@xenon-device-management/xenon 2.13.2 → 2.15.0

package/lib/src/services/passwordResetLink.js

@@ -1,25 +1,66 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resetLinkBase = resetLinkBase;
 exports.buildResetLink = buildResetLink;
+exports.requestBase = requestBase;
+exports.describeLifetime = describeLifetime;
 exports.resetEmail = resetEmail;
+const config_1 = require("../config");
+const publicUrl_1 = require("./publicUrl");
 /**
- * The URL a reset token is redeemed at. Built from the request so it matches
- * the host the caller reached the server on (honouring a TLS-terminating
- * proxy's x-forwarded-proto). The raw token is a credential for the account
- * until it expires or is used: never log the result.
+ * Where a password reset link points, and the email that carries it. The raw
+ * token in a link is a credential for the account until it expires or is
+ * used: never log the result.
  *
  * The token goes in the fragment (#), not the path. Browsers never send the
  * fragment to the server, so opening the link can't put the token in any
  * server-side log. As a path segment it was logged on every open: Appium's
  * [HTTP] request line and Xenon's UI-fallback line both record the URL.
  */
-function buildResetLink(req, rawToken) {
+/**
+ * The address a link Xenon sends (by email, or to the log fallback) points
+ * at: this server's address from XENON_PUBLIC_URL (publicServerBase), or
+ * null when it is unset or not a usable address.
+ *
+ * Never the request's Host header. Through 2.14 the link was built from it,
+ * so anyone could ask for a reset of someone else's account naming a host of
+ * their own (a matching Origin passes the CSRF check), and Xenon emailed the
+ * victim a genuine link to that host, which handed over the token.
+ */
+function resetLinkBase(cfg = config_1.config) {
+    return (0, publicUrl_1.publicServerBase)(cfg);
+}
+/** The reset page for `rawToken`, under `base` (resetLinkBase, or requestBase). */
+function buildResetLink(base, rawToken) {
+    return `${base}/xenon/reset-password#${rawToken}`;
+}
+/**
+ * The address the caller reached this server on, honouring a TLS-terminating
+ * proxy's x-forwarded-proto. Only for a link handed back to the signed-in
+ * administrator who asked for it (POST /users/:id/reset-link when it can't be
+ * emailed): they see where it points before passing it on, and hold the token
+ * anyway. Never for a link Xenon sends to someone else.
+ */
+function requestBase(req) {
     const proto = req.secure || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
     const host = req.headers.host || 'localhost';
-    return `${proto}://${host}/xenon/reset-password#${rawToken}`;
+    return `${proto}://${host}`;
+}
+/** "1 hour", "30 minutes", "2 hours": a reset link's lifetime, for the email. */
+function describeLifetime(ms) {
+    const minutes = Math.max(1, Math.round(ms / 60000));
+    if (minutes % 60 === 0) {
+        const hours = minutes / 60;
+        return `${hours} hour${hours === 1 ? '' : 's'}`;
+    }
+    return `${minutes} minute${minutes === 1 ? '' : 's'}`;
 }
-/** The reset email, shared by self-service and admin-issued resets. */
-function resetEmail(user, link) {
+/**
+ * The reset email, shared by self-service and admin-issued resets. `ttlMs` is
+ * how long the link lasts (PasswordResetService.ttlMs(), from
+ * XENON_RESET_TOKEN_TTL_MS): the email said "1 hour" whatever it was.
+ */
+function resetEmail(user, link, ttlMs) {
     return {
         to: user.email,
         subject: 'Reset your Xenon password',
@@ -27,6 +68,6 @@ function resetEmail(user, link) {
             `Someone requested a password reset for your Xenon account. ` +
             `If that was you, click the link below to choose a new password:\n\n` +
             `${link}\n\n` +
-            `This link expires in 1 hour. If you did not request this, ignore this email — no action is needed.\n`,
+            `This link expires in ${describeLifetime(ttlMs)}. If you did not request this, ignore this email — no action is needed.\n`,
     };
 }

