@andrian.yablonskyy/thub-coordinator 1.0.38 → 1.0.40

package/views/help/_coordinator.pug

@@ -11,7 +11,7 @@
   p.small.
     #[code sudo npm i -g] does the whole setup for the user who ran #[code sudo]. It creates
     #[code ~/.config/thub/coordinator.json] (with a random #[code sessionSecret]) and
-    #[code ~/var/lib/thub] (database, artifacts, avatars). It installs, enables and starts
+    #[code ~/var/lib/thub] (database, avatars). It installs, enables and starts
     #[code thub-coordinator.service], plus the root helper behind the navbar's #[strong Update app] button.
 
   h3.h6 2. Configure
@@ -25,12 +25,13 @@
       "trustProxy": "loopback",
       "dataDir": "/home/thub/var/lib/thub",
       "sessionSecret": "<long random string>",
+      "session": { "secureCookie": "auto" },
       "clientJoinKey": "<output of: thub-admin join-key generate>",
       "heartbeat": { "intervalSec": 10, "missedLimit": 3, "sweepIntervalSec": 5 },
       "scheduler": { "assignAckTimeoutSec": 15, "requeueOnLost": true, "maxQueuedPerAgent": 20, "tickIntervalSec": 10 },
       "jobs": { "defaultTimeoutSec": 1800, "maxTimeoutSec": 14400 },
-      "retention": { "logRetentionDays": 14, "artifactRetentionDays": 30, "jobRetention": "forever" },
-      "artifacts": { "maxUploadMb": 512, "linkTtlHours": 168 },
+      "rateLimit": { "requestsPerMinute": 500, "loginPerMinute": 10 },
+      "retention": { "jobRetention": "forever" },
       "updates": { "checkIntervalMin": 15, "registry": null }
     }
   .table-responsive
@@ -51,25 +52,35 @@
           td Which proxies' #[code X-Forwarded-For] to trust for a Client's external address: #[code loopback] (default), a CIDR such as #[code "10.0.0.0/8"], a hop count, or #[code false].
         tr
           td: code sessionSecret
-          td Signs dashboard sessions and artifact download links. Keep it secret and never use the #[code change-me-…] placeholder.
+          td Signs dashboard session cookies. Keep it secret and never use the #[code change-me-…] placeholder.
+        tr
+          td: code session.secureCookie
+          td #[code "auto"] (default): the session cookie is Secure (HTTPS-only) whenever #[code publicUrl] is https://. #[code true]/#[code false] force it. Sessions are stored in the database and survive restarts.
         tr
           td: code clientJoinKey
           td The shared secret Clients self-register with. Unset or #[code null] turns registration off (#[code 503]).
         tr
           td: code heartbeat.*
-          td Clients heartbeat every #[code intervalSec]. After #[code missedLimit] misses a resource goes #[code OUT_OF_SERVICE] and its job becomes #[code LOST].
+          td Clients heartbeat every #[code intervalSec] — the Coordinator tells them, so it's set here only (and on Settings). After #[code missedLimit] misses a resource goes #[code OUT_OF_SERVICE] and its job becomes #[code LOST]; #[code sweepIntervalSec] is how often that's checked.
         tr
           td: code scheduler.*
           td #[code assignAckTimeoutSec]: how long an assignment waits for the Client to accept. #[code requeueOnLost]: retry a #[code LOST] job once. #[code maxQueuedPerAgent]: queue limit per agent.
+        tr
+          td: code rateLimit.*
+          td Requests per minute per caller (agent/resource token, dashboard user, else IP; default 500), and sign-in attempts per IP (default 10). Past it: #[code 429] with #[code Retry-After]. #[code 0] turns a limit off.
         tr
           td: code jobs.*
           td Default and maximum job timeout, in seconds.
         tr
           td: code retention.*
-          td #[code jobRetention]: #[code 1w], #[code 2w], #[code 1m], #[code 3m], #[code 6m] or #[code forever]. Older finished jobs, their logs and artifacts are deleted hourly.
+          td #[code jobRetention]: #[code 1w], #[code 2w], #[code 1m], #[code 3m], #[code 6m] or #[code forever]. Older finished jobs and their logs are deleted hourly.
         tr
           td: code updates.*
           td How often to check npm for new versions (#[code 0] turns the periodic check off), and an optional private registry.
+  +note('info').
+    Most of these can also be changed by admins on the dashboard's #[a(href="/admin/settings") Settings] page — stored in the
+    database on top of this file; some apply at once, the rest after a restart (#[strong Restart now] under systemd). An environment
+    variable still wins. Locked out by a setting? #[code thub-admin settings reset] on the Coordinator host, then restart.
   p.small.
     Resolution order: #[code THUB_COORDINATOR_CONFIG] (a path) → #[code ~/.config/thub/coordinator.json] → the bundled
     default. These environment variables override the file: #[code THUB_LISTEN], #[code THUB_PUBLIC_URL],
@@ -96,7 +107,7 @@
           proxy_http_version 1.1;
           proxy_buffering off;          # SSE log streams
           proxy_read_timeout 1h;
-          client_max_body_size 512m;    # artifacts.maxUploadMb
+          client_max_body_size 10m;     # log batches, avatars
         }
 
