@xenon-device-management/xenon 2.13.1 → 2.13.2

package/lib/src/services/device-access/ticketActorAccess.js

@@ -13,6 +13,7 @@ exports.makeTicketActorAuthorizer = makeTicketActorAuthorizer;
 const manualLock_1 = require("../recording/manualLock");
 const deviceAccessPolicy_1 = require("./deviceAccessPolicy");
 const deviceClaims_1 = require("../../data-service/deviceClaims");
+const leaseHold_1 = require("./leaseHold");
 /**
  * Build the ownership check for a caller authenticated by a stream ticket.
  *
@@ -53,6 +54,10 @@ function makeTicketActorAuthorizer(deps) {
             const sessionOwnerUserId = device.busy && device.session_id && !(0, manualLock_1.isManualLock)(device.session_id)
                 ? yield deps.resolveSessionOwner(device.session_id)
                 : null;
+            // As deviceAccessGuard: a leased phone is its lease holder's.
+            const lease = deps.findActiveLease && deps.resolveLeaseHolder && !actor.isAdmin
+                ? yield (0, leaseHold_1.leaseHoldFor)({ udid, host: device.host }, deps.findActiveLease, deps.resolveLeaseHolder)
+                : null;
             return (0, deviceAccessPolicy_1.evaluateDeviceAccess)({
                 udid,
                 // heldHere, as deviceAccessGuard reads it.
@@ -63,6 +68,7 @@ function makeTicketActorAuthorizer(deps) {
                 actorUserId: actor.actorId,
                 actorApiKeyId: actor.apiKeyId,
                 isAdmin: !!actor.isAdmin,
+                lease,
             }).allow;
         });
     };

package/lib/src/services/lease/activeLeases.js

@@ -0,0 +1,37 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.leaseKey = void 0;
+exports.activeLeasesByDevice = activeLeasesByDevice;
+exports.activeLeaseOn = activeLeaseOn;
+const prisma_1 = require("../../prisma");
+const leaseKey = (udid, host) => `${udid}@${host}`;
+exports.leaseKey = leaseKey;
+/** Every live lease, keyed by `leaseKey(udid, host)`. */
+function activeLeasesByDevice() {
+    return __awaiter(this, arguments, void 0, function* (db = prisma_1.prisma, now = Date.now()) {
+        const rows = yield db.lease.findMany({
+            where: { status: 'active', expiresAt: { gte: now } },
+            select: { id: true, deviceUdid: true, deviceHost: true, actorId: true },
+        });
+        return new Map(rows.map((l) => [(0, exports.leaseKey)(l.deviceUdid, l.deviceHost), l]));
+    });
+}
+/** The live lease on one phone, or null. */
+function activeLeaseOn(udid_1, host_1) {
+    return __awaiter(this, arguments, void 0, function* (udid, host, db = prisma_1.prisma, now = Date.now()) {
+        var _a;
+        return ((_a = (yield db.lease.findFirst({
+            where: { deviceUdid: udid, deviceHost: host, status: 'active', expiresAt: { gte: now } },
+            select: { id: true, deviceUdid: true, deviceHost: true, actorId: true },
+        }))) !== null && _a !== void 0 ? _a : null);
+    });
+}

package/lib/src/services/recording/busy-precheck.js

@@ -23,6 +23,9 @@ const typedi_1 = require("typedi");
 const device_store_1 = require("../../data-service/device-store");
 const manualLock_1 = require("./manualLock");
 const deviceAccessPolicy_1 = require("../device-access/deviceAccessPolicy");
+const leaseHold_1 = require("../device-access/leaseHold");
+const SessionOwnerResolver_1 = require("../device-access/SessionOwnerResolver");
+const activeLeases_1 = require("../lease/activeLeases");
 const recording_store_1 = require("./recording-store");
 /**
  * Atomic multi-UDID busy detection. Used by RecordingOrchestrator before
@@ -39,14 +42,18 @@ const recording_store_1 = require("./recording-store");
  *   - missing/null   → unknown (defensive fallback).
  */
 let BusyPrecheck = class BusyPrecheck {
-    // Both parameters must emit `Object` metadata: TypeDI injects constructor
+    // Every parameter must emit `Object` metadata: TypeDI injects constructor
     // parameters by type, and a function type made it look up `Function` in the
     // container, failing every recording start.
