@xenon-device-management/xenon 2.14.0 → 2.16.0

package/lib/test/unit/proxy-option.spec.js

@@ -0,0 +1,358 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const http_1 = __importDefault(require("http"));
+const https_1 = __importDefault(require("https"));
+const typedi_1 = require("typedi");
+const socket_io_1 = require("socket.io");
+const ws_1 = require("ws");
+const PluginContext_1 = require("../../src/PluginContext");
+const IPluginArgs_1 = require("../../src/interfaces/IPluginArgs");
+const outboundProxy_1 = require("../../src/helpers/outboundProxy");
+const forwardToNode_1 = require("../../src/gateway/forwardToNode");
+const hubSessionToken_1 = require("../../src/gateway/hubSessionToken");
+const nodeWebDriverUrl_1 = require("../../src/gateway/nodeWebDriverUrl");
+const nodeSocketRelay_1 = require("../../src/app/ws/nodeSocketRelay");
+const RemoteSession_1 = require("../../src/sessions/RemoteSession");
+const LocalSession_1 = require("../../src/sessions/LocalSession");
+const SessionLifecycleService_1 = require("../../src/services/SessionLifecycleService");
+const SocketClient_1 = require("../../src/services/SocketClient");
+const InternalHttpClient_1 = require("../../src/InternalHttpClient");
+const helpers_1 = require("../../src/helpers");
+const node_forge_1 = require("node-forge");
+const container_registration_1 = require("../helpers/container-registration");
+const fake_http_proxy_1 = require("../helpers/fake-http-proxy");
+const PROXY_ENV = [
+    'HTTP_PROXY',
+    'http_proxy',
+    'HTTPS_PROXY',
+    'https_proxy',
+    'NO_PROXY',
+    'no_proxy',
+];
+/**
+ * The `proxy` plugin option reached one call: the create a hub sends to a node
+ * or a cloud provider. The session's commands, its screenshots and heartbeats,
+ * device control, the sockets, and a node's calls to its hub all took the
+ * environment's proxy instead, or none: a lab that set only the option had
+ * its sessions created through the proxy and then driven straight at the node.
+ *
+ * Every call one Xenon server makes to another, or to a cloud provider, now
+ * takes it. NO_PROXY still names the hosts that go direct, and so does any
+ * loopback host, which a proxy elsewhere can't reach.
+ */
+describe('the proxy plugin option', function () {
+    this.timeout(30000);
+    describe('the rule', () => {
+        const env = (vars) => vars;
+        const option = { host: 'squid.lab', port: 3128 };
+        it("is taken over the environment's proxy, for http and https alike", () => {
+            const vars = env({ HTTP_PROXY: 'http://env:1', HTTPS_PROXY: 'http://env:2' });
+            (0, chai_1.expect)((0, outboundProxy_1.outboundProxyFor)('http://node.lab:4723/x', { env: vars, option })).to.equal('http://squid.lab:3128');
+            (0, chai_1.expect)((0, outboundProxy_1.outboundProxyFor)('https://cloud.example/wd/hub', { env: vars, option })).to.equal('http://squid.lab:3128');
+            (0, chai_1.expect)((0, outboundProxy_1.outboundProxyFor)('ws://node.lab:4723/x', { env: vars, option })).to.equal('http://squid.lab:3128');
+        });
+        it('is written as a URL: its protocol, its credentials escaped, or the string it is', () => {
+            (0, chai_1.expect)((0, outboundProxy_1.outboundProxyFor)('http://node.lab/x', {
+                env: env({}),
+                option: {
+                    protocol: 'https',
+                    host: 'squid.lab',
+                    port: 3129,
+                    auth: { username: 'lab@x', password: 'p:ss' },
+                },
+            })).to.equal('https://lab%40x:p%3Ass@squid.lab:3129');
+            (0, chai_1.expect)((0, outboundProxy_1.outboundProxyFor)('http://node.lab/x', { env: env({}), option: 'http://squid.lab:8080' })).to.equal('http://squid.lab:8080');
+            (0, chai_1.expect)((0, outboundProxy_1.outboundProxyFor)('http://node.lab/x', { env: env({}), option: { host: 'squid.lab' } })).to.equal('http://squid.lab');
