@xenon-device-management/xenon 2.13.2 → 2.15.0

package/lib/test/unit/phone-network/session-start.spec.js

@@ -0,0 +1,110 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const typedi_1 = require("typedi");
+const SessionLifecycleService_1 = require("../../../src/services/SessionLifecycleService");
+const NetworkConditioningService_1 = require("../../../src/services/NetworkConditioningService");
+const InterceptorService_1 = require("../../../src/services/InterceptorService");
+const PhoneNetworkRestore_1 = require("../../../src/services/network/PhoneNetworkRestore");
+const PluginContext_1 = require("../../../src/PluginContext");
+const IPluginArgs_1 = require("../../../src/interfaces/IPluginArgs");
+const XenonCapabilityManager_1 = require("../../../src/XenonCapabilityManager");
+const SessionManager_1 = require("../../../src/sessions/SessionManager");
+const SessionType_1 = __importDefault(require("../../../src/enums/SessionType"));
+const container_registration_1 = require("../../helpers/container-registration");
+const scratch_database_1 = require("../../helpers/scratch-database");
+const android = { udid: 'R5CT', platform: 'android', deviceType: 'real', host: 'h' };
+const sessionOf = (type) => ({
+    getId: () => 's1',
+    getType: () => type,
+    getCapabilities: () => ({}),
+    apiKeyId: null,
+    userId: null,
+    startVideoRecording: sinon_1.default.stub().resolves(),
+});
+const capsWith = (extra) => (Object.assign({ [XenonCapabilityManager_1.XENON_CAPABILITIES.VIDEO_RECORDING]: false, [XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_MOCKS]: [], [XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_INCLUDE_HOSTS]: [], [XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_EXCLUDE_HOSTS]: [] }, extra));
+/**
+ * Where a session's network changes are made. Only the server that drives the
+ * phone makes them: a hub used to run its own adb against a node's phone (on
+ * one Mac, the very same phone), and start a second proxy for it.
+ */
+describe('a session’s network changes at its start', function () {
+    this.timeout(30000);
+    // The row a hub writes for a session another server runs (recordRoutedSession).
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
+    let restoreRegs;
+    let order;
+    let applyProfile;
+    let start;
+    let restoreLeftovers;
+    let context;
+    beforeEach(() => {
+        restoreRegs = (0, container_registration_1.saveRegistrations)(NetworkConditioningService_1.NetworkConditioningService, InterceptorService_1.InterceptorService, PhoneNetworkRestore_1.PhoneNetworkRestore, PluginContext_1.PluginContext);
+        order = [];
+        applyProfile = sinon_1.default.stub().callsFake(() => __awaiter(this, void 0, void 0, function* () { return void order.push('profile'); }));
+        start = sinon_1.default.stub().callsFake(() => __awaiter(this, void 0, void 0, function* () { return void order.push('interceptor'); }));
+        restoreLeftovers = sinon_1.default.stub().callsFake(() => __awaiter(this, void 0, void 0, function* () {
+            order.push('leftovers');
+            return 0;
+        }));
+        typedi_1.Container.set(NetworkConditioningService_1.NetworkConditioningService, { applyProfile });
+        typedi_1.Container.set(InterceptorService_1.InterceptorService, { start });
+        typedi_1.Container.set(PhoneNetworkRestore_1.PhoneNetworkRestore, { restoreLeftovers });
+        context = new PluginContext_1.PluginContext();
+        context.pluginArgs = Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), { enableDashboard: false });
+        typedi_1.Container.set(PluginContext_1.PluginContext, context);
+    });
+    afterEach(() => __awaiter(this, void 0, void 0, function* () {
+        sinon_1.default.restore();
+        SessionManager_1.SESSION_MANAGER.removeSession('s1');
+        restoreRegs();
+        yield scratch.db.session.deleteMany({});
+    }));
