@xenon-device-management/xenon 2.14.0 → 2.15.0

package/lib/test/unit/self-healing-boot.spec.js

@@ -20,14 +20,17 @@ const plugin_1 = require("../../src/plugin");
 const ServerManager_1 = require("../../src/services/ServerManager");
 const PluginContext_1 = require("../../src/PluginContext");
 const SelfHealingSwitch_1 = require("../../src/services/settings/SelfHealingSwitch");
+const aiEngineSettings_1 = require("../../src/services/settings/aiEngineSettings");
 const logger_1 = __importDefault(require("../../src/logger"));
 /**
- * The self-healing value saved on the Settings page is read once at boot, so a
- * restart doesn't put the server back on the option it was started with. It
- * has to be loaded once the database is ready (migrations ran) and before the
- * first route can answer or the first command arrive.
+ * The self-healing value saved on the Settings page, and the AI engine page's
+ * provider, model and base URL, are read once at boot, so a restart doesn't put
+ * the server back on the options it was started with. They have to be loaded
+ * once the database is ready (migrations ran), after the startup options were
+ * applied (the AI engine's are what a cleared value goes back to), and before
+ * the first route can answer or the first command arrive.
  */
-describe('loading the saved self-healing setting, at boot', () => {
+describe('loading the saved self-healing and AI engine settings, at boot', () => {
     let statics;
     beforeEach(() => {
         statics = {
@@ -57,6 +60,7 @@ describe('loading the saved self-healing setting, at boot', () => {
         // The real one kills every go-ios process on the machine.
         sinon_1.default.stub(boot, 'reapLeftoverGoIos').callsFake(step('reap'));
         sinon_1.default.stub(SelfHealingSwitch_1.SelfHealingSwitch.prototype, 'load').callsFake(step('self-healing setting'));
+        sinon_1.default.stub(aiEngineSettings_1.AiEngineSettings.prototype, 'load').callsFake(step('AI engine settings'));
         sinon_1.default.stub(boot, 'registerRoutes').callsFake(() => {
             steps.push('routes');
             throw new Error('boot stopped by the test');
@@ -69,6 +73,7 @@ describe('loading the saved self-healing setting, at boot', () => {
             'database and migrations',
             'reap',
             'self-healing setting',
+            'AI engine settings',
             'routes',
         ]);
     }));

package/lib/test/unit/self-healing-setting.spec.js

@@ -203,10 +203,10 @@ describe('the AI self-healing switch', () => {
             (0, chai_1.expect)(attemptHealing.calledOnce).to.equal(true);
         }));
         it("still hands a session's own healing tiers to the healing it runs", () => __awaiter(void 0, void 0, void 0, function* () {
-            sinon_1.default.stub(SessionManager_1.SESSION_MANAGER, 'getSession').returns({
-                getCapabilities: () => ({ 'xe:options': { healingTiers: [1, 2] } }),
-            });
-            const driver = { sessionId: 'sess-6' };
+            // Read from the session's driver, which every session has: SESSION_MANAGER
+            // holds a local one only with the dashboard on, and holds none here.
+            const driver = { sessionId: 'sess-6', caps: { 'xe:options': { healingTiers: [1, 2] } } };
+            (0, chai_1.expect)(SessionManager_1.SESSION_MANAGER.getSession('sess-6')).to.equal(undefined);
             yield typedi_1.Container.get(CommandInterceptor_1.CommandInterceptor)
                 .handle(() => __awaiter(void 0, void 0, void 0, function* () {
                 throw noSuchElement();
@@ -219,9 +219,10 @@ describe('the AI self-healing switch', () => {
             let learn;
             beforeEach(() => {
                 sinon_1.default.stub(event_manager_1.DASHBORD_EVENT_MANAGER, 'afterSessionCommand').resolves();
-                learn = sinon_1.default.stub(CommandInterceptor_1.CommandInterceptor.prototype, 'triggerLearning');
+                learn = sinon_1.default.stub(CommandInterceptor_1.CommandInterceptor.prototype, 'triggerLearning').resolves();
             });
-            const afterFind = () => typedi_1.Container.get(CommandInterceptor_1.CommandInterceptor).runPostCommandHooks('sess-7', 'findElement', {}, ['id', 'there'], { ELEMENT: 'el-1' }, pluginArgs);
+            /** A findElement the driver answers with its element. */
+            const afterFind = () => typedi_1.Container.get(CommandInterceptor_1.CommandInterceptor).handle(() => __awaiter(void 0, void 0, void 0, function* () { return ({ ELEMENT: 'el-1' }); }), { sessionId: 'sess-7' }, 'findElement', ['id', 'there', 'sess-7'], pluginArgs, false);
             it('learns the selector while the switch is on', () => __awaiter(void 0, void 0, void 0, function* () {
                 yield afterFind();
                 (0, chai_1.expect)(learn.calledOnce).to.equal(true);

