@xenon-device-management/xenon 2.14.0 → 2.16.0

package/lib/src/services/SocketServer.js

@@ -1,10 +1,43 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -19,9 +52,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 var SocketServer_1;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SocketServer = void 0;
+exports.SocketServer = exports.SOCKET_RECHECK_INTERVAL_MS = void 0;
 const socket_io_1 = require("socket.io");
 const typedi_1 = require("typedi");
+const jose = __importStar(require("jose"));
 const logger_1 = __importDefault(require("../logger"));
 const config_1 = require("../config");
 const ApiKeyService_1 = require("./ApiKeyService");
@@ -33,9 +67,40 @@ const SocketEvents_1 = require("../enums/SocketEvents");
 const callerTeamIds_1 = require("./device-access/callerTeamIds");
 const DeviceTeamResolver_1 = require("./device-access/DeviceTeamResolver");
 const upgradeRouter_1 = require("../app/ws/upgradeRouter");
+const sessionCommandSummary_1 = require("../dashboard/sessionCommandSummary");
+const SelectorVisibilityResolver_1 = require("./selector-health/SelectorVisibilityResolver");
+const identityChanges_1 = require("./identity/identityChanges");
 /** socket.io's default path, which the dashboard and nodes connect to. */
 const SOCKET_IO_PATH = '/socket.io';
+/**
+ * How often every socket is checked again, for a change this server didn't
+ * make itself (another server sharing the database, a direct edit). Changes
+ * made through Xenon reach a socket at once (onIdentityChanged).
+ */
+exports.SOCKET_RECHECK_INTERVAL_MS = 60000;
+/** setTimeout fires at once for a longer delay. */
+const MAX_TIMER_MS = 2147483647;
+/** How many sockets a sweep checks at once, so a large lab's sweep is no burst of queries. */
+const SWEEP_BATCH = 10;
+/**
+ * The credential no longer admits the socket: wrong, revoked, expired, or its
+ * user inactive or gone. Anything else thrown while checking means the check
+ * could not run (the database or signing key unavailable).
+ */
+class SocketRefused extends Error {
+}
 const SESSION_COOKIE = 'xenon_dashboard_session';
+const EVENT_LOG_KEEPS = new Map([
+    [SocketEvents_1.SocketEvents.INTERCEPTOR_REQUEST, null],
+    [SocketEvents_1.SocketEvents.SESSION_COMMAND, sessionCommandSummary_1.sessionCommandSummary],
+]);
+/** A row's expiresAt as epoch ms, or undefined for none. */
+function msOf(at) {
+    if (!at)
+        return undefined;
+    const ms = new Date(at).getTime();
+    return Number.isNaN(ms) ? undefined : ms;
+}
 function readCookie(cookieHeader, name) {
     if (!cookieHeader)
         return undefined;
@@ -55,8 +120,23 @@ let SocketServer = SocketServer_1 = class SocketServer {
         this.nodes = new Map(); // socketId -> nodeHost
         /** The tail of each phone's pending event deliveries (see emitToDashboardForDevices). */
         this.deliveries = new Map();
+        /** The tail of each selector's pending event deliveries (see emitToDashboardForSelector). */
+        this.selectorDeliveries = new Map();
+        /** The timer that checks a socket again when its credential ends, by socket id. */
+        this.expiryTimers = new Map();
+        /**
+         * Each socket's checks, numbered as they start. A check's outcome is
+         * applied unless one that started after it has already applied its own.
+         */
+        this.checks = new WeakMap();
+        /** The check of a socket whose handshake overlapped a change; it joins the dashboard room after it. */
+        this.connectChecks = new WeakMap();
+        /** Counts the identity changes, so a handshake that overlapped one checks again. */
+        this.identityEpoch = 0;
+        this.sweeping = false;
     }
-    initialize(server) {
+    initialize(server, options = {}) {
+        var _a;
         // socket.io (engine.io) takes its websocket transport by adding its own
         // `upgrade` listener, which would also see every other upgrade and end
         // the ones it doesn't own after 1 s. The upgrade router moves that
@@ -74,9 +154,12 @@ let SocketServer = SocketServer_1 = class SocketServer {
         }));
         this.io.use((socket, next) => __awaiter(this, void 0, void 0, function* () {
             try {
-                const identity = yield this.authenticate(socket);
+                const epoch = this.identityEpoch;
+                const { identity, endsAt } = yield this.check(socket);
                 socket.data.identity = identity;
                 socket.data.principal = identity.principal;
+                socket.data.endsAt = endsAt;
+                socket.data.checkedEpoch = epoch;
                 next();
             }
             catch (err) {
@@ -88,6 +171,13 @@ let SocketServer = SocketServer_1 = class SocketServer {
             const socketId = socket.id;
             const principal = socket.data.principal;
             logger_1.default.info(`[SocketServer] New connection: ${socketId} (principal=${principal})`);
+            this.armExpiry(socket);
+            // A user changed while this handshake was being checked. The change
+            // found no socket of theirs to check yet, so this one may hold what was
+            // true before it.
