@xenon-device-management/xenon 2.14.0 → 2.16.0

package/lib/test/unit/socketServer.scopedEmit.spec.js

@@ -19,6 +19,7 @@ const typedi_1 = require("typedi");
 const SocketServer_1 = require("../../src/services/SocketServer");
 const EventLogService_1 = require("../../src/services/EventLogService");
 const DeviceTeamResolver_1 = require("../../src/services/device-access/DeviceTeamResolver");
+const SelectorVisibilityResolver_1 = require("../../src/services/selector-health/SelectorVisibilityResolver");
 const recording_store_1 = require("../../src/services/recording/recording-store");
 const NotificationService_1 = require("../../src/services/NotificationService");
 const device_store_1 = require("../../src/data-service/device-store");
@@ -32,6 +33,7 @@ const container_registration_1 = require("../helpers/container-registration");
  * `io.to(room).emit` for the unscoped path.
  */
 function fakeIo(specs) {
+    var _a, _b;
     const received = new Map();
     const sockets = new Map();
     const dashboard = new Set();
@@ -43,8 +45,8 @@ function fakeIo(specs) {
             data: {
                 identity: {
                     principal: 'dashboard',
-                    userId: `user-${s.id}`,
-                    role: s.teamIds === undefined ? 'ADMIN' : 'MEMBER',
+                    userId: (_a = s.userId) !== null && _a !== void 0 ? _a : `user-${s.id}`,
+                    role: (_b = s.role) !== null && _b !== void 0 ? _b : (s.teamIds === undefined ? 'ADMIN' : 'MEMBER'),
                     teamIds: s.teamIds,
                 },
             },
@@ -324,15 +326,245 @@ describe('SocketServer.emitToDashboardForDevices — events reach only the teams
             (0, chai_1.expect)(events(inbox('member-a'))).to.deep.equal(['device_unblocked']);
         }));
     });
-    it('emitToDashboard (selector events, nodes) stays unscoped', () => {
+    describe('adminOnly: captured network traffic, which REST serves to admins only', () => {
+        it("reaches admins, never the members who see the phone (a team's or the shared pool's)", () => __awaiter(void 0, void 0, void 0, function* () {
+            const { inbox } = connect(EVERYONE);
+            yield server.emitToDashboardForDevices('interceptor_request', { id: 'q-a' }, { udid: 'phone-a', adminOnly: true });
+            yield server.emitToDashboardForDevices('interceptor_request', { id: 'q-s' }, { udid: 'phone-s', adminOnly: true });
+            (0, chai_1.expect)(inbox('admin').map(([, d]) => d.id)).to.deep.equal(['q-a', 'q-s']);
+            for (const id of ['member-a', 'member-b', 'member-none', 'node']) {
+                (0, chai_1.expect)(inbox(id), id).to.deep.equal([]);
+            }
+        }));
+        it('with members connected it looks nothing up: only admins, who see every phone, are sent it', () => __awaiter(void 0, void 0, void 0, function* () {
+            const { inbox } = connect(EVERYONE);
+            // A slow store must not hold captured requests back either.
+            holdLookups();
+            yield server.emitToDashboardForDevices('interceptor_request', { id: 'q1' }, {
+                udid: 'phone-a',
+                adminOnly: true,
+            });
+            (0, chai_1.expect)(lookups).to.deep.equal([]);
+            (0, chai_1.expect)(events(inbox('admin'))).to.deep.equal(['interceptor_request']);
+            (0, chai_1.expect)(inbox('member-a')).to.deep.equal([]);
+        }));
+        it('the role decides, not the team list: a member with no team list still gets nothing', () => __awaiter(void 0, void 0, void 0, function* () {
+            // No socket has a member's role and no team list today; if one ever
+            // does, it must not take the synchronous room broadcast.
