@xenon-device-management/xenon 2.14.0 → 2.16.0

package/lib/test/unit/omni-vision.spec.js

@@ -70,16 +70,14 @@ describe('OmniVisionService Unit Tests', () => {
         (0, chai_1.expect)(result === null || result === void 0 ? void 0 : result.id).to.contain('omni_ai_');
         (0, chai_1.expect)(result === null || result === void 0 ? void 0 : result.rect).to.deep.equal({ x: 30, y: 30, width: 40, height: 40 });
     }));
-    it('getVirtualElement should retrieve stored elements', () => __awaiter(void 0, void 0, void 0, function* () {
+    it('getVirtualElement gives back an element kept for its session, to that session only', () => __awaiter(void 0, void 0, void 0, function* () {
         sinon_1.default.stub(AIService_1.AI_SERVICE, 'visualFind').resolves({ x: 50, y: 50 });
         const created = yield omniService.findByIcon(mockDriver, 'back');
-        if (created) {
-            const retrieved = omniService.getVirtualElement(created.id);
-            (0, chai_1.expect)(retrieved).to.deep.equal(created);
-        }
-        else {
+        if (!created)
             throw new Error('Failed to create mock virtual element');
-        }
+        omniService.remember('session-1', created);
+        (0, chai_1.expect)(omniService.getVirtualElement(created.id, 'session-1')).to.deep.equal(created);
+        (0, chai_1.expect)(omniService.getVirtualElement(created.id, 'session-2')).to.equal(undefined);
     }));
     it('analyzeScreen should combine OCR and AI insights', () => __awaiter(void 0, void 0, void 0, function* () {
         const mockWorker = {

package/lib/test/unit/openapi-for-site.spec.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+// scripts/ is plain CommonJS that the export script also loads, so it is
+// required rather than imported.
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const site = require('../../scripts/lib/openapi-for-site');
+const { forSite, VERSION_TOKEN, assertNoRawDocumentLink } = site;
+/**
+ * The documentation site publishes the server's OpenAPI document. The spec
+ * names the version it was built from in `info`, so a committed copy would
+ * change on every release. forSite swaps that version for a token the site's
+ * build fills in, and points the "raw document" link at the user's own server,
+ * since the link would otherwise lead to the docs host.
+ */
+describe('openapi for the documentation site', () => {
+    const version = '2.13.1';
+    const makeSpec = () => ({
+        info: {
+            version,
+            description: `This reference describes version **${version}**. The raw OpenAPI document is at [\`/xenon/api-docs.json\`](/xenon/api-docs.json).`,
+        },
+        paths: { '/api/devices': {} },
+    });
+    it('puts the version token where the version was', () => {
+        const result = forSite(makeSpec(), version);
+        (0, chai_1.expect)(result.info.version).to.equal('__XENON_VERSION__');
+        (0, chai_1.expect)(VERSION_TOKEN).to.equal('__XENON_VERSION__');
+        (0, chai_1.expect)(result.info.description).to.contain('version **__XENON_VERSION__**');
+    });
+    it('leaves no trace of the version anywhere in the result', () => {
+        (0, chai_1.expect)(JSON.stringify(forSite(makeSpec(), version))).to.not.contain(version);
+    });
+    it('points the raw-document line at the reader’s own server, with no link', () => {
+        const { description } = forSite(makeSpec(), version).info;
+        (0, chai_1.expect)(description).to.contain('`/xenon/api-docs.json` on your server');
+        (0, chai_1.expect)(description).to.not.contain('](/xenon/api-docs.json)');
+    });
+    it('keeps the paths exactly as they were', () => {
+        (0, chai_1.expect)(forSite(makeSpec(), version).paths).to.deep.equal(makeSpec().paths);
+    });
+    it('does not change the object it is given', () => {
+        const spec = makeSpec();
+        forSite(spec, version);
