@xenon-device-management/xenon 2.12.0 → 2.13.0

package/lib/src/app/routers/grid.js

@@ -187,13 +187,36 @@ function registerNode(request, response) {
         });
     });
 }
-function blockDevice(request, response) {
+/**
+ * The phone a block or unblock names: exactly one row, by udid and host.
+ * Through 2.12 the body went to getDevice as a filter, so an empty body
+ * blocked the first phone in the store, and a udid alone the first row of it,
+ * whatever server it was on. Answers the refusal itself and returns
+ * undefined, or the row.
+ */
+function deviceToBlock(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
-        const requestBody = request.body;
-        const device = yield (0, device_service_1.getDevice)(requestBody);
-        if (lodash_1.default.isNil(device)) {
-            return response.status(404).json({ success: false, error: 'Device not found' });
+        var _a;
+        const { udid, host } = (_a = request.body) !== null && _a !== void 0 ? _a : {};
+        if (typeof udid !== 'string' || udid === '' || typeof host !== 'string' || host === '') {
+            response
+                .status(400)
+                .json({ success: false, error: 'bad_request', message: 'udid and host are required' });
+            return undefined;
         }
+        const device = yield device_store_1.DeviceStoreFactory.getStore().findDevice({ udid, host });
+        if (!device) {
+            response.status(404).json({ success: false, error: 'Device not found' });
+            return undefined;
+        }
+        return device;
+    });
+}
+function blockDevice(request, response) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const device = yield deviceToBlock(request, response);
+        if (!device)
+            return;
         try {
             yield (0, device_service_1.userBlockDevice)(device.udid, device.host);
         }
@@ -208,11 +231,9 @@ function blockDevice(request, response) {
 }
 function unBlockDevice(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
-        const requestBody = request.body;
-        const device = yield (0, device_service_1.getDevice)(requestBody);
-        if (lodash_1.default.isNil(device)) {
-            return response.status(404).json({ success: false, error: 'Device not found' });
-        }
+        const device = yield deviceToBlock(request, response);
+        if (!device)
+            return;
         try {
             yield (0, device_service_1.userUnblockDevice)(device.udid, device.host);
         }
@@ -295,6 +316,7 @@ function getQueueSummary(request, response) {
 }
 function nodeAdbStatusOnOtherHost(currentHost, request, response) {
     return __awaiter(this, void 0, void 0, function* () {
+        var _a;
         const { host } = request.params;
         // when host is this hub, return status from AndroidDeviceManager directly
         // otherwise, forward request to the node
@@ -312,7 +334,9 @@ function nodeAdbStatusOnOtherHost(currentHost, request, response) {
         }
         else {
             // find node url from database of devices
-            const devices = yield store.findDevices({ host: { $contains: host } });
+            // The store's own host filter: findDevices hands its filter to Prisma
+            // as it is, and Prisma rejected the `$contains` that used to be here.
+            const devices = yield store.getDevices({ filterByHost: host });
             if (devices.length === 0) {
                 response
                     .status(404)
@@ -323,7 +347,17 @@ function nodeAdbStatusOnOtherHost(currentHost, request, response) {
             // remove wd/hub from url
             const normalizedUrl = device.host.replace(/\/wd\/hub$/, '');
             const url = `${normalizedUrl}/xenon/api/node/status`;
-            const result = yield InternalHttpClient_1.InternalHttpClient.get(url);
+            let result;
+            try {
+                result = yield InternalHttpClient_1.InternalHttpClient.get(url);
+            }
+            catch (err) {
+                response.status(502).json({
+                    error: 'node_unreachable',
+                    message: `Could not get ${normalizedUrl}'s status: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`,
+                });
+                return;
+            }
             response.json(result);
         }
     });
@@ -404,7 +438,6 @@ function getActiveSessions(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         const { SessionManager } = yield Promise.resolve().then(() => __importStar(require('../../sessions/SessionManager')));
         const sessionManager = typedi_1.Container.get(SessionManager);
-        const stats = sessionManager.getStats();
         const sessions = sessionManager.getAllSessions().map((s) => {
             var _a, _b, _c;
             return ({
@@ -418,8 +451,15 @@ function getActiveSessions(request, response) {
         // Phase 4A: filter by visibility of the underlying device.
         const auth = request.auth;
         const visibleSessions = yield (0, device_service_1.filterRowsByVisibleDevice)(sessions, auth === null || auth === void 0 ? void 0 : auth.teamIds, 'deviceUdid');
+        // The counts are of the sessions listed, so a member's describe only what
+        // they may see. Through 2.12 they counted every team's sessions.
+        const byType = { local: 0, remote: 0, cloud: 0 };
+        for (const session of visibleSessions) {
+            const type = String(session.type).toLowerCase();
+            byType[type] = (byType[type] || 0) + 1;
+        }
         response.json({
-            stats,
+            stats: { total: visibleSessions.length, byType },
             sessions: visibleSessions,
         });
     });

