } = req.params;
     const { content } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const manager = yield getDeviceManagerForPlatform(device.platform);
     if (manager && manager.setClipboard) {
         try {
@@ -312,14 +335,16 @@ router.post('/:udid/clipboard', (req, res) => __awaiter(void 0, void 0, void 0,
             return res.status(500).send({ error: err.message });
         }
     }
-    res.status(400).send('Manager not found or setClipboard not supported');
+    res
+        .status(400)
+        .json({ error: 'not_supported', message: 'Manager not found or setClipboard not supported' });
 }));
 router.post('/:udid/touchAndHold', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
     const { udid } = req.params;
     const { x, y, duration = 1000 } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const manager = yield getDeviceManagerForPlatform(device.platform);
     if (manager && manager.touchAndHold) {
         try {
@@ -331,13 +356,15 @@ router.post('/:udid/touchAndHold', (req, res) => __awaiter(void 0, void 0, void
             return res.status(500).send({ error: err.message });
         }
     }
-    res.status(400).send('Manager not found or touchAndHold not supported');
+    res
+        .status(400)
+        .json({ error: 'not_supported', message: 'Manager not found or touchAndHold not supported' });
 }));
 router.post('/:udid/lock', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
     const { udid } = req.params;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const manager = yield getDeviceManagerForPlatform(device.platform);
     if (manager && manager.lock) {
         try {
@@ -349,13 +376,15 @@ router.post('/:udid/lock', (req, res) => __awaiter(void 0, void 0, void 0, funct
             return res.status(500).send({ error: err.message });
         }
     }
-    res.status(400).send('Manager not found or lock not supported');
+    res
+        .status(400)
+        .json({ error: 'not_supported', message: 'Manager not found or lock not supported' });
 }));
 router.post('/:udid/unlock', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
     const { udid } = req.params;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const manager = yield getDeviceManagerForPlatform(device.platform);
     if (manager && manager.unlock) {
         try {
@@ -367,7 +396,9 @@ router.post('/:udid/unlock', (req, res) => __awaiter(void 0, void 0, void 0, fun
             return res.status(500).send({ error: err.message });
         }
     }
-    res.status(400).send('Manager not found or unlock not supported');
+    res
+        .status(400)
+        .json({ error: 'not_supported', message: 'Manager not found or unlock not supported' });
 }));
 /**
  * Is the device's panel lit?
@@ -386,7 +417,7 @@ router.get('/:udid/display', (req, res) => __awaiter(void 0, void 0, void 0, fun
     const { udid } = req.params;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send({ status: 'error', message: 'Device not found' });
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const manager = yield getDeviceManagerForPlatform(device.platform);
     if (!(manager === null || manager === void 0 ? void 0 : manager.getDisplayState))
         return res.status(200).send({ state: 'unknown' });
@@ -398,7 +429,7 @@ router.post('/:udid/install', (req, res) => __awaiter(void 0, void 0, void 0, fu
     const { appPath } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const manager = yield getDeviceManagerForPlatform(device.platform);
     if (manager && manager.installApp) {
         try {
@@ -410,22 +441,28 @@ router.post('/:udid/install', (req, res) => __awaiter(void 0, void 0, void 0, fu
             return res.status(500).send({ error: err.message });
         }
     }
-    res.status(400).send('Manager not found or installApp not supported');
+    res
+        .status(400)
+        .json({ error: 'not_supported', message: 'Manager not found or installApp not supported' });
 }));
 router.post('/:udid/install-repository-app', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a;
+    var _a, _b;
     const { udid } = req.params;
-    const { appId } = req.body;
+    const { appId } = (_a = req.body) !== null && _a !== void 0 ? _a : {};
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
+    // Without one the lookup below threw, and the answer was a 500.
+    if (typeof appId !== 'string' || !appId) {
+        return res.status(400).json({ error: 'bad_request', message: 'appId is required' });
+    }
     try {
         const { APP_SERVICE } = yield Promise.resolve().then(() => __importStar(require('../../dashboard/services/app-service')));
         const app = yield APP_SERVICE.getAppById(appId);
         // Installing hands over the binary as a download does: another team's
         // app answers as an unknown one.
-        if (!(0, appVisibility_1.canSeeApp)(app, (_a = req.auth) === null || _a === void 0 ? void 0 : _a.teamIds)) {
-            return res.status(404).send('App not found in repository');
+        if (!(0, appVisibility_1.canSeeApp)(app, (_b = req.auth) === null || _b === void 0 ? void 0 : _b.teamIds)) {
+            return res.status(404).json({ error: 'not_found', message: 'App not found in repository' });
         }
         // A node's phone: the app is in this server's library, not the node's,
         // so the file goes to the node's own upload-install.
