@xenon-device-management/xenon 2.13.2 → 2.15.0

package/lib/test/unit/authMiddleware.credentialLifetime.spec.js

@@ -0,0 +1,149 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const typedi_1 = require("typedi");
+const authMiddleware_1 = require("../../src/middleware/authMiddleware");
+const ApiKeyService_1 = require("../../src/services/ApiKeyService");
+const UserSessionService_1 = require("../../src/services/UserSessionService");
+const UserService_1 = require("../../src/services/UserService");
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const prisma_1 = require("../../src/prisma");
+const container_registration_1 = require("../helpers/container-registration");
+/**
+ * How long the credential behind a request lasts, as authMiddleware sees it.
+ *
+ * - req.auth.credentialExpiresAt: when a Bearer token or an API key stops
+ *   working, so what it mints (POST /auth/token, POST /profile/tokens) can't
+ *   outlive it.
+ * - The dashboard cookie's Max-Age, renewed on every request, follows
+ *   XENON_USER_SESSION_TTL_MS. It was renewed at a fixed 24 hours, so a
+ *   longer setting signed people out after a day away anyway.
+ */
+describe('authMiddleware: how long the credential lasts', () => {
+    let dir;
+    let keys;
+    let restore;
+    let ttlBefore;
+    const member = { id: 'u1', role: 'MEMBER', status: 'ACTIVE' };
+    function res() {
+        const out = { cookies: [] };
+        out.status = (c) => {
+            out.code = c;
+            return out;
+        };
+        out.json = (b) => {
+            out.body = b;
+            return out;
+        };
+        out.cookie = (name, value, opts) => {
+            out.cookies.push({ name, value, opts });
+            return out;
+        };
+        return out;
+    }
+    function run(headers) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const req = { headers, query: {}, path: '/x' };
+            const r = res();
+            const next = sinon_1.default.spy();
+            yield (0, authMiddleware_1.authMiddleware)(req, r, next);
+            (0, chai_1.expect)(next.calledOnce, `refused: ${JSON.stringify(r.body)}`).to.equal(true);
+            return { req, res: r };
+        });
+    }
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        ttlBefore = process.env.XENON_USER_SESSION_TTL_MS;
+        restore = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, UserService_1.UserService, ApiKeyService_1.ApiKeyService, UserSessionService_1.UserSessionService);
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-cred-life-'));
+        keys = new JwtKeyService_1.JwtKeyService();
+        yield keys.init(dir);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, keys);
+        typedi_1.Container.set(UserService_1.UserService, { findById: sinon_1.default.stub().resolves(member) });
+        typedi_1.Container.set(ApiKeyService_1.ApiKeyService, {
+            verifyPair: sinon_1.default.stub().resolves(null),
+            verify: sinon_1.default.stub().resolves(null),
+        });
+        const sessions = new UserSessionService_1.UserSessionService();
+        sinon_1.default.stub(sessions, 'resolve').resolves(null);
+        typedi_1.Container.set(UserSessionService_1.UserSessionService, sessions);
+        sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([]);
+    }));
+    afterEach(() => {
+        if (ttlBefore === undefined)
+            delete process.env.XENON_USER_SESSION_TTL_MS;
+        else
+            process.env.XENON_USER_SESSION_TTL_MS = ttlBefore;
+        sinon_1.default.restore();
+        restore();
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    describe('req.auth.credentialExpiresAt', () => {
+        it("is a Bearer token's exp", () => __awaiter(void 0, void 0, void 0, function* () {
+            const token = yield keys.sign({ sub: 'u1', scopes: 'read' }, { audience: 'xenon-rest', ttlSeconds: 600 });