package/lib/src/app/routers/profile.js

@@ -22,15 +22,24 @@ const ROLE_SCOPES = {
     ADMIN: ['devices', 'sessions', 'read'],
     MEMBER: ['sessions', 'read'],
 };
-function widenedScope(requested, allowed) {
-    // 'admin' is widening for any non-super-admin allowed set.
-    for (const r of requested) {
-        if (r === 'admin' && !allowed.includes('admin'))
-            return true;
-        if (!allowed.includes(r))
-            return true;
-    }
-    return false;
+const KNOWN_SCOPES = ['read', 'sessions', 'devices', 'admin'];
+function isScope(value) {
+    return KNOWN_SCOPES.includes(value);
+}
+/** Whether a scope list grants `scope`; `admin` grants every scope, as scopeGuard reads it. */
+function grants(scopes, scope) {
+    return scopes.includes('admin') || scopes.includes(scope);
+}
+/**
+ * Whether a token with `requested` would reach past the caller's role or past
+ * the credential creating it. Through 2.12 only the role was checked, so a
+ * `read`-only key of an admin could mint itself a `devices,sessions` token.
+ * And a SUPER_ADMIN, whose role's list is just `admin`, could not ask for a
+ * narrower token than that.
+ */
+function widenedScope(requested, allowed, credential) {
+    const credentialScopes = credential.split(',').map((s) => s.trim());
+    return requested.some((r) => !grants(allowed, r) || !grants(credentialScopes, r));
 }
 function profileRouter() {
     const r = (0, express_1.Router)();
@@ -102,7 +111,7 @@ function profileRouter() {
         })));
     }));
     r.post('/tokens', (req, res) => __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
+        var _a, _b, _c;
         const auth = requireAuth(req, res);
         if (!auth)
             return;
@@ -124,9 +133,14 @@ function profileRouter() {
             expiresAtDate = d;
         }
         const allowed = (_a = ROLE_SCOPES[auth.role]) !== null && _a !== void 0 ? _a : ROLE_SCOPES.MEMBER;
+        if (scopes !== undefined && (!Array.isArray(scopes) || !scopes.every(isScope))) {
+            return res.status(400).json({ error: `scopes must be some of ${KNOWN_SCOPES.join(', ')}` });
+        }
         const requested = scopes && scopes.length > 0 ? scopes : allowed;
-        if (widenedScope(requested, allowed)) {
-            return res.status(400).json({ error: 'cannot widen scopes beyond your role' });
+        if (widenedScope(requested, allowed, String((_b = auth.scopes) !== null && _b !== void 0 ? _b : ''))) {
+            return res
+                .status(400)
+                .json({ error: 'cannot widen scopes beyond your role or the credential you are using' });
         }
         const { id, raw } = yield apiKeySvc.create({
             name,
@@ -137,7 +151,7 @@ function profileRouter() {
         return res.status(201).json({
             id,
             token: raw,
-            expiresAt: (_b = expiresAtDate === null || expiresAtDate === void 0 ? void 0 : expiresAtDate.toISOString()) !== null && _b !== void 0 ? _b : null,
+            expiresAt: (_c = expiresAtDate === null || expiresAtDate === void 0 ? void 0 : expiresAtDate.toISOString()) !== null && _c !== void 0 ? _c : null,
         });
     }));
     r.delete('/tokens/:id', (req, res) => __awaiter(this, void 0, void 0, function* () {

