@xenon-device-management/xenon 2.15.0 → 2.17.0

package/lib/src/scripts/initialize-database.js

@@ -14,42 +14,38 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const node_child_process_1 = require("node:child_process");
 const config_1 = require("../config");
-const prepare_prisma_1 = require("./prepare-prisma");
 const logger_1 = __importDefault(require("../logger"));
-const env = Object.assign(Object.assign({}, process.env), { DATABASE_URL: config_1.config.databaseUrl });
-function executeCmd(cmd) {
-    var _a;
-    try {
-        (0, node_child_process_1.execSync)(cmd, {
-            env,
-            stdio: 'inherit',
-        });
-    }
-    catch (error) {
-        const msg = (_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : String(error);
-        logger_1.default.error(`[DBInit] Failed to execute command: ${cmd} | Error: ${msg}`, error);
-        throw error;
-    }
-}
+const database_check_1 = require("./database-check");
+const run_migrations_1 = require("./run-migrations");
+/**
+ * `npm run db:migrate`: bring the database up to date, then regenerate the
+ * client.
+ *
+ * It checks the database URL and uses the rule the server uses at startup
+ * (database-check.ts, then run-migrations.ts): the database decides between
+ * `migrate deploy` and `db push`, so a database whose migration history
+ * matches its tables stays on `migrate deploy`. It runs whatever
+ * XENON_AUTO_MIGRATE says, since it is how you update the schema when that is
+ * off. Through 2.15.0 it always ran `db push`, and first rewrote
+ * prisma/schema.prisma's provider to `databaseProvider`. With `postgresql`,
+ * that left a PostgreSQL schema in the checkout that the SQLite file couldn't
+ * use.
+ */
 function main() {
     return __awaiter(this, void 0, void 0, function* () {
-        logger_1.default.info(`[DBInit] Preparing database for provider: ${config_1.config.databaseProvider}`);
-        // 1. Ensure schema matches provider
-        yield (0, prepare_prisma_1.preparePrismaSchema)();
-        // 2. Handle Migrations
-        if (config_1.config.databaseProvider === 'sqlite') {
-            logger_1.default.info('[DBInit] Syncing SQLite schema via db push...');
-            executeCmd('npx prisma db push --accept-data-loss --skip-generate');
-        }
-        else {
-            // For PostgreSQL, we might not have migrations checked in yet.
-            // In "Cellular Architecture", we use db push to ensure the schema is synced
-            // without requiring migration history sync across cells.
-            logger_1.default.info('[DBInit] Syncing PostgreSQL schema via db push...');
-            executeCmd('npx prisma db push --accept-data-loss');
-        }
+        // A PostgreSQL URL would otherwise reach the history read and fail there,
+        // under a message about the file.
+        (0, database_check_1.assertSupportedDatabase)();
+        yield (0, run_migrations_1.syncDatabaseSchema)();
         logger_1.default.info('[DBInit] Generating Prisma Client...');
-        executeCmd('npx prisma generate');
+        (0, node_child_process_1.execSync)('npx prisma generate', {
+            env: Object.assign(Object.assign({}, process.env), { DATABASE_URL: config_1.config.databaseUrl }),
+            stdio: 'inherit',
+        });
     });
 }
-(() => __awaiter(void 0, void 0, void 0, function* () { return yield main(); }))();
+main().catch((err) => {
+    var _a;
+    logger_1.default.error(`[DBInit] ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
+    process.exit(1);
+});

package/lib/src/scripts/run-migrations.js

@@ -45,6 +45,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.planSchemaSync = planSchemaSync;
+exports.readMigrationHistory = readMigrationHistory;
+exports.schemaSyncFailure = schemaSyncFailure;
+exports.syncDatabaseSchema = syncDatabaseSchema;
 exports.runMigrations = runMigrations;
 const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
@@ -52,6 +56,230 @@ const path = __importStar(require("node:path"));
 const os = __importStar(require("node:os"));
 const logger_1 = __importDefault(require("../logger"));
 const config_1 = require("../config");
+const database_check_1 = require("./database-check");
+/**
+ * Which command brings a database up to date. `historyMatchesTables` is asked
+ * only about a database with migrations left to apply. Given the applied
+ * migrations, it says whether the tables are what they make, or null when it
+ * can't tell.
