@xenon-device-management/xenon 2.14.0 → 2.16.0

package/lib/src/app/openapi/platform.yaml

@@ -188,9 +188,11 @@ paths:
       summary: Read the lab's settings and AI provider
       description: |
         The lab-wide settings in effect (health checks, build cleanup and the AI self-healing
-        switch), merged with the AI settings currently in effect. Each setting is the value saved
-        in the dashboard, else the plugin option the server was started with, else the default,
-        which is also what the server runs with. `defaults` holds the defaults themselves, which
+        switch), merged with the AI settings in effect (provider, models and base URL). Each
+        setting is the value saved in the dashboard, else the plugin option or environment
+        variable the server was started with, else the default, which is also what the server
+        runs with. A model or base URL set nowhere is absent: the provider's own applies. A user
+        name, password or query value in the base URL is sent as `***`. `defaults` holds the defaults themselves, which
         is what "restore defaults" goes back to. Only `healthCheckSchedule` can be absent: no
         schedule is set. Through 2.13 `enableSelfHealing` was neither stored nor sent, so the
         Settings page always showed it on.
@@ -266,10 +268,18 @@ paths:
           switch was accepted and ignored. The value belongs to the server it is saved on:
           saving it on a hub changes the hub's own sessions, not those on a node's phones,
           which the node's own setting decides.
-        - AI fields (`aiProvider`, `aiModel`, `aiBaseUrl` and the per-provider models) change the
-          running server only. They are not stored, so a restart returns to the values the
-          server was started with. API keys can't be set here; they come from the server's
-          environment.
+        - AI fields (`aiProvider`, `aiModel`, `aiBaseUrl` and the per-provider models) are stored
+          too. A stored value replaces the plugin option or environment variable the server was
+          started with, and applies to the next AI call, with no restart. An empty value removes
+          the stored one, and the server's own applies again. They are checked first and refused
+          with `400`: `aiProvider` must be `gemini`, `openai`, `anthropic` or `ollama`; a model
+          name has no spaces and at most 200 characters; `aiBaseUrl` is an http or https address
+          with no user name, password or query. Through 2.14 they changed the running server
+          only, and a restart undid them. Like the self-healing switch, they belong to the server
+          they are saved on.
+        - API keys can't be set here, and are never stored: they come from the server's
+          environment. `aiTemperature`, `aiMaxTokens` and `aiTopP`, which the AI engine page sent
+          through 2.14, were never used by any AI call and are ignored like any unknown field.
 
         Needs the `SUPER_ADMIN` role and the `admin` scope; an `ADMIN` gets `403` with a message
         saying so (through 2.12 an `ADMIN` could). With the dashboard cookie the request must
@@ -299,7 +309,7 @@ paths:
               example:
                 success: true
         '400':
-          description: A build-cleanup field or the self-healing switch has a value that could not work. Nothing was saved.
+          description: A build-cleanup field, the self-healing switch or an AI field has a value that could not work. Nothing was saved.
           content:
             application/json:
               schema:
@@ -2387,6 +2397,7 @@ components:
               type: boolean
         aiProvider:
           type: string
+          description: The provider in effect, saved on the AI engine page, else the server's option or environment, else gemini.
           example: gemini
         aiModel:
           type: string
@@ -2438,30 +2449,37 @@ components:
           type: boolean
         aiProvider:
           type: string
-          description: Not stored; until the server restarts.
+          description: The provider every AI call uses. Stored; empty goes back to the server's own.
           enum:
             - gemini
             - openai
             - anthropic
             - ollama
+            - ''
         aiModel:
           type: string
-          description: Not stored; until the server restarts.
+          description: The model for a provider with no model of its own below. Stored; empty goes back to the server's own.
+          maxLength: 200
         aiBaseUrl:
           type: string
-          description: Not stored; until the server restarts.
+          description: Where OpenAI-compatible and Ollama calls go. An http or https address with no user name, password or query. Stored; empty goes back to the server's own.
+          example: http://gpu-box.lab:11434
         geminiModel:
           type: string
-          description: Not stored; until the server restarts.
+          description: Stored; empty goes back to the server's own.
+          maxLength: 200
         openaiModel:
           type: string
-          description: Not stored; until the server restarts.
+          description: Stored; empty goes back to the server's own.
+          maxLength: 200
         anthropicModel:
           type: string
-          description: Not stored; until the server restarts.
+          description: Stored; empty goes back to the server's own.
+          maxLength: 200
         ollamaModel:
           type: string
-          description: Not stored; until the server restarts.
+          description: Stored; empty goes back to the server's own.
+          maxLength: 200
     PlatformAiTestRequest:
       type: object
       description: Every field is optional and falls back to the server's current setting.