+            const { inbox } = connect([
+                { id: 'admin', teamIds: undefined },
+                { id: 'odd-member', teamIds: undefined, role: 'MEMBER' },
+            ]);
+            yield server.emitToDashboardForDevices('interceptor_request', { id: 'q1' }, { udid: 'phone-s', adminOnly: true });
+            (0, chai_1.expect)(events(inbox('admin'))).to.deep.equal(['interceptor_request']);
+            (0, chai_1.expect)(inbox('odd-member')).to.deep.equal([]);
+        }));
+        it('a socket with no identity never gets it', () => __awaiter(void 0, void 0, void 0, function* () {
+            const { io, inbox } = fakeIo([
+                { id: 'admin', teamIds: undefined },
+                { id: 'odd', teamIds: [] },
+            ]);
+            io.sockets.sockets.get('odd').data = {};
+            server.io = io;
+            yield server.emitToDashboardForDevices('interceptor_request', {}, {
+                udid: 'phone-s',
+                adminOnly: true,
+            });
+            (0, chai_1.expect)(events(inbox('admin'))).to.deep.equal(['interceptor_request']);
+            (0, chai_1.expect)(inbox('odd')).to.deep.equal([]);
+        }));
+        it('auth disabled (every socket a super admin): the room broadcast as before, with no lookup', () => __awaiter(void 0, void 0, void 0, function* () {
+            const { inbox, roomBroadcasts } = connect([
+                { id: 'lab-1', teamIds: undefined, role: 'SUPER_ADMIN' },
+                { id: 'lab-2', teamIds: undefined, role: 'SUPER_ADMIN' },
+            ]);
+            yield server.emitToDashboardForDevices('interceptor_request', {}, {
+                udid: 'phone-b',
+                adminOnly: true,
+            });
+            (0, chai_1.expect)(roomBroadcasts).to.deep.equal(['dashboard']);
+            (0, chai_1.expect)(lookups).to.deep.equal([]);
+            (0, chai_1.expect)(events(inbox('lab-1'))).to.deep.equal(['interceptor_request']);
+            (0, chai_1.expect)(events(inbox('lab-2'))).to.deep.equal(['interceptor_request']);
+        }));
+        it("keeps the phone's order: it waits for the phone's event ahead of it", () => __awaiter(void 0, void 0, void 0, function* () {
+            const { inbox } = connect(EVERYONE);
+            holdLookups();
+            const command = server.emitToDashboardForDevices('session_command', {}, { udid: 'phone-a' });
+            const captured = server.emitToDashboardForDevices('interceptor_request', {}, {
+                udid: 'phone-a',
+                adminOnly: true,
+            });
+            yield new Promise((r) => setImmediate(r));
+            (0, chai_1.expect)(inbox('admin'), 'nothing overtakes the pending event').to.deep.equal([]);
+            openGate();
+            yield Promise.all([command, captured]);
+            (0, chai_1.expect)(events(inbox('admin'))).to.deep.equal(['session_command', 'interceptor_request']);
+            (0, chai_1.expect)(events(inbox('member-a'))).to.deep.equal(['session_command']);
+        }));
+        it('{ udids, strip, adminOnly }: admins only, the payload untouched', () => __awaiter(void 0, void 0, void 0, function* () {
+            const { inbox } = connect(EVERYONE);
+            const payload = { recordings: [{ udid: 'phone-a' }, { udid: 'phone-s' }] };
+            yield server.emitToDashboardForDevices('capture_group', payload, {
+                udids: ['phone-a', 'phone-s'],
+                strip: (d, visible) => (Object.assign(Object.assign({}, d), { recordings: d.recordings.filter((r) => visible.includes(r.udid)) })),
+                adminOnly: true,
+            });
+            (0, chai_1.expect)(inbox('admin')[0][1]).to.equal(payload);
+            for (const id of ['member-a', 'member-b', 'member-none']) {
+                (0, chai_1.expect)(inbox(id), id).to.deep.equal([]);
+            }
+        }));
+        it('is still recorded in the event log once, as any other event', () => __awaiter(void 0, void 0, void 0, function* () {
+            connect(EVERYONE);
+            // interceptor_request itself is never logged (EVENT_LOG_KEEPS); its start is.
