@xenon-device-management/xenon 2.13.1 → 2.14.0

package/lib/src/services/ServerManager.js

@@ -71,15 +71,19 @@ const LogcatStreamService_1 = require("../device-managers/android/LogcatStreamSe
 const IOSLogStreamService_1 = require("../device-managers/ios/IOSLogStreamService");
 const logSource_1 = require("./logcat/logSource");
 const SessionOwnerResolver_1 = require("./device-access/SessionOwnerResolver");
+const activeLeases_1 = require("./lease/activeLeases");
 const ticketActorAccess_1 = require("./device-access/ticketActorAccess");
 // enable resolveJsonModule in tsconfig must be true for this to work
 const package_json_1 = __importDefault(require("../../package.json"));
 const IPluginArgs_1 = require("../interfaces/IPluginArgs");
 const config_service_1 = require("../data-service/config-service");
 const PluginContext_1 = require("../PluginContext");
+const SelfHealingSwitch_1 = require("./settings/SelfHealingSwitch");
 const device_store_1 = require("../data-service/device-store");
 const device_utils_1 = require("../device-utils");
 const localDeviceHosts_1 = require("../device-managers/localDeviceHosts");
+const deviceSettings_1 = require("../data-service/deviceSettings");
+const PhoneNetworkRestore_1 = require("./network/PhoneNetworkRestore");
 const app_1 = require("../app");
 const registerCommandAuth_1 = require("../app/registerCommandAuth");
 const defaultGateway_1 = require("../gateway/defaultGateway");
@@ -128,10 +132,14 @@ let ServerManager = ServerManager_1 = class ServerManager {
                 this.logger.warn('Authentication is DISABLED — every /xenon/api caller is treated as a ' +
                     'synthetic SUPER_ADMIN. Local development only.');
             }
+            this.applyRecordingOptions(pluginArgs);
             yield this.syncDatabaseAndAIConfig(pluginArgs);
             yield this.initializeCoreSubsystems(pluginArgs, cliArgs.port);
             // Before anything below starts go-ios: the reap would kill it too.
             yield this.reapLeftoverGoIos();
+            // The Settings page's AI self-healing toggle, which the command interceptor
+            // reads from memory at every command: load it before a command can arrive.
+            yield typedi_1.Container.get(SelfHealingSwitch_1.SelfHealingSwitch).load();
             this.registerRoutes(expressApp, httpServer, cliArgs, pluginArgs);
             yield this.bootEmulators(pluginArgs);
             this.registerDependenciesInContainer(pluginArgs, cliArgs, nodeId);
@@ -169,6 +177,8 @@ let ServerManager = ServerManager_1 = class ServerManager {
                     authorize: (0, ticketActorAccess_1.makeTicketActorAuthorizer)({
                         findDevice: (udid) => device_store_1.DeviceStoreFactory.getStore().findDevice({ udid }),
                         resolveSessionOwner: (sessionId) => typedi_1.Container.get(SessionOwnerResolver_1.SessionOwnerResolver).ownerOf(sessionId),
+                        findActiveLease: (udid, host) => (0, activeLeases_1.activeLeaseOn)(udid, host),
+                        resolveLeaseHolder: (actorId) => typedi_1.Container.get(SessionOwnerResolver_1.SessionOwnerResolver).leaseHolderOf(actorId),
                     }),
                     // One WebSocket, two transports. The device's platform picks which —
                     // see resolveLogSource. The filter is only meaningful for ostrace,
@@ -255,6 +265,9 @@ let ServerManager = ServerManager_1 = class ServerManager {
             yield (0, device_utils_1.updateDeviceList)(localHosts, pluginArgs.hub, pluginArgs.tlsRejectUnauthorized);
             // remove stale devices
             yield (0, device_utils_1.removeStaleDevices)(localHosts, pluginArgs.tlsRejectUnauthorized);
+            // In the background: put back the network a previous run left changed on
+            // this server's phones (an Offline profile, an interceptor proxy).