+        });
+        it('leaves a host NO_PROXY names direct', () => {
+            (0, chai_1.expect)((0, outboundProxy_1.outboundProxyFor)('http://node.lab:4723/x', {
+                env: env({ NO_PROXY: '.lab' }),
+                option,
+            })).to.equal(undefined);
+        });
+        it('leaves loopback hosts direct; the environment still decides for them', () => {
+            for (const url of [
+                'http://localhost:4724/x',
+                'http://127.0.0.1:4724/x',
+                'http://127.1.2.3/x',
+                'http://[::1]:4724/x',
+            ]) {
+                (0, chai_1.expect)((0, outboundProxy_1.outboundProxyFor)(url, { env: env({}), option }), url).to.equal(undefined);
+            }
+            (0, chai_1.expect)((0, outboundProxy_1.outboundProxyFor)('http://127.0.0.1:4724/x', {
+                env: env({ HTTP_PROXY: 'http://env:1' }),
+                option,
+            })).to.equal('http://env:1');
+        });
+        it('is ignored, with a warning, when it names no host', () => {
+            const warn = sinon_1.default.stub();
+            (0, chai_1.expect)((0, outboundProxy_1.outboundProxyFor)('http://node.lab/x', {
+                env: env({ HTTP_PROXY: 'http://env:1' }),
+                option: { port: 3128 },
+                warn,
+            })).to.equal('http://env:1');
+            (0, chai_1.expect)(warn.calledOnce).to.equal(true);
+            (0, chai_1.expect)(warn.firstCall.args[0]).to.include('proxy');
+        });
+    });
+    describe('every call to another server goes through it', () => {
+        let proxy;
+        let context;
+        let savedContext;
+        let savedEnv;
+        let restoreRegs;
+        const servers = [];
+        const sockets = [];
+        const ios = [];
+        beforeEach(() => __awaiter(this, void 0, void 0, function* () {
+            savedEnv = Object.fromEntries(PROXY_ENV.map((k) => [k, process.env[k]]));
+            for (const k of PROXY_ENV)
+                delete process.env[k];
+            proxy = yield (0, fake_http_proxy_1.startFakeProxy)({
+                hosts: { 'node.test': '127.0.0.1', 'hub.test': '127.0.0.1' },
+            });
+            context = typedi_1.Container.get(PluginContext_1.PluginContext);
+            savedContext = Object.assign({}, context);
+            const [, proxyPort] = proxy.url.replace('http://', '').split(':');
+            context.setContext(Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), { bindHostOrIp: '127.0.0.1', proxy: {
+                    host: '127.0.0.1',
+                    port: Number(proxyPort),
+                    auth: { username: 'lab', password: 's3cret' },
+                } }), 4723, 'hub-1', '');
+            restoreRegs = (0, container_registration_1.saveRegistrations)(hubSessionToken_1.HubSessionTokenIssuer);
+            typedi_1.Container.set(hubSessionToken_1.HubSessionTokenIssuer, {
+                tokenFor: () => __awaiter(this, void 0, void 0, function* () { return null; }),
+                createTokenFor: () => __awaiter(this, void 0, void 0, function* () { return null; }),
+                controlTokenFor: () => __awaiter(this, void 0, void 0, function* () { return null; }),
+            });
+        }));
+        afterEach(() => __awaiter(this, void 0, void 0, function* () {
+            restoreRegs();
+            Object.assign(context, savedContext);
+            for (const k of PROXY_ENV) {
+                if (savedEnv[k] === undefined)
+                    delete process.env[k];
+                else
+                    process.env[k] = savedEnv[k];
+            }
+            for (const io of ios.splice(0))
+                io.close();
+            for (const wss of sockets.splice(0)) {
+                for (const client of wss.clients)
+                    client.terminate();
+                wss.close();
+            }
