@xenon-device-management/xenon 2.14.0 → 2.16.0

package/lib/test/unit/android-adb-retry.spec.js

@@ -0,0 +1,112 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const adbkit_1 = __importDefault(require("@devicefarmer/adbkit"));
+const appium_adb_1 = require("appium-adb");
+const test_container_1 = require("../helpers/test-container");
+const RETRY_MS = 60000;
+/**
+ * When adb couldn't be started, or its device tracking couldn't, the server
+ * logged "Could not find ADB" without the reason and never looked again: every
+ * later discovery answered no phones until a restart, even once adb worked
+ * (an SDK installed, a stuck adb server killed). It now says why, and tries
+ * again a minute later.
+ */
+describe('Android discovery when adb is unavailable', () => {
+    const sandbox = sinon_1.default.createSandbox();
+    let manager;
+    let createADB;
+    let trackDevices;
+    let errors;
+    let clock;
+    let savedNodeEnv;
+    const workingAdb = () => ({
+        adbRemoteHost: null,
+        getConnectedDevices: sandbox.stub().resolves([]),
+    });
+    beforeEach(() => {
+        savedNodeEnv = process.env.NODE_ENV;
+        clock = sandbox.useFakeTimers({ now: Date.now(), toFake: ['Date'] });
+        createADB = sandbox.stub(appium_adb_1.ADB, 'createADB');
+        trackDevices = sandbox.stub().resolves({ on: sandbox.stub() });
+        sandbox.stub(adbkit_1.default, 'createClient').returns({ trackDevices });
+        manager = (0, test_container_1.createTestAndroidManager)({ platform: 'android' });
+        sandbox.stub(manager, 'requireSdkRoot').resolves();
+        errors = sandbox.stub(manager.log, 'error');
+    });
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        sandbox.restore();
+        if (savedNodeEnv === undefined)
+            delete process.env.NODE_ENV;
+        else
+            process.env.NODE_ENV = savedNodeEnv;
+        yield (0, test_container_1.resetTestContainer)();
+    }));
+    const discover = () => manager.getDevices({ androidDeviceType: 'both' }, []);
+    it('says why adb could not be started', () => __awaiter(void 0, void 0, void 0, function* () {
+        createADB.rejects(new Error('Could not find adb. spawn adb ENOENT'));
+        (0, chai_1.expect)(yield discover()).to.deep.equal([]);
+        const logged = errors.getCalls().map((c) => String(c.args[0]));
+        (0, chai_1.expect)(logged.some((m) => m.includes('spawn adb ENOENT')), logged.join('\n')).to.equal(true);
+    }));
+    it('tries adb again a minute later, and not before', () => __awaiter(void 0, void 0, void 0, function* () {
+        const adb = workingAdb();
+        createADB.onFirstCall().rejects(new Error('spawn adb ENOENT'));
+        createADB.onSecondCall().resolves(adb);
+        yield discover();
+        clock.tick(RETRY_MS - 1000);
+        yield discover();
+        (0, chai_1.expect)(createADB.callCount, 'within the minute').to.equal(1);
+        clock.tick(2000);
+        yield discover();
+        (0, chai_1.expect)(createADB.callCount, 'after the minute').to.equal(2);
+        (0, chai_1.expect)(adb.getConnectedDevices.called, 'discovery ran').to.equal(true);
+    }));
+    it('says why device tracking failed, keeps listing phones, and tries it again', () => __awaiter(void 0, void 0, void 0, function* () {
+        process.env.NODE_ENV = 'development';
+        const adb = workingAdb();
+        createADB.resolves(adb);
+        trackDevices.onFirstCall().rejects(new Error('connect ECONNREFUSED 127.0.0.1:5037'));
+        yield discover();
+        const logged = errors.getCalls().map((c) => String(c.args[0]));
+        (0, chai_1.expect)(logged.some((m) => m.includes('ECONNREFUSED')), logged.join('\n')).to.equal(true);
+        yield discover();
+        (0, chai_1.expect)(adb.getConnectedDevices.callCount, 'phones still listed').to.equal(2);
+        (0, chai_1.expect)(trackDevices.callCount, 'within the minute').to.equal(1);
+        clock.tick(RETRY_MS + 1000);
+        yield discover();
+        (0, chai_1.expect)(trackDevices.callCount, 'after the minute').to.equal(2);
+    }));
+    it('starts one device tracker when two discoveries start adb at once', () => __awaiter(void 0, void 0, void 0, function* () {
+        // Each tracker runs the whole plug-in handling again for every phone
+        // plugged in, and nothing could end the extra one.
