@xenon-device-management/xenon 2.15.0 → 2.16.0

package/lib/test/unit/socket-team-scope.integration.spec.js

@@ -16,6 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const http_1 = __importDefault(require("http"));
+const express_1 = __importDefault(require("express"));
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
@@ -24,16 +25,30 @@ const socket_io_client_1 = require("socket.io-client");
 const SocketServer_1 = require("../../src/services/SocketServer");
 const EventLogService_1 = require("../../src/services/EventLogService");
 const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const verifyCredential_1 = require("../../src/middleware/verifyCredential");
 const ApiKeyService_1 = require("../../src/services/ApiKeyService");
+const UserSessionService_1 = require("../../src/services/UserSessionService");
 const DeviceTeamResolver_1 = require("../../src/services/device-access/DeviceTeamResolver");
 const device_store_1 = require("../../src/data-service/device-store");
 const device_service_1 = require("../../src/data-service/device-service");
 const event_manager_1 = require("../../src/dashboard/event-manager");
 const SessionManager_1 = require("../../src/sessions/SessionManager");
 const NotificationService_1 = require("../../src/services/NotificationService");
+const InterceptorService_1 = require("../../src/services/InterceptorService");
+const SelectorStateService_1 = require("../../src/services/SelectorStateService");
+const SelectorVisibilityResolver_1 = require("../../src/services/selector-health/SelectorVisibilityResolver");
 const prisma_1 = require("../../src/prisma");
 const config_1 = require("../../src/config");
+const users_1 = require("../../src/app/routers/users");
+const teams_1 = require("../../src/app/routers/teams");
+const apikeys_1 = require("../../src/app/routers/apikeys");
+const auth_1 = require("../../src/app/routers/auth");
 const container_registration_1 = require("../helpers/container-registration");
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const scratch_database_1 = require("../helpers/scratch-database");
+const UserService_1 = require("../../src/services/UserService");
+const identityChanges_1 = require("../../src/services/identity/identityChanges");
+const selector_health_fixture_1 = require("../helpers/selector-health-fixture");
 /**
  * A real Socket.io server (SocketServer.initialize on a real http server) and
  * two real socket.io clients: a team-A member and an admin, both connecting
@@ -173,4 +188,738 @@ describe('Live dashboard events are team-scoped (real Socket.io, two clients)',
         (0, chai_1.expect)(member.inbox).to.have.length(2);
         (0, chai_1.expect)(onPhone(member.inbox, 'phone-a')).to.deep.equal(['device_added', 'session_command']);
     }));
+    it("a request captured on the member's own team phone reaches the admin only", () => __awaiter(void 0, void 0, void 0, function* () {
+        const member = yield connect('u-member-a');
+        const admin = yield connect('u-admin');
+        yield until(() => dashboardRoomSize() === 2, 'both clients in the dashboard room');
+        // The headers and bodies of a captured request can carry the app's
+        // sign-in tokens; REST's /interceptor routes are admin-only.
+        const captured = {
+            id: 'q1',
+            sessionId: 'session-on-phone-a',
+            reqHeaders: { authorization: 'Bearer app-secret' },
+            resHeaders: { 'set-cookie': 'sid=app-secret' },
+        };
+        const interceptor = new InterceptorService_1.InterceptorService();
+        interceptor.emit({ type: 'session_started', sessionId: 'session-on-phone-a', port: 1, host: 'h' }, 'phone-a');
+        interceptor.emit({ type: 'request', sessionId: captured.sessionId, payload: captured }, 'phone-a');
+        interceptor.emit({ type: 'session_stopped', sessionId: captured.sessionId }, 'phone-a');
+        // A member's event on the same phone, sent after them, proves the
+        // member's socket is live: one chain delivers the phone's events in order.
+        yield sessionCommand('phone-a');
+        yield until(() => admin.inbox.length >= 4, 'the admin to get all four events');
+        yield until(() => member.inbox.length >= 1, 'the member to get the session command');
+        yield new Promise((r) => setTimeout(r, 50));
+        (0, chai_1.expect)(admin.inbox.map(([event]) => event)).to.deep.equal([
+            'interceptor_session_started',
+            'interceptor_request',
+            'interceptor_session_stopped',
+            'session_command',
+        ]);
+        (0, chai_1.expect)(admin.inbox[1][1]).to.deep.equal(captured);
+        (0, chai_1.expect)(member.inbox.map(([event]) => event)).to.deep.equal(['session_command']);
+    }));
+});
+/**
+ * Selector Health's live events, on a real Socket.io server and a real
+ * (scratch) database seeded with Selector Health's own fixture: Priya is on
+ * team A, Alex on team B. A selector reaches a member only if it healed in a
+ * session they may see, as `GET /healing/selectors` decides.
