@xenon-device-management/xenon 2.14.0 → 2.16.0

package/lib/src/interceptors/xenonScripts.js

@@ -14,9 +14,26 @@
  * - A name Xenon doesn't have fails with `unknown command`.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.XENON_SCRIPT_NAMES = void 0;
+exports.XENON_SCRIPT_NAMES = exports.NETWORK_CAPTURE_SCRIPTS = void 0;
+exports.interceptorScriptName = interceptorScriptName;
+exports.isNetworkCaptureScript = isNetworkCaptureScript;
 exports.xenonScriptName = xenonScriptName;
 exports.unknownXenonScriptMessage = unknownXenonScriptMessage;
+/**
+ * The scripts CommandInterceptor answers from the session's network capture.
+ * Their arguments and answers are the capture (requests, HAR, mocks), which
+ * REST shows to admins only, so the command log keeps neither (commandLogFields).
+ * A new script that answers from the capture goes in this list. A hub hides
+ * by its own copy, so it needs the release that adds the script.
+ */
+exports.NETWORK_CAPTURE_SCRIPTS = [
+    'addMock',
+    'removeMock',
+    'clearMocks',
+    'getMocks',
+    'getRequests',
+    'exportHar',
+];
 /** The names CommandInterceptor and the session-details commands answer. Keep in step with both. */
 exports.XENON_SCRIPT_NAMES = [
     'setAutowaitProperties',
@@ -29,18 +46,22 @@ exports.XENON_SCRIPT_NAMES = [
     'analyzeScreen',
     'omniScan',
     'assertVisualState',
-    'addMock',
-    'removeMock',
-    'clearMocks',
-    'getMocks',
-    'getRequests',
-    'exportHar',
+    ...exports.NETWORK_CAPTURE_SCRIPTS,
     'setSessionName',
     'setSessionStatus',
     'debug',
     'addTag',
     'captureEvidence',
 ];
+/** The name CommandInterceptor routes a script by: its `xe:` / `xenon:` prefix, if any, taken off. */
+function interceptorScriptName(script) {
+    return script.replace(/^(xe|xenon)\s*:\s*/, '').trim();
+}
+/** Whether CommandInterceptor answers `script` from the session's network capture. */
+function isNetworkCaptureScript(script) {
+    return (typeof script === 'string' &&
+        exports.NETWORK_CAPTURE_SCRIPTS.includes(interceptorScriptName(script)));
+}
 /** The name in a `xenon: <name>` or `xe: <name>` script, or null for any other script. */
 function xenonScriptName(script) {
     if (typeof script !== 'string')

package/lib/src/logger.js

@@ -185,7 +185,9 @@ class XenonLogger {
             }
             if (redactedArgs.length)
                 logEntry.args = redactedArgs;
-            this.baseLogger.info(JSON.stringify(logEntry));
+            // At its own level, so --log-level filters it and an error reaches
+            // stderr, as in text mode.
+            this.baseLogger[level](JSON.stringify(logEntry));
         }
         else {
             const ctxPrefix = this.buildTextPrefix(ctx);

