@andrian.yablonskyy/thub-coordinator 1.0.38 → 1.0.40

package/test/job-artifacts.test.js

@@ -0,0 +1,115 @@
+/**
+ * @file        packages/coordinator/test/job-artifacts.test.js
+ * @description Tests: artifacts a job reports (metadata only) — validation, storage with the result, the job page and the Agent API
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { sanitizeArtifacts, normalizeTimestamp, formatBytes, MAX_ARTIFACTS } = require('../src/services/job-artifacts'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+test('formatBytes: B, KB, MB, GB …, 1024-based', () => {
+  assert.equal(formatBytes(0), '0 B');
+  assert.equal(formatBytes(1023), '1023 B');
+  assert.equal(formatBytes(1233), '1.2 KB');
+  assert.equal(formatBytes(15 * 1024), '15 KB');
+  assert.equal(formatBytes(5.5 * 1024 ** 2), '5.5 MB');
+  assert.equal(formatBytes(3 * 1024 ** 3), '3.0 GB');
+  assert.equal(formatBytes(2 * 1024 ** 4), '2.0 TB');
+  assert.equal(formatBytes(-1), '—');
+});
+
+test('timestamps: Unix seconds, Unix milliseconds or ISO dates', () => {
+  assert.equal(normalizeTimestamp(1790000000), '2026-09-21T14:13:20.000Z');
+  assert.equal(normalizeTimestamp(1790000000123), '2026-09-21T14:13:20.123Z');
+  assert.equal(normalizeTimestamp('1790000000'), '2026-09-21T14:13:20.000Z');
+  assert.equal(normalizeTimestamp('2026-09-21T14:13:20Z'), '2026-09-21T14:13:20.000Z');
+  assert.equal(normalizeTimestamp(1234), '1970-01-01T00:20:34.000Z'); // small numbers are seconds
+  assert.equal(normalizeTimestamp('soon'), null);
+  assert.equal(normalizeTimestamp(undefined), null);
+});
+
+test('sanitizeArtifacts keeps valid entries, only http(s) links, and drops the rest', () => {
+  const { artifacts, dropped } = sanitizeArtifacts([
+    { name: 'app.bin', size: 1233, link: 'https://artifactory.example.com/fw/app.bin', timestamp: 1790000000 },
+    { name: ' report.html ', link: 'http://files.lab/r.html' }, // size/timestamp optional
+    { name: 'evil', size: 1, link: 'javascript:alert(1)' },
+    { name: 'data', link: 'data:text/html,<script>x</script>' },
+    { name: '', link: 'https://x.example/a' },
+    { name: 'no-link' },
+    { name: 'neg', size: -5, link: 'https://x.example/n' }, // bad size: kept, size unknown
+    'not an object'
+  ]);
+  assert.equal(dropped, 5);
+  assert.deepEqual(artifacts, [
+    { name: 'app.bin', size: 1233, link: 'https://artifactory.example.com/fw/app.bin', timestamp: '2026-09-21T14:13:20.000Z' },
+    { name: 'report.html', size: null, link: 'http://files.lab/r.html', timestamp: null },
+    { name: 'neg', size: null, link: 'https://x.example/n', timestamp: null }
+  ]);
+  const many = sanitizeArtifacts(Array.from({ length: MAX_ARTIFACTS + 3 }, (_, i) => ({ name: `f${i}`, link: `https://x.example/${i}` })));
+  assert.equal(many.artifacts.length, MAX_ARTIFACTS);
+  assert.equal(many.dropped, 3);