+ */
+describe('Selector events reach only those who may see the selector (real Socket.io, real database)', () => {
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
+    const ADMIN_ID = 'sh-u-admin';
+    let httpServer;
+    let server;
+    let url;
+    let dir;
+    let restore;
+    let authDisabled;
+    const clients = [];
+    before(() => __awaiter(void 0, void 0, void 0, function* () {
+        yield (0, selector_health_fixture_1.seedSelectorHealth)(scratch.db);
+        yield scratch.db.user.create({
+            data: {
+                id: ADMIN_ID,
+                name: 'Admin',
+                email: 'admin@xenon.local',
+                passwordHash: 'x',
+                accessKey: 'ak-admin',
+                role: 'ADMIN',
+            },
+        });
+        yield scratch.db.teamMember.create({ data: { teamId: selector_health_fixture_1.TEAM.a, userId: selector_health_fixture_1.USER.priya } });
+        yield scratch.db.teamMember.create({ data: { teamId: selector_health_fixture_1.TEAM.b, userId: selector_health_fixture_1.USER.alex } });
+    }));
+    function connect(userId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const bearer = yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).sign({ sub: userId }, { audience: 'xenon-rest', ttlSeconds: 60 });
+            const socket = (0, socket_io_client_1.io)(url, {
+                auth: { bearer },
+                transports: ['websocket'],
+                reconnection: false,
+                forceNew: true,
+            });
+            clients.push(socket);
+            const inbox = [];
+            socket.onAny((event, data) => inbox.push([event, data]));
+            yield new Promise((resolve, reject) => {
+                socket.once('connect', () => resolve());
+                socket.once('connect_error', reject);
+            });
+            socket.emit('register_dashboard');
+            return inbox;
+        });
+    }
+    function until(check_1, what_1) {
+        return __awaiter(this, arguments, void 0, function* (check, what, ms = 3000) {
+            const deadline = Date.now() + ms;
+            while (!check()) {
+                if (Date.now() > deadline)
+                    throw new Error(`timed out waiting for ${what}`);
+                yield new Promise((r) => setTimeout(r, 10));
+            }
+        });
+    }
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        authDisabled = config_1.config.authDisabled;
+        config_1.config.authDisabled = false;
+        restore = (0, container_registration_1.saveRegistrations)(SocketServer_1.SocketServer, EventLogService_1.EventLogService, JwtKeyService_1.JwtKeyService, ApiKeyService_1.ApiKeyService, SelectorVisibilityResolver_1.SelectorVisibilityResolver);
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-selector-scope-'));
+        const keys = new JwtKeyService_1.JwtKeyService();
+        yield keys.init(dir);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, keys);
+        typedi_1.Container.set(ApiKeyService_1.ApiKeyService, { verifyPair: () => __awaiter(void 0, void 0, void 0, function* () { return null; }), verify: () => __awaiter(void 0, void 0, void 0, function* () { return null; }) });
+        typedi_1.Container.set(EventLogService_1.EventLogService, { appendSafe: () => undefined });
+        typedi_1.Container.set(SelectorVisibilityResolver_1.SelectorVisibilityResolver, new SelectorVisibilityResolver_1.SelectorVisibilityResolver());
+        server = new SocketServer_1.SocketServer();
+        typedi_1.Container.set(SocketServer_1.SocketServer, server);
+        httpServer = http_1.default.createServer();
+        server.initialize(httpServer);
+        yield new Promise((r) => httpServer.listen(0, '127.0.0.1', () => r()));
+        url = `http://127.0.0.1:${httpServer.address().port}`;
+    }));
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        for (const c of clients.splice(0))
+            c.close();
+        yield new Promise((r) => server.io ? server.io.close(() => r()) : r());
+        yield new Promise((r) => httpServer.close(() => r()));
+        restore();
+        config_1.config.authDisabled = authDisabled;
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+    }));
+    it("muting team B's selector reaches the admin and Alex, not Priya; team A's reaches the admin and Priya", () => __awaiter(void 0, void 0, void 0, function* () {
+        const admin = yield connect(ADMIN_ID);
+        const priya = yield connect(selector_health_fixture_1.USER.priya);
+        const alex = yield connect(selector_health_fixture_1.USER.alex);
+        yield until(() => { var _a, _b; return ((_b = (_a = server.io) === null || _a === void 0 ? void 0 : _a.sockets.adapter.rooms.get('dashboard')) === null || _b === void 0 ? void 0 : _b.size) === 3; }, 'all three clients in the dashboard room');
+        // The scratch client itself: its transaction must not reach another database.
+        const states = new SelectorStateService_1.SelectorStateService(scratch.db);
+        yield states.mute({ strategy: 'xpath', selector: selector_health_fixture_1.SEL.bOnly, apiKeyId: '', reason: 'redesign' });
+        yield states.mute({ strategy: 'id', selector: selector_health_fixture_1.SEL.warm, apiKeyId: '' });
+        yield until(() => admin.length >= 2, 'the admin to get both events');
+        yield until(() => priya.length >= 1 && alex.length >= 1, 'each member to get their own');
+        // Give any stray delivery a moment to land before asserting its absence.
+        yield new Promise((r) => setTimeout(r, 50));
+        const muted = (inbox) => inbox
+            .filter(([event]) => event === 'selector_muted')
+            .map(([, data]) => data.original_selector)
+            .sort();
+        (0, chai_1.expect)(muted(admin)).to.deep.equal([selector_health_fixture_1.SEL.warm, selector_health_fixture_1.SEL.bOnly].sort());
+        (0, chai_1.expect)(muted(priya)).to.deep.equal([selector_health_fixture_1.SEL.warm]);
+        (0, chai_1.expect)(muted(alex)).to.deep.equal([selector_health_fixture_1.SEL.bOnly]);
+        (0, chai_1.expect)(priya, 'nothing else').to.have.length(1);
+        (0, chai_1.expect)(alex, 'nothing else').to.have.length(1);
+    }));
+});
+/**
+ * A socket keeps who it is (role, teams, and that its sign-in is still good)
+ * from its handshake. REST looks the caller up again on every request, so a
+ * change to the user reaches it at once; these hold the live events to the
+ * same, on a real Socket.io server and real clients, against a real (scratch)
+ * database, through the routes and services that make the change.
