@xenon-device-management/xenon 2.13.2 → 2.15.0

package/lib/test/unit/reset-link-address.spec.js

@@ -0,0 +1,266 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const express_1 = __importDefault(require("express"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const typedi_1 = require("typedi");
+const users_1 = require("../../src/app/routers/users");
+const auth_1 = require("../../src/app/routers/auth");
+const PasswordResetService_1 = require("../../src/services/PasswordResetService");
+const EmailService_1 = require("../../src/services/EmailService");
+const UserService_1 = require("../../src/services/UserService");
+const prisma_1 = require("../../src/prisma");
+const config_1 = require("../../src/config");
+const passwordResetMode_1 = require("../../src/services/passwordResetMode");
+const passwordResetLink_1 = require("../../src/services/passwordResetLink");
+/**
+ * Where a password reset link that Xenon sends points.
+ *
+ * Through 2.14 it was built from the Host header of the request that asked
+ * for it. Anyone could ask for a reset of someone else's account with a Host
+ * of their own choosing (a matching Origin passes the CSRF check), and with
+ * SMTP set up Xenon emailed the victim a genuine link to the attacker's host:
+ * opening it handed the attacker the token, which opens the account.
+ *
+ * A link Xenon emails or logs is now built from XENON_PUBLIC_URL, the address
+ * people open the dashboard at. Without it Xenon sends no link at all: the
+ * sign-in page sends people to an administrator, and an administrator's
+ * "send reset link" hands the link back to them instead of emailing it.
+ */
+const RAW = 'RAWTOKEN_abcdefghijklmnopqrstuvwxyz0123456789';
+const EVIL = 'attacker.example';
+function withConfig(patch) {
+    const orig = {};
+    for (const k of Object.keys(patch)) {
+        orig[k] = config_1.config[k];
+        config_1.config[k] = patch[k];
+    }
+    return () => Object.assign(config_1.config, orig);
+}
+function until(pred_1) {
+    return __awaiter(this, arguments, void 0, function* (pred, ms = 3000) {
+        const t0 = Date.now();
+        while (!pred()) {
+            if (Date.now() - t0 > ms)
+                throw new Error('timed out waiting for the route to finish');
+            yield new Promise((r) => setTimeout(r, 5));
+        }
+    });
+}
+describe('password reset links point at XENON_PUBLIC_URL, never the request', () => {
+    let restore;
+    afterEach(() => {
+        sinon_1.default.restore();
+        restore === null || restore === void 0 ? void 0 : restore();
+        restore = undefined;
+    });
+    function publicApp() {
+        const app = (0, express_1.default)();
+        app.use(express_1.default.json());
+        app.use('/auth', (0, auth_1.authPublicRouter)());
+        return app;
+    }
+    function usersApp() {
+        const app = (0, express_1.default)();
+        app.use(express_1.default.json());
+        app.use((req, _res, next) => {
+            req.auth = {
+                userId: 'admin1',
+                role: 'ADMIN',
+                scopes: 'admin,devices,sessions,read',
+            };
+            next();
+        });
+        app.use('/users', (0, users_1.usersRouter)());
+        return app;
+    }
+    const active = { id: 'u1', email: 'u@x.local', name: 'U', role: 'MEMBER', status: 'ACTIVE' };
+    describe('POST /auth/forgot-password', () => {
+        it('emails a link to XENON_PUBLIC_URL whatever Host the request names', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({
+                smtpUrl: 'smtp://mail.example.com:587',
+                publicUrl: 'https://xenon.example.com',
+            });
+            sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findByEmail').resolves(active);
+            sinon_1.default
+                .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken')
+                .resolves({ raw: RAW, id: 't1' });
+            const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
+            yield (0, loopbackRequest_1.default)(publicApp())
+                .post('/auth/forgot-password')
+                .set('Host', EVIL)
+                .set('X-Forwarded-Proto', 'http')
+                .send({ email: 'u@x.local' });
+            yield until(() => send.called);
+            const text = send.firstCall.args[0].text;
+            (0, chai_1.expect)(text).to.include(`https://xenon.example.com/xenon/reset-password#${RAW}`);
+            (0, chai_1.expect)(text).to.not.include(EVIL);
+        }));
+        it("builds a link that opens when XENON_PUBLIC_URL is the dashboard's address", () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({
+                smtpUrl: 'smtp://mail.example.com:587',
+                publicUrl: 'http://localhost:4723/xenon/',
+            });
+            sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findByEmail').resolves(active);
+            sinon_1.default
+                .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken')
+                .resolves({ raw: RAW, id: 't1' });