+            yield server.emitToDashboardForDevices('interceptor_session_started', { sessionId: 's1' }, {
+                udid: 'phone-a',
+                adminOnly: true,
+            });
+            (0, chai_1.expect)(appendSafe.callCount).to.equal(1);
+        }));
+    });
+    it('node events (emitToDashboard) stay unscoped', () => {
         const { inbox } = connect(EVERYONE);
-        server.emitToDashboard('selector_fixed', { selector: '//x' });
+        server.emitToDashboard('node_connected', { host: 'http://node:4723' });
         for (const id of ['admin', 'member-a', 'member-b', 'member-none']) {
-            (0, chai_1.expect)(events(inbox(id)), id).to.deep.equal(['selector_fixed']);
+            (0, chai_1.expect)(events(inbox(id)), id).to.deep.equal(['node_connected']);
         }
         (0, chai_1.expect)(lookups).to.deep.equal([]);
     });
 });
+describe('SocketServer.emitToDashboardForSelector — a selector event reaches only those who may see the selector', () => {
+    /** The teams whose sessions healed each selector (Selector Health's rule, faked). */
+    const HEALED_ON = {
+        '//team-a': ['team-a'],
+        '//team-b': ['team-b'],
+    };
+    const TEAM_B = { strategy: 'xpath', selector: '//team-b' };
+    let restore;
+    let server;
+    let appendSafe;
+    let viewers;
+    let gate;
+    let openGate;
+    let failLookups;
+    function connect(specs) {
+        const fake = fakeIo(specs);
+        server.io = fake.io;
+        return fake;
+    }
+    beforeEach(() => {
+        restore = (0, container_registration_1.saveRegistrations)(EventLogService_1.EventLogService, SelectorVisibilityResolver_1.SelectorVisibilityResolver);
+        appendSafe = sinon_1.default.spy();
+        typedi_1.Container.set(EventLogService_1.EventLogService, { appendSafe });
+        viewers = [];
+        gate = undefined;
+        failLookups = false;
+        typedi_1.Container.set(SelectorVisibilityResolver_1.SelectorVisibilityResolver, new SelectorVisibilityResolver_1.SelectorVisibilityResolver({
+            sessionScope: (viewer) => __awaiter(void 0, void 0, void 0, function* () { return viewer; }),
+            healedIn: (key, scope) => __awaiter(void 0, void 0, void 0, function* () {
+                var _a;
+                viewers.push(scope);
+                if (gate)
+                    yield gate;
+                if (failLookups)
+                    throw new Error('database gone');
+                return ((_a = HEALED_ON[key.selector]) !== null && _a !== void 0 ? _a : []).some((t) => scope.teamIds.includes(t));
+            }),
+        }));
+        server = new SocketServer_1.SocketServer();
+    });
+    afterEach(() => {
+        sinon_1.default.restore();
+        restore();
+    });
+    const EVERYONE = [
+        { id: 'admin', teamIds: undefined },
+        { id: 'member-a', teamIds: ['team-a'] },
+        { id: 'member-b', teamIds: ['team-b'] },
+        { id: 'member-none', teamIds: [] },
+        { id: 'node', teamIds: ['team-b'], dashboard: false },
+    ];
+    it('an admin gets every selector event; a member only those of selectors they may see', () => __awaiter(void 0, void 0, void 0, function* () {
+        const { inbox } = connect(EVERYONE);
+        yield server.emitToDashboardForSelector('selector_muted', { original_selector: '//team-b' }, TEAM_B);
+        (0, chai_1.expect)(events(inbox('admin'))).to.deep.equal(['selector_muted']);
+        (0, chai_1.expect)(events(inbox('member-b'))).to.deep.equal(['selector_muted']);
+        for (const id of ['member-a', 'member-none', 'node']) {
+            (0, chai_1.expect)(inbox(id), id).to.deep.equal([]);
+        }
+    }));
+    it("asks about each member's user and teams; never about an admin", () => __awaiter(void 0, void 0, void 0, function* () {
+        connect(EVERYONE);
+        yield server.emitToDashboardForSelector('selector_fixed', {}, TEAM_B);
+        (0, chai_1.expect)(viewers).to.have.deep.members([
+            { userId: 'user-member-a', teamIds: ['team-a'] },
+            { userId: 'user-member-b', teamIds: ['team-b'] },
+            { userId: 'user-member-none', teamIds: [] },
+        ]);
+    }));
+    it("a member's two tabs cost one lookup", () => __awaiter(void 0, void 0, void 0, function* () {
+        const { inbox } = connect([
+            { id: 'tab-1', teamIds: ['team-b'], userId: 'u-b' },
+            { id: 'tab-2', teamIds: ['team-b'], userId: 'u-b' },
+        ]);
