@andrian.yablonskyy/thub-coordinator 1.0.38 → 1.0.40

package/src/security.js

@@ -0,0 +1,104 @@
+/**
+ * @file        packages/coordinator/src/security.js
+ * @description HTTP security headers for every response, and the same-origin check on the dashboard's state-changing requests (README §12)
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+// Everything the dashboard loads: its own files, plus Bootstrap and its
+// icon font from jsDelivr (layout.pug). No inline script at all — the
+// templates use data-* attributes (public/js/actions.js) — while inline
+// style="" attributes, used throughout the templates, stay allowed.
+const CDN = 'https://cdn.jsdelivr.net',
+  CONTENT_SECURITY_POLICY = [
+    'default-src \'self\'',
+    `script-src 'self' ${CDN}`,
+    `style-src 'self' ${CDN} 'unsafe-inline'`,
+    `font-src 'self' ${CDN}`,
+    // data: — Bootstrap's CSS draws some icons (select arrow, close button)
+    // as inline SVG images.
+    'img-src \'self\' data:',
+    'connect-src \'self\'',
+    'object-src \'none\'',
+    'base-uri \'self\'',
+    'form-action \'self\'',
+    'frame-ancestors \'none\''
+  ].join('; '),
+  // 180 days, this host only: HTTPS is how a TLS-fronted Coordinator is
+  // reached; other hosts under the same domain are none of its business.
+  HSTS = 'max-age=15552000',
+  UNSAFE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+
+// Sent on every response (dashboard, API, static files).
+function securityHeaders(req, res, next){
+  res.set({
+    'Content-Security-Policy': CONTENT_SECURITY_POLICY,
+    // Also frame-ancestors above; this one for browsers that predate it.
+    'X-Frame-Options': 'DENY',
+    'X-Content-Type-Options': 'nosniff',
+    // Full URLs (job ids, searches) only within the dashboard itself.
+    'Referrer-Policy': 'same-origin',
+    'Cross-Origin-Opener-Policy': 'same-origin'
+  });
+  // Only on HTTPS (behind a TLS proxy: X-Forwarded-Proto from a trusted
+  // proxy, trustProxy) — over plain HTTP a browser ignores it anyway.
+  if (req.secure){
+    res.set('Strict-Transport-Security', HSTS);
+  }
+  next();
+}
+
+function originOf(url){
+  try {
+    return new URL(url).origin;
+  }
+  catch {
+    return null;
+  }
+}
+
+// CSRF defence for the session-authenticated routes (the dashboard, and
+// /api/v1/admin), on top of the session cookie's SameSite=Lax: a request
+// that changes something must come from this dashboard's own pages. The
+// browser says where from in Origin (every modern browser sends it on a
+// POST), else Referer; a request carrying neither isn't from a browser page
+// (curl, a script) and couldn't have been forged by one, so it passes. The
+// Agent/Client APIs use bearer tokens, which a browser never attaches by
+// itself, and don't go through here.
+function sameOriginOnly(config){
+  return (req, res, next) => {
+    if (!UNSAFE_METHODS.has(req.method)){
+      return next();
+    }
+    const origin = req.get('origin'),
+      from = origin !== undefined ? origin : req.get('referer') !== undefined ? originOf(req.get('referer')) : undefined;
+    if (from === undefined){
+      return next();
+    }
+    // The address the browser used (Host, as the reverse proxy passes it),
+    // or the configured publicUrl (a proxy that rewrites Host) — read on
+    // every request, since the dashboard can change it (§13.2).
+    const configured = originOf(config.publicUrl),
+      allowed = [configured, `${req.protocol}://${req.get('host')}`];
+    if (from && allowed.includes(from)){
+      return next();
+    }
+    const text = `Blocked: this request came from ${from || 'an unknown page'}, not from this dashboard (${configured}). ` +
+      'Changes can only be made from the dashboard\'s own pages. If you opened the dashboard at a different address, ' +
+      'set publicUrl to that address.';
+    if (req.originalUrl.startsWith('/api/')){ // req.path is relative to the router's mount point
+      return res.status(403).json({ error: text });
+    }
+    res.status(403).type('text/plain').send(text);
+  };
+}
+
+module.exports = { securityHeaders, sameOriginOnly, CONTENT_SECURITY_POLICY };

package/src/server.js

@@ -15,7 +15,8 @@
 
 'use strict';
 