+            yield proxy.close();
+            yield Promise.all(servers.splice(0).map((s) => new Promise((resolve) => {
+                var _a;
+                (_a = s.closeAllConnections) === null || _a === void 0 ? void 0 : _a.call(s);
+                s.close(() => resolve());
+            })));
+        }));
+        /** A server on 127.0.0.1 answering every request with `body`, and its port. */
+        function server() {
+            return __awaiter(this, arguments, void 0, function* (body = {}, handler) {
+                const asked = [];
+                const s = http_1.default.createServer(handler !== null && handler !== void 0 ? handler : ((req, res) => {
+                    asked.push(`${req.method} ${req.url}`);
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify(body));
+                }));
+                servers.push(s);
+                yield new Promise((resolve) => s.listen(0, '127.0.0.1', () => resolve()));
+                return { port: s.address().port, asked, server: s };
+            });
+        }
+        it('a command forwarded to a node, with the proxy credentials', () => __awaiter(this, void 0, void 0, function* () {
+            const { port } = yield server();
+            yield (0, forwardToNode_1.readAnswer)(yield (0, forwardToNode_1.sendToNode)({
+                url: `http://node.test:${port}/wd/session/s/url`,
+                method: 'GET',
+                headers: {},
+            }));
+            (0, chai_1.expect)(proxy.seen).to.include(`GET http://node.test:${port}/wd/session/s/url`);
+            (0, chai_1.expect)(proxy.authorizations[0]).to.equal(`Basic ${Buffer.from('lab:s3cret').toString('base64')}`);
+        }));
+        it("a remote session's own calls (its screenshot)", () => __awaiter(this, void 0, void 0, function* () {
+            const { port } = yield server({ value: 'iVBOR' });
+            const session = new RemoteSession_1.RemoteSession({
+                sessionId: 's',
+                device: { udid: 'p', host: `http://node.test:${port}` },
+                sessionResponse: {},
+                xenonOption: {},
+                baseUrl: `http://node.test:${port}/wd`,
+            });
+            (0, chai_1.expect)(yield session.getScreenShot()).to.equal('iVBOR');
+            (0, chai_1.expect)(proxy.seen).to.include(`GET http://node.test:${port}/wd/session/s/screenshot`);
+        }));
+        it("the lookup of a node's base path", () => __awaiter(this, void 0, void 0, function* () {
+            const { port } = yield server({ basePath: '/wd' });
+            (0, chai_1.expect)(yield (0, nodeWebDriverUrl_1.nodeWebDriverUrl)({ udid: 'p', host: `http://node.test:${port}` }, '')).to.equal(`http://node.test:${port}/wd`);
+            (0, chai_1.expect)(proxy.seen).to.include(`GET http://node.test:${port}/xenon/api/webdriver`);
+        }));
+        it('the create, as before', () => __awaiter(this, void 0, void 0, function* () {
+            const { port, asked } = yield server(undefined, (req, res) => {
+                asked.push(`${req.method} ${req.url}`);
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end(req.url === '/xenon/api/webdriver'
+                    ? JSON.stringify({ basePath: '' })
+                    : JSON.stringify({ value: { sessionId: 'made', capabilities: {} } }));
+            });
+            yield typedi_1.Container.get(SessionLifecycleService_1.SessionLifecycleService).forwardSessionRequest({ udid: 'p', host: `http://node.test:${port}` }, { alwaysMatch: {}, firstMatch: [{}] });
+            (0, chai_1.expect)(proxy.seen).to.include(`POST http://node.test:${port}/session`);
+        }));
+        it('the create, straight to a node NO_PROXY names', () => __awaiter(this, void 0, void 0, function* () {
+            // node.test resolves only at the proxy, so going straight there fails:
+            // what is tested is that the proxy is never asked.