package/lib/src/app/openapi/sessions.yaml

@@ -108,13 +108,13 @@ paths:
                   name: Checkout with saved card
                   status: failed
                   node_id: 3c9a1f20-8d4e-4b7a-a1c2-5e6f7a8b9c0d
-                  has_live_video: true
+                  has_live_video: false
                   video_recording_enabled: true
                   video_recording: 6f1c2a8e-3b4d-4e5f-9a7b-1c2d3e4f5a6b.mp4
                   startTime: '2026-10-03T14:20:11.004Z'
                   endTime: '2026-10-03T14:22:05.120Z'
                   failure_reason: 'NoSuchElementError: An element could not be located'
-                  failure_category: element_not_found
+                  failure_category: ELEMENT_NOT_FOUND
                   device_udid: emulator-5554
                   device_platform: android
                   device_version: '14'
@@ -923,7 +923,7 @@ paths:
                 type: string
               example: |
                 id,build_id,status,failure_category,failure_reason,device_platform,device_version,device_name,node_id,startTime,endTime,name
-                6f1c2a8e-3b4d-4e5f-9a7b-1c2d3e4f5a6b,9d2f4c1e-7a3b-4e8f-b6c5-2d1e0f9a8b7c,failed,element_not_found,"NoSuchElementError: An element could not be located",android,14,Pixel 7,3c9a1f20-8d4e-4b7a-a1c2-5e6f7a8b9c0d,2026-10-03T14:20:11.004Z,2026-10-03T14:22:05.120Z,Checkout with saved card
+                6f1c2a8e-3b4d-4e5f-9a7b-1c2d3e4f5a6b,9d2f4c1e-7a3b-4e8f-b6c5-2d1e0f9a8b7c,failed,ELEMENT_NOT_FOUND,"NoSuchElementError: An element could not be located",android,14,Pixel 7,3c9a1f20-8d4e-4b7a-a1c2-5e6f7a8b9c0d,2026-10-03T14:20:11.004Z,2026-10-03T14:22:05.120Z,Checkout with saved card
         '400':
           description: '`format` is neither `json` nor `csv`.'
           content:
@@ -2688,6 +2688,15 @@ components:
             failure_category:
               type: string
               nullable: true
+              description: >-
+                What kind of failure it was, read from the failure reason and the last failed
+                commands' errors when the session fails: `SESSION_LOST`, `APP_CRASH`,
+                `SYSTEM_OVERLOAD`, `STALE_ELEMENT`, `TIMEOUT`, `ELEMENT_NOT_FOUND`,
+                `PERMISSION_BLOCKED` or `UNKNOWN`; or `HUB_RESTART` for a session the server's
+                restart or shutdown ended. Sessions filed through 2.15 may also hold `WDA_FAILURE` or
+                `XENON_COMMAND_FAILURE`, no longer written. Null for a session that hasn't failed,
+                and for a failure recorded without that analysis.
+              example: ELEMENT_NOT_FOUND
             is_profiling_available:
               type: boolean
             device_info:

