@xenon-device-management/xenon 2.13.2 → 2.15.0

package/lib/src/interceptors/xenonScripts.js

@@ -0,0 +1,55 @@
+"use strict";
+/**
+ * Xenon's execute scripts: `driver.execute('xenon: <name>', ...)`, or `xe:`.
+ *
+ * Who answers them:
+ * - The five session-details commands (SESSION_DETAILS_COMMANDS in
+ *   dashboard/commands.ts) are answered by the server that keeps the
+ *   session's record: a hub, for a session on a node's phone, when its
+ *   dashboard is on (its gateway's before-hook), otherwise the server that
+ *   drives the phone.
+ * - Every other one is answered by the server that drives the phone
+ *   (CommandInterceptor), because that is where the session's autowait
+ *   settings, Omni-Vision and network capture live. A hub forwards them.
+ * - A name Xenon doesn't have fails with `unknown command`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XENON_SCRIPT_NAMES = void 0;
+exports.xenonScriptName = xenonScriptName;
+exports.unknownXenonScriptMessage = unknownXenonScriptMessage;
+/** The names CommandInterceptor and the session-details commands answer. Keep in step with both. */
+exports.XENON_SCRIPT_NAMES = [
+    'setAutowaitProperties',
+    'getAutowaitProperties',
+    'smartTap',
+    'omniClick',
+    'visualTap',
+    'uiInventory',
+    'uiScanExport',
+    'analyzeScreen',
+    'omniScan',
+    'assertVisualState',
+    'addMock',
+    'removeMock',
+    'clearMocks',
+    'getMocks',
+    'getRequests',
+    'exportHar',
+    'setSessionName',
+    'setSessionStatus',
+    'debug',
+    'addTag',
+    'captureEvidence',
+];
+/** The name in a `xenon: <name>` or `xe: <name>` script, or null for any other script. */
+function xenonScriptName(script) {
+    if (typeof script !== 'string')
+        return null;
+    const match = /^\s*(?:xenon|xe)\s*:\s*(\S+)\s*$/.exec(script);
+    return match ? match[1] : null;
+}
+/** The message for a `xenon:` / `xe:` script Xenon doesn't have. */
+function unknownXenonScriptMessage(script) {
+    return (`Unknown Xenon command "${script.trim()}". ` +
+        `Xenon's execute commands are: ${exports.XENON_SCRIPT_NAMES.join(', ')}.`);
+}

package/lib/src/interfaces/IPluginArgs.js

@@ -30,7 +30,7 @@ exports.DefaultPluginArgs = {
     bindHostOrIp: 'auto',
     enableDashboard: false,
     bootedSimulators: false,
-    healthCheckIntervalMs: 86400000,
+    healthCheckIntervalMs: 300000,
     healthCheckSchedule: undefined,
     removeDevicesFromDatabaseBeforeRunningThePlugin: false,
     databaseProvider: undefined,
@@ -50,7 +50,6 @@ exports.DefaultPluginArgs = {
     recordingCleanupMaxCount: 100,
     recordingFailedCleanupDays: 2,
     sessionHeartbeatIntervalMs: 30000,
-    enableJsonLogging: false,
     autowait: {
         enabled: false,
         timeoutMs: 10000,