+ *
+ * A socket whose user may still connect is updated where it is, never
+ * disconnected. One whose credential no longer checks out has its connection
+ * closed: the client reconnects as after any drop, and the handshake decides
+ * on the credential it has then. These clients don't reconnect, so a closed
+ * one stays closed ('transport close'), except where a test says otherwise.
+ */
+describe("A socket's identity follows its user (real Socket.io, real database)", () => {
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
+    const ID = {
+        super: 'rv-u-super',
+        admin: 'rv-u-admin',
+        admin2: 'rv-u-admin2',
+        member: 'rv-u-member',
+    };
+    const TEAMS = { a: 'rv-team-a', b: 'rv-team-b' };
+    const PHONES = {
+        'rv-phone-a': TEAMS.a,
+        'rv-phone-b': TEAMS.b,
+        'rv-phone-shared': null,
+    };
+    const SESSION = { member: 'rv-sess-member', admin: 'rv-sess-admin' };
+    const MEMBER_KEY = 'rv-raw-member-key';
+    const MEMBER_KEY_ID = 'rv-key-member';
+    const SUPER = {
+        kind: 'user-session',
+        userId: ID.super,
+        role: 'SUPER_ADMIN',
+        scopes: 'admin,devices,sessions,read',
+        teamIds: undefined,
+    };
+    let httpServer;
+    let server;
+    let url;
+    let dir;
+    let restore;
+    let authDisabled;
+    let app;
+    const clients = [];
+    const ttl = process.env.XENON_USER_SESSION_TTL_MS;
+    function seed() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const db = scratch.db;
+            yield db.teamMember.deleteMany();
+            yield db.userSession.deleteMany();
+            yield db.apiKey.deleteMany();
+            yield db.team.deleteMany();
+            yield db.user.deleteMany();
+            const user = (id, role) => db.user.create({
+                data: {
+                    id,
+                    role,
+                    name: id,
+                    email: `${id}@xenon.local`,
+                    passwordHash: 'x',
+                    accessKey: `ak-${id}`,
+                },
+            });
+            yield user(ID.super, 'SUPER_ADMIN');
+            yield user(ID.admin, 'ADMIN');
+            yield user(ID.admin2, 'ADMIN');
+            yield user(ID.member, 'MEMBER');
+            yield db.team.create({ data: { id: TEAMS.a, name: 'Team A' } });
+            yield db.team.create({ data: { id: TEAMS.b, name: 'Team B' } });
+            yield db.teamMember.create({ data: { teamId: TEAMS.a, userId: ID.member } });
+            const inAnHour = new Date(Date.now() + 60 * 60 * 1000);
+            yield db.userSession.create({
+                data: { id: SESSION.member, userId: ID.member, expiresAt: inAnHour },
+            });
+            yield db.userSession.create({
+                data: { id: SESSION.admin, userId: ID.admin, expiresAt: inAnHour },
+            });
+            yield db.apiKey.create({
+                data: {
+                    id: MEMBER_KEY_ID,
+                    name: 'member key',
+                    keyHash: new ApiKeyService_1.ApiKeyService().hash(MEMBER_KEY),
+                    scopes: 'devices,sessions,read',
+                    userId: ID.member,
+                },
+            });
+        });
+    }
+    /** Starts the server; each test calls it first, with any options it needs. */
+    function start(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const listening = http_1.default.createServer();
+            httpServer = listening;
+            server.initialize(listening, options);
+            yield new Promise((r) => listening.listen(0, '127.0.0.1', () => r()));
+            url = `http://127.0.0.1:${listening.address().port}`;
+        });
+    }
+    /** A dashboard client (bearer or cookie), or a node's (an access key and token). */
+    function connect(as) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const credentials = 'bearerToken' in as
+                ? { auth: { bearer: as.bearerToken } }
+                : 'bearer' in as
+                    ? {
+                        auth: {
+                            bearer: yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).sign({ sub: as.bearer }, { audience: 'xenon-rest', ttlSeconds: (_a = as.ttlSeconds) !== null && _a !== void 0 ? _a : 60 }),
+                        },
+                    }
+                    : 'cookie' in as
+                        ? { extraHeaders: { cookie: `xenon_dashboard_session=${as.cookie}` } }
+                        : { auth: { accessKey: as.accessKey, token: as.token } };
+            const socket = (0, socket_io_client_1.io)(url, Object.assign(Object.assign({}, credentials), { transports: ['websocket'], reconnection: false, forceNew: true }));
+            clients.push(socket);
+            const inbox = [];
+            let reason;
+            socket.onAny((event, data) => inbox.push([event, data]));
+            socket.on('disconnect', (why) => {
+                reason = why;
+            });
+            yield new Promise((resolve, reject) => {
+                socket.once('connect', () => resolve());
+                socket.once('connect_error', reject);
+            });
+            if (!('accessKey' in as))
+                socket.emit('register_dashboard');
+            return { socket, inbox, ended: () => reason };
+        });
+    }
+    /** Who the server holds the client's socket to be now. */
+    const identityOf = (client) => { var _a, _b; return (_b = (_a = server.io) === null || _a === void 0 ? void 0 : _a.sockets.sockets.get(client.socket.id)) === null || _b === void 0 ? void 0 : _b.data.identity; };