package/lib/src/services/passwordResetMode.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.passwordResetMode = passwordResetMode;
+const passwordResetLink_1 = require("./passwordResetLink");
 function passwordResetMode(cfg) {
-    return cfg.smtpUrl && cfg.smtpUrl.trim() ? 'email' : 'admin';
+    const smtp = !!(cfg.smtpUrl && cfg.smtpUrl.trim());
+    return smtp && (0, passwordResetLink_1.resetLinkBase)(cfg) !== null ? 'email' : 'admin';
 }

package/lib/src/services/publicUrl.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.publicServerBase = publicServerBase;
+const config_1 = require("../config");
+/**
+ * XENON_PUBLIC_URL: the address people reach this Xenon server at, such as
+ * https://xenon.example.com or http://lab-mac:4723. Links Xenon hands out
+ * (password reset links, a device's dashboard_link) are built from it, never
+ * from the request's Host header, which whoever sends the request chooses.
+ *
+ * The dashboard's own address is taken too: a trailing `/xenon` or `/xenon/`
+ * is dropped, so `http://localhost:4723/xenon/` gives `http://localhost:4723`.
+ * Kept as given it built `/xenon/xenon/reset-password`, which the dashboard
+ * sends to its sign-in page, losing the token.
+ *
+ * Any other path is refused: the dashboard loads its pages, scripts and API
+ * from `/xenon` on the server's root (its base path is fixed at build time),
+ * so it can't be served under a reverse-proxy prefix, and a link under one
+ * wouldn't open. So are an address that isn't http(s), and one with a query,
+ * fragment or user name (a fragment would swallow a reset token).
+ *
+ * Returns the origin (scheme, host and port, no trailing slash), or null when
+ * the variable is unset or not such an address.
+ */
+function publicServerBase(cfg = config_1.config) {
+    var _a;
+    const raw = (_a = cfg.publicUrl) === null || _a === void 0 ? void 0 : _a.trim();
+    if (!raw)
+        return null;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch (_b) {
+        return null;
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:')
+        return null;
+    if (url.search || url.hash || url.username || url.password)
+        return null;
+    const path = url.pathname.replace(/\/+$/, '');
+    if (path !== '' && path !== '/xenon')
+        return null;
+    return url.origin;
+}

package/lib/src/services/recording/concurrency-gate.js

@@ -18,10 +18,19 @@ const config_1 = require("../../config");
  * and are NOT counted against this gate — they bypass it entirely.
  */
 let ConcurrencyGate = class ConcurrencyGate {
-    constructor(limit) {
-        var _a;
+    /**
+     * An explicit `limit` is fixed. Without one the gate follows
+     * `config.maxConcurrentRecordings` as it stands at each admission, not as it
+     * stood when the gate was built: the gate is created on first use, and the
+     * `maxConcurrentRecordings` option is applied at boot.
+     */
+    constructor(fixedLimit) {
+        this.fixedLimit = fixedLimit;
         this.active = new Set();
-        this.limit = (_a = limit !== null && limit !== void 0 ? limit : config_1.config.maxConcurrentRecordings) !== null && _a !== void 0 ? _a : 4;
+    }
+    get limit() {
+        var _a, _b;
+        return (_b = (_a = this.fixedLimit) !== null && _a !== void 0 ? _a : config_1.config.maxConcurrentRecordings) !== null && _b !== void 0 ? _b : 4;
     }
     /**
      * Atomic admission: either ALL recordingIds are admitted, or none are.