+            const { req } = yield run({ authorization: `Bearer ${token}` });
+            const exp = JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString()).exp;
+            (0, chai_1.expect)(req.auth.credentialExpiresAt).to.equal(exp * 1000);
+        }));
+        it("is an API key's expiresAt, and absent for a key that never expires", () => __awaiter(void 0, void 0, void 0, function* () {
+            const expiresAt = new Date(Date.now() + 3600000);
+            const verifyPair = typedi_1.Container.get(ApiKeyService_1.ApiKeyService).verifyPair;
+            verifyPair.resolves({ id: 'k1', userId: 'u1', scopes: 'read', rateLimit: 300, expiresAt });
+            const pair = { 'x-xenon-access-key': 'xen_a', 'x-xenon-token': 'tk' };
+            (0, chai_1.expect)((yield run(pair)).req.auth.credentialExpiresAt).to.equal(expiresAt.getTime());
+            verifyPair.resolves({
+                id: 'k1',
+                userId: 'u1',
+                scopes: 'read',
+                rateLimit: 300,
+                expiresAt: null,
+            });
+            (0, chai_1.expect)((yield run(pair)).req.auth.credentialExpiresAt).to.equal(undefined);
+        }));
+        it('is absent for a dashboard sign-in, which renews itself', () => __awaiter(void 0, void 0, void 0, function* () {
+            typedi_1.Container.get(UserSessionService_1.UserSessionService).resolve.resolves({
+                id: 's1',
+                userId: 'u1',
+            });
+            const { req } = yield run({ cookie: 'xenon_dashboard_session=s1' });
+            (0, chai_1.expect)(req.auth.kind).to.equal('user-session');
+            (0, chai_1.expect)(req.auth.credentialExpiresAt).to.equal(undefined);
+        }));
+    });
+    describe("the dashboard cookie's renewed Max-Age", () => {
+        it('follows XENON_USER_SESSION_TTL_MS, longer than a day included', () => __awaiter(void 0, void 0, void 0, function* () {
+            process.env.XENON_USER_SESSION_TTL_MS = String(7 * 24 * 3600000);
+            typedi_1.Container.get(UserSessionService_1.UserSessionService).resolve.resolves({
+                id: 's1',
+                userId: 'u1',
+            });
+            const { res: r } = yield run({ cookie: 'xenon_dashboard_session=s1' });
+            (0, chai_1.expect)(r.cookies[0].opts.maxAge).to.equal(7 * 24 * 3600000);
+        }));
+        it('is 24 hours by default', () => __awaiter(void 0, void 0, void 0, function* () {
+            delete process.env.XENON_USER_SESSION_TTL_MS;
+            typedi_1.Container.get(UserSessionService_1.UserSessionService).resolve.resolves({
+                id: 's1',
+                userId: 'u1',
+            });
+            const { res: r } = yield run({ cookie: 'xenon_dashboard_session=s1' });
+            (0, chai_1.expect)(r.cookies[0].opts.maxAge).to.equal(24 * 3600000);
+        }));
+    });
+});

package/lib/test/unit/bug-report/video-slice.spec.js

@@ -8,9 +8,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const chai_1 = require("chai");
 const events_1 = require("events");
+const path_1 = __importDefault(require("path"));
+const ffmpegPath_1 = require("../../../src/helpers/ffmpegPath");
 const video_slice_1 = require("../../../src/services/bug-report/video-slice");
 class FakeProc extends events_1.EventEmitter {
     constructor() {
@@ -41,6 +46,20 @@ describe('sliceVideo', () => {
         if (!result.ok)
             (0, chai_1.expect)(result.error).to.include('exit 1');
     }));
+    it("runs Xenon's own ffmpeg, never a bare `ffmpeg` from PATH", () => __awaiter(void 0, void 0, void 0, function* () {
+        // A server started from the Mac app has no shell PATH, and src/index.ts puts
+        // Xenon's ffmpeg folder at the end of PATH, behind any system ffmpeg.
