@xenon-device-management/xenon 2.14.0 → 2.15.0

package/lib/test/integration/recordings-router.spec.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const typedi_1 = require("typedi");
 const recordings_1 = __importDefault(require("../../src/app/routers/recordings"));
 const authMiddleware_1 = require("../../src/middleware/authMiddleware");
@@ -76,7 +76,7 @@ describe('Recordings router (integration)', () => {
             startedAt: new Date(),
             compositeEnabled: false,
         });
-        const r = yield (0, supertest_1.default)(makeApp())
+        const r = yield (0, loopbackRequest_1.default)(makeApp())
             .post('/xenon/api/recordings')
             .send({ udids: ['U1'] });
         (0, chai_1.expect)(r.status).to.equal(202);
@@ -88,7 +88,7 @@ describe('Recordings router (integration)', () => {
             .rejects(new RecordingOrchestrator_1.RecordingError('device_busy', [
             { udid: 'U2', reason: 'automation', sessionId: 'sess-x' },
         ]));
-        const r = yield (0, supertest_1.default)(makeApp())
+        const r = yield (0, loopbackRequest_1.default)(makeApp())
             .post('/xenon/api/recordings')
             .send({ udids: ['U1', 'U2'] });
         (0, chai_1.expect)(r.status).to.equal(409);
@@ -101,7 +101,7 @@ describe('Recordings router (integration)', () => {
         sinon_1.default
             .stub(typedi_1.Container.get(RecordingOrchestrator_1.RecordingOrchestrator), 'start')
             .rejects(new RecordingOrchestrator_1.RecordingError('concurrency_cap', undefined, 4, 4));
-        const r = yield (0, supertest_1.default)(makeApp())
+        const r = yield (0, loopbackRequest_1.default)(makeApp())
             .post('/xenon/api/recordings')
             .send({ udids: ['U1'] });
         (0, chai_1.expect)(r.status).to.equal(409);
@@ -109,16 +109,16 @@ describe('Recordings router (integration)', () => {
     }));
     it('POST /recordings: 400 when udids missing or empty', () => __awaiter(void 0, void 0, void 0, function* () {
         const app = makeApp();
-        yield (0, supertest_1.default)(app).post('/xenon/api/recordings').send({}).expect(400);
-        yield (0, supertest_1.default)(app).post('/xenon/api/recordings').send({ udids: [] }).expect(400);
-        yield (0, supertest_1.default)(app).post('/xenon/api/recordings').send({ udids: [123] }).expect(400);
+        yield (0, loopbackRequest_1.default)(app).post('/xenon/api/recordings').send({}).expect(400);
+        yield (0, loopbackRequest_1.default)(app).post('/xenon/api/recordings').send({ udids: [] }).expect(400);
+        yield (0, loopbackRequest_1.default)(app).post('/xenon/api/recordings').send({ udids: [123] }).expect(400);
     }));
     it('POST /recordings/:groupId/stop: 200', () => __awaiter(void 0, void 0, void 0, function* () {
         sinon_1.default.stub(typedi_1.Container.get(RecordingOrchestrator_1.RecordingOrchestrator), 'stop').resolves({
             groupId: 'g-1',
             recordings: [{ id: 'r-1', udid: 'U1', status: 'STOPPED', durationMs: 5000, sizeBytes: 1024 }],
         });
-        const r = yield (0, supertest_1.default)(makeApp()).post('/xenon/api/recordings/g-1/stop');
+        const r = yield (0, loopbackRequest_1.default)(makeApp()).post('/xenon/api/recordings/g-1/stop');
         (0, chai_1.expect)(r.status).to.equal(200);
         (0, chai_1.expect)(r.body.recordings[0].status).to.equal('STOPPED');
     }));
@@ -127,11 +127,11 @@ describe('Recordings router (integration)', () => {
         sinon_1.default
             .stub(typedi_1.Container.get(RecordingOrchestrator_1.RecordingOrchestrator), 'addBookmark')
             .resolves({ id: 'bm-1', label: 'bug here' });
-        const ok = yield (0, supertest_1.default)(makeApp())
+        const ok = yield (0, loopbackRequest_1.default)(makeApp())
             .post('/xenon/api/recordings/g-1/bookmark')
             .send({ recordingId: 'r-1', timecodeMs: 1000, label: 'bug here' });
         (0, chai_1.expect)(ok.status).to.equal(201);
