@andrian.yablonskyy/thub-coordinator 1.0.38 → 1.0.40

package/src/web/routes.js

@@ -16,6 +16,7 @@
 const fs = require('node:fs'),
   os = require('node:os'),
   path = require('node:path'),
+  { once } = require('node:events'),
   express = require('express'),
   multer = require('multer'),
   { requireAdminSession, requireAdminRole } = require('../auth'),
@@ -26,11 +27,19 @@ const fs = require('node:fs'),
   } = require('@andrian.yablonskyy/thub-common'),
   { retentionCutoff, JOB_RETENTION } = require('../services/cleanup'),
   listPrefs = require('../services/list-prefs'),
-  search = require('../services/search');
-
-// Resources page sort keys (list-prefs.js) -> comparators. Empty values
-// (never heartbeated, no version reported) sort last in both directions.
-const RESOURCE_SORT_VALUE = {
+  search = require('../services/search'),
+  { createLoginGuard } = require('../login-guard'),
+  { formatBytes } = require('../services/job-artifacts');
+
+// When this process started: the settings page tells a restart happened by it changing.
+const STARTED_AT = new Date().toISOString(),
+  // Job log viewer: lines per page it loads (and the most one request may ask for).
+  LOG_PAGE = 1000,
+  LOG_PAGE_MAX = 5000,
+
+  // Resources page sort keys (list-prefs.js) -> comparators. Empty values
+  // (never heartbeated, no version reported) sort last in both directions.
+  RESOURCE_SORT_VALUE = {
     name: (r) => r.name,
     type: (r) => r.type,
     version: (r) => r.client_version,
@@ -65,7 +74,8 @@ const RESOURCE_SORT_VALUE = {
 // views hitting the same kind of SSE stream the Agent uses (§6.4), just
 // authenticated by session cookie instead of a bearer token.
 function createWebRouter({ services, config }){
-  const router = express.Router();
+  const router = express.Router(),
+    loginGuard = createLoginGuard();
 
   // Shown as a toast (layout.pug): `danger` stays until closed, `warning`
   // closes after 30 s, `info`/`success` after 10 s — unless `sticky`.
@@ -165,6 +175,8 @@ function createWebRouter({ services, config }){
     res.locals.isNewer = isNewer;
     res.locals.nextCronRun = nextCronRun;
     res.locals.formatDateTime = formatDateTime;
+    // 1233 -> "1.2 KB" (job artifacts).
+    res.locals.fmtBytes = formatBytes;
     res.locals.currentPath = req.originalUrl;
     // A live-update re-fetch (server.js, req.thubPassive) renders the page
     // only for its data: flash messages stay for the next real page view.
@@ -203,19 +215,59 @@ function createWebRouter({ services, config }){
     next();
   });
 
+  // A Secure-only session cookie (server.js cookieSecure, §12) is never
+  // sent back over plain HTTP, so signing in would just loop back here.
+  // Say why instead — usually a proxy not passing X-Forwarded-Proto.
+  function httpsProblem(req){
+    if (req.session.cookie.secure !== true || req.secure){
+      return null;
+    }
+    return {
+      type: 'danger',
+      sticky: true,
+      text: `Signing in needs HTTPS: this Coordinator's session cookie is sent only over HTTPS (publicUrl is ${config.publicUrl}), ` +
+        'but this request reached it as plain HTTP. Open the dashboard through that https:// address; behind a reverse proxy, ' +
+        'make it send "X-Forwarded-Proto: https" and check trustProxy. To allow plain HTTP, set session.secureCookie to false.'
+    };
+  }
+
   router.get('/login', (req, res) => {
     if (req.session.user){
       return res.redirect('/');
     }
-    res.render('login', { title: 'Sign in' });
+    const problem = httpsProblem(req);
+    res.render('login', { title: 'Sign in', ...(problem ? { messages: [problem] } : {}) });
   });
 