+            process.env.NO_PROXY = 'node.test';
+            const created = yield typedi_1.Container.get(SessionLifecycleService_1.SessionLifecycleService).forwardSessionRequest({ udid: 'p', host: 'http://node.test:9' }, { alwaysMatch: {}, firstMatch: [{}] });
+            (0, chai_1.expect)(created).to.be.instanceOf(Error);
+            (0, chai_1.expect)(proxy.seen).to.deep.equal([]);
+        }));
+        it("Xenon's other internal calls (a health probe)", () => __awaiter(this, void 0, void 0, function* () {
+            const { port } = yield server({ ok: true });
+            (0, chai_1.expect)(yield (0, helpers_1.isXenonRunning)(`http://node.test:${port}`)).to.equal(true);
+            (0, chai_1.expect)(proxy.seen).to.include(`GET http://node.test:${port}/xenon/api/health`);
+        }));
+        it("the live-preview and logcat sockets to a node's phone", () => __awaiter(this, void 0, void 0, function* () {
+            const { port, server: s } = yield server({ ticket: 'node-ticket', expiresIn: 60 });
+            const wss = new ws_1.WebSocketServer({ server: s });
+            sockets.push(wss);
+            const socket = yield (0, nodeSocketRelay_1.openNodeSocket)({ udid: 'p', actor: { actorId: 'alice' }, path: 'logcat' }, {
+                findDevice: () => __awaiter(this, void 0, void 0, function* () {
+                    return ({
+                        udid: 'p',
+                        host: `http://node.test:${port}`,
+                        nodeId: 'node-1',
+                    });
+                }),
+                controlToken: () => __awaiter(this, void 0, void 0, function* () { return null; }),
+            });
+            socket.terminate();
+            (0, chai_1.expect)(proxy.seen).to.include(`CONNECT node.test:${port}`);
+        }));
+        it("a node fetching its hub's keys", () => __awaiter(this, void 0, void 0, function* () {
+            const { port } = yield server({ keys: [] });
+            const token = [
+                Buffer.from(JSON.stringify({ alg: 'RS256', kid: 'k1' })).toString('base64url'),
+                Buffer.from(JSON.stringify({ sid: 's' })).toString('base64url'),
+                'c2lnbmF0dXJl',
+            ].join('.');
+            yield new hubSessionToken_1.HubSessionTokenVerifier(`http://hub.test:${port}`)
+                .verify(token, 's')
+                .catch(() => undefined);
+            (0, chai_1.expect)(proxy.seen).to.include(`GET http://hub.test:${port}/xenon/api/auth/jwks.json`);
+        }));
+        it("a node's live-events connection to its hub", () => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const { port, server: s } = yield server();
+            ios.push(new socket_io_1.Server(s));
+            const client = new SocketClient_1.SocketClient();
+            try {
+                client.initialize(`http://hub.test:${port}`, 'http://node.lab:4723');
+                const deadline = Date.now() + 10000;
+                while (!client.isConnected()) {
+                    if (Date.now() > deadline)
+                        throw new Error('the node never connected to its hub');
+                    yield new Promise((r) => setTimeout(r, 25));
+                }
+            }
+            finally {
+                (_a = client.socket) === null || _a === void 0 ? void 0 : _a.close();
+            }
+            (0, chai_1.expect)(proxy.seen.some((l) => l.startsWith(`GET http://hub.test:${port}/socket.io/`)), proxy.seen.join('\n')).to.equal(true);
+        }));
+        it("but not a session's call to this server, which carries its secret", () => __awaiter(this, void 0, void 0, function* () {
+            // Appium bound to a LAN address: the /wd-internal URL isn't a loopback
+            // name, so only the session's own `proxy: false` keeps it direct.