+            if (socket.data.checkedEpoch !== this.identityEpoch) {
+                this.connectChecks.set(socket, this.recheck(socket));
+            }
             // Protocol version handshake — still runs after auth so a logged-in
             // client on the wrong protocol version still gets a clean disconnect.
             socket.on(SocketEvents_1.SocketEvents.HANDSHAKE, (data) => {
@@ -112,16 +202,22 @@ let SocketServer = SocketServer_1 = class SocketServer {
                 // Notify dashboard about new node
                 this.emitToDashboard(SocketEvents_1.SocketEvents.NODE_CONNECTED, { host });
             });
-            socket.on(SocketEvents_1.SocketEvents.REGISTER_DASHBOARD, () => {
+            socket.on(SocketEvents_1.SocketEvents.REGISTER_DASHBOARD, () => __awaiter(this, void 0, void 0, function* () {
                 if (!SocketServer_1.canRegisterAs(principal, 'dashboard')) {
                     logger_1.default.warn(`[SocketServer] Rejected REGISTER_DASHBOARD from principal=${principal} on ${socketId}`);
                     socket.disconnect();
                     return;
                 }
+                // Its events wait for the identity the overlapping change gave it.
+                yield this.connectChecks.get(socket);
+                if (!socket.connected)
+                    return;
                 logger_1.default.info(`[SocketServer] Dashboard client registered (Socket: ${socketId})`);
                 socket.join('dashboard');
-            });
+            }));
             socket.on('disconnect', () => {
+                clearTimeout(this.expiryTimers.get(socketId));
+                this.expiryTimers.delete(socketId);
                 if (this.nodes.has(socketId)) {
                     const host = this.nodes.get(socketId);
                     logger_1.default.info(`[SocketServer] Node disconnected: ${host} (Socket: ${socketId})`);
@@ -133,8 +229,128 @@ let SocketServer = SocketServer_1 = class SocketServer {
                 }
             });
         });
+        const stopListening = (0, identityChanges_1.onIdentityChanged)((userId) => this.recheckUser(userId));
+        const sweep = setInterval(() => void this.sweep(), (_a = options.recheckIntervalMs) !== null && _a !== void 0 ? _a : exports.SOCKET_RECHECK_INTERVAL_MS);
+        sweep.unref();
+        server.once('close', () => {
+            stopListening();
+            clearInterval(sweep);
+        });
         logger_1.default.info('[SocketServer] WebSocket server initialized (auth enabled)');
     }
+    /**
+     * Checks every socket of `userId` again, on its own credential (see
+     * recheck). Settles once each has its new identity or is closed (or, if it
+     * could not be checked, is as it was).
+     */
+    recheckUser(userId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.identityEpoch += 1;
+            if (!this.io || config_1.config.authDisabled === true)
+                return;
+            const sockets = Array.from(this.io.sockets.sockets.values()).filter((socket) => { var _a, _b; return ((_b = (_a = socket.data) === null || _a === void 0 ? void 0 : _a.identity) === null || _b === void 0 ? void 0 : _b.userId) === userId; });
+            yield Promise.all(sockets.map((socket) => this.recheck(socket)));
+        });
+    }
+    /**
+     * Every socket again, for a change made where this server doesn't hear of
+     * it, SWEEP_BATCH at a time. One sweep at a time.
