@andrian.yablonskyy/thub-coordinator 1.0.38 → 1.0.40

package/test/security.test.js

@@ -0,0 +1,107 @@
+/**
+ * @file        packages/coordinator/test/security.test.js
+ * @description Tests: security headers on every response, and the same-origin (CSRF) check on the dashboard's POSTs
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+async function start(t, extra = {}){
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-sec-')),
+    file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({
+    dataDir: path.join(dir, 'data'), sessionSecret: 'test-secret-test-secret', updates: { checkIntervalMin: 0 }, ...extra
+  }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  await new Promise((r) => server.on('listening', r));
+  services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+  return { base: `http://127.0.0.1:${server.address().port}`, services };
+}
+
+test('security headers on pages, the API and static files; HSTS only over HTTPS', async (t) => {
+  const { base } = await start(t);
+  for (const url of ['/login', '/api/v1/resources', '/css/thub.css']){
+    const res = await fetch(`${base}${url}`),
+      csp = res.headers.get('content-security-policy');
+    assert.equal(res.headers.get('x-frame-options'), 'DENY', url);
+    assert.equal(res.headers.get('x-content-type-options'), 'nosniff', url);
+    assert.equal(res.headers.get('referrer-policy'), 'same-origin', url);
+    assert.equal(res.headers.get('x-powered-by'), null, url);
+    assert.equal(res.headers.get('strict-transport-security'), null, url); // plain HTTP
+    assert.match(csp, /default-src 'self'/);
+    assert.match(csp, /script-src 'self' https:\/\/cdn\.jsdelivr\.net(;|$)/); // no 'unsafe-inline' for scripts
+    assert.match(csp, /frame-ancestors 'none'/);
+    assert.match(csp, /object-src 'none'/);
+  }
+  // Behind the (loopback, trusted) TLS proxy.
+  const tls = await fetch(`${base}/login`, { headers: { 'X-Forwarded-Proto': 'https' } });
+  assert.match(tls.headers.get('strict-transport-security'), /^max-age=\d+$/);
+});
+
+test('same-origin check: POSTs from other sites are refused; own pages, publicUrl and non-browser clients pass', async (t) => {
+  const { base, services } = await start(t, { publicUrl: 'http://thub.lab.example' }),
+    post = (url, headers = {}) => fetch(`${base}${url}`, {
+      method: 'POST', headers, body: new URLSearchParams({ username: 'admin', password: 'pw' }), redirect: 'manual'
+    }),
+
+    // A forged cross-site form post (login CSRF here; any dashboard action alike).
+    evil = await post('/login', { Origin: 'https://evil.example' });
+  assert.equal(evil.status, 403);
+  assert.match(await evil.text(), /came from https:\/\/evil\.example, not from this dashboard \(http:\/\/thub\.lab\.example\)/);
+  assert.equal((await post('/login', { Origin: 'null' })).status, 403); // sandboxed iframe, data: URL
+  assert.equal((await post('/login', { Referer: 'https://evil.example/page' })).status, 403); // no Origin: Referer decides
+  assert.equal((await post('/login', { Origin: 'http://thub.lab.example:8443' })).status, 403); // another port is another origin
+
+  // The dashboard's own pages: the address it was opened at, or publicUrl
+  // (a reverse proxy that rewrites Host).
+  assert.equal((await post('/login', { Origin: base })).status, 302);
+  assert.equal((await post('/login', { Origin: 'http://thub.lab.example' })).status, 302);
+  assert.equal((await post('/login', { Referer: `${base}/login` })).status, 302);
+  // Neither header: not a browser page (curl, a script) — nothing to forge.
+  assert.equal((await post('/login')).status, 302);
+
+  // Reading is never blocked.
+  assert.equal((await fetch(`${base}/login`, { headers: { Origin: 'https://evil.example' } })).status, 200);
+
+  // The session-authenticated admin API is covered too (JSON answer)…
+  const admin = await fetch(`${base}/api/v1/admin/jobs/reset-queue`, { method: 'POST', headers: { Origin: 'https://evil.example' } });
+  assert.equal(admin.status, 403);
+  assert.match((await admin.json()).error, /Blocked/);
+  // …the bearer-token Agent API isn't: a browser never attaches that token by itself.
+  const { token } = services.agents.create({ name: 'ci', kind: 'ci' }),
+    agent = await fetch(`${base}/api/v1/jobs`, {
+      method: 'POST',
+      headers: { Origin: 'https://evil.example', authorization: `Bearer ${token}`, 'content-type': 'application/json' },
+      body: JSON.stringify({})
+    });
+  assert.notEqual(agent.status, 403); // 400 invalid spec — got past the check
+});
+
+test('templates carry no inline event handlers (the CSP would block them)', () => {
+  const views = path.join(__dirname, '..', 'views'),
+    files = fs.readdirSync(views, { recursive: true }).filter((f) => f.endsWith('.pug'));
+  for (const f of files){
+    assert.doesNotMatch(fs.readFileSync(path.join(views, f), 'utf8'), /\bon[a-z]+="/, f);
+  }
+});