+            void this.cleanUpPhoneNetworks(localHosts, nodeId);
             this.logger.info(`🚀 Xenon will be served at http://${pluginArgs.bindHostOrIp}:${cliArgs.port}/xenon with id ${nodeId}`);
             this.logger.info('You can provide the following URLs to access Xenon:');
             for (const url of (0, networkAddresses_1.listReachableBaseUrls)(cliArgs.port)) {
@@ -263,6 +276,29 @@ let ServerManager = ServerManager_1 = class ServerManager {
             }
         });
     }
+    /**
+     * What a previous run of this server left on its phones' network: the
+     * changes its ledger holds, and on this server's own Android phones a proxy
+     * that points at a capture port of this machine where nothing answers.
+     * Each change is logged. A phone not connected now is put back at its next
+     * session here, or at the next start.
+     */
+    cleanUpPhoneNetworks(localHosts, nodeId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            try {
+                const devices = yield device_store_1.DeviceStoreFactory.getStore().getAllDevices();
+                const androids = devices
+                    .filter((d) => { var _a; return ((_a = d.platform) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'android' && !d.cloud; })
+                    .filter((d) => (0, localDeviceHosts_1.isOwnDevice)(localHosts, nodeId, d))
+                    .map((d) => d.udid);
+                yield typedi_1.Container.get(PhoneNetworkRestore_1.PhoneNetworkRestore).cleanUpAtBoot([...new Set(androids)]);
+            }
+            catch (err) {
+                this.logger.warn(`Could not check the phones' network settings: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
+            }
+        });
+    }
     resolvePluginArgs(cliArgs) {
         return __awaiter(this, void 0, void 0, function* () {
             const pluginConfigs = cliArgs.plugin;
@@ -287,6 +323,24 @@ let ServerManager = ServerManager_1 = class ServerManager {
             return pluginArgs;
         });
     }
+    /**
+     * `maxConcurrentRecordings` and `recordingsAssetsPath` are schema options,
+     * but only their environment variables ever reached `config`. Apply the
+     * options now (option, else the variable, else the default) before the
+     * artifact store is built from the path and the recordings router first
+     * reads the cap. See `recordingConfigFrom`.
+     */
+    applyRecordingOptions(pluginArgs) {
+        const envCap = process.env.XENON_MAX_CONCURRENT_RECORDINGS;
+        const applied = (0, config_1.recordingConfigFrom)(pluginArgs);
+        if (pluginArgs.maxConcurrentRecordings === undefined &&
+            (envCap === null || envCap === void 0 ? void 0 : envCap.trim()) &&
+            Number(envCap) !== applied.maxConcurrentRecordings) {
+            this.logger.warn(`Ignoring XENON_MAX_CONCURRENT_RECORDINGS=${JSON.stringify(envCap)}: ` +
+                `it must be a whole number of at least 1. The cap is ${applied.maxConcurrentRecordings}.`);
+        }
+        (0, config_1.updateConfig)(applied);
+    }
     syncDatabaseAndAIConfig(pluginArgs) {
         return __awaiter(this, void 0, void 0, function* () {
             const { updateConfig } = yield Promise.resolve().then(() => __importStar(require('../config')));
@@ -331,11 +385,15 @@ let ServerManager = ServerManager_1 = class ServerManager {
     }
     initializeCoreSubsystems(pluginArgs, port) {
         return __awaiter(this, void 0, void 0, function* () {
+            // Before anything opens the database: the URL must suit the database
+            // client this install was built with (SQLite for the published plugin).
+            const { assertSupportedDatabase } = yield Promise.resolve().then(() => __importStar(require('../scripts/database-check')));
+            assertSupportedDatabase();
             yield (0, device_utils_1.initializeStorage)();
