@xenon-device-management/xenon 2.13.2 → 2.15.0

package/lib/test/unit/self-healing-setting.spec.js

@@ -0,0 +1,273 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const express_1 = __importDefault(require("express"));
+const sinon_1 = __importDefault(require("sinon"));
+const typedi_1 = require("typedi");
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const dashboard_1 = __importDefault(require("../../src/app/routers/dashboard"));
+const PluginContext_1 = require("../../src/PluginContext");
+const CommandInterceptor_1 = require("../../src/interceptors/CommandInterceptor");
+const HealingOrchestrator_1 = require("../../src/services/healing/HealingOrchestrator");
+const SelfHealingSwitch_1 = require("../../src/services/settings/SelfHealingSwitch");
+const web_config_service_1 = require("../../src/data-service/web-config-service");
+const IPluginArgs_1 = require("../../src/interfaces/IPluginArgs");
+const event_manager_1 = require("../../src/dashboard/event-manager");
+const SessionManager_1 = require("../../src/sessions/SessionManager");
+const logger_1 = __importDefault(require("../../src/logger"));
+const container_registration_1 = require("../helpers/container-registration");
+const scratch_database_1 = require("../helpers/scratch-database");
+/**
+ * The Settings page's "AI self-healing" toggle used to do nothing: POST /config
+ * stored only the fields its table knew, GET /config never sent the switch back
+ * (so the page always showed Enabled), and CommandInterceptor read the copy of
+ * the plugin options the server started with, which nothing updates.
+ *
+ * It follows the other lab settings now: a value saved in the dashboard wins
+ * over the startup option, which wins over the default, and applies to the very
+ * next command without a restart. The interceptor runs on every command, so it
+ * reads an in-memory value (SelfHealingSwitch), never the database.
+ */
+describe('the AI self-healing switch', () => {
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
+    let context;
+    let startedWith;
+    let restoreContainer;
+    let healingSwitch;
+    const startup = (over = {}) => {
+        context.pluginArgs = Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), over);
+        return context.pluginArgs;
+    };
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        context = typedi_1.Container.get(PluginContext_1.PluginContext);
+        startedWith = context.pluginArgs;
+        restoreContainer = (0, container_registration_1.saveRegistrations)(HealingOrchestrator_1.HealingOrchestrator, SelfHealingSwitch_1.SelfHealingSwitch);
+        // A switch of its own, as at boot, so no saved value leaks in from another spec.
+        typedi_1.Container.set(SelfHealingSwitch_1.SelfHealingSwitch, new SelfHealingSwitch_1.SelfHealingSwitch());
+        healingSwitch = typedi_1.Container.get(SelfHealingSwitch_1.SelfHealingSwitch);
+        yield scratch.db.webConfig.deleteMany({});
+    }));
+    afterEach(() => {
+        context.pluginArgs = startedWith;
+        restoreContainer();
+        sinon_1.default.restore();
+    });
+    function app() {
+        const a = (0, express_1.default)();
+        a.use(express_1.default.json());
+        a.use((req, _res, next) => {
+            req.auth = {
+                kind: 'user-session',
+                userId: 'usr_x',
+                role: 'SUPER_ADMIN',
+                scopes: 'admin,devices,sessions,read',
+                rateLimit: 1000,
+            };
+            next();
+        });
+        dashboard_1.default.register(a);
+        return a;
+    }
+    const save = (body) => (0, loopbackRequest_1.default)(app()).post('/config').send(body).timeout(5000);
+    const read = () => (0, loopbackRequest_1.default)(app()).get('/config').timeout(5000);
+    describe('as the Settings page saves and reads it', () => {
+        it('is kept: what POST /config saves, GET /config sends back', () => __awaiter(void 0, void 0, void 0, function* () {
+            startup();
+            const saved = yield save({ enableSelfHealing: false });
+            (0, chai_1.expect)(saved.status).to.equal(200);
+            const shown = yield read();
+            (0, chai_1.expect)(shown.status).to.equal(200);
+            (0, chai_1.expect)(shown.body.enableSelfHealing).to.equal(false);
+            (0, chai_1.expect)(yield typedi_1.Container.get(web_config_service_1.WebConfigService).getConfig()).to.deep.equal({
+                enableSelfHealing: false,
+            });
+        }));
+        it('can be turned back on', () => __awaiter(void 0, void 0, void 0, function* () {
+            startup();
+            yield save({ enableSelfHealing: false });
