@xenon-device-management/xenon 2.12.0 → 2.13.0

package/lib/test/unit/access-scopes.spec.js

@@ -0,0 +1,227 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const express_1 = __importDefault(require("express"));
+const sinon_1 = __importDefault(require("sinon"));
+const typedi_1 = require("typedi");
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const webhook_1 = __importDefault(require("../../src/app/routers/webhook"));
+const recordings_1 = __importDefault(require("../../src/app/routers/recordings"));
+const NotificationService_1 = require("../../src/services/NotificationService");
+const dashboard_1 = __importDefault(require("../../src/app/routers/dashboard"));
+const config_1 = __importDefault(require("../../src/app/routers/config"));
+const web_config_service_1 = require("../../src/data-service/web-config-service");
+const AIService_1 = require("../../src/services/AIService");
+const grid_1 = __importDefault(require("../../src/app/routers/grid"));
+const SessionManager_1 = require("../../src/sessions/SessionManager");
+const prisma_1 = require("../../src/prisma");
+const csrfMiddleware_1 = require("../../src/middleware/csrfMiddleware");
+const config_2 = require("../../src/config");
+function appAs(caller, mount) {
+    const app = (0, express_1.default)();
+    app.use(express_1.default.json());
+    app.use((req, _res, next) => {
+        req.auth = Object.assign({ kind: 'api-key', userId: 'usr_x', rateLimit: 1000 }, caller);
+        next();
+    });
+    const router = express_1.default.Router();
+    mount(router);
+    app.use(router);
+    return app;
+}
+describe('access scopes', () => {
+    afterEach(() => sinon_1.default.restore());
+    describe('GET /webhook', () => {
+        const app = (scopes) => appAs({ role: 'ADMIN', scopes }, (r) => webhook_1.default.register(r));
+        it("refuses an admin's key without the admin scope", () => __awaiter(void 0, void 0, void 0, function* () {
+            const list = sinon_1.default.stub(typedi_1.Container.get(NotificationService_1.NotificationService), 'getConfigs').resolves([]);
+            const r = yield (0, loopbackRequest_1.default)(app('read')).get('/webhook').timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(403);
+            (0, chai_1.expect)(list.called).to.equal(false);
+        }));
+        it('answers an admin with the admin scope', () => __awaiter(void 0, void 0, void 0, function* () {
+            sinon_1.default.stub(typedi_1.Container.get(NotificationService_1.NotificationService), 'getConfigs').resolves([]);
+            const r = yield (0, loopbackRequest_1.default)(app('admin')).get('/webhook').timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(200);
+        }));
+    });
+    describe('recording writes', () => {
+        const app = (scopes) => appAs({ role: 'MEMBER', scopes }, (r) => recordings_1.default.register(r));
+        for (const path of [
+            '/recordings',
+            '/recordings/g1/add-device',
+            '/recordings/g1/stop',
+            '/recordings/g1/bookmark',
+            '/recordings/g1/annotation',
+            '/recordings/g1/annotations/clear',
+        ]) {
+            it(`refuses POST ${path} without the devices scope`, () => __awaiter(void 0, void 0, void 0, function* () {
+                const r = yield (0, loopbackRequest_1.default)(app('sessions,read')).post(path).send({}).timeout(5000);
+                (0, chai_1.expect)(r.status).to.equal(403);
+                (0, chai_1.expect)(r.body).to.deep.equal({ error: 'insufficient scope' });
+            }));
+        }
+        it('lets the same key read recordings', () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = yield (0, loopbackRequest_1.default)(app('sessions,read')).get('/recordings?limit=x').timeout(5000);
+            (0, chai_1.expect)(r.status).to.not.equal(403);
+        }));
+        it('leaves routes mounted after the recordings router alone', () => __awaiter(void 0, void 0, void 0, function* () {
+            const a = appAs({ role: 'MEMBER', scopes: 'read' }, (r) => {
+                recordings_1.default.register(r);
+                r.post('/elsewhere', (_req, res) => res.json({ ok: true }));
+            });
+            const r = yield (0, loopbackRequest_1.default)(a).post('/elsewhere').send({}).timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(200);
+        }));
+    });
+    describe('/config', () => {
+        const ALL = 'admin,devices,sessions,read';
+        const app = (role, scopes = ALL) => appAs({ role, scopes }, (r) => {
+            dashboard_1.default.register(r);
+            config_1.default.register(r);
+        });
+        const SETTINGS_REFUSED = {
+            error: "Only a super admin can change the lab's settings.",