+     */
+    sweep() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.sweeping || !this.io || config_1.config.authDisabled === true)
+                return;
+            this.sweeping = true;
+            try {
+                const sockets = Array.from(this.io.sockets.sockets.values());
+                for (let i = 0; i < sockets.length; i += SWEEP_BATCH) {
+                    yield Promise.all(sockets.slice(i, i + SWEEP_BATCH).map((s) => this.recheck(s)));
+                }
+            }
+            finally {
+                this.sweeping = false;
+            }
+        });
+    }
+    /**
+     * The handshake's check, again, on the socket's own credential, renewing
+     * nothing: a sign-in's TTL doesn't slide and a key's `lastUsedAt` doesn't
+     * move. Its outcome is applied unless a check that started after it has
+     * already applied its own. So once a check settles, the socket is at least
+     * as current as what it read: a change's check lands before REST answers,
+     * though a sweep's started meanwhile, and a newer check that could not run
+     * doesn't cancel an older refusal.
+     *
+     * - Admitted: the socket gets its new identity where it is, still
+     *   connected, so a demoted admin's tab keeps its member's events.
+     * - Refused: its connection is closed (the transport, not
+     *   `disconnect()`). The client reconnects as it does after any drop, and
+     *   the handshake decides on the credential it has now: a fresh bearer
+     *   token from its `auth` function (Xenon Studio, the documented client),
+     *   or the browser's new cookie, is admitted; the refused one is refused,
+     *   and socket.io-client doesn't try again after a refused handshake.
+     *   `disconnect()` would have the client never reconnect at all
+     *   (`io server disconnect`), so every token's `exp` would end a
+     *   long-running client's events for good. Once closing, the socket is
+     *   sent nothing more.
+     * - Could not check: the socket is kept as it was. Closing every
+     *   dashboard over a database hiccup would have their reconnects refused
+     *   too, leaving them all without live events.
+     */
+    recheck(socket) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            let state = this.checks.get(socket);
+            if (!state) {
+                state = { started: 0, applied: 0 };
+                this.checks.set(socket, state);
+            }
+            const checks = state;
+            const n = ++checks.started;
+            const current = () => n > checks.applied && socket.connected;
+            const before = socket.data.identity;
+            let checked;
+            try {
+                checked = yield this.check(socket, true);
+            }
+            catch (err) {
+                if (!current())
+                    return;
+                if (err instanceof SocketRefused) {
+                    checks.applied = n;
+                    logger_1.default.info(`[SocketServer] Closing ${socket.id} (user ${before === null || before === void 0 ? void 0 : before.userId}): ${err.message}`);
+                    socket.conn.close();
+                }
+                else {
+                    logger_1.default.warn(`[SocketServer] Could not check ${socket.id} (user ${before === null || before === void 0 ? void 0 : before.userId}) again, so it is kept as it was: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
+                }
+                return;
+            }
+            if (!current())
+                return;
+            checks.applied = n;
+            const { identity, endsAt } = checked;
+            socket.data.identity = identity;
+            socket.data.endsAt = endsAt;
+            this.armExpiry(socket);
+            if ((before === null || before === void 0 ? void 0 : before.role) !== identity.role ||
+                JSON.stringify(before === null || before === void 0 ? void 0 : before.teamIds) !== JSON.stringify(identity.teamIds)) {
+                logger_1.default.info(`[SocketServer] ${socket.id} (user ${identity.userId}) is now ${identity.role}, teams ${identity.teamIds ? `[${identity.teamIds.join(', ')}]` : 'all'}`);
+            }
+        });
+    }
+    /** Checks the socket again when its credential ends by itself (`socket.data.endsAt`). */
+    armExpiry(socket) {
+        clearTimeout(this.expiryTimers.get(socket.id));
+        this.expiryTimers.delete(socket.id);
+        const endsAt = socket.data.endsAt;
+        if (endsAt === undefined || !socket.connected)
+            return;
+        const delay = Math.min(Math.max(endsAt - Date.now(), 0), MAX_TIMER_MS);
+        const timer = setTimeout(() => void this.recheck(socket), delay);
+        timer.unref();
+        this.expiryTimers.set(socket.id, timer);
+    }
     // Role-based registration guard. A dashboard-authed socket can't join the
     // 'nodes' broadcast room and a node-authed socket can't subscribe to
     // dashboard events — keeps a stolen credential of one class from acting
@@ -146,13 +362,27 @@ let SocketServer = SocketServer_1 = class SocketServer {
     }
     authenticate(socket) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d;
+            return (yield this.check(socket)).identity;
+        });
+    }
+    /**
+     * Who the socket's handshake credential says it is now, and when that
+     * credential ends by itself (`endsAt`, epoch ms; none for one that doesn't).