package/lib/src/app/routers/apikeys.js

@@ -15,6 +15,8 @@ const typedi_1 = require("typedi");
 const ApiKeyService_1 = require("../../services/ApiKeyService");
 const scopeGuard_1 = require("../../middleware/scopeGuard");
 const roleGuard_1 = require("../../middleware/roleGuard");
+const mintedLifetime_1 = require("../../services/token/mintedLifetime");
+const KNOWN_SCOPES = ['read', 'sessions', 'devices', 'admin'];
 function apiKeysRouter() {
     const r = (0, express_1.Router)();
     r.use((0, roleGuard_1.roleGuard)('ADMIN'));
@@ -23,11 +25,16 @@ function apiKeysRouter() {
         res.json(yield svc.list());
     }));
     r.post('/', (0, scopeGuard_1.scopeGuard)(['admin']), (req, res) => __awaiter(this, void 0, void 0, function* () {
-        var _a;
+        var _a, _b;
         const { name, scopes, rateLimit, teamId, expiresAt } = req.body;
         if (!name || !Array.isArray(scopes) || scopes.length === 0) {
             return res.status(400).json({ error: 'name and scopes required' });
         }
+        // Only the scopes that exist. Any string was stored, so a typo made a key
+        // with none of the scopes its maker meant.
+        if (!scopes.every((s) => KNOWN_SCOPES.includes(s))) {
+            return res.status(400).json({ error: `scopes must be some of ${KNOWN_SCOPES.join(', ')}` });
+        }
         let expiresAtDate;
         if (expiresAt !== undefined && expiresAt !== null) {
             const d = new Date(expiresAt);
@@ -39,6 +46,11 @@ function apiKeysRouter() {
             }
             expiresAtDate = d;
         }
+        // Made with a credential that expires, a key ends no later than it.
+        const within = (0, mintedLifetime_1.keyExpiryWithin)(expiresAtDate, (_a = req.auth) === null || _a === void 0 ? void 0 : _a.credentialExpiresAt);
+        if ('error' in within)
+            return res.status(400).json({ error: within.error });
+        expiresAtDate = within.expiresAt;
         const { id, raw } = yield svc.create({
             name,
             scopes,
@@ -47,7 +59,7 @@ function apiKeysRouter() {
             userId: req.auth.userId,
             expiresAt: expiresAtDate,
         });
-        res.json({ id, key: raw, expiresAt: (_a = expiresAtDate === null || expiresAtDate === void 0 ? void 0 : expiresAtDate.toISOString()) !== null && _a !== void 0 ? _a : null });
+        res.json({ id, key: raw, expiresAt: (_b = expiresAtDate === null || expiresAtDate === void 0 ? void 0 : expiresAtDate.toISOString()) !== null && _b !== void 0 ? _b : null });
     }));
     r.delete('/:id', (0, scopeGuard_1.scopeGuard)(['admin']), (req, res) => __awaiter(this, void 0, void 0, function* () {
         yield svc.revoke(req.params.id);