+        (0, chai_1.expect)(spec).to.deep.equal(makeSpec());
+    });
+    it('refuses an empty or missing version', () => {
+        (0, chai_1.expect)(() => forSite(makeSpec(), '')).to.throw(/version/);
+        (0, chai_1.expect)(() => forSite(makeSpec(), undefined)).to.throw(/version/);
+        (0, chai_1.expect)(() => forSite(makeSpec(), 2.13)).to.throw(/version/);
+    });
+    it('only touches the version inside info', () => {
+        const spec = makeSpec();
+        spec.paths['/api/version'] = { get: { example: { pluginVersion: version } } };
+        const result = forSite(spec, version);
+        (0, chai_1.expect)(result.paths['/api/version'].get.example.pluginVersion).to.equal(version);
+    });
+    describe('the guard against a link to the raw document', () => {
+        const guarded = (description) => {
+            const spec = makeSpec();
+            spec.info.description = description;
+            return JSON.stringify(forSite(spec, version), null, 2);
+        };
+        it('passes the introduction as the server writes it, once forSite has rewritten the link', () => {
+            (0, chai_1.expect)(() => assertNoRawDocumentLink(guarded(makeSpec().info.description))).to.not.throw();
+        });
+        it('catches the link when the introduction is reworded', () => {
+            const text = guarded('Download the [raw document](/xenon/api-docs.json).');
+            (0, chai_1.expect)(() => assertNoRawDocumentLink(text)).to.throw(/still links to \/xenon\/api-docs\.json[\s\S]*src\/app\/swagger\.ts/);
+        });
+        it('catches a link that has a space, an angle bracket or a fragment in its target', () => {
+            (0, chai_1.expect)(() => assertNoRawDocumentLink('a [b]( /xenon/api-docs.json)')).to.throw();
+            (0, chai_1.expect)(() => assertNoRawDocumentLink('a [b](</xenon/api-docs.json>)')).to.throw();
+            (0, chai_1.expect)(() => assertNoRawDocumentLink('a [b](/xenon/api-docs.json#info "title")')).to.throw();
+        });
+        it('lets plain code and other links through', () => {
+            (0, chai_1.expect)(() => assertNoRawDocumentLink('at `/xenon/api-docs.json` on your server, see [the profile](/xenon/profile)')).to.not.throw();
+        });
+    });
+});

package/lib/test/unit/outbound-proxy.spec.js

@@ -0,0 +1,320 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const http_1 = __importDefault(require("http"));
+const axios_1 = __importDefault(require("axios"));
+const typedi_1 = require("typedi");
+const ws_1 = require("ws");
+const forwardToNode_1 = require("../../src/gateway/forwardToNode");
+const hubSessionToken_1 = require("../../src/gateway/hubSessionToken");
+const nodeSocketRelay_1 = require("../../src/app/ws/nodeSocketRelay");
+const PluginContext_1 = require("../../src/PluginContext");
+const IPluginArgs_1 = require("../../src/interfaces/IPluginArgs");
+const outboundProxy_1 = require("../../src/helpers/outboundProxy");
+const SocketClient_1 = require("../../src/services/SocketClient");
+const socket_io_1 = require("socket.io");
+const fake_http_proxy_1 = require("../helpers/fake-http-proxy");
+const PROXY_ENV = [
+    'HTTP_PROXY',
+    'http_proxy',
+    'HTTPS_PROXY',
+    'https_proxy',
+    'NO_PROXY',
+    'no_proxy',
+];
+/**
+ * Xenon's axios calls take a proxy from the environment by axios's rule: the
+ * URL's own scheme's variable, lower-case name first, unless NO_PROXY names
+ * the host. Its other calls to a node didn't:
+ * - a forwarded command, device control action, recording relay and socket
+ *   ticket took HTTP_PROXY or HTTPS_PROXY whatever the scheme, ignored the
+ *   lower-case names and ignored NO_PROXY;
+ * - the live-preview and logcat sockets ignored every proxy, after asking for
+ *   their ticket through one;
+ * - a node fetching its hub's keys (JWKS) ignored every proxy.
+ * They all follow axios's rule now.
