cronwatch 0.13.1 → 0.14.1

data/lib/cronwatch/schedule.rb

@@ -103,12 +103,29 @@ module Cronwatch
     end
 
     # The first fire strictly after `from`, or nil when the cron never fires
-    # again. The walker works on the wall clock and Zone.to_utc takes the
-    # earlier of a repeated time, so, like croner, asked from inside the hour
-    # that repeats when clocks go back it can answer with times in the past.
-    # Its answers are filtered, and a stretch of nothing but past times is
-    # stepped over an hour at a time. Ported from fireAfter in schedule.ts.
+    # again. On the night clocks spring forward every slot the pattern names
+    # still fires: one whose local time the jump skips is moved forward by the
+    # gap's length (see spring_gap and gap_fire_after), so the fires stay
+    # strictly ascending whichever instant they are counted from. Ported from
+    # fireAfter in schedule.ts.
     def fire_after(parsed, from)
+      found = crone_fire_after(parsed, from)
+      start = count_from(from)
+      return found if start.nil?
+
+      moved = gap_fire_after(parsed, start)
+      !moved.nil? && (found.nil? || moved < found) ? moved : found
+    end
+
+    # The first fire strictly after `from` as croner counts it, or nil when
+    # the cron never fires again. The walker works on the wall clock and
+    # Zone.to_utc takes the earlier of a repeated time, so, like croner, asked
+    # from inside the hour that repeats when clocks go back it can answer with
+    # times in the past. Its answers are filtered, and a stretch of nothing
+    # but past times is stepped over an hour at a time. Asked from inside a
+    # spring-forward gap it skips the slots moved out of it, which fire_after
+    # adds back. Ported from croneFireAfter in schedule.ts.
+    def crone_fire_after(parsed, from)
       raise ArgumentError, "schedule \"#{parsed.source}\" was not made by Schedule.parse" unless parsed.pattern
       return nil if parsed.never
 
@@ -128,10 +145,79 @@ module Cronwatch
       nil
     end
 
+    # A spring-forward jump: `jump_at`, the first instant on the later offset;
+    # `gap_ms`, the later offset less the earlier one; `before_ms`, the earlier
+    # offset. All in milliseconds.
+    Gap = Struct.new(:jump_at, :gap_ms, :before_ms)
+
+    # How far back a spring-forward jump is looked for: more than any gap a zone has had.
+    JUMP_LOOKBACK_MS = 3 * 3_600_000
+
+    # The window a spring-forward jump moves skipped slots into, when `at`
+    # lies in one: from the jump for the gap's length (30 minutes on Lord Howe
+    # Island, an hour in most zones). Nil when `at` is not within a gap's
+    # length after a jump in the three hours before it.
+    def spring_gap(timezone, at)
+      jump = spring_jump(timezone, at)
+      jump && at < jump.jump_at + jump.gap_ms ? jump : nil
+    end
+
+    # The spring-forward jump in the three hours up to `at`, found to the
+    # minute: the first minute on the later offset. Nil when the offset at
+    # `at` is not ahead of the offset three hours before.
+    def spring_jump(timezone, at)
+      # Every zone kept its local mean time, with no clock change, in the year 1.
+      return nil if at - JUMP_LOOKBACK_MS < Duration::FIRST_DATE_MS || at >= Duration::LAST_DATE_MS
+
+      after = utc_offset(at, timezone)
+      before = utc_offset(at - JUMP_LOOKBACK_MS, timezone)
+      return nil if after <= before
+
+      lo = at - JUMP_LOOKBACK_MS
+      hi = at
+      while hi - lo > 60_000
+        mid = lo + (hi - lo).div(2)
+        if utc_offset(mid, timezone) == after then hi = mid
+        else lo = mid
+        end
+      end
+      Gap.new(hi.div(60_000) * 60_000, after - before, before)
+    end
+
+    # The first slot the pattern names strictly after `at`, the pattern read
+    # in UTC, which stands for wall-clock time in gap_fire_after.
+    def wall_fire_after(parsed, at)
+      next_runs(parsed, 1, at, "UTC").first
+    end
+
+    # The first slot moved out of a spring-forward gap strictly after
+    # `start`, when `start` lies in that gap's window, else nil. A slot whose
+    # local time the jump skips fires at that local time read on the earlier
+    # offset, which is the same as moving it forward by the gap's length:
+    # 01:20 on the night London skips 01:00 to 02:00 fires at 02:20 BST
+    # (01:20Z). The walker moves them the same way when asked from before the
+    # jump, as croner does, but not from inside it.
+    def gap_fire_after(parsed, start)
+      return nil if parsed.never
+
+      gap = spring_gap(parsed.timezone, start)
+      return nil unless gap
+
+      # Wall-clock time as if it were UTC: the slots the jump skips run from
+      # jump_at + before_ms for gap_ms.
+      slot = wall_fire_after(parsed, start + gap.before_ms)
+      return nil if slot.nil? || slot >= gap.jump_at + gap.before_ms + gap.gap_ms
+
+      slot - gap.before_ms
+    end
+
     # Every fire of a cron strictly after `from` and at or before `to`,
-    # ascending, or nil when there are more than `limit`. Walks the fires in
-    # batches, as firesBetween in schedule.ts asks croner for them, and drops
-    # any that do not move forward (see fire_after).
+    # ascending, or nil when there are more than `limit`: the fires next_fire
+    # gives one after another. Walks the fires in batches, as firesBetween in
+    # schedule.ts asks croner for them, and drops any that do not move forward
+    # (the hour that repeats when clocks go back, see crone_fire_after).
+    # Around a spring-forward gap, where a batch can skip a moved slot or give
+    # one out of order, it counts with fire_after instead.
     def fires_between(parsed, from, to, limit)
       raise ArgumentError, "schedule \"#{parsed.source}\" was not made by Schedule.parse" unless parsed.pattern
       return [] if parsed.never
@@ -143,17 +229,46 @@ module Cronwatch
       probe = start
       last = start
       1000.times do
+        if spring_gap(parsed.timezone, last)
+          # Counting from inside a gap's window: the walker would skip its moved slots.
+          t = fire_after(parsed, last)
+          return out if t.nil? || t > to
+
+          out << t
+          last = probe = t
+          return nil if out.length > limit
+
+          next
+        end
         batch = next_runs(parsed, [limit + 1 - out.length, 24].min, probe)
         return out if batch.empty?
 
