@xenon-device-management/xenon 2.15.0 → 2.16.0

package/lib/test/unit/socketServer.scopedEmit.spec.js

@@ -19,6 +19,7 @@ const typedi_1 = require("typedi");
 const SocketServer_1 = require("../../src/services/SocketServer");
 const EventLogService_1 = require("../../src/services/EventLogService");
 const DeviceTeamResolver_1 = require("../../src/services/device-access/DeviceTeamResolver");
+const SelectorVisibilityResolver_1 = require("../../src/services/selector-health/SelectorVisibilityResolver");
 const recording_store_1 = require("../../src/services/recording/recording-store");
 const NotificationService_1 = require("../../src/services/NotificationService");
 const device_store_1 = require("../../src/data-service/device-store");
@@ -32,6 +33,7 @@ const container_registration_1 = require("../helpers/container-registration");
  * `io.to(room).emit` for the unscoped path.
  */
 function fakeIo(specs) {
+    var _a, _b;
     const received = new Map();
     const sockets = new Map();
     const dashboard = new Set();
@@ -43,8 +45,8 @@ function fakeIo(specs) {
             data: {
                 identity: {
                     principal: 'dashboard',
-                    userId: `user-${s.id}`,
-                    role: s.teamIds === undefined ? 'ADMIN' : 'MEMBER',
+                    userId: (_a = s.userId) !== null && _a !== void 0 ? _a : `user-${s.id}`,
+                    role: (_b = s.role) !== null && _b !== void 0 ? _b : (s.teamIds === undefined ? 'ADMIN' : 'MEMBER'),
                     teamIds: s.teamIds,
                 },
             },
@@ -324,15 +326,245 @@ describe('SocketServer.emitToDashboardForDevices — events reach only the teams
             (0, chai_1.expect)(events(inbox('member-a'))).to.deep.equal(['device_unblocked']);
         }));
     });
-    it('emitToDashboard (selector events, nodes) stays unscoped', () => {
+    describe('adminOnly: captured network traffic, which REST serves to admins only', () => {
+        it("reaches admins, never the members who see the phone (a team's or the shared pool's)", () => __awaiter(void 0, void 0, void 0, function* () {
+            const { inbox } = connect(EVERYONE);
+            yield server.emitToDashboardForDevices('interceptor_request', { id: 'q-a' }, { udid: 'phone-a', adminOnly: true });
+            yield server.emitToDashboardForDevices('interceptor_request', { id: 'q-s' }, { udid: 'phone-s', adminOnly: true });
+            (0, chai_1.expect)(inbox('admin').map(([, d]) => d.id)).to.deep.equal(['q-a', 'q-s']);
+            for (const id of ['member-a', 'member-b', 'member-none', 'node']) {
+                (0, chai_1.expect)(inbox(id), id).to.deep.equal([]);
+            }
+        }));
+        it('with members connected it looks nothing up: only admins, who see every phone, are sent it', () => __awaiter(void 0, void 0, void 0, function* () {
+            const { inbox } = connect(EVERYONE);
+            // A slow store must not hold captured requests back either.
+            holdLookups();
+            yield server.emitToDashboardForDevices('interceptor_request', { id: 'q1' }, {
+                udid: 'phone-a',
+                adminOnly: true,
+            });
+            (0, chai_1.expect)(lookups).to.deep.equal([]);
+            (0, chai_1.expect)(events(inbox('admin'))).to.deep.equal(['interceptor_request']);
+            (0, chai_1.expect)(inbox('member-a')).to.deep.equal([]);
+        }));
+        it('the role decides, not the team list: a member with no team list still gets nothing', () => __awaiter(void 0, void 0, void 0, function* () {
+            // No socket has a member's role and no team list today; if one ever
+            // does, it must not take the synchronous room broadcast.