+        const proc = new FakeProc();
+        let command = '';
+        const p = (0, video_slice_1.sliceVideo)('/in.mp4', 0, 60, '/tmp/out.mp4', (cmd) => {
+            command = cmd;
+            return proc;
+        });
+        setImmediate(() => proc.emit('exit', 0));
+        yield p;
+        (0, chai_1.expect)(command).to.equal((0, ffmpegPath_1.resolveFfmpegPath)());
+        (0, chai_1.expect)(path_1.default.isAbsolute(command)).to.equal(true);
+    }));
     it('returns ok=false on spawn error', () => __awaiter(void 0, void 0, void 0, function* () {
         const proc = new FakeProc();
         const p = (0, video_slice_1.sliceVideo)('/in.mp4', 0, 60, '/tmp/out.mp4', fakeSpawn(proc));

package/lib/test/unit/cleanup-settings-db.spec.js

@@ -0,0 +1,103 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const express_1 = __importDefault(require("express"));
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const typedi_1 = require("typedi");
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const dashboard_1 = __importDefault(require("../../src/app/routers/dashboard"));
+const CleanupService_1 = require("../../src/services/CleanupService");
+const PluginContext_1 = require("../../src/PluginContext");
+const config_1 = require("../../src/config");
+const IPluginArgs_1 = require("../../src/interfaces/IPluginArgs");
+const device_utils_1 = require("../../src/device-utils");
+const scratch_database_1 = require("../helpers/scratch-database");
+/**
+ * The Maintenance page's path from end to end, against a real (scratch)
+ * database: what POST /config saves is what the next cleanup run acts on,
+ * whatever the server was started with. (Saving more than one setting used to
+ * fail outright, see web-config-service.spec.ts.)
+ */
+describe('a retention window saved on the Maintenance page', () => {
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
+    const DAY_MS = 24 * 60 * 60 * 1000;
+    let context;
+    let savedArgs;
+    let savedRecordings;
+    let tmp;
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        context = typedi_1.Container.get(PluginContext_1.PluginContext);
+        savedArgs = context.pluginArgs;
+        context.pluginArgs = Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), { buildCleanupDays: 30, buildCleanupMaxCount: 100 });
+        savedRecordings = config_1.config.recordingsAssetsPath;
+        tmp = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-cleanup-db-'));
+        config_1.config.recordingsAssetsPath = path_1.default.join(tmp, 'recordings');
+        yield scratch.db.webConfig.deleteMany({});
+        yield scratch.db.build.deleteMany({});
+        const ago = (days) => new Date(Date.now() - days * DAY_MS);
+        yield scratch.db.build.create({ data: { id: 'b-10-days', createdAt: ago(10) } });
+        yield scratch.db.build.create({ data: { id: 'b-1-day', createdAt: ago(1) } });
+    }));
+    afterEach(() => {
+        (0, device_utils_1.stopAllTimers)();
+        context.pluginArgs = savedArgs;
+        config_1.config.recordingsAssetsPath = savedRecordings;
+        fs_1.default.rmSync(tmp, { recursive: true, force: true });
+    });
+    function app() {
+        const a = (0, express_1.default)();
+        a.use(express_1.default.json());
+        a.use((req, _res, next) => {
+            req.auth = {
+                kind: 'user-session',
+                userId: 'usr_x',
+                role: 'SUPER_ADMIN',
+                scopes: 'admin,devices,sessions,read',
+                rateLimit: 1000,
+            };
+            next();
+        });
+        dashboard_1.default.register(a);
+        return a;
+    }
+    const buildIds = () => __awaiter(void 0, void 0, void 0, function* () { return (yield scratch.db.build.findMany({ select: { id: true } })).map((b) => b.id).sort(); });
+    it('is what the next cleanup run purges by, over the 30 days the server started with', () => __awaiter(void 0, void 0, void 0, function* () {
+        const saved = yield (0, loopbackRequest_1.default)(app())