+    function untilAsync(check_1, what_1) {
+        return __awaiter(this, arguments, void 0, function* (check, what, ms = 3000) {
+            const deadline = Date.now() + ms;
+            while (!(yield check())) {
+                if (Date.now() > deadline)
+                    throw new Error(`timed out waiting for ${what}`);
+                yield new Promise((r) => setTimeout(r, 10));
+            }
+        });
+    }
+    function until(check_1, what_1) {
+        return __awaiter(this, arguments, void 0, function* (check, what, ms = 3000) {
+            const deadline = Date.now() + ms;
+            while (!check()) {
+                if (Date.now() > deadline)
+                    throw new Error(`timed out waiting for ${what}`);
+                yield new Promise((r) => setTimeout(r, 10));
+            }
+        });
+    }
+    const roomSize = () => { var _a, _b, _c; return (_c = (_b = (_a = server.io) === null || _a === void 0 ? void 0 : _a.sockets.adapter.rooms.get('dashboard')) === null || _b === void 0 ? void 0 : _b.size) !== null && _c !== void 0 ? _c : 0; };
+    /** One event about a phone, delivered to every socket that may see it before this settles. */
+    function emit(udid, event, adminOnly = false) {
+        return server.emitToDashboardForDevices(event, { udid }, { udid, teamId: PHONES[udid], adminOnly });
+    }
+    /** Lets a delivery that was going to reach a socket land before its absence is asserted. */
+    const settle = () => new Promise((r) => setTimeout(r, 50));
+    const seen = (client) => client.inbox.map(([event, data]) => `${event}:${data.udid}`);
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        authDisabled = config_1.config.authDisabled;
+        config_1.config.authDisabled = false;
+        restore = (0, container_registration_1.saveRegistrations)(SocketServer_1.SocketServer, EventLogService_1.EventLogService, JwtKeyService_1.JwtKeyService, ApiKeyService_1.ApiKeyService, UserSessionService_1.UserSessionService, DeviceTeamResolver_1.DeviceTeamResolver, SelectorVisibilityResolver_1.SelectorVisibilityResolver);
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-socket-identity-'));
+        const keys = new JwtKeyService_1.JwtKeyService();
+        yield keys.init(dir);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, keys);
+        typedi_1.Container.set(ApiKeyService_1.ApiKeyService, new ApiKeyService_1.ApiKeyService());
+        typedi_1.Container.set(UserSessionService_1.UserSessionService, new UserSessionService_1.UserSessionService());
+        typedi_1.Container.set(EventLogService_1.EventLogService, { appendSafe: () => undefined });
+        typedi_1.Container.set(DeviceTeamResolver_1.DeviceTeamResolver, new DeviceTeamResolver_1.DeviceTeamResolver({
+            findDevice: (udid) => __awaiter(void 0, void 0, void 0, function* () { return udid in PHONES ? { udid, teamId: PHONES[udid] } : null; }),
+        }));
+        yield seed();
+        server = new SocketServer_1.SocketServer();
+        typedi_1.Container.set(SocketServer_1.SocketServer, server);
+        // The routes the dashboard's Users, Teams and API keys pages call, and
+        // sign-out, as a super admin.
+        app = (0, express_1.default)();
+        app.use(express_1.default.json());
+        app.use('/auth', (0, auth_1.authPublicRouter)());
+        app.use((req, _res, next) => {
+            req.auth = SUPER;
+            next();
+        });
+        app.use('/users', (0, users_1.usersRouter)());
+        app.use('/teams', (0, teams_1.teamsRouter)());
+        app.use('/apikeys', (0, apikeys_1.apiKeysRouter)());
+    }));
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        for (const c of clients.splice(0))
+            c.close();
+        yield new Promise((r) => server.io ? server.io.close(() => r()) : r());
+        if (ttl === undefined)
+            delete process.env.XENON_USER_SESSION_TTL_MS;
+        else
+            process.env.XENON_USER_SESSION_TTL_MS = ttl;
+        const open = httpServer;
+        if (open === null || open === void 0 ? void 0 : open.listening)
+            yield new Promise((r) => open.close(() => r()));
+        httpServer = undefined;
+        sinon_1.default.restore();
+        restore();
+        config_1.config.authDisabled = authDisabled;
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+    }));
+    it('an admin demoted to member gets no captured request once the change is saved, and stays connected as a member', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield start();
+        const demoted = yield connect({ bearer: ID.admin });
+        const control = yield connect({ bearer: ID.admin2 });
+        yield until(() => roomSize() === 2, 'both clients in the dashboard room');
+        yield (0, loopbackRequest_1.default)(app).patch(`/users/${ID.admin}`).send({ role: 'MEMBER' }).expect(200);
+        yield emit('rv-phone-shared', 'interceptor_request', true);
+        yield emit('rv-phone-a', 'device_blocked');
+        yield emit('rv-phone-shared', 'device_unblocked');
+        yield until(() => control.inbox.length >= 3, 'the other admin to get all three');
+        yield until(() => demoted.inbox.length >= 1, "the shared phone's event");
+        yield settle();
+        (0, chai_1.expect)(seen(control)).to.deep.equal([
+            'interceptor_request:rv-phone-shared',
+            'device_blocked:rv-phone-a',
+            'device_unblocked:rv-phone-shared',
+        ]);
+        // A member of no team: the shared pool only, and no captured traffic.