package/lib/src/middleware/authMiddleware.js

@@ -24,7 +24,13 @@ const PluginContext_1 = require("../PluginContext");
 const hubSessionToken_1 = require("../gateway/hubSessionToken");
 const localDeviceHosts_1 = require("../device-managers/localDeviceHosts");
 const SESSION_COOKIE = 'xenon_dashboard_session';
-const SESSION_TTL_MS = 24 * 60 * 60 * 1000;
+/** An API key's expiresAt as epoch ms, or undefined for a key that never expires. */
+function keyExpiresAt(expiresAt) {
+    if (!expiresAt)
+        return undefined;
+    const ms = new Date(expiresAt).getTime();
+    return Number.isNaN(ms) ? undefined : ms;
+}
 // Role → scopes derivation. The same table is used in profile token creation
 // to enforce that members can never grant 'admin'.
 // Cookie-session scopes: a logged-in user gets the full set of scopes
@@ -185,6 +191,7 @@ function authMiddleware(req, res, next) {
                 apiKeyId: row.id,
                 rateLimit: row.rateLimit,
                 teamIds,
+                credentialExpiresAt: keyExpiresAt(row.expiresAt),
             };
             req.apiKey = { id: row.id, scopes: row.scopes, rateLimit: row.rateLimit, teamId: (_b = row.teamId) !== null && _b !== void 0 ? _b : null };
             return next();
@@ -224,6 +231,7 @@ function authMiddleware(req, res, next) {
                     teamId: (_e = payload.teamId) !== null && _e !== void 0 ? _e : null,
                     rateLimit: 300,
                     teamIds,
+                    credentialExpiresAt: typeof payload.exp === 'number' ? payload.exp * 1000 : undefined,
                 };
                 return next();
             }
@@ -242,11 +250,14 @@ function authMiddleware(req, res, next) {
                 if (!user || user.status !== 'ACTIVE')
                     return res.status(401).json({ error: 'invalid session' });
                 const isSecure = req.secure || req.headers['x-forwarded-proto'] === 'https';
+                // Renewed for as long as the session row now lasts
+                // (XENON_USER_SESSION_TTL_MS). A fixed 24 hours here capped any longer
+                // setting: the browser dropped the cookie after a day away.
                 res.cookie(SESSION_COOKIE, cookie, {
                     httpOnly: true,
                     secure: isSecure,
                     sameSite: 'strict',
-                    maxAge: SESSION_TTL_MS,
+                    maxAge: userSessionSvc.ttlMs(),
                 });
                 const teamIds = yield (0, callerTeamIds_1.computeTeamIds)({
                     role: user.role,
@@ -279,7 +290,7 @@ function authMiddleware(req, res, next) {
                     httpOnly: true,
                     secure: isSecure,
                     sameSite: 'strict',
-                    maxAge: SESSION_TTL_MS,
+                    maxAge: userSessionSvc.ttlMs(),
                 });
                 const teamIds = yield (0, callerTeamIds_1.computeTeamIds)({
                     role: user.role,
@@ -295,6 +306,7 @@ function authMiddleware(req, res, next) {
                     apiKeyId: row.id,
                     rateLimit: row.rateLimit,
                     teamIds,
+                    credentialExpiresAt: keyExpiresAt(row.expiresAt),
                 };
                 req.apiKey = { id: row.id, scopes: row.scopes, rateLimit: row.rateLimit, teamId: (_g = row.teamId) !== null && _g !== void 0 ? _g : null };
                 return next();

package/lib/src/middleware/commandCaller.js

@@ -103,9 +103,9 @@ class CommandCallerVerifier {
             if (!out)
                 return null;
             // A Bearer token carries the scopes of the credential that minted it
-            // (/auth/token), so it is judged like a key. Judging it by role alone,
-            // as a xenon-session token is for leases, would let an ADMIN's ordinary
-            // key mint its way to an override.
+            // (/auth/token), so it is judged like a key. Judging it by role alone
+            // would let an ADMIN's ordinary key mint its way to an override, as a
+            // xenon-session token's lease override did through 2.14.
             return {
                 caller: {
                     userId: out.user.id,