-  router.post('/login', (req, res) => {
+  // Backoff after failed attempts, per IP and per username, checked before
+  // any hashing; a cap on password checks running at once (login-guard.js).
+  // The answer to a wrong password and to an unknown user is the same, and
+  // takes as long (admin-users.js).
+  function throttled(res, { reason, retryAfterSec }, what){
+    res.set('Retry-After', String(retryAfterSec));
+    const text = reason === 'busy'
+      ? 'The Coordinator is busy checking other sign-ins — try again in a moment.'
+      : `Too many failed ${what} — try again in ${retryAfterSec} s.`;
+    return { status: reason === 'busy' ? 503 : 429, text };
+  }
+
+  router.post('/login', async (req, res) => {
+    const problem = httpsProblem(req);
+    if (problem){
+      return res.status(400).render('login', { title: 'Sign in', messages: [problem] });
+    }
     const { username, password } = req.body,
-      user = services.adminUsers.verify(username, password);
+      allowed = loginGuard.check(req.ip, username);
+    if (!allowed.ok){
+      const { status, text } = throttled(res, allowed, 'sign-ins');
+      return res.status(status).render('login', { title: 'Sign in', messages: [{ type: 'danger', text }] });
+    }
+    const user = await loginGuard.run(() => services.adminUsers.verify(username, password));
     if (!user){
+      loginGuard.failure(req.ip, username);
       return res.status(401).render('login', { title: 'Sign in', messages: [{ type: 'danger', text: 'Invalid credentials' }] });
     }
+    loginGuard.success(req.ip, username);
     req.session.user = user;
     req.session.cookie.maxAge = user.sessionTimeoutMin * 60 * 1000;
     res.redirect('/');
@@ -307,17 +359,29 @@ function createWebRouter({ services, config }){
   // profile form since it needs the *current* password re-entered, and a
   // mismatch between newPassword/confirmPassword is a form-level check
   // that has nothing to do with the other fields.
-  router.post('/profile/password', (req, res) => {
-    const { currentPassword, newPassword, confirmPassword } = req.body;
+  // The current password is checked like a sign-in: the same backoff, so a
+  // stolen session can't be used to guess it.
+  router.post('/profile/password', async (req, res) => {
+    const { currentPassword, newPassword, confirmPassword } = req.body,
+      { username } = req.session.user;
     if (newPassword !== confirmPassword){
       flash(req, 'danger', 'New password and confirmation do not match.');
       return res.redirect('/profile');
     }
+    const allowed = loginGuard.check(req.ip, username);
+    if (!allowed.ok){
+      flash(req, 'danger', throttled(res, allowed, 'password checks').text);
+      return res.redirect('/profile');
+    }
     try {
-      services.adminUsers.changePassword(req.session.user.id, currentPassword, newPassword);
+      await loginGuard.run(() => services.adminUsers.changePassword(req.session.user.id, currentPassword, newPassword));
+      loginGuard.success(req.ip, username);
       flash(req, 'success', 'Password changed.');
     }
     catch (err){
+      if (err.status === 401){
+        loginGuard.failure(req.ip, username);
+      }
       flash(req, 'danger', err.message);
     }
     res.redirect('/profile');
@@ -563,6 +627,24 @@ function createWebRouter({ services, config }){
     res.redirect(returnTo(req, '/resources'));
   });
 
+  // Groups tab (resource card): the Client's group membership, as a config
+  // revision the Client writes to its file (registry.setClientGroups).
+  router.post('/resources/:id/groups', requireAdminRole, (req, res) => {
+    try {
+      const ids = [].concat(req.body.groups || []).filter((g) => typeof g === 'string' && g),
+        r = services.registry.setClientGroups(req.params.id, ids, {
+          by: req.session.user.username,
+          knownGroupIds: services.groups.list().map((g) => g.id)
+        });
+      flash(req, 'success', `Groups of ${r.name} saved: ${r.group_ids.length ? `${r.group_ids.length} group(s)` : 'none'} — in effect now.\n` +
+        'The Client writes them to its config file on its next heartbeat, then restarts once it has no job running.');
+    }
+    catch (err){
+      flash(req, 'danger', err.message);
+    }
+    res.redirect(returnTo(req, '/resources'));
+  });
+
   // Export (resource card, admins — the file holds the join key): the
   // Client's config file as JSON, secrets excluded.
   router.get('/resources/:id/config/export', requireAdminRole, (req, res) => {
@@ -786,7 +868,7 @@ function createWebRouter({ services, config }){
   });
 
