@xenon-device-management/xenon 2.6.2 → 2.8.0

package/lib/test/unit/ios-tunnels.spec.js

@@ -0,0 +1,387 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const child_process_1 = __importDefault(require("child_process"));
+const events_1 = require("events");
+const http_1 = __importDefault(require("http"));
+const sinon_1 = __importDefault(require("sinon"));
+const typedi_1 = require("typedi");
+const IOSTunnels_1 = require("../../src/device-managers/ios/IOSTunnels");
+const ProcessRegistry_1 = require("../../src/services/ProcessRegistry");
+/**
+ * Each iOS 17+ phone gets its own go-ios tunnel, an isolated per-device agent
+ * on its own pair of leased ports. Through 2.7 every tunnel took go-ios's
+ * default 60105/60106, so a second iPhone's stream killed the first's.
+ *
+ * go-ios keeps a per-device agent running when its phone is unplugged, and
+ * starts the replugged phone's tunnel on its next traffic port, P + 2: the
+ * next phone's pair. So a tunnel that loses its phone, or moves its traffic
+ * port, is stopped.
+ *
+ * go-ios, the allocator, HTTP and timers are fakes here, except in the last
+ * block, which runs the real seams against a local HTTP server and a stubbed
+ * spawn.
+ */
+const PHONE_A = 'test-iphone-a-00008150';
+const PHONE_B = 'test-iphone-b-00008110';
+class FakeProcess extends events_1.EventEmitter {
+    constructor(pid) {
+        super();
+        this.pid = pid;
+        this.exitCode = null;
+        this.stdout = new events_1.EventEmitter();
+        this.stderr = new events_1.EventEmitter();
+    }
+    exit(code = 1) {
+        this.exitCode = code;
+        this.emit('exit', code);
+    }
+}
+/** Two adjacent ports per phone from 12100, as PortAllocator.acquirePair leases them. */
+function fakeAllocator() {
+    let next = 12100;
+    const leased = new Map();
+    return {
+        leased,
+        acquirePair: sinon_1.default.stub().callsFake((_purpose, udid) => __awaiter(this, void 0, void 0, function* () {
+            const port = next;
+            next += 2;
+            leased.set(port, udid);
+            leased.set(port + 1, udid);
+            return port;
+        })),
+        release: sinon_1.default.stub().callsFake((port, udid) => __awaiter(this, void 0, void 0, function* () {
+            if (leased.get(port) === udid)
+                leased.delete(port);
+        })),
+        touch: sinon_1.default.stub().resolves(),
+    };
+}
+class TestTunnels extends IOSTunnels_1.IOSTunnels {
+    constructor() {
+        super(...arguments);
+        this.versions = new Map();
+        this.spawned = [];
+        this.killed = [];
+        this.sleeps = [];
+        /** Each tunnel-info poll: true is the phone's tunnel on P + 1, false a 404. */
+        this.answers = () => true;
+        this.ports = fakeAllocator();
+        this.nextPid = 7000;
+    }
+    iosVersion(udid) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const version = this.versions.get(udid);
+            if (version === undefined)
+                throw new Error(`no such phone: ${udid}`);
+            return version;
+        });
+    }
+    spawnTunnel(udid, args) {
+        const proc = new FakeProcess(this.nextPid++);
+        this.spawned.push({ udid, args, proc });
+        return proc;
+    }
+    tunnelInfo(port, udid) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const answer = this.answers(port, udid);
+            if (answer === true)
+                return { state: 'up', userspacePort: port + 1 };
+            if (answer === false)
+                return { state: 'gone' };
+            return answer;
+        });
+    }
+    sleep(ms) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.sleeps.push(ms);
+        });
+    }
+    killGroup(pid) {
+        this.killed.push(pid);
+    }