package/lib/src/app/routers/recordings.js

@@ -275,6 +275,11 @@ function summaryContext(req, all, visible) {
 const recLog = logger_1.default.scope('RecordingsRouter');
 const router = (0, express_1.Router)();
 router.use((0, roleGuard_1.roleGuard)('MEMBER'));
+// Every recording write needs the `devices` scope: it holds, records and marks
+// phones. Through 2.12 only DELETE asked, so a `read`-only key could start and
+// stop recordings. Mounted on /recordings only: this router sits at the API's
+// root, and a router-wide guard would also catch the routes after it.
+router.use('/recordings', (0, scopeGuard_1.mutationScopeGuard)(['devices']));
 router.get('/recordings', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
     const parsed = (0, recordingRequests_1.parseLibraryQuery)(req.query);
     if (!parsed.ok)
@@ -559,8 +564,7 @@ router.get('/recordings/:groupId', (req, res) => __awaiter(void 0, void 0, void
 }));
 // Irreversible, so an API key needs `devices`, as on /control: owning the
 // recording, or an admin role, is not enough for a read-only key.
-const devicesScope = (0, scopeGuard_1.mutationScopeGuard)(['devices']);
-router.delete('/recordings/:groupId', devicesScope, (req, res) => __awaiter(void 0, void 0, void 0, function* () {
+router.delete('/recordings/:groupId', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
     const { groupId } = req.params;
     try {
         const store = typedi_1.Container.get(recording_store_1.RecordingStore);
@@ -619,9 +623,11 @@ router.get('/recordings/:groupId/composite.mp4', (req, res) => __awaiter(void 0,
     if (!compositePath) {
         return res.status(404).json({ error: 'composite_not_found' });
     }
-    res.setHeader('Content-Type', 'video/mp4');
-    res.setHeader('Accept-Ranges', 'bytes');
-    fs.createReadStream(compositePath).pipe(res);
+    // sendFile, as source.mp4: it answers Range requests (206, 416) so a
+    // player can seek. A piped stream sent `Accept-Ranges: bytes` and then the
+    // whole file, with 200, whatever was asked. DOWNLOAD_OPTIONS lets the
+    // path under ~/.cache through on Express 5 (see sourceMp4Handler).
+    return res.sendFile(path.resolve(compositePath), Object.assign(Object.assign({}, apps_1.DOWNLOAD_OPTIONS), { headers: { 'Content-Type': 'video/mp4' } }), (err) => handleSendError('composite.mp4', req, res, err));
 }));
 /**
  * Videos-only zip (mp4 files). Prefer this over proof bundle for dashboard