+            const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
+            yield (0, loopbackRequest_1.default)(publicApp()).post('/auth/forgot-password').send({ email: 'u@x.local' });
+            yield until(() => send.called);
+            (0, chai_1.expect)(send.firstCall.args[0].text).to.include(`http://localhost:4723/xenon/reset-password#${RAW}`);
+            (0, chai_1.expect)(send.firstCall.args[0].text).to.not.include('/xenon/xenon/');
+        }));
+        it('sends nothing, and mints nothing, when XENON_PUBLIC_URL is not set', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({ smtpUrl: 'smtp://mail.example.com:587', publicUrl: undefined });
+            const find = sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findByEmail').resolves(active);
+            const create = sinon_1.default.stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken');
+            const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
+            const r = yield (0, loopbackRequest_1.default)(publicApp())
+                .post('/auth/forgot-password')
+                .set('Host', EVIL)
+                .send({ email: 'u@x.local' });
+            yield until(() => find.called);
+            yield new Promise((resolve) => setImmediate(resolve));
+            (0, chai_1.expect)(r.status).to.equal(204);
+            (0, chai_1.expect)(create.called).to.equal(false);
+            (0, chai_1.expect)(send.called).to.equal(false);
+        }));
+        it('sends nothing through the log fallback without XENON_PUBLIC_URL either', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({
+                smtpUrl: undefined,
+                passwordResetLogFallback: true,
+                publicUrl: undefined,
+            });
+            const find = sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findByEmail').resolves(active);
+            const create = sinon_1.default.stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken');
+            yield (0, loopbackRequest_1.default)(publicApp()).post('/auth/forgot-password').send({ email: 'u@x.local' });
+            yield until(() => find.called);
+            yield new Promise((resolve) => setImmediate(resolve));
+            (0, chai_1.expect)(create.called).to.equal(false);
+        }));
+    });
+    describe('GET /auth/options tells the sign-in page whether self-service reset works', () => {
+        it("is 'admin' with SMTP but no XENON_PUBLIC_URL, 'email' with both", () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({ smtpUrl: 'smtp://mail.example.com:587', publicUrl: undefined });
+            (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(publicApp()).get('/auth/options')).body.passwordReset).to.equal('admin');
+            config_1.config.publicUrl = 'https://xenon.example.com';
+            (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(publicApp()).get('/auth/options')).body.passwordReset).to.equal('email');
+        }));
+    });
+    describe('POST /users/:id/reset-link', () => {
+        beforeEach(() => {
+            sinon_1.default.stub(prisma_1.prisma.user, 'findUnique').resolves(active);
+            sinon_1.default
+                .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken')
+                .resolves({ raw: RAW, id: 't1' });
+        });
+        it('emails a link to XENON_PUBLIC_URL whatever Host the request names', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({
+                smtpUrl: 'smtp://mail.example.com:587',
+                publicUrl: 'https://xenon.example.com',
+            });
+            const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
+            const r = yield (0, loopbackRequest_1.default)(usersApp()).post('/users/u1/reset-link').set('Host', EVIL);
+            (0, chai_1.expect)(r.body).to.include({ emailed: true });
+            (0, chai_1.expect)(send.firstCall.args[0].text).to.include(`https://xenon.example.com/xenon/reset-password#${RAW}`);
+            (0, chai_1.expect)(send.firstCall.args[0].text).to.not.include(EVIL);
+        }));
+        it('without XENON_PUBLIC_URL, hands the link to the admin instead of emailing it', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({ smtpUrl: 'smtp://mail.example.com:587', publicUrl: undefined });
+            const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
+            const r = yield (0, loopbackRequest_1.default)(usersApp()).post('/users/u1/reset-link');
+            (0, chai_1.expect)(r.status).to.equal(200);
+            (0, chai_1.expect)(r.body.emailed).to.equal(false);
+            (0, chai_1.expect)(r.body.link).to.match(new RegExp(`/xenon/reset-password#${RAW}$`));
+            (0, chai_1.expect)(send.called).to.equal(false);
+        }));
+    });
+    describe('resetLinkBase (XENON_PUBLIC_URL)', () => {
+        // The variable is the server's address. The dashboard's own address,
+        // with /xenon (README gives http://localhost:4723/xenon/), is taken too:
+        // kept as given it made /xenon/xenon/reset-password, which the dashboard
+        // routes to the sign-in page, losing the token.