+        stepped = false
         batch.each do |t|
           next if t <= last
+
+          if spring_gap(parsed.timezone, t)
+            # The batch reached a gap's window, where its order is the
+            # walker's: the next fire is counted from the last one, and the
+            # rest with it.
+            following = fire_after(parsed, last)
+            return out if following.nil? || following > to
+
+            out << following
+            last = probe = following
+            return nil if out.length > limit
+
+            stepped = true
+            break
+          end
           return out if t > to
 
           out << t
           last = t
           return nil if out.length > limit
         end
+        next if stepped
+
         finish = batch.last
         probe = finish > probe ? finish : probe + 3_600_000
       end
@@ -177,7 +292,7 @@ module Cronwatch
     # moved back, as runsAfter in schedule.ts asks croner: a time before 400
     # goes forward, into the same local mean time every zone kept then, and
     # one from 2800 goes back, to where the zone's present rules already hold.
-    def next_runs(parsed, count, from)
+    def next_runs(parsed, count, from, timezone = parsed.timezone)
       from = count_from(from)
       return [] if from.nil?
 
@@ -189,7 +304,7 @@ module Cronwatch
       runs = []
       at = from + shift
       count.times do
-        at = parsed.pattern.next_after(at, parsed.timezone)
+        at = parsed.pattern.next_after(at, timezone)
         break if at.nil? || at - shift > Duration::LAST_DATE_MS
 
         runs << (at - shift)
@@ -197,25 +312,38 @@ module Cronwatch
       runs
     end
 
-    # The next time the schedule fires strictly after `from`. For an interval, counted from the last run when there is one.
+    # The next time the schedule fires strictly after `from`. For an interval,
+    # counted from the last run's start when there is one (see interval_due
+    # for a run that outlasted its period).
     def next_fire(parsed, from, last_run_at)
       return (last_run_at || from) + parsed.every_ms if parsed.interval?
 