+            .post('/config')
+            .send({ buildCleanupDays: 5, buildCleanupMaxCount: 50, deleteBuildAssets: false })
+            .timeout(5000);
+        (0, chai_1.expect)(saved.status).to.equal(200);
+        const shown = yield (0, loopbackRequest_1.default)(app()).get('/config').timeout(5000);
+        (0, chai_1.expect)(shown.body).to.include({
+            buildCleanupDays: 5,
+            buildCleanupMaxCount: 50,
+            deleteBuildAssets: false,
+        });
+        yield typedi_1.Container.get(CleanupService_1.CleanupService).runCleanup(context.pluginArgs);
+        (0, chai_1.expect)(yield buildIds()).to.deep.equal(['b-1-day']);
+    }));
+    it('leaves both builds when nothing was saved and the server started with 30 days', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield typedi_1.Container.get(CleanupService_1.CleanupService).runCleanup(context.pluginArgs);
+        (0, chai_1.expect)(yield buildIds()).to.deep.equal(['b-1-day', 'b-10-days']);
+    }));
+    it('purges by a cap saved over the 100 the server started with', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield (0, loopbackRequest_1.default)(app()).post('/config').send({ buildCleanupMaxCount: 1 }).timeout(5000);
+        yield typedi_1.Container.get(CleanupService_1.CleanupService).runCleanup(context.pluginArgs);
+        (0, chai_1.expect)(yield buildIds()).to.deep.equal(['b-1-day']);
+    }));
+});

package/lib/test/unit/cleanup-settings.spec.js

@@ -0,0 +1,244 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const express_1 = __importDefault(require("express"));
+const sinon_1 = __importDefault(require("sinon"));
+const typedi_1 = require("typedi");
+const node_schedule_1 = __importDefault(require("node-schedule"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const dashboard_1 = __importDefault(require("../../src/app/routers/dashboard"));
+const prisma_1 = require("../../src/prisma");
+const CleanupService_1 = require("../../src/services/CleanupService");
+const web_config_service_1 = require("../../src/data-service/web-config-service");
+const PluginContext_1 = require("../../src/PluginContext");
+const IPluginArgs_1 = require("../../src/interfaces/IPluginArgs");
+const device_utils_1 = require("../../src/device-utils");
+/**
+ * The Maintenance page saves the cleanup values (POST /config -> WebConfig),
+ * but the cleanup job read only the plugin options the server started with,
+ * so a saved retention window, build cap, asset purge or schedule did
+ * nothing until it matched what the server was started with, and never took
+ * effect at all. These pin the rule that replaced it: a value saved in the
+ * dashboard wins over the startup option, applies at the next run without a
+ * restart, and a new schedule replaces the old timer at once.
+ */
+const DAY_MS = 24 * 60 * 60 * 1000;
+function startupArgs(over = {}) {
+    return Object.assign(Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), { buildCleanupDays: 30, buildCleanupMaxCount: 100, buildCleanupSchedule: '0 0 * * *', deleteBuildAssets: true }), over);
+}
+/** How many days back the first build query looks: the retention window the run used. */
+function daysBack(findMany) {
+    const cutoff = findMany.firstCall.args[0].where.createdAt.lt;
+    return Math.round((Date.now() - cutoff.getTime()) / DAY_MS);
+}
+/** A WebConfig table in memory: what POST /config saves is what GET reads. */
+function fakeWebConfig(initial = {}) {
+    const saved = Object.assign({}, initial);
+    const svc = typedi_1.Container.get(web_config_service_1.WebConfigService);
+    sinon_1.default.stub(svc, 'getConfig').callsFake(() => __awaiter(this, void 0, void 0, function* () { return (Object.assign({}, saved)); }));
+    sinon_1.default.stub(svc, 'setConfig').callsFake((c) => __awaiter(this, void 0, void 0, function* () {
+        for (const [k, v] of Object.entries(c))
+            if (v !== undefined)
+                saved[k] = v;
+    }));
+    return saved;
