@xenon-device-management/xenon 2.14.0 → 2.16.0

package/lib/test/unit/selector-verification-missed-regression.spec.js

@@ -53,7 +53,7 @@ describe('SelectorVerificationJob catches a heal the live check missed', functio
         yield scratch.db.selectorEvent.deleteMany();
         yield scratch.db.selectorState.deleteMany();
         yield scratch.db.sessionLog.deleteMany();
-        socket = { emitToDashboard: sinon_1.default.stub() };
+        socket = { emitToDashboardForSelector: sinon_1.default.stub().resolves() };
     }));
     const find = (build, selector, healed, at) => scratch.db.sessionLog.create({
         data: {
@@ -105,7 +105,7 @@ describe('SelectorVerificationJob catches a heal the live check missed', functio
         (0, chai_1.expect)(row).to.include({ status: 'active', regression_count: 1, clean_builds_count: 0 });
         (0, chai_1.expect)(row.fixed_at).to.equal(null);
         (0, chai_1.expect)(yield actionsOf('//pending/broke')).to.deep.equal(['broke_again']);
-        (0, chai_1.expect)(socket.emitToDashboard.firstCall.args[0]).to.equal('selector_regressed');
+        (0, chai_1.expect)(socket.emitToDashboardForSelector.firstCall.args[0]).to.equal('selector_regressed');
     }));
     it('sends a fixed selector back to fix', () => __awaiter(this, void 0, void 0, function* () {
         yield state('//resolved/broke', 'resolved');