+    allocator() {
+        return this.ports;
+    }
+}
+const settle = () => new Promise((resolve) => setImmediate(resolve));
+describe('IOSTunnels: a go-ios tunnel per iPhone', () => {
+    let t;
+    beforeEach(() => {
+        sinon_1.default.stub(process, 'kill');
+        t = new TestTunnels();
+        t.versions.set(PHONE_A, 17.4);
+        t.versions.set(PHONE_B, 18.1);
+    });
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        yield t.stop(PHONE_A);
+        yield t.stop(PHONE_B);
+        sinon_1.default.restore();
+    }));
+    it('starts no tunnel for a phone below iOS 17', () => __awaiter(void 0, void 0, void 0, function* () {
+        t.versions.set('old-iphone', 16.7);
+        (0, chai_1.expect)(yield t.ensure('old-iphone')).to.equal(null);
+        (0, chai_1.expect)(t.spawned).to.deep.equal([]);
+        (0, chai_1.expect)(t.ports.acquirePair.called).to.equal(false);
+    }));
+    it("starts no tunnel when the phone's version can't be read", () => __awaiter(void 0, void 0, void 0, function* () {
+        (0, chai_1.expect)(yield t.ensure('unknown-iphone')).to.equal(null);
+        (0, chai_1.expect)(t.spawned).to.deep.equal([]);
+    }));
+    it("leases a pair and starts the phone's own agent on it", () => __awaiter(void 0, void 0, void 0, function* () {
+        const port = yield t.ensure(PHONE_A);
+        (0, chai_1.expect)(port).to.equal(12100);
+        (0, chai_1.expect)(t.ports.acquirePair.calledOnceWithExactly('tunnel', PHONE_A, { ttlMs: IOSTunnels_1.TUNNEL_LEASE_TTL_MS })).to.equal(true);
+        (0, chai_1.expect)(t.spawned.map((s) => s.args)).to.deep.equal([
+            ['tunnel', 'start', '--udid', PHONE_A, '--userspace', '--tunnel-info-port', '12100'],
+        ]);
+        (0, chai_1.expect)(t.portFor(PHONE_A)).to.equal(12100);
+    }));
+    it('is ready only once the tunnel answers for the phone', () => __awaiter(void 0, void 0, void 0, function* () {
+        const asked = [];
+        t.answers = (port, udid) => {
+            asked.push([port, udid]);
+            return asked.length === 3;
+        };
+        (0, chai_1.expect)(yield t.ensure(PHONE_A)).to.equal(12100);
+        (0, chai_1.expect)(asked).to.deep.equal([
+            [12100, PHONE_A],
+            [12100, PHONE_A],
+            [12100, PHONE_A],
+        ]);
+        (0, chai_1.expect)(t.sleeps).to.deep.equal([500, 500]);
+    }));
+    it('waits 20 s in all for a tunnel that never answers, then goes on with it', () => __awaiter(void 0, void 0, void 0, function* () {
+        t.answers = () => false;
+        (0, chai_1.expect)(yield t.ensure(PHONE_A)).to.equal(12100);
+        (0, chai_1.expect)(t.sleeps.reduce((a, b) => a + b, 0)).to.equal(IOSTunnels_1.TUNNEL_READY_TIMEOUT_MS);
+        (0, chai_1.expect)(t.portFor(PHONE_A), 'still tracked').to.equal(12100);
+    }));
+    it('fails the start when the tunnel exits before it is ready, and gives its ports back', () => __awaiter(void 0, void 0, void 0, function* () {
+        t.answers = () => {
+            t.spawned[0].proc.exit(1);
+            return false;
+        };
+        const err = yield t.ensure(PHONE_A).then(() => null, (e) => e);
+        yield settle();
+        (0, chai_1.expect)(err === null || err === void 0 ? void 0 : err.message).to.match(/exited before it was ready/);
+        (0, chai_1.expect)(t.portFor(PHONE_A)).to.equal(undefined);
+        (0, chai_1.expect)([...t.ports.leased.keys()]).to.deep.equal([]);
+    }));
+    it('fails the start when the tunnel comes up on another traffic port, and stops it', () => __awaiter(void 0, void 0, void 0, function* () {
+        t.answers = () => ({ state: 'up', userspacePort: 12102 });
+        const err = yield t.ensure(PHONE_A).then(() => null, (e) => e);
+        yield settle();