       fire_after(parsed, from)
     end
 
+    # When an interval of `every_ms` is next due after a run: a period after
+    # it started, or, when it finished (`finished_at` not nil) later than
+    # that, a period after it finished. A run that outlasts its period is not
+    # followed by a missed alert the moment it ends.
+    def interval_due(every_ms, started_at, finished_at)
+      due = started_at + every_ms
+      !finished_at.nil? && finished_at > due ? finished_at + every_ms : due
+    end
+
     # When the schedule next wants a run, given the last one. For a cron that is
     # the first fire the last run does not already cover; with no run yet, the
     # first fire at or after registration. For an interval it is the last run's
-    # start (or registration) plus the interval. Nil for a cron that never
-    # fires again.
+    # start (or registration) plus the interval, or its finish plus the
+    # interval when it finished (`last_finished_at`, nil while it runs) later
+    # than that (interval_due). Nil for a cron that never fires again.
     #
     # Counting forward from the last run, rather than back from now, is what
     # lets a job whose period is shorter than its grace be missed at all, and it
     # works for a cron that fires once a year or less.
-    def expectation(parsed, last_run_at, registered_at, grace_ms)
+    def expectation(parsed, last_run_at, registered_at, grace_ms, last_finished_at = nil)
       due_at =
-        if parsed.interval? then (last_run_at || registered_at) + parsed.every_ms
+        if parsed.interval?
+          last_run_at.nil? ? registered_at + parsed.every_ms : interval_due(parsed.every_ms, last_run_at, last_finished_at)
         elsif last_run_at.nil? then fire_after(parsed, registered_at - 1)
         else due_after_run(parsed, last_run_at)
         end
@@ -227,12 +355,17 @@ module Cronwatch
     # year 1 is due; after 9999 there is none (see count_from).
     def due_after_run(parsed, started_at)
       # A fire at or before the start is covered by the run itself.
-      following_fire = fire_after(parsed, started_at)
-      return nil if following_fire.nil?
+      due = fire_after(parsed, started_at)
+      # Bounded: a gap holds at most a few hours of moved slots.
+      100_000.times do
+        return nil if due.nil?
+
+        following = fire_after(parsed, due)
+        return due unless run_covers?(started_at, due, following) || in_spring_forward_gap?(parsed, started_at, due)
 
-      following = fire_after(parsed, following_fire)
-      covers = run_covers?(started_at, following_fire, following) || in_spring_forward_gap?(parsed, started_at, following_fire)
-      covers ? following : following_fire
+        due = following
+      end
+      due
     end
 
     # Whether a run starting at `started_at` covers the fire at `due_at`. A minute
@@ -244,39 +377,21 @@ module Cronwatch
       started_at >= due_at - slack
     end
 
-    # On the night clocks spring forward, a fire whose local time does not exist
-    # (02:30 when 02:00 jumps to 03:00) is moved by croner to the same distance
-    # past the jump (03:30), while vixie cron runs it at the jump itself (03:00).
-    # A run that starts at or after the jump, and before the first fire after
-    # it when that fire lies within one gap of it, is taken to cover that fire,
-    # so neither scheduler's run is reported as missed. A cron that really fires
-    # at 03:30 that night is treated the same way, which only matters if it also
-    # ran early by up to an hour.
+    # On the night clocks spring forward, a slot whose local time does not
+    # exist (02:30 when 02:00 jumps to 03:00) fires moved forward by the gap
+    # (03:30; see gap_fire_after), while vixie cron runs every skipped job
+    # once, at the jump itself (03:00). A run that starts at or after the jump
+    # (less a minute of slack), and before such a moved fire, is taken to
+    # cover it, so neither scheduler's run is reported as missed. Only a moved
+    # slot that is not also a slot of its own on the later offset counts: a
+    # cron that fires every 10 minutes moves 02:10 onto its own 03:10, which
+    # was not skipped.
     def in_spring_forward_gap?(parsed, started_at, fire_at)
-      lookback = 3 * 3_600_000
-      # Every zone kept its local mean time, with no clock change, in the year 1.
-      return false if fire_at - lookback < Duration::FIRST_DATE_MS
-
-      after = utc_offset(fire_at, parsed.timezone)
-      before = utc_offset(fire_at - lookback, parsed.timezone)
-      gap = after - before
-      return false if gap <= 0
-
-      # Find the jump: the first minute in the window with the later offset.
-      lo = fire_at - lookback
-      hi = fire_at
-      while hi - lo > 60_000
-        mid = lo + (hi - lo).div(2)
-        if utc_offset(mid, parsed.timezone) == after then hi = mid
-        else lo = mid
-        end
-      end
-      jump_at = hi.div(60_000) * 60_000
-      return false if fire_at - jump_at >= gap || started_at < jump_at - EARLY_SLACK_MS || started_at >= fire_at
+      gap = spring_gap(parsed.timezone, fire_at)
+      return false if gap.nil? || started_at < gap.jump_at - EARLY_SLACK_MS || started_at >= fire_at
 