package/lib/test/unit/selector-visibility-resolver.spec.js

@@ -0,0 +1,209 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const typedi_1 = require("typedi");
+const container_registration_1 = require("../helpers/container-registration");
+const scratch_database_1 = require("../helpers/scratch-database");
+const selector_health_fixture_1 = require("../helpers/selector-health-fixture");
+const SelectorVisibilityResolver_1 = require("../../src/services/selector-health/SelectorVisibilityResolver");
+const KEY = { strategy: 'xpath', selector: '//x' };
+const MEMBER_A = { userId: 'u-a', teamIds: ['team-a'] };
+describe('SelectorVisibilityResolver: who may see a selector, for its live events', () => {
+    it('TypeDI builds it, as the socket server gets it (Container.get)', () => {
+        // A function-typed constructor parameter would make Container.get throw.
+        const restore = (0, container_registration_1.saveRegistrations)(SelectorVisibilityResolver_1.SelectorVisibilityResolver);
+        try {
+            (0, chai_1.expect)(typedi_1.Container.get(SelectorVisibilityResolver_1.SelectorVisibilityResolver)).to.be.instanceOf(SelectorVisibilityResolver_1.SelectorVisibilityResolver);
+        }
+        finally {
+            restore();
+        }
+    });
+    describe('caching', () => {
+        let clock;
+        let scopes;
+        let checks;
+        let visible;
+        function resolver(over = {}) {
+            return new SelectorVisibilityResolver_1.SelectorVisibilityResolver(Object.assign({ sessionScope: (viewer) => __awaiter(this, void 0, void 0, function* () {
+                    var _a;
+                    scopes.push((_a = viewer.userId) !== null && _a !== void 0 ? _a : '');
+                    return { OR: [{ device_udid: { in: viewer.teamIds } }] };
+                }), healedIn: (key) => __awaiter(this, void 0, void 0, function* () {
+                    checks.push(key.selector);
+                    return visible;
+                }), now: () => clock }, over));
+        }
+        beforeEach(() => {
+            clock = 1000000;
+            scopes = [];
+            checks = [];
+            visible = true;
+        });
+        it('asks once per viewer and selector while the answer is fresh, then again', () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = resolver();
+            (0, chai_1.expect)(yield r.canSee(KEY, MEMBER_A)).to.equal(true);
+            visible = false;
+            (0, chai_1.expect)(yield r.canSee(KEY, MEMBER_A), 'still the cached answer').to.equal(true);
+            (0, chai_1.expect)(checks).to.have.length(1);
+            clock += SelectorVisibilityResolver_1.SELECTOR_VISIBILITY_TTL_MS;
+            (0, chai_1.expect)(yield r.canSee(KEY, MEMBER_A), 'asked again after the TTL').to.equal(false);
+            (0, chai_1.expect)(checks).to.have.length(2);
+        }));
+        it('concurrent questions share one lookup', () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = resolver();
+            const answers = yield Promise.all([
+                r.canSee(KEY, MEMBER_A),
+                r.canSee(KEY, { userId: 'u-a', teamIds: ['team-a'] }),
+                r.canSee(KEY, MEMBER_A),
+            ]);
+            (0, chai_1.expect)(answers).to.deep.equal([true, true, true]);
+            (0, chai_1.expect)(checks).to.have.length(1);
+            (0, chai_1.expect)(scopes).to.have.length(1);
+        }));
+        it("a viewer's sessions are read once for all their selectors", () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = resolver();
+            yield r.canSee(KEY, MEMBER_A);
+            yield r.canSee({ strategy: 'id', selector: 'other' }, MEMBER_A);
+            (0, chai_1.expect)(scopes).to.deep.equal(['u-a']);
+            (0, chai_1.expect)(checks).to.deep.equal(['//x', 'other']);
+        }));
+        it('the same teams in another order are the same viewer; another user or team is not', () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = resolver();
+            yield r.canSee(KEY, { userId: 'u-a', teamIds: ['team-a', 'team-b'] });
+            yield r.canSee(KEY, { userId: 'u-a', teamIds: ['team-b', 'team-a'] });
+            (0, chai_1.expect)(checks, 'team order').to.have.length(1);
+            yield r.canSee(KEY, { userId: 'u-b', teamIds: ['team-a', 'team-b'] });
+            yield r.canSee(KEY, { userId: 'u-a', teamIds: ['team-a'] });
+            (0, chai_1.expect)(checks, 'another user, other teams').to.have.length(3);
+        }));
+        it('a selector with no strategy is its own selector, not one with the same text', () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = resolver();
+            yield r.canSee({ strategy: '', selector: '//x' }, MEMBER_A);
+            yield r.canSee({ strategy: 'xpath', selector: '//x' }, MEMBER_A);
+            (0, chai_1.expect)(checks).to.have.length(2);
+        }));
+        it('a lookup that fails answers no, and is asked again next time', () => __awaiter(void 0, void 0, void 0, function* () {
+            let fail = true;
+            const r = resolver({
+                healedIn: (key) => __awaiter(void 0, void 0, void 0, function* () {
+                    checks.push(key.selector);
+                    if (fail)
+                        throw new Error('database gone');
+                    return true;
+                }),
+            });
+            (0, chai_1.expect)(yield r.canSee(KEY, MEMBER_A)).to.equal(false);
+            fail = false;
+            (0, chai_1.expect)(yield r.canSee(KEY, MEMBER_A)).to.equal(true);
+            (0, chai_1.expect)(checks).to.have.length(2);
+        }));
+        it("a viewer's sessions that can't be read answer no, and are read again next time", () => __awaiter(void 0, void 0, void 0, function* () {
+            let fail = true;
+            const r = resolver({