+        process.env.NODE_ENV = 'development';
+        createADB.resolves(workingAdb());
+        const pending = [];
+        trackDevices.callsFake(() => new Promise((resolve) => pending.push(() => resolve({ on: sandbox.stub() }))));
+        const both = Promise.all([discover(), discover()]);
+        while (pending.length === 0)
+            yield new Promise((r) => setImmediate(r));
+        // Time for a second discovery to reach the tracker too, if it would.
+        for (let i = 0; i < 20; i++)
+            yield new Promise((r) => setImmediate(r));
+        pending.forEach((start) => start());
+        yield both;
+        (0, chai_1.expect)(createADB.callCount, 'adb started').to.equal(1);
+        (0, chai_1.expect)(trackDevices.callCount, 'trackers started').to.equal(1);
+    }));
+});

package/lib/test/unit/android-h264-viewers.spec.js

@@ -0,0 +1,272 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const http_1 = __importDefault(require("http"));
+const chai_1 = require("chai");
+const typedi_1 = require("typedi");
+const ws_1 = require("ws");
+const AndroidH264StreamService_1 = __importDefault(require("../../src/device-managers/android/AndroidH264StreamService"));
+const h264StreamWs_1 = require("../../src/app/ws/h264StreamWs");
+const PluginContext_1 = require("../../src/PluginContext");
+const container_registration_1 = require("../helpers/container-registration");
+const loopbackServer_1 = require("../helpers/loopbackServer");
+/**
+ * Which viewers an H.264 capture outlives once a page has asked for MJPEG.
+ *
+ * A page whose H.264 player fails (a device control page, or a Live devices
+ * tile) asks for MJPEG (`stream/start` with `player: 'mjpeg'`). The phone may
+ * have other viewers still playing its H.264 preview: another tile, another
+ * tab, another admin. Ending the capture under them froze their picture on
+ * its last frame. So the capture ends when nobody watches it: at once if
+ * nobody does, else the moment the last one leaves, and never after the
+ * ten-minute idle wait an unwatched H.264 capture otherwise gets.
+ */
+const UDID = 'R58M123';
+const key = (n) => ({ type: 'key', data: Buffer.from([n]), ptsMs: n });
+// The capture seam (openCapture) is stubbed, as in android-h264-service.spec.ts.