package/lib/src/services/session/sessionIdentity.js

@@ -21,9 +21,11 @@ function resolveSessionIdentity(input) {
         if (!input.sessionToken)
             return NONE;
         // Attribution is decoupled from enforcement: a token that does not verify is
-        // IGNORED here, never rejected. assertSessionTokenGate remains the only
-        // decider of whether the session is admitted. That separation is what lets a
-        // valid token identify its caller even when the gate is switched off.
+        // IGNORED here, never rejected. Whether the session is admitted is decided
+        // by the caller: assertSessionTokenGate for a session with no valid
+        // credentials, and authorizeSessionRequest's `sessions` scope check for a
+        // token that verifies. That separation is what lets a valid token identify
+        // its caller even when the gate is switched off.
         try {
             const payload = yield input.verify(input.sessionToken);
             const sub = payload === null || payload === void 0 ? void 0 : payload.sub;

package/lib/src/services/session/shutdownReason.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UNEXPECTED_SHUTDOWN_REASON = void 0;
+exports.unexpectedShutdownReason = unexpectedShutdownReason;
+/** The reason recorded when Appium ends a session and gives no cause of its own. */
+exports.UNEXPECTED_SHUTDOWN_REASON = 'Driver shut down unexpectedly';
+/**
+ * The failure reason of a session Appium ended by itself
+ * (`XenonPlugin.onUnexpectedShutdown`): the message of the cause Appium
+ * passed, else UNEXPECTED_SHUTDOWN_REASON.
+ *
+ * Appium's new-command timeout is the usual cause, and its message ("New
+ * Command Timeout of 60 seconds expired. Try customizing the timeout using
+ * the 'newCommandTimeout' desired capability") is what files the session
+ * under TIMEOUT. A driver that gives up on itself passes its own error, such
+ * as base-driver's "The driver was unexpectedly shut down!". The umbrella's
+ * placeholder for a missing cause, "Unknown error", says nothing, so it gets
+ * the fallback too. Through 2.14 every such session was recorded with the
+ * fixed reason, which no failure pattern matches, so an idle session was
+ * filed UNKNOWN.
+ */
+function unexpectedShutdownReason(cause) {
+    const message = typeof cause === 'string' ? cause : cause === null || cause === void 0 ? void 0 : cause.message;
+    const text = typeof message === 'string' ? message.trim() : '';
+    return text && text !== 'Unknown error' ? text : exports.UNEXPECTED_SHUTDOWN_REASON;
+}

package/lib/src/services/settings/SelfHealingSwitch.js

@@ -0,0 +1,70 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SelfHealingSwitch = void 0;
+const typedi_1 = require("typedi");
+const logger_1 = __importDefault(require("../../logger"));
+const web_config_service_1 = require("../../data-service/web-config-service");
+const labSettings_1 = require("./labSettings");
+/**
+ * Whether self-healing is on, for the command interceptor, which asks at every
+ * command and so must never read the database.
+ *
+ * The value saved on the Settings page (the `WebConfig` row `enableSelfHealing`)
+ * is kept here, loaded once at boot and replaced when `POST /config` saves it.
+ * The rule is the one every lab setting follows (`selfHealingEnabled`): the
+ * saved value, else the plugin option the server started with, else on. The
+ * interceptor passes the options it was given, so the startup half is always
+ * the live one.
+ *
+ * Through 2.13 the toggle was stored nowhere and the interceptor read the
+ * startup options alone, so switching healing off in the dashboard did nothing.
+ */
+let SelfHealingSwitch = class SelfHealingSwitch {
+    /** Whether a failed findElement goes on to the healing tiers, now. */
+    isEnabled(startup) {
+        return (0, labSettings_1.selfHealingEnabled)(startup.enableSelfHealing, this.saved);
+    }
+    /**
+     * Reads the saved value, once, at boot. A database that can't be read leaves
+     * the startup option in charge, as it does for the cleanup job, and is said
+     * once here rather than at every command.
+     */
+    load() {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const { enableSelfHealing } = yield typedi_1.Container.get(web_config_service_1.WebConfigService).getConfig();
+                this.saved = typeof enableSelfHealing === 'boolean' ? enableSelfHealing : undefined;
+            }
+            catch (err) {
+                this.saved = undefined;
+                logger_1.default.warn(`Could not read the saved self-healing setting, using the startup option: ${err === null || err === void 0 ? void 0 : err.message}`);
+            }
+        });
+    }
+    /** What `POST /config` just saved, in force for the next command. */
+    set(saved) {
+        this.saved = saved;
+    }
+};
+exports.SelfHealingSwitch = SelfHealingSwitch;
+exports.SelfHealingSwitch = SelfHealingSwitch = __decorate([
+    (0, typedi_1.Service)()
+], SelfHealingSwitch);