-    constructor(store, recordings) {
+    constructor(store, recordings, leases) {
         this.storeProvider = store ? () => store : () => device_store_1.DeviceStoreFactory.getStore();
         this.recordings = recordings !== null && recordings !== void 0 ? recordings : {
             isRecording: (udid) => typedi_1.Container.get(recording_store_1.RecordingStore).isRecording(udid),
         };
+        this.leases = leases !== null && leases !== void 0 ? leases : {
+            find: (udid, host) => (0, activeLeases_1.activeLeaseOn)(udid, host),
+            holderOf: (actorId) => typedi_1.Container.get(SessionOwnerResolver_1.SessionOwnerResolver).leaseHolderOf(actorId),
+        };
     }
     /**
      * @param udids   Devices to inspect.
@@ -79,6 +86,20 @@ let BusyPrecheck = class BusyPrecheck {
                     out.push({ udid, reason: 'recording_other_group' });
                     continue;
                 }
+                // A leased phone is its lease holder's, whatever `busy` says (a lease
+                // locks with `busy` alone, which other writes can clear). Anyone else
+                // is refused; for the holder the lease itself is no conflict, though a
+                // session or hold on the phone still is, below. A failed lookup throws:
+                // the start fails rather than records someone's leased phone.
+                const lease = yield (0, leaseHold_1.leaseHoldFor)(device, this.leases.find, this.leases.holderOf);
+                if (lease) {
+                    if (!(0, deviceAccessPolicy_1.isLeaseHolder)(lease, actorId, actorApiKeyId)) {
+                        out.push({ udid, reason: 'leased' });
+                        continue;
+                    }
+                    if (!device.session_id)
+                        continue;
+                }
                 if (!device.busy)
                     continue;
                 // This server's own hold, else, on a hub, a node phone's preview hold
@@ -112,5 +133,5 @@ let BusyPrecheck = class BusyPrecheck {
 exports.BusyPrecheck = BusyPrecheck;
 exports.BusyPrecheck = BusyPrecheck = __decorate([
     (0, typedi_1.Service)(),
-    __metadata("design:paramtypes", [Object, Object])
+    __metadata("design:paramtypes", [Object, Object, Object])
 ], BusyPrecheck);

package/lib/test/unit/device-access-lease.spec.js

@@ -0,0 +1,270 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const express_1 = __importDefault(require("express"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const deviceAccessPolicy_1 = require("../../src/services/device-access/deviceAccessPolicy");
+const deviceAccessGuard_1 = require("../../src/middleware/deviceAccessGuard");
+const ticketActorAccess_1 = require("../../src/services/device-access/ticketActorAccess");
+const streamStartConflict_1 = require("../../src/app/routers/streamStartConflict");
+const busy_precheck_1 = require("../../src/services/recording/busy-precheck");
+// A phone an SDK lease holds is its lease holder's. The guard used to read
+// only `busy` and `session_id`: a freshly leased phone (busy, no session) was
+// refused to everyone but admins, its holder included, and a leased phone
+// whose `busy` had been cleared (a lease-bound session's release, the idle
+// sweeper) was open to anyone.