package/lib/src/app/routers/auth.js

@@ -28,11 +28,16 @@ const JwtKeyService_1 = require("../../services/token/JwtKeyService");
 const mcpScopes_1 = require("../../services/token/mcpScopes");
 const passwordResetMode_1 = require("../../services/passwordResetMode");
 const passwordResetLink_1 = require("../../services/passwordResetLink");
+const mintedLifetime_1 = require("../../services/token/mintedLifetime");
+const mcpTokenTtl_1 = require("../../services/token/mcpTokenTtl");
 const SESSION_COOKIE = 'xenon_dashboard_session';
 const isSecureFromReq = (req) => req.secure || req.headers['x-forwarded-proto'] === 'https';
-const MCP_TTL_SEC = Number(process.env.XENON_MCP_TOKEN_TTL_SEC || 86400);
+const MCP_TTL_SEC = (0, mcpTokenTtl_1.mcpTokenTtlSec)();
 const REST_TTL_SEC = 3600;
 const MINTABLE_AUDIENCES = ['xenon-rest', 'xenon-mcp'];
+function grantsScope(scopesCsv, scope) {
+    return scopesCsv.split(',').some((s) => s.trim() === scope);
+}
 function issueToken(auth, body) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c, _d;
@@ -40,7 +45,7 @@ function issueToken(auth, body) {
         if (!MINTABLE_AUDIENCES.includes(audience)) {
             throw new Error(`unsupported audience: ${audience}`);
         }
-        const expiresIn = audience === 'xenon-mcp' ? MCP_TTL_SEC : REST_TTL_SEC;
+        const expiresIn = (0, mintedLifetime_1.mintedLifetimeSec)(audience === 'xenon-mcp' ? MCP_TTL_SEC : REST_TTL_SEC, auth.credentialExpiresAt);
         const svc = typedi_1.Container.get(JwtKeyService_1.JwtKeyService);
         if (audience === 'xenon-mcp') {
             // Validate the untrusted `scopes` body field before it reaches the mapper:
@@ -66,7 +71,23 @@ function issueToken(auth, body) {
             // Session-token capability (spec §3 item 6 / R9): a sibling credential the
             // client injects as `xe:options.sessionToken` so the Appium createSession
             // interceptor can refuse tokenless direct-connect sessions when the gate is on.
-            const sessionToken = yield svc.sign({ sub: auth.userId, teamId: (_c = auth.teamId) !== null && _c !== void 0 ? _c : null }, { audience: 'xenon-session', ttlSeconds: expiresIn });
+            //
+            // It creates Appium sessions, so it comes only with a grant that includes
+            // `appium:use`, which needs the `sessions` scope. Through 2.14 every
+            // credential got one, a read-only key included. It carries the scopes a
+            // session is judged by: `sessions`, and `admin` (a lease override) only
+            // when the minting credential has it and the grant isn't narrower than
+            // it: the default grant (no scopes asked for), or a full-admin one.
+            if (!grant.granular.includes('appium:use')) {
+                return { token, expiresIn, audience, scopes: grant.granular };
+            }
+            const askedForScopes = Array.isArray(body.scopes) && body.scopes.length > 0;
+            const sessionAdmin = grantsScope(auth.scopes, 'admin') && (!askedForScopes || grant.roles.includes('admin'));
+            const sessionToken = yield svc.sign({
+                sub: auth.userId,
+                teamId: (_c = auth.teamId) !== null && _c !== void 0 ? _c : null,
+                scopes: sessionAdmin ? 'admin,sessions' : 'sessions',
+            }, { audience: 'xenon-session', ttlSeconds: expiresIn });
             return { token, expiresIn, audience, scopes: grant.granular, sessionToken };
         }
         const token = yield svc.sign({ sub: auth.userId, role: auth.role, scopes: auth.scopes, teamId: (_d = auth.teamId) !== null && _d !== void 0 ? _d : null }, { audience, ttlSeconds: expiresIn });
@@ -139,11 +160,15 @@ function authPublicRouter() {
             const emailSvc = typedi_1.Container.get(EmailService_1.EmailService);
             // No SMTP and no opt-in log fallback: nothing can reach the user, so
             // don't mint a live credential. Admins issue links from the Users page.
-            if (user && user.status === 'ACTIVE' && emailSvc.canDeliver()) {
+            // No XENON_PUBLIC_URL: nothing says where the link may point. The
+            // request's Host is the asker's to choose, and the asker may not be
+            // the account's owner, so it is never used here.
+            const base = (0, passwordResetLink_1.resetLinkBase)();
+            if (user && user.status === 'ACTIVE' && emailSvc.canDeliver() && base) {
                 const resetSvc = typedi_1.Container.get(PasswordResetService_1.PasswordResetService);
                 const { raw } = yield resetSvc.createToken(user.id);
-                const link = (0, passwordResetLink_1.buildResetLink)(req, raw);
-                yield emailSvc.send((0, passwordResetLink_1.resetEmail)(user, link));
+                const link = (0, passwordResetLink_1.buildResetLink)(base, raw);
+                yield emailSvc.send((0, passwordResetLink_1.resetEmail)(user, link, resetSvc.ttlMs()));
             }
         }
         catch (e) {