+        (0, chai_1.expect)(seen(demoted)).to.deep.equal(['device_unblocked:rv-phone-shared']);
+        (0, chai_1.expect)(demoted.socket.connected, 'still connected').to.equal(true);
+        (0, chai_1.expect)(demoted.ended()).to.equal(undefined);
+    }));
+    it('a disabled user is signed out of every socket once the change is saved; others stay', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield start();
+        const disabled = yield connect({ bearer: ID.admin });
+        const sameUserCookie = yield connect({ cookie: SESSION.admin });
+        const control = yield connect({ bearer: ID.admin2 });
+        yield until(() => roomSize() === 3, 'all three clients in the dashboard room');
+        yield (0, loopbackRequest_1.default)(app).patch(`/users/${ID.admin}`).send({ status: 'INACTIVE' }).expect(200);
+        yield until(() => disabled.ended() !== undefined, 'the bearer socket to end');
+        yield until(() => sameUserCookie.ended() !== undefined, 'the cookie socket to end');
+        (0, chai_1.expect)(disabled.ended()).to.equal('transport close');
+        (0, chai_1.expect)(sameUserCookie.ended()).to.equal('transport close');
+        yield emit('rv-phone-shared', 'interceptor_request', true);
+        yield until(() => control.inbox.length >= 1, 'the other admin to get it');
+        (0, chai_1.expect)(control.socket.connected).to.equal(true);
+    }));
+    it("a deleted user's socket is ended", () => __awaiter(void 0, void 0, void 0, function* () {
+        yield start();
+        const deleted = yield connect({ bearer: ID.member });
+        yield until(() => roomSize() === 1, 'the client in the dashboard room');
+        yield (0, loopbackRequest_1.default)(app).delete(`/users/${ID.member}`).expect(204);
+        yield until(() => deleted.ended() !== undefined, 'the socket to end');
+        (0, chai_1.expect)(deleted.ended()).to.equal('transport close');
+    }));
+    it("a member taken off a team stops getting its phones' events, and one added to a team starts, without reconnecting", () => __awaiter(void 0, void 0, void 0, function* () {
+        yield start();
+        const member = yield connect({ cookie: SESSION.member });
+        const admin = yield connect({ bearer: ID.admin });
+        yield until(() => roomSize() === 2, 'both clients in the dashboard room');
+        yield (0, loopbackRequest_1.default)(app).delete(`/teams/${TEAMS.a}/members/${ID.member}`).expect(200);
+        yield emit('rv-phone-a', 'device_blocked');
+        yield until(() => admin.inbox.length >= 1, "the admin to get team A's event");
+        yield settle();
+        (0, chai_1.expect)(seen(member), 'off team A').to.deep.equal([]);
+        yield (0, loopbackRequest_1.default)(app).post(`/teams/${TEAMS.b}/members`).send({ userId: ID.member }).expect(200);
+        yield emit('rv-phone-b', 'device_blocked');
+        yield until(() => member.inbox.length >= 1, "team B's event");
+        (0, chai_1.expect)(seen(member), 'on team B').to.deep.equal(['device_blocked:rv-phone-b']);
+        (0, chai_1.expect)(member.ended()).to.equal(undefined);
+    }));
+    it("signing out ends that sign-in's socket, not the same user's other ones", () => __awaiter(void 0, void 0, void 0, function* () {
+        yield start();
+        const signedOut = yield connect({ cookie: SESSION.member });
+        const ide = yield connect({ bearer: ID.member });
+        yield until(() => roomSize() === 2, 'both clients in the dashboard room');
+        yield (0, loopbackRequest_1.default)(app)
+            .post('/auth/logout')
+            .set('Cookie', `xenon_dashboard_session=${SESSION.member}`)
+            .expect(204);
+        yield until(() => signedOut.ended() !== undefined, 'the signed-out socket to end');
+        (0, chai_1.expect)(signedOut.ended()).to.equal('transport close');
+        yield emit('rv-phone-a', 'device_blocked');
+        yield until(() => ide.inbox.length >= 1, "the bearer socket to get team A's event");
+        (0, chai_1.expect)(ide.ended()).to.equal(undefined);
+    }));
+    it("a revoked API key's socket is ended", () => __awaiter(void 0, void 0, void 0, function* () {
+        yield start();
+        const keyed = yield connect({ cookie: MEMBER_KEY });
+        yield until(() => roomSize() === 1, 'the client in the dashboard room');
+        yield (0, loopbackRequest_1.default)(app).delete(`/apikeys/${MEMBER_KEY_ID}`).expect(200);
+        yield until(() => keyed.ended() !== undefined, 'the socket to end');
+        (0, chai_1.expect)(keyed.ended()).to.equal('transport close');
+    }));
+    it('a bearer socket closes when REST stops taking its token, and the token is refused from then on', function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.timeout(10000);
+            yield start();
+            // Past its exp, but within the 60 s REST still takes it for: ~2 s left.