package/lib/src/services/settings/aiEngineSettings.js

@@ -0,0 +1,219 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiEngineSettings = exports.AI_ENGINE_SETTINGS = exports.AI_PROVIDERS = void 0;
+exports.pickAiEngine = pickAiEngine;
+exports.effectiveAiEngine = effectiveAiEngine;
+exports.validateAiEngineUpdate = validateAiEngineUpdate;
+exports.aiEngineUpdateOf = aiEngineUpdateOf;
+const typedi_1 = require("typedi");
+const logger_1 = __importDefault(require("../../logger"));
+const config_1 = require("../../config");
+const web_config_service_1 = require("../../data-service/web-config-service");
+/**
+ * The AI engine page's settings: which provider answers the AI calls (failure
+ * analysis, the visual and LLM healing tiers, visual assertions), and the model
+ * and address it uses.
+ *
+ * They follow the rule every lab setting does (labSettings.ts): a value saved
+ * in the dashboard (`WebConfig`, written by `POST /config`), else the plugin
+ * option or environment variable the server was started with, else the
+ * default. The result is written to `config`, which every AI call reads, at
+ * boot and on each save, so a change applies to the next call without a
+ * restart. Through 2.14 `POST /config` changed `config` and saved nothing: a
+ * restart went back to the provider the server was started with.
+ *
+ * API keys are not among them. They come from the server's environment only,
+ * are never saved, and are never sent to the dashboard.
+ */
+exports.AI_PROVIDERS = ['gemini', 'openai', 'anthropic', 'ollama'];
+/** The settings decided here, by their names in `config`, `WebConfig` and `/config`. */
+exports.AI_ENGINE_SETTINGS = [
+    'aiProvider',
+    'aiModel',
+    'aiBaseUrl',
+    'geminiModel',
+    'openaiModel',
+    'anthropicModel',
+    'ollamaModel',
+];
+const MODEL_SETTINGS = [
+    'aiModel',
+    'geminiModel',
+    'openaiModel',
+    'anthropicModel',
+    'ollamaModel',
+];
+const DEFAULT_PROVIDER = 'gemini';
+const MODEL_MAX_LENGTH = 200;
+const BASE_URL_MAX_LENGTH = 2048;
+const isProvider = (v) => typeof v === 'string' && exports.AI_PROVIDERS.includes(v);
+const isNonEmpty = (v) => typeof v === 'string' && v.trim() !== '';
+/** The AI engine settings in `source` (the running config, the saved rows), and nothing else. */
+function pickAiEngine(source) {
+    const out = {};
+    for (const name of exports.AI_ENGINE_SETTINGS) {
+        if (typeof source[name] === 'string')
+            out[name] = source[name];
+    }
+    return out;
+}
+/**
+ * The settings in effect, field by field: the saved value when it can work,
+ * else the one the server was started with, else the default (gemini; a model
+ * or base URL has none, and the provider's own then applies). An empty saved
+ * value is the person clearing it. The started-with provider is kept as it
+ * is, even one Xenon doesn't know: falling back to another provider would
+ * send screenshots somewhere the server's owner didn't choose. AIService then
+ * runs with no provider, and says so.
+ */
+function effectiveAiEngine(startup, saved) {
+    const out = {
+        aiProvider: isProvider(saved.aiProvider)
+            ? saved.aiProvider
+            : isNonEmpty(startup.aiProvider)
+                ? startup.aiProvider
+                : DEFAULT_PROVIDER,
+    };
+    for (const name of exports.AI_ENGINE_SETTINGS) {
+        if (name === 'aiProvider')
+            continue;
+        const mine = saved[name];
+        out[name] = isNonEmpty(mine)
+            ? mine.trim()
+            : isNonEmpty(startup[name])
+                ? startup[name]
+                : undefined;
+    }
+    return out;
+}
+/** Why `url` can't be saved as the base URL, or null. */
+function baseUrlProblem(url) {
+    const why = "aiBaseUrl must be an http or https address with no user name, password or query (the API key comes from the server's environment), or empty to use the server's own.";
+    if (url.length > BASE_URL_MAX_LENGTH)
+        return why;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch (_a) {