+function make() {
+    const svc = Object.create(AndroidH264StreamService_1.default.prototype);
+    svc.sessions = new Map();
+    svc.startPromises = new Map();
+    svc.scrcpyIncompatible = new Set();
+    return svc;
+}
+/** A service whose next capture is under the test's control. */
+function withCapture() {
+    const svc = make();
+    const capture = {
+        kills: 0,
+        push: () => undefined,
+    };
+    let release = () => undefined;
+    let held = false;
+    svc.openCapture = (_udid, onPacket) => __awaiter(this, void 0, void 0, function* () {
+        capture.push = onPacket;
+        if (held)
+            yield new Promise((r) => (release = r));
+        onPacket({ type: 'config', data: Buffer.from([0]), ptsMs: 0 });
+        return {
+            kill: () => {
+                capture.kills += 1;
+            },
+        };
+    });
+    return {
+        svc,
+        capture,
+        /** Keep the next capture starting until `finishStart()`. */
+        holdStart: () => (held = true),
+        finishStart: () => release(),
+    };
+}
+/** A viewer's socket: what it received, and how it leaves. */
+function watch(mux) {
+    const got = [];
+    const leave = mux.addClient((p) => got.push(p.type));
+    return { got, leave };
+}
+/** Waits for `done()`, a few milliseconds at a time: a socket's close lands on the server later. */
+function until(done, what) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const by = Date.now() + 2000;
+        while (!done()) {
+            if (Date.now() > by)
+                throw new Error(`timed out waiting until ${what}`);
+            yield new Promise((r) => setTimeout(r, 5));
+        }
+    });
+}
+describe('AndroidH264StreamService: a page that asks for MJPEG', () => {
+    const loopback = (0, loopbackServer_1.loopbackServers)();
+    let restoreContainer;
+    beforeEach(() => {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(PluginContext_1.PluginContext);
+        typedi_1.Container.set(PluginContext_1.PluginContext, { pluginArgs: {} });
+    });
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        restoreContainer();
+        yield loopback.closeAll();
+    }));
+    it('ends the H.264 capture at once when nobody watches it', () => __awaiter(void 0, void 0, void 0, function* () {
+        const { svc, capture } = withCapture();
+        yield svc.start(UDID);
+        yield svc.endWhenUnwatched(UDID);
+        (0, chai_1.expect)(capture.kills).to.equal(1);
+        (0, chai_1.expect)(svc.getMultiplexer(UDID)).to.equal(undefined);
+    }));
+    it('keeps it for a viewer still playing it', () => __awaiter(void 0, void 0, void 0, function* () {
+        const { svc, capture } = withCapture();
+        const viewer = watch(yield svc.start(UDID));
+        yield svc.endWhenUnwatched(UDID);
+        (0, chai_1.expect)(capture.kills).to.equal(0);
+        capture.push(key(1));
+        (0, chai_1.expect)(viewer.got).to.deep.equal(['config', 'key']);
+    }));
+    it('ends it the moment its last viewer leaves, not after the idle wait', () => __awaiter(void 0, void 0, void 0, function* () {
+        const { svc, capture } = withCapture();
+        const mux = yield svc.start(UDID);
+        const a = watch(mux);
+        const b = watch(mux);
+        yield svc.endWhenUnwatched(UDID);
+        a.leave();
+        (0, chai_1.expect)(capture.kills, 'b still plays it').to.equal(0);
+        b.leave();
+        (0, chai_1.expect)(capture.kills).to.equal(1);
+        (0, chai_1.expect)(svc.getMultiplexer(UDID)).to.equal(undefined);
+    }));
+    it('serves a viewer who joins before then, and ends when they leave too', () => __awaiter(void 0, void 0, void 0, function* () {
+        const { svc, capture } = withCapture();
+        const a = watch(yield svc.start(UDID));
+        yield svc.endWhenUnwatched(UDID);
+        const late = watch(yield svc.start(UDID));
+        a.leave();
+        (0, chai_1.expect)(capture.kills).to.equal(0);
+        capture.push(key(2));
+        (0, chai_1.expect)(late.got).to.include('key');
+        late.leave();
+        (0, chai_1.expect)(capture.kills).to.equal(1);
+    }));
+    it('does nothing when no H.264 capture runs for the phone', () => __awaiter(void 0, void 0, void 0, function* () {
+        const { svc, capture } = withCapture();
+        yield svc.endWhenUnwatched(UDID);
+        (0, chai_1.expect)(capture.kills).to.equal(0);
+        (0, chai_1.expect)(svc.getMultiplexer(UDID)).to.equal(undefined);
+    }));
+    it('leaves a capture that is still starting to the viewer starting it', () => __awaiter(void 0, void 0, void 0, function* () {
+        // A tile's socket starts the capture it is about to watch: ending it
+        // mid-start would leave that capture running with nothing to stop it.