+        yield server.emitToDashboardForSelector('selector_progress', {}, TEAM_B);
+        (0, chai_1.expect)(viewers).to.have.length(1);
+        (0, chai_1.expect)(events(inbox('tab-1'))).to.deep.equal(['selector_progress']);
+        (0, chai_1.expect)(events(inbox('tab-2'))).to.deep.equal(['selector_progress']);
+    }));
+    it('a lookup that fails sends it to admins only', () => __awaiter(void 0, void 0, void 0, function* () {
+        failLookups = true;
+        const { inbox } = connect(EVERYONE);
+        yield server.emitToDashboardForSelector('selector_regressed', {}, TEAM_B);
+        (0, chai_1.expect)(events(inbox('admin'))).to.deep.equal(['selector_regressed']);
+        (0, chai_1.expect)(inbox('member-b')).to.deep.equal([]);
+    }));
+    it('a socket with no identity is a member of no team, with no user', () => __awaiter(void 0, void 0, void 0, function* () {
+        const { io, inbox } = fakeIo([{ id: 'odd', teamIds: [] }]);
+        io.sockets.sockets.get('odd').data = {};
+        server.io = io;
+        yield server.emitToDashboardForSelector('selector_fixed', {}, TEAM_B);
+        (0, chai_1.expect)(viewers).to.deep.equal([{ userId: undefined, teamIds: [] }]);
+        (0, chai_1.expect)(inbox('odd')).to.deep.equal([]);
+    }));
+    it("a selector's events keep their order: the second waits for the first's lookup", () => __awaiter(void 0, void 0, void 0, function* () {
+        const { inbox } = connect(EVERYONE);
+        gate = new Promise((resolve) => (openGate = resolve));
+        const fixed = server.emitToDashboardForSelector('selector_fixed', {}, TEAM_B);
+        const cancelled = server.emitToDashboardForSelector('selector_cancelled', {}, TEAM_B);
+        yield new Promise((r) => setImmediate(r));
+        (0, chai_1.expect)(inbox('admin'), 'nothing overtakes the pending event').to.deep.equal([]);
+        openGate();
+        yield Promise.all([fixed, cancelled]);
+        for (const id of ['admin', 'member-b']) {
+            (0, chai_1.expect)(events(inbox(id)), id).to.deep.equal(['selector_fixed', 'selector_cancelled']);
+        }
+    }));
+    it('with only unscoped sockets (auth disabled) it is the room broadcast, with no lookup', () => __awaiter(void 0, void 0, void 0, function* () {
+        const { inbox, roomBroadcasts } = connect([
+            { id: 'lab-1', teamIds: undefined, role: 'SUPER_ADMIN' },
+            { id: 'lab-2', teamIds: undefined, role: 'SUPER_ADMIN' },
+        ]);
+        void server.emitToDashboardForSelector('selector_fixed', {}, TEAM_B);
+        (0, chai_1.expect)(roomBroadcasts).to.deep.equal(['dashboard']);
+        (0, chai_1.expect)(viewers).to.deep.equal([]);
+        (0, chai_1.expect)(events(inbox('lab-1'))).to.deep.equal(['selector_fixed']);
+        (0, chai_1.expect)(events(inbox('lab-2'))).to.deep.equal(['selector_fixed']);
+    }));
+    it('is recorded in the event log once, unscoped', () => __awaiter(void 0, void 0, void 0, function* () {
+        connect(EVERYONE);
+        const payload = { original_selector: '//team-b' };
+        yield server.emitToDashboardForSelector('selector_muted', payload, TEAM_B);
+        (0, chai_1.expect)(appendSafe.callCount).to.equal(1);
+        (0, chai_1.expect)(appendSafe.firstCall.args[0]).to.deep.equal({ type: 'selector_muted', payload });
+    }));
+    it('before initialize() (no io) it only logs', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield server.emitToDashboardForSelector('selector_muted', {}, TEAM_B);
+        (0, chai_1.expect)(viewers).to.deep.equal([]);
+        (0, chai_1.expect)(appendSafe.callCount).to.equal(1);
+    }));
+});
 describe('Auth disabled: the lab path looks nothing up', () => {
     let restore;
     let authDisabled;

package/lib/test/unit/socketServer.sessionCookie.spec.js

@@ -59,7 +59,8 @@ describe('SocketServer — a signed-in dashboard session cookie', () => {
         restore = (0, container_registration_1.saveRegistrations)(UserSessionService_1.UserSessionService, UserService_1.UserService, ApiKeyService_1.ApiKeyService, EventLogService_1.EventLogService);
         resolve = sinon_1.default.stub().callsFake((id) => __awaiter(void 0, void 0, void 0, function* () { var _a; return (_a = SESSIONS[id]) !== null && _a !== void 0 ? _a : null; }));
         verify = sinon_1.default.stub().resolves(null);
-        typedi_1.Container.set(UserSessionService_1.UserSessionService, { resolve });
+        // ttlMs: authMiddleware renews the cookie for the session's lifetime.