package/lib/src/middleware/authMiddleware.js

@@ -24,7 +24,13 @@ const PluginContext_1 = require("../PluginContext");
 const hubSessionToken_1 = require("../gateway/hubSessionToken");
 const localDeviceHosts_1 = require("../device-managers/localDeviceHosts");
 const SESSION_COOKIE = 'xenon_dashboard_session';
-const SESSION_TTL_MS = 24 * 60 * 60 * 1000;
+/** An API key's expiresAt as epoch ms, or undefined for a key that never expires. */
+function keyExpiresAt(expiresAt) {
+    if (!expiresAt)
+        return undefined;
+    const ms = new Date(expiresAt).getTime();
+    return Number.isNaN(ms) ? undefined : ms;
+}
 // Role → scopes derivation. The same table is used in profile token creation
 // to enforce that members can never grant 'admin'.
 // Cookie-session scopes: a logged-in user gets the full set of scopes
@@ -185,6 +191,7 @@ function authMiddleware(req, res, next) {
                 apiKeyId: row.id,
                 rateLimit: row.rateLimit,
                 teamIds,
+                credentialExpiresAt: keyExpiresAt(row.expiresAt),
             };
             req.apiKey = { id: row.id, scopes: row.scopes, rateLimit: row.rateLimit, teamId: (_b = row.teamId) !== null && _b !== void 0 ? _b : null };
             return next();
@@ -224,6 +231,7 @@ function authMiddleware(req, res, next) {
                     teamId: (_e = payload.teamId) !== null && _e !== void 0 ? _e : null,
                     rateLimit: 300,
                     teamIds,
+                    credentialExpiresAt: typeof payload.exp === 'number' ? payload.exp * 1000 : undefined,
                 };
                 return next();
             }
@@ -242,11 +250,14 @@ function authMiddleware(req, res, next) {
                 if (!user || user.status !== 'ACTIVE')
                     return res.status(401).json({ error: 'invalid session' });
                 const isSecure = req.secure || req.headers['x-forwarded-proto'] === 'https';
+                // Renewed for as long as the session row now lasts
+                // (XENON_USER_SESSION_TTL_MS). A fixed 24 hours here capped any longer
+                // setting: the browser dropped the cookie after a day away.
                 res.cookie(SESSION_COOKIE, cookie, {
                     httpOnly: true,
                     secure: isSecure,
                     sameSite: 'strict',
-                    maxAge: SESSION_TTL_MS,
+                    maxAge: userSessionSvc.ttlMs(),
                 });
                 const teamIds = yield (0, callerTeamIds_1.computeTeamIds)({
                     role: user.role,
@@ -279,7 +290,7 @@ function authMiddleware(req, res, next) {
                     httpOnly: true,
                     secure: isSecure,
                     sameSite: 'strict',
-                    maxAge: SESSION_TTL_MS,
+                    maxAge: userSessionSvc.ttlMs(),
                 });
                 const teamIds = yield (0, callerTeamIds_1.computeTeamIds)({
                     role: user.role,
@@ -295,6 +306,7 @@ function authMiddleware(req, res, next) {
                     apiKeyId: row.id,
                     rateLimit: row.rateLimit,
                     teamIds,
+                    credentialExpiresAt: keyExpiresAt(row.expiresAt),
                 };
                 req.apiKey = { id: row.id, scopes: row.scopes, rateLimit: row.rateLimit, teamId: (_g = row.teamId) !== null && _g !== void 0 ? _g : null };
                 return next();

package/lib/src/middleware/commandCaller.js

@@ -103,9 +103,9 @@ class CommandCallerVerifier {
             if (!out)
                 return null;
             // A Bearer token carries the scopes of the credential that minted it
-            // (/auth/token), so it is judged like a key. Judging it by role alone,
-            // as a xenon-session token is for leases, would let an ADMIN's ordinary
-            // key mint its way to an override.
+            // (/auth/token), so it is judged like a key. Judging it by role alone
+            // would let an ADMIN's ordinary key mint its way to an override, as a
+            // xenon-session token's lease override did through 2.14.
             return {
                 caller: {
                     userId: out.user.id,