@@ -440,7 +477,9 @@ router.post('/:udid/install-repository-app', (req, res) => __awaiter(void 0, voi
             yield manager.installApp(udid, app.filepath);
             return res.status(200).send({ success: true, message: `Installed ${app.name}` });
         }
-        res.status(400).send('Manager not found or installApp not supported');
+        res
+            .status(400)
+            .json({ error: 'not_supported', message: 'Manager not found or installApp not supported' });
     }
     catch (err) {
         logger_1.default.error(`Installation from repository failed: ${err.message}`);
@@ -484,16 +523,20 @@ router.post('/:udid/upload-install', uploadParser, (req, res) => __awaiter(void
     const answer = yield (() => __awaiter(void 0, void 0, void 0, function* () {
         const device = yield getDeviceInfo(udid);
         if (!device)
-            return { status: 404, body: 'Device not found' };
+            return { status: 404, body: DEVICE_NOT_FOUND };
         if (!req.files || Object.keys(req.files).length === 0) {
-            return { status: 400, body: 'No files were uploaded.' };
+            return { status: 400, body: { error: 'bad_request', message: 'No files were uploaded.' } };
+        }
+        if (!appFile || !appPath) {
+            return { status: 400, body: { error: 'bad_request', message: 'File "app" is required' } };
         }
-        if (!appFile || !appPath)
-            return { status: 400, body: 'File "app" is required' };
         yield appFile.mv(appPath);
         const manager = yield getDeviceManagerForPlatform(device.platform);
         if (!(manager === null || manager === void 0 ? void 0 : manager.installApp)) {
-            return { status: 400, body: 'Manager not found or installApp not supported' };
+            return {
+                status: 400,
+                body: { error: 'not_supported', message: 'Manager not found or installApp not supported' },
+            };
         }
         yield manager.installApp(udid, appPath);
         return {
@@ -518,7 +561,7 @@ router.post('/:udid/uninstall', (req, res) => __awaiter(void 0, void 0, void 0,
     const { bundleId } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const manager = yield getDeviceManagerForPlatform(device.platform);
     if (manager && manager.uninstallApp) {
         try {
@@ -530,13 +573,15 @@ router.post('/:udid/uninstall', (req, res) => __awaiter(void 0, void 0, void 0,
             return res.status(500).send({ error: err.message });
         }
     }
-    res.status(400).send('Manager not found or uninstallApp not supported');
+    res
+        .status(400)
+        .json({ error: 'not_supported', message: 'Manager not found or uninstallApp not supported' });
 }));
 router.get('/:udid/apps', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
     const { udid } = req.params;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const manager = yield getDeviceManagerForPlatform(device.platform);
     if (manager && manager.listApps) {
         try {
@@ -549,13 +594,15 @@ router.get('/:udid/apps', (req, res) => __awaiter(void 0, void 0, void 0, functi
             return res.status(500).send({ error: err.message });
         }
     }
-    res.status(400).send('Manager not found or listApps not supported');
+    res
+        .status(400)
+        .json({ error: 'not_supported', message: 'Manager not found or listApps not supported' });
 }));
 router.get('/:udid/logs', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
     const { udid } = req.params;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const manager = yield getDeviceManagerForPlatform(device.platform);
     if (manager && manager.getLogs) {
         try {
@@ -567,7 +614,9 @@ router.get('/:udid/logs', (req, res) => __awaiter(void 0, void 0, void 0, functi
             return res.status(500).send({ error: err.message });
         }
     }
-    res.status(400).send('Manager not found or getLogs not supported');
+    res
+        .status(400)
+        .json({ error: 'not_supported', message: 'Manager not found or getLogs not supported' });
 }));
 const MJPEG_PROXY_CACHE = new Map();
 /**
@@ -581,7 +630,7 @@ router.post('/:udid/stream/start', (req, res) => __awaiter(void 0, void 0, void
     exports.previewLeaves.cancel(udid);
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     // Ownership at stream-start time. A manual lock with no live stream is an
     // orphan to reclaim; a live foreign stream is a conflict we must refuse.
     // Refusing is what stops one user's start from silently rewriting another
@@ -728,7 +777,7 @@ router.post('/:udid/stream/ticket', (req, res) => __awaiter(void 0, void 0, void
         return res.status(503).json((0, deviceAccessPolicy_1.ownershipUnavailableBody)());
     }
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     // Carry the two other things `evaluateDeviceAccess` needs alongside the user
     // id. A ticket consumer (the logcat WS) has no Express request to run
     // resolveActor against, and re-deriving them from a User row at redeem time
@@ -818,7 +867,7 @@ router.post('/:udid/stream/leave', (req, res) => __awaiter(void 0, void 0, void
     const { udid } = req.params;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const actor = (0, actor_1.resolveActor)(req);
     const lockInfo = (0, manualLock_1.inspectManualLock)(device.session_id, actor.userId, udid);
     const mayRelease = (0, deviceAccessPolicy_1.isSelfManualLock)(device.session_id, udid, actor.userId, actor.apiKeyId) ||
@@ -838,7 +887,7 @@ router.post('/:udid/stream/stop', (req, res) => __awaiter(void 0, void 0, void 0
     const { udid } = req.params;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     // Multi-user safety: refuse to release a manual lock owned by another user.