package/lib/test/unit/session-app-resolution.spec.js

@@ -145,7 +145,11 @@ describe('createSession — an app named by id follows the team rule', () => {
                 return owned.includes('admin') || req.some((s) => owned.includes(s));
             },
         });
-        typedi_1.Container.set(UserService_1.UserService, { findById: () => __awaiter(void 0, void 0, void 0, function* () { return null; }) });
+        // Every key's owner is an ACTIVE member: a key names its owner only while
+        // they are. The admin key is unscoped by its admin scope.
+        typedi_1.Container.set(UserService_1.UserService, {
+            findById: (id) => __awaiter(void 0, void 0, void 0, function* () { return ({ id, role: 'MEMBER', status: 'ACTIVE' }); }),
+        });
         sinon_1.default.stub(app_service_1.APP_SERVICE, 'getAppById').callsFake((id) => __awaiter(void 0, void 0, void 0, function* () { var _a; return (_a = APPS[id]) !== null && _a !== void 0 ? _a : null; }));
         const device = { udid: 'u1', host: 'h1', platform: 'android', nodeId: 'node-hub' };
         allocate = sinon_1.default.stub(deviceUtils, 'allocateDeviceForSession').resolves(device);

package/lib/test/unit/session-attribution-wiring.spec.js

@@ -41,10 +41,12 @@ describe('authorizeSessionRequest — identity', () => {
         authDisabledBefore = config_1.config.authDisabled;
         config_1.config.authDisabled = false;
         restore = (0, container_registration_1.saveRegistrations)(ApiKeyService_1.ApiKeyService, JwtKeyService_1.JwtKeyService, UserService_1.UserService);
-        // No such user and no teams, as the developer's database answered for
-        // these ids: the real lookups read that database. Nothing here is about
-        // the owner's teams.
-        typedi_1.Container.set(UserService_1.UserService, { findById: () => __awaiter(void 0, void 0, void 0, function* () { return null; }) });
+        // Every id is an ACTIVE member in no team: a credential names its owner
+        // only while they are (session-create-credential-owner.spec.ts covers
+        // the other cases). The real lookups would read the developer's database.
+        typedi_1.Container.set(UserService_1.UserService, {
+            findById: (id) => __awaiter(void 0, void 0, void 0, function* () { return ({ id, role: 'MEMBER', status: 'ACTIVE' }); }),
+        });
         sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([]);
         svc = new SessionLifecycleService_1.SessionLifecycleService();
     });
@@ -105,7 +107,7 @@ describe('authorizeSessionRequest — identity', () => {
             hasScope: () => false,
         });
         typedi_1.Container.set(JwtKeyService_1.JwtKeyService, {
-            verify: sinon_1.default.stub().resolves({ sub: 'usr_carol' }),
+            verify: sinon_1.default.stub().resolves({ sub: 'usr_carol', scopes: 'sessions' }),
         });
         const res = yield invoke(svc, capsWith({ 'xe:options': { sessionToken: 'tok' } }));
         (0, chai_1.expect)(res.apiKeyId).to.equal(null);
@@ -156,13 +158,14 @@ describe('authorizeSessionRequest — leaseAccess', () => {
         findUser = sinon_1.default.stub().resolves(owner);
         typedi_1.Container.set(UserService_1.UserService, { findById: findUser });
     };
-    const withSessionToken = (owner, teamId = null) => {
+    // A session token carries the scopes of the credential that minted it.
+    const withSessionToken = (owner, teamId = null, scopes = 'sessions') => {
         typedi_1.Container.set(ApiKeyService_1.ApiKeyService, {
             verifyPair: sinon_1.default.stub().resolves(null),
             hasScope: () => false,
         });
         typedi_1.Container.set(JwtKeyService_1.JwtKeyService, {
-            verify: sinon_1.default.stub().resolves({ sub: 'usr_alice', teamId }),
+            verify: sinon_1.default.stub().resolves({ sub: 'usr_alice', teamId, scopes }),
         });
         findUser = sinon_1.default.stub().resolves(owner);
         typedi_1.Container.set(UserService_1.UserService, { findById: findUser });
@@ -208,9 +211,19 @@ describe('authorizeSessionRequest — leaseAccess', () => {
             withKey(keyRow('admin'), user('SUPER_ADMIN', 'INACTIVE'));