+            yield save({ enableSelfHealing: true });
+            (0, chai_1.expect)((yield read()).body.enableSelfHealing).to.equal(true);
+        }));
+        it('is on, and says so, when nothing was saved and the server was started with nothing', () => __awaiter(void 0, void 0, void 0, function* () {
+            startup();
+            const shown = yield read();
+            (0, chai_1.expect)(shown.body.enableSelfHealing).to.equal(true);
+            (0, chai_1.expect)(shown.body.defaults.enableSelfHealing).to.equal(true);
+        }));
+        it('shows the option the server started with when nothing was saved', () => __awaiter(void 0, void 0, void 0, function* () {
+            startup({ enableSelfHealing: false });
+            (0, chai_1.expect)((yield read()).body.enableSelfHealing).to.equal(false);
+        }));
+        it('shows a saved value over the option the server started with', () => __awaiter(void 0, void 0, void 0, function* () {
+            startup({ enableSelfHealing: false });
+            yield save({ enableSelfHealing: true });
+            (0, chai_1.expect)((yield read()).body.enableSelfHealing).to.equal(true);
+        }));
+        it('is saved on its own, without touching the other settings', () => __awaiter(void 0, void 0, void 0, function* () {
+            startup();
+            yield save({ buildCleanupDays: 7 });
+            yield save({ enableSelfHealing: false });
+            (0, chai_1.expect)(yield typedi_1.Container.get(web_config_service_1.WebConfigService).getConfig()).to.deep.equal({
+                buildCleanupDays: 7,
+                enableSelfHealing: false,
+            });
+        }));
+        for (const bad of ['false', 'no', 0, 1, null, {}, []]) {
+            it(`refuses ${JSON.stringify(bad)} with a 400 naming the setting, and saves nothing`, () => __awaiter(void 0, void 0, void 0, function* () {
+                startup();
+                const refused = yield save({ enableSelfHealing: bad, buildCleanupDays: 9 });
+                (0, chai_1.expect)(refused.status).to.equal(400);
+                (0, chai_1.expect)(refused.body).to.include({ error: 'invalid_setting', field: 'enableSelfHealing' });
+                (0, chai_1.expect)(yield typedi_1.Container.get(web_config_service_1.WebConfigService).getConfig()).to.deep.equal({});
+            }));
+        }
+    });
+    describe('on a running interceptor', () => {
+        const noSuchElement = () => Object.assign(new Error('NoSuchElement: An element could not be located'), {
+            name: 'NoSuchElementError',
+        });
+        let attemptHealing;
+        let pluginArgs;
+        beforeEach(() => {
+            pluginArgs = startup();
+            attemptHealing = sinon_1.default.stub().resolves(null);
+            typedi_1.Container.set(HealingOrchestrator_1.HealingOrchestrator, { attemptHealing });
+        });
+        /** A findElement the driver answers with NoSuchElement, as a broken selector does. */
+        function findMissing(sessionId) {
+            return __awaiter(this, void 0, void 0, function* () {
+                let thrown;
+                try {
+                    yield typedi_1.Container.get(CommandInterceptor_1.CommandInterceptor).handle(() => __awaiter(this, void 0, void 0, function* () {
+                        throw noSuchElement();
+                    }), { sessionId }, 'findElement', ['xpath', '//android.widget.Button[@text="Gone"]', sessionId], pluginArgs, false);
+                }
+                catch (err) {
+                    thrown = err;
+                }
+                return thrown;
+            });
+        }
+        it('heals a missing element while the switch is on, as it always did', () => __awaiter(void 0, void 0, void 0, function* () {
+            const thrown = yield findMissing('sess-on');
+            (0, chai_1.expect)(attemptHealing.calledOnce).to.equal(true);
+            // Nothing healed it, so the test still sees its own NoSuchElement.
+            (0, chai_1.expect)(thrown === null || thrown === void 0 ? void 0 : thrown.name).to.equal('NoSuchElementError');
+        }));
+        it('stops healing for the next command once off is saved, with no restart', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield findMissing('sess-1');
+            (0, chai_1.expect)(attemptHealing.callCount).to.equal(1);
+            (0, chai_1.expect)((yield save({ enableSelfHealing: false })).status).to.equal(200);
+            const thrown = yield findMissing('sess-1');
+            (0, chai_1.expect)(attemptHealing.callCount).to.equal(1);
+            // The failure reaches the test untouched, which is the point of turning it off.