+        typedi_1.Container.set(UserSessionService_1.UserSessionService, { resolve, ttlMs: () => 24 * 3600000 });
         typedi_1.Container.set(UserService_1.UserService, { findById: (id) => __awaiter(void 0, void 0, void 0, function* () { var _a; return (_a = USERS[id]) !== null && _a !== void 0 ? _a : null; }) });
         typedi_1.Container.set(ApiKeyService_1.ApiKeyService, { verify, verifyPair: sinon_1.default.stub().resolves(null) });
         typedi_1.Container.set(EventLogService_1.EventLogService, { appendSafe: () => undefined });

package/lib/test/unit/stream-start-pipelines.spec.js

@@ -72,6 +72,10 @@ const own_node_id_1 = require("../helpers/own-node-id");
  * cannot decode H.264 (WebCodecs exists only in a secure context, so plain
  * http://hub:4723 has none), shows MJPEG, so it says so when it starts the
  * stream (`player: 'mjpeg'`), and the server then runs MJPEG only.
+ *
+ * Only once nobody plays the H.264 capture, though. A Live devices tile, or a
+ * second tab, may still be playing it when one page falls back to MJPEG; the
+ * capture then ends when its last viewer leaves, not under them.
  */
 const UDID = 'DEV-1';
 function buildApp() {
@@ -98,10 +102,31 @@ describe('POST /control/:udid/stream/start: which capture runs', () => {
     let restoreContainer;
     let savedArgs;
     let mjpegStart;
+    let h264;
     let h264Start;
     let h264Stop;
-    let h264Running;
+    let captureKills;
+    let pushPacket;
     let row;
+    /** The real H.264 service with its capture (scrcpy) stubbed out. */
+    const h264Service = () => {
+        const svc = Object.create(AndroidH264StreamService_1.default.prototype);
+        svc.sessions = new Map();
+        svc.startPromises = new Map();
+        svc.scrcpyIncompatible = new Set();
+        svc.openCapture = (_udid, onPacket) => __awaiter(void 0, void 0, void 0, function* () {
+            pushPacket = onPacket;
+            onPacket({ type: 'config', data: Buffer.from([0]), ptsMs: 0 });
+            return { kill: () => (captureKills += 1) };
+        });
+        return svc;
+    };
+    /** Another page playing the phone's H.264 preview: what it got, and its leave. */
+    const h264Viewer = () => __awaiter(void 0, void 0, void 0, function* () {
+        const got = [];
+        const leave = (yield h264.start(UDID)).addClient((p) => got.push(p.type));
+        return { got, leave };
+    });
     const flag = (androidH264) => {
         typedi_1.Container.get(PluginContext_1.PluginContext).pluginArgs = Object.assign(Object.assign({}, savedArgs), { streaming: { androidH264 } });
     };
@@ -120,27 +145,27 @@ describe('POST /control/:udid/stream/start: which capture runs', () => {
         };
         sinon_1.default.stub(device_store_1.DeviceStoreFactory, 'getStore').returns({ findDevice: () => __awaiter(void 0, void 0, void 0, function* () { return row; }) });
         sinon_1.default.stub(deviceService, 'blockDevice').resolves();
-        h264Running = false;
+        captureKills = 0;
         mjpegStart = sinon_1.default.stub().resolves({ mjpegPort: 9100 });
-        h264Start = sinon_1.default.stub().callsFake(() => __awaiter(void 0, void 0, void 0, function* () {
-            h264Running = true;
-            return {};
-        }));
-        h264Stop = sinon_1.default.stub().callsFake(() => __awaiter(void 0, void 0, void 0, function* () {
-            h264Running = false;
-        }));
+        h264 = h264Service();
         typedi_1.Container.set(AndroidStreamService_1.default, {
             startStream: mjpegStart,
             getStreamStatus: () => undefined,
         });
         typedi_1.Container.set(IOSStreamService_1.default, { getStreamStatus: () => undefined });
-        typedi_1.Container.set(AndroidH264StreamService_1.default, {
-            start: h264Start,
-            stop: h264Stop,
-            getMultiplexer: () => (h264Running ? { clientCount: 0 } : undefined),