             (0, chai_1.expect)((yield access(pairCaps())).canOverride).to.equal(false);
         }));
-        it('follows the role of a session-token caller, ADMIN included', () => __awaiter(void 0, void 0, void 0, function* () {
-            withSessionToken(user('ADMIN'));
+        // By the scopes it was minted with, as a key is judged. By its user's role
+        // alone, an ADMIN's key without the admin scope minted itself an override.
+        it("follows resolveActor's rule on a session token's user's role now", () => __awaiter(void 0, void 0, void 0, function* () {
+            withSessionToken(user('ADMIN'), null, 'admin,sessions');
+            (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(true);
+            withSessionToken(user('ADMIN'), null, 'sessions');
+            (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(false);
+            withSessionToken(user('SUPER_ADMIN'), null, 'admin,sessions');
+            (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(true);
+            withSessionToken(user('SUPER_ADMIN'), null, 'sessions');
             (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(true);
+            withSessionToken(user('MEMBER'), null, 'admin,sessions');
+            (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(false);
             withSessionToken(user('MEMBER'));
             (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(false);
         }));
@@ -223,9 +236,24 @@ describe('authorizeSessionRequest — leaseAccess', () => {
             (0, chai_1.expect)(res.scoped).to.equal(false);
             (0, chai_1.expect)((yield res.leaseAccess()).canOverride).to.equal(false);
         }));
-        it('is false when the lookup fails, and the teams fall back to the shared pool', () => __awaiter(void 0, void 0, void 0, function* () {
+        // The owner is looked up when the credential is checked: a key names them
+        // only while they are ACTIVE, so a lookup that fails refuses the session
+        // rather than run it as someone who may have been switched off.
+        it('refuses the session when the owner lookup fails', () => __awaiter(void 0, void 0, void 0, function* () {
             withKey(keyRow('admin'), null);
             typedi_1.Container.set(UserService_1.UserService, { findById: sinon_1.default.stub().rejects(new Error('db down')) });
+            let error;
+            try {
+                yield invoke(svc, pairCaps());
+            }
+            catch (e) {
+                error = e;
+            }
+            (0, chai_1.expect)(error === null || error === void 0 ? void 0 : error.message).to.equal('db down');
+        }));
+        it('is false, and the teams fall back to the shared pool, when the team lookup fails', () => __awaiter(void 0, void 0, void 0, function* () {
+            withKey(keyRow('sessions'), user('MEMBER'));
+            teamRows.rejects(new Error('db down'));
             (0, chai_1.expect)(yield access(pairCaps())).to.deep.equal({ canOverride: false, teamIds: [] });
         }));
         it('is true when auth is disabled, where every caller is an admin', () => __awaiter(void 0, void 0, void 0, function* () {
@@ -331,9 +359,9 @@ describe('authorizeSessionRequest — leaseAccess', () => {
             }
             (0, chai_1.expect)(error === null || error === void 0 ? void 0 : error.message).to.equal("xe:options.team 'team_c' is not allowed for this API key");
         }));
-        it('falls back to the shared pool when the lookup fails', () => __awaiter(void 0, void 0, void 0, function* () {
-            withKey(keyRow('sessions'), null);
-            typedi_1.Container.set(UserService_1.UserService, { findById: sinon_1.default.stub().rejects(new Error('db down')) });
+        it('falls back to the shared pool when the team lookup fails', () => __awaiter(void 0, void 0, void 0, function* () {
+            withKey(keyRow('sessions'), user('MEMBER'));
+            teamRows.rejects(new Error('db down'));
             (0, chai_1.expect)(yield scope(pairCaps())).to.deep.equal({ callerTeamIds: [], scoped: true });
         }));
         it('stays unscoped, with no lookup, for a session with no credentials', () => __awaiter(void 0, void 0, void 0, function* () {