package/lib/src/middleware/verifyCredential.js

@@ -42,9 +42,11 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ACCEPTED_BEARER_AUDIENCES = void 0;
+exports.SessionTokenSubjectError = exports.ACCEPTED_BEARER_AUDIENCES = void 0;
 exports.verifyKeyPairCredential = verifyKeyPairCredential;
 exports.verifyBearerCredential = verifyBearerCredential;
+exports.isWrongSessionToken = isWrongSessionToken;
+exports.verifySessionTokenCredential = verifySessionTokenCredential;
 const jose = __importStar(require("jose"));
 const typedi_1 = require("typedi");
 const ApiKeyService_1 = require("../services/ApiKeyService");
@@ -96,6 +98,12 @@ function verifyKeyPairCredential(accessKey, token) {
  * JWT) means the token is wrong. Any other error (typically "JWT key service
  * not initialized") means it could not be checked, and is rethrown once no
  * audience has verified.
+ *
+ * The payload's `scopes` are the token's as of now: `admin` is dropped once
+ * its user is a MEMBER. A token's scopes are fixed when it is minted, for up
+ * to a day, and REST (resolveActor, scopeGuard) and per-command auth's
+ * override read them, so through 2.14 an admin demoted since kept admin
+ * powers until the token expired.
  */
 function verifyBearerCredential(token) {
     return __awaiter(this, void 0, void 0, function* () {
@@ -119,6 +127,55 @@ function verifyBearerCredential(token) {
         const user = yield typedi_1.Container.get(UserService_1.UserService).findById(String(payload.sub));
         if (!user || user.status !== 'ACTIVE')
             return null;
+        return { payload: Object.assign(Object.assign({}, payload), { scopes: scopesForLiveRole(payload.scopes, user.role) }), user };
+    });
+}
+/** A token's `scopes` claim without `admin` when its user is now a MEMBER. */
+function scopesForLiveRole(scopes, role) {
+    const list = String(scopes !== null && scopes !== void 0 ? scopes : '')
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    if (role === 'ADMIN' || role === 'SUPER_ADMIN')
+        return list.join(',');
+    return list.filter((s) => s !== 'admin').join(',');
+}
+/** The subject of a session token is no longer an ACTIVE user (deleted or Inactive). */
+class SessionTokenSubjectError extends Error {
+    constructor() {
+        super('the session token names a user who is deleted or not active');
+        this.name = 'SessionTokenSubjectError';
+    }
+}
+exports.SessionTokenSubjectError = SessionTokenSubjectError;
+/**
+ * Whether verifySessionTokenCredential's error means the token is wrong (a
+ * bad signature, audience or lifetime, not a JWT, or a departed user), as
+ * opposed to a check that could not run (the signing key or the database
+ * unavailable). A wrong token counts as none; a check that could not run
+ * refuses the create, as a key whose owner can't be looked up does.
+ */
+function isWrongSessionToken(err) {
+    return err instanceof jose.errors.JOSEError || err instanceof SessionTokenSubjectError;
+}
+/**
+ * A `xenon-session` token (the `xe:options.sessionToken` capability), checked
+ * as REST checks a Bearer token: a valid signature, audience and lifetime,
+ * and a subject who is an ACTIVE user, looked up now. Through 2.14 session
+ * create checked the signature alone, so a deleted or Inactive user's token
+ * created sessions as them until it expired.
+ *
+ * Throws for a token that does not verify, as JwtKeyService.verify does, so
+ * the session-token gate and attribution treat a wrong signature and a
+ * departed user alike. Whether the token may create sessions at all (its
+ * `scopes`) is the caller's to judge.
+ */
+function verifySessionTokenCredential(token) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const payload = yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(token, { audience: 'xenon-session' });
+        const user = yield typedi_1.Container.get(UserService_1.UserService).findById(String(payload.sub));
+        if (!user || user.status !== 'ACTIVE')
+            throw new SessionTokenSubjectError();
         return { payload, user: user };
     });
 }