package/test/session.test.js

@@ -0,0 +1,132 @@
+/**
+ * @file        packages/coordinator/test/session.test.js
+ * @description Tests: dashboard sessions — the SQLite session store, sessions surviving a restart, and the Secure cookie flag
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { promisify } = require('node:util'),
+  { openDb } = require('../src/db'),
+  { SqliteSessionStore } = require('../src/services/session-store'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp, cookieSecure } = require('../src/server');
+
+test('session store: get/set/touch/destroy, expired sessions dropped and pruned', async () => {
+  let now = Date.parse('2026-09-30T12:00:00Z');
+  const store = new SqliteSessionStore(openDb(':memory:'), { pruneIntervalMs: 0, now: () => now }),
+    get = promisify(store.get.bind(store)),
+    set = promisify(store.set.bind(store)),
+    touch = promisify(store.touch.bind(store)),
+    destroy = promisify(store.destroy.bind(store)),
+    length = promisify(store.length.bind(store)),
+    sess = (minutes) => ({ cookie: { expires: new Date(now + minutes * 60_000).toISOString() }, user: { id: 'u1' } });
+
+  await set('a', sess(60));
+  await set('b', sess(5));
+  assert.deepEqual((await get('a')).user, { id: 'u1' });
+  assert.equal(await get('nope'), null);
+  assert.equal(await length(), 2);
+
+  now += 10 * 60_000; // b's 5 minutes are up
+  assert.equal(await get('b'), null); // expired: gone on read
+  await touch('a', sess(60)); // activity moves a's expiry out
+  now += 55 * 60_000;
+  assert.ok(await get('a'));
+
+  await set('c', sess(1));
+  now += 2 * 60_000;
+  assert.equal(store.prune(), 1); // c, never read again, swept
+  assert.equal(await length(), 1);
+
+  await destroy('a'); // logout
+  assert.equal(await get('a'), null);
+});
+
+test('cookieSecure: Secure for an https publicUrl, per-request otherwise, or as configured', () => {
+  assert.equal(cookieSecure({ publicUrl: 'https://thub.example.com', session: { secureCookie: 'auto' } }), true);
+  assert.equal(cookieSecure({ publicUrl: 'http://localhost:8080', session: { secureCookie: 'auto' } }), 'auto');
+  assert.equal(cookieSecure({ publicUrl: 'https://thub.example.com', session: { secureCookie: false } }), false);
+  assert.equal(cookieSecure({ publicUrl: 'http://lab', session: { secureCookie: true } }), true);
+});
+
+// --- over HTTP ------------------------------------------------------------
+
+function writeConfig(dir, extra = {}){
+  const file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({
+    dataDir: path.join(dir, 'data'), sessionSecret: 'test-secret-test-secret', updates: { checkIntervalMin: 0 }, ...extra
+  }));
+  return file;
+}
+
+async function start(t, file){
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  await new Promise((r) => server.on('listening', r));
+  const stop = () => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  });
+  t.after(stop);
+  return { base: `http://127.0.0.1:${server.address().port}`, services, stop };
+}
+
+const login = (base, headers = {}) => fetch(`${base}/login`, {
+  method: 'POST', headers, body: new URLSearchParams({ username: 'admin', password: 'pw' }), redirect: 'manual'
+});
+
+test('a signed-in session survives a Coordinator restart', async (t) => {
+  const file = writeConfig(fs.mkdtempSync(path.join(os.tmpdir(), 'thub-sess-'))),
+    first = await start(t, file);
+  first.services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+  const cookie = (await login(first.base)).headers.get('set-cookie').split(';')[0];
+  assert.equal((await fetch(`${first.base}/jobs`, { headers: { cookie }, redirect: 'manual' })).status, 200);
+  await first.stop();
+
+  const second = await start(t, file); // same database, new process state
+  assert.equal((await fetch(`${second.base}/jobs`, { headers: { cookie }, redirect: 'manual' })).status, 200);
+
+  await fetch(`${second.base}/logout`, { method: 'POST', headers: { cookie }, redirect: 'manual' });
+  assert.equal((await fetch(`${second.base}/jobs`, { headers: { cookie }, redirect: 'manual' })).status, 302);
+});
+
+test('https publicUrl: the session cookie is Secure; plain HTTP gets an explanation, not a login loop', async (t) => {
+  const file = writeConfig(fs.mkdtempSync(path.join(os.tmpdir(), 'thub-sess-')), { publicUrl: 'https://thub.example.com' }),
+    { base, services } = await start(t, file);
+  services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+
+  // Behind the (loopback, trusted) reverse proxy terminating TLS.
+  const viaProxy = await login(base, { 'X-Forwarded-Proto': 'https' }),
+    setCookie = viaProxy.headers.get('set-cookie');
+  assert.equal(viaProxy.status, 302);
+  assert.match(setCookie, /; Secure/);
+  assert.match(setCookie, /; HttpOnly/);
+  assert.match(setCookie, /; SameSite=Lax/);
+
+  // The proxy forgot X-Forwarded-Proto: no cookie could come back — say so.
+  const plain = await login(base);
+  assert.equal(plain.status, 400);
+  assert.equal(plain.headers.get('set-cookie'), null);
+  assert.match(await plain.text(), /Signing in needs HTTPS/);
+  assert.match(await (await fetch(`${base}/login`)).text(), /X-Forwarded-Proto: https/);
+});
+
+test('config: session.secureCookie must be "auto", true or false', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-sess-'));
+  assert.equal(loadConfig(writeConfig(dir)).session.secureCookie, 'auto');
+  assert.throws(() => loadConfig(writeConfig(dir, { session: { secureCookie: 'yes' } })), /session\.secureCookie must be/);
+});