             const { runMigrations } = yield Promise.resolve().then(() => __importStar(require('../scripts/run-migrations')));
             yield runMigrations();
             // A hub keeps its nodes' phones: the sessions on them outlive its restart.
-            yield device_store_1.DeviceStoreFactory.getStore().clearStorage((0, localDeviceHosts_1.devicesClearedAtBoot)(pluginArgs, (0, localDeviceHosts_1.localDeviceHosts)(pluginArgs, port)));
+            yield (0, deviceSettings_1.resetDevicesAtBoot)(device_store_1.DeviceStoreFactory.getStore(), pluginArgs, (0, localDeviceHosts_1.localDeviceHosts)(pluginArgs, port));
             const { bootstrapIdentity } = yield Promise.resolve().then(() => __importStar(require('./identity/bootstrap')));
             yield bootstrapIdentity();
             typedi_1.Container.get(EmailService_1.EmailService).warnIfLogFallbackEnabled();
@@ -414,16 +472,47 @@ let ServerManager = ServerManager_1 = class ServerManager {
                 `${router.describeAppiumPath()}.`);
         }
     }
+    /**
+     * Boot the emulators `emulators` lists, with each one's launch options.
+     *
+     * An iOS-only server, or one told to use real Android devices only
+     * (`androidDeviceType: real`, which discovery would then ignore them for),
+     * boots none. Anything else boots them, `platform: both` included: it used
+     * to boot only when `platform` named Android, so with the default it did
+     * nothing. A boot that fails is logged and the rest go on: an emulator that
+     * won't start must not keep the server from coming up with the phones it
+     * has, and with `both` counted this step now runs on many more servers.
+     */
     bootEmulators(pluginArgs) {
         return __awaiter(this, void 0, void 0, function* () {
-            if (pluginArgs.emulators &&
-                pluginArgs.emulators.length > 0 &&
-                pluginArgs.platform.toLowerCase().includes('android')) {
-                this.logger.info('Emulators will be booted!!');
-                const adb = yield appium_adb_1.ADB.createADB({});
-                const array = pluginArgs.emulators || [];
-                yield Promise.all(array.map((arr) => adb.launchAVD(arr.avdName, arr)));
+            const emulators = pluginArgs.emulators || [];
+            if (emulators.length === 0)
+                return;
+            const platform = String(pluginArgs.platform).toLowerCase();
+            if (platform === 'ios') {
+                this.logger.warn(`Not booting the ${emulators.length} configured emulator(s): platform is ios.`);
+                return;
+            }
+            if (pluginArgs.androidDeviceType === 'real') {
+                this.logger.warn(`Not booting the ${emulators.length} configured emulator(s): androidDeviceType is real.`);
+                return;
             }
+            this.logger.info(`Booting ${emulators.length} configured emulator(s)...`);
+            let adb;
+            try {
+                adb = yield appium_adb_1.ADB.createADB({});
+            }
+            catch (err) {
+                this.logger.warn(`Not booting the configured emulators: no usable adb (${err === null || err === void 0 ? void 0 : err.message}).`);
+                return;
+            }
+            const results = yield Promise.allSettled(emulators.map((emulator) => adb.launchAVD(emulator.avdName, emulator)));
+            results.forEach((result, index) => {
+                var _a, _b;
+                if (result.status === 'rejected') {
+                    this.logger.warn(`Could not boot emulator ${emulators[index].avdName}: ${(_b = (_a = result.reason) === null || _a === void 0 ? void 0 : _a.message) !== null && _b !== void 0 ? _b : result.reason}`);
+                }
+            });
         });
     }
     registerDependenciesInContainer(pluginArgs, cliArgs, nodeId) {