+            const session = new LocalSession_1.LocalSession({
+                sessionId: 's-1',
+                device: { udid: 'p' },
+                sessionResponse: {},
+                xenonOption: {},
+                driver: { opts: { address: 'node.test', port: 9, basePath: '/wd/hub' } },
+            });
+            yield session.getPageSource().catch(() => undefined);
+            (0, chai_1.expect)(proxy.seen).to.deep.equal([]);
+        }));
+        it('but not a call to this machine', () => __awaiter(this, void 0, void 0, function* () {
+            const { port, asked } = yield server({ ok: true });
+            (0, chai_1.expect)(yield (0, helpers_1.isXenonRunning)(`http://127.0.0.1:${port}`)).to.equal(true);
+            (0, chai_1.expect)(proxy.seen).to.deep.equal([]);
+            (0, chai_1.expect)(asked).to.include('GET /xenon/api/health');
+        }));
+    });
+    describe('TLS to the server behind it', () => {
+        let proxy;
+        let context;
+        let savedContext;
+        let tlsServer;
+        let port;
+        before(function () {
+            return __awaiter(this, void 0, void 0, function* () {
+                this.timeout(60000);
+                tlsServer = https_1.default.createServer(selfSignedCertificate('node.test'), (_req, res) => {
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end('{"ok":true}');
+                });
+                yield new Promise((resolve) => tlsServer.listen(0, '127.0.0.1', () => resolve()));
+                port = tlsServer.address().port;
+            });
+        });
+        after(() => __awaiter(this, void 0, void 0, function* () {
+            yield new Promise((resolve) => tlsServer.close(() => resolve()));
+        }));
+        beforeEach(() => __awaiter(this, void 0, void 0, function* () {
+            proxy = yield (0, fake_http_proxy_1.startFakeProxy)({ hosts: { 'node.test': '127.0.0.1' } });
+            context = typedi_1.Container.get(PluginContext_1.PluginContext);
+            savedContext = Object.assign({}, context);
+            const [, proxyPort] = proxy.url.replace('http://', '').split(':');
+            context.setContext(Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), { proxy: { host: '127.0.0.1', port: Number(proxyPort) } }), 4723, 'hub-1', '');
+        }));
+        afterEach(() => __awaiter(this, void 0, void 0, function* () {
+            Object.assign(context, savedContext);
+            yield proxy.close();
+        }));
+        it('accepts a self-signed certificate when tlsRejectUnauthorized is false', () => __awaiter(this, void 0, void 0, function* () {
+            const answer = yield InternalHttpClient_1.InternalHttpClient.getClient(false).get(`https://node.test:${port}/x`);
+            (0, chai_1.expect)(answer.data).to.deep.equal({ ok: true });
+            (0, chai_1.expect)(proxy.seen).to.include(`CONNECT node.test:${port}`);
+        }));
+        it('refuses it otherwise', () => __awaiter(this, void 0, void 0, function* () {
+            const outcome = yield InternalHttpClient_1.InternalHttpClient.getClient(true)
+                .get(`https://node.test:${port}/x`)
+                .then(() => 'accepted', (err) => { var _a; return String((_a = err === null || err === void 0 ? void 0 : err.code) !== null && _a !== void 0 ? _a : err === null || err === void 0 ? void 0 : err.message); });
+            (0, chai_1.expect)(outcome).to.not.equal('accepted');
+            (0, chai_1.expect)(proxy.seen).to.include(`CONNECT node.test:${port}`);
+        }));
+    });
+});
+/** A certificate for `host`, signed by its own key: one no client trusts. */
+function selfSignedCertificate(host) {
+    const keys = node_forge_1.pki.rsa.generateKeyPair(2048);
+    const cert = node_forge_1.pki.createCertificate();
+    cert.publicKey = keys.publicKey;
+    cert.serialNumber = '01';
+    cert.validity.notBefore = new Date(Date.now() - 60000);
+    cert.validity.notAfter = new Date(Date.now() + 24 * 60 * 60 * 1000);
+    const subject = [{ name: 'commonName', value: host }];
+    cert.setSubject(subject);
+    cert.setIssuer(subject);
+    cert.sign(keys.privateKey, node_forge_1.md.sha256.create());
+    return { cert: node_forge_1.pki.certificateToPem(cert), key: node_forge_1.pki.privateKeyToPem(keys.privateKey) };
+}

package/lib/test/unit/queue-requester.spec.js

@@ -126,7 +126,7 @@ describe('createSession records who asked on the pending-session row', () => {
         typedi_1.Container.set(JwtKeyService_1.JwtKeyService, {
             verify: (t) => __awaiter(void 0, void 0, void 0, function* () {
                 const [sub, teamId] = t.replace(/^jwt:/, '').split('@');
-                return { sub, teamId: teamId !== null && teamId !== void 0 ? teamId : null };
+                return { sub, teamId: teamId !== null && teamId !== void 0 ? teamId : null, scopes: 'sessions' };
             }),
         });
         teamRows = sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([]);

package/lib/test/unit/reset-link-address.spec.js

@@ -0,0 +1,266 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const express_1 = __importDefault(require("express"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const typedi_1 = require("typedi");
+const users_1 = require("../../src/app/routers/users");
+const auth_1 = require("../../src/app/routers/auth");
+const PasswordResetService_1 = require("../../src/services/PasswordResetService");
+const EmailService_1 = require("../../src/services/EmailService");
+const UserService_1 = require("../../src/services/UserService");
+const prisma_1 = require("../../src/prisma");
+const config_1 = require("../../src/config");
+const passwordResetMode_1 = require("../../src/services/passwordResetMode");
+const passwordResetLink_1 = require("../../src/services/passwordResetLink");
+/**
+ * Where a password reset link that Xenon sends points.