package/test/settings.test.js

@@ -0,0 +1,206 @@
+/**
+ * @file        packages/coordinator/test/settings.test.js
+ * @description Tests: Coordinator settings from the dashboard — precedence, validation, applying now vs after a restart, the page, thub-admin reset
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { spawnSync } = require('node:child_process'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+function configFile(extra = {}){
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-settings-')),
+    file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({
+    dataDir: path.join(dir, 'data'), sessionSecret: 'test-secret-test-secret', updates: { checkIntervalMin: 0 },
+    publicUrl: 'http://thub.lab', jobs: { defaultTimeoutSec: 1800, maxTimeoutSec: 14400 }, ...extra
+  }));
+  return file;
+}
+
+const byKey = (list) => Object.fromEntries(list.map((s) => [s.key, s]));
+
+test('settings: dashboard values override the file, "now" ones apply at once, "restart" ones at the next start', () => {
+  const file = configFile(),
+    config = loadConfig(file),
+    { settings } = buildServices(config);
+
+  assert.equal(byKey(settings.list())['jobs.maxTimeoutSec'].source, 'file');
+  const result = settings.save(
+    { changes: { 'jobs.maxTimeoutSec': '3600', 'scheduler.tickIntervalSec': '30', 'scheduler.requeueOnLost': 'false' } },
+    { by: 'alice' }
+  );
+  assert.deepEqual(result.now.sort(), ['jobs.maxTimeoutSec', 'scheduler.requeueOnLost']);
+  assert.deepEqual(result.restart, ['scheduler.tickIntervalSec']);
+
+  // Applied now: every service reads the same config object.
+  assert.equal(config.jobs.maxTimeoutSec, 3600);
+  assert.equal(config.scheduler.requeueOnLost, false);
+  // Not yet: shown as pending.
+  assert.equal(config.scheduler.tickIntervalSec, 10);
+  const list = byKey(settings.list());
+  assert.equal(list['scheduler.tickIntervalSec'].pendingRestart, true);
+  assert.equal(list['jobs.maxTimeoutSec'].source, 'dashboard');
+  assert.equal(list['jobs.maxTimeoutSec'].updatedBy, 'alice');
+
+  // The next start (same database) runs with them all.
+  const config2 = loadConfig(file),
+    { settings: settings2 } = buildServices(config2);
+  assert.equal(config2.scheduler.tickIntervalSec, 30);
+  assert.equal(config2.jobs.maxTimeoutSec, 3600);
+  assert.equal(byKey(settings2.list())['scheduler.tickIntervalSec'].pendingRestart, false);
+
+  // Reset: back to the config file's value.
+  settings2.save({ reset: ['jobs.maxTimeoutSec'] });
+  assert.equal(config2.jobs.maxTimeoutSec, 14400);
+  assert.equal(byKey(settings2.list())['jobs.maxTimeoutSec'].source, 'file');
+});
+
+test('settings: validated all-or-nothing; env-locked ones can\'t change; bad stored values are skipped at startup', (t) => {
+  const file = configFile(),
+    config = loadConfig(file),
+    { settings, db } = buildServices(config);
+
+  assert.throws(() => settings.save({ changes: { 'jobs.maxTimeoutSec': '600', publicUrl: 'not a url' } }), /Public URL: must be a URL/);
+  assert.equal(config.jobs.maxTimeoutSec, 14400); // nothing saved
+  assert.throws(() => settings.save({ changes: { 'jobs.defaultTimeoutSec': '7200', 'jobs.maxTimeoutSec': '3600' } }), /longer than the maximum/);
+  assert.throws(() => settings.save({ changes: { clientJoinKey: 'short' } }), /at least 16 characters/);
+  assert.throws(() => settings.save({ changes: { 'retention.jobRetention': '5y' } }), /must be one of/);