+        it('is the server address, with or without a trailing slash', () => {
+            (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl: 'https://xenon.example.com' })).to.equal('https://xenon.example.com');
+            (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl: 'https://xenon.example.com/' })).to.equal('https://xenon.example.com');
+            (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl: 'http://lab-mac:4723' })).to.equal('http://lab-mac:4723');
+        });
+        for (const publicUrl of [
+            'http://localhost:4723/xenon',
+            'http://localhost:4723/xenon/',
+            'http://localhost:4723/xenon//',
+        ]) {
+            it(`takes the dashboard's address too: ${publicUrl}`, () => {
+                (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl })).to.equal('http://localhost:4723');
+                (0, chai_1.expect)((0, passwordResetLink_1.buildResetLink)(String((0, passwordResetLink_1.resetLinkBase)({ publicUrl })), 'TOK')).to.equal('http://localhost:4723/xenon/reset-password#TOK');
+            });
+        }
+        // The dashboard loads its pages, scripts and API from /xenon on the
+        // server's root, so it can't be served under another prefix: an address
+        // with any other path is a mistake, and no link is sent rather than one
+        // that can't open.
+        it('is null for an address with any other path', () => {
+            for (const publicUrl of [
+                'https://lab.example.com/qa/',
+                'https://lab.example.com/qa/xenon',
+                'http://localhost:4723/xenon/login',
+            ]) {
+                (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl }), publicUrl).to.equal(null);
+            }
+        });
+        it('is null when unset, or not an http(s) address', () => {
+            for (const publicUrl of [
+                undefined,
+                '',
+                '   ',
+                'not a url',
+                'ftp://x.example',
+                'javascript:alert(1)',
+            ]) {
+                (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl }), String(publicUrl)).to.equal(null);
+            }
+        });
+        it('is null for an address with a query or fragment, which would swallow the token', () => {
+            (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl: 'https://x.example/?a=1' })).to.equal(null);
+            (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl: 'https://x.example/#a' })).to.equal(null);
+        });
+    });
+    describe('passwordResetMode', () => {
+        it("is 'email' only with both SMTP and XENON_PUBLIC_URL", () => {
+            (0, chai_1.expect)((0, passwordResetMode_1.passwordResetMode)({ smtpUrl: 'smtp://m:587', publicUrl: 'https://x.example' })).to.equal('email');
+            (0, chai_1.expect)((0, passwordResetMode_1.passwordResetMode)({ smtpUrl: 'smtp://m:587' })).to.equal('admin');
+            (0, chai_1.expect)((0, passwordResetMode_1.passwordResetMode)({ publicUrl: 'https://x.example' })).to.equal('admin');
+        });
+    });
+    // The email said "1 hour" whatever XENON_RESET_TOKEN_TTL_MS was.
