@xenon-device-management/xenon 2.15.0 → 2.16.0

package/lib/src/services/ApiKeyService.js

@@ -23,6 +23,7 @@ const typedi_1 = require("typedi");
 const crypto_1 = __importDefault(require("crypto"));
 const prisma_1 = require("../prisma");
 const logger_1 = __importDefault(require("../logger"));
+const identityChanges_1 = require("./identity/identityChanges");
 let ApiKeyService = class ApiKeyService {
     constructor() {
         this.log = logger_1.default.scope('ApiKey');
@@ -38,8 +39,13 @@ let ApiKeyService = class ApiKeyService {
     generateRaw() {
         return crypto_1.default.randomBytes(32).toString('hex');
     }
-    verify(raw) {
-        return __awaiter(this, void 0, void 0, function* () {
+    /**
+     * The live key for `raw`. A use of it is recorded (`lastUsedAt`);
+     * `touch: false` only looks, for a check that isn't a use (a socket's
+     * re-check). Likewise verifyPair.
+     */
+    verify(raw_1) {
+        return __awaiter(this, arguments, void 0, function* (raw, { touch = true } = {}) {
             if (!raw)
                 return null;
             const row = yield prisma_1.prisma.apiKey.findUnique({ where: { keyHash: this.hash(raw) } });
@@ -47,6 +53,8 @@ let ApiKeyService = class ApiKeyService {
                 return null;
             if (row.expiresAt && row.expiresAt.getTime() <= Date.now())
                 return null;
+            if (!touch)
+                return row;
             prisma_1.prisma.apiKey
                 .update({ where: { id: row.id }, data: { lastUsedAt: new Date() } })
                 .catch(() => undefined);
@@ -77,8 +85,8 @@ let ApiKeyService = class ApiKeyService {
             return { id: row.id, raw };
         });
     }
-    verifyPair(accessKey, token) {
-        return __awaiter(this, void 0, void 0, function* () {
+    verifyPair(accessKey_1, token_1) {
+        return __awaiter(this, arguments, void 0, function* (accessKey, token, { touch = true } = {}) {
             if (!accessKey || !token)
                 return null;
             const user = yield prisma_1.prisma.user.findUnique({ where: { accessKey } });
@@ -91,6 +99,8 @@ let ApiKeyService = class ApiKeyService {
                 return null;
             if (row.expiresAt && row.expiresAt.getTime() <= Date.now())
                 return null;
+            if (!touch)
+                return row;
             prisma_1.prisma.apiKey
                 .update({ where: { id: row.id }, data: { lastUsedAt: new Date() } })
                 .catch(() => undefined);
@@ -99,7 +109,8 @@ let ApiKeyService = class ApiKeyService {
     }
     revoke(id) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield prisma_1.prisma.apiKey.update({ where: { id }, data: { revokedAt: new Date() } });
+            const row = yield prisma_1.prisma.apiKey.update({ where: { id }, data: { revokedAt: new Date() } });
+            yield (0, identityChanges_1.identityChanged)(row.userId);
         });
     }
     list() {

package/lib/src/services/InterceptorService.js

@@ -240,7 +240,11 @@ let InterceptorService = class InterceptorService {
             throw new Error(`Interceptor not active for session ${sessionId}`);
         return state;
     }
-    /** `udid` is the session's phone: the dashboard events reach only the teams that see it. */
+    /**
+     * `udid` is the session's phone. The dashboard events reach only admins who
+     * see it: a captured request's headers and bodies can carry the app's
+     * sign-in tokens, and REST's /interceptor routes are admin-only too.
+     */
     emit(evt, udid) {
         for (const l of this.listeners) {
             try {
@@ -255,7 +259,7 @@ let InterceptorService = class InterceptorService {
     broadcast(evt, udid) {
         try {
             const socket = typedi_1.Container.get(SocketServer_1.SocketServer);
-            const scope = { udid };
+            const scope = { udid, adminOnly: true };
             if (evt.type === 'request') {
                 void socket.emitToDashboardForDevices(SocketEvents_1.SocketEvents.INTERCEPTOR_REQUEST, evt.payload, scope);
             }

