@xenon-device-management/xenon 2.13.0 → 2.13.2

package/lib/src/device-managers/ios/WDAClient.js

@@ -36,6 +36,11 @@ const os_1 = __importDefault(require("os"));
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const execFilePromise = (0, util_1.promisify)(child_process_1.execFile);
 const execPromise = (0, util_1.promisify)(child_process_1.exec);
+/** WDA's answer for a session that no longer exists: 404 "invalid session id". */
+function isInvalidSession(err) {
+    var _a, _b, _c;
+    return ((_c = (_b = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.data) === null || _b === void 0 ? void 0 : _b.value) === null || _c === void 0 ? void 0 : _c.error) === 'invalid session id';
+}
 /** A key name the iPhone has no equivalent for. Device control answers 400. */
 class UnsupportedKeyError extends Error {
     constructor(key) {
@@ -79,7 +84,7 @@ let WDAClient = WDAClient_1 = class WDAClient {
     }
     performWDACommand(udid_1, method_1, endpoint_1, data_1) {
         return __awaiter(this, arguments, void 0, function* (udid, method, endpoint, data, retryCount = 0, options) {
-            var _a, _b, _c;
+            var _a, _b, _c, _d;
             const device = yield device_store_1.DeviceStoreFactory.getStore().findDevice({ udid });
             if (!device)
                 throw new Error(`Device ${udid} not found`);
@@ -91,12 +96,12 @@ let WDAClient = WDAClient_1 = class WDAClient {
                 throw new Error(`WDA port not available for ${udid}`);
             const cacheKey = `${udid}:${port}`;
             let cached = this.wdaConnectionCache.get(cacheKey);
-            if (!(cached === null || cached === void 0 ? void 0 : cached.sessionId)) {
-                const sid = typedi_1.Container.get(IOSStreamService_1.default).getWDASessionId(udid);
-                if (sid) {
-                    cached = { host: '127.0.0.1', pathPrefix: `/session/${sid}`, sessionId: sid };
-                    this.wdaConnectionCache.set(cacheKey, cached);
-                }
+            // The preview's session wins: each preview creates its own, so after a
+            // restart on the same port the cached one is dead.
+            const previewSid = typedi_1.Container.get(IOSStreamService_1.default).getWDASessionId(udid);
+            if (previewSid && previewSid !== (cached === null || cached === void 0 ? void 0 : cached.sessionId)) {
+                cached = { host: '127.0.0.1', pathPrefix: `/session/${previewSid}`, sessionId: previewSid };
+                this.wdaConnectionCache.set(cacheKey, cached);
             }
             const prefixes = (cached === null || cached === void 0 ? void 0 : cached.sessionId) ? [`/session/${cached.sessionId}`] : ['', '/session/any'];
             let lastError;
@@ -106,8 +111,10 @@ let WDAClient = WDAClient_1 = class WDAClient {
             const targetHost = '127.0.0.1';
             for (const prefix of prefixes) {
                 try {
+                    // WDA serves /wda/homescreen only without a session; inside one it
+                    // answers 404 "unknown command".
                     const isSessionless = !(options === null || options === void 0 ? void 0 : options.useSessionPath) &&
-                        (['/status', '/health', '/wda/healthcheck'].includes(endpoint));
+                        ['/status', '/health', '/wda/healthcheck', '/wda/homescreen'].includes(endpoint);
                     const url = `http://${targetHost}:${port}${isSessionless ? '' : prefix}${endpoint}`;
                     // Principal Stability: Screenshots, activation, and script execution need longer timeouts.
                     // Heartbeats and Status checks should be snappy to fail-over quickly.
@@ -147,17 +154,33 @@ let WDAClient = WDAClient_1 = class WDAClient {
                         if (retryCount < 2) {
                             // Phase 1: Dead Session Recovery (404)
                             if (status === 404 && prefix.includes('/session/')) {
+                                const deadSession = isInvalidSession(err);
                                 // Special Intelligence: Some WDA versions don't support /execute, /wda/homescreen, etc.
                                 // We should NOT clear the session if these specific commands fail with 404,
-                                // as they might just be unsupported features.
+                                // as they might just be unsupported features. A dead session is
+                                // not one of those: it was, for every button after a preview restart.