+}
+describe('cleanup settings saved in the dashboard', () => {
+    let context;
+    let savedArgs;
+    beforeEach(() => {
+        context = typedi_1.Container.get(PluginContext_1.PluginContext);
+        savedArgs = context.pluginArgs;
+    });
+    afterEach(() => {
+        (0, device_utils_1.stopAllTimers)();
+        context.pluginArgs = savedArgs;
+        sinon_1.default.restore();
+    });
+    describe('the cleanup run', () => {
+        function stubDatabase() {
+            const findMany = sinon_1.default.stub(prisma_1.prisma.build, 'findMany').resolves([]);
+            sinon_1.default.stub(prisma_1.prisma.build, 'count').resolves(0);
+            const service = typedi_1.Container.get(CleanupService_1.CleanupService);
+            const purgeBuild = sinon_1.default.stub(service, 'purgeBuild').resolves();
+            sinon_1.default.stub(service, 'purgeOrphanSessions').resolves();
+            sinon_1.default.stub(service, 'purgeRecordings').resolves();
+            return { service, findMany, purgeBuild };
+        }
+        it('uses the retention window saved in the dashboard, not the startup option', () => __awaiter(void 0, void 0, void 0, function* () {
+            fakeWebConfig({ buildCleanupDays: 7 });
+            const { service, findMany } = stubDatabase();
+            yield service.runCleanup(startupArgs({ buildCleanupDays: 30 }));
+            (0, chai_1.expect)(daysBack(findMany)).to.equal(7);
+        }));
+        it('uses the build cap and the asset purge saved in the dashboard', () => __awaiter(void 0, void 0, void 0, function* () {
+            fakeWebConfig({ buildCleanupMaxCount: 2, deleteBuildAssets: false });
+            const { service, findMany, purgeBuild } = stubDatabase();
+            prisma_1.prisma.build.count.resolves(3);
+            findMany.callsFake(((args) => __awaiter(void 0, void 0, void 0, function* () {
+                var _a;
+                if ((args === null || args === void 0 ? void 0 : args.take) === 2)
+                    return [{ id: 'b3' }, { id: 'b2' }];
+                if ((_a = args === null || args === void 0 ? void 0 : args.where) === null || _a === void 0 ? void 0 : _a.createdAt)
+                    return [];
+                return [{ id: 'b1' }, { id: 'b2' }, { id: 'b3' }];
+            })));
+            yield service.runCleanup(startupArgs({ buildCleanupMaxCount: 100, deleteBuildAssets: true }));
+            (0, chai_1.expect)(purgeBuild.calledOnce).to.equal(true);
+            (0, chai_1.expect)(purgeBuild.firstCall.args).to.deep.equal(['b1', false]);
+        }));
+        it('falls back to the startup options when nothing was saved', () => __awaiter(void 0, void 0, void 0, function* () {
+            fakeWebConfig({});
+            const { service, findMany } = stubDatabase();
+            yield service.runCleanup(startupArgs({ buildCleanupDays: 12 }));
+            (0, chai_1.expect)(daysBack(findMany)).to.equal(12);
+        }));
+        it('still runs on the startup options when the saved settings cannot be read', () => __awaiter(void 0, void 0, void 0, function* () {
+            sinon_1.default.stub(typedi_1.Container.get(web_config_service_1.WebConfigService), 'getConfig').rejects(new Error('db down'));
+            const { service, findMany } = stubDatabase();
+            yield service.runCleanup(startupArgs({ buildCleanupDays: 12 }));
+            (0, chai_1.expect)(daysBack(findMany)).to.equal(12);
+        }));
+        it('ignores a saved value that would purge everything', () => __awaiter(void 0, void 0, void 0, function* () {
+            fakeWebConfig({ buildCleanupDays: 0, buildCleanupMaxCount: 0 });
+            const { service, findMany } = stubDatabase();
+            yield service.runCleanup(startupArgs({ buildCleanupDays: 12 }));
+            (0, chai_1.expect)(daysBack(findMany)).to.equal(12);
+        }));
+    });
+    describe('the schedule', () => {
+        it('starts on the schedule saved in the dashboard', () => __awaiter(void 0, void 0, void 0, function* () {