package/lib/src/app/routers/control.js

@@ -724,12 +724,20 @@ router.post('/:udid/stream/start', (req, res) => __awaiter(void 0, void 0, void
             yield typedi_1.Container.get(AndroidH264StreamService_1.default).start(udid, { source: h264Cfg.source });
         }
         else {
-            // One capture pipeline per device: an H.264 capture still running for it
-            // (a tile's, or this page's own before its player failed) ends before the
-            // screencap loop starts.
+            // One capture pipeline per device where possible.
             const h264 = typedi_1.Container.get(AndroidH264StreamService_1.default);
-            if (h264.getMultiplexer(udid))
-                yield h264.stop(udid);
+            if (recording) {
+                // A recording reads the MJPEG capture, and H.264 never runs beside it.
+                if (h264.getMultiplexer(udid))
+                    yield h264.stop(udid);
+            }
+            else {
+                // This page shows MJPEG. An H.264 capture still running for the phone
+                // (this page's own before its player failed, or a tile's) ends before
+                // the screencap loop starts if nobody watches it, else when its last
+                // viewer leaves: another tile or tab may still be playing it.
+                yield h264.endWhenUnwatched(udid);
+            }
             mjpegPort = (yield typedi_1.Container.get(AndroidStreamService_1.default).startStream(udid)).mjpegPort;
         }
         // Lazy-load the screen size if missing: tiles need it to accept taps.

package/lib/src/app/routers/dashboard.js

@@ -59,6 +59,7 @@ const web_config_service_1 = require("../../data-service/web-config-service");
 const PluginContext_1 = require("../../PluginContext");
 const labSettings_1 = require("../../services/settings/labSettings");
 const SelfHealingSwitch_1 = require("../../services/settings/SelfHealingSwitch");
+const aiEngineSettings_1 = require("../../services/settings/aiEngineSettings");
 const typedi_1 = require("typedi");
 const scopeGuard_1 = require("../../middleware/scopeGuard");
 const roleGuard_1 = require("../../middleware/roleGuard");
@@ -1102,6 +1103,34 @@ function streamLiveSessionVideo(request, response) {
         }
     });
 }
+/**
+ * The base URL as the dashboard may see it: a user name, password or query
+ * value it carries is masked. Saving one is refused (aiEngineSettings.ts), but
+ * the server's environment can still hold one, and every admin can read this.
+ */
+function maskedBaseUrl(url) {
+    if (!url)
+        return url;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch (_a) {
+        return url;
+    }
+    // Shown as given unless something needs masking: toString() would add a '/'.
+    if (!parsed.username && !parsed.password && !parsed.search && !parsed.hash)
+        return url;
+    if (parsed.username || parsed.password) {
+        parsed.username = '***';
+        parsed.password = '';
+    }
+    for (const name of [...new Set(parsed.searchParams.keys())]) {
+        parsed.searchParams.set(name, '***');
+    }
+    parsed.hash = '';
+    return parsed.toString();
+}
 function getGlobalConfig(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         try {
@@ -1110,13 +1139,13 @@ function getGlobalConfig(request, response) {
             // the default. The pages show this (a saved value alone left them to guess
             // at what a setting never saved was), and `defaults` for "restore defaults".
             const effective = (0, labSettings_1.effectiveSettings)(typedi_1.Container.get(PluginContext_1.PluginContext).pluginArgs, dbConfig);
-            // Merge with Environment Config (AI Settings)
+            // The AI engine settings in effect (aiEngineSettings.ts keeps `config` at
+            // them). Never a key: only whether one is set.
             const { config } = yield Promise.resolve().then(() => __importStar(require('../../config')));
-            // Sanitize keys - return boolean existence only
             const aiConfig = {
                 aiProvider: config.aiProvider,
                 aiModel: config.aiModel,
-                aiBaseUrl: config.aiBaseUrl,
+                aiBaseUrl: maskedBaseUrl(config.aiBaseUrl),
                 geminiModel: config.geminiModel,
                 openaiModel: config.openaiModel,
                 anthropicModel: config.anthropicModel,
@@ -1136,39 +1165,25 @@ function getGlobalConfig(request, response) {
 }
 function updateGlobalConfig(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
+        var _a;
         try {
             const payload = request.body;
             // Before anything is saved: a value the cleanup job would act on, such as a
-            // retention window of 0, is refused rather than stored.
-            const problem = (0, labSettings_1.validateSettingsUpdate)(payload !== null && payload !== void 0 ? payload : {});
+            // retention window of 0, is refused rather than stored, and so is an AI
+            // provider or address that could not work, now that it outlives a restart.
+            const problem = (_a = (0, labSettings_1.validateSettingsUpdate)(payload !== null && payload !== void 0 ? payload : {})) !== null && _a !== void 0 ? _a : (0, aiEngineSettings_1.validateAiEngineUpdate)(payload !== null && payload !== void 0 ? payload : {});
             if (problem) {
                 return response
                     .status(400)
                     .json({ error: 'invalid_setting', field: problem.field, message: problem.message });
             }
-            // Handle Runtime AI Config Overrides (Memory only)
-            // Only pass defined values to avoid overwriting env vars (e.g. aiBaseUrl, ollamaModel) with undefined
-            const runtimeOverrides = {};
-            if (payload.aiProvider !== undefined)
-                runtimeOverrides.aiProvider = payload.aiProvider;
-            if (payload.aiModel !== undefined)
-                runtimeOverrides.aiModel = payload.aiModel;
-            if (payload.aiBaseUrl !== undefined)
-                runtimeOverrides.aiBaseUrl = payload.aiBaseUrl;
-            if (payload.geminiModel !== undefined)
-                runtimeOverrides.geminiModel = payload.geminiModel;
-            if (payload.openaiModel !== undefined)
-                runtimeOverrides.openaiModel = payload.openaiModel;
-            if (payload.anthropicModel !== undefined)
-                runtimeOverrides.anthropicModel = payload.anthropicModel;
-            if (payload.ollamaModel !== undefined)
-                runtimeOverrides.ollamaModel = payload.ollamaModel;
-            if (Object.keys(runtimeOverrides).length > 0) {
-                const { updateConfig } = yield Promise.resolve().then(() => __importStar(require('../../config')));
-                updateConfig(runtimeOverrides);
+            // Saved, then in force for the next AI call. Through 2.14 the AI fields
+            // changed the running server only, and a restart undid them.
+            const aiEngine = (0, aiEngineSettings_1.aiEngineUpdateOf)(payload !== null && payload !== void 0 ? payload : {});
+            yield typedi_1.Container.get(web_config_service_1.WebConfigService).setConfig(Object.assign(Object.assign({}, payload), aiEngine));
+            if (Object.keys(aiEngine).length > 0) {
+                typedi_1.Container.get(aiEngineSettings_1.AiEngineSettings).noteSaved(aiEngine);
             }
-            // Persist Web Configs to DB
-            yield typedi_1.Container.get(web_config_service_1.WebConfigService).setConfig(payload);
             // The command interceptor asks at every command and never reads the
             // database: hand it the saved value, in force from the next command.
             if (payload.enableSelfHealing !== undefined) {