+  settings.save({ changes: { publicUrl: 'https://thub.example.com/', clientJoinKey: 'jk_0123456789abcdef' } });
+  assert.equal(config.publicUrl, 'https://thub.example.com'); // trailing slash dropped
+  assert.equal(config.clientJoinKey, 'jk_0123456789abcdef');
+  settings.save({ changes: { clientJoinKey: '' } }); // cleared: registration off
+  assert.equal(config.clientJoinKey, null);
+
+  // A value an older version stored that this one rejects: ignored, warned.
+  db.prepare('INSERT OR REPLACE INTO settings (key, value, updated_at) VALUES (?, ?, ?)').run('retention.jobRetention', '"5y"', 'x');
+  const warn = t.mock.method(console, 'warn', () => {}),
+    config2 = loadConfig(file);
+  buildServices(config2);
+  assert.equal(config2.retention.jobRetention, 'forever');
+  assert.match(warn.mock.calls[0].arguments[0], /Ignoring dashboard setting retention\.jobRetention/);
+
+  // The environment wins, and the dashboard can't override it.
+  const prev = process.env.THUB_PUBLIC_URL;
+  process.env.THUB_PUBLIC_URL = 'https://from-env.example';
+  t.after(() => (prev === undefined ? delete process.env.THUB_PUBLIC_URL : (process.env.THUB_PUBLIC_URL = prev)));
+  const config3 = loadConfig(file),
+    { settings: settings3 } = buildServices(config3);
+  assert.equal(config3.publicUrl, 'https://from-env.example');
+  assert.equal(byKey(settings3.list()).publicUrl.source, 'env');
+  assert.deepEqual(settings3.save({ changes: { publicUrl: 'https://other.example' } }).changed, []);
+  assert.equal(config3.publicUrl, 'https://from-env.example');
+});
+
+test('settings page: admins only; saves; refuses a setting that would lock everyone out', async (t) => {
+  const config = loadConfig(configFile()),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  await new Promise((r) => server.on('listening', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+  services.adminUsers.create({ username: 'view', password: 'pw', role: 'viewer' });
+  const login = async (u) => (await fetch(`${base}/login`, {
+      method: 'POST', body: new URLSearchParams({ username: u, password: 'pw' }), redirect: 'manual'
+    })).headers.get('set-cookie').split(';')[0],
+    admin = await login('admin'),
+    viewer = await login('view'),
+    post = (body) => fetch(`${base}/admin/settings`, { method: 'POST', headers: { cookie: admin }, body: new URLSearchParams(body), redirect: 'manual' }),
+    page = async () => (await fetch(`${base}/admin/settings`, { headers: { cookie: admin } })).text();
+
+  assert.equal((await fetch(`${base}/admin/settings`, { headers: { cookie: viewer } })).status, 403);
+  const html = await page();
+  assert.match(html, /name="s\[jobs\.maxTimeoutSec\]"/);
+  assert.match(html, /href="\/admin\/settings"/); // navbar link
+  assert.doesNotMatch(html, /test-secret-test-secret/); // secrets never in the page
+
+  // A checkbox posts "false" then (checked) "true"; the last one wins.
+  await post([['s[jobs.maxTimeoutSec]', '7200'], ['s[scheduler.requeueOnLost]', 'false']]);
+  assert.equal(config.jobs.maxTimeoutSec, 7200);
+  assert.equal(config.scheduler.requeueOnLost, false);
+  assert.match(await page(), /Saved and applied: Maximum job timeout \(s\), Retry lost jobs\./);
+
+  // An empty secret field leaves the key alone; "clear" removes it.
+  await post({ 's[clientJoinKey]': 'jk_0123456789abcdef' });
+  await post({ 's[clientJoinKey]': '' });
+  assert.equal(config.clientJoinKey, 'jk_0123456789abcdef');
