@xenon-device-management/xenon 2.14.0 → 2.16.0

package/lib/test/helpers/scratch-database.js

@@ -52,16 +52,54 @@ const MODELS = [
     'sessionMetric',
     'selectorEvent',
 ];
+let scratchCount = 0;
+let template;
+/**
+ * A database migrated once for the whole process, which each suite copies.
+ * Removed when the process exits.
+ */
+function migratedTemplate() {
+    if (template)
+        return template;
+    const file = path_1.default.join(os_1.default.tmpdir(), `xenon-scratch-template-${process.pid}-${Date.now()}.db`);
+    (0, child_process_1.execSync)('npx prisma migrate deploy', {
+        cwd: path_1.default.resolve(__dirname, '../..'),
+        env: Object.assign(Object.assign({}, process.env), { DATABASE_URL: `file:${file}` }),
+        stdio: 'pipe',
+    });
+    process.once('exit', () => {
+        for (const f of [file, `${file}-journal`]) {
+            try {
+                fs_1.default.unlinkSync(f);
+            }
+            catch (_a) {
+                // already gone
+            }
+        }
+    });
+    template = file;
+    return file;
+}
 /**
  * Back the whole `prisma` wrapper with a scratch SQLite file for the enclosing
  * `describe`, so the real queries (the device store, the session lifecycle,
  * SessionOwnerResolver) run against a real database that is not the server's.
  * Like useScratchPortLeases, for every model.
  *
- * Call it inside a `describe`, never at the top of a file. The database is
- * migrated once per suite; the stubs are made before each test and removed
- * after it, so a spec's own `sinon.restore()` can't leave the next test on
- * the real database. Tests empty the tables they use.
+ * Call it inside a `describe`, never at the top of a file. Each suite gets a
+ * fresh database: a copy of one migrated once per process (migrating takes
+ * seconds). The stubs are made before each test and removed after it, so a
+ * spec's own `sinon.restore()` can't leave the next test on the real
+ * database. Tests empty the tables they use.
+ *
+ * With `wholeSuite`, the stubs are made once, before the suite's own `before`
+ * hooks (call it first in the describe), and removed after the suite. Making
+ * them takes tens of milliseconds, which a suite of hundreds of short tests
+ * otherwise pays per test. Its `before` hooks can then seed the rows every
+ * test reads, and nothing needs deleting: the file goes with the suite. Only
+ * for a suite that doesn't stub or restore `prisma` itself. Its own `after`
+ * hooks run once the stubs are gone, so they must not touch `prisma`: it is
+ * the real database again by then.
  *
  * With `captureQueries`, `queries` holds the SQL each test ran, so a spec can
  * ask SQLite how it reads a table (`EXPLAIN QUERY PLAN`).
@@ -72,13 +110,10 @@ function useScratchDatabase(options = {}) {
     let dbPath = '';
     before(function () {
         this.timeout(90000);
-        dbPath = path_1.default.join(os_1.default.tmpdir(), `xenon-scratch-${process.pid}-${Date.now()}.db`);
+        scratchCount += 1;
+        dbPath = path_1.default.join(os_1.default.tmpdir(), `xenon-scratch-${process.pid}-${Date.now()}-${scratchCount}.db`);
+        fs_1.default.copyFileSync(migratedTemplate(), dbPath);
         const url = `file:${dbPath}`;
-        (0, child_process_1.execSync)('npx prisma migrate deploy', {
-            cwd: path_1.default.resolve(__dirname, '../..'),
-            env: Object.assign(Object.assign({}, process.env), { DATABASE_URL: url }),
-            stdio: 'pipe',
-        });
         if (options.captureQueries) {
             const db = new client_1.PrismaClient({
                 datasources: { db: { url } },
@@ -90,9 +125,10 @@ function useScratchDatabase(options = {}) {
         else {
             ctx.db = new client_1.PrismaClient({ datasources: { db: { url } } });
         }
+        if (options.wholeSuite)
+            stubPrisma();
     });
-    beforeEach(() => {
-        ctx.queries.length = 0;
+    function stubPrisma() {
         for (const model of MODELS) {
             const wrapper = prisma_1.prisma[model];
             const delegate = ctx.db[model];
@@ -102,8 +138,16 @@ function useScratchDatabase(options = {}) {
                 sandbox.stub(wrapper, name).callsFake((...args) => delegate[name](...args));
             }
         }
+    }
+    beforeEach(() => {
+        ctx.queries.length = 0;
+        if (!options.wholeSuite)
+            stubPrisma();
+    });
+    afterEach(() => {
+        if (!options.wholeSuite)
+            sandbox.restore();
     });
-    afterEach(() => sandbox.restore());
     after(() => __awaiter(this, void 0, void 0, function* () {
         sandbox.restore();
         if (ctx.db)