-        const bad = yield (0, supertest_1.default)(makeApp())
+        const bad = yield (0, loopbackRequest_1.default)(makeApp())
             .post('/xenon/api/recordings/g-1/bookmark')
             .send({ timecodeMs: 1000 });
         (0, chai_1.expect)(bad.status).to.equal(400);
@@ -166,7 +166,7 @@ describe('Recordings router (integration)', () => {
             startedAt: new Date(),
             compositeEnabled: false,
         });
-        const r = yield (0, supertest_1.default)(makeBearerApp())
+        const r = yield (0, loopbackRequest_1.default)(makeBearerApp())
             .post('/xenon/api/recordings')
             .send({ udids: ['U1'] });
         (0, chai_1.expect)(r.status).to.equal(202);
@@ -176,7 +176,7 @@ describe('Recordings router (integration)', () => {
             groupId: 'g-1',
             recordings: [{ id: 'r-2', udid: 'U2', status: 'RECORDING' }],
         });
-        const r = yield (0, supertest_1.default)(makeBearerApp())
+        const r = yield (0, loopbackRequest_1.default)(makeBearerApp())
             .post('/xenon/api/recordings/g-1/add-device')
             .send({ udid: 'U2' });
         (0, chai_1.expect)(r.status).to.equal(201);
@@ -215,7 +215,7 @@ describe('Recordings router (integration)', () => {
             startedAt: new Date(),
             compositeEnabled: false,
         });
-        const r = yield (0, supertest_1.default)(makeHeaderPairApp())
+        const r = yield (0, loopbackRequest_1.default)(makeHeaderPairApp())
             .post('/xenon/api/recordings')
             .send({ udids: ['U1'] });
         (0, chai_1.expect)(r.status).to.equal(202);
@@ -227,7 +227,7 @@ describe('Recordings router (integration)', () => {
             groupId: 'g-1',
             recordings: [{ id: 'r-2', udid: 'U2', status: 'RECORDING' }],
         });
-        const r = yield (0, supertest_1.default)(makeHeaderPairApp())
+        const r = yield (0, loopbackRequest_1.default)(makeHeaderPairApp())
             .post('/xenon/api/recordings/g-1/add-device')
             .send({ udid: 'U2' });
         (0, chai_1.expect)(r.status).to.equal(201);
@@ -239,7 +239,7 @@ describe('Recordings router (integration)', () => {
         sinon_1.default
             .stub(typedi_1.Container.get(RecordingOrchestrator_1.RecordingOrchestrator), 'addAnnotation')
             .resolves({ id: 'an-1' });
-        const ok = yield (0, supertest_1.default)(makeApp())
+        const ok = yield (0, loopbackRequest_1.default)(makeApp())
             .post('/xenon/api/recordings/g-1/annotation')
             .send({
             recordingId: 'r-1',
@@ -249,7 +249,7 @@ describe('Recordings router (integration)', () => {
             color: '#ff0000',
         });
         (0, chai_1.expect)(ok.status).to.equal(201);
-        const bad = yield (0, supertest_1.default)(makeApp())
+        const bad = yield (0, loopbackRequest_1.default)(makeApp())
             .post('/xenon/api/recordings/g-1/annotation')
             .send({ shape: 'RECT' });
         (0, chai_1.expect)(bad.status).to.equal(400);

package/lib/test/integration/reset-revokes-sessions.spec.js

@@ -15,20 +15,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const auth_1 = require("../../src/app/routers/auth");
 const typedi_1 = require("typedi");
 const UserService_1 = require("../../src/services/UserService");
 const UserSessionService_1 = require("../../src/services/UserSessionService");
 const PasswordResetService_1 = require("../../src/services/PasswordResetService");
 const prisma_1 = require("../../src/prisma");
+const scratch_database_1 = require("../helpers/scratch-database");
 describe('reset-password revokes all sessions', function () {
     this.timeout(30000);
+    (0, scratch_database_1.useScratchDatabase)({ wholeSuite: true });
     const email = 'reset-revokes-it@xenon.local';
     let user;
     before(() => __awaiter(this, void 0, void 0, function* () {
-        yield prisma_1.prisma.userSession.deleteMany({ where: { user: { email } } });