package/lib/src/services/SessionLifecycleService.js

@@ -98,6 +98,8 @@ const SessionStatus_1 = require("../types/SessionStatus");
 const SessionType_1 = __importDefault(require("../enums/SessionType"));
 const async_lock_1 = __importDefault(require("async-lock"));
 const base_driver_1 = require("@appium/base-driver");
+const PhoneNetworkRestore_1 = require("./network/PhoneNetworkRestore");
+const interceptorOptions_1 = require("./interceptor/interceptorOptions");
 /**
  * How long the hub waits for a node (or cloud provider) to create a session.
  * A create is sent once (InternalRequestConfig `retry: false`): the node may
@@ -222,9 +224,7 @@ let SessionLifecycleService = class SessionLifecycleService {
                 // Who asked, for the queue's team scoping (queueVisibility). On this row
                 // only, never in `caps`, and last so a client can't supply its own.
                 [queueVisibility_1.REQUESTER_KEY]: authResult.requester }));
-            const lockName = this.getLockName(caps);
-            this.logger.debug(`📱 Acquiring lock: ${lockName}`);
-            const device = yield commandsQueueGuard.acquire(lockName, () => __awaiter(this, void 0, void 0, function* () {
+            const allocate = () => __awaiter(this, void 0, void 0, function* () {
                 var _a;
                 try {
                     return yield (0, device_utils_1.allocateDeviceForSession)(caps, pluginArgs.deviceAvailabilityTimeoutMs, pluginArgs.deviceAvailabilityQueryIntervalMs, pluginArgs, sessionTeamIds, {
@@ -238,7 +238,21 @@ let SessionLifecycleService = class SessionLifecycleService {
                     yield (0, pending_sessions_service_1.removePendingSession)(pendingSessionId);
                     throw err;
                 }
-            }));
+            });
+            // Creates for a platform queue on one lock, first come first served, and
+            // each has its full deviceAvailabilityTimeoutMs from the head of the
+            // queue. A lease-bound session allocates nothing (its phone is the
+            // lease's) and doesn't queue: behind the lock it waited for every create
+            // ahead of it, each of which may wait minutes for a busy phone.
+            let device;
+            if ((0, leaseSessionCaps_1.leaseIdOf)(caps)) {
+                device = yield allocate();
+            }
+            else {
+                const lockName = this.getLockName(caps);
+                this.logger.debug(`📱 Acquiring lock: ${lockName}`);
+                device = yield commandsQueueGuard.acquire(lockName, allocate);
+            }
             yield (0, device_service_1.updateDeviceProgress)(device.udid, device.host, 'Allocating node resources...');
             this.logger.debug(`device.host: ${device.host} and pluginArgs.bindHostOrIp: ${pluginArgs.bindHostOrIp}`);
             const allocation = {
@@ -865,26 +879,11 @@ let SessionLifecycleService = class SessionLifecycleService {
     applyPostSessionLogic(session, caps, device) {
         return __awaiter(this, void 0, void 0, function* () {
             const context = typedi_1.Container.get(PluginContext_1.PluginContext);
-            const networkProfile = caps[XenonCapabilityManager_1.XENON_CAPABILITIES.NETWORK_PROFILE];
-            if (networkProfile) {
-                const { NetworkConditioningService } = yield Promise.resolve().then(() => __importStar(require('./NetworkConditioningService')));
-                yield typedi_1.Container.get(NetworkConditioningService).applyProfile(session.getId(), device, networkProfile);
-            }
-            if (caps[XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_ENABLED]) {
-                try {
-                    const { InterceptorService } = yield Promise.resolve().then(() => __importStar(require('./InterceptorService')));
-                    yield typedi_1.Container.get(InterceptorService).start(session.getId(), device, {
-                        enabled: true,
-                        bufferSize: caps[XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_BUFFER_SIZE],
-                        captureBodies: caps[XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_CAPTURE_BODIES] !== false,
-                        mocks: caps[XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_MOCKS] || [],
-                        includeHosts: caps[XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_INCLUDE_HOSTS] || [],
-                        excludeHosts: caps[XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_EXCLUDE_HOSTS] || [],
-                    });
-                }
-                catch (err) {
-                    this.logger.warn(`🕸️ Failed to start interceptor for ${session.getId()}: ${err.message}`);
-                }
+            // Only the server that drives the phone changes its network: a node
+            // applies its own sessions' profile and interceptor, and a hub that did
+            // it too ran its own adb against the node's phone.
+            if (session.getType() === SessionType_1.default.LOCAL) {
+                yield this.applySessionNetwork(session.getId(), caps, device, context.pluginArgs);
             }
             const isDashboardEnabled = !!context.pluginArgs.enableDashboard;
             const shouldSaveLogs = session.getType() !== SessionType_1.default.CLOUD;
@@ -918,6 +917,36 @@ let SessionLifecycleService = class SessionLifecycleService {
             }
         });
     }
+    /**
+     * The session's network profile and network capture, on a phone this
+     * server drives. First what an earlier session left on the phone and
+     * couldn't put back is undone, so this session starts from the phone's own
+     * settings and records those as the ones to put back. Each ending undoes
+     * these through PhoneNetworkRestore.
+     */
+    applySessionNetwork(sessionId, caps, device, pluginArgs) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (((_a = device.platform) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'android') {
+                yield typedi_1.Container.get(PhoneNetworkRestore_1.PhoneNetworkRestore).restoreLeftovers({ udid: device.udid });
+            }