package/lib/test/unit/session-create-credential-owner.spec.js

@@ -0,0 +1,242 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const typedi_1 = require("typedi");
+const SessionLifecycleService_1 = require("../../src/services/SessionLifecycleService");
+const ApiKeyService_1 = require("../../src/services/ApiKeyService");
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const UserService_1 = require("../../src/services/UserService");
+const config_1 = require("../../src/config");
+const prisma_1 = require("../../src/prisma");
+const container_registration_1 = require("../helpers/container-registration");
+const sessionCredentials_1 = require("../../src/services/session/sessionCredentials");
+/**
+ * Session create judges the credentials it is given by REST's rule: a key
+ * pair or session token says who the caller is only while that user exists
+ * and is ACTIVE. Through 2.14 the pair was checked against the key alone
+ * (ApiKeyService.verifyPair) and the session token against its signature
+ * alone, so a user set to Inactive, or deleted, kept creating sessions as
+ * themselves, past XENON_REQUIRE_SESSION_TOKEN too.
+ *
+ * Such credentials now count as wrong ones: with the gate on the session is
+ * refused, with it off it runs with no owner, like any session presenting
+ * credentials that don't check out.
+ *
+ * A session token also has to carry the `sessions` scope, as a key pair
+ * must: POST /auth/token gave one to any credential, a read-only one
+ * included.
+ */
+// authorizeSessionRequest is private: the single place a create's identity is
+// decided. It is handed the credentials createSession took out of the caps.
+const invoke = (svc, caps) => svc.authorizeSessionRequest(caps, (0, sessionCredentials_1.takeSessionCredentials)(caps));
+const capsWith = (options) => ({
+    alwaysMatch: { 'xe:options': options },
+    firstMatch: [{}],
+});
+function refusalOf(promise) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        try {
+            yield promise;
+            return null;
+        }
+        catch (err) {
+            return String((_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err);
+        }
+    });
+}
+describe('session create: the credentials of an inactive or deleted user', () => {
+    let svc;
+    let dir;
+    let keys;
+    let restore;
+    let authDisabledBefore;
+    let gateBefore;
+    let users;
+    let findById;
+    const keyRow = { id: 'key_alice', userId: 'usr_alice', scopes: 'sessions', teamId: null };
+    const alice = () => users.usr_alice;
+    const pair = () => capsWith({ accessKey: 'xen_alice', token: 'tk' });
+    const token = (claims = { sub: 'usr_alice', scopes: 'sessions' }) => keys.sign(claims, { audience: 'xenon-session', ttlSeconds: 600 });
+    const gate = (on) => {
+        if (on)
+            process.env.XENON_REQUIRE_SESSION_TOKEN = 'true';
+        else
+            delete process.env.XENON_REQUIRE_SESSION_TOKEN;
+    };
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        authDisabledBefore = config_1.config.authDisabled;
+        config_1.config.authDisabled = false;
+        gateBefore = process.env.XENON_REQUIRE_SESSION_TOKEN;
+        restore = (0, container_registration_1.saveRegistrations)(ApiKeyService_1.ApiKeyService, JwtKeyService_1.JwtKeyService, UserService_1.UserService);
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-create-owner-'));
+        keys = new JwtKeyService_1.JwtKeyService();
+        yield keys.init(dir);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, keys);
+        typedi_1.Container.set(ApiKeyService_1.ApiKeyService, {
+            verifyPair: sinon_1.default.stub().resolves(keyRow),
+            hasScope: (row, req) => {
+                const owned = row.scopes.split(',');
+                return owned.includes('admin') || req.some((s) => owned.includes(s));
+            },
+        });
+        users = { usr_alice: { id: 'usr_alice', role: 'MEMBER', status: 'ACTIVE' } };
+        findById = sinon_1.default.stub().callsFake((id) => __awaiter(void 0, void 0, void 0, function* () { var _a; return (_a = users[id]) !== null && _a !== void 0 ? _a : null; }));
+        typedi_1.Container.set(UserService_1.UserService, { findById });
+        sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([]);
+        svc = new SessionLifecycleService_1.SessionLifecycleService();
+    }));
+    afterEach(() => {
+        config_1.config.authDisabled = authDisabledBefore;
+        if (gateBefore === undefined)