   h3.h6 4. Users, agents and the join key

package/views/help/_docker.pug

@@ -106,7 +106,7 @@
         td Removes the container when the tests end.
       tr
         td: code -v "$THUB_WORK_DIR:/work" -w /work
-        td The checkout and downloads, and the #[code results/] and #[code artifacts/] folders, which the Client uploads.
+        td The checkout and downloads, and the #[code results/] and #[code artifacts/] folders, where the Client reads JUnit XML for the test counts.
       tr
         td: code -e NAME
         td Passes a job variable (#[code --env], #[code THUB_*], #[code JOB_*]) into the container.

package/views/help/_env.pug

@@ -9,7 +9,8 @@
   -
     const thubVars = [
       ['THUB_JOB_ID', 'The job id, e.g. M-00125'],
-      ['THUB_WORK_DIR', 'The directory the command runs in: the --git-repo checkout, else empty. results/ and artifacts/ in it are uploaded'],
+      ['THUB_ARTIFACTS_FILE', 'Where the command may list the artifacts it published elsewhere: a JSON array of {"name", "size", "link", "timestamp"}, shown on the job page'],
+      ['THUB_WORK_DIR', 'The directory the command runs in: the --git-repo checkout, else empty. JUnit XML in results/ or artifacts/ gives the test counts; deleted when the job ends'],
       ['THUB_SUITE', '--suite (default: default)'],
       ['THUB_GIT_COMMIT', 'The exact commit checked out for --git-repo'],
       ['THUB_DOWNLOADS_DIR', 'Where the --download-file files are'],

package/views/help/_git.pug

@@ -20,8 +20,9 @@
     git remote add origin git@github.com:yourorg/firmware-tests.git
     git push -u origin main
   p.small.
-    The exit code of #[code --command] is the verdict. JUnit files under #[code results/] or #[code artifacts/] are uploaded
-    as artifacts and summed into the job's test counts. Any other file there is uploaded too.
+    The exit code of #[code --command] is the verdict. JUnit files under #[code results/] or #[code artifacts/] are summed into
+    the job's test counts. Nothing is uploaded: the workspace is deleted when the job ends, so publish anything you need to keep
+    from the command itself (e.g. #[code curl -T report.html "$ARTIFACTORY/…"] with a token passed as #[code --env]).
 
   h3.h6 2. Give Clients read access: SSH deploy key (recommended)
   p.small.

package/views/help/_overview.pug

@@ -13,7 +13,7 @@
             | Coordinator
           p.card-text.small.mb-0.
             This service. It holds the job queue and the resource registry, and runs the scheduler and
-            the heartbeat monitor. It stores logs and artifacts in SQLite plus a local directory,
+            the heartbeat monitor. It stores job state and logs in SQLite,
             and serves this dashboard. It's the only thing that needs a public HTTPS port.
     .col-md-4
       .card.h-100
@@ -41,7 +41,7 @@
     li The Coordinator queues it (#[code QUEUED]) and the scheduler assigns it to an idle Client whose type, labels and group match.
     li The Client accepts it, clones #[code --git-repo], downloads #[code --download-file] files and prepares the DUT (#[code PREPARING]).
     li It runs #[code --command] with #[code sh -c], and output streams live to the Agent and the dashboard (#[code RUNNING]).
-    li The exit code is the verdict: #[code 0] = #[code PASSED], anything else = #[code FAILED]. JUnit files and artifacts are uploaded.
+    li The exit code is the verdict: #[code 0] = #[code PASSED], anything else = #[code FAILED]. The Client reports the JUnit test counts; the job's files stay on the Client and are deleted with its workspace.
     li The Agent exits with the verdict code, so a CI step passes or fails with it.
 