+     * Throws SocketRefused when the credential no longer admits it, anything
+     * else when it could not be checked. A `recheck` renews nothing (see
+     * recheck).
+     */
+    check(socket_1) {
+        return __awaiter(this, arguments, void 0, function* (socket, recheck = false) {
+            var _a, _b, _c, _d, _e;
             if (config_1.config.authDisabled === true) {
                 return {
-                    principal: 'auth-disabled',
-                    userId: 'auth-disabled',
-                    role: 'SUPER_ADMIN',
-                    teamIds: undefined,
+                    identity: {
+                        principal: 'auth-disabled',
+                        userId: 'auth-disabled',
+                        role: 'SUPER_ADMIN',
+                        teamIds: undefined,
+                    },
                 };
             }
             const auth = (socket.handshake.auth || {});
@@ -166,58 +396,74 @@ let SocketServer = SocketServer_1 = class SocketServer {
                 try {
                     payload = yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(bearer, { audience: 'xenon-rest' });
                 }
-                catch (_e) {
-                    throw new Error('invalid bearer token');
+                catch (err) {
+                    if (err instanceof jose.errors.JOSEError)
+                        throw new SocketRefused('invalid bearer token');
+                    throw new Error(`bearer token could not be checked: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
                 }
+                // The socket closes when REST stops taking the token: verify() allows
+                // JWT_CLOCK_TOLERANCE_SEC past exp, and refuses it from then on.
+                const endsAt = typeof payload.exp === 'number'
+                    ? (payload.exp + JwtKeyService_1.JWT_CLOCK_TOLERANCE_SEC) * 1000
+                    : undefined;
                 const owner = yield prisma_1.prisma.user.findUnique({
                     where: { id: String(payload.sub) },
                     select: { status: true, role: true },
                 });
                 if (!owner || owner.status !== 'ACTIVE')
-                    throw new Error('inactive user');
+                    throw new SocketRefused('inactive user');
                 // The team claim is read exactly as REST's bearer path reads it.
-                return this.identify('dashboard', String(payload.sub), owner.role, (_a = payload.teamId) !== null && _a !== void 0 ? _a : null);
+                const identity = yield this.identify('dashboard', String(payload.sub), owner.role, (_b = payload.teamId) !== null && _b !== void 0 ? _b : null);
+                return { identity, endsAt };
             }
             // Node path: per-node (accessKey, token) pair. Resolves to a real
             // ApiKey row owned by a real User; we additionally enforce that the
             // User is ACTIVE so a disabled account can't keep a stolen key alive.
             const pairKey = (typeof auth.accessKey === 'string' && auth.accessKey) ||
-                ((_b = headers['x-xenon-access-key']) !== null && _b !== void 0 ? _b : '');
+                ((_c = headers['x-xenon-access-key']) !== null && _c !== void 0 ? _c : '');
             const pairTok = (typeof auth.token === 'string' && auth.token) ||
-                ((_c = headers['x-xenon-token']) !== null && _c !== void 0 ? _c : '');
+                ((_d = headers['x-xenon-token']) !== null && _d !== void 0 ? _d : '');
             if (pairKey && pairTok) {
-                const row = yield typedi_1.Container.get(ApiKeyService_1.ApiKeyService).verifyPair(pairKey, pairTok);
+                const row = yield typedi_1.Container.get(ApiKeyService_1.ApiKeyService).verifyPair(pairKey, pairTok, {
+                    touch: !recheck,
+                });
                 if (!row)
-                    throw new Error('invalid (accessKey, token) pair');
+                    throw new SocketRefused('invalid (accessKey, token) pair');
                 const owner = yield prisma_1.prisma.user.findUnique({
                     where: { id: row.userId },
                     select: { status: true, role: true },
                 });
                 if (!owner || owner.status !== 'ACTIVE')
-                    throw new Error('inactive user');
-                return this.identify('node', row.userId, owner.role, row.teamId);
+                    throw new SocketRefused('inactive user');
+                const identity = yield this.identify('node', row.userId, owner.role, row.teamId);
+                return { identity, endsAt: msOf(row.expiresAt) };
             }
             // Dashboard path: the cookie. As in REST's authMiddleware, it is first a
             // UserSession id (set by /auth/login), then a raw API key (the older
             // /api-key-gate cookie). A session whose user is disabled is refused, not
             // retried as a key.