+  assert.deepEqual(sanitizeArtifacts(undefined), { artifacts: [], dropped: 0 });
+});
+
+test('a finished job\'s reported artifacts: stored with the result, on the job page and via the Agent API', async (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-art-')),
+    file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({ dataDir: path.join(dir, 'data'), updates: { checkIntervalMin: 0 }, rateLimit: { loginPerMinute: 0 } }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  await new Promise((r) => server.on('listening', r));
+  const base = `http://127.0.0.1:${server.address().port}`,
+    { resourceId, resourceToken } = services.registry.registerAuto({ clientId: 'c1', name: 'lab-sw-01', type: 'sw', labels: [] }),
+    { agent, token } = services.agents.create({ name: 'ci', kind: 'ci' }),
+    job = services.jobs.create({ agentId: agent.id, source: 'ci', spec: { target: { type: 'sw' }, command: './t.sh' } }),
+    asClient = (url, body) => fetch(`${base}/api/v1${url}`, {
+      method: 'POST', headers: { authorization: `Bearer ${resourceToken}`, 'content-type': 'application/json' }, body: JSON.stringify(body)
+    });
+  services.db.prepare('UPDATE jobs SET resource_id = ?, state = ? WHERE id = ?').run(resourceId, 'RUNNING', job.id);
+
+  const result = await asClient(`/jobs/${job.id}/result`, {
+    state: 'PASSED', exitCode: 0, summary: { total: 1, passed: 1, failed: 0, skipped: 0 },
+    artifacts: [
+      { name: 'app.bin', size: 1233, link: 'https://artifactory.example.com/fw/app.bin', timestamp: 1790000000 },
+      { name: 'x', link: 'javascript:alert(1)' }
+    ]
+  });
+  assert.equal(result.status, 200);
+  assert.deepEqual(services.jobs.get(job.id).artifacts.map((a) => a.name), ['app.bin']);
+
+  // Agent API: in the job, and on its own (with `url` for older Agents).
+  const agentGet = (url) => fetch(`${base}/api/v1${url}`, { headers: { authorization: `Bearer ${token}` } }).then((r) => r.json());
+  assert.equal((await agentGet(`/jobs/${job.id}`)).artifacts[0].link, 'https://artifactory.example.com/fw/app.bin');
+  assert.equal((await agentGet(`/jobs/${job.id}/artifacts`)).artifacts[0].url, 'https://artifactory.example.com/fw/app.bin');
+
+  // The job page.
+  services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+  const cookie = (await fetch(`${base}/login`, {
+      method: 'POST', body: new URLSearchParams({ username: 'admin', password: 'pw' }), redirect: 'manual'
+    })).headers.get('set-cookie').split(';')[0],
+    html = await (await fetch(`${base}/jobs/${job.id}`, { headers: { cookie } })).text();
+  assert.match(html, /<a href="https:\/\/artifactory\.example\.com\/fw\/app\.bin" target="_blank" rel="noopener noreferrer">app\.bin<\/a>/);
+  assert.match(html, />1\.2 KB</);
+  assert.match(html, /21\/09\/2026 14:13:20/); // the admin's time zone (UTC)
+  assert.doesNotMatch(html, /javascript:alert/);
+});