+ */
+describe('proxies for the calls Xenon makes to another server', function () {
+    this.timeout(20000);
+    let saved;
+    let proxy;
+    const servers = [];
+    beforeEach(() => __awaiter(this, void 0, void 0, function* () {
+        saved = Object.fromEntries(PROXY_ENV.map((k) => [k, process.env[k]]));
+        for (const k of PROXY_ENV)
+            delete process.env[k];
+        proxy = yield (0, fake_http_proxy_1.startFakeProxy)();
+    }));
+    afterEach(() => __awaiter(this, void 0, void 0, function* () {
+        for (const k of PROXY_ENV) {
+            if (saved[k] === undefined)
+                delete process.env[k];
+            else
+                process.env[k] = saved[k];
+        }
+        yield proxy.close();
+        yield Promise.all(servers.splice(0).map((s) => new Promise((resolve) => {
+            var _a;
+            (_a = s.closeAllConnections) === null || _a === void 0 ? void 0 : _a.call(s);
+            s.close(() => resolve());
+        })));
+    }));
+    /** What `promise` settled with (its error, if it failed), or 'pending' after `ms`. */
+    function settlesWithin(promise, ms) {
+        return __awaiter(this, void 0, void 0, function* () {
+            let timer;
+            const pending = new Promise((resolve) => {
+                timer = setTimeout(() => resolve('pending'), ms);
+            });
+            try {
+                return yield Promise.race([
+                    promise.then((v) => v, (e) => e),
+                    pending,
+                ]);
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        });
+    }
+    /** A server on 127.0.0.1 that answers everything 200, and its origin. */
+    function target(handler) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const server = http_1.default.createServer(handler !== null && handler !== void 0 ? handler : ((_req, res) => {
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end('{}');
+            }));
+            servers.push(server);
+            yield new Promise((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
+            return `http://127.0.0.1:${server.address().port}`;
+        });
+    }
+    describe('the rule', () => {
+        const env = (vars) => vars;
+        it("takes the URL's own scheme's variable, the lower-case name first", () => {
+            const vars = env({ HTTP_PROXY: 'http://upper:1', http_proxy: 'http://lower:1' });
+            (0, chai_1.expect)((0, outboundProxy_1.envProxyFor)('http://node:4723/x', vars)).to.equal('http://lower:1');
+            (0, chai_1.expect)((0, outboundProxy_1.envProxyFor)('https://node/x', env({ HTTP_PROXY: 'http://p:1' }))).to.equal(undefined);
+            (0, chai_1.expect)((0, outboundProxy_1.envProxyFor)('https://node/x', env({ HTTPS_PROXY: 'http://p:2' }))).to.equal('http://p:2');
+            (0, chai_1.expect)((0, outboundProxy_1.envProxyFor)('http://node/x', env({ HTTPS_PROXY: 'http://p:2' }))).to.equal(undefined);
+        });
+        it("treats a WebSocket URL as its scheme's HTTP counterpart", () => {
+            (0, chai_1.expect)((0, outboundProxy_1.envProxyFor)('ws://node/x', env({ HTTP_PROXY: 'http://p:1' }))).to.equal('http://p:1');
+            (0, chai_1.expect)((0, outboundProxy_1.envProxyFor)('wss://node/x', env({ HTTPS_PROXY: 'http://p:2' }))).to.equal('http://p:2');
+        });
+        it('takes none for a host NO_PROXY names: *, the host, or a .suffix of it', () => {
+            const proxied = { HTTP_PROXY: 'http://p:1' };
+            const via = (noProxy, url = 'http://node.lab.example:4723/x') => (0, outboundProxy_1.envProxyFor)(url, env(Object.assign(Object.assign({}, proxied), { NO_PROXY: noProxy })));
+            (0, chai_1.expect)(via('*')).to.equal(undefined);
+            (0, chai_1.expect)(via('other, node.lab.example')).to.equal(undefined);
+            (0, chai_1.expect)(via('.lab.example')).to.equal(undefined);
+            (0, chai_1.expect)(via('lab.example')).to.equal('http://p:1');
+            (0, chai_1.expect)(via('node.lab.example:4723')).to.equal('http://p:1');
+            (0, chai_1.expect)((0, outboundProxy_1.envProxyFor)('http://node/x', env(Object.assign(Object.assign({}, proxied), { no_proxy: 'node', NO_PROXY: 'x' })))).to.equal(undefined);