+            const networkProfile = caps[XenonCapabilityManager_1.XENON_CAPABILITIES.NETWORK_PROFILE];
+            if (networkProfile) {
+                const { NetworkConditioningService } = yield Promise.resolve().then(() => __importStar(require('./NetworkConditioningService')));
+                yield typedi_1.Container.get(NetworkConditioningService).applyProfile(sessionId, device, networkProfile);
+            }
+            const interceptor = (0, interceptorOptions_1.resolveInterceptorOptions)(caps, pluginArgs.interceptor);
+            if (interceptor.enabled) {
+                try {
+                    const { InterceptorService } = yield Promise.resolve().then(() => __importStar(require('./InterceptorService')));
+                    yield typedi_1.Container.get(InterceptorService).start(sessionId, device, interceptor);
+                }
+                catch (err) {
+                    this.logger.warn(`🕸️ Failed to start interceptor for ${sessionId}: ${err.message}`);
+                }
+            }
+        });
+    }
     /**
      * The row a hub keeps for a session it routes to a node or a cloud when the
      * dashboard's own (onSessionStarted) isn't written: with the dashboard off,
@@ -1085,6 +1114,10 @@ let SessionLifecycleService = class SessionLifecycleService {
             // which releases ports and archives video twice.
             if (sessionId) {
                 yield sessionCleanupLock.acquire(sessionId, () => __awaiter(this, void 0, void 0, function* () {
+                    // The phone's network (profile, interceptor proxy) and the capture,
+                    // before the phone is released to the next session. Whether or not
+                    // SESSION_MANAGER holds the session.
+                    yield typedi_1.Container.get(PhoneNetworkRestore_1.PhoneNetworkRestore).restoreSession(sessionId, 'session deleted');
                     yield (0, device_service_1.releaseSessionDevices)(sessionId);
                     this.logger.info(`📱 Unblocking the device that is blocked for session ${sessionId}`);
                     const session = SessionManager_1.SESSION_MANAGER.getSession(sessionId);
@@ -1125,37 +1158,10 @@ let SessionLifecycleService = class SessionLifecycleService {
                             // Another concurrent deleteSession already cleaned up.
                             return;
                         }
-                        const device = session.getDevice();
-                        try {
-                            const { NetworkConditioningService } = yield Promise.resolve().then(() => __importStar(require('./NetworkConditioningService')));
-                            yield typedi_1.Container.get(NetworkConditioningService).reset(sessionId, device);
-                        }
-                        catch (resetErr) {
-                            this.logger.warn(`⚠️ NetworkConditioningService.reset failed for session ${sessionId}: ${resetErr.message}`);
-                        }
-                        try {
-                            const { InterceptorService } = yield Promise.resolve().then(() => __importStar(require('./InterceptorService')));
-                            const interceptor = typedi_1.Container.get(InterceptorService);
-                            if (interceptor.isActive(sessionId))
-                                yield interceptor.stop(sessionId);
-                        }
-                        catch (interceptorErr) {
-                            this.logger.warn(`⚠️ InterceptorService.stop failed for session ${sessionId}: ${interceptorErr.message}`);
-                        }
+                        // The phone's network was put back before it was released (above).
                         yield event_manager_1.DASHBORD_EVENT_MANAGER.onSessionStopped(sessionId, status, reason);
                         SessionManager_1.SESSION_MANAGER.removeSession(sessionId);
                         typedi_1.Container.get(hubSessionToken_1.HubSessionTokenIssuer).forget(sessionId);
-                        try {
-                            const { getSessionById } = yield Promise.resolve().then(() => __importStar(require('../dashboard/services/session-service')));
-                            const sessionData = yield getSessionById(sessionId);
-                            if (sessionData && (sessionData.status === 'failed' || sessionData.failure_reason)) {
-                                const { NotificationService } = yield Promise.resolve().then(() => __importStar(require('./NotificationService')));
-                                yield typedi_1.Container.get(NotificationService).dispatchEvent('session_failed', sessionData);
-                            }
-                        }
-                        catch (err) {
-                            /* ignore notification errors */
-                        }
                     }));
                 }
             }
@@ -1228,6 +1234,7 @@ let SessionLifecycleService = class SessionLifecycleService {
     stopSessionForShutdown(sessionId, reason) {
         return __awaiter(this, void 0, void 0, function* () {
             yield sessionCleanupLock.acquire(sessionId, () => __awaiter(this, void 0, void 0, function* () {
+                yield typedi_1.Container.get(PhoneNetworkRestore_1.PhoneNetworkRestore).restoreSession(sessionId, reason);
                 try {
                     yield (0, device_service_1.releaseSessionDevices)(sessionId);
                 }
@@ -1246,7 +1253,10 @@ let SessionLifecycleService = class SessionLifecycleService {
                     }
                 }
                 try {
-                    yield event_manager_1.DASHBORD_EVENT_MANAGER.onSessionStopped(sessionId, SessionStatus_1.SessionStatus.FAILED, reason);
+                    // A shutdown fails the sessions it drains; no test caused it, so no webhook.
+                    yield event_manager_1.DASHBORD_EVENT_MANAGER.onSessionStopped(sessionId, SessionStatus_1.SessionStatus.FAILED, reason, {
+                        notify: false,
+                    });
                 }
                 catch (err) {
                     this.logger.warn(`[shutdown] onSessionStopped failed for ${sessionId}: ${err.message}`);