package/test/login-guard.test.js

@@ -0,0 +1,139 @@
+/**
+ * @file        packages/coordinator/test/login-guard.test.js
+ * @description Tests: sign-in protection — backoff per IP and per username, async password checks, no username enumeration by timing
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { createLoginGuard } = require('../src/login-guard'),
+  { openDb } = require('../src/db'),
+  { createAdminUsersService } = require('../src/services/admin-users'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+test('backoff: per IP from the 5th failure, doubling up to 15 min; a success clears it', () => {
+  let t = 0;
+  const guard = createLoginGuard({ now: () => t });
+  for (let i = 0; i < 4; i++){
+    guard.failure('10.0.0.1', `u${i}`); // different names: only the IP counts up
+    assert.equal(guard.check('10.0.0.1', 'any').ok, true);
+  }
+  guard.failure('10.0.0.1', 'u4'); // 5th
+  assert.deepEqual(guard.check('10.0.0.1', 'any'), { ok: false, reason: 'backoff', retryAfterSec: 1 });
+  assert.equal(guard.check('10.0.0.2', 'any').ok, true); // another address isn't affected
+  t += 1000;
+  guard.failure('10.0.0.1', 'u5'); // 6th: 2 s
+  assert.equal(guard.check('10.0.0.1', 'any').retryAfterSec, 2);
+  for (let i = 0; i < 20; i++){
+    guard.failure('10.0.0.1', `v${i}`);
+  }
+  assert.equal(guard.check('10.0.0.1', 'any').retryAfterSec, 15 * 60); // capped
+  guard.success('10.0.0.1', 'admin');
+  assert.equal(guard.check('10.0.0.1', 'any').ok, true);
+});
+
+test('backoff: per username from the 10th failure, from any address, up to 5 min; forgotten after an hour', () => {
+  let t = 0;
+  const guard = createLoginGuard({ now: () => t });
+  for (let i = 0; i < 9; i++){
+    guard.failure(`10.0.1.${i}`, 'Admin'); // one guess per address
+  }
+  assert.equal(guard.check('10.0.9.9', 'admin').ok, true);
+  guard.failure('10.0.1.9', ' ADMIN '); // 10th, any spelling
+  assert.equal(guard.check('10.0.9.9', 'admin').ok, false); // even from a fresh address
+  for (let i = 0; i < 30; i++){
+    guard.failure(`10.0.2.${i}`, 'admin');
+  }
+  assert.equal(guard.check('10.0.9.9', 'admin').retryAfterSec, 5 * 60); // capped, its owner isn't locked out for long
+  t += 61 * 60 * 1000;
+  assert.equal(guard.check('10.0.9.9', 'admin').ok, true);
+});
+
+test('a limit on password checks running at once', async () => {
+  const guard = createLoginGuard({ maxConcurrent: 1 });
+  let release;
+  const running = guard.run(() => new Promise((r) => (release = r)));
+  assert.deepEqual(guard.check('ip', 'u'), { ok: false, reason: 'busy', retryAfterSec: 1 });
+  release();
+  await running;
+  assert.equal(guard.check('ip', 'u').ok, true);
+});
+
+test('password checks don\'t block the event loop, and an unknown user takes as long as a wrong password', async () => {
+  const users = createAdminUsersService(openDb(':memory:'));
+  users.create({ username: 'alice', password: 'correct horse', role: 'admin' });
+
+  // Timers keep firing while four checks run (scryptSync would stall them all).
+  let last = performance.now(),
+    worstGap = 0;
+  const ticker = setInterval(() => {
+    const now = performance.now();
+    worstGap = Math.max(worstGap, now - last);
+    last = now;
+  }, 5);
+  await Promise.all([1, 2, 3, 4].map(() => users.verify('alice', 'wrong')));
+  clearInterval(ticker);
+  assert.ok(worstGap < 60, `event loop stalled for ${worstGap.toFixed(0)} ms`);
+
+  const time = async (name) => {
+      const start = performance.now();
+      for (let i = 0; i < 4; i++){
+        assert.equal(await users.verify(name, 'wrong'), null);
+      }
+      return performance.now() - start;
+    },
+    known = await time('alice'),
+    unknown = await time('nobody');
+  assert.ok(unknown > known * 0.5 && unknown < known * 2, `unknown user ${unknown.toFixed(0)} ms vs wrong password ${known.toFixed(0)} ms`);
+  assert.ok((await users.verify('alice', 'correct horse')).id);
+});
+
+test('sign-in page: a locked-out guesser gets 429 with Retry-After, before any password is checked', async (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-guard-')),
+    file = path.join(dir, 'coordinator.json');
+  // The per-IP sign-in budget off, to see the backoff on its own.
+  fs.writeFileSync(file, JSON.stringify({ dataDir: path.join(dir, 'data'), updates: { checkIntervalMin: 0 }, rateLimit: { loginPerMinute: 0 } }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  await new Promise((r) => server.on('listening', r));
+  services.adminUsers.create({ username: 'admin', password: 'right', role: 'admin' });
+  const base = `http://127.0.0.1:${server.address().port}`,
+    // The test reaches the Coordinator over loopback, which trustProxy
+    // trusts: X-Forwarded-For stands in for different client addresses.
+    login = (ip, username, password) => fetch(`${base}/login`, {
+      method: 'POST', headers: { 'X-Forwarded-For': ip }, body: new URLSearchParams({ username, password }), redirect: 'manual'
+    }),
+    verify = t.mock.method(services.adminUsers, 'verify');
+
+  for (let i = 0; i < 5; i++){
+    assert.equal((await login('203.0.113.7', `guess${i}`, 'x')).status, 401);
+  }
+  const locked = await login('203.0.113.7', 'admin', 'right'); // even the right password waits
+  assert.equal(locked.status, 429);
+  assert.equal(locked.headers.get('retry-after'), '1');
+  assert.match(await locked.text(), /Too many failed sign-ins — try again in 1 s/);
+  assert.equal(verify.mock.callCount(), 5); // the 6th never reached a password check
+
+  assert.equal((await login('198.51.100.1', 'admin', 'right')).status, 302); // the owner, elsewhere, signs in
+  await new Promise((r) => setTimeout(r, 1100));
+  assert.equal((await login('203.0.113.7', 'admin', 'right')).status, 302); // after the wait, and a success clears it
+  assert.equal((await login('203.0.113.7', 'nobody', 'x')).status, 401); // counting starts over
+});