+            const bearer = yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).sign({ sub: ID.admin }, { audience: 'xenon-rest', ttlSeconds: 2 - JwtKeyService_1.JWT_CLOCK_TOLERANCE_SEC });
+            (0, chai_1.expect)(yield (0, verifyCredential_1.verifyBearerCredential)(bearer), 'REST takes it').to.not.equal(null);
+            const ide = yield connect({ bearerToken: bearer });
+            yield until(() => ide.ended() !== undefined, 'the socket to close', 3500);
+            (0, chai_1.expect)(ide.ended()).to.equal('transport close');
+            (0, chai_1.expect)(yield (0, verifyCredential_1.verifyBearerCredential)(bearer), 'nor does REST, by then').to.equal(null);
+            const late = (0, socket_io_client_1.io)(url, {
+                auth: { bearer },
+                transports: ['websocket'],
+                reconnection: false,
+                forceNew: true,
+            });
+            clients.push(late);
+            const refused = yield new Promise((resolve) => {
+                late.once('connect', () => resolve('connected'));
+                late.once('connect_error', (err) => resolve(err.message));
+            });
+            (0, chai_1.expect)(refused).to.equal('unauthorized');
+        });
+    });
+    it('a client that fetches a fresh token is let back in after its token runs out', function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.timeout(10000);
+            yield start();
+            // As Xenon Studio and the documented client do: a function, which
+            // socket.io calls for every connection attempt.
+            let tokens = 0;
+            const socket = (0, socket_io_client_1.io)(url, {
+                auth: (cb) => {
+                    tokens += 1;
+                    typedi_1.Container.get(JwtKeyService_1.JwtKeyService)
+                        .sign({ sub: ID.admin }, { audience: 'xenon-rest', ttlSeconds: tokens === 1 ? 2 - JwtKeyService_1.JWT_CLOCK_TOLERANCE_SEC : 60 })
+                        .then((bearer) => cb({ bearer }));
+                },
+                transports: ['websocket'],
+                reconnectionDelay: 50,
+                forceNew: true,
+            });
+            clients.push(socket);
+            const reasons = [];
+            let connects = 0;
+            socket.on('disconnect', (why) => reasons.push(why));
+            socket.on('connect', () => {
+                connects += 1;
+                socket.emit('register_dashboard');
+            });
+            yield until(() => connects === 2, 'the client to come back with a fresh token', 4000);
+            (0, chai_1.expect)(reasons).to.deep.equal(['transport close']);
+            (0, chai_1.expect)(tokens).to.equal(2);
+            yield until(() => roomSize() === 1, 'it to register again');
+            yield emit('rv-phone-shared', 'interceptor_request', true);
+            const received = yield new Promise((resolve) => socket.once('interceptor_request', (data) => resolve(data.udid)));
+            (0, chai_1.expect)(received).to.equal('rv-phone-shared');
+        });
+    });
+    it("a disabled user's client, reconnecting by itself, is refused once and stops", () => __awaiter(void 0, void 0, void 0, function* () {
+        yield start();
+        const bearer = yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).sign({ sub: ID.admin }, { audience: 'xenon-rest', ttlSeconds: 60 });
+        const socket = (0, socket_io_client_1.io)(url, {
+            auth: { bearer },
+            transports: ['websocket'],
+            reconnectionDelay: 50,
+            forceNew: true,
+        });
+        clients.push(socket);
+        const refusals = [];
+        socket.on('connect_error', (err) => refusals.push(err.message));
+        yield new Promise((resolve) => socket.once('connect', () => resolve()));
+        yield (0, loopbackRequest_1.default)(app).patch(`/users/${ID.admin}`).send({ status: 'INACTIVE' }).expect(200);
+        yield until(() => refusals.length === 1, 'the reconnect to be refused');
+        (0, chai_1.expect)(refusals).to.deep.equal(['unauthorized']);
+        (0, chai_1.expect)(socket.active, 'socket.io gives up after a refused handshake').to.equal(false);
+        yield new Promise((r) => setTimeout(r, 300));
+        (0, chai_1.expect)(refusals, 'no further attempts').to.have.length(1);
+    }));
+    it('a sign-in that lapses ends its socket when it expires, not before, though nothing ended it', function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.timeout(10000);
+            // The handshake is a use of the sign-in: it renews it for the TTL. The
+            // socket's own checks renew nothing, so with no REST call it lapses then.
+            process.env.XENON_USER_SESSION_TTL_MS = '1500';
+            yield scratch.db.userSession.update({
+                where: { id: SESSION.member },
+                data: { expiresAt: new Date(Date.now() + 700) },
+            });
+            yield start();
+            const t0 = Date.now();
+            const lapsing = yield connect({ cookie: SESSION.member });
+            yield until(() => lapsing.ended() !== undefined, 'the socket to end with its sign-in', 5000);
+            (0, chai_1.expect)(lapsing.ended()).to.equal('transport close');
+            (0, chai_1.expect)(Date.now() - t0, 'ended at the renewed expiry').to.be.at.least(1400);
+        });
+    });
+    it("a node whose user's access key was rotated is ended", () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        yield start();
+        const node = yield connect({ accessKey: `ak-${ID.member}`, token: MEMBER_KEY });
+        (0, chai_1.expect)((_a = identityOf(node)) === null || _a === void 0 ? void 0 : _a.principal).to.equal('node');
+        yield typedi_1.Container.get(UserService_1.UserService).rotateAccessKey(ID.member);
+        yield until(() => node.ended() !== undefined, 'the node socket to end');
+        (0, chai_1.expect)(node.ended()).to.equal('transport close');
+    }));
+    it('a change made elsewhere (straight to the database) reaches the socket at the next sweep', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield start({ recheckIntervalMs: 100 });
+        const admin = yield connect({ bearer: ID.admin });
+        yield until(() => roomSize() === 1, 'the client in the dashboard room');
+        // Another server sharing the database, or a hand edit: no notice here.