                                 const NON_FATAL_ENDPOINTS = ['execute', 'homescreen', 'pressButton'];
-                                if (NON_FATAL_ENDPOINTS.some((e) => endpoint.includes(e))) {
+                                if (!deadSession && NON_FATAL_ENDPOINTS.some((e) => endpoint.includes(e))) {
                                     this.log.debug(`[WDA] Command ${endpoint} failed with 404 (Unsupported or Logical Error). Skipping session reset.`);
                                     throw err;
                                 }
-                                this.log.warn(`[WDA] Session ${cached === null || cached === void 0 ? void 0 : cached.sessionId} appears dead. Resetting and retrying...`);
-                                this.wdaConnectionCache.delete(cacheKey);
-                                typedi_1.Container.get(IOSStreamService_1.default).setWDASessionId(udid, '');
+                                // WDA names its live session in every answer, a refusal included.
+                                const liveSid = (_d = err.response.data) === null || _d === void 0 ? void 0 : _d.sessionId;
+                                const stream = typedi_1.Container.get(IOSStreamService_1.default);
+                                if (deadSession && typeof liveSid === 'string' && liveSid !== (cached === null || cached === void 0 ? void 0 : cached.sessionId)) {
+                                    this.log.warn(`[WDA] Session ${cached === null || cached === void 0 ? void 0 : cached.sessionId} is gone; WebDriverAgent's is ${liveSid}. Retrying in it...`);
+                                    this.wdaConnectionCache.set(cacheKey, {
+                                        host: targetHost,
+                                        pathPrefix: `/session/${liveSid}`,
+                                        sessionId: liveSid,
+                                    });
+                                    stream.setWDASessionId(udid, liveSid);
+                                }
+                                else {
+                                    this.log.warn(`[WDA] Session ${cached === null || cached === void 0 ? void 0 : cached.sessionId} appears dead. Resetting and retrying...`);
+                                    this.wdaConnectionCache.delete(cacheKey);
+                                    stream.setWDASessionId(udid, '');
+                                }
                                 return this.performWDACommand(udid, method, endpoint, data, retryCount + 1, options);
                             }
                             // Phase 2: Transient State Recovery (500)
@@ -376,7 +399,9 @@ let WDAClient = WDAClient_1 = class WDAClient {
             }
             catch (e) {
                 this.log.debug(`[WDA] Generic pressButton failed for '${n}': ${e.message}`);
-                if (e === null || e === void 0 ? void 0 : e.response)
+                // A 404 is a missing session or route, never a missing button: WDA
+                // refuses a button it doesn't know with a 500.
+                if ((e === null || e === void 0 ? void 0 : e.response) && e.response.status !== 404)
                     throw new UnsupportedKeyError(String(key));
                 throw e;
             }
@@ -592,12 +617,99 @@ let WDAClient = WDAClient_1 = class WDAClient {
     // These three used to catch WDA's error and log it at debug level, so
     // device control answered 200 for a clipboard write, lock or unlock that
     // never happened. The error now reaches the route, which answers 500.
+    //
+    // On an iPhone, iOS ignores a pasteboard write from an app in the
+    // background and WDA still answers success, so the write is made with WDA's
+    // own app in front and read back before it counts.
     setClipboard(udid, content) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield this.sendWDACommand(udid, 'post', '/wda/setPasteboard', {
-                content: Buffer.from(content).toString('base64'),
+            const encoded = Buffer.from(content).toString('base64');
+            const write = () => this.sendWDACommand(udid, 'post', '/wda/setPasteboard', {
+                content: encoded,
                 contentType: 'plaintext',
             });
+            if (!(yield this.isRealDevice(udid))) {
+                yield write();
+                return;
+            }
+            yield this.withWDAInFront(udid, () => __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                yield write();
+                const res = yield this.sendWDACommand(udid, 'post', '/wda/getPasteboard', {
+                    contentType: 'plaintext',
+                });
+                const readBack = (_a = res.data) === null || _a === void 0 ? void 0 : _a.value;
+                if (readBack !== encoded && this.parsePasteboardResponse(res.data) !== content.trim()) {
+                    throw new Error('The iPhone didn’t take the clipboard text.');
+                }
+            }));
+        });
+    }
+    isRealDevice(udid) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const device = yield device_store_1.DeviceStoreFactory.getStore()
+                .findDevice({ udid })
+                .catch(() => undefined);
+            return !!(device === null || device === void 0 ? void 0 : device.realDevice);
+        });
+    }
+    activeBundleId(udid) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            const res = yield this.sendWDACommand(udid, 'get', '/wda/activeAppInfo');
+            return ((_b = (_a = res.data) === null || _a === void 0 ? void 0 : _a.value) === null || _b === void 0 ? void 0 : _b.bundleId) || ((_c = res.data) === null || _c === void 0 ? void 0 : _c.bundleId);
+        });
+    }
+    /**
+     * Runs `action` with WDA's own app in front, then puts back the app that
+     * was: the home screen, or the app by its bundle id.