package/test/logs.test.js

@@ -0,0 +1,150 @@
+/**
+ * @file        packages/coordinator/test/logs.test.js
+ * @description Tests: job log paging for the dashboard viewer, the full SSE replay, and the raw log (RAW button)
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+// A Coordinator on a random port, an admin session, and one job with `n`
+// log lines ("line 1".."line n").
+async function setup(t, n){
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-logs-')),
+    file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({
+    dataDir: path.join(dir, 'data'), sessionSecret: 'test-secret-test-secret', updates: { checkIntervalMin: 0 }
+  }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  await new Promise((r) => server.on('listening', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+
+  services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+  const login = await fetch(`${base}/login`, {
+      method: 'POST', body: new URLSearchParams({ username: 'admin', password: 'pw' }), redirect: 'manual'
+    }),
+    cookie = login.headers.get('set-cookie').split(';')[0],
+    { agent } = services.agents.create({ name: 'ci', kind: 'ci' });
+  services.registry.registerAuto({ clientId: 'c1', name: 'lab-sw-01', type: 'sw', labels: [] });
+  const job = services.jobs.create({ agentId: agent.id, source: 'ci', spec: { target: { type: 'sw' }, command: './t.sh' } });
+  for (let i = 0; i < n; i += 500){
+    services.logs.appendBatch(job.id, Array.from({ length: Math.min(500, n - i) }, (_, k) => ({ stream: 'runner', line: `line ${i + k + 1}` })));
+  }
+  const finish = () => services.db.prepare('UPDATE jobs SET state = ?, finished_at = ? WHERE id = ?').run('PASSED', new Date().toISOString(), job.id);
+  return { base, cookie, services, job, finish, get: (p) => fetch(`${base}${p}`, { headers: { cookie } }) };
+}
+
+test('log pages: the end first, then earlier pages until the start', async (t) => {
+  const { get, job } = await setup(t, 2500),
+    last = await (await get(`/jobs/${job.id}/logs?limit=1000`)).json();
+  assert.equal(last.total, 2500);
+  assert.equal(last.hasMore, true);
+  assert.equal(last.lines.length, 1000);
+  assert.equal(last.lines[0].line, 'line 1501');
+  assert.equal(last.lines.at(-1).line, 'line 2500');
+
+  const earlier = await (await get(`/jobs/${job.id}/logs?limit=1000&before=${last.lines[0].seq}`)).json();
+  assert.deepEqual([earlier.lines[0].line, earlier.lines.at(-1).line, earlier.hasMore], ['line 501', 'line 1500', true]);
+
+  const first = await (await get(`/jobs/${job.id}/logs?limit=1000&before=${earlier.lines[0].seq}`)).json();
+  assert.deepEqual([first.lines.length, first.lines[0].line, first.hasMore], [500, 'line 1', false]);
+
+  // Limits are clamped: never more than 5000 a request.
+  assert.equal((await (await get(`/jobs/${job.id}/logs?limit=999999`)).json()).lines.length, 2500);
+});
+
+test('log stream replays every line, not just the first 500', async (t) => {
+  const { get, job, finish } = await setup(t, 1234);
+  finish();
+  const text = await (await get(`/jobs/${job.id}/stream`)).text(),
+    lines = [...text.matchAll(/^event: log$/gm)].length;
+  assert.equal(lines, 1234);
+  assert.match(text, /"line":"line 1234"/);
+  assert.match(text, /event: end/);
+
+  // Resuming after a seq replays only what follows it.
+  const resumed = await (await get(`/jobs/${job.id}/stream?after=1200`)).text();
+  assert.equal([...resumed.matchAll(/^event: log$/gm)].length, 34);
+});
+
+test('RAW: the whole log as plain text, for as long as the job exists', async (t) => {