   // "Clean up database" (§9): everything before the given time — finished
-  // jobs with their logs/artifacts, and older history — then VACUUM. The
+  // jobs with their logs, and older history — then VACUUM. The
   // time is dd/mm/yyyy HH:MM:SS in the user's own time zone.
   router.post('/jobs/clean-history', requireAdminRole, (req, res) => {
     const tz = req.session.user.timezone || 'UTC',
@@ -818,8 +900,7 @@ function createWebRouter({ services, config }){
       return res.status(404).send('Not found');
     }
     job.resource = job.resource_id ? services.registry.get(job.resource_id) : null;
-    const artifacts = services.artifacts.listForJob(job.id).map((a) => ({ ...a, url: services.artifacts.signedUrl(a) })),
-      jobActive = ACTIVE_JOB_STATES.has(job.state);
+    const jobActive = ACTIVE_JOB_STATES.has(job.state);
     res.render('jobs/show', {
       title: job.id,
       active: 'jobs',
@@ -829,7 +910,6 @@ function createWebRouter({ services, config }){
         ? services.registry.waitingReason(job.spec.target.type, job.spec.target.labels || [], job.spec.target.group,
           job.spec.target.client)
         : null,
-      artifacts,
       jobActive,
       canCancel: req.session.user.role === 'admin' && jobActive
     });
@@ -847,15 +927,53 @@ function createWebRouter({ services, config }){
     res.redirect(returnTo(req, `/jobs/${req.params.id}`));
   });
 
-  // Plain, one-shot fetch — used by the log viewer for a job that's
-  // already finished, so it doesn't open a live connection (§SSE) for
-  // output that will never change again.
+  // The log viewer's pages (public/js/log-viewer.js): the last `limit`
+  // lines first, then earlier ones (`before` = the oldest seq it has) as the
+  // reader scrolls up. `total` is how many lines the job has in all.
   router.get('/jobs/:id/logs', (req, res) => {
-    res.json({ lines: services.logs.listSince(req.params.id, 0) });
+    const before = Number.parseInt(req.query.before, 10),
+      limit = Math.min(Math.max(Number.parseInt(req.query.limit, 10) || LOG_PAGE, 1), LOG_PAGE_MAX),
+      page = services.logs.pageBefore(req.params.id, before > 0 ? before : undefined, limit);
+    res.json({ ...page, total: services.logs.count(req.params.id) });
+  });
+
+  // RAW (log viewer): the whole log as plain text, for a new tab, a
+  // download or grep. Streamed in pages, waiting for the socket to drain,
+  // so a huge log never sits in memory. Log lines live as long as their job
+  // (§9), so this is always the complete log.
+  router.get('/jobs/:id/log.txt', async (req, res, next) => {
+    try {
+      const job = services.jobs.get(req.params.id);
+      if (!job){
+        return res.status(404).type('text/plain').send('Unknown job');
+      }
+      res.set({
+        'Content-Type': 'text/plain; charset=utf-8',
+        // The log is whatever the job printed: never let a browser sniff it
+        // into HTML.
+        'X-Content-Type-Options': 'nosniff',
+        'Content-Disposition': `inline; filename="${job.id}.log"`,
+        'Cache-Control': 'no-store'
+      });
+      for (let seq = 0, page; (page = services.logs.listSince(job.id, seq, LOG_PAGE_MAX)).length;){
+        const chunk = page.map((l) => `[${l.ts}] [${l.stream}] ${l.line}\n`).join('');
+        seq = page.at(-1).seq;
+        if (!res.write(chunk)){
+          await once(res, 'drain');
+        }
+        if (res.destroyed){
+          return;
+        }
+      }
+      res.end();
+    }
+    catch (err){
+      next(err);
+    }
   });
 
   router.get('/jobs/:id/stream', (req, res) => {
-    attachJobStream(req, res, { jobId: req.params.id, services, config });
+    attachJobStream(req, res, { jobId: req.params.id, services });
   });
 
   // Resource groups (§13.1) — their own page since they're a distinct
@@ -927,6 +1045,97 @@ function createWebRouter({ services, config }){
     });
   }
 