+     *
+     * Bringing WDA's app forward waits for it to go idle, which it never does:
+     * about 21 s on an iPhone 14 Plus, against 0.1 s with the wait off. The wait
+     * is a WDA setting shared with any Appium session on the phone, so it is
+     * turned off only when its value could be read, and always put back.
+     */
+    withWDAInFront(udid, action) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const previous = yield this.activeBundleId(udid).catch(() => undefined);
+            const wdaBundleId = (yield typedi_1.Container.get(IOSStreamService_1.default).detectWDABundleId(udid)) ||
+                'com.qasecret.WebDriverAgentRunner.xctrunner';
+            const idleWait = yield this.sendWDACommand(udid, 'get', '/appium/settings')
+                .then((res) => { var _a, _b; return (_b = (_a = res.data) === null || _a === void 0 ? void 0 : _a.value) === null || _b === void 0 ? void 0 : _b.waitForIdleTimeout; })
+                .catch(() => undefined);
+            const setIdleWait = (seconds) => this.sendWDACommand(udid, 'post', '/appium/settings', {
+                settings: { waitForIdleTimeout: seconds },
+            });
+            try {
+                if (typeof idleWait === 'number')
+                    yield setIdleWait(0);
+                yield this.sendWDACommand(udid, 'post', '/wda/apps/activate', { bundleId: wdaBundleId });
+                // Activation answers before the app is in front, and a write made
+                // before then is lost.
+                const deadline = Date.now() + 3000;
+                while (Date.now() < deadline) {
+                    if ((yield this.activeBundleId(udid).catch(() => undefined)) === wdaBundleId)
+                        break;
+                    yield new Promise((r) => setTimeout(r, 100));
+                }
+                yield action();
+            }
+            finally {
+                try {
+                    if (previous === 'com.apple.springboard') {
+                        yield this.sendWDACommand(udid, 'post', '/wda/homescreen', {});
+                    }
+                    else if (previous && previous !== wdaBundleId) {
+                        yield this.sendWDACommand(udid, 'post', '/wda/apps/activate', { bundleId: previous });
+                    }
+                }
+                catch (e) {
+                    this.log.warn(`[Clipboard] Couldn't put back ${previous} on ${udid}: ${e.message}`);
+                }
+                if (typeof idleWait === 'number') {
+                    yield setIdleWait(idleWait).catch((e) => this.log.warn(`[Clipboard] Couldn't restore WDA's idle wait on ${udid}: ${e.message}`));
+                }
+            }
         });
     }
     lock(udid) {

package/lib/src/device-utils.js

@@ -99,6 +99,7 @@ const config_1 = require("./config");
 const device_store_1 = require("./data-service/device-store");
 const leaseSessionCaps_1 = require("./services/lease/leaseSessionCaps");
 const deviceVisibility_1 = require("./services/device-access/deviceVisibility");
+const activeLeases_1 = require("./services/lease/activeLeases");
 // Use a Proxy to ensure we're always using the latest store from the factory,
 // which is critical for test isolation when the factory cache is cleared.
 const pendingStore = new Proxy({}, {
@@ -182,6 +183,14 @@ function allocateDeviceForSession(capability_1, deviceTimeOutMs_1, deviceQueryIn
             // text or its stack tells them apart.
             if (!leasedDevice)
                 throw new Error((0, leaseSessionCaps_1.leaseRefusalMessage)(leaseIdCap));
+            // As for an allocated phone below: the idle sweeper reads this session's
+            // own timeout from the row, and its idle time from now, not from when the
+            // lease was taken. Without it a leased session was ended after the
+            // server-wide newCommandTimeoutSec, whatever the session asked for.
