@xenon-device-management/xenon 2.13.2 → 2.15.0

package/lib/src/services/SessionLifecycleService.js

@@ -69,7 +69,6 @@ const device_utils_1 = require("../device-utils");
 const TracingService_1 = require("./TracingService");
 const PortAllocator_1 = require("./PortAllocator");
 const XenonCapabilityManager_1 = require("../XenonCapabilityManager");
-const JwtKeyService_1 = require("./token/JwtKeyService");
 const sessionIdentity_1 = require("./session/sessionIdentity");
 const leaseSessionCaps_1 = require("./lease/leaseSessionCaps");
 const sessionCredentials_1 = require("./session/sessionCredentials");
@@ -80,6 +79,7 @@ const callerTeamIds_1 = require("./device-access/callerTeamIds");
 const queueVisibility_1 = require("./device-access/queueVisibility");
 const appVisibility_1 = require("./device-access/appVisibility");
 const LiveSessionOwners_1 = require("./device-access/LiveSessionOwners");
+const sessionMemory_1 = require("../sessions/sessionMemory");
 const SessionMetricsService_1 = require("./metrics/SessionMetricsService");
 const appCapability_1 = require("./session/appCapability");
 const CircuitBreaker_1 = require("../data-service/CircuitBreaker");
@@ -98,6 +98,23 @@ const SessionStatus_1 = require("../types/SessionStatus");
 const SessionType_1 = __importDefault(require("../enums/SessionType"));
 const async_lock_1 = __importDefault(require("async-lock"));
 const base_driver_1 = require("@appium/base-driver");
+const PhoneNetworkRestore_1 = require("./network/PhoneNetworkRestore");
+const interceptorOptions_1 = require("./interceptor/interceptorOptions");
+/**
+ * A session token admits a session only with the `sessions` scope, as a key
+ * pair does. Tokens minted before this check carry no `scopes` claim, and
+ * POST /auth/token gave one to any credential, a read-only one included:
+ * they are refused too.
+ */
+function sessionTokenGrantsSessions(scopes) {
+    if (typeof scopes !== 'string')
+        return false;
+    const owned = scopes.split(',').map((s) => s.trim());
+    return owned.includes('sessions') || owned.includes('admin');
+}
+const SESSION_TOKEN_LACKS_SCOPE = 'session rejected: xe:options.sessionToken carries no `sessions` scope; tokens minted by ' +
+    'Xenon 2.14 or earlier carry none — mint a new one with POST /xenon/api/auth/token ' +
+    '({"audience":"xenon-mcp"}) using a credential that has the `sessions` scope.';
 /**
  * How long the hub waits for a node (or cloud provider) to create a session.
  * A create is sent once (InternalRequestConfig `retry: false`): the node may
@@ -261,6 +278,7 @@ let SessionLifecycleService = class SessionLifecycleService {
                 apiKeyId: authResult.apiKeyId,
                 userId: authResult.userId,
                 appDownload,
+                allocatedAt: Date.now(),
             };
             // The grant opens one phone, on this node. A token taken to another node
             // (an emulator's udid repeats across machines), or naming a phone this
@@ -389,7 +407,7 @@ let SessionLifecycleService = class SessionLifecycleService {
             this.logger.debug(`📱 Removing pending session with capability_id: ${allocation.pendingSessionId}`);
             yield (0, pending_sessions_service_1.removePendingSession)(allocation.pendingSessionId);
             if (this.isCreateSessionResponseInternal(session)) {
-                yield this.finalizeSession(session, device, caps, driver, remote, allocation.apiKeyId, allocation.userId);
+                yield this.finalizeSession(session, device, caps, driver, remote, allocation.apiKeyId, allocation.userId, allocation.allocatedAt);
             }
             else {
                 yield this.handleSessionFailure(session, device, remote);
@@ -503,9 +521,11 @@ let SessionLifecycleService = class SessionLifecycleService {
     // took out of `xe:options` (or its `xenon:options` alias): an access-key +
     // token pair, or a session token. Today this is best-effort: if none is
     // supplied we log a warning and let the request through to avoid breaking
-    // pre-existing test clients, unless XENON_REQUIRE_SESSION_TOKEN is on. A
-    // supplied key that is invalid / revoked / has insufficient scope is
-    // rejected. Respects the global `authDisabled` flag.