+        });
+    });
+    describe('a call to a node takes the path an axios call takes', () => {
+        const cases = [
+            { name: 'HTTP_PROXY', vars: (p) => ({ HTTP_PROXY: p }) },
+            { name: 'http_proxy', vars: (p) => ({ http_proxy: p }) },
+            {
+                name: 'HTTP_PROXY, NO_PROXY naming the node',
+                vars: (p) => ({ HTTP_PROXY: p, NO_PROXY: '127.0.0.1' }),
+            },
+            { name: 'HTTP_PROXY, no_proxy=*', vars: (p) => ({ HTTP_PROXY: p, no_proxy: '*' }) },
+            {
+                name: 'HTTP_PROXY, NO_PROXY listing the node second',
+                vars: (p) => ({ HTTP_PROXY: p, NO_PROXY: 'hub.lab, 127.0.0.1' }),
+            },
+            { name: 'only HTTPS_PROXY, for an http node', vars: (p) => ({ HTTPS_PROXY: p }) },
+        ];
+        for (const { name, vars } of cases) {
+            it(name, () => __awaiter(this, void 0, void 0, function* () {
+                Object.assign(process.env, vars(proxy.url));
+                const node = yield target();
+                yield axios_1.default.get(`${node}/by-axios`);
+                yield (0, forwardToNode_1.readAnswer)(yield (0, forwardToNode_1.sendToNode)({ url: `${node}/by-xenon`, method: 'GET', headers: {} }));
+                const axiosProxied = proxy.seen.includes(`GET ${node}/by-axios`);
+                const xenonProxied = proxy.seen.includes(`GET ${node}/by-xenon`);
+                (0, chai_1.expect)(xenonProxied, `forwarded call via the proxy (axios: ${axiosProxied})`).to.equal(axiosProxied);
+            }));
+        }
+    });
+    describe("a node fetching its hub's keys", () => {
+        // A JWS that parses, so jose asks the key set for its key.
+        const token = [
+            Buffer.from(JSON.stringify({ alg: 'RS256', kid: 'k1' })).toString('base64url'),
+            Buffer.from(JSON.stringify({ sid: 's' })).toString('base64url'),
+            'c2lnbmF0dXJl',
+        ].join('.');
+        function fetchKeys(hub) {
+            return __awaiter(this, void 0, void 0, function* () {
+                yield new hubSessionToken_1.HubSessionTokenVerifier(hub).verify(token, 's').catch(() => undefined);
+            });
+        }
+        it('goes through the proxy', () => __awaiter(this, void 0, void 0, function* () {
+            const hub = yield target((_req, res) => {
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end('{"keys":[]}');
+            });
+            process.env.HTTP_PROXY = proxy.url;
+            yield fetchKeys(hub);
+            (0, chai_1.expect)(proxy.seen).to.include(`GET ${hub}/xenon/api/auth/jwks.json`);
+        }));
+        it('gives up in its time when the proxy never answers', () => __awaiter(this, void 0, void 0, function* () {
+            // The fetch's own timeout starts once the request has a socket, which a
+            // proxy agent hands it only after its CONNECT is answered.
+            yield proxy.close();
+            proxy = yield (0, fake_http_proxy_1.startFakeProxy)({ ignoreConnect: true });
+            process.env.HTTPS_PROXY = proxy.url;
+            const outcome = yield settlesWithin(new hubSessionToken_1.HubSessionTokenVerifier('https://hub.lab.example:4723', undefined, {
+                timeoutMs: 300,
+            }).verify(token, 's'), 3000);
+            (0, chai_1.expect)(outcome).to.be.instanceOf(hubSessionToken_1.HubTokenUnavailableError);
+        }));
+        it('goes straight to a hub NO_PROXY names', () => __awaiter(this, void 0, void 0, function* () {
+            const asked = [];
+            const hub = yield target((req, res) => {
+                asked.push(String(req.url));
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end('{"keys":[]}');
+            });
+            process.env.HTTP_PROXY = proxy.url;
+            process.env.NO_PROXY = '127.0.0.1';
+            yield fetchKeys(hub);
+            (0, chai_1.expect)(proxy.seen).to.deep.equal([]);
+            (0, chai_1.expect)(asked).to.include('/xenon/api/auth/jwks.json');
+        }));
+    });
+    describe("a node's live-events connection to its hub", () => {
+        let client;
+        let hubIo;