+ */
+function planSchemaSync(history, localMigrations, historyMatchesTables) {
+    if (!history) {
+        return {
+            command: 'db push',
+            acceptDataLoss: true,
+            reason: 'it has no migration history (a new database, or one kept up to date with db push)',
+            basis: 'no-history',
+            failed: [],
+        };
+    }
+    if (history.failed.length > 0) {
+        return {
+            command: 'db push',
+            acceptDataLoss: false,
+            reason: `its migration history records a failed migration (${history.failed.join(', ')}), ` +
+                'which migrate deploy will not get past',
+            basis: 'failed-migration',
+            failed: history.failed,
+        };
+    }
+    const applied = new Set(history.applied);
+    const pending = localMigrations.filter((name) => !applied.has(name));
+    if (pending.length === 0) {
+        return {
+            command: 'migrate deploy',
+            acceptDataLoss: false,
+            reason: 'its migration history has every migration',
+            basis: 'complete',
+            failed: [],
+        };
+    }
+    const matches = historyMatchesTables(localMigrations.filter((name) => applied.has(name)));
+    if (matches === false) {
+        return {
+            command: 'db push',
+            acceptDataLoss: false,
+            reason: 'its tables differ from what its recorded migrations make (db push updated it, or it ' +
+                'was changed by hand), so migrate deploy could fail on a change that is already there',
+            basis: 'tables-differ',
+            failed: [],
+        };
+    }
+    return {
+        command: 'migrate deploy',
+        acceptDataLoss: false,
+        reason: `its migration history is missing ${pending.length} migration(s)` +
+            (matches === null ? ' (the tables could not be compared with the history)' : ''),
+        basis: matches === null ? 'uncompared' : 'behind',
+        failed: [],
+    };
+}
+/**
+ * The file a SQLite `file:` URL names, or null for anything else. Prisma reads
+ * a relative path from the schema's directory, so that is `baseDir`; without
+ * one, a relative path gives null.
+ */
+function sqliteFilePath(databaseUrl, baseDir) {
+    if (!databaseUrl.startsWith('file:'))
+        return null;
+    const file = databaseUrl.slice('file:'.length).split('?')[0];
+    if (path.isAbsolute(file))
+        return file;
+    return baseDir ? path.resolve(baseDir, file) : null;
+}
+/** The migration history in `_prisma_migrations`, or null when the database has none. */
+function readMigrationHistory(databaseUrl) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c;
+        const file = sqliteFilePath(databaseUrl);
+        if (file && !fs.existsSync(file))
+            return null;
+        const { PrismaClient } = yield Promise.resolve().then(() => __importStar(require('../generated/client')));
+        const client = new PrismaClient({ datasources: { db: { url: databaseUrl } } });
+        try {
+            const rows = yield client.$queryRawUnsafe('SELECT migration_name, finished_at, rolled_back_at FROM "_prisma_migrations"');
+            return {
+                applied: rows.filter((r) => r.finished_at && !r.rolled_back_at).map((r) => r.migration_name),
+                failed: rows.filter((r) => !r.finished_at && !r.rolled_back_at).map((r) => r.migration_name),
+            };
+        }
+        catch (err) {
+            const message = String((_c = (_b = (_a = err === null || err === void 0 ? void 0 : err.meta) === null || _a === void 0 ? void 0 : _a.message) !== null && _b !== void 0 ? _b : err === null || err === void 0 ? void 0 : err.message) !== null && _c !== void 0 ? _c : err);
+            if (/no such table|relation .* does not exist/i.test(message))
+                return null;
+            if (/no such column|column .* does not exist/i.test(message)) {
+                // A table of that name that isn't Prisma's. The default setting always
+                // started on such a database, with db push, which leaves the table alone.