+    // pre-existing test clients, unless XENON_REQUIRE_SESSION_TOKEN is on.
+    // Credentials that don't verify — a wrong, revoked or expired key or token,
+    // or one whose user is deleted or not ACTIVE — count as none. Credentials
+    // that verify without the `sessions` scope are rejected. Respects the
+    // global `authDisabled` flag.
     //
     // Returns the caller's { apiKeyId, callerTeamIds } so allocation can filter
     // devices, and app resolution uploaded apps, by team. `apiKeyId` is null
@@ -547,23 +567,47 @@ let SessionLifecycleService = class SessionLifecycleService {
             }
             const { ApiKeyService } = yield Promise.resolve().then(() => __importStar(require('./ApiKeyService')));
             const svc = typedi_1.Container.get(ApiKeyService);
+            const { verifyKeyPairCredential, verifySessionTokenCredential, isWrongSessionToken } = yield Promise.resolve().then(() => __importStar(require('../middleware/verifyCredential')));
             // xe:options.{accessKey, token} — the only key-pair credential shape.
+            // Checked by REST's rule (verifyKeyPairCredential): a live key whose owner
+            // exists and is ACTIVE. The key alone (verifyPair) let a user set to
+            // Inactive, or deleted, keep creating sessions as themselves. The owner
+            // found here is the one lookup the session's scope and lease use.
             const pair = credentials.pair;
-            const row = pair ? yield svc.verifyPair(pair.accessKey, pair.token) : null;
+            const verifiedPair = pair ? yield verifyKeyPairCredential(pair.accessKey, pair.token) : null;
+            // The session token, verified once for both the gate and attribution, by
+            // REST's rule too: a live signature and an ACTIVE subject, looked up now.
+            let tokenCheck;
+            const verifyToken = (t) => {
+                if (!tokenCheck)
+                    tokenCheck = verifySessionTokenCredential(t);
+                return tokenCheck;
+            };
+            // Both readers below treat any failure as a token that doesn't check out:
+            // the gate refuses it as "invalid or expired", attribution ignores it. A
+            // check that could not run (the database or the signing key unavailable)
+            // is not that: it refuses the create here, as a key whose owner can't be
+            // looked up does, rather than run the session with no owner.
+            if (!verifiedPair && credentials.sessionToken) {
+                yield verifyToken(credentials.sessionToken).catch((err) => {
+                    if (!isWrongSessionToken(err))
+                        throw err;
+                });
+            }
             const { assertSessionTokenGate, sessionTokenGateEnabled } = yield Promise.resolve().then(() => __importStar(require('./sessionTokenGate')));
             try {
                 yield assertSessionTokenGate({
                     enabled: sessionTokenGateEnabled(),
-                    hasValidKeyPair: !!row,
+                    hasValidKeyPair: !!verifiedPair,
                     token: credentials.sessionToken,
-                    verify: (t) => typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(t, { audience: 'xenon-session' }),
+                    verify: verifyToken,
                 });
             }
             catch (err) {
                 this.logger.error(`❌ ${err.message}`);
                 throw new base_driver_1.errors.InvalidArgumentError(err.message);
             }
-            if (!row) {
+            if (!verifiedPair) {
                 // No key pair. An xe:options.sessionToken still identifies the caller,
                 // so read it for attribution even when the gate is off — otherwise the
                 // ownership guard fails closed on a session whose owner we actually know.
@@ -571,23 +615,36 @@ let SessionLifecycleService = class SessionLifecycleService {
                 // The token's teamId claim narrows it the way a key's team does; kept
                 // from the one verify rather than verifying again.
                 let tokenTeamId = null;
+                let tokenScopes;
+                let tokenOwner;
                 const identity = yield (0, sessionIdentity_1.resolveSessionIdentity)({
                     row: null,
                     sessionToken: credentials.sessionToken,
                     verify: (t) => __awaiter(this, void 0, void 0, function* () {
-                        const payload = yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(t, {
-                            audience: 'xenon-session',
-                        });
+                        const { payload, user } = yield verifyToken(t);
                         tokenTeamId = typeof (payload === null || payload === void 0 ? void 0 : payload.teamId) === 'string' ? payload.teamId : null;
+                        tokenScopes = payload === null || payload === void 0 ? void 0 : payload.scopes;
+                        tokenOwner = user;
                         return payload;
                     }),
                 });
+                // A token that names its owner may create sessions only with the
+                // `sessions` scope, as a key pair may: refused, like a key without it.