package/lib/src/services/OrphanSweeper.js

@@ -26,6 +26,7 @@ const event_manager_1 = require("../dashboard/event-manager");
 const SessionStatus_1 = require("../types/SessionStatus");
 const device_service_1 = require("../data-service/device-service");
 const PhoneNetworkRestore_1 = require("./network/PhoneNetworkRestore");
+const TracingService_1 = require("./TracingService");
 const sessionMemory_1 = require("../sessions/sessionMemory");
 let OrphanSweeper = class OrphanSweeper {
     constructor() {
@@ -76,6 +77,11 @@ let OrphanSweeper = class OrphanSweeper {
                     // the ledger's, at boot (PhoneNetworkRestore).
                     yield typedi_1.Container.get(PhoneNetworkRestore_1.PhoneNetworkRestore).restoreSession(s.id, 'heartbeat timeout');
                     (0, sessionMemory_1.forgetSessionMemory)(s.id);
+                    // A previous process's session has no span here; this one's ends.
+                    typedi_1.Container.get(TracingService_1.TracingService).endSessionSpan(s.id, {
+                        failed: true,
+                        reason: 'Session heartbeat timeout',
+                    });
                     // This session's claim only, not every row with its udid: the phone
                     // may be another session's by now (deviceClaims.ts).
                     yield (0, device_service_1.releaseSessionDevices)(s.id);

package/lib/src/services/SelectorStateService.js

@@ -51,6 +51,10 @@ function whereTuple(strategy, selector) {
         },
     };
 }
+/** Just the selector a change is about, for the socket server's scoped emit. */
+function selectorOf(tuple) {
+    return { strategy: tuple.strategy, selector: tuple.selector };
+}
 /** The SelectorEvent row for one change. */
 function selectorEventData(tuple, action, userId, reason) {
     return {
@@ -140,7 +144,7 @@ let SelectorStateService = class SelectorStateService {
                 return upserted;
             }));
             scopedLog.info(`markFixed: ${ctx.strategy}=${ctx.selector} → pending (api_key=${ctx.apiKeyId})`);
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_FIXED, serialize(row));
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_FIXED, serialize(row), selectorOf(ctx));
             return row;
         });
     }
@@ -174,7 +178,7 @@ let SelectorStateService = class SelectorStateService {
                 return upserted;
             }));
             scopedLog.info(`mute: ${ctx.strategy}=${ctx.selector} → muted (api_key=${ctx.apiKeyId})`);
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_MUTED, serialize(row));
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_MUTED, serialize(row), selectorOf(ctx));
             return row;
         });
     }
@@ -231,13 +235,13 @@ let SelectorStateService = class SelectorStateService {
             scopedLog.info(`unmute: ${ctx.strategy}=${ctx.selector} → ${result ? 'active' : 'deleted'} (api_key=${ctx.apiKeyId})`);
             // Emit the post-state. When the row was deleted, surface the prior tuple
             // so the dashboard can drop it from the muted list.
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_UNMUTED, result
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_UNMUTED, result
                 ? serialize(result)
                 : {
                     original_strategy: ctx.strategy,
                     original_selector: ctx.selector,
                     status: 'deleted',
-                });
+                }, selectorOf(ctx));
             return result;
         });
     }
@@ -279,13 +283,13 @@ let SelectorStateService = class SelectorStateService {
                 return row;
             }));
             scopedLog.info(`cancelVerification: ${ctx.strategy}=${ctx.selector} → ${result ? 'active' : 'deleted'} (api_key=${ctx.apiKeyId})`);
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_CANCELLED, result
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_CANCELLED, result
                 ? serialize(result)
                 : {
                     original_strategy: ctx.strategy,
                     original_selector: ctx.selector,
                     status: 'deleted',
-                });
+                }, selectorOf(ctx));
             return result;
         });
     }
@@ -329,7 +333,7 @@ let SelectorStateService = class SelectorStateService {
                 return updated;
             }));
             scopedLog.warn(`onHealRecorded: ${ctx.strategy}=${ctx.selector} regressed from ${existing.status} (session=${ctx.sessionId})`);
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_REGRESSED, serialize(row));
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_REGRESSED, serialize(row), selectorOf(ctx));
             return row;
         });
     }