+    describe('the email says how long the link really lasts', () => {
+        const user = { email: 'u@x.local', name: 'U' };
+        for (const [ms, words] of [
+            [60 * 60 * 1000, '1 hour'],
+            [30 * 60 * 1000, '30 minutes'],
+            [2 * 60 * 60 * 1000, '2 hours'],
+            [90 * 60 * 1000, '90 minutes'],
+            [24 * 60 * 60 * 1000, '24 hours'],
+            [60 * 1000, '1 minute'],
+        ]) {
+            it(`${words} for ${ms} ms`, () => {
+                (0, chai_1.expect)((0, passwordResetLink_1.resetEmail)(user, 'https://x/l', ms).text).to.include(`This link expires in ${words}.`);
+            });
+        }
+    });
+});

package/lib/test/unit/reset-link.test.js

@@ -82,7 +82,10 @@ describe('password-reset links', () => {
             (0, chai_1.expect)(logged.join('\n')).to.not.include(RAW);
         }));
         it('with SMTP, emails the user and returns no link', () => __awaiter(void 0, void 0, void 0, function* () {
-            restore = withConfig({ smtpUrl: 'smtp://mail.example.com:587' });
+            restore = withConfig({
+                smtpUrl: 'smtp://mail.example.com:587',
+                publicUrl: 'https://xenon.example.com',
+            });
             sinon_1.default.stub(prisma_1.prisma.user, 'findUnique').resolves(member);
             sinon_1.default
                 .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken')
@@ -164,8 +167,11 @@ describe('password-reset links', () => {
             (0, chai_1.expect)(r.status).to.equal(204);
             (0, chai_1.expect)(create.called).to.equal(false);
         }));
-        it('still mints and sends when SMTP is configured', () => __awaiter(void 0, void 0, void 0, function* () {
-            restore = withConfig({ smtpUrl: 'smtp://mail.example.com:587' });
+        it('still mints and sends when SMTP and XENON_PUBLIC_URL are configured', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({
+                smtpUrl: 'smtp://mail.example.com:587',
+                publicUrl: 'https://xenon.example.com',
+            });
             sinon_1.default
                 .stub(typedi_1.Container.get(UserService_1.UserService), 'findByEmail')
                 .resolves({ id: 'u1', email: 'u@x.local', name: 'U', status: 'ACTIVE' });
@@ -181,7 +187,7 @@ describe('password-reset links', () => {
     });
     describe('token placement (never in a URL the server sees)', () => {
         it('puts the token in the fragment, which browsers never send', () => {
-            const link = (0, passwordResetLink_1.buildResetLink)({ secure: false, headers: { host: 'lab:4723' } }, RAW);
+            const link = (0, passwordResetLink_1.buildResetLink)('http://lab:4723', RAW);
             (0, chai_1.expect)(link).to.equal(`http://lab:4723/xenon/reset-password#${RAW}`);
             (0, chai_1.expect)(new URL(link).pathname).to.not.include(RAW);
         });

package/lib/test/unit/resilio-path-healing.spec.js

@@ -0,0 +1,270 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const typedi_1 = require("typedi");
+const scratch_database_1 = require("../helpers/scratch-database");
+const loki_stores_1 = require("../helpers/loki-stores");
+const device_store_1 = require("../../src/data-service/device-store");
+const page_sources_1 = require("../helpers/page-sources");
+const prisma_store_1 = require("../../src/data-service/prisma-store");
+const HealEtalonService_1 = require("../../src/services/healing/HealEtalonService");
+const ResilioTreeHealingProvider_1 = require("../../src/services/healing/ResilioTreeHealingProvider");
+const HealingOrchestrator_1 = require("../../src/services/healing/HealingOrchestrator");
+const resilioPath_1 = require("../../src/services/healing/resilioPath");
+const CommandInterceptor_1 = require("../../src/interceptors/CommandInterceptor");
+/**
+ * Self-healing's first tier, Resilio, finds an element by the path it had
+ * through the screen's element tree when its selector last worked. Through
+ * 2.14 it never found anything: the database dropped the path when it saved
+ * the selector's fingerprint, and the provider gives up without one. Its
+ * locators were also lowercase (an HTML parse of the page source), which the
+ * drivers' XPath doesn't match, and it answered with the nearest element
+ * however far it was, so with a path it would have healed to the wrong
+ * button whenever the right one was gone.
+ *
+ * Here the path is learnt from a found element, stored in a scratch
+ * database, and used on a changed screen. resiliotree runs for real; the
+ * driver is a fake that runs each XPath on the page source.
+ */
+const FORM_A = page_sources_1.android.page(page_sources_1.android.layout(0, 'login_form', '[0,200][1080,1400]', page_sources_1.android.field(0, 'username', 'Username', '[40,240][1040,360]') +
+    page_sources_1.android.field(1, 'password', 'Password', '[40,400][1040,520]') +
+    page_sources_1.android.button(2, 'forgot', 'Forgot password?', '[40,560][1040,680]') +
+    page_sources_1.android.button(3, 'login', 'Log in', '[40,720][1040,840]')));
+// The buttons moved into a new row, after a new "Sign up" button.