+        (0, chai_1.expect)(err === null || err === void 0 ? void 0 : err.message).to.match(/12102/);
+        (0, chai_1.expect)(t.killed).to.deep.equal([t.spawned[0].proc.pid]);
+        (0, chai_1.expect)(t.portFor(PHONE_A)).to.equal(undefined);
+        (0, chai_1.expect)([...t.ports.leased.keys()]).to.deep.equal([]);
+    }));
+    it('gives a second phone its own pair, and leaves the first alone', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield t.ensure(PHONE_A);
+        (0, chai_1.expect)(yield t.ensure(PHONE_B)).to.equal(12102);
+        (0, chai_1.expect)(t.spawned[1].args).to.include.members(['--udid', PHONE_B, '12102']);
+        (0, chai_1.expect)(t.portFor(PHONE_A)).to.equal(12100);
+        (0, chai_1.expect)(t.killed).to.deep.equal([]);
+    }));
+    it("reuses a phone's running tunnel", () => __awaiter(void 0, void 0, void 0, function* () {
+        yield t.ensure(PHONE_A);
+        (0, chai_1.expect)(yield t.ensure(PHONE_A)).to.equal(12100);
+        (0, chai_1.expect)(t.spawned.length).to.equal(1);
+        (0, chai_1.expect)(t.ports.acquirePair.callCount).to.equal(1);
+    }));
+    it("stops only that phone's tunnel and gives its pair back", () => __awaiter(void 0, void 0, void 0, function* () {
+        yield t.ensure(PHONE_A);
+        yield t.ensure(PHONE_B);
+        yield t.stop(PHONE_A);
+        (0, chai_1.expect)(t.killed).to.deep.equal([t.spawned[0].proc.pid]);
+        (0, chai_1.expect)(t.portFor(PHONE_A)).to.equal(undefined);
+        (0, chai_1.expect)(t.portFor(PHONE_B)).to.equal(12102);
+        (0, chai_1.expect)([...t.ports.leased.entries()]).to.deep.equal([
+            [12102, PHONE_B],
+            [12103, PHONE_B],
+        ]);
+    }));
+    it('stops nothing for a phone with no tunnel', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield t.stop(PHONE_A);
+        (0, chai_1.expect)(t.killed).to.deep.equal([]);
+        (0, chai_1.expect)(t.ports.release.called).to.equal(false);
+    }));
+    it('lets a tunnel whose process exits go, and starts a new one next time', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield t.ensure(PHONE_A);
+        t.spawned[0].proc.exit(2); // go-ios crashed
+        yield settle();
+        (0, chai_1.expect)(t.portFor(PHONE_A)).to.equal(undefined);
+        (0, chai_1.expect)(t.ports.leased.has(12100)).to.equal(false);
+        (0, chai_1.expect)(t.ports.leased.has(12101)).to.equal(false);
+        (0, chai_1.expect)(yield t.ensure(PHONE_A)).to.equal(12102);
+        (0, chai_1.expect)(t.spawned.length).to.equal(2);
+    }));
+    it('a failed lease starts nothing', () => __awaiter(void 0, void 0, void 0, function* () {
+        t.ports.acquirePair.rejects(new Error("Port range for purpose 'tunnel' is exhausted"));
+        const err = yield t.ensure(PHONE_A).then(() => null, (e) => e);
+        (0, chai_1.expect)(err === null || err === void 0 ? void 0 : err.message).to.match(/exhausted/);
+        (0, chai_1.expect)(t.spawned).to.deep.equal([]);
+        (0, chai_1.expect)(t.portFor(PHONE_A)).to.equal(undefined);
+    }));
+    it('envFor sets GO_IOS_AGENT_PORT only while the phone has a tunnel', () => __awaiter(void 0, void 0, void 0, function* () {
+        const inherited = process.env.GO_IOS_AGENT_PORT;
+        (0, chai_1.expect)(t.envFor(PHONE_A).ENABLE_GO_IOS_AGENT).to.equal('yes');
+        (0, chai_1.expect)(t.envFor(PHONE_A).GO_IOS_AGENT_PORT).to.equal(inherited);
+        yield t.ensure(PHONE_A);
+        (0, chai_1.expect)(t.envFor(PHONE_A).GO_IOS_AGENT_PORT).to.equal('12100');
+        (0, chai_1.expect)(t.envFor(PHONE_B).GO_IOS_AGENT_PORT, 'another phone').to.equal(inherited);
+        yield t.stop(PHONE_A);
+        (0, chai_1.expect)(t.envFor(PHONE_A).GO_IOS_AGENT_PORT).to.equal(inherited);
+    }));