+            message: "Only a super admin can change the lab's settings.",
+        };
+        beforeEach(() => {
+            sinon_1.default.stub(typedi_1.Container.get(web_config_service_1.WebConfigService), 'getConfig').resolves({});
+        });
+        it('refuses a member the settings', () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(app('MEMBER')).get('/config').timeout(5000)).status).to.equal(403);
+        }));
+        it('shows an admin the settings', () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(app('ADMIN')).get('/config').timeout(5000)).status).to.equal(200);
+        }));
+        for (const path of ['/config', '/config/reset-metrics']) {
+            it(`refuses an admin POST ${path}, saying why`, () => __awaiter(void 0, void 0, void 0, function* () {
+                const set = sinon_1.default.stub(typedi_1.Container.get(web_config_service_1.WebConfigService), 'setConfig').resolves();
+                const r = yield (0, loopbackRequest_1.default)(app('ADMIN'))
+                    .post(path)
+                    .send({ buildCleanupDays: 7 })
+                    .timeout(5000);
+                (0, chai_1.expect)(r.status).to.equal(403);
+                (0, chai_1.expect)(r.body).to.deep.equal(SETTINGS_REFUSED);
+                (0, chai_1.expect)(set.called).to.equal(false);
+            }));
+            it(`refuses a super admin's key without the admin scope POST ${path}`, () => __awaiter(void 0, void 0, void 0, function* () {
+                const r = yield (0, loopbackRequest_1.default)(app('SUPER_ADMIN', 'read')).post(path).send({}).timeout(5000);
+                (0, chai_1.expect)(r.status).to.equal(403);
+            }));
+        }
+        it('lets a super admin change the settings', () => __awaiter(void 0, void 0, void 0, function* () {
+            const set = sinon_1.default.stub(typedi_1.Container.get(web_config_service_1.WebConfigService), 'setConfig').resolves();
+            const r = yield (0, loopbackRequest_1.default)(app('SUPER_ADMIN'))
+                .post('/config')
+                .send({ buildCleanupDays: 7 })
+                .timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(200);
+            (0, chai_1.expect)(set.calledOnce).to.equal(true);
+        }));
+        it('refuses an admin an AI provider test, saying why', () => __awaiter(void 0, void 0, void 0, function* () {
+            const test = sinon_1.default.stub(AIService_1.AI_SERVICE, 'testConnection').resolves({ success: true });
+            const r = yield (0, loopbackRequest_1.default)(app('ADMIN')).post('/config/test-ai').send({}).timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(403);
+            (0, chai_1.expect)(r.body.message).to.equal('Only a super admin can test an AI provider.');
+            (0, chai_1.expect)(test.called).to.equal(false);
+        }));
+    });
+    describe('GET /sessions/active', () => {
+        const session = (id, udid, type) => ({
+            getId: () => id,
+            getType: () => type,
+            getDevice: () => ({ udid, name: udid, platform: 'android' }),
+        });
+        function app(teamIds) {
+            const a = (0, express_1.default)();
+            a.use((req, _res, next) => {
+                req.auth = {
+                    kind: 'user-session',
+                    userId: 'usr_x',
+                    role: teamIds ? 'MEMBER' : 'ADMIN',
+                    scopes: 'devices,sessions,read',
+                    rateLimit: 1000,
+                    teamIds,
+                };
+                next();
+            });
+            const router = express_1.default.Router();
+            grid_1.default.register(router, { bindHostOrIp: '127.0.0.1' });
+            a.use(router);
+            return a;
+        }
+        beforeEach(() => {
+            sinon_1.default
+                .stub(typedi_1.Container.get(SessionManager_1.SessionManager), 'getAllSessions')
+                .returns([
+                session('s-shared', 'SHARED', 'LOCAL'),
+                session('s-b1', 'PHONE-B', 'LOCAL'),
+                session('s-b2', 'PHONE-B2', 'REMOTE'),
+            ]);
+            sinon_1.default.stub(prisma_1.prisma.device, 'findMany').resolves([
+                { udid: 'SHARED', teamId: null },
+                { udid: 'PHONE-B', teamId: 'team-b' },
+                { udid: 'PHONE-B2', teamId: 'team-b' },
+            ]);
+        });
+        it("counts only the sessions a member can see, not other teams'", () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = yield (0, loopbackRequest_1.default)(app(['team-a']))
+                .get('/sessions/active')
+                .timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(200);