-const path = require('node:path'),
+const fs = require('node:fs'),
+  path = require('node:path'),
   express = require('express'),
   session = require('express-session'),
 
@@ -31,21 +32,38 @@ const path = require('node:path'),
   { createScheduler } = require('./services/scheduler'),
   { createHeartbeatMonitor } = require('./services/heartbeat'),
   { createLogsService } = require('./services/logs'),
-  { createArtifactsService } = require('./services/artifacts'),
   { createCommandsService } = require('./services/commands'),
   { createRetentionService } = require('./services/retention'),
   { createCleanupService } = require('./services/cleanup'),
   { startDevMode } = require('./dev/virtual'),
   { createUpdatesService } = require('./services/updates'),
   { createLiveService } = require('./services/live'),
+  { SqliteSessionStore } = require('./services/session-store'),
+  { securityHeaders, sameOriginOnly } = require('./security'),
+  { createSettingsService } = require('./services/settings'),
+  { createRateLimiter } = require('./rate-limit'),
 
   { createAgentRouter } = require('./api/agent'),
   { createResourceRouter } = require('./api/resource'),
   { createAdminRouter } = require('./api/admin'),
   { createWebRouter } = require('./web/routes');
 
+// Artifacts are no longer stored on the Coordinator (README §9): an
+// upgraded one frees the space the old <dataDir>/artifacts took, once.
+function removeLegacyArtifacts(config){
+  const dir = path.join(config.dataDir, 'artifacts');
+  if (fs.existsSync(dir)){
+    fs.rmSync(dir, { recursive: true, force: true });
+    console.log(`Removed ${dir}: the Coordinator no longer stores job artifacts`);
+  }
+}
+
 function buildServices(config){
+  removeLegacyArtifacts(config);
   const db = openDb(config.dbPath),
+    // First: dashboard settings (README §13.2) go into `config` before any
+    // service reads it — some read theirs only once, at creation.
+    settings = createSettingsService(db, { config }).applyAtStartup(),
     events = createEventsService(db),
     registry = createRegistryService(db, { bus, events }),
     agents = createAgentsService(db, { events }),
@@ -53,14 +71,14 @@ function buildServices(config){
     adminUsers = createAdminUsersService(db),
     commands = createCommandsService({ bus }),
     logs = createLogsService(db, { bus }),
-    artifacts = createArtifactsService(db, { config }),
-    jobs = createJobsService(db, { bus, events, registry, artifacts, config }),
+    jobs = createJobsService(db, { bus, events, registry, config }),
     scheduler = createScheduler(db, { bus, events, registry, config }),
     heartbeatMonitor = createHeartbeatMonitor(db, { bus, events, registry, jobs, config }),
-    retention = createRetentionService(db, { bus, logs, artifacts, config }),
+    retention = createRetentionService(db, { config }),
     cleanup = createCleanupService(db, { jobs, config }),
     updates = createUpdatesService({ config }),
-    live = createLiveService(db, { bus, updates });
+    live = createLiveService(db, { bus, updates }),
+    sessionStore = new SqliteSessionStore(db);
 
   jobs.reconcileOnStartup();
   updates.start();
@@ -83,13 +101,14 @@ function buildServices(config){
     commands,
     jobs,
     logs,
-    artifacts,
     scheduler,
     heartbeatMonitor,
     retention,
     cleanup,
     updates,
-    live
+    live,
+    sessionStore,
+    settings
   };
 }
 
@@ -101,11 +120,26 @@ function commonVersion(){
   return require('@andrian.yablonskyy/thub-common/package.json').version;
 }
 