+    const apply = (type, caps) => typedi_1.Container.get(SessionLifecycleService_1.SessionLifecycleService).applyPostSessionLogic(sessionOf(type), caps, android);
+    it('puts back what an earlier session left on the phone, then applies its own', () => __awaiter(this, void 0, void 0, function* () {
+        yield apply(SessionType_1.default.LOCAL, capsWith({
+            [XenonCapabilityManager_1.XENON_CAPABILITIES.NETWORK_PROFILE]: 'Offline',
+            [XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_ENABLED]: true,
+        }));
+        (0, chai_1.expect)(restoreLeftovers.calledOnceWith({ udid: 'R5CT' })).to.equal(true);
+        (0, chai_1.expect)(order).to.deep.equal(['leftovers', 'profile', 'interceptor']);
+    }));
+    it("doesn't touch a phone another server drives", () => __awaiter(this, void 0, void 0, function* () {
+        for (const type of [SessionType_1.default.REMOTE, SessionType_1.default.CLOUD]) {
+            yield apply(type, capsWith({
+                [XenonCapabilityManager_1.XENON_CAPABILITIES.NETWORK_PROFILE]: 'Offline',
+                [XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_ENABLED]: true,
+            }));
+            SessionManager_1.SESSION_MANAGER.removeSession('s1');
+        }
+        (0, chai_1.expect)(order).to.deep.equal([]);
+    }));
+    it("starts the interceptor by the server's option when the session doesn't say", () => __awaiter(this, void 0, void 0, function* () {
+        context.pluginArgs = Object.assign(Object.assign({}, context.pluginArgs), { interceptor: { enabled: true, bufferSize: 9 } });
+        yield apply(SessionType_1.default.LOCAL, capsWith({}));
+        (0, chai_1.expect)(start.calledOnce).to.equal(true);
+        const [sessionId, device, opts] = start.firstCall.args;
+        (0, chai_1.expect)(sessionId).to.equal('s1');
+        (0, chai_1.expect)(device).to.equal(android);
+        (0, chai_1.expect)(opts).to.include({ enabled: true, bufferSize: 9, captureBodies: true });
+    }));
+    it("leaves the interceptor off when the session turns it off over the server's option", () => __awaiter(this, void 0, void 0, function* () {
+        context.pluginArgs = Object.assign(Object.assign({}, context.pluginArgs), { interceptor: { enabled: true } });
+        yield apply(SessionType_1.default.LOCAL, capsWith({ [XenonCapabilityManager_1.XENON_CAPABILITIES.INTERCEPTOR_ENABLED]: false }));
+        (0, chai_1.expect)(start.called).to.equal(false);
+    }));
+});

package/lib/test/unit/phone-network/xenon-proxy.spec.js

@@ -0,0 +1,69 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const net_1 = __importDefault(require("net"));
+const xenonProxy_1 = require("../../../src/services/network/xenonProxy");
+describe('a phone proxy setting, read', () => {
+    it('parses host:port', () => {
+        (0, chai_1.expect)((0, xenonProxy_1.parseProxySetting)('127.0.0.1:11100')).to.deep.equal({ host: '127.0.0.1', port: 11100 });
+        (0, chai_1.expect)((0, xenonProxy_1.parseProxySetting)(' 10.0.2.2:11105 ')).to.deep.equal({ host: '10.0.2.2', port: 11105 });
+    });
+    it('reads no proxy from what Android stores for none', () => {
+        for (const none of [null, undefined, '', 'null', ':0', '  ']) {
+            (0, chai_1.expect)((0, xenonProxy_1.isUnsetProxy)(none), String(none)).to.equal(true);
+            (0, chai_1.expect)((0, xenonProxy_1.parseProxySetting)(none)).to.equal(null);
+        }
+        (0, chai_1.expect)((0, xenonProxy_1.isUnsetProxy)('proxy.corp:3128')).to.equal(false);
+    });
+    it('refuses a value that is not host:port', () => {
+        (0, chai_1.expect)((0, xenonProxy_1.parseProxySetting)('proxy.corp')).to.equal(null);
+        (0, chai_1.expect)((0, xenonProxy_1.parseProxySetting)('a:b')).to.equal(null);
+        (0, chai_1.expect)((0, xenonProxy_1.parseProxySetting)('a:0')).to.equal(null);
+        (0, chai_1.expect)((0, xenonProxy_1.parseProxySetting)('a:70000')).to.equal(null);
+    });
+    it('knows the addresses a phone uses to reach this machine', () => {