+            (0, chai_1.expect)(r.body.sessions.map((s) => s.id)).to.deep.equal(['s-shared']);
+            (0, chai_1.expect)(r.body.stats).to.deep.equal({ total: 1, byType: { local: 1, remote: 0, cloud: 0 } });
+        }));
+        it('counts every session for an admin', () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = yield (0, loopbackRequest_1.default)(app(undefined)).get('/sessions/active').timeout(5000);
+            (0, chai_1.expect)(r.body.stats).to.deep.equal({ total: 3, byType: { local: 2, remote: 1, cloud: 0 } });
+        }));
+    });
+    describe('the same-origin check', () => {
+        let saved;
+        beforeEach(() => {
+            saved = config_2.config.authDisabled;
+            config_2.config.authDisabled = false;
+        });
+        afterEach(() => {
+            config_2.config.authDisabled = saved;
+        });
+        function app() {
+            const a = (0, express_1.default)();
+            a.use(csrfMiddleware_1.csrfMiddleware);
+            a.post('/x', (_req, res) => res.json({ ok: true }));
+            return a;
+        }
+        it('lets a bearer request through without Origin or Referer', () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = yield (0, loopbackRequest_1.default)(app())
+                .post('/x')
+                .set('Authorization', 'Bearer eyJhbGciOiJSUzI1NiJ9.e30.sig')
+                .timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(200);
+        }));
+        it('still refuses a cookie request without Origin or Referer', () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = yield (0, loopbackRequest_1.default)(app())
+                .post('/x')
+                .set('Cookie', 'xenon_dashboard_session=abc')
+                .timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(403);
+        }));
+        it('does not take another Authorization scheme for a bearer token', () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = yield (0, loopbackRequest_1.default)(app()).post('/x').set('Authorization', 'Basic dTpw').timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(403);
+        }));
+    });
+});

package/lib/test/unit/api-error-handling.spec.js

@@ -0,0 +1,179 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const express_1 = __importDefault(require("express"));
+const sinon_1 = __importDefault(require("sinon"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const apiErrors_1 = require("../../src/app/apiErrors");
+const index_1 = require("../../src/app/index");
+const config_1 = require("../../src/config");
+const scratch_database_1 = require("../helpers/scratch-database");
+/**
+ * Express 4 ignores the promise an async handler returns. A handler that
+ * threw after an `await` left the request without an answer until the
+ * client gave up, and logged an unhandled rejection: deleting an unknown API
+ * key, creating a user whose email exists, a selector lookup with a `%`,
+ * another node's status. A synchronous throw got Express's own HTML page,
+ * with a stack trace. Every error under /xenon/api now gets a JSON answer.
+ */
+const prismaError = (code, meta = {}) => Object.assign(new Error(`prisma ${code}`), { code, meta, clientVersion: '5.4.0' });
+function appWith(route, method = 'get') {
+    (0, apiErrors_1.forwardAsyncErrors)();
+    const app = (0, express_1.default)();
+    app.use(express_1.default.json());
+    app[method]('/x', route);
+    app.use(apiErrors_1.apiErrorHandler);
+    return app;
+}
+describe('API errors', () => {
+    describe('the error handling', () => {
+        beforeEach(() => {
+            sinon_1.default.stub(console, 'error');
+        });
+        afterEach(() => sinon_1.default.restore());
+        it('answers an async handler that throws, with JSON', () => __awaiter(void 0, void 0, void 0, function* () {
+            const app = appWith(() => __awaiter(void 0, void 0, void 0, function* () {
+                yield Promise.resolve();
+                throw new Error('boom: secret detail');
+            }));
+            const r = yield (0, loopbackRequest_1.default)(app).get('/x').timeout(3000);
+            (0, chai_1.expect)(r.status).to.equal(500);
+            (0, chai_1.expect)(r.body).to.deep.equal({ error: 'internal', message: 'Internal server error' });
+            (0, chai_1.expect)(r.text).not.to.include('secret detail');
+        }));
+        it('answers a synchronous throw with JSON, not an HTML stack trace', () => __awaiter(void 0, void 0, void 0, function* () {
+            const app = appWith(() => {
+                throw new Error('sync boom');
+            });
+            const r = yield (0, loopbackRequest_1.default)(app).get('/x').timeout(3000);