+    it("touch keeps both of the phone's ports leased", () => __awaiter(void 0, void 0, void 0, function* () {
+        yield t.ensure(PHONE_A);
+        yield t.touch(PHONE_A);
+        yield t.touch(PHONE_B); // no tunnel: nothing to touch
+        (0, chai_1.expect)(t.ports.touch.args).to.deep.equal([
+            [12100, IOSTunnels_1.TUNNEL_LEASE_TTL_MS],
+            [12101, IOSTunnels_1.TUNNEL_LEASE_TTL_MS],
+        ]);
+    }));
+});
+describe('IOSTunnels: a phone that goes away (go-ios keeps its agent running)', () => {
+    let t;
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        sinon_1.default.stub(process, 'kill');
+        t = new TestTunnels();
+        t.versions.set(PHONE_A, 17.4);
+        t.versions.set(PHONE_B, 18.1);
+        yield t.ensure(PHONE_A);
+        yield t.ensure(PHONE_B);
+    }));
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        yield t.stop(PHONE_A);
+        yield t.stop(PHONE_B);
+        sinon_1.default.restore();
+    }));
+    it("stops the tunnel of a phone that went away, gives its ports back, and leaves the other phone's", () => __awaiter(void 0, void 0, void 0, function* () {
+        t.answers = (_port, udid) => udid !== PHONE_A; // A's agent: 404 for A
+        yield t.checkTunnels();
+        (0, chai_1.expect)(t.killed).to.deep.equal([t.spawned[0].proc.pid]);
+        (0, chai_1.expect)(t.portFor(PHONE_A)).to.equal(undefined);
+        (0, chai_1.expect)(t.portFor(PHONE_B)).to.equal(12102);
+        (0, chai_1.expect)([...t.ports.leased.keys()]).to.deep.equal([12102, 12103]);
+    }));
+    it('stops a tunnel that came back on another traffic port (a replug)', () => __awaiter(void 0, void 0, void 0, function* () {
+        t.answers = (port, udid) => udid === PHONE_A ? { state: 'up', userspacePort: port + 2 } : true;
+        yield t.checkTunnels();
+        (0, chai_1.expect)(t.killed).to.deep.equal([t.spawned[0].proc.pid]);
+        (0, chai_1.expect)(t.portFor(PHONE_A)).to.equal(undefined);
+        (0, chai_1.expect)(t.portFor(PHONE_B)).to.equal(12102);
+    }));
+    it("leaves a tunnel alone when its agent doesn't answer (busy, not gone)", () => __awaiter(void 0, void 0, void 0, function* () {
+        t.answers = () => ({ state: 'unknown' });
+        yield t.checkTunnels();
+        (0, chai_1.expect)(t.killed).to.deep.equal([]);
+        (0, chai_1.expect)(t.portFor(PHONE_A)).to.equal(12100);
+    }));
+    it('leaves a tunnel that never came up alone while it answers 404', () => __awaiter(void 0, void 0, void 0, function* () {
+        t.versions.set('slow-iphone', 17.0);
+        t.answers = (_port, udid) => udid !== 'slow-iphone'; // never ready: the start goes on after 20 s
+        yield t.ensure('slow-iphone');
+        yield t.checkTunnels();
+        (0, chai_1.expect)(t.killed).to.deep.equal([]);
+        (0, chai_1.expect)(t.portFor('slow-iphone')).to.equal(12104);
+        yield t.stop('slow-iphone');
+    }));
+    it('checks every 5 s while a tunnel runs, and stops checking when none does', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield t.stop(PHONE_A);
+        yield t.stop(PHONE_B);
+        const clock = sinon_1.default.useFakeTimers({ toFake: ['setInterval', 'clearInterval'] });
+        try {
+            const check = sinon_1.default.stub(t, 'checkTunnels').resolves();
+            yield t.ensure(PHONE_A);
+            clock.tick(IOSTunnels_1.TUNNEL_CHECK_MS);
+            (0, chai_1.expect)(check.callCount).to.equal(1);
+            yield t.stop(PHONE_A);
+            clock.tick(IOSTunnels_1.TUNNEL_CHECK_MS * 3);
+            (0, chai_1.expect)(check.callCount, 'no tunnel, no checks').to.equal(1);
+        }
+        finally {
+            clock.restore();
+        }
+    }));
+});
+describe('iosVersionOf', () => {
+    it('reads the version ios info reports', () => {