+            (0, chai_1.expect)(thrown === null || thrown === void 0 ? void 0 : thrown.name).to.equal('NoSuchElementError');
+        }));
+        it('heals again once on is saved after off', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield save({ enableSelfHealing: false });
+            yield findMissing('sess-2');
+            (0, chai_1.expect)(attemptHealing.called).to.equal(false);
+            yield save({ enableSelfHealing: true });
+            yield findMissing('sess-2');
+            (0, chai_1.expect)(attemptHealing.calledOnce).to.equal(true);
+        }));
+        it('does not read the database for a command', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield save({ enableSelfHealing: false });
+            const reads = sinon_1.default.spy(typedi_1.Container.get(web_config_service_1.WebConfigService), 'getConfig');
+            yield findMissing('sess-3');
+            yield findMissing('sess-3');
+            (0, chai_1.expect)(reads.called).to.equal(false);
+        }));
+        it('follows the startup option when nothing is saved', () => __awaiter(void 0, void 0, void 0, function* () {
+            pluginArgs = startup({ enableSelfHealing: false });
+            yield findMissing('sess-4');
+            (0, chai_1.expect)(attemptHealing.called).to.equal(false);
+        }));
+        it('lets a saved on beat a startup off', () => __awaiter(void 0, void 0, void 0, function* () {
+            pluginArgs = startup({ enableSelfHealing: false });
+            yield save({ enableSelfHealing: true });
+            yield findMissing('sess-5');
+            (0, chai_1.expect)(attemptHealing.calledOnce).to.equal(true);
+        }));
+        it("still hands a session's own healing tiers to the healing it runs", () => __awaiter(void 0, void 0, void 0, function* () {
+            // Read from the session's driver, which every session has: SESSION_MANAGER
+            // holds a local one only with the dashboard on, and holds none here.
+            const driver = { sessionId: 'sess-6', caps: { 'xe:options': { healingTiers: [1, 2] } } };
+            (0, chai_1.expect)(SessionManager_1.SESSION_MANAGER.getSession('sess-6')).to.equal(undefined);
+            yield typedi_1.Container.get(CommandInterceptor_1.CommandInterceptor)
+                .handle(() => __awaiter(void 0, void 0, void 0, function* () {
+                throw noSuchElement();
+            }), driver, 'findElement', ['id', 'gone', 'sess-6'], pluginArgs, false)
+                .catch(() => undefined);
+            (0, chai_1.expect)(attemptHealing.calledOnce).to.equal(true);
+            (0, chai_1.expect)(attemptHealing.firstCall.args).to.deep.equal(['sess-6', driver, 'id', 'gone', [1, 2]]);
+        }));
+        describe('and what it learns from a found element', () => {
+            let learn;
+            beforeEach(() => {
+                sinon_1.default.stub(event_manager_1.DASHBORD_EVENT_MANAGER, 'afterSessionCommand').resolves();
+                learn = sinon_1.default.stub(CommandInterceptor_1.CommandInterceptor.prototype, 'triggerLearning').resolves();
+            });
+            /** A findElement the driver answers with its element. */
+            const afterFind = () => typedi_1.Container.get(CommandInterceptor_1.CommandInterceptor).handle(() => __awaiter(void 0, void 0, void 0, function* () { return ({ ELEMENT: 'el-1' }); }), { sessionId: 'sess-7' }, 'findElement', ['id', 'there', 'sess-7'], pluginArgs, false);
+            it('learns the selector while the switch is on', () => __awaiter(void 0, void 0, void 0, function* () {
+                yield afterFind();
+                (0, chai_1.expect)(learn.calledOnce).to.equal(true);
+            }));
+            it('learns nothing once off is saved', () => __awaiter(void 0, void 0, void 0, function* () {
+                yield save({ enableSelfHealing: false });
+                yield afterFind();
+                (0, chai_1.expect)(learn.called).to.equal(false);
+            }));
+        });
+    });
+    describe('at boot', () => {
+        it('is the saved value, over the startup option', () => __awaiter(void 0, void 0, void 0, function* () {
+            const pluginArgs = startup({ enableSelfHealing: true });
+            yield scratch.db.webConfig.create({
+                data: { id: 'enableSelfHealing', name: 'enableSelfHealing', value: 'false' },
+            });
+            yield healingSwitch.load();
+            (0, chai_1.expect)(healingSwitch.isEnabled(pluginArgs)).to.equal(false);
+        }));
+        it('is the startup option when nothing is saved', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield healingSwitch.load();
+            (0, chai_1.expect)(healingSwitch.isEnabled(startup({ enableSelfHealing: false }))).to.equal(false);
+            (0, chai_1.expect)(healingSwitch.isEnabled(startup({ enableSelfHealing: true }))).to.equal(true);
+        }));
+        it('is on when neither was set', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield healingSwitch.load();
+            (0, chai_1.expect)(healingSwitch.isEnabled({})).to.equal(true);
+        }));
+        it('is the startup option, and says so once, when the saved value cannot be read', () => __awaiter(void 0, void 0, void 0, function* () {
+            const warn = sinon_1.default.stub(logger_1.default, 'warn');
+            sinon_1.default.stub(typedi_1.Container.get(web_config_service_1.WebConfigService), 'getConfig').rejects(new Error('db is down'));
+            yield healingSwitch.load();
+            const off = startup({ enableSelfHealing: false });
+            const on = startup({ enableSelfHealing: true });
+            (0, chai_1.expect)(healingSwitch.isEnabled(off)).to.equal(false);
+            (0, chai_1.expect)(healingSwitch.isEnabled(on)).to.equal(true);
+            // However many commands follow, it is said once, at the load.