package/lib/src/app/routers/grid.js

@@ -89,10 +89,12 @@ function getDevices(request, response) {
             const [enriched] = yield (0, device_service_1.enrichDevicesWithTeamNames)([match]);
             return response.json(enriched);
         }
-        /* dashboard-plugin-url is the base url for opening the appium-dashboard-plugin
-         * This value will be attached to all express request via middleware
+        /* dashboard-plugin-url is where this server reaches the appium-dashboard-plugin,
+         * and dashboard-plugin-link the base of the link people open; both from
+         * configuration, never from the request (app/dashboardPluginLink.ts).
          */
         const dashboardPluginUrl = request['dashboard-plugin-url'];
+        const dashboardPluginLink = request['dashboard-plugin-link'];
         if (dashboardPluginUrl) {
             const response = yield InternalHttpClient_1.InternalHttpClient.get(`${dashboardPluginUrl}/api/sessions?start_time=${SERVER_UP_TIME}`);
             const sessions = ((_a = response === null || response === void 0 ? void 0 : response.result) === null || _a === void 0 ? void 0 : _a.rows) || [];
@@ -105,7 +107,7 @@ function getDevices(request, response) {
             });
             devices = devices.map((d) => {
                 var _a;
-                d.dashboard_link = `${dashboardPluginUrl}?device_udid=${d.udid}&start_time=${SERVER_UP_TIME}`;
+                d.dashboard_link = `${dashboardPluginLink}?device_udid=${d.udid}&start_time=${SERVER_UP_TIME}`;
                 d.total_session_count = ((_a = deviceSessionMap[d.udid]) === null || _a === void 0 ? void 0 : _a.length) || 0;
                 return d;
             });