+  const { get, job, finish, services } = await setup(t, 6001),
+    res = await get(`/jobs/${job.id}/log.txt`),
+    text = await res.text();
+  assert.equal(res.status, 200);
+  assert.match(res.headers.get('content-type'), /^text\/plain; charset=utf-8/);
+  assert.equal(res.headers.get('x-content-type-options'), 'nosniff');
+  assert.match(res.headers.get('content-disposition'), new RegExp(`inline; filename="${job.id}.log"`));
+  const rows = text.trimEnd().split('\n');
+  assert.equal(rows.length, 6001); // more than one 5000-line page
+  assert.match(rows[0], /^\[\d{4}-\d\d-\d\dT[^\]]+\] \[runner\] line 1$/);
+  assert.match(rows.at(-1), /\] \[runner\] line 6001$/);
+
+  // Still complete once the job has finished — no retention of its own
+  // (log lines go with the job), and no artifact to fall back to.
+  finish();
+  assert.equal((await (await get(`/jobs/${job.id}/log.txt`)).text()).trimEnd().split('\n').length, 6001);
+  services.db.prepare('DELETE FROM job_logs WHERE job_id = ?').run(job.id);
+  assert.equal(await (await get(`/jobs/${job.id}/log.txt`)).text(), '');
+
+  assert.equal((await get('/jobs/M-99999/log.txt')).status, 404);
+});
+
+test('artifacts are gone: old Clients\' uploads are discarded, old Agents get none, the store is removed', async (t) => {
+  const { base, services, job } = await setup(t, 3),
+    { resourceId, resourceToken } = services.registry.registerAuto({ clientId: 'c9', name: 'lab-hw-09', type: 'hw', labels: [] }),
+    { token: agentToken } = services.agents.create({ name: 'old-agent', kind: 'ci' });
+  services.db.prepare('UPDATE jobs SET resource_id = ? WHERE id = ?').run(resourceId, job.id);
+
+  // An old Client still uploads its results after the job: accepted (so the
+  // job doesn't end in ERROR), stored nowhere.
+  const form = new FormData();
+  form.append('files', new Blob(['<testsuite tests="1"/>']), 'results.xml');
+  const upload = await fetch(`${base}/api/v1/jobs/${job.id}/artifacts`, {
+    method: 'POST', headers: { authorization: `Bearer ${resourceToken}` }, body: form
+  });
+  assert.equal(upload.status, 201);
+  assert.deepEqual(await upload.json(), { artifacts: [] });
+  assert.equal(fs.existsSync(path.join(path.dirname(services.db.name), 'artifacts')), false);
+
+  // An old Agent's `thub status` still asks: none.
+  const listed = await fetch(`${base}/api/v1/jobs/${job.id}/artifacts`, { headers: { authorization: `Bearer ${agentToken}` } });
+  assert.deepEqual(await listed.json(), { artifacts: [] });
+
+  // No table, no download route.
+  assert.equal(services.db.prepare('SELECT COUNT(*) AS n FROM sqlite_master WHERE name = ?').get('artifacts').n, 0);
+  assert.equal((await fetch(`${base}/artifacts/download/x.y.z`, { redirect: 'manual' })).status, 302); // just the login redirect
+});
+
+test('upgrade: a leftover <dataDir>/artifacts is deleted on startup', (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-legacy-')),
+    file = path.join(dir, 'coordinator.json'),
+    legacy = path.join(dir, 'data', 'artifacts', 'M-00001');
+  fs.mkdirSync(legacy, { recursive: true });
+  fs.writeFileSync(path.join(legacy, 'console.log'), 'old');
+  fs.writeFileSync(file, JSON.stringify({ dataDir: path.join(dir, 'data'), updates: { checkIntervalMin: 0 } }));
+  const log = t.mock.method(console, 'log', () => {});
+  buildServices(loadConfig(file));
+  assert.equal(fs.existsSync(path.join(dir, 'data', 'artifacts')), false);
+  assert.match(log.mock.calls[0].arguments[0], /no longer stores job artifacts/);
+});