+        const { svc, capture, holdStart, finishStart } = withCapture();
+        holdStart();
+        const starting = svc.start(UDID);
+        yield Promise.resolve();
+        yield svc.endWhenUnwatched(UDID);
+        finishStart();
+        const viewer = watch(yield starting);
+        (0, chai_1.expect)(capture.kills).to.equal(0);
+        viewer.leave();
+        (0, chai_1.expect)(capture.kills).to.equal(1);
+    }));
+    it('ends a capture whose viewer never came at the watchdog’s next look', () => __awaiter(void 0, void 0, void 0, function* () {
+        const { svc, capture, holdStart, finishStart } = withCapture();
+        holdStart();
+        const starting = svc.start(UDID);
+        yield Promise.resolve();
+        yield svc.endWhenUnwatched(UDID);
+        finishStart();
+        yield starting;
+        svc.sweep(Date.now());
+        (0, chai_1.expect)(capture.kills).to.equal(1);
+    }));
+    it('keeps the idle wait for a capture no page asked to end', () => __awaiter(void 0, void 0, void 0, function* () {
+        const { svc, capture } = withCapture();
+        yield svc.start(UDID);
+        svc.sweep(Date.now());
+        svc.sweep(Date.now() + 60000);
+        (0, chai_1.expect)(capture.kills).to.equal(0);
+        (0, chai_1.expect)(svc.getMultiplexer(UDID)).to.not.equal(undefined);
+    }));
+    it('does not end a newer capture when an older one’s last viewer leaves', () => __awaiter(void 0, void 0, void 0, function* () {
+        const { svc, capture } = withCapture();
+        const old = watch(yield svc.start(UDID));
+        yield svc.endWhenUnwatched(UDID);
+        yield svc.stop(UDID); // a recording took the phone, say
+        (0, chai_1.expect)(capture.kills).to.equal(1);
+        yield svc.start(UDID);
+        old.leave();
+        (0, chai_1.expect)(capture.kills).to.equal(1);
+        (0, chai_1.expect)(svc.getMultiplexer(UDID)).to.not.equal(undefined);
+    }));
+    it('ends it when the last viewer’s H.264 socket closes', () => __awaiter(void 0, void 0, void 0, function* () {
+        // The socket route (h264StreamWs.ts), as a tile's player opens and closes it.
+        const { svc, capture } = withCapture();
+        const server = yield loopback.serve(http_1.default.createServer());
+        (0, h264StreamWs_1.attachH264Ws)(server, {
+            redeem: () => __awaiter(void 0, void 0, void 0, function* () { return ({ actorId: 'usr_alice' }); }),
+            startStream: (udid) => svc.start(udid),
+        });
+        const { port } = server.address();
+        // The config packet is sent the moment the socket joins the multiplexer.
+        const viewer = () => new Promise((resolve, reject) => {
+            const ws = new ws_1.WebSocket(`ws://127.0.0.1:${port}/xenon/api/control/${UDID}/stream/h264?ticket=t`);
+            ws.once('message', () => resolve(ws));
+            ws.once('error', reject);
+        });
+        const tile = yield viewer();
+        const otherTab = yield viewer();
+        const viewers = () => { var _a, _b; return (_b = (_a = svc.getMultiplexer(UDID)) === null || _a === void 0 ? void 0 : _a.clientCount) !== null && _b !== void 0 ? _b : 0; };
+        yield svc.endWhenUnwatched(UDID);
+        tile.close();
+        yield until(() => viewers() === 1, 'the tile’s socket has left');
+        (0, chai_1.expect)(capture.kills, 'the other tab still plays it').to.equal(0);
+        otherTab.close();
+        yield until(() => capture.kills === 1, 'the capture has ended');
+        (0, chai_1.expect)(svc.getMultiplexer(UDID)).to.equal(undefined);
+    }));
+});
+/**
+ * A capture stopped while viewers still play it: a recording starting on the
+ * phone (ensureMjpegForRecording), or a stream/stop. Their sockets stayed open
+ * with no frames, so the picture froze on its last frame and the page never
+ * fell back to MJPEG.