package/lib/src/app/routers/profile.js

@@ -17,6 +17,7 @@ const ApiKeyService_1 = require("../../services/ApiKeyService");
 const UserService_1 = require("../../services/UserService");
 const prisma_1 = require("../../prisma");
 const profileIdentity_1 = require("./profileIdentity");
+const mintedLifetime_1 = require("../../services/token/mintedLifetime");
 const ROLE_SCOPES = {
     SUPER_ADMIN: ['admin'],
     ADMIN: ['devices', 'sessions', 'read'],
@@ -79,10 +80,23 @@ function profileRouter() {
             return res.status(404).json({ error: 'user not found' });
         return res.json({ accessKey: user.accessKey });
     }));
+    // Rotating the access key ends every key pair its owner has, whatever their
+    // scopes, so it takes the person themselves (a dashboard sign-in) or a
+    // credential with the admin scope. Through 2.14 any credential could, a
+    // read-only token included, and cut off every one of its owner's clients.
     r.post('/access-key/rotate', (req, res) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
         const auth = requireAuth(req, res);
         if (!auth)
             return;
+        const credentialScopes = String((_a = auth.scopes) !== null && _a !== void 0 ? _a : '')
+            .split(',')
+            .map((s) => s.trim());
+        if (auth.kind !== 'user-session' && !credentialScopes.includes('admin')) {
+            return res.status(403).json({
+                error: 'rotating the access key needs a dashboard sign-in or a credential with the admin scope',
+            });
+        }
         const userId = yield effectiveUserId(auth.userId);
         if (!userId)
             return res.status(404).json({ error: 'user not found' });
@@ -132,6 +146,13 @@ function profileRouter() {
             }
             expiresAtDate = d;
         }
+        // A token made with a credential that expires (a Bearer token, an API key
+        // with an expiry) ends no later than it. Through 2.14 a 1-hour Bearer
+        // token could make itself a key that never expired.
+        const within = (0, mintedLifetime_1.keyExpiryWithin)(expiresAtDate, auth.credentialExpiresAt);
+        if ('error' in within)
+            return res.status(400).json({ error: within.error });
+        expiresAtDate = within.expiresAt;
         const allowed = (_a = ROLE_SCOPES[auth.role]) !== null && _a !== void 0 ? _a : ROLE_SCOPES.MEMBER;
         if (scopes !== undefined && (!Array.isArray(scopes) || !scopes.every(isScope))) {
             return res.status(400).json({ error: `scopes must be some of ${KNOWN_SCOPES.join(', ')}` });