+        afterEach(() => {
+            var _a;
+            (_a = client === null || client === void 0 ? void 0 : client.socket) === null || _a === void 0 ? void 0 : _a.close();
+            client = undefined;
+            hubIo === null || hubIo === void 0 ? void 0 : hubIo.close();
+            hubIo = undefined;
+        });
+        function connect() {
+            return __awaiter(this, void 0, void 0, function* () {
+                const hub = yield target();
+                hubIo = new socket_io_1.Server(servers[servers.length - 1]);
+                client = new SocketClient_1.SocketClient();
+                client.initialize(hub, 'http://node.lab:4723');
+                const deadline = Date.now() + 10000;
+                while (!client.isConnected()) {
+                    if (Date.now() > deadline)
+                        throw new Error('the node never connected to its hub');
+                    yield new Promise((r) => setTimeout(r, 25));
+                }
+                return hub;
+            });
+        }
+        it('goes through the proxy: polling as plain requests, as axios sends them', () => __awaiter(this, void 0, void 0, function* () {
+            process.env.HTTP_PROXY = proxy.url;
+            const hub = yield connect();
+            (0, chai_1.expect)(proxy.seen.some((s) => s.startsWith(`GET ${hub}/socket.io/?EIO=4&transport=polling`)), proxy.seen.join('\n')).to.equal(true);
+        }));
+        it('stays connected through a proxy that refuses tunnels, by polling', () => __awaiter(this, void 0, void 0, function* () {
+            // A stock Squid refuses CONNECT to any port but 443, and a node's hub
+            // is on 4723: the WebSocket upgrade fails, polling carries on.
+            yield proxy.close();
+            proxy = yield (0, fake_http_proxy_1.startFakeProxy)({ refuseConnect: true });
+            process.env.HTTP_PROXY = proxy.url;
+            yield connect();
+            (0, chai_1.expect)(client === null || client === void 0 ? void 0 : client.isConnected()).to.equal(true);
+        }));
+        it('goes straight to a hub NO_PROXY names', () => __awaiter(this, void 0, void 0, function* () {
+            process.env.HTTP_PROXY = proxy.url;
+            process.env.NO_PROXY = '127.0.0.1';
+            yield connect();
+            (0, chai_1.expect)(proxy.seen).to.deep.equal([]);
+        }));
+    });
+    describe("the live-preview and logcat sockets to a node's phone", () => {
+        let context;
+        let savedContext;
+        const sockets = [];
+        beforeEach(() => {
+            context = typedi_1.Container.get(PluginContext_1.PluginContext);
+            savedContext = Object.assign({}, context);
+            context.setContext(Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), { bindHostOrIp: '127.0.0.1' }), 1, 'hub-1', '');
+        });
+        afterEach(() => {
+            Object.assign(context, savedContext);
+            for (const wss of sockets.splice(0)) {
+                for (const client of wss.clients)
+                    client.terminate();
+                wss.close();
+            }
+        });
+        function nodeWithSocket() {
+            return __awaiter(this, void 0, void 0, function* () {
+                const origin = yield target((req, res) => {
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({ ticket: 'node-ticket', expiresIn: 60 }));
+                });
+                const wss = new ws_1.WebSocketServer({ server: servers[servers.length - 1] });
+                sockets.push(wss);
+                return origin;
+            });
+        }
+        function open(origin) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const socket = yield (0, nodeSocketRelay_1.openNodeSocket)({ udid: 'p', actor: { actorId: 'alice' }, path: 'logcat' }, {
+                    findDevice: () => __awaiter(this, void 0, void 0, function* () { return ({ udid: 'p', host: origin, nodeId: 'node-1' }); }),
+                    controlToken: () => __awaiter(this, void 0, void 0, function* () { return null; }),
+                });
+                socket.terminate();
+            });
+        }
+        it('take the proxy their ticket takes', () => __awaiter(this, void 0, void 0, function* () {