+ */
+describe('AndroidH264StreamService: a capture stopped under its viewers', () => {
+    const loopback = (0, loopbackServer_1.loopbackServers)();
+    let restoreContainer;
+    beforeEach(() => {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(PluginContext_1.PluginContext);
+        typedi_1.Container.set(PluginContext_1.PluginContext, { pluginArgs: {} });
+    });
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        restoreContainer();
+        yield loopback.closeAll();
+    }));
+    it('closes its viewers’ sockets with 1012 when the capture is stopped under them', () => __awaiter(void 0, void 0, void 0, function* () {
+        // 1012 says the stream ended: the player shows MJPEG, without asking the
+        // server to end an H.264 capture that is already gone.
+        const { svc, capture } = withCapture();
+        const server = yield loopback.serve(http_1.default.createServer());
+        (0, h264StreamWs_1.attachH264Ws)(server, {
+            redeem: () => __awaiter(void 0, void 0, void 0, function* () { return ({ actorId: 'usr_alice' }); }),
+            startStream: (udid) => svc.start(udid),
+        });
+        const { port } = server.address();
+        const sockets = [];
+        // How the socket ended, or 'still open' if it hadn't within 2 s.
+        const viewer = () => new Promise((resolve, reject) => {
+            const ws = new ws_1.WebSocket(`ws://127.0.0.1:${port}/xenon/api/control/${UDID}/stream/h264?ticket=t`);
+            sockets.push(ws);
+            const closed = new Promise((r) => {
+                const timer = setTimeout(() => r('still open'), 2000);
+                ws.once('close', (code, reason) => {
+                    clearTimeout(timer);
+                    r([code, reason.toString()]);
+                });
+            });
+            ws.once('message', () => resolve({ closed }));
+            ws.once('error', reject);
+        });
+        try {
+            const tile = yield viewer();
+            const otherTab = yield viewer();
+            yield svc.stop(UDID);
+            (0, chai_1.expect)(yield tile.closed).to.deep.equal([1012, 'stream ended']);
+            (0, chai_1.expect)(yield otherTab.closed).to.deep.equal([1012, 'stream ended']);
+        }
+        finally {
+            sockets.forEach((ws) => ws.terminate());
+        }
+        (0, chai_1.expect)(capture.kills).to.equal(1);
+    }));
+});

package/lib/test/unit/android-preview-hold.spec.js

@@ -54,6 +54,7 @@ const device_store_1 = require("../../src/data-service/device-store");
 const recording_store_1 = require("../../src/services/recording/recording-store");
 const AndroidStreamService_1 = __importDefault(require("../../src/device-managers/android/AndroidStreamService"));
 const AndroidH264StreamService_1 = __importDefault(require("../../src/device-managers/android/AndroidH264StreamService"));
+const H264Multiplexer_1 = require("../../src/device-managers/android/H264Multiplexer");
 const previewHold_1 = require("../../src/device-managers/android/previewHold");
 const UDID = 'android-1';
 const HOLD = `manual_user-1_${UDID}`;
@@ -126,7 +127,7 @@ describe('Android live-preview hold', () => {
         it('releases the hold once nobody has watched for 10 minutes', () => __awaiter(void 0, void 0, void 0, function* () {
             const svc = new AndroidH264StreamService_1.default();
             const kill = sinon_1.default.spy();
-            svc.sessions.set(UDID, { status: 'running', mux: { clientCount: 0 }, capture: { kill } });
+            svc.sessions.set(UDID, { status: 'running', mux: new H264Multiplexer_1.H264Multiplexer(), capture: { kill } });
             yield clock.tickAsync(60000); // first sweep notes it is empty
             yield clock.tickAsync(11 * 60000);
             (0, chai_1.expect)(kill.called, 'capture stopped').to.equal(true);
@@ -137,7 +138,7 @@ describe('Android live-preview hold', () => {
             const svc = new AndroidH264StreamService_1.default();
             svc.sessions.set(UDID, {
                 status: 'running',
-                mux: { clientCount: 0 },
+                mux: new H264Multiplexer_1.H264Multiplexer(),
                 capture: { kill() { } },
             });
             yield clock.tickAsync(12 * 60000);

package/lib/test/unit/apikeys-router.spec.js

@@ -0,0 +1,84 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const express_1 = __importDefault(require("express"));
+const typedi_1 = require("typedi");
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const apikeys_1 = require("../../src/app/routers/apikeys");
+const ApiKeyService_1 = require("../../src/services/ApiKeyService");
+/**
+ * POST /apikeys stores the scopes it is given. It stored any string, so a
+ * typo (`session`, `Admin`) made a key that silently had none of the scopes
+ * its maker meant, and a list shown back on the API keys page that no check
+ * reads. It takes the four scopes POST /profile/tokens takes.