+            const { inbox } = connect([
+                { id: 'admin', teamIds: undefined },
+                { id: 'odd-member', teamIds: undefined, role: 'MEMBER' },
+            ]);
+            yield server.emitToDashboardForDevices('interceptor_request', { id: 'q1' }, { udid: 'phone-s', adminOnly: true });
+            (0, chai_1.expect)(events(inbox('admin'))).to.deep.equal(['interceptor_request']);
+            (0, chai_1.expect)(inbox('odd-member')).to.deep.equal([]);
+        }));
+        it('a socket with no identity never gets it', () => __awaiter(void 0, void 0, void 0, function* () {
+            const { io, inbox } = fakeIo([
+                { id: 'admin', teamIds: undefined },
+                { id: 'odd', teamIds: [] },
+            ]);
+            io.sockets.sockets.get('odd').data = {};
+            server.io = io;
+            yield server.emitToDashboardForDevices('interceptor_request', {}, {
+                udid: 'phone-s',
+                adminOnly: true,
+            });
+            (0, chai_1.expect)(events(inbox('admin'))).to.deep.equal(['interceptor_request']);
+            (0, chai_1.expect)(inbox('odd')).to.deep.equal([]);
+        }));
+        it('auth disabled (every socket a super admin): the room broadcast as before, with no lookup', () => __awaiter(void 0, void 0, void 0, function* () {
+            const { inbox, roomBroadcasts } = connect([
+                { id: 'lab-1', teamIds: undefined, role: 'SUPER_ADMIN' },
+                { id: 'lab-2', teamIds: undefined, role: 'SUPER_ADMIN' },
+            ]);
+            yield server.emitToDashboardForDevices('interceptor_request', {}, {
+                udid: 'phone-b',
+                adminOnly: true,
+            });
+            (0, chai_1.expect)(roomBroadcasts).to.deep.equal(['dashboard']);
+            (0, chai_1.expect)(lookups).to.deep.equal([]);
+            (0, chai_1.expect)(events(inbox('lab-1'))).to.deep.equal(['interceptor_request']);
+            (0, chai_1.expect)(events(inbox('lab-2'))).to.deep.equal(['interceptor_request']);
+        }));
+        it("keeps the phone's order: it waits for the phone's event ahead of it", () => __awaiter(void 0, void 0, void 0, function* () {
+            const { inbox } = connect(EVERYONE);
+            holdLookups();
+            const command = server.emitToDashboardForDevices('session_command', {}, { udid: 'phone-a' });
+            const captured = server.emitToDashboardForDevices('interceptor_request', {}, {
+                udid: 'phone-a',
+                adminOnly: true,
+            });
+            yield new Promise((r) => setImmediate(r));
+            (0, chai_1.expect)(inbox('admin'), 'nothing overtakes the pending event').to.deep.equal([]);
+            openGate();
+            yield Promise.all([command, captured]);
+            (0, chai_1.expect)(events(inbox('admin'))).to.deep.equal(['session_command', 'interceptor_request']);
+            (0, chai_1.expect)(events(inbox('member-a'))).to.deep.equal(['session_command']);
+        }));
+        it('{ udids, strip, adminOnly }: admins only, the payload untouched', () => __awaiter(void 0, void 0, void 0, function* () {
+            const { inbox } = connect(EVERYONE);
+            const payload = { recordings: [{ udid: 'phone-a' }, { udid: 'phone-s' }] };
+            yield server.emitToDashboardForDevices('capture_group', payload, {
+                udids: ['phone-a', 'phone-s'],
+                strip: (d, visible) => (Object.assign(Object.assign({}, d), { recordings: d.recordings.filter((r) => visible.includes(r.udid)) })),
+                adminOnly: true,
+            });
+            (0, chai_1.expect)(inbox('admin')[0][1]).to.equal(payload);
+            for (const id of ['member-a', 'member-b', 'member-none']) {
+                (0, chai_1.expect)(inbox(id), id).to.deep.equal([]);
+            }
+        }));
+        it('is still recorded in the event log once, as any other event', () => __awaiter(void 0, void 0, void 0, function* () {
+            connect(EVERYONE);
+            // interceptor_request itself is never logged (EVENT_LOG_KEEPS); its start is.