+            const node = yield nodeWithSocket();
+            process.env.HTTP_PROXY = proxy.url;
+            yield open(node);
+            (0, chai_1.expect)(proxy.seen).to.include(`POST ${node}/xenon/api/control/p/stream/ticket`);
+            (0, chai_1.expect)(proxy.seen).to.include(`CONNECT ${node.replace('http://', '')}`);
+        }));
+        it('go straight to the node when the proxy refuses a tunnel, as they did before', () => __awaiter(this, void 0, void 0, function* () {
+            yield proxy.close();
+            proxy = yield (0, fake_http_proxy_1.startFakeProxy)({ refuseConnect: true });
+            const node = yield nodeWithSocket();
+            process.env.HTTP_PROXY = proxy.url;
+            yield open(node);
+            (0, chai_1.expect)(proxy.seen).to.include(`CONNECT ${node.replace('http://', '')}`);
+        }));
+        it('give up in their time when the proxy never answers the tunnel', () => __awaiter(this, void 0, void 0, function* () {
+            yield proxy.close();
+            proxy = yield (0, fake_http_proxy_1.startFakeProxy)({ ignoreConnect: true });
+            const node = yield nodeWithSocket();
+            process.env.HTTP_PROXY = proxy.url;
+            const outcome = yield settlesWithin((0, nodeSocketRelay_1.openNodeSocket)({ udid: 'p', actor: { actorId: 'alice' }, path: 'logcat' }, {
+                findDevice: () => __awaiter(this, void 0, void 0, function* () { return ({ udid: 'p', host: node, nodeId: 'node-1' }); }),
+                controlToken: () => __awaiter(this, void 0, void 0, function* () { return null; }),
+                timeoutMs: 300,
+            }), 3000);
+            (0, chai_1.expect)(outcome).to.be.instanceOf(Error);
+        }));
+        it('go straight to a node NO_PROXY names', () => __awaiter(this, void 0, void 0, function* () {
+            const node = yield nodeWithSocket();
+            process.env.HTTP_PROXY = proxy.url;
+            process.env.NO_PROXY = '127.0.0.1';
+            yield open(node);
+            (0, chai_1.expect)(proxy.seen).to.deep.equal([]);
+        }));
+    });
+});

package/lib/test/unit/package-engines.spec.js

@@ -0,0 +1,27 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const root = path_1.default.join(__dirname, '..', '..');
+const readJson = (file) => JSON.parse(fs_1.default.readFileSync(file, 'utf8'));
+const pkg = readJson(path_1.default.join(root, 'package.json'));
+const lock = readJson(path_1.default.join(root, 'package-lock.json'));
+const appium = readJson(require.resolve('appium/package.json'));
+/**
+ * The plugin runs inside Appium, so it supports the Node versions Appium 3
+ * does and no others. `engines` used to say `^14.17.0 || ^16.13.0 || >=18.0.0`
+ * while every Appium 3 release needs 20.19, 22.12 or 24 and later.
+ */
+describe('package.json engines', () => {
+    it("are the installed Appium 3's, the Appium the plugin is built and tested against", () => {
+        (0, chai_1.expect)(appium.version).to.match(/^3\./);
+        (0, chai_1.expect)(pkg.engines).to.deep.equal({ node: appium.engines.node, npm: appium.engines.npm });
+    });
+    it('match the copy in package-lock.json', () => {
+        (0, chai_1.expect)(lock.packages[''].engines).to.deep.equal(pkg.engines);
+    });
+});

package/lib/test/unit/passwordResetMode.test.js

@@ -3,8 +3,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const chai_1 = require("chai");
 const passwordResetMode_1 = require("../../src/services/passwordResetMode");
 describe('passwordResetMode', () => {
-    it('is email when an SMTP URL is configured', () => {
-        (0, chai_1.expect)((0, passwordResetMode_1.passwordResetMode)({ smtpUrl: 'smtp://mail.example.com:587' })).to.equal('email');
+    it('is email when an SMTP URL and XENON_PUBLIC_URL are configured', () => {
+        (0, chai_1.expect)((0, passwordResetMode_1.passwordResetMode)({
+            smtpUrl: 'smtp://mail.example.com:587',
+            publicUrl: 'https://xenon.example.com',
+        })).to.equal('email');
+    });
+    // The emailed link points at XENON_PUBLIC_URL, never at the request's Host:
+    // without it Xenon emails no link, so the form must not promise one.