+const FORM_MOVED = page_sources_1.android.page(page_sources_1.android.layout(0, 'login_form', '[0,200][1080,1400]', page_sources_1.android.field(0, 'username', 'Username', '[40,240][1040,360]') +
+    page_sources_1.android.field(1, 'password', 'Password', '[40,400][1040,520]') +
+    page_sources_1.android.layout(2, 'actions', '[0,560][1080,1100]', page_sources_1.android.button(0, 'signup', 'Sign up', '[40,560][1040,680]') +
+        page_sources_1.android.button(1, 'forgot', 'Forgot password?', '[40,720][1040,840]') +
+        page_sources_1.android.button(2, 'login', 'Log in', '[40,880][1040,1000]'))));
+// The button is another one now: new id, new text.
+const FORM_RENAMED = page_sources_1.android.page(page_sources_1.android.layout(0, 'login_form', '[0,200][1080,1400]', page_sources_1.android.field(0, 'username', 'Username', '[40,240][1040,360]') +
+    page_sources_1.android.field(1, 'password', 'Password', '[40,400][1040,520]') +
+    page_sources_1.android.button(2, 'forgot', 'Forgot password?', '[40,560][1040,680]') +
+    page_sources_1.android.button(3, 'sign_in', 'Sign in', '[40,720][1040,840]')));
+// The button is gone.
+const FORM_GONE = page_sources_1.android.page(page_sources_1.android.layout(0, 'login_form', '[0,200][1080,1400]', page_sources_1.android.field(0, 'username', 'Username', '[40,240][1040,360]') +
+    page_sources_1.android.field(1, 'password', 'Password', '[40,400][1040,520]') +
+    page_sources_1.android.button(2, 'forgot', 'Forgot password?', '[40,560][1040,680]')));
+// Two buttons the path can't tell apart.
+const FORM_TWICE = page_sources_1.android.page(page_sources_1.android.layout(0, 'login_form', '[0,200][1080,1400]', page_sources_1.android.layout(0, '', '[0,200][1080,700]', page_sources_1.android.button(0, 'login', 'Log in', '[40,720][1040,840]')) +
+    page_sources_1.android.layout(1, '', '[0,700][1080,1400]', page_sources_1.android.button(0, 'login', 'Log in', '[40,720][1040,840]'))));
+// A positional XPath, as an inspector writes one: the second button of the form.
+const POSITIONAL = "//*[@resource-id='com.example.shop:id/login_form']/android.widget.Button[2]";
+describe('Resilio healing, from the path a selector had when it worked', function () {
+    this.timeout(90000);
+    (0, scratch_database_1.useScratchDatabase)();
+    let etalons;
+    let restoreStore;
+    beforeEach(() => {
+        // The etalon service on the Prisma store (the scratch database), whatever
+        // store this process picked.
+        etalons = typedi_1.Container.get(HealEtalonService_1.HealEtalonService);
+        const service = etalons;
+        const before = service.store;
+        service.store = new prisma_store_1.PrismaHealEtalonStore();
+        restoreStore = () => {
+            service.store = before;
+        };
+    });
+    afterEach(() => {
+        restoreStore();
+        sinon_1.default.restore();
+    });
+    describe('the fingerprint store', () => {
+        const store = () => new prisma_store_1.PrismaHealEtalonStore();
+        const fingerprint = (selector, path) => ({
+            selector,
+            strategy: 'xpath',
+            attributes: { 'resource-id': 'com.example.shop:id/login' },
+            nodeName: 'android.widget.Button',
+            path,
+            lastSeen: Date.now(),
+        });
+        const PATH = { format: 'page-source-1', nodes: [{ tag: 'hierarchy', id: '', index: 0 }] };
+        it("keeps a selector's path", () => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            yield store().saveSignature(fingerprint('//keep-path', PATH));
+            (0, chai_1.expect)((_a = (yield store().getSignature('//keep-path'))) === null || _a === void 0 ? void 0 : _a.path).to.deep.equal(PATH);
+        }));
+        it('keeps the path when a later fingerprint comes without one', () => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            yield store().saveSignature(fingerprint('//keep-old-path', PATH));
+            yield store().saveSignature(fingerprint('//keep-old-path'));
+            (0, chai_1.expect)((_a = (yield store().getSignature('//keep-old-path'))) === null || _a === void 0 ? void 0 : _a.path).to.deep.equal(PATH);