     // Admin scope bypasses this so support can clear stuck sessions.
     //
@@ -903,7 +952,7 @@ router.get('/:udid/stream/status', (req, res) => __awaiter(void 0, void 0, void
     const { udid } = req.params;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     // Advertise which transport the frontend player should use. A recording
     // device keeps MJPEG (one capture pipeline per device).
     const flagOn = (0, androidH264Config_1.resolveAndroidH264)((_a = typedi_1.Container.get(PluginContext_1.PluginContext).pluginArgs.streaming) === null || _a === void 0 ? void 0 : _a.androidH264).enabled;
@@ -973,7 +1022,7 @@ router.get('/:udid/stream', (req, res) => __awaiter(void 0, void 0, void 0, func
     });
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     // The MJPEG preview attaches here on a reload; see screenSizeDeps.
     void (0, fillMissingScreenSize_1.fillMissingScreenSize)(device, screenSizeDeps);
     let mjpegPort = device.mjpegServerPort;
@@ -1029,7 +1078,7 @@ router.get('/:udid/stream', (req, res) => __awaiter(void 0, void 0, void 0, func
     if (!mjpegPort) {
         return res.status(404).send({
             error: 'MJPEG port not found for device',
-            hint: 'For iOS: Use POST /stream/start to begin streaming. For Android: Start an Appium session first.',
+            hint: 'Start the preview with POST /stream/start, then open this stream again.',
         });
     }
     const videoUrl = `http://127.0.0.1:${mjpegPort}`;
@@ -1059,7 +1108,7 @@ router.get('/:udid/stream', (req, res) => __awaiter(void 0, void 0, void 0, func
             proxy.proxyRequest(req, res);
         }
         else {
-            res.status(404).send('Proxy not created');
+            res.status(404).json({ error: 'not_found', message: 'The preview could not be started' });
         }
     }
     catch (err) {
@@ -1076,9 +1125,9 @@ router.post('/:udid/shell', (req, res) => __awaiter(void 0, void 0, void 0, func
     const { command } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     if (!command)
-        return res.status(400).send('Command is required');
+        return res.status(400).json({ error: 'bad_request', message: 'Command is required' });
     const manager = yield getDeviceManagerForPlatform(device.platform);
     if (manager && manager.executeShell) {
         try {
@@ -1091,7 +1140,9 @@ router.post('/:udid/shell', (req, res) => __awaiter(void 0, void 0, void 0, func
             return res.status(200).send({ error: err.message });
         }
     }
-    res.status(400).send('Manager not found or executeShell not supported');
+    res
+        .status(400)
+        .json({ error: 'not_supported', message: 'Manager not found or executeShell not supported' });
 }));
 /**
  * Where Omni-Vision reads the screen from, for the stand-in driver it is
@@ -1127,14 +1178,20 @@ router.get('/:udid/omni-scan', (req, res) => __awaiter(void 0, void 0, void 0, f
     const { udid } = req.params;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const screen = yield omniScreen(req, udid, device);
     if (!screen)
-        return res.status(400).send('Manager not found');
+        return res.status(400).json({ error: 'not_supported', message: 'Manager not found' });
     try {
         const omniService = typedi_1.Container.get(OmniVisionService_1.OmniVisionService);
         const mockDriver = Object.assign({ sessionId: `manual_${udid}` }, screen);
         const result = yield omniService.analyzeScreen(mockDriver);
+        // analyzeScreen reports a failed analysis in its result rather than
+        // throwing (the Appium execute-script path returns that object as is).