+const UDID = 'DEV-1';
+const HOST = 'http://hub:4723';
+const ALICE = 'usr_alice';
+const ALICE_KEY = 'key_alice';
+const BOB = 'usr_bob';
+const BOB_KEY = 'key_bob';
+const aliceLease = { actorId: ALICE_KEY, holderUserId: ALICE };
+function input(over = {}) {
+    return Object.assign({ udid: UDID, busy: true, sessionId: null, sessionOwnerUserId: null, actorUserId: BOB, actorApiKeyId: BOB_KEY, isAdmin: false, lease: aliceLease }, over);
+}
+describe('device access on a leased phone', () => {
+    describe('evaluateDeviceAccess', () => {
+        it('lets the lease holder through by the key that created it', () => {
+            (0, chai_1.expect)((0, deviceAccessPolicy_1.evaluateDeviceAccess)(input({ actorUserId: 'usr_other', actorApiKeyId: ALICE_KEY }))).to.deep.equal({ allow: true });
+        });
+        it('lets the lease holder through with any credential of theirs', () => {
+            (0, chai_1.expect)((0, deviceAccessPolicy_1.evaluateDeviceAccess)(input({ actorUserId: ALICE, actorApiKeyId: undefined }))).to.deep.equal({ allow: true });
+        });
+        it('lets a user through on a lease made with their bearer token (actorId is the user id)', () => {
+            (0, chai_1.expect)((0, deviceAccessPolicy_1.evaluateDeviceAccess)(input({
+                actorUserId: ALICE,
+                actorApiKeyId: undefined,
+                lease: { actorId: ALICE, holderUserId: ALICE },
+            }))).to.deep.equal({ allow: true });
+        });
+        it('refuses anyone else, naming the lease holder', () => {
+            (0, chai_1.expect)((0, deviceAccessPolicy_1.evaluateDeviceAccess)(input())).to.deep.equal({
+                allow: false,
+                code: 'device_held_by_another_user',
+                holderId: ALICE,
+                heldBy: 'lease',
+            });
+        });
+        it("refuses anyone else even when the phone's busy flag was cleared", () => {
+            (0, chai_1.expect)((0, deviceAccessPolicy_1.evaluateDeviceAccess)(input({ busy: false })).allow).to.equal(false);
+        });
+        it('lets the owner of the session running on the leased phone drive it', () => {
+            (0, chai_1.expect)((0, deviceAccessPolicy_1.evaluateDeviceAccess)(input({ sessionId: 'sess-1', sessionOwnerUserId: BOB }))).to.deep.equal({ allow: true });
+        });
+        it("doesn't let a manual hold on a leased phone stand in for the lease", () => {
+            (0, chai_1.expect)((0, deviceAccessPolicy_1.evaluateDeviceAccess)(input({ sessionId: `manual_${BOB}_${UDID}` })).allow).to.equal(false);
+        });
+        it('fails closed when the holder cannot be resolved', () => {
+            const d = (0, deviceAccessPolicy_1.evaluateDeviceAccess)(input({ lease: { actorId: 'key_gone', holderUserId: null } }));
+            (0, chai_1.expect)(d).to.deep.equal({
+                allow: false,
+                code: 'device_held_by_another_user',
+                holderId: '',
+                heldBy: 'lease',
+            });
+        });
+        it('still allows an admin', () => {
+            (0, chai_1.expect)((0, deviceAccessPolicy_1.evaluateDeviceAccess)(input({ isAdmin: true }))).to.deep.equal({ allow: true });
+        });
+        it('leaves an unleased phone to the rules it had', () => {
+            (0, chai_1.expect)((0, deviceAccessPolicy_1.evaluateDeviceAccess)(input({ lease: null, busy: false }))).to.deep.equal({
+                allow: true,
+            });
+            (0, chai_1.expect)((0, deviceAccessPolicy_1.evaluateDeviceAccess)(input({ lease: null, sessionId: 'sess-1', sessionOwnerUserId: ALICE }))
+                .allow).to.equal(false);
+        });
+        it('isLeaseHolder needs a lease', () => {
+            (0, chai_1.expect)((0, deviceAccessPolicy_1.isLeaseHolder)(null, ALICE, ALICE_KEY)).to.equal(false);
+        });
+    });
+    describe('deviceAccessGuard', () => {
+        function appFor(opts) {
+            var _a;
+            const app = (0, express_1.default)();
+            app.use(express_1.default.json());
+            app.use((req, _res, next) => {
+                var _a;
+                req.auth = {
+                    kind: 'api-key',
+                    userId: opts.actorUserId,
+                    role: (_a = opts.role) !== null && _a !== void 0 ? _a : 'MEMBER',
+                    scopes: 'devices',
+                    rateLimit: 100,
+                };
+                if (opts.apiKeyId)
+                    req.apiKey = { id: opts.apiKeyId };
+                next();
+            });
+            const router = express_1.default.Router();
+            router.use((0, deviceAccessGuard_1.deviceAccessGuard)({
+                findDevice: () => __awaiter(this, void 0, void 0, function* () {
+                    var _a;