package/lib/test/integration/androidDevices.spec.js

@@ -133,6 +133,6 @@ describe('Android Test', () => {
         };
         yield (0, device_utils_1.allocateDeviceForSession)(capabilities, 1000, 1000, pluginArgs).catch((error) => (0, chai_1.expect)(error)
             .to.be.an('error')
-            .with.property('message', 'Device is busy or blocked.. Device request: {"platform":"android"}'));
+            .with.property('message', 'Device is busy or blocked. Device request: {"platform":"android"}'));
     }));
 });

package/lib/test/integration/audit-ingest.spec.js

@@ -15,7 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const sinon_1 = __importDefault(require("sinon"));
 // Static import (matches the passing integration-spec idiom, e.g. selector-health-endpoint.spec):
 // a dynamic `await import('...routers/audit')` fails ESM resolution on the extensionless path
@@ -37,7 +37,7 @@ describe('POST /xenon/api/audit/events', () => {
         app.use('/xenon/api/audit', (0, audit_1.makeRouter)({ eventLogService: eventLogSvc }));
     });
     it('202s on a valid batch of 2 events and appends each via EventLogService.appendSafe with type mcp_audit', () => __awaiter(void 0, void 0, void 0, function* () {
-        const res = yield (0, supertest_1.default)(app)
+        const res = yield (0, loopbackRequest_1.default)(app)
             .post('/xenon/api/audit/events')
             .send({
             events: [
@@ -70,20 +70,20 @@ describe('POST /xenon/api/audit/events', () => {
         (0, chai_1.expect)(secondArg.payload).to.deep.include({ sessionId: 'sess-1' });
     }));
     it('400s when events is missing', () => __awaiter(void 0, void 0, void 0, function* () {
-        const res = yield (0, supertest_1.default)(app).post('/xenon/api/audit/events').send({});
+        const res = yield (0, loopbackRequest_1.default)(app).post('/xenon/api/audit/events').send({});
         (0, chai_1.expect)(res.status).to.equal(400);
         (0, chai_1.expect)(res.body.error).to.equal('bad_request');
         (0, chai_1.expect)(eventLogSvc.appendSafe.called).to.be.false;
     }));
     it('400s when events is not an array', () => __awaiter(void 0, void 0, void 0, function* () {
-        const res = yield (0, supertest_1.default)(app)
+        const res = yield (0, loopbackRequest_1.default)(app)
             .post('/xenon/api/audit/events')
             .send({ events: 'nope' });
         (0, chai_1.expect)(res.status).to.equal(400);
         (0, chai_1.expect)(res.body.error).to.equal('bad_request');
     }));
     it('400s when a batch event is malformed (missing tool)', () => __awaiter(void 0, void 0, void 0, function* () {
-        const res = yield (0, supertest_1.default)(app)