-      # Only the first fire after the jump can be a moved one; a cron that also
-      # fires at the jump (every 10 minutes, say) was not moved at all.
-      fire_after(parsed, jump_at - 1) == fire_at
+      names = ->(at) { wall_fire_after(parsed, at - 1) == at }
+      names.call(fire_at + gap.before_ms) && !names.call(fire_at + gap.before_ms + gap.gap_ms)
     end
 
     # Milliseconds the zone's wall clock is ahead of UTC at `at`.

data/lib/cronwatch/triage/anthropic.rb

@@ -111,8 +111,8 @@ module Cronwatch
         lines << "Job definition: #{JS.json(definition.respond_to?(:to_h) ? definition.to_h : definition)}"
         if run
           lines << ""
-          lines << "Triggering run: status #{run.status}, started #{stamp(run.started_at)}, duration #{duration(run)}, trigger #{run.trigger}"
-          lines << "Metrics: #{JS.json(run.metrics)}" if run.metrics && !run.metrics.empty?
+          lines << "Triggering run: status #{run.status}, started #{stamp(run.started_at)}, duration #{duration(run)}, trigger #{data(run.trigger.to_s)}"
+          lines << "Metrics: #{data(JS.json(run.metrics))}" if run.metrics && !run.metrics.empty?
           lines << "Error:\n#{data(JS.head16(run.error, 3000))}" if present?(run.error)
           lines << "Output (tail):\n#{data(JS.tail16(run.output, 3000))}" if present?(run.output)
         end
@@ -122,7 +122,7 @@ module Cronwatch
           lines << "Earlier runs, newest first:"
           earlier.each do |r|
             error = present?(r.error) ? ", error: #{data(JS.head16(r.error.split("\n", -1).first.to_s, 160))}" : ""
-            metrics = r.metrics && !r.metrics.empty? ? ", metrics #{JS.json(r.metrics)}" : ""
+            metrics = r.metrics && !r.metrics.empty? ? ", metrics #{data(JS.json(r.metrics))}" : ""
             lines << "- #{r.status}, #{stamp(r.started_at)}, #{duration(r)}#{error}#{metrics}"
           end
         end

data/lib/cronwatch/types.rb

@@ -268,6 +268,27 @@ module Cronwatch
       @triage_tried = true
     end
 
+    # The keys of the channels that still owe a held alert (the SDK's
+    # HeldAlert.owed; see Evaluate.channel_keys), as stored, or nil when it
+    # has none, so every configured channel owes it. Kept with the fields
+    # this version does not otherwise read, so it is written after them, as
+    # the SDK's spread of an alert writes it.
+    def owed = @extra&.fetch("owed", nil)
+
+    # Whether the alert carries `owed` at all, whatever it holds.
+    def owed? = @extra&.key?("owed") || false
+
+    # A copy with `owed` set to `keys`, or without it when `keys` is nil.
+    def with_owed(keys)
+      extra = (@extra || {}).dup
+      if keys.nil? then extra.delete("owed")
+      else extra["owed"] = keys
+      end
+      copy = dup
+      copy.instance_variable_set(:@extra, extra.empty? ? nil : extra)
+      copy
+    end
+
     # Read leniently, since a queued alert a foreign writer left malformed
     # must affect only its own job: a field of the wrong type is kept as it
     # came (a `type` or `run` that is not what it should be, `details` that

data/lib/cronwatch/version.rb

@@ -2,5 +2,5 @@
 
 module Cronwatch
   # Kept in step with @cronwatch/sdk.
-  VERSION = "0.13.1"
+  VERSION = "0.14.1"
 end