+                sessionScope: (viewer) => __awaiter(void 0, void 0, void 0, function* () {
+                    var _a;
+                    scopes.push((_a = viewer.userId) !== null && _a !== void 0 ? _a : '');
+                    if (fail)
+                        throw new Error('database gone');
+                    return undefined;
+                }),
+            });
+            (0, chai_1.expect)(yield r.canSee(KEY, MEMBER_A)).to.equal(false);
+            fail = false;
+            (0, chai_1.expect)(yield r.canSee(KEY, MEMBER_A)).to.equal(true);
+            (0, chai_1.expect)(scopes).to.have.length(2);
+        }));
+        it('a lookup that hangs answers no after the timeout, and is asked again next time', () => __awaiter(void 0, void 0, void 0, function* () {
+            let hang = true;
+            const r = resolver({
+                healedIn: (key) => {
+                    checks.push(key.selector);
+                    return hang ? new Promise(() => undefined) : Promise.resolve(true);
+                },
+                lookupTimeoutMs: 20,
+            });
+            (0, chai_1.expect)(yield r.canSee(KEY, MEMBER_A)).to.equal(false);
+            hang = false;
+            (0, chai_1.expect)(yield r.canSee(KEY, MEMBER_A)).to.equal(true);
+            (0, chai_1.expect)(checks).to.have.length(2);
+        }));
+    });
+    describe("REST's rule, on a real database (Selector Health's own fixture)", () => {
+        const scratch = (0, scratch_database_1.useScratchDatabase)({ wholeSuite: true });
+        const UNPLUGGED = 'sh-phone-unplugged';
+        before(() => __awaiter(void 0, void 0, void 0, function* () {
+            yield (0, selector_health_fixture_1.seedSelectorHealth)(scratch.db);
+            // Priya's session on a phone that has since gone: no Device row.
+            yield scratch.db.session.create({
+                data: {
+                    id: 'sh-s-unplugged',
+                    device_udid: UNPLUGGED,
+                    device_name: 'Gone',
+                    device_platform: 'android',
+                    desired_capabilities: '{}',
+                    session_capabilities: '{}',
+                    node_id: 'localhost',
+                    has_live_video: false,
+                    device_version: '14',
+                    status: 'passed',
+                    user_id: selector_health_fixture_1.USER.priya,
+                },
+            });
+            yield scratch.db.sessionLog.create({
+                data: {
+                    session_id: 'sh-s-unplugged',
+                    url: '/element',
+                    method: 'POST',
+                    title: 'findElement',
+                    response: '{}',
+                    command_name: 'findElement',
+                    is_healed: true,
+                    original_strategy: 'xpath',
+                    original_selector: '//unplugged/only',
+                },
+            });
+        }));
+        const xpath = (selector) => ({ strategy: 'xpath', selector });
+        const teamA = { userId: selector_health_fixture_1.USER.priya, teamIds: [selector_health_fixture_1.TEAM.a] };
+        const teamB = { userId: selector_health_fixture_1.USER.alex, teamIds: [selector_health_fixture_1.TEAM.b] };
+        const noTeam = { userId: 'sh-u-nobody', teamIds: [] };
+        it("a team's member sees the selectors healed on their team's phone or a shared one, not another team's", () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = new SelectorVisibilityResolver_1.SelectorVisibilityResolver();
+            (0, chai_1.expect)(yield r.canSee({ strategy: 'id', selector: selector_health_fixture_1.SEL.warm }, teamA), 'team A phone').to.equal(true);
+            (0, chai_1.expect)(yield r.canSee(xpath(selector_health_fixture_1.SEL.hot), teamA), 'shared phone').to.equal(true);
+            (0, chai_1.expect)(yield r.canSee(xpath(selector_health_fixture_1.SEL.bOnly), teamA), "team B's phone").to.equal(false);
+            (0, chai_1.expect)(yield r.canSee(xpath(selector_health_fixture_1.SEL.bOnly), teamB)).to.equal(true);
+            (0, chai_1.expect)(yield r.canSee({ strategy: 'id', selector: selector_health_fixture_1.SEL.warm }, teamB)).to.equal(false);
+        }));
+        it('a member of no team sees only what healed on a shared phone', () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = new SelectorVisibilityResolver_1.SelectorVisibilityResolver();
+            (0, chai_1.expect)(yield r.canSee(xpath(selector_health_fixture_1.SEL.hot), noTeam)).to.equal(true);
+            (0, chai_1.expect)(yield r.canSee(xpath(selector_health_fixture_1.SEL.muted), noTeam)).to.equal(false);
+            (0, chai_1.expect)(yield r.canSee(xpath(selector_health_fixture_1.SEL.mutedB), noTeam)).to.equal(false);
+        }));
+        it('a heal recorded with no strategy is strategy ""', () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = new SelectorVisibilityResolver_1.SelectorVisibilityResolver();
+            (0, chai_1.expect)(yield r.canSee({ strategy: '', selector: selector_health_fixture_1.SEL.legacy }, noTeam)).to.equal(true);
+        }));
+        it("a phone that has gone leaves its sessions' selectors to their owner", () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = new SelectorVisibilityResolver_1.SelectorVisibilityResolver();
+            (0, chai_1.expect)(yield r.canSee(xpath('//unplugged/only'), teamA), 'Priya owns it').to.equal(true);
+            (0, chai_1.expect)(yield r.canSee(xpath('//unplugged/only'), teamB)).to.equal(false);
+        }));
+        it('an unknown selector is seen by no one', () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = new SelectorVisibilityResolver_1.SelectorVisibilityResolver();
+            (0, chai_1.expect)(yield r.canSee(xpath('//never/healed'), teamA)).to.equal(false);
+        }));
+    });
+});