+// The session cookie's Secure flag (config session.secureCookie, §12).
+// "auto": always Secure for an https:// publicUrl — the cookie must never
+// travel over plain HTTP there — else express-session's per-request 'auto'
+// (Secure on HTTPS connections), so plain-HTTP development still works.
+function cookieSecure(config){
+  const setting = config.session?.secureCookie ?? 'auto';
+  if (setting === true || setting === false){
+    return setting;
+  }
+  return /^https:\/\//i.test(config.publicUrl || '') ? true : 'auto';
+}
+
 function createApp(config, services){
   const app = express();
   app.set('view engine', 'pug');
   app.set('views', path.join(__dirname, '..', 'views'));
   app.set('trust proxy', config.trustProxy);
+  app.disable('x-powered-by');
+  // CSP, framing, nosniff, Referrer-Policy, HSTS on HTTPS (security.js, §12).
+  app.use(securityHeaders);
   app.locals.services = services;
   // Shown in every dashboard page's footer (layout.pug).
   app.locals.coordinatorVersion = require('../package.json').version;
@@ -119,6 +153,9 @@ function createApp(config, services){
   app.use(
     session({
       secret: config.sessionSecret,
+      // In the SQLite database (services/session-store.js), not in memory:
+      // survives restarts, and expired sessions are pruned.
+      store: services.sessionStore,
       resave: false,
       saveUninitialized: false,
       // Idle timeout, not a fixed one (§10.1): `rolling` re-sends a fresh
@@ -127,7 +164,7 @@ function createApp(config, services){
       // (routes.js) after their *last* request. Each user's own preference
       // is applied per-request in web/routes.js, since it isn't known here.
       rolling: true,
-      cookie: { httpOnly: true, sameSite: 'lax' }
+      cookie: { httpOnly: true, sameSite: 'lax', secure: cookieSecure(config) }
     })
   );
   // Background requests of the dashboard's live updates (public/js/live.js):
@@ -147,23 +184,16 @@ function createApp(config, services){
   });
   app.use(express.static(path.join(__dirname, '..', 'public')));
   app.use('/avatars', express.static(config.avatarsDir));
+  // Everything below (API, dashboard, sign-in) — static files above aren't
+  // counted. Per credential, else per IP (rate-limit.js, §12).
+  app.use(createRateLimiter(config, services));
 
   app.use('/api/v1', createAgentRouter({ services, config }));
   app.use('/api/v1', createResourceRouter({ services, config }));
-  app.use('/api/v1/admin', createAdminRouter({ services }));
-
-  // HMAC-signed artifact downloads (§3.1, §12) — no session or bearer token.
-  app.get('/artifacts/download/:token', (req, res, next) => {
-    try {
-      const artifact = services.artifacts.verify(req.params.token);
-      res.download(artifact.path, artifact.name);
-    }
-    catch (err){
-      next(err);
-    }
-  });
+  // Session-authenticated, like the dashboard: same-origin requests only.
+  app.use('/api/v1/admin', sameOriginOnly(config), createAdminRouter({ services }));
 
-  app.use('/', createWebRouter({ services, config }));
+  app.use('/', sameOriginOnly(config), createWebRouter({ services, config }));
 
   app.use((err, req, res, next) => {
     const status = err.status || 500;
@@ -225,4 +255,4 @@ if (require.main === module){
   start();
 }
 
-module.exports = { start, buildServices, createApp };
+module.exports = { start, buildServices, createApp, cookieSecure };

package/src/services/admin-users.js

@@ -14,25 +14,42 @@
 'use strict';
 
 const crypto = require('node:crypto'),
+  { promisify } = require('node:util'),
   { v4: uuid } = require('uuid'),
   { normalize: normalizeListPrefs } = require('./list-prefs');
 
+// Stored as "<salt hex>:<scrypt hex>". The synchronous one is only for the
+// CLI and startup (thub-admin create-admin, the bootstrap password); every
+// request uses the async versions, which run scrypt on libuv's thread pool —
+// scryptSync would stall every request for each sign-in attempt.
+const scrypt = promisify(crypto.scrypt);
+
 function hashPassword(password){
   const salt = crypto.randomBytes(16).toString('hex'),
     derived = crypto.scryptSync(password, salt, 64).toString('hex');
   return `${salt}:${derived}`;
 }
 