+                logger_1.default.warn("[DBMigrate] The database's _prisma_migrations table is not Prisma's migration " +
+                    `history (${message}), so Xenon treats the database as having none.`);
+                return null;
+            }
+            throw err;
+        }
+        finally {
+            yield client.$disconnect();
+        }
+    });
+}
+/** The migrations in prisma/migrations, in the order Prisma applies them. */
+function localMigrationsIn(migrationsDir) {
+    return fs
+        .readdirSync(migrationsDir)
+        .filter((name) => fs.existsSync(path.join(migrationsDir, name, 'migration.sql')))
+        .sort();
+}
+/** A word a POSIX shell reads as itself: quoted only when it has to be. */
+function shellWord(word) {
+    return /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replace(/'/g, "'\\''")}'`;
+}
+/**
+ * The commands a failure's message gives, ready to paste. A copy is made with
+ * SQLite's `VACUUM INTO` through `prisma db execute`, so it is consistent
+ * whatever journal sits beside the file, and needs nothing but the CLI.
+ */
+function pasteable(at) {
+    const schema = shellWord(at.schema);
+    const url = (file) => `file:${file}`;
+    return {
+        copyTo(target) {
+            const statement = `VACUUM INTO '${target.replace(/'/g, "''")}'`;
+            const quoted = /["$`\\!]/.test(statement) ? shellWord(statement) : `"${statement}"`;
+            return `echo ${quoted} | ${at.prisma} db execute --url ${shellWord(at.databaseUrl)} --stdin`;
+        },
+        deploy(file) {
+            return `DATABASE_URL=${shellWord(url(file))} ${at.prisma} migrate deploy --schema ${schema}`;
+        },
+        letGo() {
+            return (`DATABASE_URL=${shellWord(at.databaseUrl)} ${at.prisma} db push --skip-generate ` +
+                `--accept-data-loss --schema ${schema}`);
+        },
+    };
+}
+/** A backup's name: the file's, stamped with the time, so one never overwrites another. */
+function backupOf(file, now) {
+    const stamp = now.toISOString().replace(/[-:]/g, '').replace(/\.\d+/, '');
+    return `${file}.backup-${stamp}`;
+}
+/** The migration a P3018 names, if it does. */
+function failedMigrationIn(output) {
+    const match = /Migration name:\s*(\S+)/.exec(output);
+    return match ? match[1] : null;
+}
+/**
+ * What went wrong and what to do, then Prisma's own output. A refusal to
+ * delete data gives the commands to run, with this server's paths, and never
+ * sends `migrate deploy` to a database it would fail on: one with a failed
+ * migration recorded (P3009), or one whose tables are ahead of its history
+ * (P3018, which records the migration as failed).
+ */
+function schemaSyncFailure(plan, output, at, now = new Date()) {
+    const where = (0, database_check_1.describeDatabaseUrl)(at.databaseUrl);
+    const run = pasteable(at);
+    let sentence;
+    if (/Added the required column/i.test(output)) {
+        sentence =
+            `This version adds a required column to a table that already has rows in ${where}, ` +
+                'which prisma db push cannot do: back the file up, then migrate it by hand or start ' +
+                'from a fresh database.';
+    }
+    else if (/accept-data-loss|There might be data loss/i.test(output)) {
+        const why = plan.basis === 'failed-migration'
+            ? `its migration history records a failed migration (${plan.failed.join(', ')}), ` +
+                "which prisma migrate deploy won't run past"
+            : 'its tables differ from what its recorded migrations make (something was added to ' +
+                'them by hand, or prisma db push moved them past the history)';
+        const backup = at.file
+            ? `Back the file up first:\n  ${run.copyTo(backupOf(at.file, now))}\n`
+            : 'Back the database up first. ';
+        sentence =
+            'prisma db push stopped rather than delete what Prisma lists below from the database ' +
+                `at ${where}. Xenon brings this database up to date with prisma db push because ${why}, ` +
+                'and without --accept-data-loss db push deletes no table or column that holds data. ' +
+                backup +
+                `To let what is listed go, run this and start again:\n  ${run.letGo()}\n`;
+        if (plan.basis === 'failed-migration' || !at.file) {
+            sentence += 'To keep any of it, copy it out of the database first.';
+        }
+        else {
+            // migrate deploy works on the file only if the tables are not ahead of
+            // its history, which nothing here can tell: a copy finds out.