+ */
+describe('POST /apikeys takes only scopes that exist', () => {
+    let create;
+    function app(auth = {}) {
+        const a = (0, express_1.default)();
+        a.use(express_1.default.json());
+        a.use((req, _res, next) => {
+            req.auth = Object.assign({ kind: 'user-session', userId: 'admin1', role: 'SUPER_ADMIN', scopes: 'admin,devices,sessions,read' }, auth);
+            next();
+        });
+        a.use('/apikeys', (0, apikeys_1.apiKeysRouter)());
+        return a;
+    }
+    beforeEach(() => {
+        create = sinon_1.default.stub(typedi_1.Container.get(ApiKeyService_1.ApiKeyService), 'create').resolves({ id: 'k1', raw: 'raw' });
+    });
+    afterEach(() => sinon_1.default.restore());
+    for (const scopes of [['root'], ['sessions', 'Admin'], ['session'], [42]]) {
+        it(`refuses ${JSON.stringify(scopes)}`, () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = yield (0, loopbackRequest_1.default)(app()).post('/apikeys').send({ name: 'CI', scopes });
+            (0, chai_1.expect)(r.status).to.equal(400);
+            (0, chai_1.expect)(r.body.error).to.equal('scopes must be some of read, sessions, devices, admin');
+            (0, chai_1.expect)(create.called).to.equal(false);
+        }));
+    }
+    it('creates a key with known scopes', () => __awaiter(void 0, void 0, void 0, function* () {
+        const r = yield (0, loopbackRequest_1.default)(app())
+            .post('/apikeys')
+            .send({ name: 'CI', scopes: ['sessions', 'devices'] });
+        (0, chai_1.expect)(r.status).to.equal(200);
+        (0, chai_1.expect)(create.firstCall.args[0].scopes).to.deep.equal(['sessions', 'devices']);
+    }));
+    // Made with a credential that expires, a key ends no later than it: an
+    // admin's 1-hour Bearer token made itself a key that never expired.
+    describe('from a credential that expires', () => {
+        const inAnHour = new Date(Date.now() + 3600000);
+        const bearer = () => app({ kind: 'bearer', scopes: 'admin', credentialExpiresAt: inAnHour.getTime() });
+        it('expires with that credential when no expiresAt is asked for', () => __awaiter(void 0, void 0, void 0, function* () {
+            var _a;
+            const r = yield (0, loopbackRequest_1.default)(bearer())
+                .post('/apikeys')
+                .send({ name: 'CI', scopes: ['sessions'] });
+            (0, chai_1.expect)(r.status).to.equal(200);
+            (0, chai_1.expect)(r.body.expiresAt).to.equal(inAnHour.toISOString());
+            (0, chai_1.expect)((_a = create.firstCall.args[0].expiresAt) === null || _a === void 0 ? void 0 : _a.getTime()).to.equal(inAnHour.getTime());
+        }));
+        it('refuses an expiresAt later than that credential', () => __awaiter(void 0, void 0, void 0, function* () {
+            const later = new Date(inAnHour.getTime() + 60000).toISOString();
+            const r = yield (0, loopbackRequest_1.default)(bearer())
+                .post('/apikeys')
+                .send({ name: 'CI', scopes: ['sessions'], expiresAt: later });
+            (0, chai_1.expect)(r.status).to.equal(400);
+            (0, chai_1.expect)(r.body.error).to.match(/later than the credential/);
+            (0, chai_1.expect)(create.called).to.equal(false);
+        }));
+    });
+});

package/lib/test/unit/authMiddleware.bearer.spec.js

@@ -65,6 +65,15 @@ describe('authMiddleware — Bearer branch', () => {
         (0, chai_1.expect)(req.auth.userId).to.equal('u1');
         (0, chai_1.expect)(req.auth.scopes).to.equal('devices,read');
     }));
+    it("drops admin from a demoted user's token: req.auth.scopes follows the role now", () => __awaiter(void 0, void 0, void 0, function* () {
+        // `user` is a MEMBER: the token was minted while they were an admin.