+        (0, chai_1.expect)((0, IOSTunnels_1.iosVersionOf)({ ProductVersion: '17.2.1' })).to.equal(17.2);
+        (0, chai_1.expect)((0, IOSTunnels_1.iosVersionOf)({ HumanReadableProductVersionString: 'iOS 18.0' })).to.equal(18);
+        (0, chai_1.expect)((0, IOSTunnels_1.iosVersionOf)({})).to.equal(0);
+    });
+});
+describe('IOSTunnels: its real seams', () => {
+    afterEach(() => sinon_1.default.restore());
+    it("reads the phone's tunnel from its agent: up with its traffic port, gone on 404, unknown when unreachable", () => __awaiter(void 0, void 0, void 0, function* () {
+        const server = http_1.default.createServer((req, res) => {
+            if (req.url === `/tunnel/${PHONE_A}`) {
+                res.writeHead(200, { 'content-type': 'application/json' });
+                // go-ios 1.2.1's answer, as the lab's agent gave it
+                res.end(JSON.stringify({
+                    address: 'fd51:c966:7c74::1',
+                    rsdPort: 53752,
+                    udid: PHONE_A,
+                    userspaceTun: true,
+                    userspaceTunPort: 12101,
+                }));
+            }
+            else {
+                res.writeHead(404);
+                res.end();
+            }
+        });
+        yield new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+        const { port } = server.address();
+        const t = new IOSTunnels_1.IOSTunnels();
+        try {
+            (0, chai_1.expect)(yield t.tunnelInfo(port, PHONE_A)).to.deep.equal({
+                state: 'up',
+                userspacePort: 12101,
+            });
+            (0, chai_1.expect)(yield t.tunnelInfo(port, PHONE_B), 'another phone: 404').to.deep.equal({
+                state: 'gone',
+            });
+        }
+        finally {
+            yield new Promise((resolve) => server.close(() => resolve(undefined)));
+        }
+        (0, chai_1.expect)(yield t.tunnelInfo(port, PHONE_A), 'nothing listening').to.deep.equal({
+            state: 'unknown',
+        });
+    }));
+    it('spawns the tunnel detached, with the agent setting, and tracks it', () => {
+        const fake = new FakeProcess(4321);
+        const spawn = sinon_1.default.stub(child_process_1.default, 'spawn').returns(fake);
+        const track = sinon_1.default.stub();
+        const real = typedi_1.Container.get.bind(typedi_1.Container);
+        sinon_1.default
+            .stub(typedi_1.Container, 'get')
+            .callsFake((token) => (token === ProcessRegistry_1.ProcessRegistry ? { track } : real(token)));
+        const t = new IOSTunnels_1.IOSTunnels();
+        const proc = t.spawnTunnel(PHONE_A, ['tunnel', 'start', '--udid', PHONE_A]);
+        (0, chai_1.expect)(proc).to.equal(fake);
+        const [command, args, opts] = spawn.firstCall.args;
+        (0, chai_1.expect)(command).to.equal(t.goIOSPath);
+        (0, chai_1.expect)(args).to.deep.equal(['tunnel', 'start', '--udid', PHONE_A]);
+        (0, chai_1.expect)(opts.detached).to.equal(true);
+        (0, chai_1.expect)(opts.env.ENABLE_GO_IOS_AGENT).to.equal('yes');
+        (0, chai_1.expect)(track.calledOnceWithExactly({ kind: 'other', udid: PHONE_A, process: fake })).to.equal(true);
+    });
+});

package/lib/test/unit/port-allocator-pairs.spec.js

@@ -0,0 +1,110 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const net_1 = __importDefault(require("net"));
+const PortAllocator_1 = require("../../src/services/PortAllocator");
+const scratch_port_leases_1 = require("../helpers/scratch-port-leases");
+/**
+ * A go-ios tunnel needs two adjacent ports: P for its tunnel-info API and
+ * P + 1, which go-ios derives for the phone's userspace traffic. These run
+ * PortAllocator's real queries against a scratch lease table, and real binds.