+        return why;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        return why;
+    // Anything that could carry a credential would be one saved in the database.
+    if (parsed.username || parsed.password || parsed.search || parsed.hash)
+        return why;
+    return null;
+}
+/**
+ * What is wrong with the AI engine fields of a settings update, or null.
+ * Checked before anything is saved: a saved value outlives the restart that
+ * used to undo it. Each may be empty, to go back to what the server was
+ * started with. Fields not sent are not checked.
+ */
+function validateAiEngineUpdate(body) {
+    const has = (key) => body[key] !== undefined;
+    if (has('aiProvider') && !(body.aiProvider === '' || isProvider(body.aiProvider))) {
+        return {
+            field: 'aiProvider',
+            message: `aiProvider must be one of ${exports.AI_PROVIDERS.join(', ')}, or empty to use the server's own.`,
+        };
+    }
+    for (const field of MODEL_SETTINGS) {
+        if (!has(field))
+            continue;
+        const value = body[field];
+        const name = typeof value === 'string' ? value.trim() : null;
+        if (name === null || name.length > MODEL_MAX_LENGTH || /[\s\u0000-\u001f\u007f]/.test(name)) {
+            return {
+                field,
+                message: `${field} must be a model name with no spaces, of at most ${MODEL_MAX_LENGTH} characters, or empty to use the server's own.`,
+            };
+        }
+    }
+    if (has('aiBaseUrl')) {
+        const value = body.aiBaseUrl;
+        const problem = typeof value !== 'string'
+            ? 'aiBaseUrl must be text.'
+            : value.trim() === ''
+                ? null
+                : baseUrlProblem(value.trim());
+        if (problem)
+            return { field: 'aiBaseUrl', message: problem };
+    }
+    return null;
+}
+/** The AI engine fields of a checked update, as they are saved: names trimmed. */
+function aiEngineUpdateOf(body) {
+    const picked = pickAiEngine(body);
+    for (const name of Object.keys(picked))
+        picked[name] = picked[name].trim();
+    return picked;
+}
+/**
+ * Keeps `config`'s AI engine settings at the values in effect. Loaded once at
+ * boot, after the startup options were applied and the database is ready, and
+ * told of each save by `POST /config`.
+ */
+let AiEngineSettings = class AiEngineSettings {
+    constructor() {
+        /** What the dashboard saved. */
+        this.saved = {};
+    }
+    /**
+     * Reads the saved settings and applies them. A database that can't be read
+     * leaves the startup settings in charge, as it does for the other settings.
+     */
+    load() {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.startedWith();
+            try {
+                this.saved = pickAiEngine((yield typedi_1.Container.get(web_config_service_1.WebConfigService).getConfig()));
+            }
+            catch (err) {
+                this.saved = {};
+                logger_1.default.warn(`Could not read the saved AI engine settings, using the startup options: ${err === null || err === void 0 ? void 0 : err.message}`);
+            }
+            this.apply();
+        });
+    }
+    /** What `POST /config` just saved, in force for the next AI call. */
+    noteSaved(update) {
+        this.startedWith();
+        this.saved = Object.assign(Object.assign({}, this.saved), update);
+        this.apply();
+    }
+    startedWith() {
+        if (!this.startup)
+            this.startup = pickAiEngine(config_1.config);
+        return this.startup;
+    }
+    apply() {
+        const before = config_1.config.aiProvider;
+        (0, config_1.updateConfig)(effectiveAiEngine(this.startedWith(), this.saved));
+        if (config_1.config.aiProvider !== before)
+            logger_1.default.info(`AI provider: ${config_1.config.aiProvider}`);
+    }
+};
+exports.AiEngineSettings = AiEngineSettings;
+exports.AiEngineSettings = AiEngineSettings = __decorate([
+    (0, typedi_1.Service)()
+], AiEngineSettings);