+        const res = yield (0, loopbackRequest_1.default)(app)
             .post('/xenon/api/audit/events')
             .send({
             events: [{ subject: 'agent-1', decision: 'allow', latencyMs: 10 }],
@@ -100,7 +100,7 @@ describe('POST /xenon/api/audit/events', () => {
             decision: 'allow',
             latencyMs: i,
         }));
-        const res = yield (0, supertest_1.default)(app).post('/xenon/api/audit/events').send({ events });
+        const res = yield (0, loopbackRequest_1.default)(app).post('/xenon/api/audit/events').send({ events });
         (0, chai_1.expect)(res.status).to.equal(400);
         (0, chai_1.expect)(res.body.error).to.equal('bad_request');
         (0, chai_1.expect)(eventLogSvc.appendSafe.called).to.be.false;
@@ -131,12 +131,12 @@ describe('POST /xenon/api/audit/events — guard (router-level roleGuard(MEMBER)
     });
     it('401s when unauthenticated', () => __awaiter(void 0, void 0, void 0, function* () {
         const app = yield makeApp(eventLogSvc)();
-        const res = yield (0, supertest_1.default)(app).post('/xenon/api/audit/events').send(validBody);
+        const res = yield (0, loopbackRequest_1.default)(app).post('/xenon/api/audit/events').send(validBody);
         (0, chai_1.expect)(res.status).to.equal(401);
     }));
     it('403s for a role below MEMBER', () => __awaiter(void 0, void 0, void 0, function* () {
         const app = yield makeApp(eventLogSvc)();
-        const res = yield (0, supertest_1.default)(app)
+        const res = yield (0, loopbackRequest_1.default)(app)
             .post('/xenon/api/audit/events')
             .set('x-test-role', 'BOGUS')
             .set('x-test-scopes', 'admin')
@@ -145,7 +145,7 @@ describe('POST /xenon/api/audit/events — guard (router-level roleGuard(MEMBER)
     }));
     it('403s for MEMBER role without the admin scope', () => __awaiter(void 0, void 0, void 0, function* () {
         const app = yield makeApp(eventLogSvc)();
-        const res = yield (0, supertest_1.default)(app)
+        const res = yield (0, loopbackRequest_1.default)(app)
             .post('/xenon/api/audit/events')
             .set('x-test-role', 'MEMBER')
             .set('x-test-scopes', 'devices')
@@ -155,7 +155,7 @@ describe('POST /xenon/api/audit/events — guard (router-level roleGuard(MEMBER)
     }));
     it('202s for MEMBER role with the admin scope', () => __awaiter(void 0, void 0, void 0, function* () {
         const app = yield makeApp(eventLogSvc)();
-        const res = yield (0, supertest_1.default)(app)
+        const res = yield (0, loopbackRequest_1.default)(app)
             .post('/xenon/api/audit/events')
             .set('x-test-role', 'MEMBER')
             .set('x-test-scopes', 'admin')