+            fakeWebConfig({ buildCleanupSchedule: '0 3 * * *' });
+            const scheduleJob = sinon_1.default.spy(node_schedule_1.default, 'scheduleJob');
+            yield (0, device_utils_1.setupCronCleanupBuilds)(startupArgs({ buildCleanupSchedule: '0 0 * * *' }));
+            (0, chai_1.expect)(scheduleJob.firstCall.args[0]).to.equal('0 3 * * *');
+        }));
+        it('starts on the startup schedule when none was saved', () => __awaiter(void 0, void 0, void 0, function* () {
+            fakeWebConfig({});
+            const scheduleJob = sinon_1.default.spy(node_schedule_1.default, 'scheduleJob');
+            yield (0, device_utils_1.setupCronCleanupBuilds)(startupArgs({ buildCleanupSchedule: '30 1 * * *' }));
+            (0, chai_1.expect)(scheduleJob.firstCall.args[0]).to.equal('30 1 * * *');
+        }));
+    });
+    describe('POST /config', () => {
+        function app() {
+            const a = (0, express_1.default)();
+            a.use(express_1.default.json());
+            a.use((req, _res, next) => {
+                req.auth = {
+                    kind: 'user-session',
+                    userId: 'usr_x',
+                    role: 'SUPER_ADMIN',
+                    scopes: 'admin,devices,sessions,read',
+                    rateLimit: 1000,
+                };
+                next();
+            });
+            dashboard_1.default.register(a);
+            return a;
+        }
+        it('replaces the running cleanup timer when the schedule changes', () => __awaiter(void 0, void 0, void 0, function* () {
+            fakeWebConfig({});
+            context.pluginArgs = startupArgs({ buildCleanupSchedule: '0 0 * * *' });
+            const scheduleJob = sinon_1.default.spy(node_schedule_1.default, 'scheduleJob');
+            yield (0, device_utils_1.setupCronCleanupBuilds)(context.pluginArgs);
+            const running = scheduleJob.firstCall.returnValue;
+            const cancelRunning = sinon_1.default.spy(running, 'cancel');
+            const r = yield (0, loopbackRequest_1.default)(app())
+                .post('/config')
+                .send({ buildCleanupSchedule: '0 4 * * *' })
+                .timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(200);
+            (0, chai_1.expect)(cancelRunning.calledOnce, 'the old timer was cancelled').to.equal(true);
+            (0, chai_1.expect)(scheduleJob.lastCall.args[0]).to.equal('0 4 * * *');
+            (0, chai_1.expect)(scheduleJob.lastCall.returnValue).to.not.equal(running);
+        }));
+        it('does not touch the timer when the schedule is not in the request', () => __awaiter(void 0, void 0, void 0, function* () {
+            fakeWebConfig({});
+            context.pluginArgs = startupArgs();
+            const scheduleJob = sinon_1.default.spy(node_schedule_1.default, 'scheduleJob');
+            const r = yield (0, loopbackRequest_1.default)(app()).post('/config').send({ buildCleanupDays: 14 }).timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(200);
+            (0, chai_1.expect)(scheduleJob.called).to.equal(false);
+        }));
+        for (const [label, body] of [
+            ['a retention window of zero', { buildCleanupDays: 0 }],
+            ['a negative retention window', { buildCleanupDays: -3 }],
+            ['a fractional build cap', { buildCleanupMaxCount: 2.5 }],
+            ['a build cap that is not a number', { buildCleanupMaxCount: null }],
+            ['a schedule that is not a cron expression', { buildCleanupSchedule: 'every night' }],
+            ['an asset purge that is not a boolean', { deleteBuildAssets: 'yes' }],
+        ]) {
+            it(`refuses ${label} and saves nothing`, () => __awaiter(void 0, void 0, void 0, function* () {
+                const saved = fakeWebConfig({});
+                context.pluginArgs = startupArgs();
+                const r = yield (0, loopbackRequest_1.default)(app()).post('/config').send(body).timeout(5000);