+        const own = ['192.168.1.20'];
+        (0, chai_1.expect)((0, xenonProxy_1.pointsAtThisMachine)('127.0.0.1', own)).to.equal(true);
+        (0, chai_1.expect)((0, xenonProxy_1.pointsAtThisMachine)('localhost', own)).to.equal(true);
+        (0, chai_1.expect)((0, xenonProxy_1.pointsAtThisMachine)('10.0.2.2', own)).to.equal(true);
+        (0, chai_1.expect)((0, xenonProxy_1.pointsAtThisMachine)('192.168.1.20', own)).to.equal(true);
+        (0, chai_1.expect)((0, xenonProxy_1.pointsAtThisMachine)('192.168.1.21', own)).to.equal(false);
+        (0, chai_1.expect)((0, xenonProxy_1.pointsAtThisMachine)('proxy.corp', own)).to.equal(false);
+    });
+});
+describe('isPortListening', function () {
+    let server;
+    let livePort;
+    let deadPort;
+    before(() => __awaiter(this, void 0, void 0, function* () {
+        server = net_1.default.createServer((s) => s.destroy());
+        yield new Promise((r) => server.listen(0, '127.0.0.1', () => r()));
+        livePort = server.address().port;
+        const closed = net_1.default.createServer();
+        yield new Promise((r) => closed.listen(0, '127.0.0.1', () => r()));
+        deadPort = closed.address().port;
+        yield new Promise((r) => closed.close(() => r()));
+    }));
+    after(() => __awaiter(this, void 0, void 0, function* () {
+        yield new Promise((r) => server.close(() => r()));
+    }));
+    it('says a port with a listener answers', () => __awaiter(this, void 0, void 0, function* () {
+        (0, chai_1.expect)(yield (0, xenonProxy_1.isPortListening)(livePort)).to.equal(true);
+    }));
+    it('says a closed port does not', () => __awaiter(this, void 0, void 0, function* () {
+        (0, chai_1.expect)(yield (0, xenonProxy_1.isPortListening)(deadPort)).to.equal(false);
+    }));
+});

package/lib/test/unit/plugin.spec.js

@@ -81,7 +81,7 @@ describe('Device filter tests', () => {
         (0, chai_1.expect)(filter).to.deep.equal({
             platform: 'ios',
             platformVersion: '14.0',
-            name: 'iPhone',
+            appleFamily: 'iphone',
             deviceType: 'real',
             udid: ['21112-1111-1111-111'],
             minSDK: undefined,
@@ -113,7 +113,7 @@ describe('Device filter tests', () => {
         (0, chai_1.expect)(filter).to.deep.equal({
             platform: 'ios',
             platformVersion: '14.0',
-            name: 'iPhone',
+            appleFamily: 'iphone',
             filterByHost: undefined,
             deviceType: 'simulator',
             udid: [],
@@ -140,7 +140,7 @@ describe('Device filter tests', () => {
             platform: 'ios',
             filterByHost: undefined,
             platformVersion: undefined,
-            name: 'iPhone',
+            appleFamily: 'iphone',
             deviceType: 'simulator',
             udid: [],
             minSDK: '10.2.0',

package/lib/test/unit/profile-router.test.js

@@ -39,7 +39,12 @@ describe('profile router', () => {
     }));
     it('POST /profile/access-key/rotate returns a new accessKey', () => __awaiter(void 0, void 0, void 0, function* () {
         sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'rotateAccessKey').resolves({ id: 'u1', accessKey: 'xen_NEW' });
-        const app = appWithAuth({ userId: 'u1', role: 'ADMIN', scopes: 'devices,sessions,read' });
+        const app = appWithAuth({
+            kind: 'user-session',
+            userId: 'u1',
+            role: 'ADMIN',
+            scopes: 'admin,devices,sessions,read',
+        });
         const r = yield (0, loopbackRequest_1.default)(app).post('/profile/access-key/rotate');
         (0, chai_1.expect)(r.body.accessKey).to.equal('xen_NEW');
     }));
@@ -147,4 +152,120 @@ describe('profile router', () => {
         const r = yield (0, loopbackRequest_1.default)(app).delete('/profile/tokens/k1');
         (0, chai_1.expect)(r.status).to.equal(404);
     }));
+    // A credential can't do more to its owner's account than it could itself
+    // have been made to do.