package/lib/src/services/ShutdownCoordinator.js

@@ -24,6 +24,7 @@ const logger_1 = __importDefault(require("../logger"));
 const SessionManager_1 = require("../sessions/SessionManager");
 const SessionLifecycleService_1 = require("./SessionLifecycleService");
 const SessionType_1 = __importDefault(require("../enums/SessionType"));
+const PhoneNetworkRestore_1 = require("./network/PhoneNetworkRestore");
 // Graceful shutdown phase that runs BEFORE the existing infrastructure
 // teardown in index.ts:cleanup(). Active sessions get a bounded chance to
 // archive their video + release ports + mark themselves failed, so we don't
@@ -57,6 +58,7 @@ let ShutdownCoordinator = class ShutdownCoordinator {
             const sessions = SessionManager_1.SESSION_MANAGER.getAllSessions().filter((session) => session.getType() === SessionType_1.default.LOCAL);
             if (sessions.length === 0) {
                 this.logger.info('No active sessions to drain');
+                yield this.restorePhoneNetworks(timeoutMs);
                 return { attempted: 0, completed: 0 };
             }
             this.logger.info(`Draining ${sessions.length} active session(s) (overall=${timeoutMs}ms, per-session=${perSessionTimeoutMs}ms)`);
@@ -84,10 +86,41 @@ let ShutdownCoordinator = class ShutdownCoordinator {
             }));
             const results = yield Promise.allSettled(tasks);
             const completed = results.filter((r) => r.status === 'fulfilled' && r.value).length;
+            yield this.restorePhoneNetworks(Math.max(0, deadline - Date.now()));
             this.logger.info(`Drain complete: ${completed}/${sessions.length} session(s) finalized`);
             return { attempted: sessions.length, completed };
         });
     }
+    /**
+     * The network of every phone a session of this server still has changed
+     * (profile, interceptor proxy), sessions SESSION_MANAGER doesn't hold
+     * included, within what is left of the budget. A shutdown that never gets
+     * here (Appium exits on SIGTERM first) leaves it to the next start, from
+     * the ledger (PhoneNetworkRestore.cleanUpAtBoot).
+     */
+    restorePhoneNetworks(budgetMs) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (budgetMs <= 0)
+                return;
+            let timer;
+            try {
+                yield Promise.race([
+                    typedi_1.Container.get(PhoneNetworkRestore_1.PhoneNetworkRestore).restoreAll('Xenon is shutting down'),
+                    new Promise((resolve) => {
+                        timer = setTimeout(resolve, budgetMs);
+                    }),
+                ]);
+            }
+            catch (err) {
+                this.logger.warn(`[shutdown] Putting phone networks back failed: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+            }
+        });
+    }
 };
 exports.ShutdownCoordinator = ShutdownCoordinator;
 exports.ShutdownCoordinator = ShutdownCoordinator = __decorate([