+    it('is admin with SMTP but no XENON_PUBLIC_URL', () => {
+        (0, chai_1.expect)((0, passwordResetMode_1.passwordResetMode)({ smtpUrl: 'smtp://mail.example.com:587' })).to.equal('admin');
     });
     it('is admin without SMTP, even though the log fallback defaults on', () => {
         // The fallback writes the link to the server log, which the person who

package/lib/test/unit/port-exhaustion.spec.js

@@ -196,8 +196,9 @@ describe('iOSCapabilities port acquisition', () => {
         sinon_1.default
             .stub(typedi_1.Container.get(IOSStreamService), 'getStreamStatus')
             .returns({ status: 'running', wdaPort: 8100 });
+        // An iPhone: a simulator's WDA is the driver's, never the stream's.
         const caps = { alwaysMatch: {}, firstMatch: [{}] };
-        yield (0, XenonCapabilityManager_1.iOSCapabilities)(caps, device);
+        yield (0, XenonCapabilityManager_1.iOSCapabilities)(caps, Object.assign(Object.assign({}, device), { realDevice: true }));
         (0, chai_1.expect)(caps.firstMatch[0]['appium:webDriverAgentUrl']).to.equal('http://127.0.0.1:8100');
         (0, chai_1.expect)(caps.firstMatch[0]['appium:wdaLocalPort']).to.equal(undefined);
         (0, chai_1.expect)(acquireStub.called).to.equal(false);

package/lib/test/unit/profile-router.test.js

@@ -39,7 +39,12 @@ describe('profile router', () => {
     }));
     it('POST /profile/access-key/rotate returns a new accessKey', () => __awaiter(void 0, void 0, void 0, function* () {
         sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'rotateAccessKey').resolves({ id: 'u1', accessKey: 'xen_NEW' });
-        const app = appWithAuth({ userId: 'u1', role: 'ADMIN', scopes: 'devices,sessions,read' });
+        const app = appWithAuth({
+            kind: 'user-session',
+            userId: 'u1',
+            role: 'ADMIN',
+            scopes: 'admin,devices,sessions,read',
+        });
         const r = yield (0, loopbackRequest_1.default)(app).post('/profile/access-key/rotate');
         (0, chai_1.expect)(r.body.accessKey).to.equal('xen_NEW');
     }));
@@ -147,4 +152,120 @@ describe('profile router', () => {
         const r = yield (0, loopbackRequest_1.default)(app).delete('/profile/tokens/k1');
         (0, chai_1.expect)(r.status).to.equal(404);
     }));
+    // A credential can't do more to its owner's account than it could itself
+    // have been made to do.
+    describe('what the credential in use limits', () => {
+        // Rotating the access key ends every key pair its owner has, whatever
+        // their scopes, so it takes the person themselves (a dashboard sign-in)
+        // or a credential with the admin scope. Any credential, a read-only
+        // token included, could do it.
+        describe('POST /profile/access-key/rotate', () => {
+            let rotate;
+            beforeEach(() => {
+                rotate = sinon_1.default
+                    .stub(typedi_1.Container.get(UserService_1.UserService), 'rotateAccessKey')
+                    .resolves({ id: 'u1', accessKey: 'xen_NEW' });
+            });
+            for (const [kind, scopes] of [
+                ['bearer', 'read'],
+                ['api-key', 'read'],
+                ['api-key', 'devices,sessions,read'],
+                ['bearer', 'sessions'],
+            ]) {
+                it(`is refused to ${kind === 'bearer' ? 'a Bearer token' : 'an API key'} with ${scopes}`, () => __awaiter(void 0, void 0, void 0, function* () {
+                    const app = appWithAuth({ kind, userId: 'u1', role: 'ADMIN', scopes });
+                    const r = yield (0, loopbackRequest_1.default)(app).post('/profile/access-key/rotate');
+                    (0, chai_1.expect)(r.status).to.equal(403);
+                    (0, chai_1.expect)(r.body.error).to.match(/dashboard sign-in or a credential with the admin scope/);
+                    (0, chai_1.expect)(rotate.called).to.equal(false);
+                }));
+            }
+            it('is allowed to a dashboard sign-in, a member included', () => __awaiter(void 0, void 0, void 0, function* () {
+                const app = appWithAuth({
+                    kind: 'user-session',
+                    userId: 'u1',
+                    role: 'MEMBER',
+                    scopes: 'devices,sessions,read',
+                });
+                (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(app).post('/profile/access-key/rotate')).status).to.equal(200);
+            }));
+            it('is allowed to a credential with the admin scope', () => __awaiter(void 0, void 0, void 0, function* () {
+                const app = appWithAuth({
+                    kind: 'api-key',
+                    userId: 'u1',
+                    role: 'SUPER_ADMIN',
+                    scopes: 'admin',
+                });
+                (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(app).post('/profile/access-key/rotate')).status).to.equal(200);
+            }));
+        });
+        // A token made with a credential that expires ends no later than it: a
+        // 1-hour Bearer token made itself a key that never expired.