+    describe('what the credential in use limits', () => {
+        // Rotating the access key ends every key pair its owner has, whatever
+        // their scopes, so it takes the person themselves (a dashboard sign-in)
+        // or a credential with the admin scope. Any credential, a read-only
+        // token included, could do it.
+        describe('POST /profile/access-key/rotate', () => {
+            let rotate;
+            beforeEach(() => {
+                rotate = sinon_1.default
+                    .stub(typedi_1.Container.get(UserService_1.UserService), 'rotateAccessKey')
+                    .resolves({ id: 'u1', accessKey: 'xen_NEW' });
+            });
+            for (const [kind, scopes] of [
+                ['bearer', 'read'],
+                ['api-key', 'read'],
+                ['api-key', 'devices,sessions,read'],
+                ['bearer', 'sessions'],
+            ]) {
+                it(`is refused to ${kind === 'bearer' ? 'a Bearer token' : 'an API key'} with ${scopes}`, () => __awaiter(void 0, void 0, void 0, function* () {
+                    const app = appWithAuth({ kind, userId: 'u1', role: 'ADMIN', scopes });
+                    const r = yield (0, loopbackRequest_1.default)(app).post('/profile/access-key/rotate');
+                    (0, chai_1.expect)(r.status).to.equal(403);
+                    (0, chai_1.expect)(r.body.error).to.match(/dashboard sign-in or a credential with the admin scope/);
+                    (0, chai_1.expect)(rotate.called).to.equal(false);
+                }));
+            }
+            it('is allowed to a dashboard sign-in, a member included', () => __awaiter(void 0, void 0, void 0, function* () {
+                const app = appWithAuth({
+                    kind: 'user-session',
+                    userId: 'u1',
+                    role: 'MEMBER',
+                    scopes: 'devices,sessions,read',
+                });
+                (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(app).post('/profile/access-key/rotate')).status).to.equal(200);
+            }));
+            it('is allowed to a credential with the admin scope', () => __awaiter(void 0, void 0, void 0, function* () {
+                const app = appWithAuth({
+                    kind: 'api-key',
+                    userId: 'u1',
+                    role: 'SUPER_ADMIN',
+                    scopes: 'admin',
+                });
+                (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(app).post('/profile/access-key/rotate')).status).to.equal(200);
+            }));
+        });
+        // A token made with a credential that expires ends no later than it: a
+        // 1-hour Bearer token made itself a key that never expired.
+        describe('POST /profile/tokens from a credential that expires', () => {
+            const inAnHour = new Date(Date.now() + 3600000);
+            const bearer = () => appWithAuth({
+                kind: 'bearer',
+                userId: 'u1',
+                role: 'MEMBER',
+                scopes: 'sessions,read',
+                credentialExpiresAt: inAnHour.getTime(),
+            });
+            let create;
+            beforeEach(() => {
+                create = sinon_1.default
+                    .stub(typedi_1.Container.get(ApiKeyService_1.ApiKeyService), 'create')
+                    .resolves({ id: 'k9', raw: 'raw' });
+            });
+            it('expires with that credential when no expiresAt is asked for', () => __awaiter(void 0, void 0, void 0, function* () {
+                var _a;
+                const r = yield (0, loopbackRequest_1.default)(bearer()).post('/profile/tokens').send({ name: 'CI' });
+                (0, chai_1.expect)(r.status).to.equal(201);
+                (0, chai_1.expect)(r.body.expiresAt).to.equal(inAnHour.toISOString());
+                (0, chai_1.expect)((_a = create.firstCall.args[0].expiresAt) === null || _a === void 0 ? void 0 : _a.getTime()).to.equal(inAnHour.getTime());
+            }));
+            it('refuses an expiresAt later than that credential', () => __awaiter(void 0, void 0, void 0, function* () {
+                const later = new Date(inAnHour.getTime() + 60000).toISOString();
+                const r = yield (0, loopbackRequest_1.default)(bearer())
+                    .post('/profile/tokens')
+                    .send({ name: 'CI', expiresAt: later });
+                (0, chai_1.expect)(r.status).to.equal(400);
+                (0, chai_1.expect)(r.body.error).to.match(/later than the credential/);
+                (0, chai_1.expect)(create.called).to.equal(false);
+            }));
+            // Verification allows 60 s of clock skew, so a token can still be
+            // accepted just after its exp: it must not make a key already expired.