-        yield prisma_1.prisma.user.deleteMany({ where: { email } });
         user = yield typedi_1.Container.get(UserService_1.UserService).createUser({
             email,
             name: 'Reset Revokes IT',
@@ -36,11 +36,6 @@ describe('reset-password revokes all sessions', function () {
             role: 'MEMBER',
         });
     }));
-    after(() => __awaiter(this, void 0, void 0, function* () {
-        yield prisma_1.prisma.passwordResetToken.deleteMany({ where: { userId: user.id } });
-        yield prisma_1.prisma.userSession.deleteMany({ where: { userId: user.id } });
-        yield prisma_1.prisma.user.delete({ where: { id: user.id } });
-    }));
     it('deletes every UserSession for the resetting user', () => __awaiter(this, void 0, void 0, function* () {
         const sessions = [
             yield typedi_1.Container.get(UserSessionService_1.UserSessionService).create(user.id),
@@ -51,7 +46,7 @@ describe('reset-password revokes all sessions', function () {
         const app = (0, express_1.default)();
         app.use(express_1.default.json());
         app.use('/auth', (0, auth_1.authPublicRouter)());
-        const r = yield (0, supertest_1.default)(app)
+        const r = yield (0, loopbackRequest_1.default)(app)
             .post('/auth/reset-password')
             .send({ token: raw, newPassword: 'BrandNewPw1' });
         (0, chai_1.expect)(r.status).to.equal(204);

package/lib/test/integration/role-matrix.spec.js

@@ -15,13 +15,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const authMiddleware_1 = require("../../src/middleware/authMiddleware");
 const apikeys_1 = require("../../src/app/routers/apikeys");
 const teams_1 = require("../../src/app/routers/teams");
 const processes_1 = require("../../src/app/routers/processes");
 const users_1 = require("../../src/app/routers/users");
-const prisma_1 = require("../../src/prisma");
+const scratch_database_1 = require("../helpers/scratch-database");
 const seedUser_1 = require("../helpers/seedUser");
 // scopesForRole now grants ADMIN the full 'admin,devices,sessions,read' set on
 // cookie sessions (the user themselves logged in via /login). Token-default
@@ -84,6 +84,7 @@ function buildApp() {
 }
 describe('role matrix (integration)', function () {
     this.timeout(60000);
+    (0, scratch_database_1.useScratchDatabase)({ wholeSuite: true });
     let users;
     before(() => __awaiter(this, void 0, void 0, function* () {
         users = {
@@ -92,18 +93,12 @@ describe('role matrix (integration)', function () {
             MEMBER: yield (0, seedUser_1.seedUser)('MEMBER'),
         };
     }));
-    after(() => __awaiter(this, void 0, void 0, function* () {
-        yield users.SUPER_ADMIN.cleanup();
-        yield users.ADMIN.cleanup();
-        yield users.MEMBER.cleanup();
-        yield prisma_1.prisma.user.deleteMany({ where: { email: { contains: 'rmcase-' } } });
-    }));
     CASES.forEach((c) => {
         ['SUPER_ADMIN', 'ADMIN', 'MEMBER'].forEach((role) => {
             it(`${role} ${c.method} ${c.path} → expect ${c.expect[role]}`, () => __awaiter(this, void 0, void 0, function* () {
                 const app = buildApp();
                 const expected = c.expect[role];
-                const reqBuilder = (0, supertest_1.default)(app)[c.method.toLowerCase()](c.path).set('Cookie', users[role].cookie);
+                const reqBuilder = (0, loopbackRequest_1.default)(app)[c.method.toLowerCase()](c.path).set('Cookie', users[role].cookie);
                 const body = typeof c.body === 'function' ? c.body() : c.body;
                 const r = body ? yield reqBuilder.send(body) : yield reqBuilder;
                 if (expected >= 200 && expected < 300) {

package/lib/test/integration/sdk-leases-router.spec.js

@@ -15,7 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const sinon_1 = __importDefault(require("sinon"));
 // Static imports (recordings-router.spec idiom): the previous extensionless
 // dynamic `await import(...)` fails to resolve when Node's native ESM loader