+                if (identity.userId && !sessionTokenGrantsSessions(tokenScopes)) {
+                    this.logger.error('Rejecting session: xe:options.sessionToken lacks the `sessions` scope');
+                    throw new base_driver_1.errors.InvalidArgumentError(SESSION_TOKEN_LACKS_SCOPE);
+                }
                 if (!identity.userId) {
                     this.logger.warn('Session created without valid credentials. Pass `xe:options.accessKey` + ' +
                         '`xe:options.token`, or `xe:options.sessionToken`.');
                 }
-                const leaseAccess = this.leaseAccessFor(identity.userId
-                    ? { kind: 'session-token', userId: identity.userId, teamId: tokenTeamId }
+                const leaseAccess = this.leaseAccessFor(identity.userId && tokenOwner
+                    ? {
+                        kind: 'session-token',
+                        scopes: String(tokenScopes),
+                        user: tokenOwner,
+                        teamId: tokenTeamId,
+                    }
                     : { kind: 'none' });
                 // A token's user is scoped as REST scopes them. No credentials at all
                 // stays unscoped (the back-compat path), with no lookup.
@@ -597,6 +654,7 @@ let SessionLifecycleService = class SessionLifecycleService {
                         teamId: identity.userId ? tokenTeamId : null,
                     } });
             }
+            const { row, user: owner } = verifiedPair;
             if (!svc.hasScope(row, ['sessions'])) {
                 this.logger.error('Rejecting session: credentials lack the `sessions` scope');
                 throw new base_driver_1.errors.InvalidArgumentError('credentials are invalid, revoked, or lack the `sessions` scope');
@@ -605,7 +663,7 @@ let SessionLifecycleService = class SessionLifecycleService {
             const leaseAccess = this.leaseAccessFor({
                 kind: 'api-key',
                 scopes: row.scopes,
-                userId: row.userId,
+                user: owner,
                 teamId: (_a = row.teamId) !== null && _a !== void 0 ? _a : null,
             });
             // The phones and apps this session may use: REST's rule
@@ -640,7 +698,8 @@ let SessionLifecycleService = class SessionLifecycleService {
     // How a session that names a lease is judged, looked up at most once and
     // only when asked. Who may override follows canOverrideLease; which phones
     // it can see follows REST's computeTeamIds. Both need the owner's live role,
-    // as authMiddleware reads it for every REST request.
+    // as authMiddleware reads it for every REST request: the owner the
+    // credential check looked up a moment ago, ACTIVE then.
     leaseAccessFor(credential) {
         let looked;
         return () => {
@@ -657,24 +716,24 @@ let SessionLifecycleService = class SessionLifecycleService {
             if (credential.kind === 'none') {
                 return { canOverride: (0, leaseOverride_1.canOverrideLease)({ kind: 'none' }), teamIds: undefined };
             }
+            const { user } = credential;
             try {
-                const { UserService } = yield Promise.resolve().then(() => __importStar(require('./UserService')));
-                const found = yield typedi_1.Container.get(UserService).findById(credential.userId);
-                const user = found && found.status === 'ACTIVE' ? found : null;
-                const canOverride = (0, leaseOverride_1.canOverrideLease)(credential.kind === 'api-key'
-                    ? { kind: 'api-key', scopes: credential.scopes, user }
-                    : { kind: 'session-token', user });
-                const role = (user === null || user === void 0 ? void 0 : user.role) === 'SUPER_ADMIN' || (user === null || user === void 0 ? void 0 : user.role) === 'ADMIN' ? user.role : 'MEMBER';
+                const canOverride = (0, leaseOverride_1.canOverrideLease)({
+                    kind: credential.kind,
+                    scopes: credential.scopes,
+                    user,
+                });
+                const role = user.role === 'SUPER_ADMIN' || user.role === 'ADMIN' ? user.role : 'MEMBER';
                 const teamIds = yield (0, callerTeamIds_1.computeTeamIds)({
                     role,
-                    userId: credential.userId,
+                    userId: user.id,
                     apiKeyTeamId: credential.teamId,
                 });
                 return { canOverride, teamIds };
             }
             catch (err) {
                 // Fail closed: no override, and the shared pool only.