+  // Coordinator settings (services/settings.js, README §13.2): stored in
+  // the database over the config file. "Restart now" only under systemd,
+  // whose Restart=always brings the process back (INVOCATION_ID is set for
+  // every unit it starts); run by hand, exiting would just stop it.
+  const canRestart = Boolean(process.env.INVOCATION_ID);
+
+  router.get('/admin/settings', requireAdminRole, (req, res) => {
+    const items = services.settings.list(),
+      groups = [...new Set(items.map((s) => s.group))].map((name) => ({ name, items: items.filter((s) => s.group === name) }));
+    res.render('admin/settings', {
+      title: 'Settings',
+      active: 'settings',
+      groups,
+      pendingRestart: items.filter((s) => s.pendingRestart),
+      canRestart,
+      startedAt: STARTED_AT,
+      restarting: req.query.restarting || null,
+      readOnly: {
+        listen: config.listen,
+        dataDir: config.dataDir,
+        configPath: config.configPath || '(built-in defaults)'
+      }
+    });
+  });
+
+  router.post('/admin/settings', requireAdminRole, (req, res) => {
+    const posted = req.body.s || {},
+      changes = {},
+      reset = [].concat(req.body.reset || []);
+    for (const s of services.settings.SETTINGS){
+      if (s.type === 'secret'){
+        // Empty means "unchanged": the current secret is never put in the page.
+        if (req.body.clear?.[s.key] === '1'){
+          changes[s.key] = '';
+        }
+        else if (posted[s.key]){
+          changes[s.key] = posted[s.key];
+        }
+      }
+      else if (s.key in posted){
+        // A checkbox posts a hidden "false" and, when checked, "true" after it.
+        changes[s.key] = [].concat(posted[s.key]).at(-1);
+      }
+    }
+    try {
+      const result = services.settings.save({ changes, reset }, {
+        by: req.session.user.username,
+        // Don't let an admin lock everyone out: an HTTPS-only cookie
+        // can't come back over the plain-HTTP connection they're using.
+        guard: (after) => {
+          const secureCookie = after['session.secureCookie'],
+            httpsOnly = secureCookie === true || (secureCookie === 'auto' && /^https:\/\//i.test(after.publicUrl || ''));
+          return httpsOnly && !req.secure
+            ? 'Secure session cookie: you\'re connected over plain HTTP, so with this setting nobody could sign in this way ' +
+              'after the restart. Open the dashboard over https:// first (behind a proxy: it must send X-Forwarded-Proto: https), ' +
+              'or set it to false.'
+            : null;
+        }
+      });
+      if (!result.changed.length){
+        flash(req, 'info', 'Nothing changed.');
+      }
+      else {
+        const label = (k) => services.settings.SETTINGS.find((s) => s.key === k).label;
+        flash(req, result.restart.length ? 'warning' : 'success', [
+          result.now.length ? `Saved and applied: ${result.now.map(label).join(', ')}.` : '',
+          result.restart.length ? `Saved, applies after a restart: ${result.restart.map(label).join(', ')}.` : ''
+        ].filter(Boolean).join('\n'));
+      }
+    }
+    catch (err){
+      flash(req, 'danger', err.message);
+    }
+    res.redirect('/admin/settings');
+  });
+
+  router.post('/admin/settings/restart', requireAdminRole, (req, res) => {
+    if (!canRestart){
+      flash(req, 'danger', 'This Coordinator isn\'t running under systemd, so it can\'t restart itself — restart it by hand.');
+      return res.redirect('/admin/settings');
+    }
+    res.redirect(`/admin/settings?restarting=${encodeURIComponent(STARTED_AT)}`);
+    // After the redirect is out; systemd (Restart=always) starts it again.
+    res.on('finish', () => setTimeout(() => process.kill(process.pid, 'SIGTERM'), 500));
+  });
+
+  // Polled by the settings page while restarting (public/js/settings.js).
+  router.get('/admin/settings/status', requireAdminRole, (req, res) => {
+    res.set('Cache-Control', 'no-store').json({ startedAt: STARTED_AT });
+  });
+
   router.get('/admin/agents', requireAdminRole, (req, res) => renderAgents(req, res));
 
   router.post('/admin/agents', requireAdminRole, (req, res) => {

package/test/admin-users.test.js

@@ -23,11 +23,11 @@ function buildService(){
   return createAdminUsersService(db);
 }
 
-test('a newly created user gets profile defaults (UTC, auto theme, 60min timeout)', () => {
+test('a newly created user gets profile defaults (UTC, auto theme, 60min timeout)', async () => {
   const adminUsers = buildService();
   adminUsers.create({ username: 'alice', password: 'hunter2', role: 'admin' });
 
-  const user = adminUsers.verify('alice', 'hunter2');
+  const user = await adminUsers.verify('alice', 'hunter2');
   assert.equal(user.timezone, 'UTC');
   assert.equal(user.theme, 'auto');
   assert.equal(user.sessionTimeoutMin, 60);
@@ -80,48 +80,48 @@ test('a session timeout outside the offered presets is rejected (400)', () => {
   assert.throws(() => adminUsers.updateProfile(id, { sessionTimeoutMin: 7 }), (err) => err.status === 400);
 });
 