+                (0, chai_1.expect)(r.status).to.equal(400);
+                (0, chai_1.expect)(r.body.error).to.equal('invalid_setting');
+                (0, chai_1.expect)(r.body.message).to.be.a('string').and.not.equal('');
+                (0, chai_1.expect)(saved).to.deep.equal({});
+            }));
+        }
+    });
+    describe('GET /config', () => {
+        function app() {
+            const a = (0, express_1.default)();
+            a.use((req, _res, next) => {
+                req.auth = {
+                    kind: 'user-session',
+                    userId: 'usr_x',
+                    role: 'ADMIN',
+                    scopes: 'admin,read',
+                    rateLimit: 1000,
+                };
+                next();
+            });
+            dashboard_1.default.register(a);
+            return a;
+        }
+        it('shows the value the server runs with when nothing was saved', () => __awaiter(void 0, void 0, void 0, function* () {
+            fakeWebConfig({});
+            context.pluginArgs = startupArgs({
+                buildCleanupDays: 12,
+                buildCleanupSchedule: '30 1 * * *',
+            });
+            const r = yield (0, loopbackRequest_1.default)(app()).get('/config').timeout(5000);
+            (0, chai_1.expect)(r.status).to.equal(200);
+            (0, chai_1.expect)(r.body.buildCleanupDays).to.equal(12);
+            (0, chai_1.expect)(r.body.buildCleanupSchedule).to.equal('30 1 * * *');
+        }));
+        it('shows the saved value over the startup one', () => __awaiter(void 0, void 0, void 0, function* () {
+            fakeWebConfig({ buildCleanupDays: 7 });
+            context.pluginArgs = startupArgs({ buildCleanupDays: 12 });
+            const r = yield (0, loopbackRequest_1.default)(app()).get('/config').timeout(5000);
+            (0, chai_1.expect)(r.body.buildCleanupDays).to.equal(7);
+        }));
+        it("sends the server's own defaults, so no page needs a number of its own", () => __awaiter(void 0, void 0, void 0, function* () {
+            fakeWebConfig({});
+            context.pluginArgs = startupArgs();
+            const r = yield (0, loopbackRequest_1.default)(app()).get('/config').timeout(5000);
+            (0, chai_1.expect)(r.body.defaults).to.deep.equal({
+                enableSelfHealing: true,
+                healthCheckIntervalMs: 300000,
+                buildCleanupDays: 30,
+                buildCleanupMaxCount: 100,
+                buildCleanupSchedule: '0 0 * * *',
+                deleteBuildAssets: true,
+            });
+            (0, chai_1.expect)(r.body.healthCheckIntervalMs).to.equal(300000);
+        }));
+    });
+});

package/lib/test/unit/dashboard-api-paths.spec.js

@@ -0,0 +1,101 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const index_1 = require("../../src/app/index");
+const IPluginArgs_1 = require("../../src/interfaces/IPluginArgs");
+const expressRoutes_1 = require("../helpers/expressRoutes");
+/**
+ * Every address the dashboard calls must be one the server serves.
+ *
+ * "Assign team" called `PUT /xenon/api/grid/device/:udid/team` while the
+ * server mounts that route at the API root (`/xenon/api/device/:udid/team`).
+ * Nothing mounts `/grid`, so every assignment from the Devices page was a
+ * 404, and the only test mocked the whole api-service, so it never saw it.
+ *
+ * This reads the paths the dashboard's source writes down (`/xenon/api/...`
+ * literals and the `makeGETRequest('/...')` family, which the api client
+ * prefixes with `/xenon/api`) and checks each against the routes the router
+ * really serves.
+ */
+const WEB_SRC = path_1.default.resolve(__dirname, '../../web/src');
+const API = '/xenon/api';
+/** "/xenon/api/control/:udid/tap" and "/xenon/api/control/${udid}/tap" both -> ".../control/{}/tap" */
+const shape = (p) => p
+    .replace(/\$\{[^}]*\}/g, '{}')
+    .replace(/:[A-Za-z_]\w*/g, '{}')
+    .replace(/\/+$/, '');
+// Addresses written in the dashboard that are not served, each with why.