+            (0, chai_1.expect)(r.status).to.equal(500);
+            (0, chai_1.expect)(r.type).to.equal('application/json');
+            (0, chai_1.expect)(r.text).not.to.include('at ');
+        }));
+        it('answers a record that does not exist with 404', () => __awaiter(void 0, void 0, void 0, function* () {
+            const app = appWith(() => __awaiter(void 0, void 0, void 0, function* () {
+                throw prismaError('P2025', { cause: 'Record to update not found.' });
+            }));
+            const r = yield (0, loopbackRequest_1.default)(app).get('/x').timeout(3000);
+            (0, chai_1.expect)(r.status).to.equal(404);
+            (0, chai_1.expect)(r.body).to.deep.equal({ error: 'not_found', message: 'Not found' });
+        }));
+        it('answers a duplicate with 409, naming the field', () => __awaiter(void 0, void 0, void 0, function* () {
+            const app = appWith(() => __awaiter(void 0, void 0, void 0, function* () {
+                throw prismaError('P2002', { target: ['email'] });
+            }));
+            const r = yield (0, loopbackRequest_1.default)(app).get('/x').timeout(3000);
+            (0, chai_1.expect)(r.status).to.equal(409);
+            (0, chai_1.expect)(r.body).to.deep.equal({ error: 'conflict', message: 'email is already in use' });
+        }));
+        it('answers a malformed % escape with 400', () => __awaiter(void 0, void 0, void 0, function* () {
+            const app = appWith(() => __awaiter(void 0, void 0, void 0, function* () {
+                decodeURIComponent('%E0%A4%A');
+            }));
+            const r = yield (0, loopbackRequest_1.default)(app).get('/x').timeout(3000);
+            (0, chai_1.expect)(r.status).to.equal(400);
+            (0, chai_1.expect)(r.body.error).to.equal('bad_request');
+        }));
+        it('answers a body that is not JSON with 400', () => __awaiter(void 0, void 0, void 0, function* () {
+            const app = appWith((_req, res) => res.json({ ok: true }), 'post');
+            const r = yield (0, loopbackRequest_1.default)(app)
+                .post('/x')
+                .set('Content-Type', 'application/json')
+                .send('{"broken":')
+                .timeout(3000);
+            (0, chai_1.expect)(r.status).to.equal(400);
+            (0, chai_1.expect)(r.body).to.deep.equal({
+                error: 'bad_request',
+                message: 'The request body is not valid JSON',
+            });
+        }));
+        it('keeps a status an error carries (http-errors style)', () => __awaiter(void 0, void 0, void 0, function* () {
+            const app = appWith(() => __awaiter(void 0, void 0, void 0, function* () {
+                throw Object.assign(new Error('Payload too large'), { status: 413, expose: true });
+            }));
+            const r = yield (0, loopbackRequest_1.default)(app).get('/x').timeout(3000);
+            (0, chai_1.expect)(r.status).to.equal(413);
+            (0, chai_1.expect)(r.body).to.deep.equal({ error: 'Payload too large' });
+        }));
+        it('ends a response that had already started instead of leaving it open', () => __awaiter(void 0, void 0, void 0, function* () {
+            const app = appWith((_req, res) => __awaiter(void 0, void 0, void 0, function* () {
+                res.status(200).write('partial');
+                yield Promise.resolve();
+                throw new Error('after headers');
+            }));
+            const r = yield (0, loopbackRequest_1.default)(app).get('/x').timeout(3000).buffer(true);
+            (0, chai_1.expect)(r.status).to.equal(200);
+        }));
+        it('leaves a handler that answered normally alone', () => __awaiter(void 0, void 0, void 0, function* () {
+            const app = appWith((_req, res) => __awaiter(void 0, void 0, void 0, function* () {
+                yield Promise.resolve();
+                res.json({ fine: true });
+            }));
+            const r = yield (0, loopbackRequest_1.default)(app).get('/x').timeout(3000);
+            (0, chai_1.expect)(r.status).to.equal(200);
+            (0, chai_1.expect)(r.body).to.deep.equal({ fine: true });
+        }));
+    });
+    describe('the routes that hung', () => {
+        (0, scratch_database_1.useScratchDatabase)();
+        let app;
+        let savedAuthDisabled;
+        before(() => {
+            app = (0, express_1.default)();
+            app.use('/xenon', (0, index_1.createRouter)({ bindHostOrIp: '127.0.0.1', enableDashboard: true }));
+        });
+        beforeEach(() => {
+            savedAuthDisabled = config_1.config.authDisabled;
+            // Every caller is a synthetic SUPER_ADMIN, and no same-origin check.