-                this.logger.warn(`Could not look up how user ${credential.userId} may use a lease: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
+                this.logger.warn(`Could not look up how user ${user.id} may use a lease: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
                 return { canOverride: false, teamIds: [] };
             }
         });
@@ -788,7 +847,7 @@ let SessionLifecycleService = class SessionLifecycleService {
         }
     }
     finalizeSession(session_1, device_1, caps_1, driver_1, isRemote_1) {
-        return __awaiter(this, arguments, void 0, function* (session, device, caps, driver, isRemote, apiKeyId = null, userId = null) {
+        return __awaiter(this, arguments, void 0, function* (session, device, caps, driver, isRemote, apiKeyId = null, userId = null, allocatedAt) {
             var _a;
             const sessionId = session.value[0];
             const sessionResponse = session.value[1];
@@ -824,6 +883,7 @@ let SessionLifecycleService = class SessionLifecycleService {
             const sessionInstance = this.createSessionInstance(sessionId, freshDevice, sessionResponse, xenonCapabilities, driver, webDriverUrl);
             sessionInstance.apiKeyId = apiKeyId;
             sessionInstance.userId = userId;
+            sessionInstance.allocatedAt = allocatedAt;
             // A session this server drives: its owner is known while it runs, row or
             // not (a node writes none for the hub's sessions; LiveSessionOwners).
             if (sessionInstance instanceof LocalSession_1.LocalSession) {
@@ -877,26 +937,11 @@ let SessionLifecycleService = class SessionLifecycleService {
     applyPostSessionLogic(session, caps, device) {
         return __awaiter(this, void 0, void 0, function* () {
             const context = typedi_1.Container.get(PluginContext_1.PluginContext);
-            const networkProfile = caps[XenonCapabilityManager_1.XENON_CAPABILITIES.NETWORK_PROFILE];
-            if (networkProfile) {
-                const { NetworkConditioningService } = yield Promise.resolve().then(() => __importStar(require('./NetworkConditioningService')));
-                yield typedi_1.Container.get(NetworkConditioningService).applyProfile(session.getId(), device, networkProfile);
-            }
-            if (caps[XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_ENABLED]) {
-                try {
-                    const { InterceptorService } = yield Promise.resolve().then(() => __importStar(require('./InterceptorService')));
-                    yield typedi_1.Container.get(InterceptorService).start(session.getId(), device, {
-                        enabled: true,
-                        bufferSize: caps[XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_BUFFER_SIZE],
-                        captureBodies: caps[XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_CAPTURE_BODIES] !== false,
-                        mocks: caps[XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_MOCKS] || [],
-                        includeHosts: caps[XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_INCLUDE_HOSTS] || [],
-                        excludeHosts: caps[XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_EXCLUDE_HOSTS] || [],
-                    });
-                }
-                catch (err) {
-                    this.logger.warn(`🕸️ Failed to start interceptor for ${session.getId()}: ${err.message}`);
-                }
+            // Only the server that drives the phone changes its network: a node
+            // applies its own sessions' profile and interceptor, and a hub that did
+            // it too ran its own adb against the node's phone.
+            if (session.getType() === SessionType_1.default.LOCAL) {
+                yield this.applySessionNetwork(session.getId(), caps, device, context.pluginArgs);
             }
             const isDashboardEnabled = !!context.pluginArgs.enableDashboard;
             const shouldSaveLogs = session.getType() !== SessionType_1.default.CLOUD;
@@ -930,6 +975,36 @@ let SessionLifecycleService = class SessionLifecycleService {
             }
         });
     }
+    /**
+     * The session's network profile and network capture, on a phone this
+     * server drives. First what an earlier session left on the phone and
+     * couldn't put back is undone, so this session starts from the phone's own
+     * settings and records those as the ones to put back. Each ending undoes
+     * these through PhoneNetworkRestore.