+            delete process.env.XENON_REQUIRE_SESSION_TOKEN;
+        else
+            process.env.XENON_REQUIRE_SESSION_TOKEN = gateBefore;
+        sinon_1.default.restore();
+        restore();
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    describe('with XENON_REQUIRE_SESSION_TOKEN on', () => {
+        beforeEach(() => gate(true));
+        it("refuses an Inactive user's access key and token", () => __awaiter(void 0, void 0, void 0, function* () {
+            alice().status = 'INACTIVE';
+            (0, chai_1.expect)(yield refusalOf(invoke(svc, pair()))).to.match(/session rejected/);
+        }));
+        it("refuses a deleted user's key, whose row outlived them", () => __awaiter(void 0, void 0, void 0, function* () {
+            users.usr_alice = undefined;
+            (0, chai_1.expect)(yield refusalOf(invoke(svc, pair()))).to.match(/session rejected/);
+        }));
+        it("refuses an Inactive user's session token", () => __awaiter(void 0, void 0, void 0, function* () {
+            alice().status = 'INACTIVE';
+            const caps = capsWith({ sessionToken: yield token() });
+            (0, chai_1.expect)(yield refusalOf(invoke(svc, caps))).to.match(/session rejected/);
+        }));
+        it("refuses a deleted user's session token, which is still within its lifetime", () => __awaiter(void 0, void 0, void 0, function* () {
+            users.usr_alice = undefined;
+            const caps = capsWith({ sessionToken: yield token() });
+            (0, chai_1.expect)(yield refusalOf(invoke(svc, caps))).to.match(/session rejected/);
+        }));
+        it("still admits an Active user's key and token, and their session token", () => __awaiter(void 0, void 0, void 0, function* () {
+            const byPair = yield invoke(svc, pair());
+            (0, chai_1.expect)(byPair).to.include({ apiKeyId: 'key_alice', userId: 'usr_alice' });
+            const byToken = yield invoke(svc, capsWith({ sessionToken: yield token() }));
+            (0, chai_1.expect)(byToken).to.include({ apiKeyId: null, userId: 'usr_alice' });
+        }));
+        it('looks the owner up once, though the gate and attribution both verify the token', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield invoke(svc, capsWith({ sessionToken: yield token() }));
+            (0, chai_1.expect)(findById.callCount).to.equal(1);
+        }));
+    });
+    describe('with XENON_REQUIRE_SESSION_TOKEN off', () => {
+        beforeEach(() => gate(false));
+        it("gives no owner to a session made with an Inactive user's key", () => __awaiter(void 0, void 0, void 0, function* () {
+            alice().status = 'INACTIVE';
+            const res = yield invoke(svc, pair());
+            (0, chai_1.expect)(res).to.include({ apiKeyId: null, userId: null });
+        }));
+        it("gives no owner to a session made with a deleted user's session token", () => __awaiter(void 0, void 0, void 0, function* () {
+            users.usr_alice = undefined;
+            const res = yield invoke(svc, capsWith({ sessionToken: yield token() }));
+            (0, chai_1.expect)(res).to.include({ apiKeyId: null, userId: null });
+        }));
+        it('looks an Active owner up once for a key and token', () => __awaiter(void 0, void 0, void 0, function* () {
+            const res = yield invoke(svc, pair());
+            yield res.leaseAccess();
+            (0, chai_1.expect)(res.userId).to.equal('usr_alice');
+            (0, chai_1.expect)(findById.callCount).to.equal(1);
+        }));
+    });
+    describe('a session token needs the `sessions` scope', () => {
+        for (const on of [false, true]) {
+            describe(`(gate ${on ? 'on' : 'off'})`, () => {
+                beforeEach(() => gate(on));
+                it('refuses one minted for a read-only credential', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const caps = capsWith({
+                        sessionToken: yield token({ sub: 'usr_alice', scopes: 'devices' }),
+                    });
+                    (0, chai_1.expect)(yield refusalOf(invoke(svc, caps))).to.match(/sessions` scope/);
+                }));
+                it('refuses one minted before session tokens carried their scopes, saying so', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const caps = capsWith({ sessionToken: yield token({ sub: 'usr_alice' }) });
+                    const refusal = yield refusalOf(invoke(svc, caps));
+                    (0, chai_1.expect)(refusal).to.match(/carries no `sessions` scope/);