+        }));
+    });
+    /** Learn `selector` as the interceptor does after a find, and wait for it. */
+    function learn(driver, selector) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const found = yield driver.findElement('xpath', selector);
+            typedi_1.Container.get(CommandInterceptor_1.CommandInterceptor).triggerLearning(driver, ['xpath', selector], found, `learn-${selector}`);
+            for (let i = 0; i < 100; i++) {
+                const signature = yield etalons.getSignature(selector);
+                if (((_a = signature === null || signature === void 0 ? void 0 : signature.path) === null || _a === void 0 ? void 0 : _a.format) === 'page-source-1')
+                    return signature;
+                yield new Promise((r) => setTimeout(r, 20));
+            }
+            throw new Error(`no path was learnt for ${selector}`);
+        });
+    }
+    const heal = (driver, selector, pageSource) => new ResilioTreeHealingProvider_1.ResilioTreeHealingProvider(etalons).heal({
+        sessionId: 'resilio-session',
+        driver,
+        strategy: 'xpath',
+        selector,
+        pageSource,
+    });
+    it('finds an Android element that moved in the tree', () => __awaiter(this, void 0, void 0, function* () {
+        const driver = (0, page_sources_1.pageDriver)(FORM_A);
+        yield learn(driver, POSITIONAL);
+        driver.show(FORM_MOVED);
+        const healed = yield heal(driver, POSITIONAL, FORM_MOVED);
+        (0, chai_1.expect)(healed, 'healed').to.not.equal(null);
+        (0, chai_1.expect)(healed.id).to.equal('el:com.example.shop:id/login');
+        (0, chai_1.expect)(healed.confidence).to.be.greaterThan(0.9);
+        // The locator it suggests finds that element on the new screen.
+        const again = yield driver.findElement('xpath', healed.recommendedSelector);
+        (0, chai_1.expect)(again.ELEMENT).to.equal('el:com.example.shop:id/login');
+    }));
+    it('finds an iPhone element that moved in the tree', () => __awaiter(this, void 0, void 0, function* () {
+        const before = page_sources_1.ios.page(page_sources_1.ios.group(page_sources_1.ios.field('username', 'Username', 120) +
+            page_sources_1.ios.button('forgot', 'Forgot password?', 200) +
+            page_sources_1.ios.button('login', 'Log in', 260)));
+        const after = page_sources_1.ios.page(page_sources_1.ios.group(page_sources_1.ios.field('username', 'Username', 120) +
+            page_sources_1.ios.group(page_sources_1.ios.button('signup', 'Sign up', 200) +
+                page_sources_1.ios.button('forgot', 'Forgot password?', 260) +
+                page_sources_1.ios.button('login', 'Log in', 320))));
+        const selector = '//XCUIElementTypeOther/XCUIElementTypeButton[2]';
+        const driver = (0, page_sources_1.pageDriver)(before);
+        yield learn(driver, selector);
+        driver.show(after);
+        const healed = yield heal(driver, selector, after);
+        (0, chai_1.expect)(healed === null || healed === void 0 ? void 0 : healed.id).to.equal('el:login');
+        const again = yield driver.findElement('xpath', healed.recommendedSelector);
+        (0, chai_1.expect)(again.ELEMENT).to.equal('el:login');
+    }));
+    it('leaves a renamed element to the next tier rather than guess', () => __awaiter(this, void 0, void 0, function* () {
+        const driver = (0, page_sources_1.pageDriver)(FORM_A);
+        yield learn(driver, POSITIONAL);
+        driver.show(FORM_RENAMED);
+        (0, chai_1.expect)(yield heal(driver, POSITIONAL, FORM_RENAMED)).to.equal(null);
+    }));
+    it('does not take a neighbour when the element is gone', () => __awaiter(this, void 0, void 0, function* () {
+        const driver = (0, page_sources_1.pageDriver)(FORM_A);
+        yield learn(driver, POSITIONAL);
+        driver.show(FORM_GONE);
+        (0, chai_1.expect)(yield heal(driver, POSITIONAL, FORM_GONE)).to.equal(null);
+    }));
+    it('does not pick one of two elements it cannot tell apart', () => __awaiter(this, void 0, void 0, function* () {
+        const driver = (0, page_sources_1.pageDriver)(FORM_A);