+            (0, chai_1.expect)(warn.calledOnce).to.equal(true);
+            (0, chai_1.expect)(String(warn.firstCall.args[0])).to.match(/self-healing/i);
+            (0, chai_1.expect)(String(warn.firstCall.args[0])).to.include('db is down');
+        }));
+        it('uses the startup option until it has loaded', () => {
+            (0, chai_1.expect)(healingSwitch.isEnabled({ enableSelfHealing: false })).to.equal(false);
+            (0, chai_1.expect)(healingSwitch.isEnabled({ enableSelfHealing: true })).to.equal(true);
+        });
+    });
+});

package/lib/test/unit/session-app-resolution.spec.js

@@ -145,7 +145,11 @@ describe('createSession — an app named by id follows the team rule', () => {
                 return owned.includes('admin') || req.some((s) => owned.includes(s));
             },
         });
-        typedi_1.Container.set(UserService_1.UserService, { findById: () => __awaiter(void 0, void 0, void 0, function* () { return null; }) });
+        // Every key's owner is an ACTIVE member: a key names its owner only while
+        // they are. The admin key is unscoped by its admin scope.
+        typedi_1.Container.set(UserService_1.UserService, {
+            findById: (id) => __awaiter(void 0, void 0, void 0, function* () { return ({ id, role: 'MEMBER', status: 'ACTIVE' }); }),
+        });
         sinon_1.default.stub(app_service_1.APP_SERVICE, 'getAppById').callsFake((id) => __awaiter(void 0, void 0, void 0, function* () { var _a; return (_a = APPS[id]) !== null && _a !== void 0 ? _a : null; }));
         const device = { udid: 'u1', host: 'h1', platform: 'android', nodeId: 'node-hub' };
         allocate = sinon_1.default.stub(deviceUtils, 'allocateDeviceForSession').resolves(device);

package/lib/test/unit/session-attribution-wiring.spec.js

@@ -41,10 +41,12 @@ describe('authorizeSessionRequest — identity', () => {
         authDisabledBefore = config_1.config.authDisabled;
         config_1.config.authDisabled = false;
         restore = (0, container_registration_1.saveRegistrations)(ApiKeyService_1.ApiKeyService, JwtKeyService_1.JwtKeyService, UserService_1.UserService);
-        // No such user and no teams, as the developer's database answered for
-        // these ids: the real lookups read that database. Nothing here is about
-        // the owner's teams.
-        typedi_1.Container.set(UserService_1.UserService, { findById: () => __awaiter(void 0, void 0, void 0, function* () { return null; }) });
+        // Every id is an ACTIVE member in no team: a credential names its owner
+        // only while they are (session-create-credential-owner.spec.ts covers
+        // the other cases). The real lookups would read the developer's database.
+        typedi_1.Container.set(UserService_1.UserService, {
+            findById: (id) => __awaiter(void 0, void 0, void 0, function* () { return ({ id, role: 'MEMBER', status: 'ACTIVE' }); }),
+        });
         sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([]);
         svc = new SessionLifecycleService_1.SessionLifecycleService();
     });
@@ -105,7 +107,7 @@ describe('authorizeSessionRequest — identity', () => {
             hasScope: () => false,
         });
         typedi_1.Container.set(JwtKeyService_1.JwtKeyService, {
-            verify: sinon_1.default.stub().resolves({ sub: 'usr_carol' }),
+            verify: sinon_1.default.stub().resolves({ sub: 'usr_carol', scopes: 'sessions' }),
         });
         const res = yield invoke(svc, capsWith({ 'xe:options': { sessionToken: 'tok' } }));
         (0, chai_1.expect)(res.apiKeyId).to.equal(null);
@@ -156,13 +158,14 @@ describe('authorizeSessionRequest — leaseAccess', () => {
         findUser = sinon_1.default.stub().resolves(owner);
         typedi_1.Container.set(UserService_1.UserService, { findById: findUser });
     };
-    const withSessionToken = (owner, teamId = null) => {
+    // A session token carries the scopes of the credential that minted it.