-            const cookieValue = (_d = readCookie(headers.cookie, SESSION_COOKIE)) !== null && _d !== void 0 ? _d : '';
+            const cookieValue = (_e = readCookie(headers.cookie, SESSION_COOKIE)) !== null && _e !== void 0 ? _e : '';
             if (!cookieValue) {
-                throw new Error('missing credentials (need (accessKey, token) pair or dashboard cookie)');
+                throw new SocketRefused('missing credentials (need (accessKey, token) pair or dashboard cookie)');
             }
-            const session = yield typedi_1.Container.get(UserSessionService_1.UserSessionService).resolve(cookieValue);
+            // A sign-in's expiresAt slides as REST uses it: checked again then, it
+            // has moved on and the timer is set again.
+            const session = yield typedi_1.Container.get(UserSessionService_1.UserSessionService).resolve(cookieValue, {
+                renew: !recheck,
+            });
             if (session) {
                 const user = yield prisma_1.prisma.user.findUnique({
                     where: { id: session.userId },
                     select: { status: true, role: true },
                 });
                 if (!user || user.status !== 'ACTIVE')
-                    throw new Error('inactive user');
-                return this.identify('dashboard', session.userId, user.role, null);
+                    throw new SocketRefused('inactive user');
+                const identity = yield this.identify('dashboard', session.userId, user.role, null);
+                return { identity, endsAt: msOf(session.expiresAt) };
             }
-            const row = yield typedi_1.Container.get(ApiKeyService_1.ApiKeyService).verify(cookieValue);
+            const row = yield typedi_1.Container.get(ApiKeyService_1.ApiKeyService).verify(cookieValue, { touch: !recheck });
             if (!row) {
-                throw new Error('invalid or revoked dashboard session');
+                throw new SocketRefused('invalid or revoked dashboard session');
             }
             // The key owner's role decides the team scope, and an inactive owner is
             // refused here as REST refuses them.
@@ -226,8 +472,9 @@ let SocketServer = SocketServer_1 = class SocketServer {
                 select: { status: true, role: true },
             });
             if (!owner || owner.status !== 'ACTIVE')
-                throw new Error('inactive user');
-            return this.identify('dashboard', row.userId, owner.role, row.teamId);
+                throw new SocketRefused('inactive user');
+            const identity = yield this.identify('dashboard', row.userId, owner.role, row.teamId);
+            return { identity, endsAt: msOf(row.expiresAt) };
         });
     }
     identify(principal, userId, role, apiKeyTeamId) {
@@ -237,17 +484,80 @@ let SocketServer = SocketServer_1 = class SocketServer {
             return { principal, userId, role: r, teamIds };
         });
     }
-    /** Unscoped: every dashboard socket. For events that aren't one phone's data (selectors, nodes). */
+    /**
+     * Unscoped: every dashboard socket. Only for the hub's node events, which
+     * carry a node's address and nothing of a phone, a session or a selector.
+     */
     emitToDashboard(event, data) {
         if (this.io) {
             this.io.to('dashboard').emit(event, data);
         }
-        typedi_1.Container.get(EventLogService_1.EventLogService).appendSafe({ type: event, payload: data });
+        this.logEvent(event, data);
+    }
+    /** Once per event, unscoped: whole, or what EVENT_LOG_KEEPS keeps of it. */
+    logEvent(event, data) {
+        const keep = EVENT_LOG_KEEPS.get(event);
+        if (keep === null)
+            return;
+        typedi_1.Container.get(EventLogService_1.EventLogService).appendSafe({
+            type: event,
+            payload: keep ? keep(data) : data,
+        });
+    }
+    /**
+     * A Selector Health event (`selector_*`): each dashboard socket gets it only
+     * if its caller may see the selector, by REST's rule (a selector healed in a
+     * session the caller may see; SelectorVisibilityResolver). Admins get every
+     * one. The event log records it once, unscoped.
+     *
+     * Each selector's events are delivered through one chain, in the order they
+     * were emitted. With no scoped socket connected and nothing pending for the
+     * selector, it is the synchronous room broadcast, with no lookup. The
+     * returned promise settles once the event is delivered and never rejects.