package/lib/src/app/routers/reservation.js

@@ -14,6 +14,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const express_1 = __importDefault(require("express"));
 const device_service_1 = require("../../data-service/device-service");
+const device_store_1 = require("../../data-service/device-store");
+const actor_1 = require("../../services/device-access/actor");
 const logger_1 = __importDefault(require("../../logger"));
 const scopeGuard_1 = require("../../middleware/scopeGuard");
 const roleGuard_1 = require("../../middleware/roleGuard");
@@ -36,16 +38,40 @@ router.use((0, roleGuard_1.roleGuard)('MEMBER'));
 // GET listings remain open to any authenticated key.
 router.use((0, scopeGuard_1.mutationScopeGuard)(['devices']));
 /**
- * The device a reservation route acts on, or undefined when the caller may not
- * see it. Teams are a device boundary: another team's phone takes the same 404
- * as a udid that doesn't exist, so the answer never says that it exists.
+ * The device a reservation route acts on: the row of that udid on that host,
+ * or undefined when there is none or the caller may not see it. Teams are a
+ * device boundary: another team's phone takes the same 404 as a udid that
+ * doesn't exist, so the answer never says that it exists. Through 2.12 the
+ * host was ignored when looking the phone up, then written to: a host with no
+ * such phone answered 200, and the reservation went nowhere.
  */
-function findVisibleDevice(req, udid) {
+function findVisibleDevice(req, udid, host) {
     return __awaiter(this, void 0, void 0, function* () {
-        const device = yield (0, device_service_1.getDevice)({ udid: [udid] });
+        if (typeof udid !== 'string' || typeof host !== 'string')
+            return undefined;
+        const device = yield device_store_1.DeviceStoreFactory.getStore().findDevice({ udid, host });
         return device && (0, deviceVisibility_1.isDeviceVisible)(device.teamId, teamIdsOf(req)) ? device : undefined;
     });
 }
+/**
+ * Whether the caller is the user who took a device's reservation. One from
+ * before 2.13 names no user, so anyone is.
+ */
+function holdsReservation(req, device) {
+    return !device.reservedByUserId || (0, actor_1.resolveActor)(req).userId === device.reservedByUserId;
+}
+/**
+ * Whether the caller may release or extend a device's reservation: the user
+ * who took it, or an admin. Through 2.12 anyone who could see the phone could.
+ */
+function mayChangeReservation(req, device) {
+    return (0, actor_1.resolveActor)(req).isAdmin || holdsReservation(req, device);
+}
+const NOT_HOLDER = {
+    success: false,
+    error: 'not_reservation_holder',
+    message: 'Only the person who reserved this device, or an admin, can change the reservation.',
+};
 /** The caller's teams; undefined for an admin or an auth-disabled server. */
 function teamIdsOf(req) {
     var _a;
@@ -58,6 +84,8 @@ const DURATION_OPTIONS = {
     '4h': 4 * 60 * 60 * 1000,
     '8h': 8 * 60 * 60 * 1000,
 };
+const MIN_DURATION_MS = 60 * 1000; // 1 minute
+const MAX_DURATION_MS = 24 * 60 * 60 * 1000; // 24 hours
 /**
  * GET /api/reservation
  * List all currently reserved devices
@@ -114,8 +142,6 @@ router.post('/', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
             });
         }
         // Bounds check: refuse negative, zero, NaN, Infinity, and anything over 24h.
-        const MIN_DURATION_MS = 60 * 1000; // 1 minute
-        const MAX_DURATION_MS = 24 * 60 * 60 * 1000; // 24 hours
         if (!Number.isFinite(durationMs) ||
             durationMs < MIN_DURATION_MS ||
             durationMs > MAX_DURATION_MS) {
@@ -125,12 +151,15 @@ router.post('/', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
             });
         }
         // Check if device exists
-        const device = yield findVisibleDevice(req, udid);
+        const device = yield findVisibleDevice(req, udid, host);
         if (!device) {
             return res.status(404).json({ success: false, error: 'Device not found' });
         }
         // Check if device is already reserved by someone else
-        if ((0, device_service_1.isDeviceReserved)(device) && device.reservedBy !== reservedBy) {
+        // Renewing your own: the same user (with auth disabled every caller is
+        // one), under the same name.
+        if ((0, device_service_1.isDeviceReserved)(device) &&
+            !(holdsReservation(req, device) && device.reservedBy === reservedBy)) {
             return res.status(409).json({
                 success: false,
                 error: `Device is already reserved by ${device.reservedBy} until ${new Date(device.reservedUntil).toISOString()}`,
@@ -143,7 +172,7 @@ router.post('/', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
                 error: 'Device is currently busy with an Appium session. Cannot reserve.',
             });
         }
-        yield (0, device_service_1.reserveDevice)(udid, host, reservedBy, durationMs, reason);
+        yield (0, device_service_1.reserveDevice)(udid, host, reservedBy, durationMs, reason, (0, actor_1.resolveActor)(req).userId);
         const reservedUntil = Date.now() + durationMs;
         res.json({
             success: true,
@@ -171,13 +200,15 @@ router.delete('/:udid/:host', (req, res) => __awaiter(void 0, void 0, void 0, fu
     try {
         const { udid } = req.params;
         const host = decodeURIComponent(req.params.host);
-        const device = yield findVisibleDevice(req, udid);
+        const device = yield findVisibleDevice(req, udid, host);
         if (!device) {
             return res.status(404).json({ success: false, error: 'Device not found' });
         }
         if (!(0, device_service_1.isDeviceReserved)(device)) {
             return res.status(400).json({ success: false, error: 'Device is not reserved' });
         }
+        if (!mayChangeReservation(req, device))
+            return res.status(403).json(NOT_HOLDER);
         yield (0, device_service_1.releaseReservation)(udid, host);
         res.json({
             success: true,
@@ -199,13 +230,15 @@ router.post('/:udid/:host/extend', (req, res) => __awaiter(void 0, void 0, void
         const { udid } = req.params;
         const host = decodeURIComponent(req.params.host);
         const { duration } = req.body;
-        const device = yield findVisibleDevice(req, udid);
+        const device = yield findVisibleDevice(req, udid, host);
         if (!device) {
             return res.status(404).json({ success: false, error: 'Device not found' });
         }
         if (!(0, device_service_1.isDeviceReserved)(device)) {
             return res.status(400).json({ success: false, error: 'Device is not reserved' });
         }
+        if (!mayChangeReservation(req, device))
+            return res.status(403).json(NOT_HOLDER);
         // Parse duration
         let extensionMs;
         if (typeof duration === 'string' && DURATION_OPTIONS[duration]) {
@@ -220,9 +253,24 @@ router.post('/:udid/:host/extend', (req, res) => __awaiter(void 0, void 0, void
                 error: `Invalid duration. Use: ${Object.keys(DURATION_OPTIONS).join(', ')} or a number in milliseconds`,
             });
         }
-        // Extend from current expiry time
-        const newExpiry = (device.reservedUntil || Date.now()) + extensionMs;
-        yield (0, device_service_1.reserveDevice)(udid, host, device.reservedBy, newExpiry - Date.now(), device.reservationReason);
+        // Extend from current expiry time, to at most 24 hours from now, as a new
+        // reservation may last. Through 2.12 any number was accepted, a negative
+        // one included, so one call could hold a phone for years.
+        const now = Date.now();
+        const newExpiry = (device.reservedUntil || now) + extensionMs;
+        if (!Number.isFinite(extensionMs) || extensionMs < MIN_DURATION_MS) {
+            return res.status(400).json({
+                success: false,
+                error: `duration must be at least ${MIN_DURATION_MS}ms (1 minute)`,
+            });
+        }
+        if (newExpiry - now > MAX_DURATION_MS) {
+            return res.status(400).json({
+                success: false,
+                error: 'A reservation can end at most 24 hours from now',
+            });
+        }
+        yield (0, device_service_1.reserveDevice)(udid, host, device.reservedBy, newExpiry - now, device.reservationReason, device.reservedByUserId);
         res.json({
             success: true,
             message: `Reservation extended for device ${udid}`,