+    const withSessionToken = (owner, teamId = null, scopes = 'sessions') => {
         typedi_1.Container.set(ApiKeyService_1.ApiKeyService, {
             verifyPair: sinon_1.default.stub().resolves(null),
             hasScope: () => false,
         });
         typedi_1.Container.set(JwtKeyService_1.JwtKeyService, {
-            verify: sinon_1.default.stub().resolves({ sub: 'usr_alice', teamId }),
+            verify: sinon_1.default.stub().resolves({ sub: 'usr_alice', teamId, scopes }),
         });
         findUser = sinon_1.default.stub().resolves(owner);
         typedi_1.Container.set(UserService_1.UserService, { findById: findUser });
@@ -208,9 +211,19 @@ describe('authorizeSessionRequest — leaseAccess', () => {
             withKey(keyRow('admin'), user('SUPER_ADMIN', 'INACTIVE'));
             (0, chai_1.expect)((yield access(pairCaps())).canOverride).to.equal(false);
         }));
-        it('follows the role of a session-token caller, ADMIN included', () => __awaiter(void 0, void 0, void 0, function* () {
-            withSessionToken(user('ADMIN'));
+        // By the scopes it was minted with, as a key is judged. By its user's role
+        // alone, an ADMIN's key without the admin scope minted itself an override.
+        it("follows resolveActor's rule on a session token's user's role now", () => __awaiter(void 0, void 0, void 0, function* () {
+            withSessionToken(user('ADMIN'), null, 'admin,sessions');
+            (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(true);
+            withSessionToken(user('ADMIN'), null, 'sessions');
+            (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(false);
+            withSessionToken(user('SUPER_ADMIN'), null, 'admin,sessions');
+            (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(true);
+            withSessionToken(user('SUPER_ADMIN'), null, 'sessions');
             (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(true);
+            withSessionToken(user('MEMBER'), null, 'admin,sessions');
+            (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(false);
             withSessionToken(user('MEMBER'));
             (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(false);
         }));
@@ -223,9 +236,24 @@ describe('authorizeSessionRequest — leaseAccess', () => {
             (0, chai_1.expect)(res.scoped).to.equal(false);
             (0, chai_1.expect)((yield res.leaseAccess()).canOverride).to.equal(false);
         }));
-        it('is false when the lookup fails, and the teams fall back to the shared pool', () => __awaiter(void 0, void 0, void 0, function* () {
+        // The owner is looked up when the credential is checked: a key names them
+        // only while they are ACTIVE, so a lookup that fails refuses the session
+        // rather than run it as someone who may have been switched off.
+        it('refuses the session when the owner lookup fails', () => __awaiter(void 0, void 0, void 0, function* () {
             withKey(keyRow('admin'), null);
             typedi_1.Container.set(UserService_1.UserService, { findById: sinon_1.default.stub().rejects(new Error('db down')) });
+            let error;
+            try {
+                yield invoke(svc, pairCaps());
+            }
+            catch (e) {
+                error = e;
+            }
+            (0, chai_1.expect)(error === null || error === void 0 ? void 0 : error.message).to.equal('db down');
+        }));
+        it('is false, and the teams fall back to the shared pool, when the team lookup fails', () => __awaiter(void 0, void 0, void 0, function* () {
+            withKey(keyRow('sessions'), user('MEMBER'));
+            teamRows.rejects(new Error('db down'));
             (0, chai_1.expect)(yield access(pairCaps())).to.deep.equal({ canOverride: false, teamIds: [] });
         }));
         it('is true when auth is disabled, where every caller is an admin', () => __awaiter(void 0, void 0, void 0, function* () {
@@ -331,9 +359,9 @@ describe('authorizeSessionRequest — leaseAccess', () => {
             }
             (0, chai_1.expect)(error === null || error === void 0 ? void 0 : error.message).to.equal("xe:options.team 'team_c' is not allowed for this API key");
         }));
-        it('falls back to the shared pool when the lookup fails', () => __awaiter(void 0, void 0, void 0, function* () {
-            withKey(keyRow('sessions'), null);
-            typedi_1.Container.set(UserService_1.UserService, { findById: sinon_1.default.stub().rejects(new Error('db down')) });
+        it('falls back to the shared pool when the team lookup fails', () => __awaiter(void 0, void 0, void 0, function* () {
+            withKey(keyRow('sessions'), user('MEMBER'));
+            teamRows.rejects(new Error('db down'));
             (0, chai_1.expect)(yield scope(pairCaps())).to.deep.equal({ callerTeamIds: [], scoped: true });
         }));
         it('stays unscoped, with no lookup, for a session with no credentials', () => __awaiter(void 0, void 0, void 0, function* () {