+ *
+ * Through 2.14 it was built from the Host header of the request that asked
+ * for it. Anyone could ask for a reset of someone else's account with a Host
+ * of their own choosing (a matching Origin passes the CSRF check), and with
+ * SMTP set up Xenon emailed the victim a genuine link to the attacker's host:
+ * opening it handed the attacker the token, which opens the account.
+ *
+ * A link Xenon emails or logs is now built from XENON_PUBLIC_URL, the address
+ * people open the dashboard at. Without it Xenon sends no link at all: the
+ * sign-in page sends people to an administrator, and an administrator's
+ * "send reset link" hands the link back to them instead of emailing it.
+ */
+const RAW = 'RAWTOKEN_abcdefghijklmnopqrstuvwxyz0123456789';
+const EVIL = 'attacker.example';
+function withConfig(patch) {
+    const orig = {};
+    for (const k of Object.keys(patch)) {
+        orig[k] = config_1.config[k];
+        config_1.config[k] = patch[k];
+    }
+    return () => Object.assign(config_1.config, orig);
+}
+function until(pred_1) {
+    return __awaiter(this, arguments, void 0, function* (pred, ms = 3000) {
+        const t0 = Date.now();
+        while (!pred()) {
+            if (Date.now() - t0 > ms)
+                throw new Error('timed out waiting for the route to finish');
+            yield new Promise((r) => setTimeout(r, 5));
+        }
+    });
+}
+describe('password reset links point at XENON_PUBLIC_URL, never the request', () => {
+    let restore;
+    afterEach(() => {
+        sinon_1.default.restore();
+        restore === null || restore === void 0 ? void 0 : restore();
+        restore = undefined;
+    });
+    function publicApp() {
+        const app = (0, express_1.default)();
+        app.use(express_1.default.json());
+        app.use('/auth', (0, auth_1.authPublicRouter)());
+        return app;
+    }
+    function usersApp() {
+        const app = (0, express_1.default)();
+        app.use(express_1.default.json());
+        app.use((req, _res, next) => {
+            req.auth = {
+                userId: 'admin1',
+                role: 'ADMIN',
+                scopes: 'admin,devices,sessions,read',
+            };
+            next();
+        });
+        app.use('/users', (0, users_1.usersRouter)());
+        return app;
+    }
+    const active = { id: 'u1', email: 'u@x.local', name: 'U', role: 'MEMBER', status: 'ACTIVE' };
+    describe('POST /auth/forgot-password', () => {
+        it('emails a link to XENON_PUBLIC_URL whatever Host the request names', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({
+                smtpUrl: 'smtp://mail.example.com:587',
+                publicUrl: 'https://xenon.example.com',
+            });
+            sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findByEmail').resolves(active);
+            sinon_1.default
+                .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken')
+                .resolves({ raw: RAW, id: 't1' });
+            const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
+            yield (0, loopbackRequest_1.default)(publicApp())
+                .post('/auth/forgot-password')
+                .set('Host', EVIL)
+                .set('X-Forwarded-Proto', 'http')
+                .send({ email: 'u@x.local' });
+            yield until(() => send.called);
+            const text = send.firstCall.args[0].text;
+            (0, chai_1.expect)(text).to.include(`https://xenon.example.com/xenon/reset-password#${RAW}`);
+            (0, chai_1.expect)(text).to.not.include(EVIL);
+        }));
+        it("builds a link that opens when XENON_PUBLIC_URL is the dashboard's address", () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({
+                smtpUrl: 'smtp://mail.example.com:587',
+                publicUrl: 'http://localhost:4723/xenon/',
+            });
+            sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findByEmail').resolves(active);
+            sinon_1.default
+                .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken')
+                .resolves({ raw: RAW, id: 't1' });
+            const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
+            yield (0, loopbackRequest_1.default)(publicApp()).post('/auth/forgot-password').send({ email: 'u@x.local' });
+            yield until(() => send.called);
+            (0, chai_1.expect)(send.firstCall.args[0].text).to.include(`http://localhost:4723/xenon/reset-password#${RAW}`);
+            (0, chai_1.expect)(send.firstCall.args[0].text).to.not.include('/xenon/xenon/');
+        }));