package/lib/test/integration/auth-flow.spec.js

@@ -14,13 +14,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const express_1 = __importDefault(require("express"));
 const auth_1 = require("../../src/app/routers/auth");
 const authMiddleware_1 = require("../../src/middleware/authMiddleware");
-const prisma_1 = require("../../src/prisma");
 const typedi_1 = require("typedi");
 const UserService_1 = require("../../src/services/UserService");
+const scratch_database_1 = require("../helpers/scratch-database");
 function buildApp() {
     const app = (0, express_1.default)();
     app.use(express_1.default.json());
@@ -32,10 +32,9 @@ function buildApp() {
 }
 describe('auth flow (integration)', function () {
     this.timeout(30000);
+    (0, scratch_database_1.useScratchDatabase)({ wholeSuite: true });
     let user;
     before(() => __awaiter(this, void 0, void 0, function* () {
-        yield prisma_1.prisma.userSession.deleteMany({ where: { user: { email: 'loginflow@xenon.local' } } });
-        yield prisma_1.prisma.user.deleteMany({ where: { email: 'loginflow@xenon.local' } });
         user = yield typedi_1.Container.get(UserService_1.UserService).createUser({
             email: 'loginflow@xenon.local',
             name: 'Login Flow',
@@ -43,31 +42,27 @@ describe('auth flow (integration)', function () {
             role: 'ADMIN',
         });
     }));
-    after(() => __awaiter(this, void 0, void 0, function* () {
-        yield prisma_1.prisma.userSession.deleteMany({ where: { userId: user.id } });
-        yield prisma_1.prisma.user.delete({ where: { id: user.id } });
-    }));
     it('login → cookie → /whoami → logout → 401', () => __awaiter(this, void 0, void 0, function* () {
         var _a;
         const app = buildApp();
-        const login = yield (0, supertest_1.default)(app)
+        const login = yield (0, loopbackRequest_1.default)(app)
             .post('/api/auth/login')
             .send({ email: 'loginflow@xenon.local', password: 'flow-test-12' });
         (0, chai_1.expect)(login.status).to.equal(204);
         const cookie = (_a = login.headers['set-cookie']) === null || _a === void 0 ? void 0 : _a[0];
         (0, chai_1.expect)(cookie).to.match(/^xenon_dashboard_session=/);
-        const me = yield (0, supertest_1.default)(app).get('/api/whoami').set('Cookie', cookie);
+        const me = yield (0, loopbackRequest_1.default)(app).get('/api/whoami').set('Cookie', cookie);
         (0, chai_1.expect)(me.status).to.equal(200);
         (0, chai_1.expect)(me.body.userId).to.equal(user.id);
         (0, chai_1.expect)(me.body.kind).to.equal('user-session');
-        const out = yield (0, supertest_1.default)(app).post('/api/auth/logout').set('Cookie', cookie);
+        const out = yield (0, loopbackRequest_1.default)(app).post('/api/auth/logout').set('Cookie', cookie);
         (0, chai_1.expect)(out.status).to.equal(204);
-        const me2 = yield (0, supertest_1.default)(app).get('/api/whoami').set('Cookie', cookie);
+        const me2 = yield (0, loopbackRequest_1.default)(app).get('/api/whoami').set('Cookie', cookie);
         (0, chai_1.expect)(me2.status).to.equal(401);
     }));
     it('login with wrong password returns generic 401 (no enumeration)', () => __awaiter(this, void 0, void 0, function* () {
         const app = buildApp();
-        const login = yield (0, supertest_1.default)(app)
+        const login = yield (0, loopbackRequest_1.default)(app)
             .post('/api/auth/login')
             .send({ email: 'loginflow@xenon.local', password: 'WRONG' });
         (0, chai_1.expect)(login.status).to.equal(401);
@@ -75,7 +70,7 @@ describe('auth flow (integration)', function () {
     }));
     it('login with unknown email returns the same generic 401', () => __awaiter(this, void 0, void 0, function* () {
         const app = buildApp();
-        const login = yield (0, supertest_1.default)(app)
+        const login = yield (0, loopbackRequest_1.default)(app)
             .post('/api/auth/login')
             .send({ email: 'no-such@xenon.local', password: 'whatever' });
         (0, chai_1.expect)(login.status).to.equal(401);

package/lib/test/integration/auth-rate-limit.spec.js

@@ -15,22 +15,25 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const auth_1 = require("../../src/app/routers/auth");
+const scratch_database_1 = require("../helpers/scratch-database");
 describe('login rate limit', function () {
     this.timeout(15000);
+    // Each attempt looks the email address up.
+    (0, scratch_database_1.useScratchDatabase)({ wholeSuite: true });
     it('5 bad logins from one IP → 6th returns 429 with Retry-After', () => __awaiter(this, void 0, void 0, function* () {
         const app = (0, express_1.default)();
         app.use(express_1.default.json());
         app.use('/auth', (0, auth_1.authPublicRouter)());
         for (let i = 0; i < 5; i++) {
-            const r = yield (0, supertest_1.default)(app)
+            const r = yield (0, loopbackRequest_1.default)(app)
                 .post('/auth/login')
                 .set('X-Forwarded-For', '9.9.9.9')
                 .send({ email: 'no@no.com', password: 'no' });
             (0, chai_1.expect)(r.status).to.equal(401);
         }
-        const blocked = yield (0, supertest_1.default)(app)
+        const blocked = yield (0, loopbackRequest_1.default)(app)
             .post('/auth/login')
             .set('X-Forwarded-For', '9.9.9.9')
             .send({ email: 'no@no.com', password: 'no' });