+     */
+    applySessionNetwork(sessionId, caps, device, pluginArgs) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (((_a = device.platform) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'android') {
+                yield typedi_1.Container.get(PhoneNetworkRestore_1.PhoneNetworkRestore).restoreLeftovers({ udid: device.udid });
+            }
+            const networkProfile = caps[XenonCapabilityManager_1.XENON_CAPABILITIES.NETWORK_PROFILE];
+            if (networkProfile) {
+                const { NetworkConditioningService } = yield Promise.resolve().then(() => __importStar(require('./NetworkConditioningService')));
+                yield typedi_1.Container.get(NetworkConditioningService).applyProfile(sessionId, device, networkProfile);
+            }
+            const interceptor = (0, interceptorOptions_1.resolveInterceptorOptions)(caps, pluginArgs.interceptor);
+            if (interceptor.enabled) {
+                try {
+                    const { InterceptorService } = yield Promise.resolve().then(() => __importStar(require('./InterceptorService')));
+                    yield typedi_1.Container.get(InterceptorService).start(sessionId, device, interceptor);
+                }
+                catch (err) {
+                    this.logger.warn(`🕸️ Failed to start interceptor for ${sessionId}: ${err.message}`);
+                }
+            }
+        });
+    }
     /**
      * The row a hub keeps for a session it routes to a node or a cloud when the
      * dashboard's own (onSessionStarted) isn't written: with the dashboard off,
@@ -1097,6 +1172,10 @@ let SessionLifecycleService = class SessionLifecycleService {
             // which releases ports and archives video twice.
             if (sessionId) {
                 yield sessionCleanupLock.acquire(sessionId, () => __awaiter(this, void 0, void 0, function* () {
+                    // The phone's network (profile, interceptor proxy) and the capture,
+                    // before the phone is released to the next session. Whether or not
+                    // SESSION_MANAGER holds the session.
+                    yield typedi_1.Container.get(PhoneNetworkRestore_1.PhoneNetworkRestore).restoreSession(sessionId, 'session deleted');
                     yield (0, device_service_1.releaseSessionDevices)(sessionId);
                     this.logger.info(`📱 Unblocking the device that is blocked for session ${sessionId}`);
                     const session = SessionManager_1.SESSION_MANAGER.getSession(sessionId);
@@ -1127,6 +1206,7 @@ let SessionLifecycleService = class SessionLifecycleService {
             finally {
                 if (sessionId) {
                     typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners).forget(sessionId);
+                    (0, sessionMemory_1.forgetSessionMemory)(sessionId);
                     // Before the lock's "still in memory?" check, which a dashboard-off
                     // node fails. On a node this ends the figures it holds for its hub;
                     // on a hub it collects a node session's last ones. Idempotent.
@@ -1137,37 +1217,10 @@ let SessionLifecycleService = class SessionLifecycleService {
                             // Another concurrent deleteSession already cleaned up.
                             return;
                         }
-                        const device = session.getDevice();
-                        try {
-                            const { NetworkConditioningService } = yield Promise.resolve().then(() => __importStar(require('./NetworkConditioningService')));
-                            yield typedi_1.Container.get(NetworkConditioningService).reset(sessionId, device);
-                        }
-                        catch (resetErr) {
-                            this.logger.warn(`⚠️ NetworkConditioningService.reset failed for session ${sessionId}: ${resetErr.message}`);
-                        }
-                        try {
-                            const { InterceptorService } = yield Promise.resolve().then(() => __importStar(require('./InterceptorService')));
-                            const interceptor = typedi_1.Container.get(InterceptorService);
-                            if (interceptor.isActive(sessionId))
-                                yield interceptor.stop(sessionId);
-                        }
-                        catch (interceptorErr) {
-                            this.logger.warn(`⚠️ InterceptorService.stop failed for session ${sessionId}: ${interceptorErr.message}`);
-                        }
+                        // The phone's network was put back before it was released (above).