-test('resetPassword creates the user as admin when the username does not exist yet', () => {
+test('resetPassword creates the user as admin when the username does not exist yet', async () => {
   const adminUsers = buildService();
 
   adminUsers.resetPassword({ username: 'admin', password: 'newpass' });
-  const user = adminUsers.verify('admin', 'newpass');
+  const user = await adminUsers.verify('admin', 'newpass');
   assert.ok(user);
   assert.equal(user.role, 'admin');
 });
 
-test('resetPassword on an existing user changes only the password, not the role', () => {
+test('resetPassword on an existing user changes only the password, not the role', async () => {
   const adminUsers = buildService();
   adminUsers.create({ username: 'carol', password: 'oldpass', role: 'viewer' });
 
   adminUsers.resetPassword({ username: 'carol', password: 'newpass' });
 
-  assert.equal(adminUsers.verify('carol', 'oldpass'), null);
-  const user = adminUsers.verify('carol', 'newpass');
+  assert.equal(await adminUsers.verify('carol', 'oldpass'), null);
+  const user = await adminUsers.verify('carol', 'newpass');
   assert.ok(user);
   assert.equal(user.role, 'viewer'); // not silently promoted to admin
 });
 
-test('changePassword succeeds with the correct current password', () => {
+test('changePassword succeeds with the correct current password', async () => {
   const adminUsers = buildService(),
     { id } = adminUsers.create({ username: 'dave', password: 'oldpass', role: 'admin' });
 
-  adminUsers.changePassword(id, 'oldpass', 'newpass');
+  await adminUsers.changePassword(id, 'oldpass', 'newpass');
 
-  assert.equal(adminUsers.verify('dave', 'oldpass'), null);
-  assert.ok(adminUsers.verify('dave', 'newpass'));
+  assert.equal(await adminUsers.verify('dave', 'oldpass'), null);
+  assert.ok(await adminUsers.verify('dave', 'newpass'));
 });
 
-test('changePassword is rejected (401) with the wrong current password, leaving it unchanged', () => {
+test('changePassword is rejected (401) with the wrong current password, leaving it unchanged', async () => {
   const adminUsers = buildService(),
     { id } = adminUsers.create({ username: 'dave', password: 'oldpass', role: 'admin' });
 
-  assert.throws(() => adminUsers.changePassword(id, 'wrongpass', 'newpass'), (err) => err.status === 401);
-  assert.ok(adminUsers.verify('dave', 'oldpass'));
+  await assert.rejects(adminUsers.changePassword(id, 'wrongpass', 'newpass'), (err) => err.status === 401);
+  assert.ok(await adminUsers.verify('dave', 'oldpass'));
 });
 
-test('changePassword rejects an empty new password (400)', () => {
+test('changePassword rejects an empty new password (400)', async () => {
   const adminUsers = buildService(),
     { id } = adminUsers.create({ username: 'dave', password: 'oldpass', role: 'admin' });
 
-  assert.throws(() => adminUsers.changePassword(id, 'oldpass', ''), (err) => err.status === 400);
+  await assert.rejects(adminUsers.changePassword(id, 'oldpass', ''), (err) => err.status === 400);
 });