+  await post({ 'clear[clientJoinKey]': '1' });
+  assert.equal(config.clientJoinKey, null);
+
+  // Over plain HTTP, an HTTPS-only cookie would lock everyone out: refused.
+  await post({ 's[session.secureCookie]': 'true' });
+  assert.match(await page(), /you're connected over plain HTTP|you're connected over plain HTTP/);
+  assert.equal(services.settings.list().find((s) => s.key === 'session.secureCookie').source, 'file');
+
+  // Not under systemd: no restart.
+  assert.equal((await fetch(`${base}/admin/settings/restart`, { method: 'POST', headers: { cookie: admin }, redirect: 'manual' })).status, 302);
+  assert.match(await page(), /isn't running under systemd|isn't running under systemd/);
+});
+
+test('thub-admin settings reset: the way back from a bad setting', () => {
+  const file = configFile(),
+    config = loadConfig(file),
+    { settings } = buildServices(config);
+  settings.save({ changes: { 'jobs.maxTimeoutSec': '3600', 'scheduler.maxQueuedPerAgent': '5' } });
+  const run = (...args) => spawnSync(process.execPath, [path.join(__dirname, '..', 'bin', 'thub-admin.js'), 'settings', ...args], {
+    env: { ...process.env, THUB_COORDINATOR_CONFIG: file }, encoding: 'utf8'
+  });
+  assert.match(run('list').stdout, /jobs\.maxTimeoutSec = 3600/);
+  assert.match(run('reset', 'jobs.maxTimeoutSec').stdout, /Removed 1 dashboard setting/);
+  assert.match(run('reset').stdout, /Removed 1 dashboard setting/);
+  assert.match(run('list').stdout, /No settings changed from the dashboard/);
+});
+
+test('heartbeat interval from Settings: sent in every reply; lowering it gives Clients time to switch', async (t) => {
+  const config = loadConfig(configFile()),
+    services = buildServices(config),
+    { settings, registry, heartbeatMonitor, db } = services,
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  await new Promise((r) => server.on('listening', r));
+  const { resourceId, resourceToken } = registry.registerAuto({ clientId: 'c1', name: 'lab-1', type: 'sw', labels: [] }),
+    beat = () => fetch(`http://127.0.0.1:${server.address().port}/api/v1/resources/${resourceId}/heartbeat`, {
+      method: 'POST', headers: { authorization: `Bearer ${resourceToken}`, 'content-type': 'application/json' }, body: JSON.stringify({ state: 'idle' })
+    }).then((r) => r.json()),
+    status = () => registry.get(resourceId).status;
+
+  assert.equal((await beat()).heartbeatIntervalSec, 10);
+  settings.save({ changes: { 'heartbeat.intervalSec': '5' } });
+  assert.equal((await beat()).heartbeatIntervalSec, 5); // the next reply carries it
+
+  // Last heard from 25 s ago, still on the old 10 s interval: within 3 × 10 s.
+  const now = Date.now(),
+    lastBeat = (ageSec) => db.prepare('UPDATE resources SET last_heartbeat_at = ? WHERE id = ?').run(new Date(now - ageSec * 1000).toISOString(), resourceId);
+  lastBeat(25);
+  heartbeatMonitor.sweepOnce(now); // 3 × 5 s alone would call it gone
+  assert.notEqual(status(), 'OUT_OF_SERVICE');
+  // Once every Client has had (missedLimit + 1) old intervals to switch, the new one counts.
+  heartbeatMonitor.sweepOnce(now + 41_000);
+  assert.equal(status(), 'OUT_OF_SERVICE');
+
+  // missedLimit applies at once, too.
+  settings.save({ changes: { 'heartbeat.missedLimit': '6', 'heartbeat.sweepIntervalSec': '2' } });
+  assert.equal(config.heartbeat.missedLimit, 6);
+  assert.equal(config.heartbeat.sweepIntervalSec, 5); // a timer: after a restart
+});