package/lib/test/integration/bug-report-route.spec.js

@@ -48,7 +48,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const sinon_1 = __importDefault(require("sinon"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -57,11 +57,14 @@ const unzipper = __importStar(require("unzipper"));
 const prisma_1 = require("../../src/prisma");
 const config_1 = require("../../src/config");
 const bug_report_1 = __importDefault(require("../../src/app/routers/bug-report"));
+const authMiddleware_1 = require("../../src/middleware/authMiddleware");
 describe('POST /sessions/:id/bug-report (integration)', () => {
     let tmpAssets;
+    let savedAssetsPath;
     const fixtureMp4 = path.join(__dirname, 'fixtures/bug-report/recording.mp4');
     beforeEach(() => {
         tmpAssets = fs.mkdtempSync(path.join(os.tmpdir(), 'xenon-it-'));
+        savedAssetsPath = config_1.config.sessionAssetsPath;
         config_1.config.sessionAssetsPath = tmpAssets;
         const sessionDir = path.join(tmpAssets, 'sess-it', 'video');
         fs.mkdirSync(sessionDir, { recursive: true });
@@ -69,10 +72,27 @@ describe('POST /sessions/:id/bug-report (integration)', () => {
     });
     afterEach(() => {
         sinon_1.default.restore();
+        config_1.config.sessionAssetsPath = savedAssetsPath;
         fs.rmSync(tmpAssets, { recursive: true, force: true });
     });
+    /**
+     * The router sits behind authMiddleware in the API, and its roleGuard
+     * answers 401 to a request with no `req.auth` (27fd825, three days after
+     * this spec). Stand in for the middleware with an admin, as it sets one:
+     * no `teamIds`, so the session needs no Device row to be visible.
+     */
     function makeApp() {
         const app = (0, express_1.default)();
+        app.use((req, _res, next) => {
+            req.auth = {
+                kind: 'user-session',
+                userId: 'usr_admin',
+                role: 'ADMIN',
+                scopes: (0, authMiddleware_1.scopesForRole)('ADMIN'),
+                rateLimit: 100,
+            };
+            next();
+        });
         bug_report_1.default.register(app);
         return app;
     }
@@ -94,7 +114,7 @@ describe('POST /sessions/:id/bug-report (integration)', () => {
         sinon_1.default.stub(prisma_1.prisma.sessionLog, 'findMany').resolves([
             { createdAt: new Date(), title: 'click', response: 'fail' },
         ]);
-        const res = yield (0, supertest_1.default)(makeApp())
+        const res = yield (0, loopbackRequest_1.default)(makeApp())
             .post('/sessions/sess-it/bug-report?mode=full')
             .buffer(true)
             .parse((r, cb) => {

package/lib/test/integration/forgot-password-rate-limit.spec.js

@@ -15,22 +15,25 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const auth_1 = require("../../src/app/routers/auth");
+const scratch_database_1 = require("../helpers/scratch-database");
 describe('forgot-password rate limit', function () {
     this.timeout(15000);
+    // Each attempt looks the email address up.
+    (0, scratch_database_1.useScratchDatabase)({ wholeSuite: true });
     it('3 attempts from one IP -> 4th returns 429 with Retry-After', () => __awaiter(this, void 0, void 0, function* () {
         const app = (0, express_1.default)();
         app.use(express_1.default.json());
         app.use('/auth', (0, auth_1.authPublicRouter)());
         for (let i = 0; i < 3; i++) {
-            const r = yield (0, supertest_1.default)(app)
+            const r = yield (0, loopbackRequest_1.default)(app)
                 .post('/auth/forgot-password')
                 .set('X-Forwarded-For', '7.7.7.7')
                 .send({ email: 'whatever@xenon.local' });
             (0, chai_1.expect)(r.status).to.equal(204);
         }
-        const blocked = yield (0, supertest_1.default)(app)
+        const blocked = yield (0, loopbackRequest_1.default)(app)
             .post('/auth/forgot-password')
             .set('X-Forwarded-For', '7.7.7.7')
             .send({ email: 'whatever@xenon.local' });