+            const copy = `${at.file}.copy`;
+            sentence +=
+                "To keep it, try this version's migrations on a copy of the file instead:\n" +
+                    `  ${run.copyTo(copy)}\n` +
+                    `  ${run.deploy(copy)}\n` +
+                    'If that works, run them on the file, delete the copy and start again:\n' +
+                    `  ${run.deploy(at.file)}\n` +
+                    'If it fails, they would fail on the file too (P3018 means the tables already have ' +
+                    "a change the history doesn't record): delete the copy, copy out anything you need, " +
+                    'and let what is listed go as above.';
+        }
+    }
+    else if (/P3018/.test(output)) {
+        const name = failedMigrationIn(output);
+        sentence =
+            `A migration${name ? `, ${name},` : ''} failed on the database at ${where}, and its ` +
+                "migration history now records it as failed. Check Prisma's reason below. If what the " +
+                'migration makes is already there ("already exists", "duplicate column name"), start ' +
+                'again: Xenon brings a database with a failed migration recorded up to date with ' +
+                'prisma db push, which stops before deleting a table or column that holds data. If ' +
+                'the migration failed on the rows in the database (a unique index over duplicate ' +
+                'values, say), back the file up, change those rows, and start again.';
+    }
+    else {
+        sentence =
+            `prisma ${plan.command} could not bring the database at ${where} up to date: back the ` +
+                'file up and fix what Prisma reports below, or, if its schema already matches this ' +
+                'version, set XENON_AUTO_MIGRATE=false to start without changing it.';
+    }
+    return `[DBMigrate] Cannot start: ${sentence}\n\n${output}`;
+}
+/** What a failed prisma call printed: its warnings (stdout) and its error (stderr). */
+function cliOutput(err) {
+    var _a;
+    const parts = [err === null || err === void 0 ? void 0 : err.stdout, err === null || err === void 0 ? void 0 : err.stderr].map((b) => (b ? b.toString().trim() : ''));
+    return parts.filter(Boolean).join('\n') || String((_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err).trim();
+}
 function resolvePluginRoot() {
     let dir = __dirname;
     for (let i = 0; i < 8; i++) {
@@ -81,15 +309,14 @@ function resolvePrismaInvocation(rootDir) {
         return { cmd: localBin, prefix: [] };
     return { cmd: 'npx', prefix: ['prisma'] };
 }
-function runMigrations() {
-    return __awaiter(this, arguments, void 0, function* (runSync = node_child_process_1.execFileSync) {
+/**
+ * Bring the database at `config.databaseUrl` up to date with prisma/schema.prisma,
+ * by the rule above. Throws an Error whose message says what to do when it can't.
+ * `npm run db:migrate` runs this too, whatever XENON_AUTO_MIGRATE says.