-function verifyPassword(password, stored){
+async function hashPasswordAsync(password){
+  const salt = crypto.randomBytes(16).toString('hex');
+  return `${salt}:${(await scrypt(password, salt, 64)).toString('hex')}`;
+}
+
+async function verifyPassword(password, stored){
   const [salt, derived] = stored.split(':'),
-    check = crypto.scryptSync(password, salt, 64).toString('hex');
-  return crypto.timingSafeEqual(Buffer.from(check, 'hex'), Buffer.from(derived, 'hex'));
+    check = await scrypt(String(password ?? ''), salt, 64);
+  return crypto.timingSafeEqual(check, Buffer.from(derived, 'hex'));
 }
 
-// Presets offered on the profile page (§10.1) — a fixed list rather than a
-// free-text field, so a user can't accidentally set a 3-second or 10-year
-// idle timeout.
-const SESSION_TIMEOUT_OPTIONS_MIN = [15, 30, 60, 120, 240, 480, 1440],
+// Checked instead of a real hash when the username doesn't exist, so that
+// answer takes as long as a wrong password and doesn't reveal which
+// usernames exist.
+const DUMMY_HASH = hashPassword(crypto.randomBytes(16).toString('hex')),
+
+  // Presets offered on the profile page (§10.1) — a fixed list rather than a
+  // free-text field, so a user can't accidentally set a 3-second or 10-year
+  // idle timeout.
+  SESSION_TIMEOUT_OPTIONS_MIN = [15, 30, 60, 120, 240, 480, 1440],
   THEMES = ['auto', 'light', 'dark'];
 
 function toProfile(row){
@@ -105,26 +122,22 @@ function createAdminUsersService(db){
   // Self-service password change (§10.1) — requires knowing the *current*
   // password, unlike resetPassword() above (that's the admin/operator
   // break-glass path, which deliberately doesn't need it).
-  function changePassword(id, currentPassword, newPassword){
+  async function changePassword(id, currentPassword, newPassword){
     const row = db.prepare('SELECT * FROM admin_users WHERE id = ?').get(id);
-    if (!row || !verifyPassword(currentPassword, row.password_hash)){
+    if (!row || !(await verifyPassword(currentPassword, row.password_hash))){
       throw Object.assign(new Error('Current password is incorrect'), { status: 401 });
     }
     if (!newPassword){
       throw Object.assign(new Error('New password must not be empty'), { status: 400 });
     }
-    db.prepare('UPDATE admin_users SET password_hash = ? WHERE id = ?').run(hashPassword(newPassword), id);
+    db.prepare('UPDATE admin_users SET password_hash = ? WHERE id = ?').run(await hashPasswordAsync(newPassword), id);
   }
 
-  function verify(username, password){
-    const user = getByUsername(username);
-    if (!user){
-      return null;
-    }
-    if (!verifyPassword(password, user.password_hash)){
-      return null;
-    }
-    return toProfile(user);
+  // Async (thread pool); the same work whether or not the user exists.
+  async function verify(username, password){
+    const user = getByUsername(String(username ?? '')),
+      ok = await verifyPassword(password, user ? user.password_hash : DUMMY_HASH);
+    return user && ok ? toProfile(user) : null;
   }
 
   // Partial update — only the fields present in `fields` are touched, so a

package/src/services/cleanup.js

@@ -1,6 +1,6 @@
 /**
  * @file        packages/coordinator/src/services/cleanup.js
- * @description Database cleanup: wipe finished jobs (logs, artifacts, events) and old events before a cutoff, then
+ * @description Database cleanup: wipe finished jobs (logs, events) and old events before a cutoff, then
  *              VACUUM to shrink the file — on demand from the dashboard, and hourly per retention.jobRetention (README §9)
  *
  * @author      Andrian Yablonskyy
@@ -81,7 +81,7 @@ function createCleanupService(db, { jobs, config, now = () => new Date() }){
   }
 