+            yield server.emitToDashboardForDevices('interceptor_session_started', { sessionId: 's1' }, {
+                udid: 'phone-a',
+                adminOnly: true,
+            });
+            (0, chai_1.expect)(appendSafe.callCount).to.equal(1);
+        }));
+    });
+    it('node events (emitToDashboard) stay unscoped', () => {
         const { inbox } = connect(EVERYONE);
-        server.emitToDashboard('selector_fixed', { selector: '//x' });
+        server.emitToDashboard('node_connected', { host: 'http://node:4723' });
         for (const id of ['admin', 'member-a', 'member-b', 'member-none']) {
-            (0, chai_1.expect)(events(inbox(id)), id).to.deep.equal(['selector_fixed']);
+            (0, chai_1.expect)(events(inbox(id)), id).to.deep.equal(['node_connected']);
         }
         (0, chai_1.expect)(lookups).to.deep.equal([]);
     });
 });
+describe('SocketServer.emitToDashboardForSelector — a selector event reaches only those who may see the selector', () => {
+    /** The teams whose sessions healed each selector (Selector Health's rule, faked). */
+    const HEALED_ON = {
+        '//team-a': ['team-a'],
+        '//team-b': ['team-b'],
+    };
+    const TEAM_B = { strategy: 'xpath', selector: '//team-b' };
+    let restore;
+    let server;
+    let appendSafe;
+    let viewers;
+    let gate;
+    let openGate;
+    let failLookups;
+    function connect(specs) {
+        const fake = fakeIo(specs);
+        server.io = fake.io;
+        return fake;
+    }
+    beforeEach(() => {
+        restore = (0, container_registration_1.saveRegistrations)(EventLogService_1.EventLogService, SelectorVisibilityResolver_1.SelectorVisibilityResolver);
+        appendSafe = sinon_1.default.spy();
+        typedi_1.Container.set(EventLogService_1.EventLogService, { appendSafe });
+        viewers = [];
+        gate = undefined;
+        failLookups = false;
+        typedi_1.Container.set(SelectorVisibilityResolver_1.SelectorVisibilityResolver, new SelectorVisibilityResolver_1.SelectorVisibilityResolver({
+            sessionScope: (viewer) => __awaiter(void 0, void 0, void 0, function* () { return viewer; }),
+            healedIn: (key, scope) => __awaiter(void 0, void 0, void 0, function* () {
+                var _a;
+                viewers.push(scope);
+                if (gate)
+                    yield gate;
+                if (failLookups)
+                    throw new Error('database gone');
+                return ((_a = HEALED_ON[key.selector]) !== null && _a !== void 0 ? _a : []).some((t) => scope.teamIds.includes(t));
+            }),
+        }));
+        server = new SocketServer_1.SocketServer();
+    });
+    afterEach(() => {
+        sinon_1.default.restore();
+        restore();
+    });
+    const EVERYONE = [
+        { id: 'admin', teamIds: undefined },
+        { id: 'member-a', teamIds: ['team-a'] },
+        { id: 'member-b', teamIds: ['team-b'] },
+        { id: 'member-none', teamIds: [] },
+        { id: 'node', teamIds: ['team-b'], dashboard: false },
+    ];
+    it('an admin gets every selector event; a member only those of selectors they may see', () => __awaiter(void 0, void 0, void 0, function* () {
+        const { inbox } = connect(EVERYONE);
+        yield server.emitToDashboardForSelector('selector_muted', { original_selector: '//team-b' }, TEAM_B);
+        (0, chai_1.expect)(events(inbox('admin'))).to.deep.equal(['selector_muted']);
+        (0, chai_1.expect)(events(inbox('member-b'))).to.deep.equal(['selector_muted']);
+        for (const id of ['member-a', 'member-none', 'node']) {