package/lib/src/app/routers/users.js

@@ -19,6 +19,7 @@ const typedi_1 = require("typedi");
 const crypto_1 = __importDefault(require("crypto"));
 const UserService_1 = require("../../services/UserService");
 const roleGuard_1 = require("../../middleware/roleGuard");
+const scopeGuard_1 = require("../../middleware/scopeGuard");
 const userAuthorization_1 = require("../../services/identity/userAuthorization");
 const prisma_1 = require("../../prisma");
 const PasswordResetService_1 = require("../../services/PasswordResetService");
@@ -36,6 +37,9 @@ function makeTempPassword() {
 function usersRouter() {
     const r = (0, express_1.Router)();
     r.use((0, roleGuard_1.roleGuard)('ADMIN'));
+    // And the admin scope, as /apikeys and /teams ask: an admin's `read`-only
+    // key or token is not a grant to manage accounts. Through 2.12 it was.
+    r.use((0, scopeGuard_1.scopeGuard)(['admin']));
     const userSvc = typedi_1.Container.get(UserService_1.UserService);
     function getAuth(req) {
         return req.auth;

package/lib/src/app/routers/webhook.js

@@ -54,31 +54,40 @@ function deleteConfig(req, res) {
             res.json({ success: true });
         }
         catch (err) {
+            // Prisma's "record to delete does not exist".
+            if ((err === null || err === void 0 ? void 0 : err.code) === 'P2025') {
+                return res.status(404).json({ error: 'not_found', message: 'Webhook not found' });
+            }
             logger_1.default.error(`Failed to delete webhook config: ${err}`);
             res.status(500).json({ error: 'Failed to delete configuration' });
         }
     });
 }
+// Sends a sample event the way the webhook's real events go out (its type
+// and template), and says whether it was delivered.
 function testWebhook(req, res) {
     return __awaiter(this, void 0, void 0, function* () {
-        const { url, type } = req.body;
+        var _a, _b;
+        const { url, type, payloadTemplate } = (_a = req.body) !== null && _a !== void 0 ? _a : {};
+        if (!url || typeof url !== 'string') {
+            return res.status(400).json({ error: 'url is required' });
+        }
         try {
-            yield typedi_1.Container.get(NotificationService_1.NotificationService).sendSlackMessage(url, 'device_new', {
-                udid: 'test-device-udid',
-                name: 'Test Device',
-                host: '127.0.0.1',
-            });
+            yield typedi_1.Container.get(NotificationService_1.NotificationService).sendTest(url, type || 'slack', payloadTemplate);
             res.json({ success: true });
         }
         catch (err) {
-            res.status(500).json({ error: `Test failed: ${err}` });
+            res.status(502).json({ error: 'delivery_failed', message: (_b = err === null || err === void 0 ? void 0 : err.message) !== null && _b !== void 0 ? _b : String(err) });
         }
     });
 }
 function register(parentRouter) {
     const webhookRouterInstance = (0, express_1.Router)();
     webhookRouterInstance.use((0, roleGuard_1.roleGuard)('ADMIN'));
-    webhookRouterInstance.get('/', getConfigs);
+    // The list holds every webhook's URL, which is often its secret (Slack's
+    // are), so reading it needs the admin scope too. Through 2.12 an admin's
+    // `read`-only key could list them.
+    webhookRouterInstance.get('/', (0, scopeGuard_1.scopeGuard)(['admin']), getConfigs);
     // Webhook mutations are admin-only: adding / removing / test-firing global
     // webhooks is a fleet-wide config change.
     webhookRouterInstance.post('/', (0, scopeGuard_1.scopeGuard)(['admin']), addConfig);