+            it('refuses when that credential has already expired', () => __awaiter(void 0, void 0, void 0, function* () {
+                const app = appWithAuth({
+                    kind: 'bearer',
+                    userId: 'u1',
+                    role: 'MEMBER',
+                    scopes: 'sessions,read',
+                    credentialExpiresAt: Date.now() - 1000,
+                });
+                const r = yield (0, loopbackRequest_1.default)(app).post('/profile/tokens').send({ name: 'CI' });
+                (0, chai_1.expect)(r.status).to.equal(400);
+                (0, chai_1.expect)(r.body.error).to.match(/has expired/);
+                (0, chai_1.expect)(create.called).to.equal(false);
+            }));
+            it('keeps an earlier expiresAt', () => __awaiter(void 0, void 0, void 0, function* () {
+                const sooner = new Date(Date.now() + 600000).toISOString();
+                const r = yield (0, loopbackRequest_1.default)(bearer())
+                    .post('/profile/tokens')
+                    .send({ name: 'CI', expiresAt: sooner });
+                (0, chai_1.expect)(r.status).to.equal(201);
+                (0, chai_1.expect)(r.body.expiresAt).to.equal(sooner);
+            }));
+            it('leaves a dashboard sign-in free to make a key that never expires', () => __awaiter(void 0, void 0, void 0, function* () {
+                const app = appWithAuth({
+                    kind: 'user-session',
+                    userId: 'u1',
+                    role: 'MEMBER',
+                    scopes: 'devices,sessions,read',
+                });
+                const r = yield (0, loopbackRequest_1.default)(app).post('/profile/tokens').send({ name: 'CI' });
+                (0, chai_1.expect)(r.status).to.equal(201);
+                (0, chai_1.expect)(r.body.expiresAt).to.equal(null);
+            }));
+        });
+    });
 });

package/lib/test/unit/queue-requester.spec.js

@@ -126,7 +126,7 @@ describe('createSession records who asked on the pending-session row', () => {
         typedi_1.Container.set(JwtKeyService_1.JwtKeyService, {
             verify: (t) => __awaiter(void 0, void 0, void 0, function* () {
                 const [sub, teamId] = t.replace(/^jwt:/, '').split('@');
-                return { sub, teamId: teamId !== null && teamId !== void 0 ? teamId : null };
+                return { sub, teamId: teamId !== null && teamId !== void 0 ? teamId : null, scopes: 'sessions' };
             }),
         });
         teamRows = sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([]);

package/lib/test/unit/recording-options.spec.js

@@ -0,0 +1,181 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const typedi_1 = require("typedi");
+const plugin_1 = require("../../src/plugin");
+const ServerManager_1 = require("../../src/services/ServerManager");
+const PluginContext_1 = require("../../src/PluginContext");
+const concurrency_gate_1 = require("../../src/services/recording/concurrency-gate");
+const config_1 = require("../../src/config");
+const logger_1 = __importDefault(require("../../src/logger"));
+/**
+ * `maxConcurrentRecordings` and `recordingsAssetsPath` are declared in
+ * schema.json, so Appium accepts them in a config file, but nothing read them:
+ * only the XENON_MAX_CONCURRENT_RECORDINGS and XENON_RECORDINGS_ASSETS_PATH
+ * environment variables reached src/config.ts. The option now wins, the
+ * variable is the fallback, and both are applied at boot before anything that
+ * reads them (the artifact store, the concurrency gate).