package/lib/test/integration/forgot-password.spec.js

@@ -15,20 +15,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const auth_1 = require("../../src/app/routers/auth");
 const typedi_1 = require("typedi");
 const UserService_1 = require("../../src/services/UserService");
 const PasswordResetService_1 = require("../../src/services/PasswordResetService");
 const prisma_1 = require("../../src/prisma");
+const scratch_database_1 = require("../helpers/scratch-database");
 describe('forgot-password flow (integration)', function () {
     this.timeout(30000);
+    (0, scratch_database_1.useScratchDatabase)({ wholeSuite: true });
     let user;
     const email = 'forgot-it@xenon.local';
     before(() => __awaiter(this, void 0, void 0, function* () {
-        yield prisma_1.prisma.passwordResetToken.deleteMany({ where: { user: { email } } });
-        yield prisma_1.prisma.userSession.deleteMany({ where: { user: { email } } });
-        yield prisma_1.prisma.user.deleteMany({ where: { email } });
         user = yield typedi_1.Container.get(UserService_1.UserService).createUser({
             email,
             name: 'Forgot IT',
@@ -36,42 +35,41 @@ describe('forgot-password flow (integration)', function () {
             role: 'ADMIN',
         });
     }));
-    after(() => __awaiter(this, void 0, void 0, function* () {
-        yield prisma_1.prisma.passwordResetToken.deleteMany({ where: { userId: user.id } });
-        yield prisma_1.prisma.userSession.deleteMany({ where: { userId: user.id } });
-        yield prisma_1.prisma.user.delete({ where: { id: user.id } });
-    }));
     function buildApp() {
         const app = (0, express_1.default)();
         app.use(express_1.default.json());
         app.use('/auth', (0, auth_1.authPublicRouter)());
         return app;
     }
+    // A POST with the token in the body: since #265 the token stays out of
+    // request URLs, which the server log records. The old GET /check/:token is
+    // gone, so it answered 404 to every token, valid or not.
+    const check = (app, token) => (0, loopbackRequest_1.default)(app).post('/auth/reset-password/check').send({ token });
     it('full flow: forgot -> DB token -> reset -> login with new password', () => __awaiter(this, void 0, void 0, function* () {
         const app = buildApp();
         // Generic 204 even with wrong email
-        const r1 = yield (0, supertest_1.default)(app).post('/auth/forgot-password').send({ email: 'no@no.com' });
+        const r1 = yield (0, loopbackRequest_1.default)(app).post('/auth/forgot-password').send({ email: 'no@no.com' });
         (0, chai_1.expect)(r1.status).to.equal(204);
-        const r2 = yield (0, supertest_1.default)(app).post('/auth/forgot-password').send({ email });
+        const r2 = yield (0, loopbackRequest_1.default)(app).post('/auth/forgot-password').send({ email });
         (0, chai_1.expect)(r2.status).to.equal(204);
         // Generate a token via the service directly so we have the raw value to reset with
         const { raw } = yield typedi_1.Container.get(PasswordResetService_1.PasswordResetService).createToken(user.id);
-        const check = yield (0, supertest_1.default)(app).get(`/auth/reset-password/check/${raw}`);
-        (0, chai_1.expect)(check.status).to.equal(200);
-        const reset = yield (0, supertest_1.default)(app)
+        const valid = yield check(app, raw);
+        (0, chai_1.expect)(valid.status).to.equal(200);
+        const reset = yield (0, loopbackRequest_1.default)(app)
             .post('/auth/reset-password')
             .send({ token: raw, newPassword: 'NewPassw0rd1' });
         (0, chai_1.expect)(reset.status).to.equal(204);
         // Token now consumed
-        const recheck = yield (0, supertest_1.default)(app).get(`/auth/reset-password/check/${raw}`);
+        const recheck = yield check(app, raw);
         (0, chai_1.expect)(recheck.status).to.equal(404);
         // Login with new password works
-        const login = yield (0, supertest_1.default)(app)
+        const login = yield (0, loopbackRequest_1.default)(app)
             .post('/auth/login')
             .send({ email, password: 'NewPassw0rd1' });
         (0, chai_1.expect)(login.status).to.equal(204);
         // Login with old password fails
-        const oldLogin = yield (0, supertest_1.default)(app)
+        const oldLogin = yield (0, loopbackRequest_1.default)(app)
             .post('/auth/login')
             .send({ email, password: 'old-password-1' });
         (0, chai_1.expect)(oldLogin.status).to.equal(401);
@@ -83,7 +81,8 @@ describe('forgot-password flow (integration)', function () {
             data: { expiresAt: new Date(Date.now() - 1000) },
         });
         const app = buildApp();
-        const r = yield (0, supertest_1.default)(app).get(`/auth/reset-password/check/${raw}`);
+        const r = yield check(app, raw);
         (0, chai_1.expect)(r.status).to.equal(404);
+        (0, chai_1.expect)(r.body).to.deep.equal({ error: 'invalid or expired token' });
     }));
 });