+ */
+function syncDatabaseSchema() {
+    return __awaiter(this, arguments, void 0, function* (runSync = node_child_process_1.execFileSync, readHistory = readMigrationHistory) {
         var _a;
-        if (!config_1.config.autoMigrate) {
-            logger_1.default.info('[DBMigrate] Auto-migrate disabled by XENON_AUTO_MIGRATE=false. ' +
-                'Apply schema changes externally (`prisma migrate deploy` for ' +
-                'PostgreSQL, `prisma db push` for SQLite) before the hub boots.');
-            return;
-        }
         const rootDir = resolvePluginRoot();
         const schemaPath = path.join(rootDir, 'prisma', 'schema.prisma');
         const migrationsDir = path.join(rootDir, 'prisma', 'migrations');
@@ -97,33 +324,101 @@ function runMigrations() {
             logger_1.default.warn(`[DBMigrate] Skipping auto-migrate: schema or migrations missing at ${rootDir}`);
             return;
         }
-        const dbDir = path.dirname(config_1.config.databasePath || path.join(os.homedir(), '.cache', 'xenon', 'xenon.db'));
-        fs.mkdirSync(dbDir, { recursive: true });
+        const databaseUrl = config_1.config.databaseUrl;
+        const where = (0, database_check_1.describeDatabaseUrl)(databaseUrl);
+        // The file the CLI will use: a relative path is read from prisma/, as Prisma does.
+        const file = sqliteFilePath(databaseUrl, path.dirname(schemaPath));
+        fs.mkdirSync(path.dirname(file !== null && file !== void 0 ? file : config_1.config.databasePath), { recursive: true });
         const { cmd, prefix } = resolvePrismaInvocation(rootDir);
-        const env = Object.assign(Object.assign({}, process.env), { DATABASE_URL: config_1.config.databaseUrl });
-        const isSqlite = config_1.config.databaseProvider === 'sqlite';
-        const args = isSqlite
-            ? [...prefix, 'db', 'push', '--skip-generate', '--accept-data-loss', '--schema', schemaPath]
+        const env = Object.assign(Object.assign({}, process.env), { DATABASE_URL: databaseUrl });
+        const opts = { env, cwd: rootDir, stdio: 'pipe' };
+        let history;
+        try {
+            history = yield readHistory(file ? `file:${file}` : databaseUrl);
+        }
+        catch (err) {
+            throw new Error('[DBMigrate] Cannot start: Xenon could not read the migration history of the database ' +
+                `at ${where}, so it can't tell how to bring it up to date: if another server is using ` +
+                'the file, stop that one; otherwise back the file up, check that it is a Xenon SQLite ' +
+                `database (Prisma's message is below), and start again.\n\n${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
+        }
+        // Would the history's own migrations make exactly these tables? Built from
+        // this release's copies of the applied migrations, in a scratch directory.
+        const historyMatchesTables = (applied) => {
+            const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'xenon-migration-history-'));
+            try {
+                const lock = path.join(migrationsDir, 'migration_lock.toml');
+                if (fs.existsSync(lock))
+                    fs.copyFileSync(lock, path.join(scratch, 'migration_lock.toml'));
+                for (const name of applied) {
+                    fs.mkdirSync(path.join(scratch, name));
+                    fs.copyFileSync(path.join(migrationsDir, name, 'migration.sql'), path.join(scratch, name, 'migration.sql'));
+                }
+                const diff = ['migrate', 'diff', '--from-migrations', scratch, '--to-schema-datasource'];
+                runSync(cmd, [...prefix, ...diff, schemaPath, '--exit-code'], opts);
+                return true;
+            }
+            catch (err) {
+                if ((err === null || err === void 0 ? void 0 : err.status) === 2)
+                    return false;
+                logger_1.default.warn(`[DBMigrate] Could not compare the tables with the migration history: ${cliOutput(err)}`);
+                return null;
+            }
+            finally {
+                fs.rmSync(scratch, { recursive: true, force: true });
+            }
+        };
+        const plan = planSchemaSync(history, localMigrationsIn(migrationsDir), historyMatchesTables);
+        const announce = `[DBMigrate] Syncing database schema (${plan.command}) at ${where}: ${plan.reason}.`;
+        // A database with a history that leaves migrate deploy is worth a look.