+            (0, chai_1.expect)(inbox(id), id).to.deep.equal([]);
+        }
+    }));
+    it("asks about each member's user and teams; never about an admin", () => __awaiter(void 0, void 0, void 0, function* () {
+        connect(EVERYONE);
+        yield server.emitToDashboardForSelector('selector_fixed', {}, TEAM_B);
+        (0, chai_1.expect)(viewers).to.have.deep.members([
+            { userId: 'user-member-a', teamIds: ['team-a'] },
+            { userId: 'user-member-b', teamIds: ['team-b'] },
+            { userId: 'user-member-none', teamIds: [] },
+        ]);
+    }));
+    it("a member's two tabs cost one lookup", () => __awaiter(void 0, void 0, void 0, function* () {
+        const { inbox } = connect([
+            { id: 'tab-1', teamIds: ['team-b'], userId: 'u-b' },
+            { id: 'tab-2', teamIds: ['team-b'], userId: 'u-b' },
+        ]);
+        yield server.emitToDashboardForSelector('selector_progress', {}, TEAM_B);
+        (0, chai_1.expect)(viewers).to.have.length(1);
+        (0, chai_1.expect)(events(inbox('tab-1'))).to.deep.equal(['selector_progress']);
+        (0, chai_1.expect)(events(inbox('tab-2'))).to.deep.equal(['selector_progress']);
+    }));
+    it('a lookup that fails sends it to admins only', () => __awaiter(void 0, void 0, void 0, function* () {
+        failLookups = true;
+        const { inbox } = connect(EVERYONE);
+        yield server.emitToDashboardForSelector('selector_regressed', {}, TEAM_B);
+        (0, chai_1.expect)(events(inbox('admin'))).to.deep.equal(['selector_regressed']);
+        (0, chai_1.expect)(inbox('member-b')).to.deep.equal([]);
+    }));
+    it('a socket with no identity is a member of no team, with no user', () => __awaiter(void 0, void 0, void 0, function* () {
+        const { io, inbox } = fakeIo([{ id: 'odd', teamIds: [] }]);
+        io.sockets.sockets.get('odd').data = {};
+        server.io = io;
+        yield server.emitToDashboardForSelector('selector_fixed', {}, TEAM_B);
+        (0, chai_1.expect)(viewers).to.deep.equal([{ userId: undefined, teamIds: [] }]);
+        (0, chai_1.expect)(inbox('odd')).to.deep.equal([]);
+    }));
+    it("a selector's events keep their order: the second waits for the first's lookup", () => __awaiter(void 0, void 0, void 0, function* () {
+        const { inbox } = connect(EVERYONE);
+        gate = new Promise((resolve) => (openGate = resolve));
+        const fixed = server.emitToDashboardForSelector('selector_fixed', {}, TEAM_B);
+        const cancelled = server.emitToDashboardForSelector('selector_cancelled', {}, TEAM_B);
+        yield new Promise((r) => setImmediate(r));
+        (0, chai_1.expect)(inbox('admin'), 'nothing overtakes the pending event').to.deep.equal([]);
+        openGate();
+        yield Promise.all([fixed, cancelled]);
+        for (const id of ['admin', 'member-b']) {
+            (0, chai_1.expect)(events(inbox(id)), id).to.deep.equal(['selector_fixed', 'selector_cancelled']);
+        }
+    }));
+    it('with only unscoped sockets (auth disabled) it is the room broadcast, with no lookup', () => __awaiter(void 0, void 0, void 0, function* () {
+        const { inbox, roomBroadcasts } = connect([
+            { id: 'lab-1', teamIds: undefined, role: 'SUPER_ADMIN' },
+            { id: 'lab-2', teamIds: undefined, role: 'SUPER_ADMIN' },
+        ]);
+        void server.emitToDashboardForSelector('selector_fixed', {}, TEAM_B);
+        (0, chai_1.expect)(roomBroadcasts).to.deep.equal(['dashboard']);
+        (0, chai_1.expect)(viewers).to.deep.equal([]);
+        (0, chai_1.expect)(events(inbox('lab-1'))).to.deep.equal(['selector_fixed']);