+                    return ({
+                        udid: UDID,
+                        host: HOST,
+                        busy: (_a = opts.busy) !== null && _a !== void 0 ? _a : true,
+                        session_id: null,
+                    });
+                }),
+                resolveSessionOwner: () => __awaiter(this, void 0, void 0, function* () { return null; }),
+                describeHolder: (id) => __awaiter(this, void 0, void 0, function* () { return (id === ALICE ? 'alice@example.com' : null); }),
+                findActiveLease: (_a = opts.leaseLookup) !== null && _a !== void 0 ? _a : ((udid, host) => __awaiter(this, void 0, void 0, function* () { var _a; return (udid === UDID && host === HOST ? ((_a = opts.lease) !== null && _a !== void 0 ? _a : null) : null); })),
+                resolveLeaseHolder: () => __awaiter(this, void 0, void 0, function* () { var _a; return (_a = opts.leaseHolder) !== null && _a !== void 0 ? _a : null; }),
+            }));
+            router.post('/:udid/tap', (_req, res) => res.json({ reached: true }));
+            router.get('/:udid/clipboard', (_req, res) => res.json({ reached: true }));
+            app.use('/control', router);
+            return app;
+        }
+        it('lets the lease holder control the phone they just leased', () => __awaiter(void 0, void 0, void 0, function* () {
+            const res = yield (0, loopbackRequest_1.default)(appFor({ actorUserId: ALICE, lease: { actorId: ALICE_KEY }, leaseHolder: ALICE })).post(`/control/${UDID}/tap`);
+            (0, chai_1.expect)(res.status).to.equal(200);
+            (0, chai_1.expect)(res.body.reached).to.equal(true);
+        }));
+        it('refuses another member with a message about the lease', () => __awaiter(void 0, void 0, void 0, function* () {
+            const res = yield (0, loopbackRequest_1.default)(appFor({ actorUserId: BOB, lease: { actorId: ALICE_KEY }, leaseHolder: ALICE })).post(`/control/${UDID}/tap`);
+            (0, chai_1.expect)(res.status).to.equal(409);
+            (0, chai_1.expect)(res.body.error).to.equal('device_held_by_another_user');
+            (0, chai_1.expect)(res.body.message).to.match(/leased by alice@example\.com/);
+            (0, chai_1.expect)(res.body.holder.userId).to.equal(ALICE);
+        }));
+        it('refuses another member on a leased phone whose busy flag was cleared', () => __awaiter(void 0, void 0, void 0, function* () {
+            const res = yield (0, loopbackRequest_1.default)(appFor({
+                actorUserId: BOB,
+                busy: false,
+                lease: { actorId: ALICE_KEY },
+                leaseHolder: ALICE,
+            })).get(`/control/${UDID}/clipboard`);
+            (0, chai_1.expect)(res.status).to.equal(409);
+        }));
+        it('answers 503 when it cannot tell whether a lease holds the phone', () => __awaiter(void 0, void 0, void 0, function* () {
+            const res = yield (0, loopbackRequest_1.default)(appFor({
+                actorUserId: BOB,
+                leaseLookup: () => __awaiter(void 0, void 0, void 0, function* () {
+                    throw new Error('db down');
+                }),
+            })).post(`/control/${UDID}/tap`);
+            (0, chai_1.expect)(res.status).to.equal(503);
+            (0, chai_1.expect)(res.body.error).to.equal('device_ownership_unavailable');
+        }));
+        it('does not look leases up for an admin', () => __awaiter(void 0, void 0, void 0, function* () {
+            const res = yield (0, loopbackRequest_1.default)(appFor({
+                actorUserId: BOB,
+                role: 'SUPER_ADMIN',
+                leaseLookup: () => __awaiter(void 0, void 0, void 0, function* () {
+                    throw new Error('an admin should not need this');
+                }),
+            })).post(`/control/${UDID}/tap`);
+            (0, chai_1.expect)(res.status).to.equal(200);
+        }));
+    });
+    describe('the logcat ticket authorizer', () => {
+        const authorize = (0, ticketActorAccess_1.makeTicketActorAuthorizer)({
+            findDevice: () => __awaiter(void 0, void 0, void 0, function* () { return ({ udid: UDID, host: HOST, busy: true, session_id: null }); }),
+            resolveSessionOwner: () => __awaiter(void 0, void 0, void 0, function* () { return null; }),
+            findActiveLease: () => __awaiter(void 0, void 0, void 0, function* () { return ({ actorId: ALICE_KEY }); }),
+            resolveLeaseHolder: () => __awaiter(void 0, void 0, void 0, function* () { return ALICE; }),
+        });
+        it('lets the lease holder read the leased phone', () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)(yield authorize(UDID, { actorId: ALICE })).to.equal(true);
+        }));