package/lib/src/services/settings/labSettings.js

@@ -0,0 +1,149 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.settingsDefaults = settingsDefaults;
+exports.isValidCron = isValidCron;
+exports.selfHealingEnabled = selfHealingEnabled;
+exports.effectiveSettings = effectiveSettings;
+exports.loadEffectiveSettings = loadEffectiveSettings;
+exports.validateSettingsUpdate = validateSettingsUpdate;
+const typedi_1 = require("typedi");
+const node_schedule_1 = __importDefault(require("node-schedule"));
+const schema_json_1 = __importDefault(require("../../../schema.json"));
+const logger_1 = __importDefault(require("../../logger"));
+const PluginContext_1 = require("../../PluginContext");
+const web_config_service_1 = require("../../data-service/web-config-service");
+const schemaProperties = schema_json_1.default.properties;
+function schemaDefault(key) {
+    return schemaProperties[key].default;
+}
+/** The defaults schema.json declares, which Appium fills in: the server's own. */
+function settingsDefaults() {
+    return {
+        enableSelfHealing: schemaDefault('enableSelfHealing'),
+        healthCheckIntervalMs: schemaDefault('healthCheckIntervalMs'),
+        buildCleanupDays: schemaDefault('buildCleanupDays'),
+        buildCleanupMaxCount: schemaDefault('buildCleanupMaxCount'),
+        buildCleanupSchedule: schemaDefault('buildCleanupSchedule'),
+        deleteBuildAssets: schemaDefault('deleteBuildAssets'),
+    };
+}
+/**
+ * Whether a string is a cron expression the scheduler will run: five or six
+ * fields. node-schedule alone also takes a date ("2030-01-01") as a one-off
+ * job, which is not a schedule that repeats.
+ */
+function isValidCron(value) {
+    if (typeof value !== 'string')
+        return false;
+    const fields = value.trim().split(/\s+/);
+    if (fields.length < 5 || fields.length > 6)
+        return false;
+    if (!fields.every((field) => /^[0-9A-Za-z*/,\-?#]+$/.test(field)))
+        return false;
+    const job = new node_schedule_1.default.Job(() => undefined);
+    const ok = job.schedule(value.trim());
+    job.cancel();
+    return ok;
+}
+const wholeNumberAtLeastOne = (v) => typeof v === 'number' && Number.isInteger(v) && v >= 1;
+const positiveNumber = (v) => typeof v === 'number' && Number.isFinite(v) && v > 0;
+const isBoolean = (v) => typeof v === 'boolean';
+/** The first value that is usable, in the order given. */
+function firstValid(valid, ...candidates) {
+    return candidates.find(valid);
+}
+/**
+ * Whether self-healing runs: the value saved in the dashboard, else the plugin
+ * option, else the default (on). The same rule `effectiveSettings` applies,
+ * on its own because the command interceptor asks at every command and
+ * `effectiveSettings` also checks cron expressions. A value that is not a
+ * boolean is no choice, so `"false"` as an option does not turn healing off.
+ */
+function selfHealingEnabled(startupOption, saved) {
+    var _a;
+    const fallback = schemaDefault('enableSelfHealing');
+    return (_a = firstValid(isBoolean, saved, startupOption, fallback)) !== null && _a !== void 0 ? _a : fallback;
+}
+/**
+ * The settings in effect: saved in the dashboard, else the plugin option the
+ * server started with, else the default. A saved or started-with value that
+ * could not work (a retention window of 0 would purge everything) is skipped,
+ * so a bad row never reaches the cleanup job.
+ */
+function effectiveSettings(startup, saved) {
+    var _a, _b, _c, _d, _e;
+    const defaults = settingsDefaults();
+    const out = {
+        enableSelfHealing: selfHealingEnabled(startup.enableSelfHealing, saved.enableSelfHealing),