+     */
+    emitToDashboardForSelector(event, data, selector) {
+        var _a;
+        this.logEvent(event, data);
+        const key = JSON.stringify([selector.strategy, selector.selector]);
+        if (!this.hasScopedDashboard() && !this.selectorDeliveries.has(key)) {
+            (_a = this.io) === null || _a === void 0 ? void 0 : _a.to('dashboard').emit(event, data);
+            return Promise.resolve();
+        }
+        return this.enqueue(event, [key], () => this.deliverForSelector(event, data, selector), this.selectorDeliveries);
+    }
+    deliverForSelector(event, data, selector) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            // The scoped sockets may have left while this waited its turn.
+            if (!this.hasScopedDashboard()) {
+                (_a = this.io) === null || _a === void 0 ? void 0 : _a.to('dashboard').emit(event, data);
+                return;
+            }
+            const resolver = typedi_1.Container.get(SelectorVisibilityResolver_1.SelectorVisibilityResolver);
+            const sockets = this.dashboardSockets();
+            const asked = sockets.map((socket) => { var _a; return (_a = socket.data) === null || _a === void 0 ? void 0 : _a.identity; });
+            const allowed = yield Promise.all(sockets.map((socket) => {
+                var _a, _b;
+                const teamIds = teamIdsOf(socket);
+                if (teamIds === undefined)
+                    return true;
+                const userId = (_b = (_a = socket.data) === null || _a === void 0 ? void 0 : _a.identity) === null || _b === void 0 ? void 0 : _b.userId;
+                return resolver.canSee(selector, { userId, teamIds });
+            }));
+            // A socket whose identity was replaced meanwhile (a role or team
+            // change) was not the one asked about: it gets nothing.
+            sockets.forEach((socket, i) => {
+                var _a;
+                if (allowed[i] && ((_a = socket.data) === null || _a === void 0 ? void 0 : _a.identity) === asked[i])
+                    socket.emit(event, data);
+            });
+        });
     }
     /**
      * A dashboard event about one or more phones: each dashboard socket gets it
      * only if its caller can see the phone ({@link DeviceEventScope}), by the
-     * same team rule as REST. The event log records it once, unscoped.
+     * same team rule as REST. The event log records it once, unscoped, as
+     * EVENT_LOG_KEEPS says.
      *
      * Each phone's events are delivered through one chain, in the order they
      * were emitted, whatever their scope shape: one that waits on a team lookup
@@ -262,9 +572,9 @@ let SocketServer = SocketServer_1 = class SocketServer {
      */
     emitToDashboardForDevices(event, data, scope) {
         var _a, _b;
-        typedi_1.Container.get(EventLogService_1.EventLogService).appendSafe({ type: event, payload: data });
+        this.logEvent(event, data);
         const udids = 'udids' in scope ? scope.udids : [(_a = scope.udid) !== null && _a !== void 0 ? _a : ''];
-        if (!this.hasScopedDashboard() && udids.every((udid) => !this.deliveries.has(udid))) {
+        if (this.reachesEverySocket(scope) && udids.every((udid) => !this.deliveries.has(udid))) {
             this.noteRow(scope);
             (_b = this.io) === null || _b === void 0 ? void 0 : _b.to('dashboard').emit(event, data);
             return Promise.resolve();
@@ -289,34 +599,53 @@ let SocketServer = SocketServer_1 = class SocketServer {
     hasScopedDashboard() {
         return this.dashboardSockets().some((socket) => teamIdsOf(socket) !== undefined);
     }
-    /** Runs `step` after every pending delivery for `udids`, and makes it their new tail. */
-    enqueue(event, udids, step) {
-        const before = udids.map((udid) => { var _a; return (_a = this.deliveries.get(udid)) !== null && _a !== void 0 ? _a : Promise.resolve(); });
+    /** Runs `step` after every pending delivery for `keys` in `chains`, and makes it their new tail. */
+    enqueue(event, keys, step, chains = this.deliveries) {
+        const before = keys.map((key) => { var _a; return (_a = chains.get(key)) !== null && _a !== void 0 ? _a : Promise.resolve(); });
         const done = Promise.all(before)
             .then(step)
             .catch((err) => { var _a; return logger_1.default.warn(`[SocketServer] ${event} not delivered: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`); });
-        for (const udid of udids)
-            this.deliveries.set(udid, done);
+        for (const key of keys)
+            chains.set(key, done);
         void done.then(() => {
-            for (const udid of udids) {
-                if (this.deliveries.get(udid) === done)
-                    this.deliveries.delete(udid);
+            for (const key of keys) {
+                if (chains.get(key) === done)
+                    chains.delete(key);
             }
         });
         return done;
     }
+    /**
+     * Whether every dashboard socket gets an event of this scope whatever its
+     * phones are, so it can be the room broadcast with no lookup.