package/lib/src/services/SelectorVerificationJob.js

@@ -39,6 +39,10 @@ const log = logger_1.default.scope('SelectorVerification');
  * selector that was never found again was verified as fixed.
  */
 const CLEAN_BUILDS_TO_RESOLVE = 3;
+/** The selector a row is about, as the socket server's scoped emit names it. */
+function keyOfRow(row) {
+    return { strategy: row.original_strategy, selector: row.original_selector };
+}
 /**
  * Periodically scans Pending SelectorState rows and promotes them to Resolved
  * once enough clean CI builds have been observed (no heals on the selector
@@ -180,7 +184,7 @@ let SelectorVerificationJob = class SelectorVerificationJob {
                 return promoted;
             }));
             log.info(`[${row.id}] promoted to resolved (${row.original_strategy}=${row.original_selector})`);
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_RESOLVED, this.serialize(updated));
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_RESOLVED, this.serialize(updated), keyOfRow(row));
         });
     }
     updateProgress(row, cleanBuildCount) {
@@ -189,7 +193,7 @@ let SelectorVerificationJob = class SelectorVerificationJob {
                 where: { id: row.id },
                 data: { clean_builds_count: cleanBuildCount, last_event_at: new Date() },
             });
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_PROGRESS, this.serialize(updated));
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_PROGRESS, this.serialize(updated), keyOfRow(row));
         });
     }
     serialize(row) {

package/lib/src/services/SessionLifecycleService.js

@@ -56,8 +56,6 @@ const typedi_1 = require("typedi");
 const uuid_1 = require("uuid");
 const lodash_1 = __importDefault(require("lodash"));
 const axios_1 = __importDefault(require("axios"));
-const https_proxy_agent_1 = require("https-proxy-agent");
-const http_proxy_agent_1 = require("http-proxy-agent");
 const logger_1 = __importDefault(require("../logger"));
 const helpers_1 = require("../helpers");
 const InternalHttpClient_1 = require("../InternalHttpClient");
@@ -848,7 +846,7 @@ let SessionLifecycleService = class SessionLifecycleService {
     }
     finalizeSession(session_1, device_1, caps_1, driver_1, isRemote_1) {
         return __awaiter(this, arguments, void 0, function* (session, device, caps, driver, isRemote, apiKeyId = null, userId = null, allocatedAt) {
-            var _a;
+            var _a, _b;
             const sessionId = session.value[0];
             const sessionResponse = session.value[1];
             const requestedCaps = Object.assign({}, ((_a = caps.firstMatch) === null || _a === void 0 ? void 0 : _a[0]) || {}, caps.alwaysMatch || {});
@@ -865,6 +863,23 @@ let SessionLifecycleService = class SessionLifecycleService {
                     'xenon.udid': device.udid,
                 });
             }
+            try {
+                yield this.registerSession(sessionId, sessionResponse, device, xenonCapabilities, driver, isRemote, apiKeyId, userId, allocatedAt);
+            }
+            catch (err) {
+                // The create fails, so no ending of the session will come to end it.
+                tracingService.endSessionSpan(sessionId, {
+                    failed: true,
+                    reason: `Xenon could not finish creating the session: ${(_b = err === null || err === void 0 ? void 0 : err.message) !== null && _b !== void 0 ? _b : err}`,
+                });
+                throw err;
+            }
+        });
+    }
+    /** The rest of finalizeSession, once the session's span has started. */
+    registerSession(sessionId, sessionResponse, device, xenonCapabilities, driver, isRemote, apiKeyId, userId, allocatedAt) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const context = typedi_1.Container.get(PluginContext_1.PluginContext);
             // The session takes over the pending claim its phone was allocated with.
             yield (0, device_service_1.claimDeviceForSession)(device, sessionId, {
                 session_id: sessionId,
@@ -1063,19 +1078,8 @@ let SessionLifecycleService = class SessionLifecycleService {
                 timeout: exports.REMOTE_CREATE_TIMEOUT_MS,
                 retry: false,
             };
-            if (context.pluginArgs.proxy) {
-                this.logger.info(`Added proxy to axios config: ${JSON.stringify(context.pluginArgs.proxy)}`);
-                const proxyUrl = typeof context.pluginArgs.proxy === 'string'
-                    ? context.pluginArgs.proxy
-                    : `http://${context.pluginArgs.proxy.host}:${context.pluginArgs.proxy.port}`;
-                config.httpsAgent = new https_proxy_agent_1.HttpsProxyAgent(proxyUrl, {
-                    rejectUnauthorized: context.pluginArgs.tlsRejectUnauthorized,
-                });
-                config.httpAgent = new http_proxy_agent_1.HttpProxyAgent(proxyUrl, {
-                    rejectUnauthorized: context.pluginArgs.tlsRejectUnauthorized,
-                });
-                config.proxy = false;
-            }
+            // Its proxy is InternalHttpClient's, by Xenon's one rule: the `proxy`
+            // option, else the environment's (helpers/outboundProxy.ts).
             const createdSession = yield this.invokeSessionRequest(config, context.pluginArgs.tlsRejectUnauthorized);
             if (createdSession instanceof Error) {
                 return createdSession;
@@ -1207,6 +1211,12 @@ let SessionLifecycleService = class SessionLifecycleService {
                 if (sessionId) {
                     typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners).forget(sessionId);
                     (0, sessionMemory_1.forgetSessionMemory)(sessionId);
+                    // Whether or not SESSION_MANAGER holds the session (a local one with
+                    // the dashboard off), and once: a second delete finds no span.
+                    typedi_1.Container.get(TracingService_1.TracingService).endSessionSpan(sessionId, {
+                        failed: status === SessionStatus_1.SessionStatus.FAILED,
+                        reason,
+                    });
                     // Before the lock's "still in memory?" check, which a dashboard-off
                     // node fails. On a node this ends the figures it holds for its hub;
                     // on a hub it collects a node session's last ones. Idempotent.
@@ -1240,8 +1250,11 @@ let SessionLifecycleService = class SessionLifecycleService {
                     logger_1.default.warn(`Port release failed: ${err.message}`);
                 }
             }
-            // 1. iOS Profiling Archival
-            if (device && ((_a = device.platform) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'ios') {
+            // 1. iOS Profiling Archival. Only on an iPhone, the one place
+            // EventManager.onSessionStarted starts it. A simulator's driver refuses
+            // the stop without relaxed security, and the refused stop counted as a
+            // failed command of the session: every simulator session ended failed.
+            if (device && ((_a = device.platform) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'ios' && device.realDevice === true) {
                 this.logger.info(`[${sessionId}] Stopping iOS profiling for asset archival`);
                 try {
                     const traceBase64 = yield session.stopPerformanceRecording();
@@ -1323,6 +1336,7 @@ let SessionLifecycleService = class SessionLifecycleService {
                 SessionManager_1.SESSION_MANAGER.removeSession(sessionId);
                 typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners).forget(sessionId);
                 (0, sessionMemory_1.forgetSessionMemory)(sessionId);
+                typedi_1.Container.get(TracingService_1.TracingService).endSessionSpan(sessionId, { failed: true, reason });
                 yield typedi_1.Container.get(SessionMetricsService_1.SessionMetricsService).stop(sessionId);
             }));
         });