package/views/admin/settings.pug

@@ -0,0 +1,133 @@
+extends ../layout
+
+//- One setting's input (services/settings.js SETTINGS: type text | number
+//- | checkbox | select | secret). Names: s[<key>]; reset[] / clear[<key>].
+mixin settingInput(s, locked)
+  - const id = `setting-${s.key.replace(/\./g, '-')}`
+  if s.type === 'checkbox'
+    .form-check.form-switch
+      input(type="hidden" name=`s[${s.key}]` value="false" disabled=locked)
+      input.form-check-input(id=id type="checkbox" name=`s[${s.key}]` value="true" checked=s.value === true disabled=locked)
+      label.form-check-label.visually-hidden(for=id)= s.label
+  else if s.type === 'select'
+    select.form-select.form-select-sm(id=id name=`s[${s.key}]` disabled=locked)
+      each o in s.options
+        option(value=o selected=String(s.value) === String(o))= s.labels && s.labels[o] ? `${o} — ${s.labels[o]}` : o
+  else if s.type === 'secret'
+    .input-group.input-group-sm
+      input.form-control(
+        id=id
+        type="password"
+        name=`s[${s.key}]`
+        autocomplete="new-password"
+        placeholder=s.value ? `set (…${String(s.value).slice(-4)}) — type to replace` : 'not set — registration is off'
+        disabled=locked
+        data-secret-input
+      )
+      button.btn.btn-outline-secondary(type="button" data-secret-generate=`#${id}` disabled=locked) Generate
+      button.btn.btn-outline-secondary(type="button" data-secret-show=`#${id}` disabled=locked aria-label="Show")
+        i.bi.bi-eye
+    if s.value && !locked
+      .form-check.mt-1
+        input.form-check-input(id=`${id}-clear` type="checkbox" name=`clear[${s.key}]` value="1")
+        label.form-check-label.small(for=`${id}-clear`) Clear it (turns self-registration off)
+  else
+    input.form-control.form-control-sm(
+      id=id
+      type=s.type === 'number' ? 'number' : 'text'
+      name=`s[${s.key}]`
+      value=s.value === null || s.value === undefined ? '' : String(s.value)
+      disabled=locked
+    )
+
+block content
+  .d-flex.justify-content-between.align-items-center.mb-2
+    h1.h4.mb-0 Settings
+  p.text-body-secondary.small.
+    Coordinator options, saved in its database on top of the config file (#[code= readOnly.configPath]).
+    An environment variable still wins over both. Options marked #[span.badge.text-bg-secondary after restart]
+    are read only at startup.
+
+  if restarting
+    .alert.alert-info.d-flex.align-items-center.gap-2(data-restarting=restarting role="status")
+      span.spinner-border.spinner-border-sm(aria-hidden="true")
+      span Restarting the Coordinator… this page reloads by itself once it's back.
+  else if pendingRestart.length
+    .alert.alert-warning.d-flex.flex-wrap.align-items-center.gap-2
+      i.bi.bi-arrow-clockwise
+      span.me-auto
+        | Saved but not active until a restart: #{pendingRestart.map((s) => s.label).join(', ')}.
+      if canRestart
+        form(
+          method="post"
+          action="/admin/settings/restart"
+          data-confirm="Restart the Coordinator now? The dashboard and API are unavailable for a few seconds; Clients and Agents reconnect by themselves and running jobs carry on."
+          data-confirm-title="Restart the Coordinator?"
+          data-confirm-ok="Restart now"