package/test/agent-visibility.test.js

@@ -0,0 +1,85 @@
+/**
+ * @file        packages/coordinator/test/agent-visibility.test.js
+ * @description Tests: which jobs an agent token may see — a cli token only its own, a ci token all
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+test('a cli agent sees only its own jobs (others look like unknown ids); a ci agent sees all', async (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-vis-')),
+    file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({ dataDir: path.join(dir, 'data'), updates: { checkIntervalMin: 0 } }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  await new Promise((r) => server.on('listening', r));
+  services.registry.registerAuto({ clientId: 'c1', name: 'lab-sw-01', type: 'sw', labels: [] });
+
+  const base = `http://127.0.0.1:${server.address().port}/api/v1`,
+    alice = services.agents.create({ name: 'alice', kind: 'cli' }).token,
+    bob = services.agents.create({ name: 'bob', kind: 'cli' }).token,
+    ci = services.agents.create({ name: 'pipeline', kind: 'ci' }).token,
+    call = async (token, method, url, body) => {
+      const res = await fetch(`${base}${url}`, {
+        method,
+        headers: { authorization: `Bearer ${token}`, ...(body ? { 'content-type': 'application/json' } : {}) },
+        body: body ? JSON.stringify(body) : undefined
+      });
+      return { status: res.status, body: res.headers.get('content-type')?.includes('json') ? await res.json() : await res.text() };
+    },
+    submit = async (token) => (await call(token, 'POST', '/jobs', { target: { type: 'sw' }, command: './t.sh' })).body.jobId,
+    aliceJob = await submit(alice),
+    bobJob = await submit(bob),
+    ciJob = await submit(ci);
+
+  // Alice: her own job, every way of reading it.
+  assert.equal((await call(alice, 'GET', `/jobs/${aliceJob}`)).status, 200);
+  assert.equal((await call(alice, 'GET', `/jobs/${aliceJob}/logs`)).status, 200);
+  assert.equal((await call(alice, 'GET', `/jobs/${aliceJob}/artifacts`)).status, 200);
+
+  // Anyone else's job (a colleague's, a pipeline's): exactly like an id that doesn't exist.
+  const unknown = await call(alice, 'GET', '/jobs/M-99999');
+  for (const id of [bobJob, ciJob]){
+    for (const url of [`/jobs/${id}`, `/jobs/${id}/logs`, `/jobs/${id}/logs/stream`, `/jobs/${id}/artifacts`]){
+      const r = await call(alice, 'GET', url);
+      assert.equal(r.status, 404, url);
+      assert.deepEqual(r.body, unknown.body, url);
+    }
+    assert.equal((await call(alice, 'POST', `/jobs/${id}/cancel`)).status, 404);
+  }
+  assert.equal(services.jobs.get(bobJob).state, 'QUEUED'); // untouched
+
+  // Her list is her own jobs, --mine or not.
+  const ids = async (token, q = '') => (await call(token, 'GET', `/jobs${q}`)).body.jobs.map((j) => j.id).sort();
+  assert.deepEqual(await ids(alice), [aliceJob]);
+  assert.deepEqual(await ids(alice, '?mine=true'), [aliceJob]);
+
+  // A ci agent reads every job (and lists them all, or its own with --mine)…
+  assert.equal((await call(ci, 'GET', `/jobs/${aliceJob}`)).status, 200);
+  assert.equal((await call(ci, 'GET', `/jobs/${bobJob}/logs`)).status, 200);
+  assert.deepEqual(await ids(ci), [aliceJob, bobJob, ciJob].sort());
+  assert.deepEqual(await ids(ci, '?mine=1'), [ciJob]);
+  // …but still cancels only its own.
+  assert.equal((await call(ci, 'POST', `/jobs/${aliceJob}/cancel`)).status, 403);
+  assert.equal((await call(alice, 'POST', `/jobs/${aliceJob}/cancel`)).status, 200);
+});

package/test/cleanup.test.js

@@ -23,7 +23,6 @@ const test = require('node:test'),
   { createEventsService } = require('../src/services/events'),
   { createRegistryService } = require('../src/services/registry'),
   { createAgentsService } = require('../src/services/agents'),
-  { createArtifactsService } = require('../src/services/artifacts'),
   { createJobsService } = require('../src/services/jobs'),
   { createCleanupService, retentionCutoff } = require('../src/services/cleanup'),
   { JOB_STATES } = require('@andrian.yablonskyy/thub-common');
@@ -35,8 +34,6 @@ function setup(jobRetention = 'forever'){
     config = {
       dataDir,
       dbPath: path.join(dataDir, 'thub.db'),
-      artifactsDir: path.join(dataDir, 'artifacts'),
-      artifacts: { linkTtlHours: 1 },
       sessionSecret: 's',
       publicUrl: 'http://x',
       scheduler: { maxQueuedPerAgent: 1000 },
@@ -48,8 +45,7 @@ function setup(jobRetention = 'forever'){
     events = createEventsService(db),
     registry = createRegistryService(db, { bus, events }),
     { agent } = createAgentsService(db, { events }).create({ name: 'ci', kind: 'ci' }),
-    artifacts = createArtifactsService(db, { config }),
-    jobs = createJobsService(db, { bus, events, registry, artifacts, config }),
+    jobs = createJobsService(db, { bus, events, registry, config }),
     cleanup = createCleanupService(db, { jobs, config, now: () => NOW });
   registry.registerAuto({ clientId: 'c', name: 'lab', type: 'sw', labels: [] });
 