+        if (history && plan.command === 'db push')
+            logger_1.default.warn(announce);
+        else
+            logger_1.default.info(announce);
+        const args = plan.command === 'db push'
+            ? [
+                ...prefix,
+                'db',
+                'push',
+                '--skip-generate',
+                ...(plan.acceptDataLoss ? ['--accept-data-loss'] : []),
+                '--schema',
+                schemaPath,
+            ]
             : [...prefix, 'migrate', 'deploy', '--schema', schemaPath];
         try {
-            logger_1.default.info(`[DBMigrate] Syncing database schema (${config_1.config.databaseProvider}, ${isSqlite ? 'db push' : 'migrate deploy'})...`);
-            runSync(cmd, args, { env, cwd: rootDir, stdio: 'pipe' });
+            runSync(cmd, args, opts);
             logger_1.default.info('[DBMigrate] Database schema in sync.');
         }
         catch (err) {
-            const msg = (((_a = err === null || err === void 0 ? void 0 : err.stderr) === null || _a === void 0 ? void 0 : _a.toString()) || (err === null || err === void 0 ? void 0 : err.message) || String(err)).trim();
-            logger_1.default.error(`[DBMigrate] Auto-sync failed: ${msg}`);
+            const msg = cliOutput(err);
+            logger_1.default.error(`[DBMigrate] prisma ${plan.command} failed: ${msg}`);
             // Boot must not continue. The schema is not what the code expects, so the
             // next query fails somewhere unrelated — `prisma.user.count()` reporting a
             // missing User table, say — and buries this, the actual cause. Stop here
             // and hand back something the operator can act on.
-            throw new Error(`[DBMigrate] Cannot start: database schema sync failed for ${config_1.config.databaseProvider}.\n` +
-                `${msg}\n\n` +
-                `Database: ${config_1.config.databaseUrl}\n` +
-                `A required column cannot be added to a table that already has rows. ` +
-                `Back up the database above, then either migrate it by hand or start ` +
-                `from a fresh one. To boot without touching the schema (the schema must ` +
-                `already match), set XENON_AUTO_MIGRATE=false.`);
+            throw new Error(schemaSyncFailure(plan, msg, {
+                prisma: [cmd, ...prefix].map(shellWord).join(' '),
+                schema: schemaPath,
+                databaseUrl: file ? `file:${file}` : databaseUrl,
+                file,
+            }));
+        }
+    });
+}
+/** The startup step: `syncDatabaseSchema`, unless XENON_AUTO_MIGRATE=false. */
+function runMigrations() {
+    return __awaiter(this, arguments, void 0, function* (runSync = node_child_process_1.execFileSync, readHistory = readMigrationHistory) {
+        if (!config_1.config.autoMigrate) {
+            logger_1.default.info('[DBMigrate] Auto-migrate disabled by XENON_AUTO_MIGRATE=false. Bring the schema up ' +
+                'to date yourself before the server starts: `prisma migrate deploy` for a database ' +
+                'whose migration history (`_prisma_migrations`) matches its tables (`prisma migrate ' +
+                'diff --from-migrations <the recorded ones> --to-schema-datasource prisma/schema.prisma ' +
+                '--exit-code` says so), `prisma db push` for any other (a `migrate deploy` that stops ' +
+                'with P3018 on a change already there means the database is one of those), or ' +
+                '`npm run db:migrate` from a source checkout, which chooses for you.');
+            return;
         }
+        yield syncDatabaseSchema(runSync, readHistory);
     });
 }

package/lib/src/services/ApiKeyService.js

@@ -23,6 +23,7 @@ const typedi_1 = require("typedi");
 const crypto_1 = __importDefault(require("crypto"));
 const prisma_1 = require("../prisma");
 const logger_1 = __importDefault(require("../logger"));
+const identityChanges_1 = require("./identity/identityChanges");
 let ApiKeyService = class ApiKeyService {
     constructor() {
         this.log = logger_1.default.scope('ApiKey');
@@ -38,8 +39,13 @@ let ApiKeyService = class ApiKeyService {
     generateRaw() {
         return crypto_1.default.randomBytes(32).toString('hex');
     }
-    verify(raw) {
-        return __awaiter(this, void 0, void 0, function* () {
+    /**
+     * The live key for `raw`. A use of it is recorded (`lastUsedAt`);
+     * `touch: false` only looks, for a check that isn't a use (a socket's
+     * re-check). Likewise verifyPair.