+            config_1.config.authDisabled = true;
+            sinon_1.default.stub(console, 'error');
+        });
+        afterEach(() => {
+            config_1.config.authDisabled = savedAuthDisabled;
+            sinon_1.default.restore();
+        });
+        it('DELETE /api/apikeys/:id with an unknown id answers 404', () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = yield (0, loopbackRequest_1.default)(app).delete('/xenon/api/apikeys/no-such-key').timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(404);
+            (0, chai_1.expect)(r.body.error).to.equal('not_found');
+        }));
+        it('POST /api/users with an email already in use answers 409', () => __awaiter(void 0, void 0, void 0, function* () {
+            const body = {
+                email: 'dup@example.com',
+                name: 'Dup',
+                role: 'MEMBER',
+                password: 'longenough',
+            };
+            const first = yield (0, loopbackRequest_1.default)(app).post('/xenon/api/users').send(body).timeout(5000);
+            (0, chai_1.expect)(first.status).to.equal(201);
+            const again = yield (0, loopbackRequest_1.default)(app).post('/xenon/api/users').send(body).timeout(5000);
+            (0, chai_1.expect)(again.status).to.equal(409);
+            (0, chai_1.expect)(again.body).to.deep.equal({ error: 'conflict', message: 'email is already in use' });
+        }));
+        it('GET /api/healing/state/:strategy/:value reads a selector with a % once-encoded', () => __awaiter(void 0, void 0, void 0, function* () {
+            const value = "//*[@text='50% off']";
+            const r = yield (0, loopbackRequest_1.default)(app)
+                .get(`/xenon/api/healing/state/xpath/${encodeURIComponent(value)}`)
+                .timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(200);
+            (0, chai_1.expect)(r.body).to.deep.equal({ state: null });
+        }));
+        it('GET /api/node/:host/status for another host with no devices answers 404', () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = yield (0, loopbackRequest_1.default)(app).get('/xenon/api/node/10.9.9.9:4723/status').timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(404);
+        }));
+    });
+});

package/lib/test/unit/bug-report/route.spec.js

@@ -81,6 +81,35 @@ describe('bug-report route', () => {
         const res = yield (0, loopbackRequest_1.default)(makeApp({ admin: true })).post('/sessions/sess-b/bug-report?mode=full');
         (0, chai_1.expect)(res.status).to.equal(200);
     }));
+    for (const [role, included] of [
+        ['MEMBER', false],
+        ['ADMIN', true],
+        ['SUPER_ADMIN', true],
+    ]) {
+        it(`${included ? 'adds' : 'leaves out'} the network capture for a ${role}`, () => __awaiter(void 0, void 0, void 0, function* () {
+            const assemble = sinon_1.default.stub(BugReportService_1.BugReportService.prototype, 'assemble').resolves({
+                filename: 'bugreport-sess-1.zip',
+                manifest: { warnings: [] },
+                entries: [{ name: 'a.txt', source: { kind: 'buffer', data: Buffer.from('hi') } }],
+                cleanup: () => __awaiter(void 0, void 0, void 0, function* () { }),
+            });
+            const app = (0, express_1.default)();
+            app.use((req, _res, next) => {
+                req.auth = {
+                    kind: 'user-session',
+                    userId: 'u1',
+                    role,
+                    scopes: 'sessions,read',
+                    teamIds: [],
+                };
+                next();
+            });
+            bug_report_1.default.register(app);
+            const res = yield (0, loopbackRequest_1.default)(app).post('/sessions/sess-1/bug-report?mode=full');
+            (0, chai_1.expect)(res.status).to.equal(200);
+            (0, chai_1.expect)(assemble.firstCall.args[0].includeNetwork).to.equal(included);
+        }));
+    }
     it('401 when the caller is not signed in', () => __awaiter(void 0, void 0, void 0, function* () {
         const res = yield (0, loopbackRequest_1.default)(makeApp({ signedIn: false })).post('/sessions/sess-1/bug-report?mode=full');
         (0, chai_1.expect)(res.status).to.equal(401);

package/lib/test/unit/bug-report/service.spec.js

@@ -18,6 +18,7 @@ const sinon_1 = __importDefault(require("sinon"));
 const typedi_1 = require("typedi");
 const BugReportService_1 = require("../../../src/services/bug-report/BugReportService");
 const prisma_1 = require("../../../src/prisma");
+const InterceptorService_1 = require("../../../src/services/InterceptorService");
 const FIXTURE_SESSION = {
     id: 'sess-1',
     status: 'failed',
@@ -60,4 +61,33 @@ describe('BugReportService', () => {
         (0, chai_1.expect)(bundle.entries.find((e) => e.name === 'ai-summary.txt')).to.exist;
         yield bundle.cleanup();
     }));
+    describe('the network capture', () => {
+        // A live capture: InterceptorService answers for the session.