+            yield (0, device_service_1.updatedAllocatedDevice)(leasedDevice, {
+                newCommandTimeout: sessionNewCommandTimeout(firstMatch, pluginArgs),
+                lastCmdExecutedAt: Date.now(),
+            });
             return leasedDevice;
         }
         const filters = getDeviceFiltersFromCapability(firstMatch, pluginArgs);
@@ -195,29 +204,45 @@ function allocateDeviceForSession(capability_1, deviceTimeOutMs_1, deviceQueryIn
         const intervalBetweenAttempts = firstMatch[customCapability.deviceQueryInterval] || deviceQueryIntervalMs;
         let device = null;
         const store = device_store_1.DeviceStoreFactory.getStore();
+        // Set once the wait has given up. waitUntil rejects on its timeout but
+        // doesn't stop an attempt already running, which could then claim a phone
+        // for a create that has failed: a pending claim nobody would ever use.
+        let abandoned = false;
         try {
             yield (0, async_wait_until_1.default)(() => __awaiter(this, void 0, void 0, function* () {
+                if (abandoned)
+                    return false;
                 const maxSessions = getDeviceManager().getMaxSessionCount();
                 const busyDevicesCount = yield getBusyDevicesCount();
                 if (maxSessions !== undefined && busyDevicesCount === maxSessions) {
                     logger_1.default.info(`Waiting for session available, already at max session count of: ${maxSessions}`);
                     return false;
                 }
-                // Get matching devices and find one that is not reserved
-                const matchingDevices = yield (0, device_service_1.getDevices)(filters);
-                const availableCandidate = matchingDevices.find((d) => !(0, device_service_1.isDeviceReserved)(d));
-                if (availableCandidate) {
+                // Get matching devices that are not reserved
+                const candidates = (yield (0, device_service_1.getDevices)(filters)).filter((d) => !(0, device_service_1.isDeviceReserved)(d));
+                if (candidates.length > 0) {
                     // Principal Intelligence: Multi-node consistent locking
-                    // Attempt to atomically claim this specific device: busy, with a
-                    // pending claim for the session being created (deviceClaims.ts).
-                    device = yield store.findAndLockDevice(Object.assign(Object.assign({}, filters), { udid: [availableCandidate.udid] }), { claim: true });
-                    return device !== null;
+                    // Atomically claim one of them: busy, with a pending claim for the
+                    // session being created (deviceClaims.ts). Every candidate, not just
+                    // the first: the lock skips a phone an SDK lease holds, and offering
+                    // it alone stalled the create while other phones were free. Exact
+                    // (udid, host) pairs: a udid repeats across hosts, and a reserved
+                    // twin of a candidate must not be locked in its place.
+                    const locked = yield store.findAndLockDevice(Object.assign(Object.assign({}, filters), { udid: [...new Set(candidates.map((d) => d.udid))] }), { claim: true, only: new Set(candidates.map((d) => `${d.udid}@${d.host}`)) });
+                    if (locked && abandoned) {
+                        yield (0, device_service_1.releasePendingClaim)(locked);
+                        return false;
+                    }
+                    device = locked;
+                    if (device !== null)
+                        return true;
                 }
                 logger_1.default.info(`Waiting for free device. Filter: ${JSON.stringify(filters)}}`);
                 return false;
             }), { timeout, intervalBetweenAttempts });
         }
         catch (err) {
+            abandoned = true;
             // figure out whether the device is simply busy or non-existent
             const filterCopy = Object.assign({}, filters);
             delete filterCopy.busy;
@@ -258,11 +283,9 @@ function allocateDeviceForSession(capability_1, deviceTimeOutMs_1, deviceQueryIn
             // Since findAndLockDevice already sets busy: true, we don't need blockDevice(device.udid, device.host);
             logger_1.default.info(`📱 Locked device ${lockedDevice.udid} at host ${lockedDevice.host} for new session`);