+          data-confirm-tone="warning"
+        )
+          button.btn.btn-sm.btn-warning(type="submit") Restart now
+      else
+        span.small Restart it by hand: #[code sudo systemctl restart thub-coordinator].
+
+  form(method="post" action="/admin/settings")
+    each group in groups
+      .card.mb-3
+        .card-header.fw-semibold= group.name
+        ul.list-group.list-group-flush
+          each s in group.items
+            - const locked = s.source === 'env'
+            li.list-group-item
+              .row.g-2.align-items-start
+                .col-md-4
+                  label.form-label.mb-0.fw-medium(for=`setting-${s.key.replace(/\./g, '-')}`)= s.label
+                  .small.text-body-secondary
+                    code.small= s.key
+                  .d-flex.flex-wrap.gap-1.mt-1
+                    if s.applies === 'now'
+                      span.badge.text-bg-success applies now
+                    else
+                      span.badge.text-bg-secondary after restart
+                    if s.pendingRestart
+                      span.badge.text-bg-warning restart pending
+                    if s.source === 'env'
+                      span.badge.text-bg-dark(data-bs-toggle="tooltip" data-bs-title=`Set by the environment variable ${s.env}; unset it to change this here`)= `from ${s.env}`
+                    else if s.source === 'dashboard'
+                      span.badge.text-bg-info(data-bs-toggle="tooltip" data-bs-title=`Changed ${fmtDate(s.updatedAt)}${s.updatedBy ? ` by ${s.updatedBy}` : ''}`) from dashboard
+                    else
+                      span.badge.text-bg-light.border config file / default
+                .col-md-5
+                  +settingInput(s, locked)
+                  .form-text= s.help
+                .col-md-3
+                  if s.source === 'dashboard'
+                    .form-check.small
+                      input.form-check-input(id=`reset-${s.key}` type="checkbox" name="reset" value=s.key)
+                      label.form-check-label(for=`reset-${s.key}`)
+                        | Back to the config file's value
+                        if s.type !== 'secret'
+                          |  (
+                          code= s.fileValue === null || s.fileValue === undefined ? 'unset' : String(s.fileValue)
+                          | )
+    .d-flex.justify-content-end.gap-2.mb-4
+      a.btn.btn-outline-secondary(href="/admin/settings") Discard changes
+      button.btn.btn-primary(type="submit") Save settings
+
+  .card.mb-4
+    .card-header.fw-semibold Config file only
+    .card-body.small
+      p.text-body-secondary.
+        These change the address, storage or session signing the dashboard itself runs on, so they're set in the
+        config file (then #[code sudo systemctl restart thub-coordinator]).
+      dl.row.mb-0
+        dt.col-sm-3 listen
+        dd.col-sm-9: code= readOnly.listen
+        dt.col-sm-3 dataDir
+        dd.col-sm-9: code= readOnly.dataDir
+        dt.col-sm-3 sessionSecret
+        dd.col-sm-9 set (never shown)
+      p.small.text-body-secondary.mt-3.mb-0
+        | Locked out by a setting? On the Coordinator host: #[code thub-admin settings reset], then restart it.
+
+block scripts
+  script(src="/js/settings.js")