+     */
+    verify(raw_1) {
+        return __awaiter(this, arguments, void 0, function* (raw, { touch = true } = {}) {
             if (!raw)
                 return null;
             const row = yield prisma_1.prisma.apiKey.findUnique({ where: { keyHash: this.hash(raw) } });
@@ -47,6 +53,8 @@ let ApiKeyService = class ApiKeyService {
                 return null;
             if (row.expiresAt && row.expiresAt.getTime() <= Date.now())
                 return null;
+            if (!touch)
+                return row;
             prisma_1.prisma.apiKey
                 .update({ where: { id: row.id }, data: { lastUsedAt: new Date() } })
                 .catch(() => undefined);
@@ -77,8 +85,8 @@ let ApiKeyService = class ApiKeyService {
             return { id: row.id, raw };
         });
     }
-    verifyPair(accessKey, token) {
-        return __awaiter(this, void 0, void 0, function* () {
+    verifyPair(accessKey_1, token_1) {
+        return __awaiter(this, arguments, void 0, function* (accessKey, token, { touch = true } = {}) {
             if (!accessKey || !token)
                 return null;
             const user = yield prisma_1.prisma.user.findUnique({ where: { accessKey } });
@@ -91,6 +99,8 @@ let ApiKeyService = class ApiKeyService {
                 return null;
             if (row.expiresAt && row.expiresAt.getTime() <= Date.now())
                 return null;
+            if (!touch)
+                return row;
             prisma_1.prisma.apiKey
                 .update({ where: { id: row.id }, data: { lastUsedAt: new Date() } })
                 .catch(() => undefined);
@@ -99,7 +109,8 @@ let ApiKeyService = class ApiKeyService {
     }
     revoke(id) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield prisma_1.prisma.apiKey.update({ where: { id }, data: { revokedAt: new Date() } });
+            const row = yield prisma_1.prisma.apiKey.update({ where: { id }, data: { revokedAt: new Date() } });
+            yield (0, identityChanges_1.identityChanged)(row.userId);
         });
     }
     list() {

package/lib/src/services/InterceptorService.js

@@ -240,7 +240,11 @@ let InterceptorService = class InterceptorService {
             throw new Error(`Interceptor not active for session ${sessionId}`);
         return state;
     }
-    /** `udid` is the session's phone: the dashboard events reach only the teams that see it. */
+    /**
+     * `udid` is the session's phone. The dashboard events reach only admins who
+     * see it: a captured request's headers and bodies can carry the app's
+     * sign-in tokens, and REST's /interceptor routes are admin-only too.
+     */
     emit(evt, udid) {
         for (const l of this.listeners) {
             try {
@@ -255,7 +259,7 @@ let InterceptorService = class InterceptorService {
     broadcast(evt, udid) {
         try {
             const socket = typedi_1.Container.get(SocketServer_1.SocketServer);
-            const scope = { udid };
+            const scope = { udid, adminOnly: true };
             if (evt.type === 'request') {
                 void socket.emitToDashboardForDevices(SocketEvents_1.SocketEvents.INTERCEPTOR_REQUEST, evt.payload, scope);
             }

package/lib/src/services/OrphanSweeper.js

@@ -26,6 +26,7 @@ const event_manager_1 = require("../dashboard/event-manager");
 const SessionStatus_1 = require("../types/SessionStatus");
 const device_service_1 = require("../data-service/device-service");
 const PhoneNetworkRestore_1 = require("./network/PhoneNetworkRestore");
+const TracingService_1 = require("./TracingService");
 const sessionMemory_1 = require("../sessions/sessionMemory");
 let OrphanSweeper = class OrphanSweeper {
     constructor() {
@@ -76,6 +77,11 @@ let OrphanSweeper = class OrphanSweeper {
                     // the ledger's, at boot (PhoneNetworkRestore).