package/test/rate-limit.test.js

@@ -0,0 +1,106 @@
+/**
+ * @file        packages/coordinator/test/rate-limit.test.js
+ * @description Tests: request rate limiting — token buckets per credential (IP without one), the sign-in limit, configuration
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { createBuckets } = require('../src/rate-limit'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+test('token bucket: a burst up to the limit, then refills at limit per minute', () => {
+  const b = createBuckets(),
+    t0 = 1_000_000;
+  for (let i = 0; i < 5; i++){
+    assert.equal(b.take('k', 5, t0).ok, true);
+  }
+  const refused = b.take('k', 5, t0);
+  assert.equal(refused.ok, false);
+  assert.equal(refused.retryAfterSec, 12); // one token per 60/5 s
+  assert.equal(b.take('k', 5, t0 + 12_000).ok, true); // refilled one
+  assert.equal(b.take('k', 5, t0 + 12_000).ok, false);
+  assert.equal(b.take('other', 5, t0).ok, true); // its own bucket
+  b.prune(() => 5, t0 + 120_000); // full again = forgotten
+  assert.equal(b.size(), 0);
+});
+
+async function start(t, rateLimit){
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-rl-')),
+    file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({
+    dataDir: path.join(dir, 'data'), sessionSecret: 'test-secret-test-secret', updates: { checkIntervalMin: 0 }, rateLimit
+  }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  await new Promise((r) => server.on('listening', r));
+  return { base: `http://127.0.0.1:${server.address().port}`, services, config };
+}
+
+test('per credential: each token has its own budget, even from one IP; unknown tokens count by IP', async (t) => {
+  const { base, services } = await start(t, { requestsPerMinute: 3, loginPerMinute: 0 }),
+    tokenA = services.agents.create({ name: 'a', kind: 'ci' }).token,
+    tokenB = services.agents.create({ name: 'b', kind: 'ci' }).token,
+    get = (token) => fetch(`${base}/api/v1/resources`, { headers: token ? { authorization: `Bearer ${token}` } : {} });
+
+  for (let i = 0; i < 3; i++){
+    assert.equal((await get(tokenA)).status, 200);
+  }
+  const refused = await get(tokenA);
+  assert.equal(refused.status, 429);
+  assert.equal(refused.headers.get('retry-after'), '20');
+  assert.equal(refused.headers.get('ratelimit-limit'), '3');
+  assert.match((await refused.json()).error, /Too many requests: try again in 20 s/);
+  assert.equal((await get(tokenB)).status, 200); // a Client behind the same NAT isn't affected
+
+  // Random tokens all land in the one IP bucket — no dodging the limit.
+  for (let i = 0; i < 3; i++){
+    assert.equal((await get(`agt_fake${i}`)).status, 401);
+  }
+  assert.equal((await get('agt_fake9')).status, 429);
+});
+
+test('sign-in attempts have their own small limit; 0 turns limits off; a dashboard change applies at once', async (t) => {
+  const { base, services, config } = await start(t, { requestsPerMinute: 500, loginPerMinute: 3 }),
+    login = () => fetch(`${base}/login`, { method: 'POST', body: new URLSearchParams({ username: 'x', password: 'y' }), redirect: 'manual' });
+  for (let i = 0; i < 3; i++){
+    assert.equal((await login()).status, 401);
+  }
+  const refused = await login();
+  assert.equal(refused.status, 429);
+  assert.match(await refused.text(), /Too many sign-in attempts/);
+  assert.equal((await fetch(`${base}/login`)).status, 200); // viewing the page isn't an attempt
+
+  services.settings.save({ changes: { 'rateLimit.loginPerMinute': '0', 'rateLimit.requestsPerMinute': '0' } });
+  assert.equal(config.rateLimit.loginPerMinute, 0);
+  assert.equal((await login()).status, 401); // no longer limited
+  assert.equal((await fetch(`${base}/login`)).headers.get('ratelimit-limit'), null);
+});
+
+test('config: rateLimit values must be whole numbers, 0 or more', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-rl-')),
+    file = path.join(dir, 'coordinator.json'),
+    write = (rateLimit) => fs.writeFileSync(file, JSON.stringify({ dataDir: path.join(dir, 'data'), rateLimit }));
+  write(undefined);
+  assert.deepEqual(loadConfig(file).rateLimit, { requestsPerMinute: 500, loginPerMinute: 10 });
+  write({ requestsPerMinute: -1 });
+  assert.throws(() => loadConfig(file), /rateLimit\.requestsPerMinute must be a whole number/);
+});