+ */
+describe('PortAllocator.acquirePair (go-ios tunnel ports)', () => {
+    const scratch = (0, scratch_port_leases_1.useScratchPortLeases)();
+    const listeners = [];
+    function allocator(range) {
+        const a = new PortAllocator_1.PortAllocator();
+        a.configure({ tunnel: range });
+        return a;
+    }
+    /** Something else listening on `port`, as another program's socket would. */
+    function hold(port) {
+        return new Promise((resolve, reject) => {
+            const server = net_1.default.createServer();
+            server.once('error', reject);
+            server.listen(port, '0.0.0.0', () => resolve());
+            listeners.push(server);
+        });
+    }
+    function leasesOf(udid) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const rows = yield scratch.db.portLease.findMany({
+                where: { leasedToUdid: udid },
+                orderBy: { port: 'asc' },
+            });
+            return rows.map((r) => r.port);
+        });
+    }
+    function leaseTo(udid, port, purpose) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const now = Date.now();
+            yield scratch.db.portLease.create({
+                data: { port, purpose, leasedToUdid: udid, leasedAt: now, expiresAt: now + 60000 },
+            });
+        });
+    }
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        yield Promise.all(listeners.splice(0).map((s) => new Promise((resolve) => s.close(() => resolve(undefined)))));
+    }));
+    it('leases an even port and the next one, and returns the even one', () => __awaiter(void 0, void 0, void 0, function* () {
+        const b = scratch.base;
+        const port = yield allocator([b, b + 5]).acquirePair('tunnel', 'phone-a', { ttlMs: 60000 });
+        (0, chai_1.expect)(port).to.equal(b);
+        (0, chai_1.expect)(yield leasesOf('phone-a')).to.deep.equal([b, b + 1]);
+        const rows = yield scratch.db.portLease.findMany({ where: { leasedToUdid: 'phone-a' } });
+        (0, chai_1.expect)(rows.map((r) => r.purpose)).to.deep.equal(['tunnel', 'tunnel']);
+    }));
+    it('gives a second phone the next pair', () => __awaiter(void 0, void 0, void 0, function* () {
+        const b = scratch.base;
+        const a = allocator([b, b + 5]);
+        yield a.acquirePair('tunnel', 'phone-a');
+        (0, chai_1.expect)(yield a.acquirePair('tunnel', 'phone-b')).to.equal(b + 2);
+        (0, chai_1.expect)(yield leasesOf('phone-b')).to.deep.equal([b + 2, b + 3]);
+    }));
+    it('skips a pair whose second port is leased, whatever for, and keeps none of it', () => __awaiter(void 0, void 0, void 0, function* () {
+        const b = scratch.base;
+        yield leaseTo('another-device', b + 1, 'wda');
+        (0, chai_1.expect)(yield allocator([b, b + 5]).acquirePair('tunnel', 'phone-a')).to.equal(b + 2);
+        (0, chai_1.expect)(yield leasesOf('phone-a')).to.deep.equal([b + 2, b + 3]);
+    }));
+    it('skips a pair whose second port something else listens on', () => __awaiter(void 0, void 0, void 0, function* () {
+        const b = scratch.base;
+        yield hold(b + 1);
+        (0, chai_1.expect)(yield allocator([b, b + 5]).acquirePair('tunnel', 'phone-a')).to.equal(b + 2);
+        (0, chai_1.expect)(yield leasesOf('phone-a')).to.deep.equal([b + 2, b + 3]);
+    }));
+    it('starts at the first even port of a range that starts odd', () => __awaiter(void 0, void 0, void 0, function* () {
+        const b = scratch.base;
+        (0, chai_1.expect)(yield allocator([b + 1, b + 4]).acquirePair('tunnel', 'phone-a')).to.equal(b + 2);
+    }));
+    it('throws PortRangeExhaustedError when no pair is left, and keeps no half pair', () => __awaiter(void 0, void 0, void 0, function* () {
+        const b = scratch.base;
+        yield leaseTo('another-phone', b + 1, 'tunnel');
+        const err = yield allocator([b, b + 1])
+            .acquirePair('tunnel', 'phone-a')
+            .then(() => null, (e) => e);
+        (0, chai_1.expect)(err).to.be.instanceOf(PortAllocator_1.PortRangeExhaustedError);
+        (0, chai_1.expect)(err === null || err === void 0 ? void 0 : err.message).to.match(/tunnel/);
+        (0, chai_1.expect)(yield leasesOf('phone-a')).to.deep.equal([]);
+    }));
+    it("releasePurpose deletes only that purpose's leases", () => __awaiter(void 0, void 0, void 0, function* () {
+        const b = scratch.base;
+        const a = allocator([b, b + 5]);
+        yield a.acquirePair('tunnel', 'phone-a');
+        yield leaseTo('phone-a', b + 50, 'wda');
+        yield a.releasePurpose('tunnel');
+        (0, chai_1.expect)(yield leasesOf('phone-a')).to.deep.equal([b + 50]);
+    }));
+});

package/lib/test/unit/session-list-insights.spec.js

@@ -72,6 +72,45 @@ describe('Sessions page data', () => {
         data: { id, name, email, passwordHash: 'x', accessKey: `ak-${id}` },
     });
     describe('GET /session', () => {
+        // Pages, newest first: limit, and a cursor at the last row of the page
+        // before (before = its createdAt, beforeId = its id). The id breaks ties,
+        // so rows created in the same millisecond are neither skipped nor repeated.