-        });
+        typedi_1.Container.set(AndroidH264StreamService_1.default, h264);
         typedi_1.Container.set(recording_store_1.RecordingStore, { isRecording: () => __awaiter(void 0, void 0, void 0, function* () { return false; }) });
+        // Spied after any setup start, so they count only what the route does.
+        h264Start = sinon_1.default.spy(h264, 'start');
+        h264Stop = sinon_1.default.spy(h264, 'stop');
     });
+    /** An H.264 capture already running for the phone, as a tile's start leaves it. */
+    const h264AlreadyRunning = () => __awaiter(void 0, void 0, void 0, function* () {
+        h264Start.restore();
+        yield h264.start(UDID);
+        h264Start = sinon_1.default.spy(h264, 'start');
+    });
+    const h264Running = () => h264.getMultiplexer(UDID) !== undefined;
     afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
         sinon_1.default.restore();
         typedi_1.Container.get(PluginContext_1.PluginContext).pluginArgs = savedArgs;
@@ -170,20 +195,39 @@ describe('POST /control/:udid/stream/start: which capture runs', () => {
         (0, chai_1.expect)(mjpegStart.calledOnce).to.equal(true);
         (0, chai_1.expect)(h264Start.called).to.equal(false);
     }));
-    it('ends an H.264 capture already running for the phone, so the two never overlap', () => __awaiter(void 0, void 0, void 0, function* () {
+    it('ends an H.264 capture nobody is watching, so the two never overlap', () => __awaiter(void 0, void 0, void 0, function* () {
         flag(true);
-        h264Running = true;
+        yield h264AlreadyRunning();
         yield start({ player: 'mjpeg' });
         (0, chai_1.expect)(h264Stop.calledOnceWith(UDID)).to.equal(true);
+        (0, chai_1.expect)(captureKills).to.equal(1);
         (0, chai_1.expect)(mjpegStart.calledOnce).to.equal(true);
-        (0, chai_1.expect)(h264Running).to.equal(false);
+        (0, chai_1.expect)(h264Running()).to.equal(false);
     }));
     it('stops the H.264 capture before it starts the MJPEG one', () => __awaiter(void 0, void 0, void 0, function* () {
         flag(true);
-        h264Running = true;
+        yield h264AlreadyRunning();
         yield start({ player: 'mjpeg' });
         (0, chai_1.expect)(h264Stop.calledBefore(mjpegStart)).to.equal(true);
     }));
+    it('keeps the H.264 capture for another page still playing it', () => __awaiter(void 0, void 0, void 0, function* () {
+        flag(true);
+        const other = yield h264Viewer();
+        const res = yield start({ player: 'mjpeg' });
+        (0, chai_1.expect)(res.body.type).to.equal('mjpeg');
+        (0, chai_1.expect)(mjpegStart.calledOnce).to.equal(true);
+        (0, chai_1.expect)(captureKills).to.equal(0);
+        pushPacket({ type: 'key', data: Buffer.from([1]), ptsMs: 1 });
+        (0, chai_1.expect)(other.got).to.deep.equal(['config', 'key']);
+    }));
+    it('ends the H.264 capture when that last page leaves, without waiting for the idle stop', () => __awaiter(void 0, void 0, void 0, function* () {
+        flag(true);
+        const other = yield h264Viewer();
+        yield start({ player: 'mjpeg' });
+        other.leave();
+        (0, chai_1.expect)(captureKills).to.equal(1);
+        (0, chai_1.expect)(h264Running()).to.equal(false);
+    }));
     it('runs MJPEG alone, and stops nothing, when the flag is off', () => __awaiter(void 0, void 0, void 0, function* () {
         flag(false);
         const res = yield start();
@@ -207,4 +251,14 @@ describe('POST /control/:udid/stream/start: which capture runs', () => {
         (0, chai_1.expect)(mjpegStart.calledOnce).to.equal(true);
         (0, chai_1.expect)(h264Start.called).to.equal(false);
     }));
+    it('ends H.264 at once for a phone being recorded, viewers or not, as before', () => __awaiter(void 0, void 0, void 0, function* () {