+        it('refuses anyone else', () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)(yield authorize(UDID, { actorId: BOB })).to.equal(false);
+        }));
+    });
+    describe('stream/start', () => {
+        const start = (over = {}) => (0, streamStartConflict_1.decideStreamStartConflict)(Object.assign({ udid: UDID, busy: true, sessionId: null, hasLiveManualStream: false, sessionOwnerUserId: null, actorUserId: ALICE, isAdmin: false }, over));
+        it('lets the lease holder preview their leased phone (busy, no session)', () => {
+            (0, chai_1.expect)(start({ leaseHolder: true })).to.deep.equal({ action: 'proceed' });
+        });
+        it('still refuses a busy phone with no holder on record to anyone else', () => {
+            (0, chai_1.expect)(start().action).to.equal('deny');
+        });
+        it("doesn't let a lease stand in for someone else's session on the phone", () => {
+            (0, chai_1.expect)(start({ leaseHolder: true, sessionId: 'sess-9', sessionOwnerUserId: BOB }).action).to.equal('deny');
+        });
+        function appFor(actorUserId, role = 'MEMBER', leased = true) {
+            const app = (0, express_1.default)();
+            app.use((req, _res, next) => {
+                req.auth = { kind: 'api-key', userId: actorUserId, role, scopes: 'devices' };
+                next();
+            });
+            const router = express_1.default.Router();
+            router.use((0, deviceAccessGuard_1.deviceAccessGuard)({
+                findDevice: () => __awaiter(this, void 0, void 0, function* () { return ({ udid: UDID, host: HOST, busy: false, session_id: null }); }),
+                resolveSessionOwner: () => __awaiter(this, void 0, void 0, function* () { return null; }),
+                describeHolder: () => __awaiter(this, void 0, void 0, function* () { return 'alice@example.com'; }),
+                findActiveLease: () => __awaiter(this, void 0, void 0, function* () {
+                    if (role === 'SUPER_ADMIN')
+                        throw new Error('an admin should not need this');
+                    return leased ? { actorId: ALICE_KEY } : null;
+                }),
+                resolveLeaseHolder: () => __awaiter(this, void 0, void 0, function* () { return ALICE; }),
+            }));
+            router.post('/:udid/stream/start', (_req, res) => res.json({ reached: true }));
+            app.use('/control', router);
+            return app;
+        }
+        it('refuses a stranger before the handler (and before a hub forwards it)', () => __awaiter(void 0, void 0, void 0, function* () {
+            const res = yield (0, loopbackRequest_1.default)(appFor(BOB)).post(`/control/${UDID}/stream/start`);
+            (0, chai_1.expect)(res.status).to.equal(409);
+            (0, chai_1.expect)(res.body.message).to.match(/leased by/);
+        }));
+        it('passes the lease holder on to the handler', () => __awaiter(void 0, void 0, void 0, function* () {
+            const res = yield (0, loopbackRequest_1.default)(appFor(ALICE)).post(`/control/${UDID}/stream/start`);
+            (0, chai_1.expect)(res.body.reached).to.equal(true);
+        }));
+        it('leaves an unleased phone to stream/start, as before', () => __awaiter(void 0, void 0, void 0, function* () {
+            const res = yield (0, loopbackRequest_1.default)(appFor(BOB, 'MEMBER', false)).post(`/control/${UDID}/stream/start`);
+            (0, chai_1.expect)(res.body.reached).to.equal(true);
+        }));
+        it('passes an admin without looking leases up', () => __awaiter(void 0, void 0, void 0, function* () {
+            const res = yield (0, loopbackRequest_1.default)(appFor(BOB, 'SUPER_ADMIN')).post(`/control/${UDID}/stream/start`);
+            (0, chai_1.expect)(res.body.reached).to.equal(true);
+        }));
+    });
+    describe('recordings (BusyPrecheck)', () => {
+        const precheck = (row, lease) => new busy_precheck_1.BusyPrecheck({ findDevice: () => __awaiter(void 0, void 0, void 0, function* () { return (Object.assign({ udid: UDID, host: HOST }, row)); }) }, { isRecording: () => __awaiter(void 0, void 0, void 0, function* () { return false; }) }, {
+            find: () => __awaiter(void 0, void 0, void 0, function* () {
+                if (lease instanceof Error)
+                    throw lease;
+                return lease;
+            }),
+            holderOf: () => __awaiter(void 0, void 0, void 0, function* () { return ALICE; }),
+        });
+        it("refuses a stranger's recording of a leased phone, busy or not", () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)(yield precheck({ busy: false }, { actorId: ALICE_KEY }).findBusy([UDID], BOB)).to.deep.equal([{ udid: UDID, reason: 'leased' }]);
+        }));