+        yield scratch.db.user.update({ where: { id: ID.admin }, data: { role: 'MEMBER' } });
+        yield until(() => { var _a; return ((_a = identityOf(admin)) === null || _a === void 0 ? void 0 : _a.role) === 'MEMBER'; }, 'the next sweep');
+        yield emit('rv-phone-shared', 'interceptor_request', true);
+        yield emit('rv-phone-shared', 'device_blocked');
+        yield until(() => admin.inbox.length >= 1, "the shared phone's event");
+        yield settle();
+        (0, chai_1.expect)(seen(admin)).to.deep.equal(['device_blocked:rv-phone-shared']);
+        (0, chai_1.expect)(admin.ended()).to.equal(undefined);
+    }));
+    it("checking a socket again renews nothing: a sign-in's TTL doesn't slide and a key isn't marked used", () => __awaiter(void 0, void 0, void 0, function* () {
+        const check = sinon_1.default.spy(server, 'check');
+        yield start({ recheckIntervalMs: 50 });
+        yield connect({ cookie: SESSION.member });
+        yield connect({ cookie: MEMBER_KEY });
+        // The handshakes are uses, recorded in the background.
+        const rows = () => __awaiter(void 0, void 0, void 0, function* () {
+            return ({
+                session: yield scratch.db.userSession.findUniqueOrThrow({ where: { id: SESSION.member } }),
+                key: yield scratch.db.apiKey.findUniqueOrThrow({ where: { id: MEMBER_KEY_ID } }),
+            });
+        });
+        const times = ({ session, key }) => {
+            var _a;
+            return ({
+                expiresAt: session.expiresAt.getTime(),
+                lastSeenAt: session.lastSeenAt.getTime(),
+                lastUsedAt: (_a = key.lastUsedAt) === null || _a === void 0 ? void 0 : _a.getTime(),
+            });
+        };
+        yield untilAsync(() => __awaiter(void 0, void 0, void 0, function* () {
+            const t = times(yield rows());
+            return t.lastUsedAt !== undefined && t.expiresAt > Date.now() + 2 * 60 * 60 * 1000;
+        }), 'the handshakes to be recorded');
+        const before = times(yield rows());
+        const rechecks = () => check.getCalls().filter((c) => c.args[1] === true).length;
+        yield until(() => rechecks() >= 4, 'two sweeps of both sockets');
+        yield settle();
+        (0, chai_1.expect)(times(yield rows())).to.deep.equal(before);
+    }));
+    it('a check that cannot run (the database unavailable) keeps the socket as it was', () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        yield start();
+        const admin = yield connect({ bearer: ID.admin });
+        yield until(() => roomSize() === 1, 'the client in the dashboard room');
+        // The scratch database's own stub, put back after the test.
+        prisma_1.prisma.user.findUnique.rejects(new Error('database is locked'));
+        yield (0, identityChanges_1.identityChanged)(ID.admin);
+        yield emit('rv-phone-shared', 'interceptor_request', true);
+        yield until(() => admin.inbox.length >= 1, 'the captured request');
+        (0, chai_1.expect)(admin.socket.connected).to.equal(true);
+        (0, chai_1.expect)((_a = identityOf(admin)) === null || _a === void 0 ? void 0 : _a.role).to.equal('ADMIN');
+    }));
+    const MEMBER_IDENTITY = { principal: 'dashboard', userId: ID.admin, role: 'MEMBER', teamIds: [] };
+    /** A socket for check-order tests: an admin's, whose bearer token no longer verifies. */
+    const checkedSocket = () => ({
+        id: 'fake',
+        connected: true,
+        handshake: { auth: { bearer: 'no-longer-valid' }, headers: {} },
+        data: {
+            identity: { principal: 'dashboard', userId: ID.admin, role: 'ADMIN', teamIds: undefined },
+        },
+        conn: { close: sinon_1.default.spy() },
+    });
+    it('a check that finishes first is applied though a newer one is still running', () => __awaiter(void 0, void 0, void 0, function* () {
+        // A change's check, then a sweep's started while it runs: REST answers
+        // once the change's check settles, so its outcome can't wait on the sweep.
+        let release;
+        const gate = new Promise((r) => (release = r));
+        const check = sinon_1.default.stub(server, 'check');
+        check.onFirstCall().resolves({ identity: MEMBER_IDENTITY });
+        check.onSecondCall().callsFake(() => __awaiter(void 0, void 0, void 0, function* () {
+            yield gate;
+            return { identity: Object.assign(Object.assign({}, MEMBER_IDENTITY), { teamIds: [TEAMS.a] }) };
+        }));
+        const socket = checkedSocket();
+        const first = server.recheck(socket);
+        const second = server.recheck(socket);
+        yield first;
+        (0, chai_1.expect)(socket.data.identity.role, 'applied when it settles').to.equal('MEMBER');
+        release();
+        yield second;
+        (0, chai_1.expect)(socket.data.identity.teamIds, 'then the newer one').to.deep.equal([TEAMS.a]);
+    }));
+    it('an older check that finishes after a newer one has applied changes nothing', () => __awaiter(void 0, void 0, void 0, function* () {
+        const real = server.check.bind(server);
+        let release;
+        const gate = new Promise((r) => (release = r));
+        const check = sinon_1.default.stub(server, 'check');
+        // The older check refuses (a token that no longer verifies), but only
+        // after a newer one has found the user a member.