   // Wipe everything older than `before` (a Date; default now): finished
-  // jobs that ended before it, with their logs, artifacts and events, and
+  // jobs that ended before it, with their logs and events, and
   // the other audit events (resource/agent/group) logged before it. Events
   // of jobs that stay (still active, or newer) are kept. `vacuum`: true,
   // false, or 'auto' (only if something was deleted and the last VACUUM is

package/src/services/heartbeat.js

@@ -18,9 +18,29 @@ const { RESOURCE_STATES, ACTIVE_JOB_STATES } = require('@andrian.yablonskyy/thub
 // §5.1 sweeper: runs every sweepIntervalSec, marks resources OUT_OF_SERVICE
 // after missedLimit missed heartbeats and moves any active job to LOST.
 function createHeartbeatMonitor(db, { bus, events, registry, jobs, config }){
-  function sweepOnce(){
-    const { intervalSec, missedLimit } = config.heartbeat,
-      cutoff = new Date(Date.now() - missedLimit * intervalSec * 1000).toISOString(),
+  // heartbeat.intervalSec can change while running (dashboard Settings,
+  // §13.2). Clients learn the new one from their next heartbeat reply, so
+  // right after it's *lowered* they're still on the old, longer one: keep
+  // judging by that until every Client has had time to switch over.
+  let seenInterval = config.heartbeat.intervalSec,
+    graceInterval = 0,
+    graceUntil = 0;
+  function effectiveInterval(now){
+    const current = config.heartbeat.intervalSec;
+    if (current !== seenInterval){
+      if (current < seenInterval){
+        graceInterval = seenInterval;
+        graceUntil = now + (config.heartbeat.missedLimit + 1) * seenInterval * 1000;
+      }
+      seenInterval = current;
+    }
+    return now < graceUntil ? Math.max(current, graceInterval) : current;
+  }
+
+  function sweepOnce(now = Date.now()){
+    const { missedLimit } = config.heartbeat,
+      intervalSec = effectiveInterval(now),
+      cutoff = new Date(now - missedLimit * intervalSec * 1000).toISOString(),
 
       stale = db
         .prepare(

package/src/services/job-artifacts.js

@@ -0,0 +1,91 @@
+/**
+ * @file        packages/coordinator/src/services/job-artifacts.js
+ * @description Artifacts a finished job reports (metadata only): validation, normalization and size formatting
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+// README §7.3. The job's command publishes its files wherever it likes and
+// lists them in $THUB_ARTIFACTS_FILE; the Client sends that list with the
+// result, and the job keeps only this metadata:
+//   { name, size, link, timestamp }
+// It comes from the job's own command, so it's treated as untrusted: only
+// http(s) links (a `javascript:` one would run in the dashboard when
+// clicked), bounded sizes, and entries that don't fit are dropped, not fatal.
+const MAX_ARTIFACTS = 500,
+  MAX_NAME = 255,
+  MAX_LINK = 2048;
+
+// Unix seconds, Unix milliseconds or an ISO date -> ISO string (or null).
+function normalizeTimestamp(value){
+  let ms = NaN;
+  if (typeof value === 'number' && Number.isFinite(value)){
+    ms = value < 1e11 ? value * 1000 : value; // 1e11 s is the year 5138: smaller means seconds
+  }
+  else if (typeof value === 'string' && value.trim()){
+    ms = /^\d+(\.\d+)?$/.test(value.trim()) ? normalizeTimestampMs(Number(value)) : Date.parse(value);
+  }
+  return Number.isFinite(ms) && ms >= 0 && ms < 8.64e15 ? new Date(ms).toISOString() : null;
+}
+
+function normalizeTimestampMs(n){
+  return n < 1e11 ? n * 1000 : n;
+}
+
+function normalizeLink(value){
+  if (typeof value !== 'string' || value.length > MAX_LINK){
+    return null;
+  }
+  try {
+    const url = new URL(value.trim());
+    return url.protocol === 'http:' || url.protocol === 'https:' ? url.href : null;
+  }
+  catch {
+    return null;
+  }
+}
+
+// -> { artifacts: [...valid, normalized], dropped: <count> }
+function sanitizeArtifacts(raw){
+  if (!Array.isArray(raw)){
+    return { artifacts: [], dropped: raw === undefined || raw === null ? 0 : 1 };
+  }
+  const artifacts = [];
+  let dropped = Math.max(0, raw.length - MAX_ARTIFACTS);
+  for (const item of raw.slice(0, MAX_ARTIFACTS)){
+    const name = typeof item?.name === 'string' ? item.name.trim().slice(0, MAX_NAME) : '',
+      link = normalizeLink(item?.link),
+      size = Number.isSafeInteger(item?.size) && item.size >= 0 ? item.size : null;
+    if (!name || !link){
+      dropped += 1;
+      continue;
+    }
+    artifacts.push({ name, size, link, timestamp: normalizeTimestamp(item.timestamp) });
+  }
+  return { artifacts, dropped };
+}
+
+// 1233 -> "1.2 KB" (1024-based, as file managers show it).
+const UNITS = ['B', 'KB', 'MB', 'GB', 'TB', 'PB'];
+function formatBytes(bytes){
+  if (!Number.isFinite(bytes) || bytes < 0){
+    return '—';
+  }
+  let value = bytes,
+    unit = 0;
+  while (value >= 1024 && unit < UNITS.length - 1){
+    value /= 1024;
+    unit += 1;
+  }
+  return unit === 0 ? `${value} B` : `${value < 10 ? value.toFixed(1) : Math.round(value)} ${UNITS[unit]}`;
+}
+
+module.exports = { sanitizeArtifacts, normalizeTimestamp, formatBytes, MAX_ARTIFACTS };