package/views/groups/list.pug

@@ -9,7 +9,7 @@ block content
 
   p.text-body-secondary.small: i.
     A job can be constrained to run only on resources in a group with `thub run --group <id>` (§13.1).
-    A resource joins a group by listing its id under `groups` in the Client's own config — membership isn't set here.
+    Which groups a Client is in is set on its resource card (Groups tab, admins), or as `groups` in the Client's own config — the tab writes it there.
 
   if totalCount
     .d-flex.flex-wrap.align-items-center.gap-2.mb-2

package/views/help/_agent-cli.pug

@@ -2,10 +2,10 @@
   h3.h6 Commands
   +code('thub --help').
     thub run      [options]                 Submit a job and follow its log
-    thub status   <jobId> [--json]          Status; follow the log if running, artifact links if done
+    thub status   <jobId> [--json]          Status; follow the log if running, verdict and test counts if done
     thub cancel   <jobId>                   Cancel a job
     thub resources [--json]                 Clients and their status
-    thub jobs     [--mine] [--state <s>] [--json]   Recent jobs
+    thub jobs     [--mine] [--state <s>] [--json]   Recent jobs (a cli token: only its own)
     thub config   set <url|token|group|user> <value>
     thub check-update                       Compare with the latest published Agent
     thub self-update [--to <x.y.z>]         Update with npm i -g

package/views/help/_agent-setup.pug

@@ -13,7 +13,7 @@
   h3.h6 Get a token
   p.small.
     An admin registers an agent on #[a(href="/admin/agents") Agents] (or with #[code thub-admin agent add]) and passes you
-    its token, which is shown only once. The agent's #[strong kind] decides the job id prefix and the default priority:
+    its token, which is shown only once. The agent's #[strong kind] decides the job id prefix, the default priority and which jobs it can see:
   table.table.table-sm.small.w-auto
     thead
       tr
@@ -21,17 +21,20 @@
         th For
         th Job ids
         th Default priority
+        th Can see
     tbody
       tr
         td: code ci
         td Pipelines
         td: code A-00001…
         td 50
+        td every job (details, log)
       tr
         td: code cli
         td Developers
         td: code M-00001…
         td 60 (so a busy pipeline doesn't starve them)
+        td only the jobs it submitted
 
   h3.h6 Configure
   +code('Save the settings once').

package/views/help/_client-setup.pug

@@ -83,7 +83,7 @@
         tr
           td: code groups
           td No
-          td Group ids (from #[a(href="/groups") Groups]) this Client belongs to, for #[code thub run --group].
+          td Group ids (from #[a(href="/groups") Groups]) this Client belongs to, for #[code thub run --group]. Admins can also set them on the resource card (Groups tab), which writes them here.
         tr
           td: code varDir
           td No