+        check.onFirstCall().callsFake((socket, recheck) => __awaiter(void 0, void 0, void 0, function* () {
+            yield gate;
+            return real(socket, recheck);
+        }));
+        check.onSecondCall().resolves({ identity: MEMBER_IDENTITY });
+        const socket = checkedSocket();
+        const older = server.recheck(socket);
+        yield server.recheck(socket);
+        release();
+        yield older;
+        (0, chai_1.expect)(socket.data.identity.role).to.equal('MEMBER');
+        (0, chai_1.expect)(socket.conn.close.called, 'the older refusal is dropped').to.equal(false);
+    }));
+    it("a newer check that can't run doesn't cancel an older refusal", () => __awaiter(void 0, void 0, void 0, function* () {
+        const real = server.check.bind(server);
+        let release;
+        const gate = new Promise((r) => (release = r));
+        const check = sinon_1.default.stub(server, 'check');
+        check.onFirstCall().callsFake((socket, recheck) => __awaiter(void 0, void 0, void 0, function* () {
+            yield gate;
+            return real(socket, recheck);
+        }));
+        check.onSecondCall().rejects(new Error('database is locked'));
+        const socket = checkedSocket();
+        const older = server.recheck(socket);
+        yield server.recheck(socket);
+        (0, chai_1.expect)(socket.conn.close.called, 'a check that failed changes nothing').to.equal(false);
+        release();
+        yield older;
+        (0, chai_1.expect)(socket.conn.close.calledOnce, 'the refusal stands').to.equal(true);
+    }));
+    it('a handshake that overlaps a change to its user is checked again once connected', () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a, _b;
+        yield start();
+        const real = server.check.bind(server);
+        let release;
+        const gate = new Promise((r) => (release = r));
+        let releaseRecheck;
+        const recheckGate = new Promise((r) => (releaseRecheck = r));
+        let handshakes = 0;
+        sinon_1.default.stub(server, 'check').callsFake((socket, recheck) => __awaiter(void 0, void 0, void 0, function* () {
+            const result = yield real(socket, recheck);
+            if (!recheck && handshakes++ === 0)
+                yield gate;
+            if (recheck)
+                yield recheckGate;
+            return result;
+        }));
+        const connecting = connect({ bearer: ID.admin });
+        yield until(() => handshakes === 1, 'the handshake to read the user');
+        // The change finds no socket of the user's: this one isn't connected yet.
+        yield (0, loopbackRequest_1.default)(app).patch(`/users/${ID.admin}`).send({ role: 'MEMBER' }).expect(200);
+        release();
+        const admin = yield connecting;
+        // It asked to join (connect() registers), but gets no dashboard event
+        // under the identity it connected with.
+        yield new Promise((r) => setTimeout(r, 100));
+        (0, chai_1.expect)((_a = identityOf(admin)) === null || _a === void 0 ? void 0 : _a.role).to.equal('ADMIN');
+        (0, chai_1.expect)(roomSize(), 'not in the room before its check').to.equal(0);
+        releaseRecheck();
+        yield until(() => roomSize() === 1, 'it to join the room');
+        (0, chai_1.expect)((_b = identityOf(admin)) === null || _b === void 0 ? void 0 : _b.role).to.equal('MEMBER');
+    }));
+    it("a selector event asked about before the member's team changed doesn't reach them", () => __awaiter(void 0, void 0, void 0, function* () {
+        yield start();
+        let release;
+        const gate = new Promise((r) => (release = r));
+        let asked = 0;
+        // Yes for every member, but only once released.
+        typedi_1.Container.set(SelectorVisibilityResolver_1.SelectorVisibilityResolver, {
+            canSee: () => __awaiter(void 0, void 0, void 0, function* () {
+                asked += 1;
+                yield gate;
+                return true;
+            }),
+        });
+        const member = yield connect({ cookie: SESSION.member });
+        const admin = yield connect({ bearer: ID.admin });
+        yield until(() => roomSize() === 2, 'both clients in the dashboard room');
+        const delivered = server.emitToDashboardForSelector('selector_muted', { original_selector: '//x' }, { strategy: 'xpath', selector: '//x' });
+        yield until(() => asked === 1, "the member's visibility to be asked");
+        yield (0, loopbackRequest_1.default)(app).delete(`/teams/${TEAMS.a}/members/${ID.member}`).expect(200);
+        release();
+        yield delivered;
+        yield until(() => admin.inbox.length >= 1, 'the admin to get it');
+        yield settle();
+        (0, chai_1.expect)(member.inbox, 'asked about with the team it no longer has').to.deep.equal([]);
+        (0, chai_1.expect)(member.ended()).to.equal(undefined);
+    }));
+    it('a closed server stops listening for changes', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield start();
+        const recheckUser = sinon_1.default.spy(server, 'recheckUser');
+        yield new Promise((r) => server.io.close(() => r()));
+        yield (0, identityChanges_1.identityChanged)(ID.admin);
+        (0, chai_1.expect)(recheckUser.called).to.equal(false);
+    }));
 });