@@ -53,7 +53,7 @@ describe('POST /xenon/api/sdk/leases', () => {
             allocatedPorts: { systemPort: 9001 },
             appiumCapabilities: { 'appium:udid': 'u1', 'xe:options': { leaseId: 'lse_1' } },
         });
-        const res = yield (0, supertest_1.default)(app)
+        const res = yield (0, loopbackRequest_1.default)(app)
             .post('/xenon/api/sdk/leases')
             .send({ filters: { platform: 'android' }, durationMs: 60000, heartbeatSeconds: 30 });
         (0, chai_1.expect)(res.status).to.equal(201);
@@ -62,7 +62,7 @@ describe('POST /xenon/api/sdk/leases', () => {
     }));
     it('records the api-key principal as actor/team on create', () => __awaiter(void 0, void 0, void 0, function* () {
         leaseSvc.create.resolves({ leaseId: 'lse_1', leaseToken: 't'.repeat(64) });
-        yield (0, supertest_1.default)(app)
+        yield (0, loopbackRequest_1.default)(app)
             .post('/xenon/api/sdk/leases')
             .send({ filters: { platform: 'android' } });
         (0, chai_1.expect)(leaseSvc.create.calledOnce).to.equal(true);
@@ -91,7 +91,7 @@ describe('POST /xenon/api/sdk/leases', () => {
         });
         bearerApp.use('/xenon/api/sdk/leases', (0, sdk_leases_1.makeRouter)({ leaseService: leaseSvc }));
         leaseSvc.create.resolves({ leaseId: 'lse_2', leaseToken: 't'.repeat(64) });
-        const res = yield (0, supertest_1.default)(bearerApp)
+        const res = yield (0, loopbackRequest_1.default)(bearerApp)
             .post('/xenon/api/sdk/leases')
             .send({ filters: { platform: 'android' } });
         (0, chai_1.expect)(res.status).to.equal(201);
@@ -103,7 +103,7 @@ describe('POST /xenon/api/sdk/leases', () => {
     }));
     it('returns 404 when no device matches', () => __awaiter(void 0, void 0, void 0, function* () {
         leaseSvc.create.rejects(new LeaseService_1.NoMatchingDevice('no device'));
-        const res = yield (0, supertest_1.default)(app)
+        const res = yield (0, loopbackRequest_1.default)(app)
             .post('/xenon/api/sdk/leases')
             .send({ filters: { platform: 'android', udid: 'absent' }, durationMs: 60000 });
         (0, chai_1.expect)(res.status).to.equal(404);
@@ -111,23 +111,23 @@ describe('POST /xenon/api/sdk/leases', () => {
     }));
     it('heartbeat: 200 with valid token; 403 without', () => __awaiter(void 0, void 0, void 0, function* () {
         leaseSvc.heartbeat.resolves({ heartbeatedAt: Date.now(), expiresAt: Date.now() + 60000 });
-        const res1 = yield (0, supertest_1.default)(app)
+        const res1 = yield (0, loopbackRequest_1.default)(app)
             .post('/xenon/api/sdk/leases/lse_1/heartbeat')
             .set('x-xenon-lease-token', 'cleartext');
         (0, chai_1.expect)(res1.status).to.equal(200);
-        const res2 = yield (0, supertest_1.default)(app).post('/xenon/api/sdk/leases/lse_1/heartbeat');
+        const res2 = yield (0, loopbackRequest_1.default)(app).post('/xenon/api/sdk/leases/lse_1/heartbeat');
         (0, chai_1.expect)(res2.status).to.equal(403);
     }));
     it('heartbeat: 403 on token mismatch from service', () => __awaiter(void 0, void 0, void 0, function* () {
         leaseSvc.heartbeat.rejects(new LeaseService_1.LeaseTokenMismatch());
-        const res = yield (0, supertest_1.default)(app)
+        const res = yield (0, loopbackRequest_1.default)(app)
             .post('/xenon/api/sdk/leases/lse_1/heartbeat')
             .set('x-xenon-lease-token', 'wrong');
         (0, chai_1.expect)(res.status).to.equal(403);
     }));
     it('heartbeat: 410 Gone on expired lease', () => __awaiter(void 0, void 0, void 0, function* () {
         leaseSvc.heartbeat.rejects(new LeaseService_1.LeaseGone('expired'));
-        const res = yield (0, supertest_1.default)(app)
+        const res = yield (0, loopbackRequest_1.default)(app)
             .post('/xenon/api/sdk/leases/lse_1/heartbeat')
             .set('x-xenon-lease-token', 'whatever');