package/lib/test/integration/ios/01iOSSimulator.spec.js

@@ -145,7 +145,7 @@ describe('Max sessions CLI argument test', () => {
         };
         yield (0, device_utils_1.allocateDeviceForSession)(capabilities, 6000, 1000, pluginArgs).catch((error) => (0, chai_1.expect)(error)
             .to.be.an('error')
-            .with.property('message', 'Device is busy or blocked.. Device request: {"platform":"ios","name":"iPhone","deviceType":"simulator"}'));
+            .with.property('message', 'Device is busy or blocked. Device request: {"platform":"ios","name":"iPhone","deviceType":"simulator"}'));
     }));
 });
 describe('IOS Simulator Test', () => {

package/lib/test/integration/ios/02iOSDevices.spec.js

@@ -53,7 +53,7 @@ describe('IOS Test', () => {
         };
         yield (0, device_utils_1.allocateDeviceForSession)(capabilities, 6000, 1000, pluginArgs).catch((error) => (0, chai_1.expect)(error)
             .to.be.an('error')
-            .with.property('message', 'No device matching request.. Device request: {"platform":"ios","name":"iPhone","deviceType":"real"}'));
+            .with.property('message', 'No device matching request. Device request: {"platform":"ios","name":"iPhone","deviceType":"real"}'));
     }));
     it('Should throw error if the IPA does not match with device type real', () => __awaiter(void 0, void 0, void 0, function* () {
         yield (0, device_utils_1.initializeStorage)();

package/lib/test/integration/legacy-deprecation-headers.spec.js

@@ -48,8 +48,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const scratch_database_1 = require("../helpers/scratch-database");
 describe('legacy /reservation headers', () => {
+    // The route reads the phones' reservations from the database.
+    (0, scratch_database_1.useScratchDatabase)({ wholeSuite: true });
     it('GET /reservation returns Deprecation + Sunset + Link headers', () => __awaiter(void 0, void 0, void 0, function* () {
         const router = (yield Promise.resolve().then(() => __importStar(require('../../src/app/routers/reservation')))).default;
         const app = (0, express_1.default)();
@@ -60,7 +63,7 @@ describe('legacy /reservation headers', () => {
             next();
         });
         app.use('/reservation', router);
-        const res = yield (0, supertest_1.default)(app).get('/reservation');
+        const res = yield (0, loopbackRequest_1.default)(app).get('/reservation');
         (0, chai_1.expect)(res.headers['deprecation']).to.equal('true');
         (0, chai_1.expect)(res.headers['sunset']).to.match(/^\d{4}-\d{2}-\d{2}T/);
         (0, chai_1.expect)(res.headers['link']).to.include('rel="alternate"');

package/lib/test/integration/migration.spec.js

@@ -13,15 +13,20 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const bootstrap_1 = require("../../src/services/identity/bootstrap");
 const prisma_1 = require("../../src/prisma");
+const scratch_database_1 = require("../helpers/scratch-database");
 describe('bootstrapIdentity idempotency (integration)', function () {
     this.timeout(30000);
+    (0, scratch_database_1.useScratchDatabase)({ wholeSuite: true });
+    // On a fresh database, so the first run has a super-admin to create. On a
+    // developer's populated one both runs returned at once and proved nothing.
     it('running twice does not create duplicate users', () => __awaiter(this, void 0, void 0, function* () {
         const before = yield prisma_1.prisma.user.count();
+        (0, chai_1.expect)(before, 'a fresh database').to.equal(0);
         yield (0, bootstrap_1.bootstrapIdentity)();
         const after1 = yield prisma_1.prisma.user.count();
+        (0, chai_1.expect)(after1, 'the bootstrap super-admin').to.equal(1);
         yield (0, bootstrap_1.bootstrapIdentity)();
         const after2 = yield prisma_1.prisma.user.count();
         (0, chai_1.expect)(after2).to.equal(after1);
-        (0, chai_1.expect)(after1).to.be.greaterThanOrEqual(before);
     }));
 });