package/lib/src/services/SocketClient.js

@@ -15,6 +15,7 @@ const typedi_1 = require("typedi");
 const logger_1 = __importDefault(require("../logger"));
 const config_1 = require("../config");
 const SocketEvents_1 = require("../enums/SocketEvents");
+const outboundProxy_1 = require("../helpers/outboundProxy");
 let SocketClient = class SocketClient {
     constructor() {
         this.socket = null;
@@ -46,6 +47,16 @@ let SocketClient = class SocketClient {
             reconnectionDelay: 1000,
             reconnectionDelayMax: 5000,
             auth: socketAuth,
+            // The proxy the node's other calls to its hub take (its phone reports,
+            // its JWKS fetch); it used to go straight to the hub whatever the
+            // environment said. Polling goes as plain requests, as axios sends
+            // them; only the WebSocket upgrade needs a CONNECT tunnel, and when the
+            // proxy refuses one (a stock Squid allows port 443 only) the
+            // connection stays on polling.
+            transportOptions: {
+                polling: { agent: (0, outboundProxy_1.proxyAgentFor)(normalizedHubUrl) },
+                websocket: { agent: (0, outboundProxy_1.socketProxyAgentFor)(normalizedHubUrl) },
+            },
         });
         this.socket.on('connect', () => {
             var _a, _b, _c;