package/lib/test/unit/session-create-credential-owner.spec.js

@@ -0,0 +1,242 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const typedi_1 = require("typedi");
+const SessionLifecycleService_1 = require("../../src/services/SessionLifecycleService");
+const ApiKeyService_1 = require("../../src/services/ApiKeyService");
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const UserService_1 = require("../../src/services/UserService");
+const config_1 = require("../../src/config");
+const prisma_1 = require("../../src/prisma");
+const container_registration_1 = require("../helpers/container-registration");
+const sessionCredentials_1 = require("../../src/services/session/sessionCredentials");
+/**
+ * Session create judges the credentials it is given by REST's rule: a key
+ * pair or session token says who the caller is only while that user exists
+ * and is ACTIVE. Through 2.14 the pair was checked against the key alone
+ * (ApiKeyService.verifyPair) and the session token against its signature
+ * alone, so a user set to Inactive, or deleted, kept creating sessions as
+ * themselves, past XENON_REQUIRE_SESSION_TOKEN too.
+ *
+ * Such credentials now count as wrong ones: with the gate on the session is
+ * refused, with it off it runs with no owner, like any session presenting
+ * credentials that don't check out.
+ *
+ * A session token also has to carry the `sessions` scope, as a key pair
+ * must: POST /auth/token gave one to any credential, a read-only one
+ * included.
+ */
+// authorizeSessionRequest is private: the single place a create's identity is
+// decided. It is handed the credentials createSession took out of the caps.
+const invoke = (svc, caps) => svc.authorizeSessionRequest(caps, (0, sessionCredentials_1.takeSessionCredentials)(caps));
+const capsWith = (options) => ({
+    alwaysMatch: { 'xe:options': options },
+    firstMatch: [{}],
+});
+function refusalOf(promise) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        try {
+            yield promise;
+            return null;
+        }
+        catch (err) {
+            return String((_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err);
+        }
+    });
+}
+describe('session create: the credentials of an inactive or deleted user', () => {
+    let svc;
+    let dir;
+    let keys;
+    let restore;
+    let authDisabledBefore;
+    let gateBefore;
+    let users;
+    let findById;
+    const keyRow = { id: 'key_alice', userId: 'usr_alice', scopes: 'sessions', teamId: null };
+    const alice = () => users.usr_alice;
+    const pair = () => capsWith({ accessKey: 'xen_alice', token: 'tk' });
+    const token = (claims = { sub: 'usr_alice', scopes: 'sessions' }) => keys.sign(claims, { audience: 'xenon-session', ttlSeconds: 600 });
+    const gate = (on) => {
+        if (on)
+            process.env.XENON_REQUIRE_SESSION_TOKEN = 'true';
+        else
+            delete process.env.XENON_REQUIRE_SESSION_TOKEN;
+    };
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        authDisabledBefore = config_1.config.authDisabled;
+        config_1.config.authDisabled = false;
+        gateBefore = process.env.XENON_REQUIRE_SESSION_TOKEN;
+        restore = (0, container_registration_1.saveRegistrations)(ApiKeyService_1.ApiKeyService, JwtKeyService_1.JwtKeyService, UserService_1.UserService);
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-create-owner-'));
+        keys = new JwtKeyService_1.JwtKeyService();
+        yield keys.init(dir);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, keys);
+        typedi_1.Container.set(ApiKeyService_1.ApiKeyService, {
+            verifyPair: sinon_1.default.stub().resolves(keyRow),
+            hasScope: (row, req) => {
+                const owned = row.scopes.split(',');
+                return owned.includes('admin') || req.some((s) => owned.includes(s));
+            },
+        });
+        users = { usr_alice: { id: 'usr_alice', role: 'MEMBER', status: 'ACTIVE' } };
+        findById = sinon_1.default.stub().callsFake((id) => __awaiter(void 0, void 0, void 0, function* () { var _a; return (_a = users[id]) !== null && _a !== void 0 ? _a : null; }));
+        typedi_1.Container.set(UserService_1.UserService, { findById });
+        sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([]);
+        svc = new SessionLifecycleService_1.SessionLifecycleService();
+    }));
+    afterEach(() => {
+        config_1.config.authDisabled = authDisabledBefore;
+        if (gateBefore === undefined)
+            delete process.env.XENON_REQUIRE_SESSION_TOKEN;
+        else
+            process.env.XENON_REQUIRE_SESSION_TOKEN = gateBefore;
+        sinon_1.default.restore();
+        restore();
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    describe('with XENON_REQUIRE_SESSION_TOKEN on', () => {
+        beforeEach(() => gate(true));
+        it("refuses an Inactive user's access key and token", () => __awaiter(void 0, void 0, void 0, function* () {
+            alice().status = 'INACTIVE';