package/lib/src/middleware/verifyCredential.js

@@ -42,9 +42,11 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ACCEPTED_BEARER_AUDIENCES = void 0;
+exports.SessionTokenSubjectError = exports.ACCEPTED_BEARER_AUDIENCES = void 0;
 exports.verifyKeyPairCredential = verifyKeyPairCredential;
 exports.verifyBearerCredential = verifyBearerCredential;
+exports.isWrongSessionToken = isWrongSessionToken;
+exports.verifySessionTokenCredential = verifySessionTokenCredential;
 const jose = __importStar(require("jose"));
 const typedi_1 = require("typedi");
 const ApiKeyService_1 = require("../services/ApiKeyService");
@@ -96,6 +98,12 @@ function verifyKeyPairCredential(accessKey, token) {
  * JWT) means the token is wrong. Any other error (typically "JWT key service
  * not initialized") means it could not be checked, and is rethrown once no
  * audience has verified.
+ *
+ * The payload's `scopes` are the token's as of now: `admin` is dropped once
+ * its user is a MEMBER. A token's scopes are fixed when it is minted, for up
+ * to a day, and REST (resolveActor, scopeGuard) and per-command auth's
+ * override read them, so through 2.14 an admin demoted since kept admin
+ * powers until the token expired.
  */
 function verifyBearerCredential(token) {
     return __awaiter(this, void 0, void 0, function* () {
@@ -119,6 +127,55 @@ function verifyBearerCredential(token) {
         const user = yield typedi_1.Container.get(UserService_1.UserService).findById(String(payload.sub));
         if (!user || user.status !== 'ACTIVE')
             return null;
+        return { payload: Object.assign(Object.assign({}, payload), { scopes: scopesForLiveRole(payload.scopes, user.role) }), user };
+    });
+}
+/** A token's `scopes` claim without `admin` when its user is now a MEMBER. */
+function scopesForLiveRole(scopes, role) {
+    const list = String(scopes !== null && scopes !== void 0 ? scopes : '')
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    if (role === 'ADMIN' || role === 'SUPER_ADMIN')
+        return list.join(',');
+    return list.filter((s) => s !== 'admin').join(',');
+}
+/** The subject of a session token is no longer an ACTIVE user (deleted or Inactive). */
+class SessionTokenSubjectError extends Error {
+    constructor() {
+        super('the session token names a user who is deleted or not active');
+        this.name = 'SessionTokenSubjectError';
+    }
+}
+exports.SessionTokenSubjectError = SessionTokenSubjectError;
+/**
+ * Whether verifySessionTokenCredential's error means the token is wrong (a
+ * bad signature, audience or lifetime, not a JWT, or a departed user), as
+ * opposed to a check that could not run (the signing key or the database
+ * unavailable). A wrong token counts as none; a check that could not run
+ * refuses the create, as a key whose owner can't be looked up does.
+ */
+function isWrongSessionToken(err) {
+    return err instanceof jose.errors.JOSEError || err instanceof SessionTokenSubjectError;
+}
+/**
+ * A `xenon-session` token (the `xe:options.sessionToken` capability), checked
+ * as REST checks a Bearer token: a valid signature, audience and lifetime,
+ * and a subject who is an ACTIVE user, looked up now. Through 2.14 session
+ * create checked the signature alone, so a deleted or Inactive user's token
+ * created sessions as them until it expired.
+ *
+ * Throws for a token that does not verify, as JwtKeyService.verify does, so
+ * the session-token gate and attribution treat a wrong signature and a
+ * departed user alike. Whether the token may create sessions at all (its
+ * `scopes`) is the caller's to judge.
+ */
+function verifySessionTokenCredential(token) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const payload = yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(token, { audience: 'xenon-session' });
+        const user = yield typedi_1.Container.get(UserService_1.UserService).findById(String(payload.sub));
+        if (!user || user.status !== 'ACTIVE')
+            throw new SessionTokenSubjectError();
         return { payload, user: user };
     });
 }