package/lib/test/unit/self-healing-boot.spec.js

@@ -20,14 +20,17 @@ const plugin_1 = require("../../src/plugin");
 const ServerManager_1 = require("../../src/services/ServerManager");
 const PluginContext_1 = require("../../src/PluginContext");
 const SelfHealingSwitch_1 = require("../../src/services/settings/SelfHealingSwitch");
+const aiEngineSettings_1 = require("../../src/services/settings/aiEngineSettings");
 const logger_1 = __importDefault(require("../../src/logger"));
 /**
- * The self-healing value saved on the Settings page is read once at boot, so a
- * restart doesn't put the server back on the option it was started with. It
- * has to be loaded once the database is ready (migrations ran) and before the
- * first route can answer or the first command arrive.
+ * The self-healing value saved on the Settings page, and the AI engine page's
+ * provider, model and base URL, are read once at boot, so a restart doesn't put
+ * the server back on the options it was started with. They have to be loaded
+ * once the database is ready (migrations ran), after the startup options were
+ * applied (the AI engine's are what a cleared value goes back to), and before
+ * the first route can answer or the first command arrive.
  */
-describe('loading the saved self-healing setting, at boot', () => {
+describe('loading the saved self-healing and AI engine settings, at boot', () => {
     let statics;
     beforeEach(() => {
         statics = {
@@ -57,6 +60,7 @@ describe('loading the saved self-healing setting, at boot', () => {
         // The real one kills every go-ios process on the machine.
         sinon_1.default.stub(boot, 'reapLeftoverGoIos').callsFake(step('reap'));
         sinon_1.default.stub(SelfHealingSwitch_1.SelfHealingSwitch.prototype, 'load').callsFake(step('self-healing setting'));
+        sinon_1.default.stub(aiEngineSettings_1.AiEngineSettings.prototype, 'load').callsFake(step('AI engine settings'));
         sinon_1.default.stub(boot, 'registerRoutes').callsFake(() => {
             steps.push('routes');
             throw new Error('boot stopped by the test');
@@ -69,6 +73,7 @@ describe('loading the saved self-healing setting, at boot', () => {
             'database and migrations',
             'reap',
             'self-healing setting',
+            'AI engine settings',
             'routes',
         ]);
     }));

package/lib/test/unit/self-healing-setting.spec.js

@@ -203,10 +203,10 @@ describe('the AI self-healing switch', () => {
             (0, chai_1.expect)(attemptHealing.calledOnce).to.equal(true);
         }));
         it("still hands a session's own healing tiers to the healing it runs", () => __awaiter(void 0, void 0, void 0, function* () {
-            sinon_1.default.stub(SessionManager_1.SESSION_MANAGER, 'getSession').returns({
-                getCapabilities: () => ({ 'xe:options': { healingTiers: [1, 2] } }),
-            });
-            const driver = { sessionId: 'sess-6' };
+            // Read from the session's driver, which every session has: SESSION_MANAGER
+            // holds a local one only with the dashboard on, and holds none here.
+            const driver = { sessionId: 'sess-6', caps: { 'xe:options': { healingTiers: [1, 2] } } };
+            (0, chai_1.expect)(SessionManager_1.SESSION_MANAGER.getSession('sess-6')).to.equal(undefined);
             yield typedi_1.Container.get(CommandInterceptor_1.CommandInterceptor)
                 .handle(() => __awaiter(void 0, void 0, void 0, function* () {
                 throw noSuchElement();
@@ -219,9 +219,10 @@ describe('the AI self-healing switch', () => {
             let learn;
             beforeEach(() => {
                 sinon_1.default.stub(event_manager_1.DASHBORD_EVENT_MANAGER, 'afterSessionCommand').resolves();
-                learn = sinon_1.default.stub(CommandInterceptor_1.CommandInterceptor.prototype, 'triggerLearning');
+                learn = sinon_1.default.stub(CommandInterceptor_1.CommandInterceptor.prototype, 'triggerLearning').resolves();
             });
-            const afterFind = () => typedi_1.Container.get(CommandInterceptor_1.CommandInterceptor).runPostCommandHooks('sess-7', 'findElement', {}, ['id', 'there'], { ELEMENT: 'el-1' }, pluginArgs);
+            /** A findElement the driver answers with its element. */
+            const afterFind = () => typedi_1.Container.get(CommandInterceptor_1.CommandInterceptor).handle(() => __awaiter(void 0, void 0, void 0, function* () { return ({ ELEMENT: 'el-1' }); }), { sessionId: 'sess-7' }, 'findElement', ['id', 'there', 'sess-7'], pluginArgs, false);
             it('learns the selector while the switch is on', () => __awaiter(void 0, void 0, void 0, function* () {
                 yield afterFind();
                 (0, chai_1.expect)(learn.calledOnce).to.equal(true);