+        it('lets the lease holder record their leased phone', () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)(yield precheck({ busy: true }, { actorId: ALICE_KEY }).findBusy([UDID], ALICE)).to.deep.equal([]);
+        }));
+        it('still refuses the holder while a session runs on it, as for any session', () => __awaiter(void 0, void 0, void 0, function* () {
+            const busy = yield precheck({ busy: true, session_id: 'sess-1' }, { actorId: ALICE_KEY }).findBusy([UDID], ALICE);
+            (0, chai_1.expect)(busy).to.deep.equal([{ udid: UDID, reason: 'automation', sessionId: 'sess-1' }]);
+        }));
+        it('fails the start when it cannot tell whether a lease holds the phone', () => __awaiter(void 0, void 0, void 0, function* () {
+            let thrown;
+            try {
+                yield precheck({ busy: false }, new Error('db down')).findBusy([UDID], BOB);
+            }
+            catch (e) {
+                thrown = e;
+            }
+            (0, chai_1.expect)(thrown === null || thrown === void 0 ? void 0 : thrown.message).to.equal('db down');
+        }));
+    });
+});

package/lib/test/unit/lease/allocate-lease-branch.spec.js

@@ -41,6 +41,7 @@ describe('allocateDeviceForSession — lease-bound session', () => {
     let device;
     let lease;
     let restore;
+    let updateDevice;
     const allocate = (proof, callerTeamIds) => (0, device_utils_1.allocateDeviceForSession)(leaseCaps(), 1000, 100, IPluginArgs_1.DefaultPluginArgs, callerTeamIds, proof);
     const refusedWith = (proof, callerTeamIds) => __awaiter(void 0, void 0, void 0, function* () {
         try {
@@ -71,8 +72,10 @@ describe('allocateDeviceForSession — lease-bound session', () => {
         const noAuth = { nodePairAuth: () => __awaiter(void 0, void 0, void 0, function* () { return ({ accessKey: '', token: '' }); }) };
         restore = (0, container_registration_1.saveRegistrations)(LeaseService_1.LeaseService);
         typedi_1.Container.set(LeaseService_1.LeaseService, new LeaseService_1.LeaseService(db, {}, {}, noAuth));
+        updateDevice = sinon_1.default.stub().resolves();
         sinon_1.default.stub(device_store_1.DeviceStoreFactory, 'getStore').returns({
             findDevice: sinon_1.default.stub().callsFake(() => __awaiter(void 0, void 0, void 0, function* () { return device; })),
+            updateDevice,
         });
     });
     afterEach(() => {
@@ -94,6 +97,25 @@ describe('allocateDeviceForSession — lease-bound session', () => {
             (0, chai_1.expect)(got.udid).to.equal('u1');
         }));
     });
+    describe('the idle sweeper reads the session, not the lease', () => {
+        // It used to read the server-wide newCommandTimeoutSec and the lease's
+        // creation time, so a leased session was ended a minute after the lease
+        // was taken, whatever the session asked for.
+        it("records the session's newCommandTimeout and its start", () => __awaiter(void 0, void 0, void 0, function* () {
+            const caps = leaseCaps();
+            caps.alwaysMatch['appium:newCommandTimeout'] = 120;
+            const before = Date.now();
+            yield (0, device_utils_1.allocateDeviceForSession)(caps, 1000, 100, IPluginArgs_1.DefaultPluginArgs, undefined, Object.assign(Object.assign({}, NOBODY), { leaseToken: TOKEN }));
+            const [udid, host, written] = updateDevice.firstCall.args;
+            (0, chai_1.expect)([udid, host]).to.deep.equal(['u1', 'h1']);
+            (0, chai_1.expect)(written.newCommandTimeout).to.equal(120);
+            (0, chai_1.expect)(written.lastCmdExecutedAt).to.be.at.least(before);
+        }));
+        it("falls back to the server's newCommandTimeoutSec", () => __awaiter(void 0, void 0, void 0, function* () {
+            yield allocate(Object.assign(Object.assign({}, NOBODY), { leaseToken: TOKEN }));
+            (0, chai_1.expect)(updateDevice.firstCall.args[2].newCommandTimeout).to.equal(IPluginArgs_1.DefaultPluginArgs.newCommandTimeoutSec);
+        }));
+    });
     describe("someone else's lease id is refused, as if it were not active", () => {
         it('with no credentials and no token', () => __awaiter(void 0, void 0, void 0, function* () {
             (0, chai_1.expect)(yield refusal(NOBODY)).to.equal(REFUSED);

package/lib/test/unit/lease/session-lease-proof.spec.js

@@ -179,6 +179,8 @@ describe('createSession — a lease-bound session proves it holds the lease', ()
         teamRows = sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([]);
         sinon_1.default.stub(device_store_1.DeviceStoreFactory, 'getStore').returns({
             findDevice: sinon_1.default.stub().callsFake(() => __awaiter(void 0, void 0, void 0, function* () { return device; })),
+            // The lease branch records the session's newCommandTimeout on the row.