+            (0, chai_1.expect)(yield refusalOf(invoke(svc, pair()))).to.match(/session rejected/);
+        }));
+        it("refuses a deleted user's key, whose row outlived them", () => __awaiter(void 0, void 0, void 0, function* () {
+            users.usr_alice = undefined;
+            (0, chai_1.expect)(yield refusalOf(invoke(svc, pair()))).to.match(/session rejected/);
+        }));
+        it("refuses an Inactive user's session token", () => __awaiter(void 0, void 0, void 0, function* () {
+            alice().status = 'INACTIVE';
+            const caps = capsWith({ sessionToken: yield token() });
+            (0, chai_1.expect)(yield refusalOf(invoke(svc, caps))).to.match(/session rejected/);
+        }));
+        it("refuses a deleted user's session token, which is still within its lifetime", () => __awaiter(void 0, void 0, void 0, function* () {
+            users.usr_alice = undefined;
+            const caps = capsWith({ sessionToken: yield token() });
+            (0, chai_1.expect)(yield refusalOf(invoke(svc, caps))).to.match(/session rejected/);
+        }));
+        it("still admits an Active user's key and token, and their session token", () => __awaiter(void 0, void 0, void 0, function* () {
+            const byPair = yield invoke(svc, pair());
+            (0, chai_1.expect)(byPair).to.include({ apiKeyId: 'key_alice', userId: 'usr_alice' });
+            const byToken = yield invoke(svc, capsWith({ sessionToken: yield token() }));
+            (0, chai_1.expect)(byToken).to.include({ apiKeyId: null, userId: 'usr_alice' });
+        }));
+        it('looks the owner up once, though the gate and attribution both verify the token', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield invoke(svc, capsWith({ sessionToken: yield token() }));
+            (0, chai_1.expect)(findById.callCount).to.equal(1);
+        }));
+    });
+    describe('with XENON_REQUIRE_SESSION_TOKEN off', () => {
+        beforeEach(() => gate(false));
+        it("gives no owner to a session made with an Inactive user's key", () => __awaiter(void 0, void 0, void 0, function* () {
+            alice().status = 'INACTIVE';
+            const res = yield invoke(svc, pair());
+            (0, chai_1.expect)(res).to.include({ apiKeyId: null, userId: null });
+        }));
+        it("gives no owner to a session made with a deleted user's session token", () => __awaiter(void 0, void 0, void 0, function* () {
+            users.usr_alice = undefined;
+            const res = yield invoke(svc, capsWith({ sessionToken: yield token() }));
+            (0, chai_1.expect)(res).to.include({ apiKeyId: null, userId: null });
+        }));
+        it('looks an Active owner up once for a key and token', () => __awaiter(void 0, void 0, void 0, function* () {
+            const res = yield invoke(svc, pair());
+            yield res.leaseAccess();
+            (0, chai_1.expect)(res.userId).to.equal('usr_alice');
+            (0, chai_1.expect)(findById.callCount).to.equal(1);
+        }));
+    });
+    describe('a session token needs the `sessions` scope', () => {
+        for (const on of [false, true]) {
+            describe(`(gate ${on ? 'on' : 'off'})`, () => {
+                beforeEach(() => gate(on));
+                it('refuses one minted for a read-only credential', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const caps = capsWith({
+                        sessionToken: yield token({ sub: 'usr_alice', scopes: 'devices' }),
+                    });
+                    (0, chai_1.expect)(yield refusalOf(invoke(svc, caps))).to.match(/sessions` scope/);
+                }));
+                it('refuses one minted before session tokens carried their scopes, saying so', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const caps = capsWith({ sessionToken: yield token({ sub: 'usr_alice' }) });
+                    const refusal = yield refusalOf(invoke(svc, caps));
+                    (0, chai_1.expect)(refusal).to.match(/carries no `sessions` scope/);
+                    (0, chai_1.expect)(refusal).to.match(/minted by Xenon 2\.14 or earlier carry none/);
+                    (0, chai_1.expect)(refusal).to.match(/mint a new one/);
+                }));
+                it('admits one with `sessions` or `admin`', () => __awaiter(void 0, void 0, void 0, function* () {
+                    for (const scopes of ['sessions', 'admin', 'devices,sessions']) {
+                        const caps = capsWith({ sessionToken: yield token({ sub: 'usr_alice', scopes }) });
+                        (0, chai_1.expect)((yield invoke(svc, caps)).userId).to.equal('usr_alice');
+                    }
+                }));
+            });
+        }
+    });
+    // Taking over a lease someone else created is an ownership override: a
+    // SUPER_ADMIN, or a credential with the `admin` scope. A session token was
+    // judged by its user's role alone, so an ADMIN's key without the admin
+    // scope, which may not override, minted a session token that could.