+     */
+    reachesEverySocket(scope) {
+        return this.dashboardSockets().every((socket) => teamIdsOf(socket) === undefined && (!scope.adminOnly || isAdmin(socket)));
+    }
     deliver(event, data, scope) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
             // The scoped sockets may have left while this waited its turn.
-            if (!this.hasScopedDashboard()) {
+            if (this.reachesEverySocket(scope)) {
                 (_a = this.io) === null || _a === void 0 ? void 0 : _a.to('dashboard').emit(event, data);
                 return;
             }
             const resolver = typedi_1.Container.get(DeviceTeamResolver_1.DeviceTeamResolver);
+            // Read once the team is known, so a socket that joined meanwhile is included.
+            const recipients = () => this.dashboardSockets().filter((socket) => !scope.adminOnly || isAdmin(socket));
+            // An admin-only event goes to admins, who see every phone: no lookup, so
+            // a slow store holds no captured request back.
+            if (scope.adminOnly) {
+                const admins = recipients();
+                if (admins.every((socket) => teamIdsOf(socket) === undefined)) {
+                    for (const socket of admins)
+                        socket.emit(event, data);
+                    return;
+                }
+            }
             if ('udids' in scope) {
                 const teams = yield Promise.all(scope.udids.map((udid) => resolver.resolve(udid)));
-                for (const socket of this.dashboardSockets()) {
+                for (const socket of recipients()) {
                     const teamIds = teamIdsOf(socket);
                     if (teamIds === undefined) {
                         socket.emit(event, data);
@@ -332,7 +661,7 @@ let SocketServer = SocketServer_1 = class SocketServer {
             const team = scope.teamId !== undefined
                 ? { known: true, teamId: scope.teamId }
                 : yield resolver.resolve(scope.udid);
-            for (const socket of this.dashboardSockets()) {
+            for (const socket of recipients()) {
                 if ((0, DeviceTeamResolver_1.canSeeDeviceTeam)(team, teamIdsOf(socket)))
                     socket.emit(event, data);
             }
@@ -368,3 +697,9 @@ function teamIdsOf(socket) {
     const identity = (_a = socket.data) === null || _a === void 0 ? void 0 : _a.identity;
     return identity ? identity.teamIds : [];
 }
+/** An admin by role, as `roleGuard('ADMIN')` decides. A socket with no identity is not one. */
+function isAdmin(socket) {
+    var _a, _b;
+    const role = (_b = (_a = socket.data) === null || _a === void 0 ? void 0 : _a.identity) === null || _b === void 0 ? void 0 : _b.role;
+    return role === 'ADMIN' || role === 'SUPER_ADMIN';
+}

package/lib/src/services/TeamService.js

@@ -22,6 +22,7 @@ exports.TeamService = void 0;
 const typedi_1 = require("typedi");
 const prisma_1 = require("../prisma");
 const logger_1 = __importDefault(require("../logger"));
+const identityChanges_1 = require("./identity/identityChanges");
 let TeamService = class TeamService {
     constructor() {
         this.log = logger_1.default.scope('Team');
@@ -101,7 +102,9 @@ let TeamService = class TeamService {
     }
     addMember(teamId, userId) {
         return __awaiter(this, void 0, void 0, function* () {
-            return prisma_1.prisma.teamMember.create({ data: { teamId, userId } });
+            const member = yield prisma_1.prisma.teamMember.create({ data: { teamId, userId } });
+            yield (0, identityChanges_1.identityChanged)(userId);
+            return member;
         });
     }
     removeMember(teamId, userId) {
@@ -109,6 +112,7 @@ let TeamService = class TeamService {
             yield prisma_1.prisma.teamMember.delete({
                 where: { teamId_userId: { teamId, userId } },
             });
+            yield (0, identityChanges_1.identityChanged)(userId);
         });
     }
 };