                     yield typedi_1.Container.get(PhoneNetworkRestore_1.PhoneNetworkRestore).restoreSession(s.id, 'heartbeat timeout');
                     (0, sessionMemory_1.forgetSessionMemory)(s.id);
+                    // A previous process's session has no span here; this one's ends.
+                    typedi_1.Container.get(TracingService_1.TracingService).endSessionSpan(s.id, {
+                        failed: true,
+                        reason: 'Session heartbeat timeout',
+                    });
                     // This session's claim only, not every row with its udid: the phone
                     // may be another session's by now (deviceClaims.ts).
                     yield (0, device_service_1.releaseSessionDevices)(s.id);

package/lib/src/services/SelectorStateService.js

@@ -51,6 +51,10 @@ function whereTuple(strategy, selector) {
         },
     };
 }
+/** Just the selector a change is about, for the socket server's scoped emit. */
+function selectorOf(tuple) {
+    return { strategy: tuple.strategy, selector: tuple.selector };
+}
 /** The SelectorEvent row for one change. */
 function selectorEventData(tuple, action, userId, reason) {
     return {
@@ -140,7 +144,7 @@ let SelectorStateService = class SelectorStateService {
                 return upserted;
             }));
             scopedLog.info(`markFixed: ${ctx.strategy}=${ctx.selector} → pending (api_key=${ctx.apiKeyId})`);
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_FIXED, serialize(row));
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_FIXED, serialize(row), selectorOf(ctx));
             return row;
         });
     }
@@ -174,7 +178,7 @@ let SelectorStateService = class SelectorStateService {
                 return upserted;
             }));
             scopedLog.info(`mute: ${ctx.strategy}=${ctx.selector} → muted (api_key=${ctx.apiKeyId})`);
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_MUTED, serialize(row));
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_MUTED, serialize(row), selectorOf(ctx));
             return row;
         });
     }
@@ -231,13 +235,13 @@ let SelectorStateService = class SelectorStateService {
             scopedLog.info(`unmute: ${ctx.strategy}=${ctx.selector} → ${result ? 'active' : 'deleted'} (api_key=${ctx.apiKeyId})`);
             // Emit the post-state. When the row was deleted, surface the prior tuple
             // so the dashboard can drop it from the muted list.
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_UNMUTED, result
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_UNMUTED, result
                 ? serialize(result)
                 : {
                     original_strategy: ctx.strategy,
                     original_selector: ctx.selector,
                     status: 'deleted',
-                });
+                }, selectorOf(ctx));
             return result;
         });
     }
@@ -279,13 +283,13 @@ let SelectorStateService = class SelectorStateService {
                 return row;
             }));
             scopedLog.info(`cancelVerification: ${ctx.strategy}=${ctx.selector} → ${result ? 'active' : 'deleted'} (api_key=${ctx.apiKeyId})`);
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_CANCELLED, result
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_CANCELLED, result
                 ? serialize(result)
                 : {
                     original_strategy: ctx.strategy,
                     original_selector: ctx.selector,
                     status: 'deleted',
-                });
+                }, selectorOf(ctx));
             return result;
         });
     }
@@ -329,7 +333,7 @@ let SelectorStateService = class SelectorStateService {
                 return updated;
             }));
             scopedLog.warn(`onHealRecorded: ${ctx.strategy}=${ctx.selector} regressed from ${existing.status} (session=${ctx.sessionId})`);
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_REGRESSED, serialize(row));
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_REGRESSED, serialize(row), selectorOf(ctx));
             return row;
         });
     }