         (0, chai_1.expect)(res.status).to.equal(410);

package/lib/test/integration/sdk-version.spec.js

@@ -48,7 +48,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const express_1 = __importStar(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 describe('GET /xenon/api/sdk/version', () => {
     it('returns pluginVersion + supports array', () => __awaiter(void 0, void 0, void 0, function* () {
         const register = (yield Promise.resolve().then(() => __importStar(require('../../src/app/routers/sdk-version')))).default;
@@ -61,7 +61,7 @@ describe('GET /xenon/api/sdk/version', () => {
         const apiRouter = (0, express_1.Router)();
         register(apiRouter);
         app.use('/xenon/api', apiRouter);
-        const res = yield (0, supertest_1.default)(app).get('/xenon/api/sdk/version');
+        const res = yield (0, loopbackRequest_1.default)(app).get('/xenon/api/sdk/version');
         (0, chai_1.expect)(res.status).to.equal(200);
         (0, chai_1.expect)(res.body.pluginVersion).to.be.a('string');
         (0, chai_1.expect)(res.body.supports).to.include.members(['leases', 'ports', 'heartbeat']);

package/lib/test/integration/selector-health-endpoint.spec.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const dashboard_1 = require("../../src/app/routers/dashboard");
 const roleGuard_1 = require("../../src/middleware/roleGuard");
 const prisma_1 = require("../../src/prisma");
@@ -209,23 +209,23 @@ describe('GET /healing/selector-health — MEMBER guard (router-level)', () => {
     });
     afterEach(() => sinon_1.default.restore());
     it('401s when unauthenticated', () => __awaiter(void 0, void 0, void 0, function* () {
-        const r = yield (0, supertest_1.default)(makeApp()).get('/xenon/api/healing/selector-health');
+        const r = yield (0, loopbackRequest_1.default)(makeApp()).get('/xenon/api/healing/selector-health');
         (0, chai_1.expect)(r.status).to.equal(401);
     }));
     it('403s for a role below MEMBER', () => __awaiter(void 0, void 0, void 0, function* () {
-        const r = yield (0, supertest_1.default)(makeApp())
+        const r = yield (0, loopbackRequest_1.default)(makeApp())
             .get('/xenon/api/healing/selector-health')
             .set('x-test-role', 'BOGUS');
         (0, chai_1.expect)(r.status).to.equal(403);
     }));
     it('200s for MEMBER', () => __awaiter(void 0, void 0, void 0, function* () {
-        const r = yield (0, supertest_1.default)(makeApp())
+        const r = yield (0, loopbackRequest_1.default)(makeApp())
             .get('/xenon/api/healing/selector-health')
             .set('x-test-role', 'MEMBER');
         (0, chai_1.expect)(r.status).to.equal(200);
     }));
     it('200s for ADMIN', () => __awaiter(void 0, void 0, void 0, function* () {
-        const r = yield (0, supertest_1.default)(makeApp())
+        const r = yield (0, loopbackRequest_1.default)(makeApp())
             .get('/xenon/api/healing/selector-health')
             .set('x-test-role', 'ADMIN');
         (0, chai_1.expect)(r.status).to.equal(200);

package/lib/test/integration/team-membership-migration.spec.js

@@ -8,28 +8,89 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
 const typedi_1 = require("typedi");
+const client_1 = require("../../src/generated/client");
 const UserService_1 = require("../../src/services/UserService");
 const TeamService_1 = require("../../src/services/TeamService");
 const prisma_1 = require("../../src/prisma");
+const scratch_database_1 = require("../helpers/scratch-database");
+const ROOT = path_1.default.resolve(__dirname, '../..');
+const MIGRATIONS = path_1.default.join(ROOT, 'prisma', 'migrations');
+/** The migration that backfills TeamMember from ApiKey.teamId. */
+const BACKFILL = '20260430001747_phase_3_team_members';
+/**
+ * `prisma migrate deploy` into `url` of the repository's migrations that
+ * `include` names, from a copy of the schema in `dir`. Run again with more
+ * of them, it applies only the ones not yet applied.