package/test/groups-tab.test.js

@@ -0,0 +1,97 @@
+/**
+ * @file        packages/coordinator/test/groups-tab.test.js
+ * @description Tests: a Client's group membership set from the resource card's Groups tab
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+async function start(t){
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-grp-')),
+    file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({ dataDir: path.join(dir, 'data'), updates: { checkIntervalMin: 0 }, rateLimit: { loginPerMinute: 0 } }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  await new Promise((r) => server.on('listening', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+  services.adminUsers.create({ username: 'view', password: 'pw', role: 'viewer' });
+  const login = async (u) => (await fetch(`${base}/login`, {
+    method: 'POST', body: new URLSearchParams({ username: u, password: 'pw' }), redirect: 'manual'
+  })).headers.get('set-cookie').split(';')[0];
+  return { base, services, admin: await login('admin'), viewer: await login('view') };
+}
+
+// A Client recent enough to report its config file (what Import needs too).
+const register = (services, name, { configFile = { name, type: 'sw' } } = {}) => services.registry.registerAuto({
+  clientId: `id-${name}`, name, type: 'sw', labels: [], config: {}, ...(configFile ? { configFile } : {})
+}).resourceId;
+
+test('Groups tab: in effect at once, sent to the Client as its next config revision', async (t) => {
+  const { base, services, admin, viewer } = await start(t),
+    nightly = services.groups.create({ name: 'nightly' }),
+    pr = services.groups.create({ name: 'pr-pool', comment: 'pull requests' }),
+    id = register(services, 'lab-sw-01'),
+    save = (cookie, groups) => fetch(`${base}/resources/${id}/groups`, {
+      method: 'POST', headers: { cookie }, body: new URLSearchParams([...groups.map((g) => ['groups', g]), ['returnTo', '/resources']]), redirect: 'manual'
+    }),
+    page = async () => (await fetch(`${base}/resources`, { headers: { cookie: admin } })).text();
+
+  assert.equal((await save(viewer, [nightly.id])).status, 403);
+  assert.equal((await save(admin, [nightly.id, pr.id])).status, 302);
+  const r = services.registry.get(id);
+  assert.deepEqual(r.group_ids.sort(), [nightly.id, pr.id].sort()); // scheduling follows now
+  const pending = services.registry.pendingConfig(id);
+  assert.equal(pending.revision, 1);
+  assert.deepEqual(pending.file.groups.sort(), [nightly.id, pr.id].sort()); // the Client writes it to its file
+  assert.match(await page(), /Groups of lab-sw-01 saved: 2 group\(s\) — in effect now/);
+
+  // The tab, with every group as a checkbox; no Groups line on Details any more.
+  const html = await page();
+  assert.match(html, new RegExp(`name="groups" value="${pr.id}" checked`));
+  assert.match(html, /data-config-tab="groups"/);
+  assert.match(html, /not written to the Client yet/);
+  assert.doesNotMatch(html, /<dt class="col-sm-4">Groups<\/dt>/);
+
+  // None at all: allowed.
+  await save(admin, []);
+  assert.deepEqual(services.registry.get(id).group_ids, []);
+});
+
+test('Groups tab: keeps other pending changes; refuses unknown groups and Clients too old for it', async (t) => {
+  const { services } = await start(t),
+    g = services.groups.create({ name: 'g' }),
+    id = register(services, 'lab-sw-02');
+
+  // An Import not applied yet: its fields go along with the groups.
+  services.registry.importClientConfig(id, { labels: ['board:x'] }, { by: 'admin' });
+  services.registry.setClientGroups(id, [g.id], { by: 'admin', knownGroupIds: [g.id] });
+  assert.deepEqual(services.registry.pendingConfig(id).file, { labels: ['board:x'], groups: [g.id] });
+  // A device save meanwhile doesn't drop them either.
+  services.registry.setClientConfig(id, {}, { by: 'admin' });
+  assert.deepEqual(services.registry.pendingConfig(id).file.groups, [g.id]);
+
+  assert.throws(() => services.registry.setClientGroups(id, ['no-such-group'], { knownGroupIds: [g.id] }), /Unknown group/);
+  const old = register(services, 'lab-old', { configFile: null });
+  assert.throws(() => services.registry.setClientGroups(old, [g.id], { knownGroupIds: [g.id] }), /too old to take its groups/);
+});