+        describe('POST /profile/tokens from a credential that expires', () => {
+            const inAnHour = new Date(Date.now() + 3600000);
+            const bearer = () => appWithAuth({
+                kind: 'bearer',
+                userId: 'u1',
+                role: 'MEMBER',
+                scopes: 'sessions,read',
+                credentialExpiresAt: inAnHour.getTime(),
+            });
+            let create;
+            beforeEach(() => {
+                create = sinon_1.default
+                    .stub(typedi_1.Container.get(ApiKeyService_1.ApiKeyService), 'create')
+                    .resolves({ id: 'k9', raw: 'raw' });
+            });
+            it('expires with that credential when no expiresAt is asked for', () => __awaiter(void 0, void 0, void 0, function* () {
+                var _a;
+                const r = yield (0, loopbackRequest_1.default)(bearer()).post('/profile/tokens').send({ name: 'CI' });
+                (0, chai_1.expect)(r.status).to.equal(201);
+                (0, chai_1.expect)(r.body.expiresAt).to.equal(inAnHour.toISOString());
+                (0, chai_1.expect)((_a = create.firstCall.args[0].expiresAt) === null || _a === void 0 ? void 0 : _a.getTime()).to.equal(inAnHour.getTime());
+            }));
+            it('refuses an expiresAt later than that credential', () => __awaiter(void 0, void 0, void 0, function* () {
+                const later = new Date(inAnHour.getTime() + 60000).toISOString();
+                const r = yield (0, loopbackRequest_1.default)(bearer())
+                    .post('/profile/tokens')
+                    .send({ name: 'CI', expiresAt: later });
+                (0, chai_1.expect)(r.status).to.equal(400);
+                (0, chai_1.expect)(r.body.error).to.match(/later than the credential/);
+                (0, chai_1.expect)(create.called).to.equal(false);
+            }));
+            // Verification allows 60 s of clock skew, so a token can still be
+            // accepted just after its exp: it must not make a key already expired.
+            it('refuses when that credential has already expired', () => __awaiter(void 0, void 0, void 0, function* () {
+                const app = appWithAuth({
+                    kind: 'bearer',
+                    userId: 'u1',
+                    role: 'MEMBER',
+                    scopes: 'sessions,read',
+                    credentialExpiresAt: Date.now() - 1000,
+                });
+                const r = yield (0, loopbackRequest_1.default)(app).post('/profile/tokens').send({ name: 'CI' });
+                (0, chai_1.expect)(r.status).to.equal(400);
+                (0, chai_1.expect)(r.body.error).to.match(/has expired/);
+                (0, chai_1.expect)(create.called).to.equal(false);
+            }));
+            it('keeps an earlier expiresAt', () => __awaiter(void 0, void 0, void 0, function* () {
+                const sooner = new Date(Date.now() + 600000).toISOString();
+                const r = yield (0, loopbackRequest_1.default)(bearer())
+                    .post('/profile/tokens')
+                    .send({ name: 'CI', expiresAt: sooner });
+                (0, chai_1.expect)(r.status).to.equal(201);
+                (0, chai_1.expect)(r.body.expiresAt).to.equal(sooner);
+            }));
+            it('leaves a dashboard sign-in free to make a key that never expires', () => __awaiter(void 0, void 0, void 0, function* () {
+                const app = appWithAuth({
+                    kind: 'user-session',
+                    userId: 'u1',
+                    role: 'MEMBER',
+                    scopes: 'devices,sessions,read',
+                });
+                const r = yield (0, loopbackRequest_1.default)(app).post('/profile/tokens').send({ name: 'CI' });
+                (0, chai_1.expect)(r.status).to.equal(201);
+                (0, chai_1.expect)(r.body.expiresAt).to.equal(null);
+            }));
+        });
+    });
 });