package/lib/src/app/routers/users.js

@@ -18,6 +18,7 @@ const express_1 = require("express");
 const typedi_1 = require("typedi");
 const crypto_1 = __importDefault(require("crypto"));
 const UserService_1 = require("../../services/UserService");
+const UserSessionService_1 = require("../../services/UserSessionService");
 const roleGuard_1 = require("../../middleware/roleGuard");
 const scopeGuard_1 = require("../../middleware/scopeGuard");
 const userAuthorization_1 = require("../../services/identity/userAuthorization");
@@ -130,7 +131,7 @@ function usersRouter() {
         });
         if (status === 'INACTIVE') {
             // updateUser sets status; we additionally revoke sessions.
-            yield prisma_1.prisma.userSession.deleteMany({ where: { userId: targetId } });
+            yield typedi_1.Container.get(UserSessionService_1.UserSessionService).revokeAllForUser(targetId);
         }
         res.json({
             id: updated.id,
@@ -141,8 +142,11 @@ function usersRouter() {
         });
     }));
     // Admin-issued password reset. Replaces relaying a link out of the server
-    // log: with SMTP the link is emailed to the user as before; without it the
-    // link is returned once, to the admin who asked, and never logged.
+    // log: with SMTP and XENON_PUBLIC_URL the link is emailed to the user;
+    // otherwise it is returned once, to the admin who asked, and never logged.
+    // An emailed link points at XENON_PUBLIC_URL only, never the request's
+    // Host: the admin's request could name any host, and the user would get a
+    // genuine Xenon email sending their token there.
     r.post('/:id/reset-link', (req, res) => __awaiter(this, void 0, void 0, function* () {
         const auth = getAuth(req);
         const targetId = req.params.id;
@@ -168,10 +172,11 @@ function usersRouter() {
         const resetSvc = typedi_1.Container.get(PasswordResetService_1.PasswordResetService);
         const emailSvc = typedi_1.Container.get(EmailService_1.EmailService);
         const { raw } = yield resetSvc.createToken(target.id);
-        const link = (0, passwordResetLink_1.buildResetLink)(req, raw);
+        const publicBase = (0, passwordResetLink_1.resetLinkBase)();
         const expiresAt = new Date(Date.now() + resetSvc.ttlMs()).toISOString();
-        if (emailSvc.hasSmtp()) {
-            yield emailSvc.send((0, passwordResetLink_1.resetEmail)(target, link));
+        if (emailSvc.hasSmtp() && publicBase) {
+            const link = (0, passwordResetLink_1.buildResetLink)(publicBase, raw);
+            yield emailSvc.send((0, passwordResetLink_1.resetEmail)(target, link, resetSvc.ttlMs()));
             auditLog.info(`${auth.userId} emailed a password-reset link to user ${target.id}`);
             return res.json({ emailed: true, expiresAt });
         }
@@ -179,6 +184,7 @@ function usersRouter() {
         auditLog.warn(`${auth.userId} issued a password-reset link for user ${target.id} (returned to the admin)`);
         // The body is a credential: keep it out of browser and proxy caches.
         res.set('Cache-Control', 'no-store');
+        const link = (0, passwordResetLink_1.buildResetLink)(publicBase !== null && publicBase !== void 0 ? publicBase : (0, passwordResetLink_1.requestBase)(req), raw);
         return res.json({ emailed: false, link, expiresAt });
     }));
     r.delete('/:id', (req, res) => __awaiter(this, void 0, void 0, function* () {

package/lib/src/app/swagger.js

@@ -75,6 +75,8 @@ Appium's WebDriver API (\`POST /session\` and the session's commands, under Appi
 - \`accessKey\` and \`token\`;
 - \`sessionToken\`, minted by \`POST /api/auth/token\`.
 
+Either names the session's owner only while that user exists and is active, and a session token needs the \`sessions\` scope, as a key does. A key or token that doesn't check out counts as none: with \`XENON_REQUIRE_SESSION_TOKEN\` the session is refused, without it the session runs with no owner.
+
 A leased device also takes \`leaseId\` and \`leaseToken\`, which the lease's \`appiumCapabilities\` already carry. Xenon removes these credentials before the driver or any stored record sees them.
 
 ## Live streams

package/lib/src/app/ws/h264StreamWs.js

@@ -12,6 +12,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.STREAM_ENDED = void 0;
 exports.encodeWsFrame = encodeWsFrame;
 exports.parseH264WsPath = parseH264WsPath;
 exports.attachH264Ws = attachH264Ws;
@@ -29,6 +30,12 @@ const nodeSocketRelay_1 = require("./nodeSocketRelay");
  * so it is not put on the wire).
  */
 const TYPE_CODE = { config: 0, key: 1, delta: 2 };
+/**
+ * The close code for a stream whose capture stopped under its viewer, as the
+ * logcat socket uses it for an upstream that died. The player then shows MJPEG
+ * without asking stream/start: there is no H.264 capture left to end.
+ */
+exports.STREAM_ENDED = 1012;
 function encodeWsFrame(p) {
     return Buffer.concat([Buffer.from([TYPE_CODE[p.type]]), p.data]);
 }
@@ -139,7 +146,9 @@ function attachH264Ws(server, deps) {
                 if (p.type === 'delta' && ws.bufferedAmount > maxBuffered)
                     return;
                 ws.send(encodeWsFrame(p));
-            });
+            }, 
+            // The capture stopped under this viewer (a recording, a stream/stop).
+            () => ws.close(exports.STREAM_ENDED, 'stream ended'));
             logger_1.default.info(`[${parsed.udid}] H.264 WS client connected`);
         }));
     }