package/lib/test/unit/session-app-resolution.spec.js

@@ -145,7 +145,11 @@ describe('createSession — an app named by id follows the team rule', () => {
                 return owned.includes('admin') || req.some((s) => owned.includes(s));
             },
         });
-        typedi_1.Container.set(UserService_1.UserService, { findById: () => __awaiter(void 0, void 0, void 0, function* () { return null; }) });
+        // Every key's owner is an ACTIVE member: a key names its owner only while
+        // they are. The admin key is unscoped by its admin scope.
+        typedi_1.Container.set(UserService_1.UserService, {
+            findById: (id) => __awaiter(void 0, void 0, void 0, function* () { return ({ id, role: 'MEMBER', status: 'ACTIVE' }); }),
+        });
         sinon_1.default.stub(app_service_1.APP_SERVICE, 'getAppById').callsFake((id) => __awaiter(void 0, void 0, void 0, function* () { var _a; return (_a = APPS[id]) !== null && _a !== void 0 ? _a : null; }));
         const device = { udid: 'u1', host: 'h1', platform: 'android', nodeId: 'node-hub' };
         allocate = sinon_1.default.stub(deviceUtils, 'allocateDeviceForSession').resolves(device);

package/lib/test/unit/session-attribution-wiring.spec.js

@@ -41,10 +41,12 @@ describe('authorizeSessionRequest — identity', () => {
         authDisabledBefore = config_1.config.authDisabled;
         config_1.config.authDisabled = false;
         restore = (0, container_registration_1.saveRegistrations)(ApiKeyService_1.ApiKeyService, JwtKeyService_1.JwtKeyService, UserService_1.UserService);
-        // No such user and no teams, as the developer's database answered for
-        // these ids: the real lookups read that database. Nothing here is about
-        // the owner's teams.
-        typedi_1.Container.set(UserService_1.UserService, { findById: () => __awaiter(void 0, void 0, void 0, function* () { return null; }) });
+        // Every id is an ACTIVE member in no team: a credential names its owner
+        // only while they are (session-create-credential-owner.spec.ts covers
+        // the other cases). The real lookups would read the developer's database.
+        typedi_1.Container.set(UserService_1.UserService, {
+            findById: (id) => __awaiter(void 0, void 0, void 0, function* () { return ({ id, role: 'MEMBER', status: 'ACTIVE' }); }),
+        });
         sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([]);
         svc = new SessionLifecycleService_1.SessionLifecycleService();
     });
@@ -105,7 +107,7 @@ describe('authorizeSessionRequest — identity', () => {
             hasScope: () => false,
         });
         typedi_1.Container.set(JwtKeyService_1.JwtKeyService, {
-            verify: sinon_1.default.stub().resolves({ sub: 'usr_carol' }),
+            verify: sinon_1.default.stub().resolves({ sub: 'usr_carol', scopes: 'sessions' }),
         });
         const res = yield invoke(svc, capsWith({ 'xe:options': { sessionToken: 'tok' } }));
         (0, chai_1.expect)(res.apiKeyId).to.equal(null);
@@ -156,13 +158,14 @@ describe('authorizeSessionRequest — leaseAccess', () => {
         findUser = sinon_1.default.stub().resolves(owner);
         typedi_1.Container.set(UserService_1.UserService, { findById: findUser });
     };
-    const withSessionToken = (owner, teamId = null) => {
+    // A session token carries the scopes of the credential that minted it.
+    const withSessionToken = (owner, teamId = null, scopes = 'sessions') => {
         typedi_1.Container.set(ApiKeyService_1.ApiKeyService, {
             verifyPair: sinon_1.default.stub().resolves(null),
             hasScope: () => false,
         });
         typedi_1.Container.set(JwtKeyService_1.JwtKeyService, {
-            verify: sinon_1.default.stub().resolves({ sub: 'usr_alice', teamId }),
+            verify: sinon_1.default.stub().resolves({ sub: 'usr_alice', teamId, scopes }),
         });
         findUser = sinon_1.default.stub().resolves(owner);
         typedi_1.Container.set(UserService_1.UserService, { findById: findUser });
@@ -208,9 +211,19 @@ describe('authorizeSessionRequest — leaseAccess', () => {
             withKey(keyRow('admin'), user('SUPER_ADMIN', 'INACTIVE'));