                         yield event_manager_1.DASHBORD_EVENT_MANAGER.onSessionStopped(sessionId, status, reason);
                         SessionManager_1.SESSION_MANAGER.removeSession(sessionId);
                         typedi_1.Container.get(hubSessionToken_1.HubSessionTokenIssuer).forget(sessionId);
-                        try {
-                            const { getSessionById } = yield Promise.resolve().then(() => __importStar(require('../dashboard/services/session-service')));
-                            const sessionData = yield getSessionById(sessionId);
-                            if (sessionData && (sessionData.status === 'failed' || sessionData.failure_reason)) {
-                                const { NotificationService } = yield Promise.resolve().then(() => __importStar(require('./NotificationService')));
-                                yield typedi_1.Container.get(NotificationService).dispatchEvent('session_failed', sessionData);
-                            }
-                        }
-                        catch (err) {
-                            /* ignore notification errors */
-                        }
                     }));
                 }
             }
@@ -1240,6 +1293,7 @@ let SessionLifecycleService = class SessionLifecycleService {
     stopSessionForShutdown(sessionId, reason) {
         return __awaiter(this, void 0, void 0, function* () {
             yield sessionCleanupLock.acquire(sessionId, () => __awaiter(this, void 0, void 0, function* () {
+                yield typedi_1.Container.get(PhoneNetworkRestore_1.PhoneNetworkRestore).restoreSession(sessionId, reason);
                 try {
                     yield (0, device_service_1.releaseSessionDevices)(sessionId);
                 }
@@ -1258,13 +1312,17 @@ let SessionLifecycleService = class SessionLifecycleService {
                     }
                 }
                 try {
-                    yield event_manager_1.DASHBORD_EVENT_MANAGER.onSessionStopped(sessionId, SessionStatus_1.SessionStatus.FAILED, reason);
+                    // A shutdown fails the sessions it drains; no test caused it, so no webhook.
+                    yield event_manager_1.DASHBORD_EVENT_MANAGER.onSessionStopped(sessionId, SessionStatus_1.SessionStatus.FAILED, reason, {
+                        notify: false,
+                    });
                 }
                 catch (err) {
                     this.logger.warn(`[shutdown] onSessionStopped failed for ${sessionId}: ${err.message}`);
                 }
                 SessionManager_1.SESSION_MANAGER.removeSession(sessionId);
                 typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners).forget(sessionId);
+                (0, sessionMemory_1.forgetSessionMemory)(sessionId);
                 yield typedi_1.Container.get(SessionMetricsService_1.SessionMetricsService).stop(sessionId);
             }));
         });

package/lib/src/services/ShutdownCoordinator.js

@@ -24,6 +24,7 @@ const logger_1 = __importDefault(require("../logger"));
 const SessionManager_1 = require("../sessions/SessionManager");
 const SessionLifecycleService_1 = require("./SessionLifecycleService");
 const SessionType_1 = __importDefault(require("../enums/SessionType"));
+const PhoneNetworkRestore_1 = require("./network/PhoneNetworkRestore");
 // Graceful shutdown phase that runs BEFORE the existing infrastructure
 // teardown in index.ts:cleanup(). Active sessions get a bounded chance to
 // archive their video + release ports + mark themselves failed, so we don't
@@ -57,6 +58,7 @@ let ShutdownCoordinator = class ShutdownCoordinator {
             const sessions = SessionManager_1.SESSION_MANAGER.getAllSessions().filter((session) => session.getType() === SessionType_1.default.LOCAL);
             if (sessions.length === 0) {
                 this.logger.info('No active sessions to drain');
+                yield this.restorePhoneNetworks(timeoutMs);
                 return { attempted: 0, completed: 0 };
             }
             this.logger.info(`Draining ${sessions.length} active session(s) (overall=${timeoutMs}ms, per-session=${perSessionTimeoutMs}ms)`);
@@ -84,10 +86,41 @@ let ShutdownCoordinator = class ShutdownCoordinator {
             }));
             const results = yield Promise.allSettled(tasks);
             const completed = results.filter((r) => r.status === 'fulfilled' && r.value).length;
+            yield this.restorePhoneNetworks(Math.max(0, deadline - Date.now()));
             this.logger.info(`Drain complete: ${completed}/${sessions.length} session(s) finalized`);
             return { attempted: sessions.length, completed };
         });
     }
+    /**
+     * The network of every phone a session of this server still has changed
+     * (profile, interceptor proxy), sessions SESSION_MANAGER doesn't hold
+     * included, within what is left of the budget. A shutdown that never gets
+     * here (Appium exits on SIGTERM first) leaves it to the next start, from
+     * the ledger (PhoneNetworkRestore.cleanUpAtBoot).