package/lib/src/plugin.js

@@ -66,6 +66,7 @@ const IPluginArgs_1 = require("./interfaces/IPluginArgs");
 const NodeDevices_1 = __importDefault(require("./device-managers/NodeDevices"));
 const appiumUmbrella_1 = require("./sessions/appiumUmbrella");
 const LiveSessionOwners_1 = require("./services/device-access/LiveSessionOwners");
+const sessionMemory_1 = require("./sessions/sessionMemory");
 const SessionMetricsService_1 = require("./services/metrics/SessionMetricsService");
 const PhoneNetworkRestore_1 = require("./services/network/PhoneNetworkRestore");
 const config_1 = require("./config");
@@ -73,6 +74,7 @@ const SessionManager_1 = require("./sessions/SessionManager");
 const event_manager_1 = require("./dashboard/event-manager");
 const asset_manager_1 = require("./dashboard/asset-manager");
 const session_service_1 = require("./dashboard/services/session-service");
+const shutdownReason_1 = require("./services/session/shutdownReason");
 const DEVICE_MANAGER_LOCK_NAME = 'DeviceManager';
 class XenonPlugin extends base_plugin_1.default {
     constructor(pluginName, cliArgs) {
@@ -104,11 +106,20 @@ class XenonPlugin extends base_plugin_1.default {
             return yield typedi_1.Container.get(CommandInterceptor_1.CommandInterceptor).handle(next, driver, commandName, args, this.pluginArgs, XenonPlugin.IS_HUB);
         });
     }
-    onUnexpectedShutdown(driver, _cause) {
+    onUnexpectedShutdown(driver, cause) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
             const sessionId = driver.sessionId;
             typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners).forget(sessionId);
+            (0, sessionMemory_1.forgetSessionMemory)(sessionId);
+            // With the dashboard on or off: this was the only place a session span
+            // ended, and only with the dashboard on.
+            if (sessionId) {
+                typedi_1.Container.get(TracingService_1.TracingService).endSessionSpan(sessionId, {
+                    failed: true,
+                    reason: (0, shutdownReason_1.unexpectedShutdownReason)(cause),
+                });
+            }
             if (sessionId)
                 yield typedi_1.Container.get(SessionMetricsService_1.SessionMetricsService).stop(sessionId);
             // Appium's new-command timeout ends a session here, not in deleteSession:
@@ -136,7 +147,9 @@ class XenonPlugin extends base_plugin_1.default {
             logger_1.default.info(`Unblocking device mapped with filter ${JSON.stringify(deviceFilter)} onUnexpectedShutdown from server`);
             if (XenonPlugin.IS_HUB && this.pluginArgs.enableDashboard && sessionId) {
                 const sessionLog = this.xenonLog.withSession(sessionId, (_a = driver.caps) === null || _a === void 0 ? void 0 : _a.udid);
-                sessionLog.info('Unexpected shutdown for session, updating dashboard...');
+                // Appium's cause, so an idle session is filed as a timeout.
+                const reason = (0, shutdownReason_1.unexpectedShutdownReason)(cause);
+                sessionLog.info(`Unexpected shutdown for session (${reason}), updating dashboard...`);
                 const session = SessionManager_1.SESSION_MANAGER.getSession(sessionId);
                 if (session && session.isVideoRecordingInProgress()) {
                     try {
@@ -154,10 +167,7 @@ class XenonPlugin extends base_plugin_1.default {
                         logger_1.default.debug(`[${sessionId}] rescue-video: Failed: ${err.message}`);
                     }
                 }
-                yield event_manager_1.DASHBORD_EVENT_MANAGER.onSessionStopped(sessionId, SessionStatus_1.SessionStatus.FAILED, 'Driver shut down unexpectedly');
-                typedi_1.Container.get(TracingService_1.TracingService).endSpan(sessionId, 'ERROR', {
-                    'xenon.session.stop_reason': 'Unexpected shutdown',
-                });
+                yield event_manager_1.DASHBORD_EVENT_MANAGER.onSessionStopped(sessionId, SessionStatus_1.SessionStatus.FAILED, reason);
             }
         });
     }

package/lib/src/scripts/database-check.js

@@ -93,9 +93,9 @@ function checkDatabase(opts) {
     }
     if (configured && configured !== client) {
         return {
-            warning: `[Database] databaseProvider is "${configured}", but this install's database client is ` +
-                `built for ${clientLabel}, so the setting has no effect. Your data is in ${where}. ` +
-                `Set databaseProvider to "${client}", or remove it.`,
+            warning: `[Database] databaseProvider is "${configured}", which has no effect: this install ` +
+                `stores its data in ${clientLabel}, in ${where}, and the database itself decides how ` +
+                `its schema is brought up to date. Remove the setting, or set it to "${client}".`,
         };
     }
     return {};