+        (0, chai_1.expect)(events(inbox('lab-2'))).to.deep.equal(['selector_fixed']);
+    }));
+    it('is recorded in the event log once, unscoped', () => __awaiter(void 0, void 0, void 0, function* () {
+        connect(EVERYONE);
+        const payload = { original_selector: '//team-b' };
+        yield server.emitToDashboardForSelector('selector_muted', payload, TEAM_B);
+        (0, chai_1.expect)(appendSafe.callCount).to.equal(1);
+        (0, chai_1.expect)(appendSafe.firstCall.args[0]).to.deep.equal({ type: 'selector_muted', payload });
+    }));
+    it('before initialize() (no io) it only logs', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield server.emitToDashboardForSelector('selector_muted', {}, TEAM_B);
+        (0, chai_1.expect)(viewers).to.deep.equal([]);
+        (0, chai_1.expect)(appendSafe.callCount).to.equal(1);
+    }));
+});
 describe('Auth disabled: the lab path looks nothing up', () => {
     let restore;
     let authDisabled;

package/lib/test/unit/tracing-export-routing.spec.js

@@ -0,0 +1,137 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const api_1 = require("@opentelemetry/api");
+const api_logs_1 = require("@opentelemetry/api-logs");
+const TracingService_1 = require("../../src/services/TracingService");
+const logger_1 = require("../../src/logger");
+const otlp_probe_1 = require("../helpers/otlp-probe");
+const ENV_KEYS = [
+    'OTEL_SDK_DISABLED',
+    'OTEL_LOGS_ENABLED',
+    'OTEL_TRACES_ENABLED',
+    'OTEL_METRICS_ENABLED',
+    'OTEL_EXPORTER_OTLP_ENDPOINT',
+    'OTEL_EXPORTER_OTLP_LOGS_ENDPOINT',
+    'OTEL_EXPORTER_OTLP_METRICS_ENDPOINT',
+    'XENON_OTEL_DEBUG',
+];
+/**
+ * With tracing on, Xenon builds an OTel NodeSDK for its spans. A NodeSDK
+ * that isn't handed log processors or metric readers builds its own from the
+ * standard OTEL_* variables and registers them globally before Xenon could.
+ * Xenon's own logger and meter providers were then refused, so:
+ * - logs went out as protobuf through the SDK's exporter, not Xenon's;
+ * - metrics went to the trace URL + /v1/metrics, even with
+ *   OTEL_METRICS_ENABLED=false;
+ * - only traces on also exported logs, to the trace URL + /v1/logs;
+ * - XENON_OTEL_DEBUG's console log and metric exporters never printed.
+ *
+ * A probe collector shows where each signal went.
+ */
+describe('TracingService — where logs and metrics go with tracing on', function () {
+    this.timeout(20000);
+    let probe;
+    let service;
+    let saved;
+    beforeEach(() => __awaiter(this, void 0, void 0, function* () {
+        saved = Object.fromEntries(ENV_KEYS.map((k) => [k, process.env[k]]));
+        for (const k of ENV_KEYS)
+            delete process.env[k];
+        (0, otlp_probe_1.resetOtelGlobals)();
+        logger_1.XenonLogger.setOtlpReady(false);
+        probe = yield (0, otlp_probe_1.startOtlpProbe)();
+        process.env.OTEL_EXPORTER_OTLP_ENDPOINT = probe.url('/v1/traces');
+    }));
+    afterEach(() => __awaiter(this, void 0, void 0, function* () {
+        yield (service === null || service === void 0 ? void 0 : service.shutdown());
+        service = undefined;
+        sinon_1.default.restore();
+        (0, otlp_probe_1.resetOtelGlobals)();
+        logger_1.XenonLogger.setOtlpReady(false);
+        yield probe.close();
+        for (const k of ENV_KEYS) {
+            if (saved[k] === undefined)
+                delete process.env[k];
+            else
+                process.env[k] = saved[k];
+        }
+    }));
+    function start() {
+        service = new TracingService_1.TracingService();