+     */
+    restorePhoneNetworks(budgetMs) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (budgetMs <= 0)
+                return;
+            let timer;
+            try {
+                yield Promise.race([
+                    typedi_1.Container.get(PhoneNetworkRestore_1.PhoneNetworkRestore).restoreAll('Xenon is shutting down'),
+                    new Promise((resolve) => {
+                        timer = setTimeout(resolve, budgetMs);
+                    }),
+                ]);
+            }
+            catch (err) {
+                this.logger.warn(`[shutdown] Putting phone networks back failed: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+            }
+        });
+    }
 };
 exports.ShutdownCoordinator = ShutdownCoordinator;
 exports.ShutdownCoordinator = ShutdownCoordinator = __decorate([

package/lib/src/services/SocketServer.js

@@ -33,9 +33,14 @@ const SocketEvents_1 = require("../enums/SocketEvents");
 const callerTeamIds_1 = require("./device-access/callerTeamIds");
 const DeviceTeamResolver_1 = require("./device-access/DeviceTeamResolver");
 const upgradeRouter_1 = require("../app/ws/upgradeRouter");
+const sessionCommandSummary_1 = require("../dashboard/sessionCommandSummary");
 /** socket.io's default path, which the dashboard and nodes connect to. */
 const SOCKET_IO_PATH = '/socket.io';
 const SESSION_COOKIE = 'xenon_dashboard_session';
+const EVENT_LOG_KEEPS = new Map([
+    [SocketEvents_1.SocketEvents.INTERCEPTOR_REQUEST, null],
+    [SocketEvents_1.SocketEvents.SESSION_COMMAND, sessionCommandSummary_1.sessionCommandSummary],
+]);
 function readCookie(cookieHeader, name) {
     if (!cookieHeader)
         return undefined;
@@ -242,12 +247,23 @@ let SocketServer = SocketServer_1 = class SocketServer {
         if (this.io) {
             this.io.to('dashboard').emit(event, data);
         }
-        typedi_1.Container.get(EventLogService_1.EventLogService).appendSafe({ type: event, payload: data });
+        this.logEvent(event, data);
+    }
+    /** Once per event, unscoped: whole, or what EVENT_LOG_KEEPS keeps of it. */
+    logEvent(event, data) {
+        const keep = EVENT_LOG_KEEPS.get(event);
+        if (keep === null)
+            return;
+        typedi_1.Container.get(EventLogService_1.EventLogService).appendSafe({
+            type: event,
+            payload: keep ? keep(data) : data,
+        });
     }
     /**
      * A dashboard event about one or more phones: each dashboard socket gets it
      * only if its caller can see the phone ({@link DeviceEventScope}), by the
-     * same team rule as REST. The event log records it once, unscoped.
+     * same team rule as REST. The event log records it once, unscoped, as
+     * EVENT_LOG_KEEPS says.
      *
      * Each phone's events are delivered through one chain, in the order they
      * were emitted, whatever their scope shape: one that waits on a team lookup
@@ -262,7 +278,7 @@ let SocketServer = SocketServer_1 = class SocketServer {
      */
     emitToDashboardForDevices(event, data, scope) {
         var _a, _b;
-        typedi_1.Container.get(EventLogService_1.EventLogService).appendSafe({ type: event, payload: data });
+        this.logEvent(event, data);
         const udids = 'udids' in scope ? scope.udids : [(_a = scope.udid) !== null && _a !== void 0 ? _a : ''];
         if (!this.hasScopedDashboard() && udids.every((udid) => !this.deliveries.has(udid))) {
             this.noteRow(scope);

package/lib/src/services/TeamService.js

@@ -52,20 +52,37 @@ let TeamService = class TeamService {
     delete(id) {
         return __awaiter(this, void 0, void 0, function* () {
             // Apps too: App.teamId is onDelete SetNull, so deleting a team that owns
-            // apps would quietly share them with every member.