package/lib/src/plugin.js

@@ -66,22 +66,34 @@ const IPluginArgs_1 = require("./interfaces/IPluginArgs");
 const NodeDevices_1 = __importDefault(require("./device-managers/NodeDevices"));
 const appiumUmbrella_1 = require("./sessions/appiumUmbrella");
 const LiveSessionOwners_1 = require("./services/device-access/LiveSessionOwners");
+const sessionMemory_1 = require("./sessions/sessionMemory");
 const SessionMetricsService_1 = require("./services/metrics/SessionMetricsService");
+const PhoneNetworkRestore_1 = require("./services/network/PhoneNetworkRestore");
 const config_1 = require("./config");
 const SessionManager_1 = require("./sessions/SessionManager");
 const event_manager_1 = require("./dashboard/event-manager");
 const asset_manager_1 = require("./dashboard/asset-manager");
 const session_service_1 = require("./dashboard/services/session-service");
+const shutdownReason_1 = require("./services/session/shutdownReason");
 const DEVICE_MANAGER_LOCK_NAME = 'DeviceManager';
 class XenonPlugin extends base_plugin_1.default {
     constructor(pluginName, cliArgs) {
+        var _a;
         super(pluginName, cliArgs);
         this.xenonLog = logger_1.default.scope('Plugin');
         this.pluginArgs = Object.assign({}, IPluginArgs_1.DefaultPluginArgs);
         this.aiCommandService = typedi_1.Container.get(AICommandService_1.AICommandService);
         this.xenonLog.debug(`📱 Plugin Args: ${JSON.stringify(cliArgs)}`);
         this.pluginArgs = Object.assign({}, IPluginArgs_1.DefaultPluginArgs, this.cliArgs);
-        logger_1.XenonLogger.configure({ enableJsonLogging: this.pluginArgs.enableJsonLogging });
+        // The option as it was given, not the merged copy above: JSON logging is on
+        // when the option says so, or when it isn't given and XENON_JSON_LOGGING does.
+        // schema.json gives the option no default, so Appium leaves it out when
+        // nobody set it; a default here (the merge above used to add `false`) would
+        // overwrite the variable on every start. `configure` ignores undefined.
+        const jsonLogging = (_a = this.cliArgs) === null || _a === void 0 ? void 0 : _a.enableJsonLogging;
+        logger_1.XenonLogger.configure({
+            enableJsonLogging: typeof jsonLogging === 'boolean' ? jsonLogging : undefined,
+        });
         if ((0, networkAddresses_1.shouldAutoResolveBindHost)(this.pluginArgs.bindHostOrIp)) {
             this.pluginArgs.bindHostOrIp = (0, networkAddresses_1.resolveAdvertisedBindHost)(this.pluginArgs.bindHostOrIp);
         }
@@ -94,13 +106,18 @@ class XenonPlugin extends base_plugin_1.default {
             return yield typedi_1.Container.get(CommandInterceptor_1.CommandInterceptor).handle(next, driver, commandName, args, this.pluginArgs, XenonPlugin.IS_HUB);
         });
     }
-    onUnexpectedShutdown(driver, _cause) {
+    onUnexpectedShutdown(driver, cause) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
             const sessionId = driver.sessionId;
             typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners).forget(sessionId);
+            (0, sessionMemory_1.forgetSessionMemory)(sessionId);
             if (sessionId)
                 yield typedi_1.Container.get(SessionMetricsService_1.SessionMetricsService).stop(sessionId);
+            // Appium's new-command timeout ends a session here, not in deleteSession:
+            // the phone's network (profile, interceptor proxy) and the capture are
+            // put back before the phone is released.
+            yield typedi_1.Container.get(PhoneNetworkRestore_1.PhoneNetworkRestore).restoreSession(sessionId, 'driver shut down');
             const deviceFilter = {
                 session_id: sessionId ? sessionId : undefined,
                 udid: driver.caps && driver.caps.udid ? driver.caps.udid : undefined,
@@ -122,7 +139,9 @@ class XenonPlugin extends base_plugin_1.default {
             logger_1.default.info(`Unblocking device mapped with filter ${JSON.stringify(deviceFilter)} onUnexpectedShutdown from server`);
             if (XenonPlugin.IS_HUB && this.pluginArgs.enableDashboard && sessionId) {
                 const sessionLog = this.xenonLog.withSession(sessionId, (_a = driver.caps) === null || _a === void 0 ? void 0 : _a.udid);
-                sessionLog.info('Unexpected shutdown for session, updating dashboard...');
+                // Appium's cause, so an idle session is filed as a timeout.
+                const reason = (0, shutdownReason_1.unexpectedShutdownReason)(cause);
+                sessionLog.info(`Unexpected shutdown for session (${reason}), updating dashboard...`);
                 const session = SessionManager_1.SESSION_MANAGER.getSession(sessionId);
                 if (session && session.isVideoRecordingInProgress()) {
                     try {
@@ -140,7 +159,7 @@ class XenonPlugin extends base_plugin_1.default {
                         logger_1.default.debug(`[${sessionId}] rescue-video: Failed: ${err.message}`);
                     }
                 }
-                yield event_manager_1.DASHBORD_EVENT_MANAGER.onSessionStopped(sessionId, SessionStatus_1.SessionStatus.FAILED, 'Driver shut down unexpectedly');
+                yield event_manager_1.DASHBORD_EVENT_MANAGER.onSessionStopped(sessionId, SessionStatus_1.SessionStatus.FAILED, reason);
                 typedi_1.Container.get(TracingService_1.TracingService).endSpan(sessionId, 'ERROR', {
                     'xenon.session.stop_reason': 'Unexpected shutdown',
                 });

package/lib/src/prisma.js

@@ -33,7 +33,7 @@ exports.getPrismaClient = getPrismaClient;
  * can stub individual methods (Prisma's internal Proxy blocks property assignment).
  */
 const MODEL_DELEGATES = new Set([
-    'build', 'session', 'sessionLog', 'log', 'profiling', 'app', 'device',
+    'build', 'session', 'sessionLog', 'log', 'profiling', 'app', 'device', 'deviceSetting',
     'pendingSession', 'cLIArgs', 'webhookConfig', 'webConfig', 'locatorEtalon',
     'lease', 'portLease', 'apiKey', 'selectorState', 'user', 'userSession',
     'passwordResetToken', 'team', 'teamMember', 'eventLog', 'project', 'recording', 'bookmark',