+        healthCheckIntervalMs: (_a = firstValid(positiveNumber, saved.healthCheckIntervalMs, startup.healthCheckIntervalMs, defaults.healthCheckIntervalMs)) !== null && _a !== void 0 ? _a : defaults.healthCheckIntervalMs,
+        buildCleanupDays: (_b = firstValid(wholeNumberAtLeastOne, saved.buildCleanupDays, startup.buildCleanupDays, defaults.buildCleanupDays)) !== null && _b !== void 0 ? _b : defaults.buildCleanupDays,
+        buildCleanupMaxCount: (_c = firstValid(wholeNumberAtLeastOne, saved.buildCleanupMaxCount, startup.buildCleanupMaxCount, defaults.buildCleanupMaxCount)) !== null && _c !== void 0 ? _c : defaults.buildCleanupMaxCount,
+        buildCleanupSchedule: (_d = firstValid(isValidCron, saved.buildCleanupSchedule, startup.buildCleanupSchedule, defaults.buildCleanupSchedule)) !== null && _d !== void 0 ? _d : defaults.buildCleanupSchedule,
+        deleteBuildAssets: (_e = firstValid(isBoolean, saved.deleteBuildAssets, startup.deleteBuildAssets, defaults.deleteBuildAssets)) !== null && _e !== void 0 ? _e : defaults.deleteBuildAssets,
+    };
+    // A saved schedule of '' is the person clearing it, to go back to the
+    // interval; only an unsaved one falls through to the startup option.
+    const schedule = typeof saved.healthCheckSchedule === 'string'
+        ? saved.healthCheckSchedule
+        : startup.healthCheckSchedule;
+    if (typeof schedule === 'string' && schedule.trim() !== '') {
+        out.healthCheckSchedule = schedule;
+    }
+    return out;
+}
+/** The settings in effect now: what is saved, over what the server started with. */
+function loadEffectiveSettings() {
+    return __awaiter(this, arguments, void 0, function* (startup = typedi_1.Container.get(PluginContext_1.PluginContext).pluginArgs) {
+        let saved = {};
+        try {
+            saved = yield typedi_1.Container.get(web_config_service_1.WebConfigService).getConfig();
+        }
+        catch (err) {
+            // A cleanup that can't read the dashboard's values still runs, on the
+            // startup options: skipping a night's cleanup helps nobody.
+            logger_1.default.warn(`Could not read the saved settings, using the startup options: ${err === null || err === void 0 ? void 0 : err.message}`);
+        }
+        return effectiveSettings(startup, saved);
+    });
+}
+/**
+ * What is wrong with a settings update, or null. The cleanup fields are held to
+ * a rule because a retention window of 0, or a cap of 0, would purge every
+ * build, and these values used to be inert; the self-healing switch because
+ * anything but true or false is no answer to "on or off". The other fields are
+ * not checked. Fields not sent are not checked either.
+ */
+function validateSettingsUpdate(body) {
+    const has = (key) => body[key] !== undefined;
+    for (const field of ['buildCleanupDays', 'buildCleanupMaxCount']) {
+        if (has(field) && !wholeNumberAtLeastOne(body[field])) {
+            return { field, message: `${field} must be a whole number of at least 1.` };
+        }
+    }
+    if (has('buildCleanupSchedule') && !isValidCron(body.buildCleanupSchedule)) {
+        return {
+            field: 'buildCleanupSchedule',
+            message: 'buildCleanupSchedule must be a cron expression with five or six fields, ' +
+                "such as '0 0 * * *' for midnight.",
+        };
+    }
+    if (has('deleteBuildAssets') && typeof body.deleteBuildAssets !== 'boolean') {
+        return { field: 'deleteBuildAssets', message: 'deleteBuildAssets must be true or false.' };
+    }
+    if (has('enableSelfHealing') && typeof body.enableSelfHealing !== 'boolean') {
+        return { field: 'enableSelfHealing', message: 'enableSelfHealing must be true or false.' };
+    }
+    return null;
+}