data/lib/cronwatch/web/app.rb

@@ -209,6 +209,9 @@ module Cronwatch
       begin
         request = Request.new(env)
         path = strip_base(request.pathname, base)
+        # Not under the base at all: nothing here answers it, signed in or not.
+        return html(HTML.message_page("Not found", request.pathname, base), 404) if path.nil?
+
         wants_html = !path.start_with?("/api")
         serve(request, path, wants_html, base)
       rescue StandardError => e
@@ -261,6 +264,7 @@ module Cronwatch
       # the URL and every access log. Cross-site posts were refused above.
       if @token && method == "POST" && path == "/signin"
         body = read_body(request)
+        return html(HTML.message_page("Bad request", "Malformed request body", base), 400) if body.equal?(BAD_BODY)
         # A body too large is no token at all.
         sent = body.equal?(TOO_LARGE) ? nil : body["token"]
         return sign_in_page(base) if sent.nil? || !HTTP.constant_time_equal?(sent, @token)
@@ -338,6 +342,7 @@ module Cronwatch
         if action == "silence"
           body = read_body(request)
           return html(HTML.message_page("Not silenced", "The request was too large.", base), 413) if body.equal?(TOO_LARGE)
+          return html(HTML.message_page("Not silenced", "Malformed request body", base), 400) if body.equal?(BAD_BODY)
 
           begin
             duration = silence_duration(body["for"])
@@ -385,6 +390,7 @@ module Cronwatch
         if rest[2] == "silence"
           body = read_body(request)
           return api({ ok: false, error: "Request body too large" }, 413) if body.equal?(TOO_LARGE)
+          return api({ ok: false, error: "Malformed request body" }, 400) if body.equal?(BAD_BODY)
 
           begin
             duration = silence_duration(body.key?("for") ? body["for"] : request.query("for"))
@@ -481,8 +487,15 @@ module Cronwatch
       Digest::SHA256.hexdigest("cronwatch-cookie:#{token}")
     end
 
+    # The path below the base, or nil when the request is not under it. The
+    # pathname, its dot segments already resolved (Request#pathname), must be
+    # the base or start with the base and a "/": "/cronwatchapi/jobs" is not
+    # under "/cronwatch", and neither is "/cronwatch/../api/jobs" (read as
+    # "/api/jobs"). An empty base, for an app mounted at the root, takes every path.
     def strip_base(pathname, base)
-      path = pathname.start_with?(base) ? pathname[base.length..] : pathname
+      return nil unless base.empty? || pathname == base || pathname.start_with?("#{base}/")
+
+      path = pathname[base.length..]
       path = "/" if path.empty?
       path = path[0...-1] if path.length > 1 && path.end_with?("/")
       path
@@ -520,7 +533,8 @@ module Cronwatch
 
     # A request body past Request::MAX_BODY, which read_body answers with.
     TOO_LARGE = Object.new.freeze
-    private_constant :TOO_LARGE
+    BAD_BODY = Object.new.freeze
+    private_constant :TOO_LARGE, :BAD_BODY
 
     # The form fields or JSON object of a request, each value as String(value)
     # gives it in JavaScript, or TOO_LARGE for a body past Request::MAX_BODY.
@@ -536,13 +550,13 @@ module Cronwatch
       if json
         data = JSON.parse(Output.utf8(request.body).delete_prefix(""))
         return data.to_h { |k, v| [k.to_s, js_string(v)] } if data.is_a?(Hash)
-        return data.each_with_index.to_h { |v, i| [i.to_s, js_string(v)] } if data.is_a?(Array)
+        return BAD_BODY
       else
         return request.form.transform_values { |v| form_value(v) }
       end
       {}
     rescue StandardError
-      {}
+      BAD_BODY
     end
 
     # String(value) for a parsed JSON value.
@@ -650,10 +664,40 @@ module Cronwatch
         @env["REQUEST_METHOD"].to_s.upcase
       end
 