+        const token = yield keySvc.sign({ sub: 'u1', scopes: 'admin,devices,sessions,read' }, { audience: 'xenon-rest', ttlSeconds: 60 });
+        const req = { headers: { authorization: `Bearer ${token}` }, query: {} };
+        const next = sinon_1.default.spy();
+        yield (0, authMiddleware_1.authMiddleware)(req, fakeRes(), next);
+        (0, chai_1.expect)(next.calledOnce).to.equal(true);
+        (0, chai_1.expect)(req.auth.scopes).to.equal('devices,sessions,read');
+    }));
     // Widened by Phase 2a Task 1: the MCP plugin's tools call this same REST
     // surface with a gateway-injected xenon-mcp-audience token, so it must be
     // accepted here too (see authMiddleware.mcpAudience.spec.ts for the full

package/lib/test/unit/authMiddleware.credentialLifetime.spec.js

@@ -0,0 +1,149 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const typedi_1 = require("typedi");
+const authMiddleware_1 = require("../../src/middleware/authMiddleware");
+const ApiKeyService_1 = require("../../src/services/ApiKeyService");
+const UserSessionService_1 = require("../../src/services/UserSessionService");
+const UserService_1 = require("../../src/services/UserService");
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const prisma_1 = require("../../src/prisma");
+const container_registration_1 = require("../helpers/container-registration");
+/**
+ * How long the credential behind a request lasts, as authMiddleware sees it.
+ *
+ * - req.auth.credentialExpiresAt: when a Bearer token or an API key stops
+ *   working, so what it mints (POST /auth/token, POST /profile/tokens) can't
+ *   outlive it.
+ * - The dashboard cookie's Max-Age, renewed on every request, follows
+ *   XENON_USER_SESSION_TTL_MS. It was renewed at a fixed 24 hours, so a
+ *   longer setting signed people out after a day away anyway.
+ */
+describe('authMiddleware: how long the credential lasts', () => {
+    let dir;
+    let keys;
+    let restore;
+    let ttlBefore;
+    const member = { id: 'u1', role: 'MEMBER', status: 'ACTIVE' };
+    function res() {
+        const out = { cookies: [] };
+        out.status = (c) => {
+            out.code = c;
+            return out;
+        };
+        out.json = (b) => {
+            out.body = b;
+            return out;
+        };
+        out.cookie = (name, value, opts) => {
+            out.cookies.push({ name, value, opts });
+            return out;
+        };
+        return out;
+    }
+    function run(headers) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const req = { headers, query: {}, path: '/x' };
+            const r = res();
+            const next = sinon_1.default.spy();
+            yield (0, authMiddleware_1.authMiddleware)(req, r, next);
+            (0, chai_1.expect)(next.calledOnce, `refused: ${JSON.stringify(r.body)}`).to.equal(true);
+            return { req, res: r };
+        });
+    }
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        ttlBefore = process.env.XENON_USER_SESSION_TTL_MS;
+        restore = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, UserService_1.UserService, ApiKeyService_1.ApiKeyService, UserSessionService_1.UserSessionService);
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-cred-life-'));
+        keys = new JwtKeyService_1.JwtKeyService();
+        yield keys.init(dir);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, keys);
+        typedi_1.Container.set(UserService_1.UserService, { findById: sinon_1.default.stub().resolves(member) });
+        typedi_1.Container.set(ApiKeyService_1.ApiKeyService, {
+            verifyPair: sinon_1.default.stub().resolves(null),
+            verify: sinon_1.default.stub().resolves(null),
+        });