package/src/services/jobs.js

@@ -16,6 +16,7 @@
 const { validateJobSpec, maskEnv, JOB_STATES, ACTIVE_JOB_STATES, TERMINAL_JOB_STATES, RESOURCE_STATES } = require('@andrian.yablonskyy/thub-common'),
   { paginate } = require('./list-prefs'),
   { parseTerms, likeClause } = require('./search'),
+  { sanitizeArtifacts } = require('./job-artifacts'),
   // Named in spec errors: a field the Agent sends but this thub-common
   // doesn't know means the Coordinator needs an update.
   VERSIONS = `Coordinator v${require('../../package.json').version}, ` +
@@ -28,7 +29,8 @@ function rowToJob(row){
   return {
     ...row,
     spec: JSON.parse(row.spec),
-    summary: row.summary ? JSON.parse(row.summary) : null
+    summary: row.summary ? JSON.parse(row.summary) : null,
+    artifacts: row.artifacts ? JSON.parse(row.artifacts) : []
   };
 }
 
@@ -56,7 +58,7 @@ function nextJobId(db, source){
   return `${prefix}-${String(n).padStart(5, '0')}`;
 }
 
-function createJobsService(db, { bus, events, registry, artifacts, config }){
+function createJobsService(db, { bus, events, registry, config }){
   function get(id){
     return rowToJob(db.prepare('SELECT * FROM jobs WHERE id = ?').get(id));
   }
@@ -365,7 +367,9 @@ function createJobsService(db, { bus, events, registry, artifacts, config }){
   }
 
   // Resource: POST /jobs/:id/result — final verdict from the test runner.
-  function applyResult(id, resourceId, { state, exitCode, summary }){
+  // `artifacts`: what the job published elsewhere (job-artifacts.js) — kept
+  // as metadata, stored before the job turns final so its page shows them.
+  function applyResult(id, resourceId, { state, exitCode, summary, artifacts }){
     const job = get(id);
     if (!job || job.resource_id !== resourceId){
       throw Object.assign(new Error('Job not assigned to this resource'), { status: 403 });
@@ -373,6 +377,13 @@ function createJobsService(db, { bus, events, registry, artifacts, config }){
     if (![JOB_STATES.PASSED, JOB_STATES.FAILED, JOB_STATES.ERROR].includes(state)){
       throw Object.assign(new Error('Invalid result state'), { status: 400 });
     }
+    if (artifacts !== undefined){
+      const { artifacts: list, dropped } = sanitizeArtifacts(artifacts);
+      db.prepare('UPDATE jobs SET artifacts = ? WHERE id = ?').run(list.length ? JSON.stringify(list) : null, id);
+      if (dropped){
+        events.record('job', id, 'job.artifacts_dropped', { dropped });
+      }
+    }
     return setState(id, state, { exitCode, summary });
   }
 
@@ -483,7 +494,7 @@ function createJobsService(db, { bus, events, registry, artifacts, config }){
   }
 