+    describe('a session token overrides a lease only as the credential that minted it could', () => {
+        beforeEach(() => gate(false));
+        const overrideWith = (role, scopes) => __awaiter(void 0, void 0, void 0, function* () {
+            alice().role = role;
+            const caps = capsWith({ sessionToken: yield token({ sub: 'usr_alice', scopes }) });
+            return (yield (yield invoke(svc, caps)).leaseAccess()).canOverride;
+        });
+        it("is refused for an ADMIN's token minted without the admin scope", () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)(yield overrideWith('ADMIN', 'sessions')).to.equal(false);
+        }));
+        it("is allowed for an ADMIN's or SUPER_ADMIN's token minted with the admin scope", () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)(yield overrideWith('ADMIN', 'admin,sessions')).to.equal(true);
+            (0, chai_1.expect)(yield overrideWith('SUPER_ADMIN', 'admin,sessions')).to.equal(true);
+        }));
+        // As the SUPER_ADMIN's key pair and Bearer token override.
+        it("is allowed for a SUPER_ADMIN's token minted without it", () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)(yield overrideWith('SUPER_ADMIN', 'sessions')).to.equal(true);
+        }));
+        // The scope is fixed when the token is minted; the role is read now. An
+        // admin demoted after minting overrides no more.
+        it('is refused once the admin who minted it is a member', () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)(yield overrideWith('MEMBER', 'admin,sessions')).to.equal(false);
+        }));
+        it("is refused for a member's token", () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)(yield overrideWith('MEMBER', 'sessions')).to.equal(false);
+        }));
+    });
+    // The owner lookup that fails is not a token that doesn't check out: the
+    // create is refused, as for a key whose owner can't be looked up. It ran
+    // with no owner (gate off) or was refused as "invalid or expired" (gate on).
+    describe('a session token whose owner cannot be looked up', () => {
+        for (const on of [false, true]) {
+            it(`refuses the create (gate ${on ? 'on' : 'off'})`, () => __awaiter(void 0, void 0, void 0, function* () {
+                gate(on);
+                findById.rejects(new Error('db down'));
+                const caps = capsWith({ sessionToken: yield token() });
+                (0, chai_1.expect)(yield refusalOf(invoke(svc, caps))).to.equal('db down');
+            }));
+        }
+        it('still counts a token that does not check out as none (gate off)', () => __awaiter(void 0, void 0, void 0, function* () {
+            gate(false);
+            const res = yield invoke(svc, capsWith({ sessionToken: 'not-a-jwt' }));
+            (0, chai_1.expect)(res).to.include({ apiKeyId: null, userId: null });
+            (0, chai_1.expect)(findById.called).to.equal(false);
+        }));
+    });
+});

package/lib/test/unit/session-credential-strip.spec.js

@@ -146,7 +146,7 @@ describe('createSession — credentials never reach the driver or storage', () =
             verify: (t) => __awaiter(void 0, void 0, void 0, function* () {
                 if (!t.startsWith('jwt:'))
                     throw new Error('bad token');
-                return { sub: t.slice('jwt:'.length), teamId: null };
+                return { sub: t.slice('jwt:'.length), teamId: null, scopes: 'sessions' };
             }),
         });
         // The owner's teams: none, and not read from the developer's database.