+        const sessions = new UserSessionService_1.UserSessionService();
+        sinon_1.default.stub(sessions, 'resolve').resolves(null);
+        typedi_1.Container.set(UserSessionService_1.UserSessionService, sessions);
+        sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([]);
+    }));
+    afterEach(() => {
+        if (ttlBefore === undefined)
+            delete process.env.XENON_USER_SESSION_TTL_MS;
+        else
+            process.env.XENON_USER_SESSION_TTL_MS = ttlBefore;
+        sinon_1.default.restore();
+        restore();
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    describe('req.auth.credentialExpiresAt', () => {
+        it("is a Bearer token's exp", () => __awaiter(void 0, void 0, void 0, function* () {
+            const token = yield keys.sign({ sub: 'u1', scopes: 'read' }, { audience: 'xenon-rest', ttlSeconds: 600 });
+            const { req } = yield run({ authorization: `Bearer ${token}` });
+            const exp = JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString()).exp;
+            (0, chai_1.expect)(req.auth.credentialExpiresAt).to.equal(exp * 1000);
+        }));
+        it("is an API key's expiresAt, and absent for a key that never expires", () => __awaiter(void 0, void 0, void 0, function* () {
+            const expiresAt = new Date(Date.now() + 3600000);
+            const verifyPair = typedi_1.Container.get(ApiKeyService_1.ApiKeyService).verifyPair;
+            verifyPair.resolves({ id: 'k1', userId: 'u1', scopes: 'read', rateLimit: 300, expiresAt });
+            const pair = { 'x-xenon-access-key': 'xen_a', 'x-xenon-token': 'tk' };
+            (0, chai_1.expect)((yield run(pair)).req.auth.credentialExpiresAt).to.equal(expiresAt.getTime());
+            verifyPair.resolves({
+                id: 'k1',
+                userId: 'u1',
+                scopes: 'read',
+                rateLimit: 300,
+                expiresAt: null,
+            });
+            (0, chai_1.expect)((yield run(pair)).req.auth.credentialExpiresAt).to.equal(undefined);
+        }));
+        it('is absent for a dashboard sign-in, which renews itself', () => __awaiter(void 0, void 0, void 0, function* () {
+            typedi_1.Container.get(UserSessionService_1.UserSessionService).resolve.resolves({
+                id: 's1',
+                userId: 'u1',
+            });
+            const { req } = yield run({ cookie: 'xenon_dashboard_session=s1' });
+            (0, chai_1.expect)(req.auth.kind).to.equal('user-session');
+            (0, chai_1.expect)(req.auth.credentialExpiresAt).to.equal(undefined);
+        }));
+    });
+    describe("the dashboard cookie's renewed Max-Age", () => {
+        it('follows XENON_USER_SESSION_TTL_MS, longer than a day included', () => __awaiter(void 0, void 0, void 0, function* () {
+            process.env.XENON_USER_SESSION_TTL_MS = String(7 * 24 * 3600000);
+            typedi_1.Container.get(UserSessionService_1.UserSessionService).resolve.resolves({
+                id: 's1',
+                userId: 'u1',
+            });
+            const { res: r } = yield run({ cookie: 'xenon_dashboard_session=s1' });
+            (0, chai_1.expect)(r.cookies[0].opts.maxAge).to.equal(7 * 24 * 3600000);
+        }));
+        it('is 24 hours by default', () => __awaiter(void 0, void 0, void 0, function* () {
+            delete process.env.XENON_USER_SESSION_TTL_MS;
+            typedi_1.Container.get(UserSessionService_1.UserSessionService).resolve.resolves({
+                id: 's1',
+                userId: 'u1',
+            });
+            const { res: r } = yield run({ cookie: 'xenon_dashboard_session=s1' });
+            (0, chai_1.expect)(r.cookies[0].opts.maxAge).to.equal(24 * 3600000);
+        }));
+    });
+});