             yield updateCapabilityForDevice(capability, lockedDevice);
-            let newCommandTimeout = firstMatch['appium:newCommandTimeout'];
-            if (!newCommandTimeout) {
-                newCommandTimeout = pluginArgs.newCommandTimeoutSec;
-            }
-            yield (0, device_service_1.updatedAllocatedDevice)(lockedDevice, { newCommandTimeout });
+            yield (0, device_service_1.updatedAllocatedDevice)(lockedDevice, {
+                newCommandTimeout: sessionNewCommandTimeout(firstMatch, pluginArgs),
+            });
             return lockedDevice;
         }
         else {
@@ -271,6 +294,10 @@ function allocateDeviceForSession(capability_1, deviceTimeOutMs_1, deviceQueryIn
         }
     });
 }
+/** The session's own `appium:newCommandTimeout` (seconds), else the server's. */
+function sessionNewCommandTimeout(firstMatch, pluginArgs) {
+    return firstMatch['appium:newCommandTimeout'] || pluginArgs.newCommandTimeoutSec;
+}
 /**
  * The device a lease-bound session may use, or null when it may not: the lease
  * is missing, inactive or expired, the session did not prove it holds it, or
@@ -604,6 +631,23 @@ function releaseBlockedDevices(newCommandTimeout) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
         const busyDevices = yield unblockCandidateDevices();
+        // A phone an SDK lease holds is the lease's to time out (its heartbeats and
+        // expiry, LeaseOrphanSweeper), not idle until a session runs on it. A lease
+        // sets lastCmdExecutedAt when taken, so without this the sweeper freed a
+        // leased phone the new-command timeout later, before a slow first session
+        // had even started on it.
+        let leases = new Map();
+        if (busyDevices.length) {
+            try {
+                leases = yield (0, activeLeases_1.activeLeasesByDevice)();
+            }
+            catch (err) {
+                // Not knowing which phones are leased, sweeping would free all of them:
+                // their lastCmdExecutedAt is when the lease was taken. Next tick.
+                logger_1.default.warn(`Idle sweep skipped: could not read active leases: ${err}`);
+                return;
+            }
+        }
         logger_1.default.debug(`Found ${busyDevices.length} device candidates to be released`);
         for (const device of busyDevices) {
             // need to keep this to make typescript happy. good thing tho.
@@ -622,6 +666,12 @@ function releaseBlockedDevices(newCommandTimeout) {
                 }
                 continue;
             }
+            // Leased, with no session or hold on it: not idle.
+            if (leases.has((0, activeLeases_1.leaseKey)(device.udid, device.host)) &&
+                !device.claimSessionId &&
+                !device.session_id) {
+                continue;
+            }
             const timeoutSeconds = device.newCommandTimeout != undefined ? device.newCommandTimeout : newCommandTimeout;
             const timeSinceLastCmdExecuted = (currentEpoch - device.lastCmdExecutedAt) / 1000;
             if (timeSinceLastCmdExecuted > timeoutSeconds) {

package/lib/src/middleware/deviceAccessGuard.js

@@ -12,7 +12,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OWNERSHIP_CHECKED_READS = exports.UNGUARDED_CONTROL_MUTATIONS = void 0;
+exports.LEASE_CHECKED_MUTATIONS = exports.OWNERSHIP_CHECKED_READS = exports.UNGUARDED_CONTROL_MUTATIONS = void 0;
 exports.deviceAccessGuard = deviceAccessGuard;
 const typedi_1 = require("typedi");
 const logger_1 = __importDefault(require("../logger"));
@@ -20,8 +20,10 @@ const manualLock_1 = require("../services/recording/manualLock");
 const controlDevice_1 = require("./controlDevice");
 const SessionOwnerResolver_1 = require("../services/device-access/SessionOwnerResolver");
 const deviceAccessPolicy_1 = require("../services/device-access/deviceAccessPolicy");
+const leaseHold_1 = require("../services/device-access/leaseHold");
 const actor_1 = require("../services/device-access/actor");
 const deviceClaims_1 = require("../data-service/deviceClaims");
+const activeLeases_1 = require("../services/lease/activeLeases");
 const STATE_CHANGING = new Set(['POST', 'PUT', 'DELETE', 'PATCH']);
 /**
  * Mutations under /control that this guard must NOT handle.
@@ -56,6 +58,14 @@ exports.UNGUARDED_CONTROL_MUTATIONS = [
  * "reads are cheap" assumption the mosaic depends on.