package/lib/src/services/TeamService.js

@@ -52,20 +52,37 @@ let TeamService = class TeamService {
     delete(id) {
         return __awaiter(this, void 0, void 0, function* () {
             // Apps too: App.teamId is onDelete SetNull, so deleting a team that owns
-            // apps would quietly share them with every member.
-            const [devices, members, apps] = yield Promise.all([
+            // apps would quietly share them with every member. So is a phone's saved
+            // team (DeviceSetting): a phone of the team that is not connected now
+            // would come back in the shared pool.
+            const [connected, saved, members, apps] = yield Promise.all([
                 prisma_1.prisma.device.count({ where: { teamId: id } }),
+                prisma_1.prisma.deviceSetting.findMany({ where: { teamId: id }, select: { udid: true, host: true } }),
                 prisma_1.prisma.teamMember.count({ where: { teamId: id } }),
                 prisma_1.prisma.app.count({ where: { teamId: id } }),
             ]);
+            const away = yield this.notConnected(saved);
+            const devices = connected + away;
             if (devices > 0 || members > 0 || apps > 0) {
-                throw new Error(`Team still has ${devices} device(s), ${members} member(s) and ${apps} app(s). Reassign them before deleting.`);
+                const phones = away > 0 ? `${devices} device(s) (${away} not connected now)` : `${devices} device(s)`;
+                throw new Error(`Team still has ${phones}, ${members} member(s) and ${apps} app(s). Reassign them before deleting.`);
             }
             // Clear teamId on any (revoked) ApiKey rows so the FK doesn't block delete.
             yield prisma_1.prisma.apiKey.updateMany({ where: { teamId: id }, data: { teamId: null } });
             yield prisma_1.prisma.team.delete({ where: { id } });
         });
     }
+    /** How many of these saved phones have no Device row: not connected now. */
+    notConnected(saved) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (saved.length === 0)
+                return 0;
+            const here = yield prisma_1.prisma.device.count({
+                where: { OR: saved.map(({ udid, host }) => ({ udid, host })) },
+            });
+            return saved.length - here;
+        });
+    }
     listMembers(teamId) {
         return __awaiter(this, void 0, void 0, function* () {
             const rows = yield prisma_1.prisma.teamMember.findMany({

package/lib/src/services/device-access/SessionOwnerResolver.js

@@ -46,9 +46,34 @@ let SessionOwnerResolver = class SessionOwnerResolver {
         this.db = db;
         this.ownerCache = new Map();
         this.nameCache = new Map();
+        this.leaseHolderCache = new Map();
         /** The owners of this server's live sessions. A field, not a constructor parameter: TypeDI. */
         this.liveOwners = () => typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners);
     }
+    /**
+     * The user behind a lease's `actorId`: the owner of the API key that
+     * created it, or, for a lease made with a bearer token, the user id itself.
+     * Positive results are cached, as for sessions: a lease's creator never
+     * changes.
+     */
+    leaseHolderOf(actorId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (!actorId)
+                return null;
+            const cached = this.leaseHolderCache.get(actorId);
+            if (cached)
+                return cached;
+            const key = yield this.db.apiKey.findUnique({
+                where: { id: actorId },
+                select: { userId: true },
+            });
+            const holder = key ? ((_a = key.userId) !== null && _a !== void 0 ? _a : null) : actorId;
+            if (holder)
+                this.remember(this.leaseHolderCache, actorId, holder);
+            return holder;
+        });
+    }
     ownerOf(sessionId) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a, _b;
@@ -165,6 +190,7 @@ let SessionOwnerResolver = class SessionOwnerResolver {
     clear() {
         this.ownerCache.clear();
         this.nameCache.clear();
+        this.leaseHolderCache.clear();
     }
     remember(cache, key, value) {
         if (cache.size >= MAX_CACHE_ENTRIES)