+ */
+function deploy(dir, url, include) {
+    const target = path_1.default.join(dir, 'migrations');
+    fs_1.default.mkdirSync(target, { recursive: true });
+    fs_1.default.copyFileSync(path_1.default.join(MIGRATIONS, 'migration_lock.toml'), path_1.default.join(target, 'migration_lock.toml'));
+    for (const name of fs_1.default.readdirSync(MIGRATIONS)) {
+        const sql = path_1.default.join(MIGRATIONS, name, 'migration.sql');
+        if (!include(name) || !fs_1.default.existsSync(sql))
+            continue;
+        fs_1.default.mkdirSync(path_1.default.join(target, name), { recursive: true });
+        fs_1.default.copyFileSync(sql, path_1.default.join(target, name, 'migration.sql'));
+    }
+    fs_1.default.copyFileSync(path_1.default.join(ROOT, 'prisma', 'schema.prisma'), path_1.default.join(dir, 'schema.prisma'));
+    (0, child_process_1.execSync)(`npx prisma migrate deploy --schema "${path_1.default.join(dir, 'schema.prisma')}"`, {
+        cwd: ROOT,
+        env: Object.assign(Object.assign({}, process.env), { DATABASE_URL: url }),
+        stdio: 'pipe',
+    });
+}
 describe('team-membership migration backfill (integration)', function () {
     this.timeout(60000);
-    it('no TeamMember row points at Legacy Admin', () => __awaiter(this, void 0, void 0, function* () {
-        const legacy = yield prisma_1.prisma.user.findFirst({
-            where: { email: 'legacy-admin@xenon.local' },
-        });
-        if (!legacy) {
-            // Legacy Admin only exists if Phase 1's adoption migration actually ran
-            // against a non-empty ApiKey table. Skip if absent.
-            // eslint-disable-next-line no-console
-            console.log('skipped: no Legacy Admin in this DB');
-            return;
+    (0, scratch_database_1.useScratchDatabase)({ wholeSuite: true });
+    // Through 2.14 this read the developer's own database, and returned early
+    // unless an old Legacy Admin happened to be in it. It runs the migration
+    // itself now, on a database migrated up to it and seeded as such a lab was.