+        yield learn(driver, POSITIONAL);
+        driver.show(FORM_TWICE);
+        (0, chai_1.expect)(yield heal(driver, POSITIONAL, FORM_TWICE)).to.equal(null);
+    }));
+    it('finds an element that holds others, such as a list row, after it moved', () => __awaiter(this, void 0, void 0, function* () {
+        const row = (index) => page_sources_1.android.row(index, 'logout_row', '[0,900][1080,1040]', page_sources_1.android.image(0, 'logout_icon', 'Log out icon', '[40,920][140,1020]') +
+            page_sources_1.android.text(1, 'logout_label', 'Log out', '[160,940][600,1000]'));
+        const before = page_sources_1.android.page(page_sources_1.android.layout(0, 'settings', '[0,200][1080,2000]', page_sources_1.android.text(0, 'account', 'Account', '[40,220][600,300]') + row(1)));
+        const after = page_sources_1.android.page(page_sources_1.android.layout(0, 'settings', '[0,200][1080,2000]', page_sources_1.android.text(0, 'account', 'Account', '[40,220][600,300]') +
+            page_sources_1.android.layout(1, 'danger_zone', '[0,800][1080,1200]', row(0))));
+        const selector = "//*[@resource-id='com.example.shop:id/settings']/android.widget.LinearLayout[1]";
+        const driver = (0, page_sources_1.pageDriver)(before);
+        yield learn(driver, selector);
+        driver.show(after);
+        const healed = yield heal(driver, selector, after);
+        (0, chai_1.expect)(healed === null || healed === void 0 ? void 0 : healed.id).to.equal('el:com.example.shop:id/logout_row');
+    }));
+    it('answers with the element it matched, not another one its locator also finds', () => __awaiter(this, void 0, void 0, function* () {
+        const cart = page_sources_1.android.button(1, 'cart', 'Cart', '[800,40][1040,140]');
+        const before = page_sources_1.android.page(page_sources_1.android.layout(0, 'toolbar', '[0,0][1080,200]', page_sources_1.android.text(0, 'title', 'Shop', '[40,40][600,140]') + cart));
+        // A badge whose description contains "Cart" now comes before the button.
+        const after = page_sources_1.android.page(page_sources_1.android.layout(0, 'toolbar', '[0,0][1080,200]', page_sources_1.android.text(0, 'title', 'Shop', '[40,40][600,140]') +
+            page_sources_1.android.image(1, 'badge', 'Cart badge, 3 items', '[700,40][780,140]') +
+            page_sources_1.android.layout(2, 'actions', '[800,0][1080,200]', page_sources_1.android.button(0, 'cart', 'Cart', '[800,40][1040,140]'))));
+        const selector = "//*[@resource-id='com.example.shop:id/toolbar']/android.widget.Button[1]";
+        const driver = (0, page_sources_1.pageDriver)(before);
+        yield learn(driver, selector);
+        driver.show(after);
+        const healed = yield heal(driver, selector, after);
+        (0, chai_1.expect)(healed === null || healed === void 0 ? void 0 : healed.id).to.equal('el:com.example.shop:id/cart');
+        const matches = yield driver.findElements('xpath', healed.recommendedSelector);
+        (0, chai_1.expect)(matches.map((m) => m.ELEMENT)).to.deep.equal(['el:com.example.shop:id/cart']);
+    }));
+    it('does not heal to an element whose text contradicts the selector', () => __awaiter(this, void 0, void 0, function* () {
+        const dialog = (label) => page_sources_1.android.page(page_sources_1.android.layout(0, 'dialog', '[0,600][1080,1400]', page_sources_1.android.text(0, 'message', 'Discard this draft?', '[40,640][1040,800]') +
+            page_sources_1.android.button(1, 'button1', label, '[600,1200][1040,1340]')));
+        const selector = "//android.widget.Button[@text='OK']";
+        const driver = (0, page_sources_1.pageDriver)(dialog('OK'));
+        yield learn(driver, selector);
+        driver.show(dialog('Delete'));
+        (0, chai_1.expect)(yield heal(driver, selector, dialog('Delete'))).to.equal(null);
+    }));
+    it('learns no path from an element that shares only its size with the one found', () => {
+        // The screen changed between the find and the learning: the button found
+        // (name "gone") isn't on it, and another button only has its height.