  */
 exports.OWNERSHIP_CHECKED_READS = ['clipboard', 'logs'];
+/**
+ * Unguarded mutations that still take the lease rule: starting a preview
+ * takes a hold on the phone. stream/start's own conflict handling knows
+ * holds and sessions, not leases, and on a hub the call goes on to the
+ * node, which knows nothing of the hub's leases. So a stranger is refused a
+ * leased phone here, before either, and the lease holder passes on to it.
+ */
+exports.LEASE_CHECKED_MUTATIONS = ['stream/start'];
 /**
  * Refuse /control mutations against a device somebody else holds.
  *
@@ -65,14 +75,16 @@ exports.OWNERSHIP_CHECKED_READS = ['clipboard', 'logs'];
  * handlers and was remembered in none of them.
  */
 function deviceAccessGuard(deps = {}) {
-    var _a, _b, _c;
+    var _a, _b, _c, _d, _e;
     const findDevice = (_a = deps.findDevice) !== null && _a !== void 0 ? _a : controlDevice_1.findControlDeviceInStore;
     const resolveSessionOwner = (_b = deps.resolveSessionOwner) !== null && _b !== void 0 ? _b : ((sid) => typedi_1.Container.get(SessionOwnerResolver_1.SessionOwnerResolver).ownerOf(sid));
     const describeHolder = (_c = deps.describeHolder) !== null && _c !== void 0 ? _c : ((id) => typedi_1.Container.get(SessionOwnerResolver_1.SessionOwnerResolver).displayName(id));
+    const findActiveLease = (_d = deps.findActiveLease) !== null && _d !== void 0 ? _d : ((udid, host) => (0, activeLeases_1.activeLeaseOn)(udid, host));
+    const resolveLeaseHolder = (_e = deps.resolveLeaseHolder) !== null && _e !== void 0 ? _e : ((id) => typedi_1.Container.get(SessionOwnerResolver_1.SessionOwnerResolver).leaseHolderOf(id));
     const unavailable = (res) => res.status(503).json((0, deviceAccessPolicy_1.ownershipUnavailableBody)());
     return function (req, res, next) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c;
+            var _a, _b, _c, _d, _e;
             // Router-level middleware has no req.params; controlAction reads the path.
             // It lowercases, as Express routes case-insensitively: `Stream/Start`
             // still reaches stream/start's own richer handling, and `Clipboard`
@@ -81,8 +93,9 @@ function deviceAccessGuard(deps = {}) {
             // Decide whether this request is in scope BEFORE touching the udid, so an
             // ordinary read (screenshot, stream, logs, page source) short-circuits here
             // exactly as it did when this guard was mutations-only.
+            const leaseOnly = req.method === 'POST' && exports.LEASE_CHECKED_MUTATIONS.includes(action);
             const inScope = STATE_CHANGING.has(req.method)
-                ? !exports.UNGUARDED_CONTROL_MUTATIONS.includes(action)
+                ? !exports.UNGUARDED_CONTROL_MUTATIONS.includes(action) || leaseOnly
                 : req.method === 'GET' && exports.OWNERSHIP_CHECKED_READS.includes(action);
             if (!action || !inScope)
                 return next();
@@ -116,6 +129,26 @@ function deviceAccessGuard(deps = {}) {
             // resolved device to reason about ownership at all.
             if (!device)
                 return next();
+            if (leaseOnly) {
+                if (actor.isAdmin)
+                    return next();
+                let held;
+                try {
+                    held = yield (0, leaseHold_1.leaseHoldFor)({ udid, host: device.host }, findActiveLease, resolveLeaseHolder);
+                }
+                catch (e) {
+                    logger_1.default.error(`deviceAccessGuard: lease lookup failed for ${udid}: ${(_b = e === null || e === void 0 ? void 0 : e.message) !== null && _b !== void 0 ? _b : e}`);
+                    return unavailable(res);
+                }
+                if (!held || (0, deviceAccessPolicy_1.isLeaseHolder)(held, actor.userId, actor.apiKeyId))
+                    return next();
+                return deny(req, res, udid, actor.userId, {
+                    allow: false,
+                    code: 'device_held_by_another_user',
+                    holderId: (_c = held.holderUserId) !== null && _c !== void 0 ? _c : '',
+                    heldBy: 'lease',
+                });
+            }
             let sessionOwnerUserId = null;
             if (device.busy && device.session_id && !(0, manualLock_1.isManualLock)(device.session_id)) {
                 try {
@@ -124,7 +157,19 @@ function deviceAccessGuard(deps = {}) {
                 catch (e) {
                     // Same reasoning as the device lookup above: not knowing who owns a
                     // live session is exactly the case where we must not guess allow.