+        if ((result === null || result === void 0 ? void 0 : result.status) === 'error') {
+            logger_1.default.error(`Manual Omni-Scan failed for ${udid}: ${result.message}`);
+            return res.status(500).send({ status: 'error', message: result.message });
+        }
         return res.status(200).send({ status: 'success', value: result });
     }
     catch (err) {
@@ -1161,7 +1218,7 @@ router.get('/:udid/inspector/snapshot', (req, res) => __awaiter(void 0, void 0,
         return res.status(503).json((0, deviceAccessPolicy_1.ownershipUnavailableBody)());
     }
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     try {
         const inspectorService = typedi_1.Container.get(InspectorService_1.InspectorService);
         const snapshot = yield inspectorService.getSnapshot(udid);
@@ -1193,7 +1250,7 @@ router.get('/:udid/appium-session', (req, res) => __awaiter(void 0, void 0, void
     const { udid } = req.params;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send({ status: 'error', message: 'Device not found' });
+        return res.status(404).json(DEVICE_NOT_FOUND);
     // A manual lock is the dashboard holding the device for preview/recording,
     // not an Appium session — it cannot resolve locators, so it is not one.
     const sessionId = device.session_id && !(0, manualLock_1.isManualLock)(device.session_id) ? String(device.session_id) : null;
@@ -1211,19 +1268,20 @@ router.post('/:udid/test-locator', (req, res) => __awaiter(void 0, void 0, void
     const { strategy, selector } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
-        return res.status(404).send('Device not found');
+        return res.status(404).json(DEVICE_NOT_FOUND);
     const screen = yield omniScreen(req, udid, device);
     if (!screen)
-        return res.status(400).send('Manager not found');
+        return res.status(400).json({ error: 'not_supported', message: 'Manager not found' });
     try {
         const omniService = typedi_1.Container.get(OmniVisionService_1.OmniVisionService);
         const mockDriver = { sessionId: `manual_${udid}`, getScreenshot: screen.getScreenshot };
         let value = [];
         if (strategy === '-custom:ai-text') {
-            value = yield omniService.findByText(mockDriver, selector);
+            // A failed OCR or AI call is a 500 here, not "no match".
+            value = yield omniService.findByText(mockDriver, selector, { throwOnError: true });
         }
         else if (strategy === '-custom:ai-icon') {
-            const match = yield omniService.findByIcon(mockDriver, selector);
+            const match = yield omniService.findByIcon(mockDriver, selector, { throwOnError: true });
             if (match)
                 value = [match];
         }

package/lib/src/app/routers/dashboard.js

@@ -995,8 +995,10 @@ function getMutedSelectors(request, response) {
 function getSelectorStateByTuple(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b;
-        const strategy = decodeURIComponent((_a = request.params.strategy) !== null && _a !== void 0 ? _a : '');
-        const value = decodeURIComponent((_b = request.params.value) !== null && _b !== void 0 ? _b : '');
+        // Express has already decoded the params. Decoding them again made a
+        // selector with a `%` need encoding twice, and a lone `%` threw.
+        const strategy = (_a = request.params.strategy) !== null && _a !== void 0 ? _a : '';
+        const value = (_b = request.params.value) !== null && _b !== void 0 ? _b : '';
         const row = yield prisma_1.prisma.selectorState.findUnique({
             where: {
                 original_strategy_original_selector: {
@@ -1170,6 +1172,7 @@ function resetMetrics(request, response) {
         }
     });
 }
+const changeSettingsGuard = (0, roleGuard_1.superAdminGuard)("Only a super admin can change the lab's settings.");
 function register(router) {
     router.use('/session/:sessionId', isValidSession);
     router.use((0, roleGuard_1.roleGuard)('MEMBER'));
@@ -1207,11 +1210,14 @@ function register(router) {
     router.post('/healing/selector/state', (0, roleGuard_1.roleGuard)('MEMBER'), (0, scopeGuard_1.scopeGuard)(['sessions']), postSelectorStateAction);
     router.get('/healing/state/muted', getMutedSelectors);
     router.get('/healing/state/:strategy/:value', getSelectorStateByTuple);
-    router.get('/config', getGlobalConfig);
-    // Config + destructive ops: admin-only. Read-only config stays open to any
-    // authenticated key so dashboards using 'read' scope can still populate.
-    router.post('/config', (0, roleGuard_1.roleGuard)('ADMIN'), (0, scopeGuard_1.scopeGuard)(['admin']), updateGlobalConfig);
-    router.post('/config/reset-metrics', (0, roleGuard_1.roleGuard)('ADMIN'), (0, scopeGuard_1.scopeGuard)(['admin']), resetMetrics);
+    // The lab's settings. Reading them needs ADMIN, as the pages that show
+    // them do; changing them needs SUPER_ADMIN and the admin scope. Through
+    // 2.12 any member could read them and any admin change them: the stricter
+    // guards in ConfigRouter were never reached, since these routes are
+    // registered first and answer.
+    router.get('/config', (0, roleGuard_1.roleGuard)('ADMIN'), getGlobalConfig);
+    router.post('/config', changeSettingsGuard, (0, scopeGuard_1.scopeGuard)(['admin']), updateGlobalConfig);
+    router.post('/config/reset-metrics', changeSettingsGuard, (0, scopeGuard_1.scopeGuard)(['admin']), resetMetrics);
 }
 exports.default = {
     register,