+    it('backfills TeamMember from team keys, and gives Legacy Admin no membership', () => __awaiter(this, void 0, void 0, function* () {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-team-backfill-'));
+        const url = `file:${path_1.default.join(dir, 'xenon.db')}`;
+        try {
+            deploy(dir, url, (name) => name < BACKFILL);
+            const before = new client_1.PrismaClient({ datasources: { db: { url } } });
+            try {
+                yield before.$executeRawUnsafe('INSERT INTO "Team" ("id", "name") VALUES (?, ?)', 'team-1', 'Team 1');
+                for (const [id, email] of [
+                    ['legacy', 'legacy-admin@xenon.local'],
+                    ['alice', 'alice@xenon.local'],
+                ]) {
+                    yield before.$executeRawUnsafe(`INSERT INTO "User" ("id", "email", "name", "passwordHash", "accessKey", "updatedAt")
+             VALUES (?, ?, ?, 'x', ?, CURRENT_TIMESTAMP)`, id, email, id, `ak-${id}`);
+                    yield before.$executeRawUnsafe(`INSERT INTO "ApiKey" ("id", "name", "keyHash", "scopes", "teamId", "userId")
+             VALUES (?, ?, ?, 'devices', 'team-1', ?)`, `key-${id}`, id, `hash-${id}`, id);
+                }
+            }
+            finally {
+                yield before.$disconnect();
+            }
+            deploy(dir, url, () => true);
+            const after = new client_1.PrismaClient({ datasources: { db: { url } } });
+            try {
+                const members = yield after.teamMember.findMany({ select: { teamId: true, userId: true } });
+                (0, chai_1.expect)(members).to.deep.equal([{ teamId: 'team-1', userId: 'alice' }]);
+            }
+            finally {
+                yield after.$disconnect();
+            }
+        }
+        finally {
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
         }
-        const polluted = yield prisma_1.prisma.teamMember.count({ where: { userId: legacy.id } });
-        (0, chai_1.expect)(polluted).to.equal(0);
     }));
     it('addMember / removeMember round-trip an arbitrary user', () => __awaiter(this, void 0, void 0, function* () {
         const u = yield typedi_1.Container.get(UserService_1.UserService).createUser({

package/lib/test/integration/team-visibility-apps.spec.js

@@ -15,7 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
@@ -29,17 +29,17 @@ const app_service_1 = require("../../src/dashboard/services/app-service");
 const prisma_1 = require("../../src/prisma");
 const seedUser_1 = require("../helpers/seedUser");
 const container_registration_1 = require("../helpers/container-registration");
+const scratch_database_1 = require("../helpers/scratch-database");
 /**
  * Uploaded apps follow the device team rule, run as real queries: the list
  * builds a Prisma filter (`OR: [{ teamId: null }, { teamId: { in } }]`, with an
  * empty `in` for a member in no team) that a stub would only echo back.
  *
- * Run on a migrated database:
- *   DATABASE_URL=file:/tmp/x.db npx prisma migrate deploy
- *   DATABASE_URL=file:/tmp/x.db npx mocha test/integration/team-visibility-apps.spec.ts
+ * On a scratch database of its own, so `npx mocha <file>` is enough.
  */
 describe('team visibility on uploaded apps (integration)', function () {
     this.timeout(60000);
+    (0, scratch_database_1.useScratchDatabase)({ wholeSuite: true });
     let sa;
     let alice;
     let loner;
@@ -87,17 +87,10 @@ describe('team visibility on uploaded apps (integration)', function () {
             });
         }
     }));
-    after(() => __awaiter(this, void 0, void 0, function* () {
-        yield prisma_1.prisma.app.deleteMany({ where: { id: { in: Object.values(A) } } });
-        yield prisma_1.prisma.teamMember.deleteMany({ where: { teamId: { in: [teamA.id, teamB.id] } } });
-        yield prisma_1.prisma.team.delete({ where: { id: teamA.id } }).catch(() => undefined);
-        yield prisma_1.prisma.team.delete({ where: { id: teamB.id } }).catch(() => undefined);
-        yield sa.cleanup();
-        yield alice.cleanup();
-        yield loner.cleanup();
+    after(() => {
         restore();
         fs_1.default.rmSync(dir, { recursive: true, force: true });
-    }));
+    });
     function app() {
         const a = (0, express_1.default)();
         a.use(express_1.default.json());