package/lib/src/scripts/database-check.js

@@ -0,0 +1,124 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clientProviderFromSchema = clientProviderFromSchema;
+exports.describeDatabaseUrl = describeDatabaseUrl;
+exports.checkDatabase = checkDatabase;
+exports.assertSupportedDatabase = assertSupportedDatabase;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const logger_1 = __importDefault(require("../logger"));
+const config_1 = require("../config");
+const LABEL = { sqlite: 'SQLite', postgresql: 'PostgreSQL' };
+function providerOfUrl(url) {
+    if (url.startsWith('file:'))
+        return 'sqlite';
+    if (/^postgres(ql)?:\/\//.test(url))
+        return 'postgresql';
+    return null;
+}
+/** The datasource provider in a Prisma schema's text, or null if it has none. */
+function clientProviderFromSchema(schema) {
+    const match = /datasource\s+\w+\s*{[^}]*?provider\s*=\s*"([^"]+)"/.exec(schema);
+    return match ? match[1] : null;
+}
+/** A database URL fit for a log line: a SQLite file's path, or a server URL without credentials. */
+function describeDatabaseUrl(url) {
+    if (url.startsWith('file:'))
+        return url.slice('file:'.length);
+    try {
+        const parsed = new URL(url);
+        return `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+    }
+    catch (_a) {
+        return url.split(':')[0] + ':';
+    }
+}
+/**
+ * Decide whether the server may start on `url`. Throws an Error whose message
+ * says what to change; returns a warning when `configured` disagrees with the
+ * client but the URL is usable.
+ */
+function checkDatabase(opts) {
+    var _a;
+    const { configured, url, client } = opts;
+    const clientLabel = (_a = LABEL[client]) !== null && _a !== void 0 ? _a : client;
+    const urlProvider = providerOfUrl(url);
+    const where = describeDatabaseUrl(url);
+    if (urlProvider !== client) {
+        const kind = urlProvider
+            ? `a ${LABEL[urlProvider]} database`
+            : 'not a database this install knows';
+        const fix = client === 'sqlite'
+            ? 'Set DATABASE_URL (or databaseUrl) to a SQLite file, `file:/path/to/xenon.db`, or leave it ' +
+                'unset to use the default under ~/.cache/xenon. The published plugin stores its data in SQLite only.'
+            : `Set DATABASE_URL (or databaseUrl) to a ${clientLabel} URL.`;
+        throw new Error(`[Database] Cannot start: the database URL (${where}) is ${kind}, but this install's ` +
+            `database client is built for ${clientLabel}. ${fix}`);
+    }
+    if (configured && configured !== client) {
+        return {
+            warning: `[Database] databaseProvider is "${configured}", but this install's database client is ` +
+                `built for ${clientLabel}, so the setting has no effect. Your data is in ${where}. ` +
+                `Set databaseProvider to "${client}", or remove it.`,
+        };
+    }
+    return {};
+}
+/** The provider the generated client next to this file was built for. */
+function generatedClientProvider() {
+    var _a;
+    const schemaPath = path.join(__dirname, '..', 'generated', 'client', 'schema.prisma');
+    try {
+        return (_a = clientProviderFromSchema(fs.readFileSync(schemaPath, 'utf8'))) !== null && _a !== void 0 ? _a : 'sqlite';
+    }
+    catch (_b) {
+        // The published plugin's client is SQLite; a missing copy means a plain install.
+        return 'sqlite';
+    }
+}
+/** Startup gate: log the warning, or throw so the server doesn't start on the wrong database. */
+function assertSupportedDatabase() {
+    const { warning } = checkDatabase({
+        configured: config_1.config.databaseProvider,
+        url: config_1.config.databaseUrl,
+        client: generatedClientProvider(),
+    });
+    if (warning)
+        logger_1.default.warn(warning);
+}

package/lib/src/services/AICommandService.js

@@ -49,12 +49,19 @@ let AICommandService = class AICommandService {
         return __awaiter(this, void 0, void 0, function* () {
             this.logger.info(`Testing AI locator: ${locator.strategy}=${locator.selector}`);
             const omniService = typedi_1.Container.get(OmniVisionService_1.OmniVisionService);
+            // A session's own route: its test may act on what it found.
+            const keep = (found) => {
+                if (driver === null || driver === void 0 ? void 0 : driver.sessionId)
+                    for (const el of found)
+                        omniService.remember(driver.sessionId, el);
+                return found;
+            };
             if (locator.strategy === '-custom:ai-text') {
-                return yield omniService.findByText(driver, locator.selector);
+                return keep(yield omniService.findByText(driver, locator.selector));
             }
             else if (locator.strategy === '-custom:ai-icon') {
                 const result = yield omniService.findByIcon(driver, locator.selector);
-                return result ? [result] : [];
+                return keep(result ? [result] : []);
             }
             throw new Error(`Unsupported AI strategy: ${locator.strategy}`);
         });