package/lib/src/services/device-access/deviceAccessPolicy.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isSelfManualLock = isSelfManualLock;
 exports.isOwnSession = isOwnSession;
+exports.isLeaseHolder = isLeaseHolder;
 exports.evaluateDeviceAccess = evaluateDeviceAccess;
 exports.ownershipUnavailableBody = ownershipUnavailableBody;
 exports.denyBody = denyBody;
@@ -23,10 +24,39 @@ function isOwnSession(sessionOwnerUserId, actorUserId) {
     const owner = sessionOwnerUserId !== null && sessionOwnerUserId !== void 0 ? sessionOwnerUserId : '';
     return !!(owner && actorUserId && owner === actorUserId);
 }
+/**
+ * True when the caller holds the lease: by the key that created it, or as
+ * the user behind it (any credential of theirs, the dashboard included), as
+ * ownership is keyed on the user everywhere else.
+ */
+function isLeaseHolder(lease, actorUserId, actorApiKeyId) {
+    if (!lease)
+        return false;
+    if (actorApiKeyId && lease.actorId === actorApiKeyId)
+        return true;
+    return !!actorUserId && (lease.actorId === actorUserId || lease.holderUserId === actorUserId);
+}
 function evaluateDeviceAccess(input) {
-    var _a;
+    var _a, _b;
     if (input.isAdmin)
         return ALLOW;
+    if (input.lease) {
+        if (isLeaseHolder(input.lease, input.actorUserId, input.actorApiKeyId))
+            return ALLOW;
+        // A session on a leased phone proved it may use the lease; its owner
+        // keeps driving it, as with any session of their own.
+        if (input.sessionId &&
+            !(0, manualLock_1.isManualLock)(input.sessionId) &&
+            isOwnSession(input.sessionOwnerUserId, input.actorUserId)) {
+            return ALLOW;
+        }
+        return {
+            allow: false,
+            code: 'device_held_by_another_user',
+            holderId: (_a = input.lease.holderUserId) !== null && _a !== void 0 ? _a : '',
+            heldBy: 'lease',
+        };
+    }
     if (!input.busy)
         return ALLOW;
     const asUser = (0, manualLock_1.inspectManualLock)(input.sessionId, input.actorUserId, input.udid);
@@ -42,7 +72,7 @@ function evaluateDeviceAccess(input) {
     }
     // Not a manual lock: a real Appium session holds the device (or the row is
     // busy with no id at all, which is an inconsistent state we fail closed on).
-    const owner = (_a = input.sessionOwnerUserId) !== null && _a !== void 0 ? _a : '';
+    const owner = (_b = input.sessionOwnerUserId) !== null && _b !== void 0 ? _b : '';
     if (isOwnSession(input.sessionOwnerUserId, input.actorUserId))
         return ALLOW;
     return { allow: false, code: 'device_in_use_by_session', holderId: owner };
@@ -62,11 +92,13 @@ function ownershipUnavailableBody() {
         message: 'Could not verify device ownership. Try again.',
     };
 }
-function denyBody(code, holderId, holderName) {
+function denyBody(code, holderId, holderName, heldBy) {
     const who = holderName || 'another user';
-    const message = code === 'device_held_by_another_user'
-        ? `Device is being controlled by ${who}. Ask them to release it, or use an admin key to force-release.`
-        : `Device is in use by an Appium session owned by ${who}.`;
+    const message = heldBy === 'lease'
+        ? `Device is leased by ${who} through the SDK. It is free again when their lease ends.`
+        : code === 'device_held_by_another_user'
+            ? `Device is being controlled by ${who}. Ask them to release it, or use an admin key to force-release.`
+            : `Device is in use by an Appium session owned by ${who}.`;
     return {
         success: false,
         error: code,

package/lib/src/services/device-access/leaseHold.js

@@ -0,0 +1,26 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.leaseHoldFor = leaseHoldFor;
+/**
+ * The lease hold on a device row for an ownership decision, or null. Throws
+ * when either lookup does: the caller fails closed.
+ */
+function leaseHoldFor(device, findActiveLease, resolveLeaseHolder) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (!(device === null || device === void 0 ? void 0 : device.udid) || !device.host)
+            return null;
+        const lease = yield findActiveLease(device.udid, device.host);
+        if (!lease)
+            return null;
+        return { actorId: lease.actorId, holderUserId: yield resolveLeaseHolder(lease.actorId) };
+    });
+}

package/lib/src/services/device-access/ticketActorAccess.js

@@ -13,6 +13,7 @@ exports.makeTicketActorAuthorizer = makeTicketActorAuthorizer;
 const manualLock_1 = require("../recording/manualLock");
 const deviceAccessPolicy_1 = require("./deviceAccessPolicy");
 const deviceClaims_1 = require("../../data-service/deviceClaims");
+const leaseHold_1 = require("./leaseHold");
 /**
  * Build the ownership check for a caller authenticated by a stream ticket.
  *
@@ -53,6 +54,10 @@ function makeTicketActorAuthorizer(deps) {
             const sessionOwnerUserId = device.busy && device.session_id && !(0, manualLock_1.isManualLock)(device.session_id)
                 ? yield deps.resolveSessionOwner(device.session_id)
                 : null;
+            // As deviceAccessGuard: a leased phone is its lease holder's.
+            const lease = deps.findActiveLease && deps.resolveLeaseHolder && !actor.isAdmin
+                ? yield (0, leaseHold_1.leaseHoldFor)({ udid, host: device.host }, deps.findActiveLease, deps.resolveLeaseHolder)
+                : null;
             return (0, deviceAccessPolicy_1.evaluateDeviceAccess)({
                 udid,
                 // heldHere, as deviceAccessGuard reads it.
@@ -63,6 +68,7 @@ function makeTicketActorAuthorizer(deps) {
                 actorUserId: actor.actorId,
                 actorApiKeyId: actor.apiKeyId,
                 isAdmin: !!actor.isAdmin,
+                lease,
             }).allow;
         });
     };