+        describe('paging', () => {
+            const t = (min) => new Date(now - min * MIN);
+            const ids = (res) => res.body.map((r) => r.id);
+            beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+                yield session({ id: 'a', createdAt: t(1) });
+                yield session({ id: 'b', createdAt: t(2) });
+                yield session({ id: 'c', createdAt: t(2) });
+                yield session({ id: 'd', createdAt: t(3) });
+            }));
+            it('keeps to the limit, newest first, the id breaking ties', () => __awaiter(void 0, void 0, void 0, function* () {
+                (0, chai_1.expect)(ids(yield (0, loopbackRequest_1.default)(app()).get('/session?limit=2'))).to.deep.equal(['a', 'c']);
+            }));
+            it('continues after the cursor, neither skipping nor repeating a row', () => __awaiter(void 0, void 0, void 0, function* () {
+                const res = yield (0, loopbackRequest_1.default)(app()).get(`/session?limit=2&before=${t(2).toISOString()}&beforeId=c`);
+                (0, chai_1.expect)(ids(res)).to.deep.equal(['b', 'd']);
+            }));
+            it('takes a cursor with no id as everything older than its time', () => __awaiter(void 0, void 0, void 0, function* () {
+                const res = yield (0, loopbackRequest_1.default)(app()).get(`/session?before=${t(2).toISOString()}`);
+                (0, chai_1.expect)(ids(res)).to.deep.equal(['d']);
+            }));
+            it('refuses a limit or a cursor it cannot read', () => __awaiter(void 0, void 0, void 0, function* () {
+                for (const q of ['limit=abc', 'limit=0', 'limit=-5', 'limit=2.5']) {
+                    const res = yield (0, loopbackRequest_1.default)(app()).get(`/session?${q}`);
+                    (0, chai_1.expect)(res.status, q).to.equal(400);
+                    (0, chai_1.expect)(res.body.error, q).to.equal('invalid_limit');
+                }
+                const res = yield (0, loopbackRequest_1.default)(app()).get('/session?before=soon');
+                (0, chai_1.expect)(res.status).to.equal(400);
+                (0, chai_1.expect)(res.body.error).to.equal('invalid_before');
+            }));
+            it('answers a limit over the most with the most, not an error', () => __awaiter(void 0, void 0, void 0, function* () {
+                const res = yield (0, loopbackRequest_1.default)(app()).get('/session?limit=999999');
+                (0, chai_1.expect)(res.status).to.equal(200);
+                (0, chai_1.expect)(ids(res)).to.deep.equal(['a', 'c', 'b', 'd']);
+            }));
+        });
         it('keeps the sessions created since the given time, newest first', () => __awaiter(void 0, void 0, void 0, function* () {
             yield session({ id: 'old', createdAt: ago(3 * HOUR) });
             yield session({ id: 'recent', createdAt: ago(30 * MIN) });

package/lib/test/unit/stream-own-device-row.spec.js

@@ -128,7 +128,7 @@ describe("stream services act on this server's own row for a udid", () => {
             wdaProcess: null,
             forwardWDAProcess: null,
             forwardMJPEGProcess: null,
-            tunnelProcess: null,
+            tunnelPort: null,
             wdaPort: 28101,
             mjpegPort: 29101,
             status: 'running',