+        it('sends nothing, and mints nothing, when XENON_PUBLIC_URL is not set', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({ smtpUrl: 'smtp://mail.example.com:587', publicUrl: undefined });
+            const find = sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findByEmail').resolves(active);
+            const create = sinon_1.default.stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken');
+            const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
+            const r = yield (0, loopbackRequest_1.default)(publicApp())
+                .post('/auth/forgot-password')
+                .set('Host', EVIL)
+                .send({ email: 'u@x.local' });
+            yield until(() => find.called);
+            yield new Promise((resolve) => setImmediate(resolve));
+            (0, chai_1.expect)(r.status).to.equal(204);
+            (0, chai_1.expect)(create.called).to.equal(false);
+            (0, chai_1.expect)(send.called).to.equal(false);
+        }));
+        it('sends nothing through the log fallback without XENON_PUBLIC_URL either', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({
+                smtpUrl: undefined,
+                passwordResetLogFallback: true,
+                publicUrl: undefined,
+            });
+            const find = sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findByEmail').resolves(active);
+            const create = sinon_1.default.stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken');
+            yield (0, loopbackRequest_1.default)(publicApp()).post('/auth/forgot-password').send({ email: 'u@x.local' });
+            yield until(() => find.called);
+            yield new Promise((resolve) => setImmediate(resolve));
+            (0, chai_1.expect)(create.called).to.equal(false);
+        }));
+    });
+    describe('GET /auth/options tells the sign-in page whether self-service reset works', () => {
+        it("is 'admin' with SMTP but no XENON_PUBLIC_URL, 'email' with both", () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({ smtpUrl: 'smtp://mail.example.com:587', publicUrl: undefined });
+            (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(publicApp()).get('/auth/options')).body.passwordReset).to.equal('admin');
+            config_1.config.publicUrl = 'https://xenon.example.com';
+            (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(publicApp()).get('/auth/options')).body.passwordReset).to.equal('email');
+        }));
+    });
+    describe('POST /users/:id/reset-link', () => {
+        beforeEach(() => {
+            sinon_1.default.stub(prisma_1.prisma.user, 'findUnique').resolves(active);
+            sinon_1.default
+                .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken')
+                .resolves({ raw: RAW, id: 't1' });
+        });
+        it('emails a link to XENON_PUBLIC_URL whatever Host the request names', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({
+                smtpUrl: 'smtp://mail.example.com:587',
+                publicUrl: 'https://xenon.example.com',
+            });
+            const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
+            const r = yield (0, loopbackRequest_1.default)(usersApp()).post('/users/u1/reset-link').set('Host', EVIL);
+            (0, chai_1.expect)(r.body).to.include({ emailed: true });
+            (0, chai_1.expect)(send.firstCall.args[0].text).to.include(`https://xenon.example.com/xenon/reset-password#${RAW}`);
+            (0, chai_1.expect)(send.firstCall.args[0].text).to.not.include(EVIL);
+        }));
+        it('without XENON_PUBLIC_URL, hands the link to the admin instead of emailing it', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({ smtpUrl: 'smtp://mail.example.com:587', publicUrl: undefined });
+            const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
+            const r = yield (0, loopbackRequest_1.default)(usersApp()).post('/users/u1/reset-link');
+            (0, chai_1.expect)(r.status).to.equal(200);
+            (0, chai_1.expect)(r.body.emailed).to.equal(false);
+            (0, chai_1.expect)(r.body.link).to.match(new RegExp(`/xenon/reset-password#${RAW}$`));
+            (0, chai_1.expect)(send.called).to.equal(false);
+        }));
+    });
+    describe('resetLinkBase (XENON_PUBLIC_URL)', () => {
+        // The variable is the server's address. The dashboard's own address,
+        // with /xenon (README gives http://localhost:4723/xenon/), is taken too:
+        // kept as given it made /xenon/xenon/reset-password, which the dashboard
+        // routes to the sign-in page, losing the token.