             (0, chai_1.expect)((yield access(pairCaps())).canOverride).to.equal(false);
         }));
-        it('follows the role of a session-token caller, ADMIN included', () => __awaiter(void 0, void 0, void 0, function* () {
-            withSessionToken(user('ADMIN'));
+        // By the scopes it was minted with, as a key is judged. By its user's role
+        // alone, an ADMIN's key without the admin scope minted itself an override.
+        it("follows resolveActor's rule on a session token's user's role now", () => __awaiter(void 0, void 0, void 0, function* () {
+            withSessionToken(user('ADMIN'), null, 'admin,sessions');
+            (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(true);
+            withSessionToken(user('ADMIN'), null, 'sessions');
+            (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(false);
+            withSessionToken(user('SUPER_ADMIN'), null, 'admin,sessions');
+            (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(true);
+            withSessionToken(user('SUPER_ADMIN'), null, 'sessions');
             (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(true);
+            withSessionToken(user('MEMBER'), null, 'admin,sessions');
+            (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(false);
             withSessionToken(user('MEMBER'));
             (0, chai_1.expect)((yield access(tokenCaps())).canOverride).to.equal(false);
         }));
@@ -223,9 +236,24 @@ describe('authorizeSessionRequest — leaseAccess', () => {
             (0, chai_1.expect)(res.scoped).to.equal(false);
             (0, chai_1.expect)((yield res.leaseAccess()).canOverride).to.equal(false);
         }));
-        it('is false when the lookup fails, and the teams fall back to the shared pool', () => __awaiter(void 0, void 0, void 0, function* () {
+        // The owner is looked up when the credential is checked: a key names them
+        // only while they are ACTIVE, so a lookup that fails refuses the session
+        // rather than run it as someone who may have been switched off.
+        it('refuses the session when the owner lookup fails', () => __awaiter(void 0, void 0, void 0, function* () {
             withKey(keyRow('admin'), null);
             typedi_1.Container.set(UserService_1.UserService, { findById: sinon_1.default.stub().rejects(new Error('db down')) });
+            let error;
+            try {
+                yield invoke(svc, pairCaps());
+            }
+            catch (e) {
+                error = e;
+            }
+            (0, chai_1.expect)(error === null || error === void 0 ? void 0 : error.message).to.equal('db down');
+        }));
+        it('is false, and the teams fall back to the shared pool, when the team lookup fails', () => __awaiter(void 0, void 0, void 0, function* () {
+            withKey(keyRow('sessions'), user('MEMBER'));
+            teamRows.rejects(new Error('db down'));
             (0, chai_1.expect)(yield access(pairCaps())).to.deep.equal({ canOverride: false, teamIds: [] });
         }));
         it('is true when auth is disabled, where every caller is an admin', () => __awaiter(void 0, void 0, void 0, function* () {
@@ -331,9 +359,9 @@ describe('authorizeSessionRequest — leaseAccess', () => {
             }
             (0, chai_1.expect)(error === null || error === void 0 ? void 0 : error.message).to.equal("xe:options.team 'team_c' is not allowed for this API key");
         }));
-        it('falls back to the shared pool when the lookup fails', () => __awaiter(void 0, void 0, void 0, function* () {
-            withKey(keyRow('sessions'), null);
-            typedi_1.Container.set(UserService_1.UserService, { findById: sinon_1.default.stub().rejects(new Error('db down')) });
+        it('falls back to the shared pool when the team lookup fails', () => __awaiter(void 0, void 0, void 0, function* () {
+            withKey(keyRow('sessions'), user('MEMBER'));
+            teamRows.rejects(new Error('db down'));
             (0, chai_1.expect)(yield scope(pairCaps())).to.deep.equal({ callerTeamIds: [], scoped: true });
         }));
         it('stays unscoped, with no lookup, for a session with no credentials', () => __awaiter(void 0, void 0, void 0, function* () {