-                    logger_1.default.error(`deviceAccessGuard: session owner lookup failed for ${device.session_id}: ${(_b = e === null || e === void 0 ? void 0 : e.message) !== null && _b !== void 0 ? _b : e}`);
+                    logger_1.default.error(`deviceAccessGuard: session owner lookup failed for ${device.session_id}: ${(_d = e === null || e === void 0 ? void 0 : e.message) !== null && _d !== void 0 ? _d : e}`);
+                    return unavailable(res);
+                }
+            }
+            let lease = null;
+            if (!actor.isAdmin) {
+                try {
+                    lease = yield (0, leaseHold_1.leaseHoldFor)({ udid, host: device.host }, findActiveLease, resolveLeaseHolder);
+                }
+                catch (e) {
+                    // A leased phone is held whatever `busy` says: not knowing whether a
+                    // lease holds it is not knowing who owns it.
+                    logger_1.default.error(`deviceAccessGuard: lease lookup failed for ${udid}: ${(_e = e === null || e === void 0 ? void 0 : e.message) !== null && _e !== void 0 ? _e : e}`);
                     return unavailable(res);
                 }
             }
@@ -138,9 +183,16 @@ function deviceAccessGuard(deps = {}) {
                 actorUserId: actor.userId,
                 actorApiKeyId: actor.apiKeyId,
                 isAdmin: actor.isAdmin,
+                lease,
             });
             if (decision.allow)
                 return next();
+            return deny(req, res, udid, actor.userId, decision);
+        });
+    };
+    function deny(req, res, udid, actorUserId, decision) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
             // describeHolder is cosmetic — it only resolves a display name for the
             // deny message. A failure here must still deny (never flip to allow) but
             // must not hang the request either; fall back to no holder name.
@@ -150,12 +202,14 @@ function deviceAccessGuard(deps = {}) {
                     holderName = yield describeHolder(decision.holderId);
                 }
                 catch (e) {
-                    logger_1.default.warn(`deviceAccessGuard: holder name lookup failed for ${decision.holderId}: ${(_c = e === null || e === void 0 ? void 0 : e.message) !== null && _c !== void 0 ? _c : e}`);
+                    logger_1.default.warn(`deviceAccessGuard: holder name lookup failed for ${decision.holderId}: ${(_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : e}`);
                 }
             }
-            logger_1.default.warn(`Device access denied: ${actor.userId} -> ${req.method} ${req.originalUrl} ` +
+            logger_1.default.warn(`Device access denied: ${actorUserId} -> ${req.method} ${req.originalUrl} ` +
                 `on ${udid} (${decision.code}, holder=${decision.holderId || 'unknown'})`);
-            return res.status(409).json((0, deviceAccessPolicy_1.denyBody)(decision.code, decision.holderId, holderName));
+            return res
+                .status(409)
+                .json((0, deviceAccessPolicy_1.denyBody)(decision.code, decision.holderId, holderName, decision.heldBy));
         });
-    };
+    }
 }

package/lib/src/services/ServerManager.js

@@ -71,6 +71,7 @@ const LogcatStreamService_1 = require("../device-managers/android/LogcatStreamSe
 const IOSLogStreamService_1 = require("../device-managers/ios/IOSLogStreamService");
 const logSource_1 = require("./logcat/logSource");
 const SessionOwnerResolver_1 = require("./device-access/SessionOwnerResolver");
+const activeLeases_1 = require("./lease/activeLeases");
 const ticketActorAccess_1 = require("./device-access/ticketActorAccess");
 // enable resolveJsonModule in tsconfig must be true for this to work
 const package_json_1 = __importDefault(require("../../package.json"));
@@ -169,6 +170,8 @@ let ServerManager = ServerManager_1 = class ServerManager {
                     authorize: (0, ticketActorAccess_1.makeTicketActorAuthorizer)({
                         findDevice: (udid) => device_store_1.DeviceStoreFactory.getStore().findDevice({ udid }),
                         resolveSessionOwner: (sessionId) => typedi_1.Container.get(SessionOwnerResolver_1.SessionOwnerResolver).ownerOf(sessionId),
+                        findActiveLease: (udid, host) => (0, activeLeases_1.activeLeaseOn)(udid, host),
+                        resolveLeaseHolder: (actorId) => typedi_1.Container.get(SessionOwnerResolver_1.SessionOwnerResolver).leaseHolderOf(actorId),
                     }),
                     // One WebSocket, two transports. The device's platform picks which —
                     // see resolveLogSource. The filter is only meaningful for ostrace,

package/lib/src/services/SessionLifecycleService.js

@@ -222,9 +222,7 @@ let SessionLifecycleService = class SessionLifecycleService {
                 // Who asked, for the queue's team scoping (queueVisibility). On this row
                 // only, never in `caps`, and last so a client can't supply its own.