+const KNOWN_NOT_SERVED = {
+    [`${API}/session/{}/xenon/omni-scan`]: 'XenonApiService.omniScan: an Appium plugin route, not under /xenon/api; no caller',
+    [`${API}/session/{}/xenon/test-locator`]: 'XenonApiService.testAiLocator: an Appium plugin route, not under /xenon/api; no caller',
+    [`${API}/sessions`]: "ApiKeyGate's sign-in probe: only the 401 matters, and the login check answers before routing",
+};
+// Written as a base that the same file extends (`const BASE = '/xenon/api/auth'`,
+// then `${BASE}/me`), so the base alone is not a route.
+const BASES = [`${API}/auth`, `${API}/interceptor`, `${API}/profile`];
+function sources(dir, out = []) {
+    for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
+        const full = path_1.default.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (entry.name !== 'node_modules')
+                sources(full, out);
+        }
+        else if (/\.tsx?$/.test(entry.name) && !/\.(test|spec)\.tsx?$/.test(entry.name)) {
+            out.push(full);
+        }
+    }
+    return out;
+}
+/** Each address a source file writes down, with the file it is in. */
+function dashboardAddresses() {
+    const found = [];
+    for (const file of sources(WEB_SRC)) {
+        const text = fs_1.default.readFileSync(file, 'utf8');
+        const rel = path_1.default.relative(WEB_SRC, file);
+        // '/xenon/api/...' in a string or template; not '/xenon/api-docs', nor the
+        // api client's bare `/xenon/api${url}` prefix.
+        for (const m of text.matchAll(/['"`]\/xenon\/api(\/[^'"`\s?]*)/g)) {
+            found.push({ address: `${API}${m[1]}`, file: rel });
+        }
+        // apiClient.makeGETRequest('/queue') -> the client adds the prefix.
+        for (const m of text.matchAll(/make(?:GET|POST|PUT|DELETE|PATCH)Request\(\s*['"`](\/[^'"`?]*)/g)) {
+            found.push({ address: `${API}${m[1]}`, file: rel });
+        }
+    }
+    return found;
+}
+describe('the addresses the dashboard calls', () => {
+    const served = [
+        ...(0, expressRoutes_1.routesOf)((0, index_1.createRouter)(Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), { hub: 'http://hub.example:4723' })), '/xenon'),
+    ]
+        .filter((r) => r.includes(' /xenon/api'))
+        .map((r) => shape(r.slice(r.indexOf(' ') + 1)));
+    const isServed = (address) => served.includes(shape(address));
+    const isBase = (address) => BASES.includes(shape(address));
+    const underBase = (base) => served.some((s) => s.startsWith(`${base}/`));
+    it("finds the dashboard's addresses (the scan is not reading nothing)", () => {
+        const all = dashboardAddresses();
+        (0, chai_1.expect)(all.length).to.be.greaterThan(60);
+        (0, chai_1.expect)(all.map((a) => shape(a.address))).to.include(`${API}/device/{}/team`);
+    });
+    it('are all served by the API router', () => {
+        const missing = dashboardAddresses()
+            .filter(({ address }) => !isServed(address) && !isBase(address) && !(shape(address) in KNOWN_NOT_SERVED))
+            .map(({ address, file }) => `${address}  (web/src/${file})`);
+        (0, chai_1.expect)([...new Set(missing)].sort(), 'called by the dashboard but not served').to.deep.equal([]);
+    });
+    it('has no allowance for an address that is now served or no longer written', () => {
+        const written = new Set(dashboardAddresses().map(({ address }) => shape(address)));
+        const stale = [
+            ...Object.keys(KNOWN_NOT_SERVED).filter((a) => isServed(a) || !written.has(a)),
+            ...BASES.filter((b) => !written.has(b) || !underBase(b)),
+        ];
+        (0, chai_1.expect)(stale, 'remove these from KNOWN_NOT_SERVED / BASES').to.deep.equal([]);
+    });
+});