+ */
+describe('the recording options', () => {
+    let saved;
+    let env;
+    let statics;
+    beforeEach(() => {
+        saved = { max: config_1.config.maxConcurrentRecordings, path: config_1.config.recordingsAssetsPath };
+        env = {
+            max: process.env.XENON_MAX_CONCURRENT_RECORDINGS,
+            path: process.env.XENON_RECORDINGS_ASSETS_PATH,
+        };
+        delete process.env.XENON_MAX_CONCURRENT_RECORDINGS;
+        delete process.env.XENON_RECORDINGS_ASSETS_PATH;
+        statics = {
+            nodeId: plugin_1.XenonPlugin.NODE_ID,
+            port: plugin_1.XenonPlugin.port,
+            basePath: plugin_1.XenonPlugin.nodeBasePath,
+        };
+    });
+    afterEach(() => {
+        sinon_1.default.restore();
+        (0, config_1.updateConfig)({ maxConcurrentRecordings: saved.max, recordingsAssetsPath: saved.path });
+        for (const [name, value] of [
+            ['XENON_MAX_CONCURRENT_RECORDINGS', env.max],
+            ['XENON_RECORDINGS_ASSETS_PATH', env.path],
+        ]) {
+            if (value === undefined)
+                delete process.env[name];
+            else
+                process.env[name] = value;
+        }
+        plugin_1.XenonPlugin.NODE_ID = statics.nodeId;
+        plugin_1.XenonPlugin.port = statics.port;
+        plugin_1.XenonPlugin.nodeBasePath = statics.basePath;
+    });
+    /**
+     * Boots as far as the database step and says what the options were when it
+     * began: the artifact store is built there from `recordingsAssetsPath`.
+     */
+    function seenAtDatabaseStep(pluginArgs) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const seen = {};
+            const boot = ServerManager_1.ServerManager.prototype;
+            sinon_1.default.stub(boot, 'resolvePluginArgs').resolves(pluginArgs);
+            sinon_1.default.stub(logger_1.default, 'banner');
+            sinon_1.default.stub(PluginContext_1.PluginContext.prototype, 'setContext');
+            sinon_1.default.stub(boot, 'syncDatabaseAndAIConfig').resolves();
+            sinon_1.default.stub(boot, 'initializeCoreSubsystems').callsFake(() => __awaiter(this, void 0, void 0, function* () {
+                seen.max = config_1.config.maxConcurrentRecordings;
+                seen.path = config_1.config.recordingsAssetsPath;
+                throw new Error('boot stopped by the test');
+            }));
+            yield typedi_1.Container.get(ServerManager_1.ServerManager)
+                .updateServer({}, null, { port: 4723 })
+                .catch((err) => (0, chai_1.expect)(err.message).to.equal('boot stopped by the test'));
+            return seen;
+        });
+    }
+    describe('applied at boot', () => {
+        it('takes the maxConcurrentRecordings option', () => __awaiter(void 0, void 0, void 0, function* () {
+            const seen = yield seenAtDatabaseStep({ maxConcurrentRecordings: 2 });
+            (0, chai_1.expect)(seen.max).to.equal(2);
+        }));
+        it('takes the recordingsAssetsPath option', () => __awaiter(void 0, void 0, void 0, function* () {
+            const seen = yield seenAtDatabaseStep({ recordingsAssetsPath: '/srv/xenon/recordings' });
+            (0, chai_1.expect)(seen.path).to.equal('/srv/xenon/recordings');
+        }));
+        it('falls back to the environment variables when the options are not set', () => __awaiter(void 0, void 0, void 0, function* () {
+            process.env.XENON_MAX_CONCURRENT_RECORDINGS = '7';
+            process.env.XENON_RECORDINGS_ASSETS_PATH = '/mnt/recordings';
+            const seen = yield seenAtDatabaseStep({});
+            (0, chai_1.expect)(seen).to.deep.equal({ max: 7, path: '/mnt/recordings' });
+        }));
+        it('lets the option win over the environment variable', () => __awaiter(void 0, void 0, void 0, function* () {
+            process.env.XENON_MAX_CONCURRENT_RECORDINGS = '7';
+            process.env.XENON_RECORDINGS_ASSETS_PATH = '/mnt/recordings';
+            const seen = yield seenAtDatabaseStep({
+                maxConcurrentRecordings: 3,
+                recordingsAssetsPath: '/srv/xenon/recordings',
+            });
+            (0, chai_1.expect)(seen).to.deep.equal({ max: 3, path: '/srv/xenon/recordings' });
+        }));