+        const page = page_sources_1.ios.page(page_sources_1.ios.group(page_sources_1.ios.button('next', 'Next', 300)));
+        const learnt = (0, resilioPath_1.findLearntElement)(page, 'XCUIElementTypeButton', [
+            { name: 'name', value: 'gone' },
+            { name: 'label', value: 'Gone' },
+            { name: 'height', value: '44' },
+        ]);
+        (0, chai_1.expect)(learnt).to.equal(null);
+    });
+    it('learns the element that has the identity the driver read', () => {
+        const page = page_sources_1.ios.page(page_sources_1.ios.group(page_sources_1.ios.button('next', 'Next', 300)));
+        const learnt = (0, resilioPath_1.findLearntElement)(page, 'XCUIElementTypeButton', [
+            { name: 'name', value: 'next' },
+            { name: 'height', value: '44' },
+        ]);
+        (0, chai_1.expect)(learnt === null || learnt === void 0 ? void 0 : learnt.getAttribute('name')).to.equal('next');
+    });
+    it('ignores a path an older Xenon stored, and learns it again', () => __awaiter(this, void 0, void 0, function* () {
+        const selector = "//*[@resource-id='com.example.shop:id/login']";
+        yield etalons.saveSignature('xpath', selector, { nodeName: 'android.widget.Button' }, {
+            nodes: [{ tag: 'html', id: '', index: 0 }],
+        });
+        const driver = (0, page_sources_1.pageDriver)(FORM_A);
+        (0, chai_1.expect)(yield heal(driver, selector, FORM_MOVED)).to.equal(null);
+        const learnt = yield learn(driver, selector);
+        (0, chai_1.expect)(learnt.path.format).to.equal('page-source-1');
+    }));
+    it('learns the healed element’s path after a Fuzzy XML heal', () => __awaiter(this, void 0, void 0, function* () {
+        const driver = (0, page_sources_1.pageDriver)(FORM_MOVED);
+        const save = sinon_1.default.spy(etalons, 'saveSignature');
+        const orchestrator = new HealingOrchestrator_1.HealingOrchestrator(etalons);
+        // Only Fuzzy XML (tier 2), which finds the button by the words in the selector.
+        const healed = yield orchestrator.attemptHealing('fuzzy-session', Object.assign(driver, { getScreenshot: () => __awaiter(this, void 0, void 0, function* () { return 'aGVsbG8='; }) }), 'xpath', "//android.widget.Button[@text='Log in' and @resource-id='com.example.shop:id/log_in']", [2]);
+        (0, chai_1.expect)(healed === null || healed === void 0 ? void 0 : healed.id).to.equal('el:com.example.shop:id/login');
+        (0, chai_1.expect)(save.called, 'fingerprint saved').to.equal(true);
+        const path = save.lastCall.args[3];
+        (0, chai_1.expect)(path === null || path === void 0 ? void 0 : path.format).to.equal('page-source-1');
+        (0, chai_1.expect)(path.nodes[path.nodes.length - 1].id).to.equal('com.example.shop:id/login');
+    }));
+});
+describe('The in-memory fingerprint store', () => {
+    (0, loki_stores_1.useLokiStores)();
+    it('keeps the path when a later fingerprint comes without one', () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        const store = device_store_1.DeviceStoreFactory.getHealEtalonStore();
+        const PATH = { format: 'page-source-1', nodes: [{ tag: 'hierarchy', id: '', index: 0 }] };
+        const fingerprint = { selector: '//loki-path', strategy: 'xpath', attributes: {} };
+        yield store.saveSignature(Object.assign(Object.assign({}, fingerprint), { nodeName: 'android.widget.Button', path: PATH }));
+        yield store.saveSignature(Object.assign(Object.assign({}, fingerprint), { nodeName: 'android.widget.Button', path: undefined }));
+        (0, chai_1.expect)((_a = (yield store.getSignature('//loki-path'))) === null || _a === void 0 ? void 0 : _a.path).to.deep.equal(PATH);
+    }));
+});