+                    (0, chai_1.expect)(refusal).to.match(/minted by Xenon 2\.14 or earlier carry none/);
+                    (0, chai_1.expect)(refusal).to.match(/mint a new one/);
+                }));
+                it('admits one with `sessions` or `admin`', () => __awaiter(void 0, void 0, void 0, function* () {
+                    for (const scopes of ['sessions', 'admin', 'devices,sessions']) {
+                        const caps = capsWith({ sessionToken: yield token({ sub: 'usr_alice', scopes }) });
+                        (0, chai_1.expect)((yield invoke(svc, caps)).userId).to.equal('usr_alice');
+                    }
+                }));
+            });
+        }
+    });
+    // Taking over a lease someone else created is an ownership override: a
+    // SUPER_ADMIN, or a credential with the `admin` scope. A session token was
+    // judged by its user's role alone, so an ADMIN's key without the admin
+    // scope, which may not override, minted a session token that could.
+    describe('a session token overrides a lease only as the credential that minted it could', () => {
+        beforeEach(() => gate(false));
+        const overrideWith = (role, scopes) => __awaiter(void 0, void 0, void 0, function* () {
+            alice().role = role;
+            const caps = capsWith({ sessionToken: yield token({ sub: 'usr_alice', scopes }) });
+            return (yield (yield invoke(svc, caps)).leaseAccess()).canOverride;
+        });
+        it("is refused for an ADMIN's token minted without the admin scope", () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)(yield overrideWith('ADMIN', 'sessions')).to.equal(false);
+        }));
+        it("is allowed for an ADMIN's or SUPER_ADMIN's token minted with the admin scope", () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)(yield overrideWith('ADMIN', 'admin,sessions')).to.equal(true);
+            (0, chai_1.expect)(yield overrideWith('SUPER_ADMIN', 'admin,sessions')).to.equal(true);
+        }));
+        // As the SUPER_ADMIN's key pair and Bearer token override.
+        it("is allowed for a SUPER_ADMIN's token minted without it", () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)(yield overrideWith('SUPER_ADMIN', 'sessions')).to.equal(true);
+        }));
+        // The scope is fixed when the token is minted; the role is read now. An
+        // admin demoted after minting overrides no more.
+        it('is refused once the admin who minted it is a member', () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)(yield overrideWith('MEMBER', 'admin,sessions')).to.equal(false);
+        }));
+        it("is refused for a member's token", () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)(yield overrideWith('MEMBER', 'sessions')).to.equal(false);
+        }));
+    });
+    // The owner lookup that fails is not a token that doesn't check out: the
+    // create is refused, as for a key whose owner can't be looked up. It ran
+    // with no owner (gate off) or was refused as "invalid or expired" (gate on).
+    describe('a session token whose owner cannot be looked up', () => {
+        for (const on of [false, true]) {
+            it(`refuses the create (gate ${on ? 'on' : 'off'})`, () => __awaiter(void 0, void 0, void 0, function* () {
+                gate(on);
+                findById.rejects(new Error('db down'));
+                const caps = capsWith({ sessionToken: yield token() });
+                (0, chai_1.expect)(yield refusalOf(invoke(svc, caps))).to.equal('db down');
+            }));
+        }
+        it('still counts a token that does not check out as none (gate off)', () => __awaiter(void 0, void 0, void 0, function* () {
+            gate(false);
+            const res = yield invoke(svc, capsWith({ sessionToken: 'not-a-jwt' }));
+            (0, chai_1.expect)(res).to.include({ apiKeyId: null, userId: null });
+            (0, chai_1.expect)(findById.called).to.equal(false);
+        }));
+    });
+});

package/lib/test/unit/session-credential-strip.spec.js

@@ -146,7 +146,7 @@ describe('createSession — credentials never reach the driver or storage', () =
             verify: (t) => __awaiter(void 0, void 0, void 0, function* () {
                 if (!t.startsWith('jwt:'))
                     throw new Error('bad token');
-                return { sub: t.slice('jwt:'.length), teamId: null };
+                return { sub: t.slice('jwt:'.length), teamId: null, scopes: 'sessions' };
             }),
         });
         // The owner's teams: none, and not read from the developer's database.