+        service.initialize({ isHub: true });
+        return service;
+    }
+    function countProbeMetric() {
+        api_1.metrics.getMeter('probe').createCounter('xenon.probe.count').add(1);
+    }
+    function emitProbeLog() {
+        api_logs_1.logs.getLogger('probe').emit({ body: 'probe line', severityNumber: api_logs_1.SeverityNumber.INFO });
+    }
+    it('exports no metrics with OTEL_METRICS_ENABLED=false', () => __awaiter(this, void 0, void 0, function* () {
+        process.env.OTEL_METRICS_ENABLED = 'false';
+        start();
+        countProbeMetric();
+        yield (0, otlp_probe_1.flushOtelGlobals)();
+        (0, chai_1.expect)(probe.requests.map((r) => r.path).filter((p) => p.includes('metrics'))).to.deep.equal([]);
+    }));
+    it('exports no metrics when no metrics endpoint is set, and never to the trace URL', () => __awaiter(this, void 0, void 0, function* () {
+        start();
+        countProbeMetric();
+        yield (0, otlp_probe_1.flushOtelGlobals)();
+        (0, chai_1.expect)(probe.requests.map((r) => r.path)).to.not.include('/v1/traces/v1/metrics');
+    }));
+    it("sends metrics to Xenon's metrics endpoint as OTLP/JSON", () => __awaiter(this, void 0, void 0, function* () {
+        process.env.OTEL_EXPORTER_OTLP_METRICS_ENDPOINT = probe.url('/xenon-metrics');
+        start();
+        countProbeMetric();
+        yield (0, otlp_probe_1.flushOtelGlobals)();
+        const sent = probe.requests.filter((r) => r.path === '/xenon-metrics');
+        (0, chai_1.expect)(sent, 'metrics export').to.have.length.greaterThan(0);
+        (0, chai_1.expect)(sent.every((r) => r.contentType.includes('application/json'))).to.equal(true);
+        (0, chai_1.expect)(sent.map((r) => r.body.toString('utf8')).join()).to.include('xenon.probe.count');
+    }));
+    it('exports no logs when only traces are configured', () => __awaiter(this, void 0, void 0, function* () {
+        start();
+        emitProbeLog();
+        yield (0, otlp_probe_1.flushOtelGlobals)();
+        (0, chai_1.expect)(probe.requests.map((r) => r.path).filter((p) => p.includes('logs'))).to.deep.equal([]);
+    }));
+    it("sends logs to Xenon's log endpoint as OTLP/JSON", () => __awaiter(this, void 0, void 0, function* () {
+        process.env.OTEL_EXPORTER_OTLP_LOGS_ENDPOINT = probe.url('/xenon-logs');
+        start();
+        emitProbeLog();
+        yield (0, otlp_probe_1.flushOtelGlobals)();
+        const sent = probe.requests.filter((r) => r.path === '/xenon-logs');
+        (0, chai_1.expect)(sent, 'logs export').to.have.length.greaterThan(0);
+        (0, chai_1.expect)(sent.every((r) => r.contentType.includes('application/json'))).to.equal(true);
+        (0, chai_1.expect)(sent.map((r) => r.body.toString('utf8')).join()).to.include('probe line');
+    }));
+    it('prints logs and metrics to the console with XENON_OTEL_DEBUG=true', () => __awaiter(this, void 0, void 0, function* () {
+        const printed = sinon_1.default.stub(console, 'dir');
+        process.env.XENON_OTEL_DEBUG = 'true';
+        process.env.OTEL_EXPORTER_OTLP_LOGS_ENDPOINT = probe.url('/xenon-logs');
+        start();
+        emitProbeLog();
+        countProbeMetric();
+        yield (0, otlp_probe_1.flushOtelGlobals)();
+        printed.restore();
+        const shown = printed.getCalls().map((c) => JSON.stringify(c.args[0]));
+        (0, chai_1.expect)(shown.some((s) => s.includes('probe line')), 'console log record').to.equal(true);
+        (0, chai_1.expect)(shown.some((s) => s.includes('xenon.probe.count')), 'console metric').to.equal(true);
+    }));
+});