+        it('is the server address, with or without a trailing slash', () => {
+            (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl: 'https://xenon.example.com' })).to.equal('https://xenon.example.com');
+            (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl: 'https://xenon.example.com/' })).to.equal('https://xenon.example.com');
+            (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl: 'http://lab-mac:4723' })).to.equal('http://lab-mac:4723');
+        });
+        for (const publicUrl of [
+            'http://localhost:4723/xenon',
+            'http://localhost:4723/xenon/',
+            'http://localhost:4723/xenon//',
+        ]) {
+            it(`takes the dashboard's address too: ${publicUrl}`, () => {
+                (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl })).to.equal('http://localhost:4723');
+                (0, chai_1.expect)((0, passwordResetLink_1.buildResetLink)(String((0, passwordResetLink_1.resetLinkBase)({ publicUrl })), 'TOK')).to.equal('http://localhost:4723/xenon/reset-password#TOK');
+            });
+        }
+        // The dashboard loads its pages, scripts and API from /xenon on the
+        // server's root, so it can't be served under another prefix: an address
+        // with any other path is a mistake, and no link is sent rather than one
+        // that can't open.
+        it('is null for an address with any other path', () => {
+            for (const publicUrl of [
+                'https://lab.example.com/qa/',
+                'https://lab.example.com/qa/xenon',
+                'http://localhost:4723/xenon/login',
+            ]) {
+                (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl }), publicUrl).to.equal(null);
+            }
+        });
+        it('is null when unset, or not an http(s) address', () => {
+            for (const publicUrl of [
+                undefined,
+                '',
+                '   ',
+                'not a url',
+                'ftp://x.example',
+                'javascript:alert(1)',
+            ]) {
+                (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl }), String(publicUrl)).to.equal(null);
+            }
+        });
+        it('is null for an address with a query or fragment, which would swallow the token', () => {
+            (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl: 'https://x.example/?a=1' })).to.equal(null);
+            (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl: 'https://x.example/#a' })).to.equal(null);
+        });
+    });
+    describe('passwordResetMode', () => {
+        it("is 'email' only with both SMTP and XENON_PUBLIC_URL", () => {
+            (0, chai_1.expect)((0, passwordResetMode_1.passwordResetMode)({ smtpUrl: 'smtp://m:587', publicUrl: 'https://x.example' })).to.equal('email');
+            (0, chai_1.expect)((0, passwordResetMode_1.passwordResetMode)({ smtpUrl: 'smtp://m:587' })).to.equal('admin');
+            (0, chai_1.expect)((0, passwordResetMode_1.passwordResetMode)({ publicUrl: 'https://x.example' })).to.equal('admin');
+        });
+    });
+    // The email said "1 hour" whatever XENON_RESET_TOKEN_TTL_MS was.
+    describe('the email says how long the link really lasts', () => {
+        const user = { email: 'u@x.local', name: 'U' };
+        for (const [ms, words] of [
+            [60 * 60 * 1000, '1 hour'],
+            [30 * 60 * 1000, '30 minutes'],
+            [2 * 60 * 60 * 1000, '2 hours'],
+            [90 * 60 * 1000, '90 minutes'],
+            [24 * 60 * 60 * 1000, '24 hours'],
+            [60 * 1000, '1 minute'],
+        ]) {
+            it(`${words} for ${ms} ms`, () => {
+                (0, chai_1.expect)((0, passwordResetLink_1.resetEmail)(user, 'https://x/l', ms).text).to.include(`This link expires in ${words}.`);
+            });
+        }
+    });
+});