package/test/scheduler.test.js

@@ -25,8 +25,8 @@ const test = require('node:test'),
   { createRegistryService } = require('../src/services/registry'),
   { createAgentsService } = require('../src/services/agents'),
   { createGroupsService } = require('../src/services/groups'),
-  { createArtifactsService } = require('../src/services/artifacts'),
   { createJobsService } = require('../src/services/jobs'),
+  { createLogsService } = require('../src/services/logs'),
   { createScheduler } = require('../src/services/scheduler'),
   { createHeartbeatMonitor } = require('../src/services/heartbeat'),
   { JOB_STATES, RESOURCE_STATES } = require('@andrian.yablonskyy/thub-common');
@@ -42,22 +42,19 @@ function buildTestServices(overrides = {}){
     registry = createRegistryService(db, { bus, events }),
     agents = createAgentsService(db, { events }),
     groups = createGroupsService(db, { events, registry }),
-    artifactsDir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-test-artifacts-')),
     config = {
       scheduler: { assignAckTimeoutSec: 15, requeueOnLost: true, maxQueuedPerAgent: 20, tickIntervalSec: 3600 },
       jobs: { defaultTimeoutSec: 1800, maxTimeoutSec: 14400 },
       heartbeat: { intervalSec: 10, missedLimit: 3, sweepIntervalSec: 3600 },
-      artifactsDir,
       sessionSecret: 'test-secret',
       publicUrl: 'http://localhost:8080',
-      artifacts: { linkTtlHours: 1 },
       ...overrides
     },
-    artifacts = createArtifactsService(db, { config }),
-    jobs = createJobsService(db, { bus, events, registry, artifacts, config }),
+    logs = createLogsService(db, { bus }),
+    jobs = createJobsService(db, { bus, events, registry, config }),
     scheduler = createScheduler(db, { bus, events, registry, config }),
     heartbeatMonitor = createHeartbeatMonitor(db, { bus, events, registry, jobs, config });
-  return { db, bus, registry, agents, groups, artifacts, jobs, scheduler, heartbeatMonitor, artifactsDir };
+  return { db, bus, registry, agents, groups, logs, jobs, scheduler, heartbeatMonitor };
 }
 
 function registerResource(registry, { name, type, labels = [], groups = [], clientId } = {}){
@@ -206,15 +203,16 @@ test('admin resetQueue cancels every active job and leaves finished ones alone',
   assert.equal(jobs.get(finished.id).state, JOB_STATES.PASSED); // untouched
 });
 
-test('admin cleanHistory deletes finished jobs, their artifacts on disk, and leaves active jobs alone', () => {
-  const { registry, agents, artifacts, jobs, artifactsDir } = buildTestServices(),
+test('admin cleanHistory deletes finished jobs with their log lines, and leaves active jobs alone', () => {
+  const { db, registry, agents, logs, jobs } = buildTestServices(),
     { agent } = agents.create({ name: 'ci', kind: 'ci' });
   registerResource(registry, { name: 'lab-sw-01', type: 'sw', labels: [] });
 
   const finished = jobs.create({ agentId: agent.id, source: 'cli', spec: makeSpec() });
   jobs.setState(finished.id, JOB_STATES.PASSED);
-  artifacts.storeGenerated(finished.id, 'console.log', Buffer.from('hello'), 'text/plain');
-  assert.ok(fs.existsSync(path.join(artifactsDir, finished.id)));
+  logs.appendBatch(finished.id, [{ stream: 'runner', line: 'hello' }]);
+  const logLines = (id) => db.prepare('SELECT COUNT(*) AS n FROM job_logs WHERE job_id = ?').get(id).n;
+  assert.equal(logLines(finished.id), 1);
 
   const active = jobs.create({ agentId: agent.id, source: 'cli', spec: makeSpec() }),
 
@@ -222,7 +220,7 @@ test('admin cleanHistory deletes finished jobs, their artifacts on disk, and lea
 
   assert.equal(deleted, 1);
   assert.equal(jobs.get(finished.id), undefined);
-  assert.equal(fs.existsSync(path.join(artifactsDir, finished.id)), false);
+  assert.equal(logLines(finished.id), 0);
   assert.ok(jobs.get(active.id)); // active job untouched
 });