-            const [devices, members, apps] = yield Promise.all([
+            // apps would quietly share them with every member. So is a phone's saved
+            // team (DeviceSetting): a phone of the team that is not connected now
+            // would come back in the shared pool.
+            const [connected, saved, members, apps] = yield Promise.all([
                 prisma_1.prisma.device.count({ where: { teamId: id } }),
+                prisma_1.prisma.deviceSetting.findMany({ where: { teamId: id }, select: { udid: true, host: true } }),
                 prisma_1.prisma.teamMember.count({ where: { teamId: id } }),
                 prisma_1.prisma.app.count({ where: { teamId: id } }),
             ]);
+            const away = yield this.notConnected(saved);
+            const devices = connected + away;
             if (devices > 0 || members > 0 || apps > 0) {
-                throw new Error(`Team still has ${devices} device(s), ${members} member(s) and ${apps} app(s). Reassign them before deleting.`);
+                const phones = away > 0 ? `${devices} device(s) (${away} not connected now)` : `${devices} device(s)`;
+                throw new Error(`Team still has ${phones}, ${members} member(s) and ${apps} app(s). Reassign them before deleting.`);
             }
             // Clear teamId on any (revoked) ApiKey rows so the FK doesn't block delete.
             yield prisma_1.prisma.apiKey.updateMany({ where: { teamId: id }, data: { teamId: null } });
             yield prisma_1.prisma.team.delete({ where: { id } });
         });
     }
+    /** How many of these saved phones have no Device row: not connected now. */
+    notConnected(saved) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (saved.length === 0)
+                return 0;
+            const here = yield prisma_1.prisma.device.count({
+                where: { OR: saved.map(({ udid, host }) => ({ udid, host })) },
+            });
+            return saved.length - here;
+        });
+    }
     listMembers(teamId) {
         return __awaiter(this, void 0, void 0, function* () {
             const rows = yield prisma_1.prisma.teamMember.findMany({

package/lib/src/services/bug-report/video-slice.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sliceVideo = sliceVideo;
 const child_process_1 = require("child_process");
+const ffmpegPath_1 = require("../../helpers/ffmpegPath");
 const logger_1 = __importDefault(require("../../logger"));
 function sliceVideo(inputPath, startSec, endSec, outPath, spawnFn = child_process_1.spawn) {
     return new Promise((resolve) => {
@@ -16,7 +17,9 @@ function sliceVideo(inputPath, startSec, endSec, outPath, spawnFn = child_proces
             '-c', 'copy',
             outPath,
         ];
-        const proc = spawnFn('ffmpeg', args);
+        // Xenon's own ffmpeg, as everywhere else: a bare name isn't found by a
+        // server the Mac app started, and finds a system ffmpeg first otherwise.
+        const proc = spawnFn((0, ffmpegPath_1.resolveFfmpegPath)(), args);
         let stderr = '';
         if (proc.stderr) {
             proc.stderr.on('data', (chunk) => {

package/lib/src/services/device-access/leaseOverride.js

@@ -2,18 +2,20 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.canOverrideLease = canOverrideLease;
 function canOverrideLease(credential) {
-    var _a, _b;
     switch (credential.kind) {
         case 'auth-disabled':
             return true;
-        case 'api-key': {
+        case 'api-key':
+        case 'session-token': {
             if (!credential.user)
                 return false;
             const scopes = new Set(credential.scopes.split(',').map((s) => s.trim()));
-            return scopes.has('admin') || credential.user.role === 'SUPER_ADMIN';
+            const { role } = credential.user;
+            if (credential.kind === 'session-token') {
+                return role === 'SUPER_ADMIN' || (role === 'ADMIN' && scopes.has('admin'));
+            }
+            return scopes.has('admin') || role === 'SUPER_ADMIN';
         }
-        case 'session-token':
-            return ((_a = credential.user) === null || _a === void 0 ? void 0 : _a.role) === 'SUPER_ADMIN' || ((_b = credential.user) === null || _b === void 0 ? void 0 : _b.role) === 'ADMIN';
         default:
             return false;
     }