+            updateDevice: sinon_1.default.stub().resolves(),
         });
         sinon_1.default.stub(pendingSessions, 'addNewPendingSession').callsFake((c) => __awaiter(void 0, void 0, void 0, function* () {
             pendingCopy = JSON.parse(JSON.stringify(c));
@@ -257,6 +259,63 @@ describe('createSession — a lease-bound session proves it holds the lease', ()
         (0, chai_1.expect)(findById.calledOnce).to.equal(true);
         (0, chai_1.expect)(teamRows.calledOnce).to.equal(true);
     }));
+    describe('the platform allocation lock', () => {
+        // Ordinary creates queue on it, first come first served, each with its
+        // full wait from the head of the queue. A lease-bound create allocates
+        // nothing and used to queue behind them anyway, for up to their wait.
+        const plainCaps = () => {
+            const caps = sessionCaps(ownerKey);
+            delete caps.alwaysMatch['xe:options'].leaseId;
+            return caps;
+        };
+        const tick = (ms) => new Promise((r) => setTimeout(r, ms));
+        it("doesn't make a lease-bound create queue behind one waiting for a phone", () => __awaiter(void 0, void 0, void 0, function* () {
+            const real = deviceUtils.allocateDeviceForSession;
+            let releaseWaiter = () => undefined;
+            sinon_1.default.stub(deviceUtils, 'allocateDeviceForSession').callsFake(((c, ...rest) => {
+                var _a;
+                return ((_a = c.alwaysMatch['xe:options']) === null || _a === void 0 ? void 0 : _a.leaseId)
+                    ? real(c, ...rest)
+                    : new Promise((resolve) => {
+                        releaseWaiter = resolve;
+                    });
+            }));
+            const waiting = create(plainCaps());
+            let leased = Promise.resolve();
+            try {
+                yield tick(50);
+                let leasedDone = false;
+                leased = create(sessionCaps(ownerKey)).then(() => {
+                    leasedDone = true;
+                });
+                yield Promise.race([leased, tick(2000)]);
+                (0, chai_1.expect)(leasedDone, 'the lease-bound create waited on the lock').to.equal(true);
+            }
+            finally {
+                // Free the platform lock even when this fails, and let both creates
+                // finish here, or they run on into the next test.
+                releaseWaiter(device);
+                yield waiting;
+                yield leased;
+            }
+        }));
+        it('still queues ordinary creates one at a time', () => __awaiter(void 0, void 0, void 0, function* () {
+            const waiters = [];
+            const allocate = sinon_1.default
+                .stub(deviceUtils, 'allocateDeviceForSession')
+                .callsFake((() => new Promise((resolve) => waiters.push(resolve))));
+            const first = create(plainCaps());
+            const second = create(plainCaps());
+            yield tick(100);
+            (0, chai_1.expect)(allocate.callCount, 'the second create allocated before the first finished').to.equal(1);
+            waiters[0](device);
+            yield first;
+            yield tick(50);
+            (0, chai_1.expect)(allocate.callCount).to.equal(2);
+            waiters[1](device);
+            yield second;
+        }));
+    });
     it('a session that names a lease reads them once too, for the scope and the lease', () => __awaiter(void 0, void 0, void 0, function* () {
         const findById = sinon_1.default.spy(typedi_1.Container.get(UserService_1.UserService), 'findById');
         yield allowed(sessionCaps(ownerKey));