@@ -106,13 +99,13 @@ describe('team visibility on uploaded apps (integration)', function () {
         return a;
     }
     const ids = (cookie) => __awaiter(this, void 0, void 0, function* () {
-        return (yield (0, supertest_1.default)(app()).get('/apps').set('Cookie', cookie)).body
+        return (yield (0, loopbackRequest_1.default)(app()).get('/apps').set('Cookie', cookie)).body
             .map((r) => r.id)
             .filter((id) => Object.values(A).includes(id));
     });
     const UNKNOWN = { error: 'App not found' };
     it("lists a member's shared and own-team apps, with the team's name", () => __awaiter(this, void 0, void 0, function* () {
-        const res = yield (0, supertest_1.default)(app()).get('/apps').set('Cookie', alice.cookie);
+        const res = yield (0, loopbackRequest_1.default)(app()).get('/apps').set('Cookie', alice.cookie);
         (0, chai_1.expect)(res.status).to.equal(200);
         const mine = res.body.filter((r) => Object.values(A).includes(r.id));
         (0, chai_1.expect)(mine.map((r) => r.id)).to.have.members([A.shared, A.a]);
@@ -127,20 +120,20 @@ describe('team visibility on uploaded apps (integration)', function () {
         (0, chai_1.expect)(yield ids(sa.cookie)).to.have.members(Object.values(A));
     }));
     it("answers another team's app exactly as an unknown id", () => __awaiter(this, void 0, void 0, function* () {
-        const hidden = yield (0, supertest_1.default)(app()).get(`/apps/${A.b}/download`).set('Cookie', alice.cookie);
-        const unknown = yield (0, supertest_1.default)(app())
+        const hidden = yield (0, loopbackRequest_1.default)(app()).get(`/apps/${A.b}/download`).set('Cookie', alice.cookie);
+        const unknown = yield (0, loopbackRequest_1.default)(app())
             .get(`/apps/nope-${stamp}/download`)
             .set('Cookie', alice.cookie);
         (0, chai_1.expect)(hidden.status).to.equal(404);
         (0, chai_1.expect)(hidden.body).to.deep.equal(UNKNOWN);
         (0, chai_1.expect)(unknown.status).to.equal(404);
         (0, chai_1.expect)(unknown.body).to.deep.equal(UNKNOWN);
-        const own = yield (0, supertest_1.default)(app()).get(`/apps/${A.a}/download`).set('Cookie', alice.cookie);
+        const own = yield (0, loopbackRequest_1.default)(app()).get(`/apps/${A.a}/download`).set('Cookie', alice.cookie);
         (0, chai_1.expect)(own.status).to.equal(200);
     }));
     it('a download ticket serves its app once, with no login', () => __awaiter(this, void 0, void 0, function* () {
         const t = yield typedi_1.Container.get(AppDownloadTicketService_1.AppDownloadTicketService).mint(A.b);
-        const first = yield (0, supertest_1.default)(app())
+        const first = yield (0, loopbackRequest_1.default)(app())
             .get(`/apps/${A.b}/download`)
             .query({ ticket: t })
             .buffer(true)
@@ -151,16 +144,16 @@ describe('team visibility on uploaded apps (integration)', function () {
         });
         (0, chai_1.expect)(first.status).to.equal(200);
         (0, chai_1.expect)(Buffer.compare(first.body, bytesOf(A.b))).to.equal(0);
-        const again = yield (0, supertest_1.default)(app()).get(`/apps/${A.b}/download`).query({ ticket: t });
+        const again = yield (0, loopbackRequest_1.default)(app()).get(`/apps/${A.b}/download`).query({ ticket: t });
         (0, chai_1.expect)(again.status).to.equal(401);
     }));
     it('moving an app to a team changes who sees it', () => __awaiter(this, void 0, void 0, function* () {
-        const put = (teamId) => (0, supertest_1.default)(app()).put(`/apps/${A.b}/team`).set('Cookie', sa.cookie).send({ teamId });
+        const put = (teamId) => (0, loopbackRequest_1.default)(app()).put(`/apps/${A.b}/team`).set('Cookie', sa.cookie).send({ teamId });
         (0, chai_1.expect)((yield put(teamA.id)).body).to.deep.equal({ ok: true, updated: 1 });
         (0, chai_1.expect)(yield ids(alice.cookie)).to.include(A.b);
         (0, chai_1.expect)((yield put(teamB.id)).status).to.equal(200);
         (0, chai_1.expect)(yield ids(alice.cookie)).to.not.include(A.b);
-        const member = yield (0, supertest_1.default)(app())
+        const member = yield (0, loopbackRequest_1.default)(app())
             .put(`/apps/${A.b}/team`)
             .set('Cookie', alice.cookie)
             .send({ teamId: teamA.id });