+        const HAR = { log: { version: '1.2', entries: [] } };
+        beforeEach(() => {
+            sinon_1.default.stub(prisma_1.prisma.session, 'findUnique').resolves(FIXTURE_SESSION);
+            sinon_1.default.stub(prisma_1.prisma.sessionLog, 'findMany').resolves([]);
+            const interceptor = typedi_1.Container.get(InterceptorService_1.InterceptorService);
+            sinon_1.default.stub(interceptor, 'isActive').returns(true);
+            sinon_1.default.stub(interceptor, 'exportHar').returns(HAR);
+        });
+        it('is left out unless asked for, and the manifest says why', () => __awaiter(void 0, void 0, void 0, function* () {
+            const bundle = yield typedi_1.Container.get(BugReportService_1.BugReportService).assemble({
+                sessionId: 'sess-1',
+                mode: 'full',
+            });
+            (0, chai_1.expect)(bundle.entries.find((e) => e.name === 'network.har')).to.equal(undefined);
+            (0, chai_1.expect)(bundle.manifest.warnings).to.include('network capture left out: only admins can download it');
+            yield bundle.cleanup();
+        }));
+        it('is added when asked for', () => __awaiter(void 0, void 0, void 0, function* () {
+            const bundle = yield typedi_1.Container.get(BugReportService_1.BugReportService).assemble({
+                sessionId: 'sess-1',
+                mode: 'full',
+                includeNetwork: true,
+            });
+            (0, chai_1.expect)(bundle.entries.find((e) => e.name === 'network.har')).to.exist;
+            yield bundle.cleanup();
+        }));
+    });
 });

package/lib/test/unit/control-honest-answers.spec.js

@@ -0,0 +1,134 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const express_1 = __importDefault(require("express"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const index_1 = require("../../src/app/index");
+const config_1 = require("../../src/config");
+const scratch_database_1 = require("../helpers/scratch-database");
+const sinon_1 = __importDefault(require("sinon"));
+const device_store_1 = require("../../src/data-service/device-store");
+const own_node_id_1 = require("../helpers/own-node-id");
+const AndroidDeviceManager_1 = __importDefault(require("../../src/device-managers/AndroidDeviceManager"));
+/**
+ * Device control's answers say what happened: a missing field is a 400, not
+ * a 500 from deep inside the server.
+ */
+describe('device control answers', () => {
+    (0, scratch_database_1.useScratchDatabase)();
+    (0, own_node_id_1.useOwnNodeId)();
+    const UDID = 'R5CT32ABCDE';
+    let app;
+    let saved;
+    before(() => {
+        app = (0, express_1.default)();
+        app.use('/xenon', (0, index_1.createRouter)({ bindHostOrIp: '127.0.0.1', enableDashboard: true }));
+    });
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        saved = config_1.config.authDisabled;
+        config_1.config.authDisabled = true;
+        // The store, not a row: which store the process uses depends on the specs
+        // that ran before this one.