+        // A recording reads the MJPEG capture, and H.264 never runs beside it
+        // (ensureMjpegForRecording stopped it when the recording began).
+        flag(true);
+        yield h264Viewer();
+        typedi_1.Container.set(recording_store_1.RecordingStore, { isRecording: () => __awaiter(void 0, void 0, void 0, function* () { return true; }) });
+        yield start();
+        (0, chai_1.expect)(captureKills).to.equal(1);
+        (0, chai_1.expect)(h264Running()).to.equal(false);
+    }));
 });

package/lib/test/unit/token-mint-limits.spec.js

@@ -0,0 +1,165 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const jose = __importStar(require("jose"));
+const typedi_1 = require("typedi");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const auth_1 = require("../../src/app/routers/auth");
+const container_registration_1 = require("../helpers/container-registration");
+/**
+ * A token POST /auth/token mints never carries more than the credential
+ * minting it: not more scopes, and not a longer life.
+ *
+ * - The `sessionToken` beside a xenon-mcp token creates Appium sessions, so
+ *   it is minted only when the grant includes `appium:use` (which needs the
+ *   `sessions` scope), and carries the scopes a session is judged by. Any
+ *   credential used to get one, a read-only key included.
+ * - A token minted with a Bearer token, or an API key that expires, ends no
+ *   later than that credential. A 1-hour token used to mint a fresh 1-hour
+ *   token, for ever.
+ */
+describe('POST /auth/token mints nothing its creator does not have', () => {
+    let dir;
+    let restoreContainer;
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService);
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-mint-limits-'));
+        const svc = new JwtKeyService_1.JwtKeyService();
+        yield svc.init(dir);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, svc);
+    }));
+    afterEach(() => {
+        restoreContainer();
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    const base = { kind: 'api-key', userId: 'u1', role: 'MEMBER', teamId: null, rateLimit: 300 };
+    const auth = (extra) => (Object.assign(Object.assign({}, base), extra));
+    describe('the session token', () => {
+        it('is not minted for a read-only credential', () => __awaiter(void 0, void 0, void 0, function* () {
+            const out = yield (0, auth_1.issueToken)(auth({ scopes: 'read' }), { audience: 'xenon-mcp' });
+            (0, chai_1.expect)(out.token).to.be.a('string');
+            (0, chai_1.expect)(out.sessionToken).to.equal(undefined);
+        }));
+        it('is not minted when the grant asked for leaves out appium:use', () => __awaiter(void 0, void 0, void 0, function* () {
+            const out = yield (0, auth_1.issueToken)(auth({ scopes: 'devices,sessions,read' }), {
+                audience: 'xenon-mcp',
+                scopes: ['xenon:devices:read'],
+            });
+            (0, chai_1.expect)(out.sessionToken).to.equal(undefined);
+        }));
+        it('carries `sessions`, and `admin` only when its creator has it', () => __awaiter(void 0, void 0, void 0, function* () {
+            const member = yield (0, auth_1.issueToken)(auth({ scopes: 'devices,sessions,read' }), {
+                audience: 'xenon-mcp',
+            });
+            (0, chai_1.expect)(jose.decodeJwt(String(member.sessionToken)).scopes).to.equal('sessions');
+            const dashboardAdmin = yield (0, auth_1.issueToken)(auth({ kind: 'user-session', role: 'ADMIN', scopes: 'admin,devices,sessions,read' }), { audience: 'xenon-mcp' });
+            (0, chai_1.expect)(jose.decodeJwt(String(dashboardAdmin.sessionToken)).scopes).to.equal('admin,sessions');
+        }));
+    });
+    // `admin` lets a session take over a lease someone else made. A token asked
+    // for with narrower MCP scopes doesn't get it from an admin key's breadth.