-      # The path as the browser asked for it, still percent-encoded, mount point included.
+      # The path as the browser asked for it, still percent-encoded, mount
+      # point included, with its dot segments resolved as `new URL` resolves
+      # them (a server may pass them through).
       def pathname
         path = "#{@env["SCRIPT_NAME"]}#{@env["PATH_INFO"]}"
-        path.empty? ? "/" : path
+        path.empty? ? "/" : Request.resolve_dots(path)
+      end
+
+      # A segment the URL standard reads as "." or "..", "%2e" standing for a period.
+      SINGLE_DOT = /\A(?:\.|%2e)\z/i
+      DOUBLE_DOT = /\A(?:\.|%2e){2}\z/i
+
+      # `path` with its "." and ".." segments taken out as the URL standard
+      # does: ".." takes the segment before it with it, and either one last
+      # leaves a trailing slash.
+      def self.resolve_dots(path)
+        return path unless path.start_with?("/")
+
+        segments = path.split("/", -1).drop(1)
+        return path unless segments.any? { |segment| SINGLE_DOT.match?(segment) || DOUBLE_DOT.match?(segment) }
+
+        out = []
+        segments.each_with_index do |segment, i|
+          last = i == segments.length - 1
+          if DOUBLE_DOT.match?(segment)
+            out.pop
+            out << "" if last
+          elsif SINGLE_DOT.match?(segment)
+            out << "" if last
+          else
+            out << segment
+          end
+        end
+        "/#{out.join("/")}"
       end
 
       def header(name)

data/lib/cronwatch/web/timeline.rb

@@ -121,9 +121,10 @@ module Cronwatch
 
       # When the job was due within `from` to `to`. A cron's fires come from
       # Schedule.fires_between. An interval is due one period after each run
-      # started, and after the last run once a period for as long as nothing
-      # runs (the times a missed interval job keeps being asked for); with no
-      # run yet, from its next expected time.
+      # started (after it finished, for a run that outlasted the period:
+      # Schedule.interval_due), and after the last run once a period for as
+      # long as nothing runs (the times a missed interval job keeps being
+      # asked for); with no run yet, from its next expected time.
       def due_times(job, parsed, runs, from, to)
         return DueTimes.new(times: [], dense: false) if parsed.nil?
 
@@ -131,13 +132,14 @@ module Cronwatch
           every = parsed.every_ms
           return DueTimes.new(times: [], dense: true) if (to - from).fdiv(every) > MAX_TICKS
 
-          starts = runs.map(&:started_at).sort
+          # Oldest start first, runs that started together in the order given, as a stable sort leaves them.
+          ordered = runs.each_with_index.sort_by { |run, i| [run.started_at, i] }.map(&:first)
+          dues = ordered.map { |run| Schedule.interval_due(every, run.started_at, Evaluate.finished_at_of(run)) }
           times = []
-          starts.each do |start|
-            t = start + every
-            times << t if t >= from && t <= to
+          dues.each do |due|
+            times << due if due >= from && due <= to
           end
-          t = starts.empty? ? job.next_expected_at : starts.last + every
+          t = dues.empty? ? job.next_expected_at : dues.last
           unless t.nil?
             t += (from - t).fdiv(every).ceil * every if t < from
             while t <= to
@@ -160,8 +162,10 @@ module Cronwatch
         return nil if parsed.nil? || !open?(job, :missed)
 
         grace = safely(0) { Evaluate.grace_ms(job.definition) }
-        last = job.last_run&.started_at
-        return safely(nil) { Schedule.expectation(parsed, last, last, grace)&.due_at } unless last.nil?
+        last = job.last_run
+        unless last.nil?
+          return safely(nil) { Schedule.expectation(parsed, last.started_at, last.started_at, grace, Evaluate.finished_at_of(last))&.due_at }
+        end
 
         past = times.select { |t| t + grace < now }
         past.last

data/lib/cronwatch/zone.rb

@@ -61,6 +61,9 @@ module Cronwatch
       guess = target + (target - civil_seconds(wall(target, timezone)))
       seen = wall(guess, timezone)
       if seen == wall
+        # Only an hour back is tried, as croner's fromTZ does, so a fall-back
+        # of another length (Lord Howe's 30 minutes) keeps croner's answer.
+        # Keep it so: Schedule's fall-back fires must match the SDK's.
         earlier = guess - 3600
         return wall(earlier, timezone) == wall ? earlier : guess
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cronwatch
 version: !ruby/object:Gem::Version
-  version: 0.13.1
+  version: 0.14.1
 platform: ruby
 authors:
 - Jon C. Phillips