   // Admin: "clean the queue" — permanently delete finished jobs (and their
-  // logs/artifacts, on disk and in the DB), for when the history itself,
+  // logs, in the DB), for when the history itself,
   // not just active work, needs clearing out. Unlike the nightly retention
   // sweep (§9), this runs on demand and isn't limited to old jobs.
   function cleanHistory(){
@@ -491,7 +502,7 @@ function createJobsService(db, { bus, events, registry, artifacts, config }){
   }
 
   // Finished jobs that ended before `beforeIso` (null: all of them), with
-  // their logs, artifacts (files too) and events — manual cleanup and the
+  // their logs and events — manual cleanup and the
   // job retention task (services/cleanup.js). Active jobs are never touched.
   function purgeFinishedBefore(beforeIso){
     const placeholders = [...TERMINAL_JOB_STATES].map(() => '?').join(','),
@@ -504,14 +515,11 @@ function createJobsService(db, { bus, events, registry, artifacts, config }){
       return 0;
     }
 
-    const deleteArtifacts = db.prepare('DELETE FROM artifacts WHERE job_id = ?'),
-      deleteLogs = db.prepare('DELETE FROM job_logs WHERE job_id = ?'),
+    const deleteLogs = db.prepare('DELETE FROM job_logs WHERE job_id = ?'),
       deleteEvents = db.prepare('DELETE FROM events WHERE entity = \'job\' AND entity_id = ?'),
       deleteJob = db.prepare('DELETE FROM jobs WHERE id = ?'),
       tx = db.transaction(() => {
         for (const id of ids){
-          artifacts.deleteJobArtifacts(id);
-          deleteArtifacts.run(id);
           deleteLogs.run(id);
           deleteEvents.run(id);
           deleteJob.run(id);

package/src/services/logs.js

@@ -15,7 +15,7 @@
 
 // §3.1 Log service: accepts batched log lines, assigns a monotonically
 // increasing seq per job, stores them, and fans them out over the bus for
-// SSE subscribers (§6.4). Retention is handled separately (§9).
+// SSE subscribers (§6.4). Lines are deleted with their job (§9).
 function createLogsService(db, { bus }){
   const insert = db.prepare(
       'INSERT INTO job_logs (job_id, seq, ts, stream, line) VALUES (?, ?, ?, ?, ?)'
@@ -47,24 +47,22 @@ function createLogsService(db, { bus }){
       .all(jobId, afterSeq, limit);
   }
 
-  // Used when a job finishes: fold job_logs into a flat console.log artifact.
-  function renderConsoleLog(jobId){
+  // The dashboard log viewer's pages (views/mixins/log-viewer.pug): the
+  // `limit` lines just before `beforeSeq` (the end of the log when omitted),
+  // oldest first, and whether there are earlier ones to scroll up to.
+  function pageBefore(jobId, beforeSeq, limit){
     const rows = db
-      .prepare('SELECT * FROM job_logs WHERE job_id = ? ORDER BY seq ASC')
-      .all(jobId);
-    return rows.map((r) => `[${r.ts}] [${r.stream}] ${r.line}`).join('\n') + (rows.length ? '\n' : '');
+        .prepare('SELECT seq, ts, stream, line FROM job_logs WHERE job_id = ? AND seq < ? ORDER BY seq DESC LIMIT ?')
+        .all(jobId, beforeSeq ?? Number.MAX_SAFE_INTEGER, limit + 1),
+      hasMore = rows.length > limit;
+    return { lines: rows.slice(0, limit).reverse(), hasMore };
   }
 
-  function purgeOlderThan(days){
-    const cutoff = new Date(Date.now() - days * 86400 * 1000).toISOString();
-    db.prepare(
-      `DELETE FROM job_logs WHERE job_id IN (
-         SELECT id FROM jobs WHERE finished_at IS NOT NULL AND finished_at <= ?
-       )`
-    ).run(cutoff);
+  function count(jobId){
+    return db.prepare('SELECT COUNT(*) AS n FROM job_logs WHERE job_id = ?').get(jobId).n;
   }
 
-  return { appendBatch, listSince, renderConsoleLog, purgeOlderThan };
+  return { appendBatch, listSince, pageBefore, count };
 }
 
 module.exports = { createLogsService };