+        it('keeps the default cap of 4 when neither is set', () => __awaiter(void 0, void 0, void 0, function* () {
+            const seen = yield seenAtDatabaseStep({});
+            (0, chai_1.expect)(seen.max).to.equal(4);
+        }));
+        it('ignores a cap that is not a whole number of at least 1', () => __awaiter(void 0, void 0, void 0, function* () {
+            for (const bad of [0, -2, 2.5, NaN, '3', null]) {
+                const seen = yield seenAtDatabaseStep({ maxConcurrentRecordings: bad });
+                (0, chai_1.expect)(seen.max, `option ${JSON.stringify(bad)}`).to.equal(4);
+                sinon_1.default.restore();
+            }
+        }));
+        it('ignores an environment cap that is not a whole number of at least 1', () => __awaiter(void 0, void 0, void 0, function* () {
+            process.env.XENON_MAX_CONCURRENT_RECORDINGS = 'many';
+            const seen = yield seenAtDatabaseStep({});
+            (0, chai_1.expect)(seen.max).to.equal(4);
+        }));
+        it('ignores a blank recordingsAssetsPath', () => __awaiter(void 0, void 0, void 0, function* () {
+            const seen = yield seenAtDatabaseStep({ recordingsAssetsPath: '   ' });
+            (0, chai_1.expect)(seen.path).to.equal(saved.path);
+        }));
+    });
+    describe('the concurrency gate', () => {
+        it('reads the cap when it admits, not when it is built', () => {
+            (0, config_1.updateConfig)({ maxConcurrentRecordings: 4 });
+            const gate = new concurrency_gate_1.ConcurrencyGate();
+            (0, config_1.updateConfig)({ maxConcurrentRecordings: 1 });
+            (0, chai_1.expect)(gate.getLimit()).to.equal(1);
+            (0, chai_1.expect)(gate.tryAcquire(['r1'])).to.equal(true);
+            (0, chai_1.expect)(gate.tryAcquire(['r2'])).to.equal(false);
+        });
+        it('keeps an explicit limit over the configured one', () => {
+            (0, config_1.updateConfig)({ maxConcurrentRecordings: 4 });
+            (0, chai_1.expect)(new concurrency_gate_1.ConcurrencyGate(2).getLimit()).to.equal(2);
+        });
+    });
+});
+describe('resolving the recording options', () => {
+    describe('maxConcurrentRecordings', () => {
+        it('takes the option, then the variable, then 4', () => {
+            (0, chai_1.expect)((0, config_1.resolveMaxConcurrentRecordings)(2, '7')).to.equal(2);
+            (0, chai_1.expect)((0, config_1.resolveMaxConcurrentRecordings)(undefined, '7')).to.equal(7);
+            (0, chai_1.expect)((0, config_1.resolveMaxConcurrentRecordings)(undefined, undefined)).to.equal(4);
+        });
+        it('passes over a value that is not a whole number of at least 1', () => {
+            for (const bad of [0, -1, 1.5, NaN, Infinity, '2', null, {}]) {
+                (0, chai_1.expect)((0, config_1.resolveMaxConcurrentRecordings)(bad, '7'), JSON.stringify(bad)).to.equal(7);
+            }
+            for (const bad of ['', ' ', '0', '-3', '2.5', 'many', 'NaN']) {
+                (0, chai_1.expect)((0, config_1.resolveMaxConcurrentRecordings)(undefined, bad), JSON.stringify(bad)).to.equal(4);
+            }
+        });
+    });
+    describe('recordingsAssetsPath', () => {
+        it('takes the option, then the variable, then the default folder', () => {
+            (0, chai_1.expect)((0, config_1.resolveRecordingsAssetsPath)('/a', '/b')).to.equal('/a');
+            (0, chai_1.expect)((0, config_1.resolveRecordingsAssetsPath)(undefined, '/b')).to.equal('/b');
+            (0, chai_1.expect)((0, config_1.resolveRecordingsAssetsPath)(undefined, undefined)).to.match(/\.cache\/xenon\/assets\/sessions\/recordings$/);
+        });
+        it('counts a blank value as unset', () => {
+            (0, chai_1.expect)((0, config_1.resolveRecordingsAssetsPath)('  ', '/b')).to.equal('/b');
+            (0, chai_1.expect)((0, config_1.resolveRecordingsAssetsPath)(undefined, '')).to.match(/recordings$/);
+            (0, chai_1.expect)((0, config_1.resolveRecordingsAssetsPath)(42, undefined)).to.match(/recordings$/);
+        });
+        it('trims what it is given', () => {
+            (0, chai_1.expect)((0, config_1.resolveRecordingsAssetsPath)(' /a ', undefined)).to.equal('/a');
+        });
+    });
+});