                 [queueVisibility_1.REQUESTER_KEY]: authResult.requester }));
-            const lockName = this.getLockName(caps);
-            this.logger.debug(`📱 Acquiring lock: ${lockName}`);
-            const device = yield commandsQueueGuard.acquire(lockName, () => __awaiter(this, void 0, void 0, function* () {
+            const allocate = () => __awaiter(this, void 0, void 0, function* () {
                 var _a;
                 try {
                     return yield (0, device_utils_1.allocateDeviceForSession)(caps, pluginArgs.deviceAvailabilityTimeoutMs, pluginArgs.deviceAvailabilityQueryIntervalMs, pluginArgs, sessionTeamIds, {
@@ -238,7 +236,21 @@ let SessionLifecycleService = class SessionLifecycleService {
                     yield (0, pending_sessions_service_1.removePendingSession)(pendingSessionId);
                     throw err;
                 }
-            }));
+            });
+            // Creates for a platform queue on one lock, first come first served, and
+            // each has its full deviceAvailabilityTimeoutMs from the head of the
+            // queue. A lease-bound session allocates nothing (its phone is the
+            // lease's) and doesn't queue: behind the lock it waited for every create
+            // ahead of it, each of which may wait minutes for a busy phone.
+            let device;
+            if ((0, leaseSessionCaps_1.leaseIdOf)(caps)) {
+                device = yield allocate();
+            }
+            else {
+                const lockName = this.getLockName(caps);
+                this.logger.debug(`📱 Acquiring lock: ${lockName}`);
+                device = yield commandsQueueGuard.acquire(lockName, allocate);
+            }
             yield (0, device_service_1.updateDeviceProgress)(device.udid, device.host, 'Allocating node resources...');
             this.logger.debug(`device.host: ${device.host} and pluginArgs.bindHostOrIp: ${pluginArgs.bindHostOrIp}`);
             const allocation = {

package/lib/src/services/device-access/SessionOwnerResolver.js

@@ -46,9 +46,34 @@ let SessionOwnerResolver = class SessionOwnerResolver {
         this.db = db;
         this.ownerCache = new Map();
         this.nameCache = new Map();
+        this.leaseHolderCache = new Map();
         /** The owners of this server's live sessions. A field, not a constructor parameter: TypeDI. */
         this.liveOwners = () => typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners);
     }
+    /**
+     * The user behind a lease's `actorId`: the owner of the API key that
+     * created it, or, for a lease made with a bearer token, the user id itself.
+     * Positive results are cached, as for sessions: a lease's creator never
+     * changes.
+     */
+    leaseHolderOf(actorId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (!actorId)
+                return null;
+            const cached = this.leaseHolderCache.get(actorId);
+            if (cached)
+                return cached;
+            const key = yield this.db.apiKey.findUnique({
+                where: { id: actorId },
+                select: { userId: true },
+            });
+            const holder = key ? ((_a = key.userId) !== null && _a !== void 0 ? _a : null) : actorId;
+            if (holder)
+                this.remember(this.leaseHolderCache, actorId, holder);
+            return holder;
+        });
+    }
     ownerOf(sessionId) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a, _b;
@@ -165,6 +190,7 @@ let SessionOwnerResolver = class SessionOwnerResolver {
     clear() {
         this.ownerCache.clear();
         this.nameCache.clear();
+        this.leaseHolderCache.clear();
     }
     remember(cache, key, value) {
         if (cache.size >= MAX_CACHE_ENTRIES)