+    describe("the session token's admin scope follows the grant", () => {
+        const adminKey = () => auth({ scopes: 'admin' });
+        const scopesOf = (t) => jose.decodeJwt(String(t)).scopes;
+        it('is left out when narrower scopes are asked for', () => __awaiter(void 0, void 0, void 0, function* () {
+            const out = yield (0, auth_1.issueToken)(adminKey(), { audience: 'xenon-mcp', scopes: ['appium:use'] });
+            (0, chai_1.expect)(scopesOf(out.sessionToken)).to.equal('sessions');
+        }));
+        it('is given for the default grant, and for a full-admin one', () => __awaiter(void 0, void 0, void 0, function* () {
+            const byDefault = yield (0, auth_1.issueToken)(adminKey(), { audience: 'xenon-mcp' });
+            (0, chai_1.expect)(scopesOf(byDefault.sessionToken)).to.equal('admin,sessions');
+            const full = yield (0, auth_1.issueToken)(adminKey(), {
+                audience: 'xenon-mcp',
+                scopes: [
+                    'appium:use',
+                    'xenon:analytics:read',
+                    'xenon:devices:lock',
+                    'xenon:devices:read',
+                    'xenon:recordings',
+                ],
+            });
+            (0, chai_1.expect)(scopesOf(full.sessionToken)).to.equal('admin,sessions');
+        }));
+    });
+    describe('its lifetime', () => {
+        const now = () => Math.floor(Date.now() / 1000);
+        for (const audience of ['xenon-rest', 'xenon-mcp']) {
+            it(`a ${audience} token ends no later than the credential that minted it`, () => __awaiter(void 0, void 0, void 0, function* () {
+                const creatorExp = now() + 600;
+                const out = yield (0, auth_1.issueToken)(auth({ kind: 'bearer', scopes: 'sessions,read', credentialExpiresAt: creatorExp * 1000 }), { audience });
+                const p = jose.decodeJwt(out.token);
+                (0, chai_1.expect)(p.exp).to.be.at.most(creatorExp);
+                (0, chai_1.expect)(out.expiresIn).to.be.at.most(600);
+                (0, chai_1.expect)(out.expiresIn).to.be.at.least(598);
+                if (out.sessionToken) {
+                    (0, chai_1.expect)(jose.decodeJwt(out.sessionToken).exp).to.be.at.most(creatorExp);
+                }
+            }));
+        }
+        it('keeps its own lifetime when the credential outlives it', () => __awaiter(void 0, void 0, void 0, function* () {
+            const out = yield (0, auth_1.issueToken)(auth({ scopes: 'sessions', credentialExpiresAt: Date.now() + 30 * 86400000 }), { audience: 'xenon-rest' });
+            (0, chai_1.expect)(out.expiresIn).to.equal(3600);
+        }));
+        it('is refused when the credential has already expired', () => __awaiter(void 0, void 0, void 0, function* () {
+            let caught;
+            try {
+                yield (0, auth_1.issueToken)(auth({ scopes: 'sessions', credentialExpiresAt: Date.now() - 1000 }), {
+                    audience: 'xenon-rest',
+                });
+            }
+            catch (err) {
+                caught = err;
+            }
+            (0, chai_1.expect)(caught === null || caught === void 0 ? void 0 : caught.message).to.match(/expired/);
+        }));
+    });
+});