package/lib/test/integration/node-pair-auth-rest.spec.js

@@ -15,15 +15,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const authMiddleware_1 = require("../../src/middleware/authMiddleware");
 const grid_1 = __importDefault(require("../../src/app/routers/grid"));
 const typedi_1 = require("typedi");
 const UserService_1 = require("../../src/services/UserService");
 const ApiKeyService_1 = require("../../src/services/ApiKeyService");
-const prisma_1 = require("../../src/prisma");
+const scratch_database_1 = require("../helpers/scratch-database");
 describe('node pair auth — REST /register (integration)', function () {
     this.timeout(60000);
+    (0, scratch_database_1.useScratchDatabase)({ wholeSuite: true });
     let nodeUser;
     let rawToken;
     before(() => __awaiter(this, void 0, void 0, function* () {
@@ -41,11 +42,6 @@ describe('node pair auth — REST /register (integration)', function () {
         });
         rawToken = tok.raw;
     }));
-    after(() => __awaiter(this, void 0, void 0, function* () {
-        yield prisma_1.prisma.apiKey.deleteMany({ where: { userId: nodeUser.id } });
-        yield prisma_1.prisma.userSession.deleteMany({ where: { userId: nodeUser.id } });
-        yield prisma_1.prisma.user.delete({ where: { id: nodeUser.id } });
-    }));
     function buildApp() {
         const app = (0, express_1.default)();
         app.use(express_1.default.json());
@@ -54,7 +50,7 @@ describe('node pair auth — REST /register (integration)', function () {
         return app;
     }
     it('pair (accessKey, token) → not 401/403', () => __awaiter(this, void 0, void 0, function* () {
-        const r = yield (0, supertest_1.default)(buildApp())
+        const r = yield (0, loopbackRequest_1.default)(buildApp())
             .post('/register')
             .query({ type: 'add' })
             .set('x-xenon-access-key', nodeUser.accessKey)
@@ -64,7 +60,7 @@ describe('node pair auth — REST /register (integration)', function () {
         (0, chai_1.expect)(r.status).to.not.equal(403);
     }));
     it('no auth headers → 401', () => __awaiter(this, void 0, void 0, function* () {
-        const r = yield (0, supertest_1.default)(buildApp())
+        const r = yield (0, loopbackRequest_1.default)(buildApp())
             .post('/register')
             .query({ type: 'add' })
             .send([]);

package/lib/test/integration/ports-router.spec.js

@@ -48,7 +48,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const sinon_1 = __importDefault(require("sinon"));
 describe('POST /xenon/api/ports/allocate', () => {
     let app;
@@ -62,7 +62,7 @@ describe('POST /xenon/api/ports/allocate', () => {
         app.use('/xenon/api/ports', router.makeRouter({ allocator: { allocate: allocateStub } }));
     }));
     it('returns 200 with the allocated ports', () => __awaiter(void 0, void 0, void 0, function* () {
-        const res = yield (0, supertest_1.default)(app)
+        const res = yield (0, loopbackRequest_1.default)(app)
             .post('/xenon/api/ports/allocate')
             .send({ udid: 'u1', host: 'h1', purposes: ['systemPort', 'chromedriverPort'], durationMs: 60000 });
         (0, chai_1.expect)(res.status).to.equal(200);
@@ -70,14 +70,14 @@ describe('POST /xenon/api/ports/allocate', () => {
         (0, chai_1.expect)(allocateStub.calledOnce).to.equal(true);
     }));
     it('returns 400 when purposes is missing or empty', () => __awaiter(void 0, void 0, void 0, function* () {
-        const res = yield (0, supertest_1.default)(app)
+        const res = yield (0, loopbackRequest_1.default)(app)
             .post('/xenon/api/ports/allocate')
             .send({ udid: 'u1', host: 'h1', durationMs: 60000 });
         (0, chai_1.expect)(res.status).to.equal(400);
     }));
     it('returns 500 on allocator failure', () => __awaiter(void 0, void 0, void 0, function* () {
         allocateStub.rejects(new Error('boom'));
-        const res = yield (0, supertest_1.default)(app)
+        const res = yield (0, loopbackRequest_1.default)(app)
             .post('/xenon/api/ports/allocate')
             .send({ udid: 'u1', host: 'h1', purposes: ['systemPort'], durationMs: 60000 });
         (0, chai_1.expect)(res.status).to.equal(500);