package/lib/src/scripts/initialize-database.js

@@ -14,42 +14,44 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const node_child_process_1 = require("node:child_process");
 const config_1 = require("../config");
-const prepare_prisma_1 = require("./prepare-prisma");
 const logger_1 = __importDefault(require("../logger"));
-const env = Object.assign(Object.assign({}, process.env), { DATABASE_URL: config_1.config.databaseUrl });
-function executeCmd(cmd) {
-    var _a;
-    try {
-        (0, node_child_process_1.execSync)(cmd, {
-            env,
-            stdio: 'inherit',
-        });
-    }
-    catch (error) {
-        const msg = (_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : String(error);
-        logger_1.default.error(`[DBInit] Failed to execute command: ${cmd} | Error: ${msg}`, error);
-        throw error;
-    }
-}
+const database_check_1 = require("./database-check");
+const run_migrations_1 = require("./run-migrations");
+/**
+ * `npm run db:migrate`: bring the database up to date, then regenerate the
+ * client.
+ *
+ * It checks the database URL and uses the rule the server uses at startup
+ * (database-check.ts, then run-migrations.ts): the database decides between
+ * `migrate deploy` and `db push`, so a database whose migration history
+ * matches its tables stays on `migrate deploy`. It runs whatever
+ * XENON_AUTO_MIGRATE says, since it is how you update the schema when that is
+ * off. Through 2.15.0 it always ran `db push`, and first rewrote
+ * prisma/schema.prisma's provider to `databaseProvider`. With `postgresql`,
+ * that left a PostgreSQL schema in the checkout that the SQLite file couldn't
+ * use.
+ *
+ * It first warns of changes to prisma/schema.prisma that no migration makes.
+ * `npm run db:generate` gives the developer's database a migration history, and
+ * from then on it is updated with `migrate deploy`, which never applies them,
+ * while the log said the schema was in sync.
+ */
 function main() {
     return __awaiter(this, void 0, void 0, function* () {
-        logger_1.default.info(`[DBInit] Preparing database for provider: ${config_1.config.databaseProvider}`);
-        // 1. Ensure schema matches provider
-        yield (0, prepare_prisma_1.preparePrismaSchema)();
-        // 2. Handle Migrations
-        if (config_1.config.databaseProvider === 'sqlite') {
-            logger_1.default.info('[DBInit] Syncing SQLite schema via db push...');
-            executeCmd('npx prisma db push --accept-data-loss --skip-generate');
-        }
-        else {
-            // For PostgreSQL, we might not have migrations checked in yet.
-            // In "Cellular Architecture", we use db push to ensure the schema is synced
-            // without requiring migration history sync across cells.
-            logger_1.default.info('[DBInit] Syncing PostgreSQL schema via db push...');
-            executeCmd('npx prisma db push --accept-data-loss');
-        }
+        // A PostgreSQL URL would otherwise reach the history read and fail there,
+        // under a message about the file.
+        (0, database_check_1.assertSupportedDatabase)();
+        (0, run_migrations_1.warnOfUnmigratedSchemaChanges)();
+        yield (0, run_migrations_1.syncDatabaseSchema)();
         logger_1.default.info('[DBInit] Generating Prisma Client...');
-        executeCmd('npx prisma generate');
+        (0, node_child_process_1.execSync)('npx prisma generate', {
+            env: Object.assign(Object.assign({}, process.env), { DATABASE_URL: config_1.config.databaseUrl }),
+            stdio: 'inherit',
+        });
     });
 }
-(() => __awaiter(void 0, void 0, void 0, function* () { return yield main(); }))();
+main().catch((err) => {
+    var _a;
+    logger_1.default.error(`[DBInit] ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
+    process.exit(1);
+});