+        sinon_1.default.stub(device_store_1.DeviceStoreFactory, 'getStore').returns({
+            findDevice: (filter) => __awaiter(void 0, void 0, void 0, function* () {
+                return (filter === null || filter === void 0 ? void 0 : filter.udid) === UDID
+                    ? {
+                        udid: UDID,
+                        host: 'http://127.0.0.1:4723',
+                        nodeId: own_node_id_1.OWN_NODE_ID,
+                        platform: 'android',
+                        busy: false,
+                        session_id: null,
+                        teamId: null,
+                    }
+                    : undefined;
+            }),
+        });
+    }));
+    afterEach(() => {
+        config_1.config.authDisabled = saved;
+        sinon_1.default.restore();
+    });
+    // Most routes answered an unknown udid with the text "Device not found",
+    // which a JSON client couldn't parse; two answered a different JSON shape.
+    for (const [method, action] of [
+        ['get', 'screenshot'],
+        ['post', 'tap'],
+        ['get', 'display'],
+        ['get', 'appium-session'],
+        ['get', 'logs'],
+    ]) {
+        it(`${method.toUpperCase()} ${action} answers an unknown device with JSON`, () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = yield (0, loopbackRequest_1.default)(app)[method](`/xenon/api/control/NO-SUCH-PHONE/${action}`)
+                .send({ x: 1, y: 2 })
+                .timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(404);
+            (0, chai_1.expect)(r.type).to.equal('application/json');
+            (0, chai_1.expect)(r.body).to.deep.equal({ error: 'not_found', message: 'Device not found' });
+        }));
+    }
+    describe('POST /api/control/:udid/install-repository-app', () => {
+        for (const [what, body] of [
+            ['no body', {}],
+            ['an empty appId', { appId: '' }],
+            ['an appId that is not a string', { appId: 42 }],
+        ]) {
+            it(`answers 400 for ${what}`, () => __awaiter(void 0, void 0, void 0, function* () {
+                const r = yield (0, loopbackRequest_1.default)(app)
+                    .post(`/xenon/api/control/${UDID}/install-repository-app`)
+                    .send(body)
+                    .timeout(5000);
+                (0, chai_1.expect)(r.status).to.equal(400);
+                (0, chai_1.expect)(r.body).to.deep.equal({ error: 'bad_request', message: 'appId is required' });
+            }));
+        }
+        it('answers 404 for an app the library does not have', () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = yield (0, loopbackRequest_1.default)(app)
+                .post(`/xenon/api/control/${UDID}/install-repository-app`)
+                .send({ appId: '6f1d2c3b-0000-4000-8000-000000000000' })
+                .timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(404);
+        }));
+    });
+});
+/**
+ * Android's live logs answered 200 when adb failed, with the error inside
+ * `logs` as if it were a log line, and the session log stored it as one.
+ */
+describe('AndroidDeviceManager.getLogs', () => {
+    afterEach(() => sinon_1.default.restore());
+    it('fails when adb fails', () => __awaiter(void 0, void 0, void 0, function* () {
+        const manager = new AndroidDeviceManager_1.default({});
+        sinon_1.default.stub(manager, 'getAdb').resolves({
+            adbInstance: { adbExec: sinon_1.default.stub().rejects(new Error('device offline')) },
+        });
+        const err = yield manager.getLogs('R5CT32ABCDE').then(() => null, (e) => e);
+        (0, chai_1.expect)(err === null || err === void 0 ? void 0 : err.message).to.equal('device offline');
+    }));
+    it('fails when adb is not available', () => __awaiter(void 0, void 0, void 0, function* () {
+        const manager = new AndroidDeviceManager_1.default({});
+        sinon_1.default.stub(manager, 'getAdb').resolves({ adbInstance: undefined });
+        const err = yield manager.getLogs('R5CT32ABCDE').then(() => null, (e) => e);
+        (0, chai_1.expect)(err === null || err === void 0 ? void 0 : err.message).to.equal('ADB is not available');
+    }));
+    it('returns the lines when adb answers', () => __awaiter(void 0, void 0, void 0, function* () {
+        const manager = new AndroidDeviceManager_1.default({});
+        sinon_1.default.stub(manager, 'getAdb').resolves({
+            adbInstance: { adbExec: sinon_1.default.stub().resolves('10-04 09:00:00.000 1 1 I Tag: hello') },
+        });
+        (0, chai_1.expect)(yield manager.getLogs('R5CT32ABCDE')).to.include('hello');
+    }));
+});