   h3.h6 Key design rules

package/views/help/_troubleshooting.pug

@@ -16,6 +16,10 @@
       ['Live logs don\'t stream through the proxy', 'Turn off response buffering for the Coordinator (nginx: `proxy_buffering off;`, Caddy: `flush_interval -1`).'],
       ['Finding a job, resource, group or agent', 'Use the search box on its list page (press `/` to jump to it). Every word must match, e.g. `lab-hw-01 FAILED` or a git ref. Job search covers ids, users, resources, agents, commands, repos and `--meta`, but not `--env` values (secrets). On a job page, search the log above the log viewer: `Enter`/`Shift+Enter` step through matches.'],
       ['Lists don\'t update by themselves (navbar shows Offline or Paused)', '`Paused`: you\'re editing something on the page (a field, the inline rename, a dialog); it resumes when you\'re done. `Offline`: the browser can\'t hold the `/live` stream open, often a proxy buffering it (nginx: `proxy_buffering off;`); reloading the page always shows current data. `Session ended`: sign in again. Background updates never extend the session\'s idle timeout.'],
+      ['Sign-in says it needs HTTPS', 'The session cookie is HTTPS-only because `publicUrl` is `https://`, but the request arrived as plain HTTP. Open the dashboard through its https:// address; behind a reverse proxy, make it send `X-Forwarded-Proto: https` (nginx: `proxy_set_header X-Forwarded-Proto $scheme;`) and check `trustProxy`. To allow plain HTTP, set `session.secureCookie` to `false`.'],
+      ['Where are a job\'s test reports and output files?', 'The Coordinator keeps only the log and the result (verdict, exit code, JUnit test counts). Files the job creates stay in its workspace on the Client and are deleted when the job ends. To keep them, publish them from `--command`, e.g. `curl -fsS -H "Authorization: Bearer $ART_TOKEN" -T results/report.xml "https://artifactory.example.com/qa/$THUB_JOB_ID/report.xml"` with `--env ART_TOKEN`. To show them on the job page and in `thub status`, list them in `$THUB_ARTIFACTS_FILE` as `[{"name", "size", "link", "timestamp"}]` — only that metadata is kept. The full log is always available from the job page\'s Raw button.'],
+      ['429 Too Many Requests', 'A caller went over `rateLimit.requestsPerMinute` (per agent or resource token, per dashboard user, else per IP; default 500). The Agent and Client wait for `Retry-After` and retry by themselves; a script calling the API should do the same. Raise the limit in the config file or on Settings if your normal traffic needs more (a Client streaming logs makes up to ~240 requests a minute). Too many sign-in attempts from one address: wait a minute (`rateLimit.loginPerMinute`).'],
+      ['Sign-in says “Too many failed sign-ins”', 'After repeated wrong passwords the Coordinator makes each further attempt wait, doubling each time: per address from the 5th failure (up to 15 min), per username from the 10th from any address (up to 5 min). Wait the time shown, or sign in from another address; a successful sign-in clears it, and an hour without failures forgets it. The Coordinator never tells whether a username exists.'],
       ['Locked out of the dashboard', 'Restart the Coordinator once with `THUB_BOOTSTRAP_ADMIN_PASSWORD=<new>` (resets the `admin` user), then unset it.']
     ]
     const withCode = (text) => text

package/views/jobs/list.pug

@@ -15,12 +15,12 @@ block content
     .col-12.col-md-5.col-lg-4
       +searchBox(filters.q, 'Search jobs: id, user, resource, command, repo…', list.urlFor({ q: '' }))
     .col-auto
-      select.form-select.form-select-sm(name="state" onchange="this.form.submit()")
+      select.form-select.form-select-sm(name="state" data-autosubmit)
         option(value="") any state
         each s in ['QUEUED','ASSIGNED','PREPARING','RUNNING','PASSED','FAILED','ERROR','TIMEOUT','CANCELED','LOST']
           option(value=s selected=filters.state === s)= s
     .col-auto
-      select.form-select.form-select-sm(name="source" onchange="this.form.submit()")
+      select.form-select.form-select-sm(name="source" data-autosubmit)
         option(value="") any source
         option(value="ci" selected=filters.source === 'ci') ci
         option(value="cli" selected=filters.source === 'cli') cli
@@ -87,7 +87,7 @@ block content
           |
           code CANCELED
           | .
-        p.small.text-body-secondary.mb-0 Finished jobs, logs and artifacts are not touched.
+        p.small.text-body-secondary.mb-0 Finished jobs and their logs are not touched.
       else
         p.mb-0 There are no active jobs — nothing to cancel.
 
@@ -128,11 +128,11 @@ block content
         each preset in cleanupInfo.presets
           button.btn.btn-sm.btn-outline-secondary(
             type="button"
+            data-fill="#cleanup-before"
             data-value=preset.value
-            onclick="document.getElementById('cleanup-before').value = this.dataset.value"
           )= preset.label
       p
-        | Deletes finished jobs that ended before then, with their logs and artifacts (files too), and the resource, agent and group history logged before then — then compacts the database file.
+        | Deletes finished jobs that ended before then, with their logs, and the resource, agent and group history logged before then — then compacts the database file.
         |
         strong This cannot be undone.
         |  Active jobs are never touched.

package/views/jobs/show.pug

@@ -49,15 +49,41 @@ block content
       dt.col-sm-2 Message
       dd.col-sm-10= job.message
 
+  //- What the job published elsewhere and listed in $THUB_ARTIFACTS_FILE
+  //- (README §7.3): metadata only; the links go to wherever the files are.
   h2.h6.mt-4#artifacts Artifacts
-  if artifacts.length
-    ul.list-group
-      each a in artifacts
-        li.list-group-item.d-flex.justify-content-between
-          span= a.name
-          a(href=a.url) download
+  if job.artifacts.length
+    .table-responsive
+      table.table.table-sm.align-middle.mb-0
+        thead
+          tr
+            th Name
+            th.text-end Size
+            th Time
+            th
+        tbody
+          each a in job.artifacts
+            tr
+              td
+                a(href=a.link target="_blank" rel="noopener noreferrer")= a.name
+              td.text-end.text-nowrap(title=a.size != null ? `${a.size} bytes` : null)= a.size != null ? fmtBytes(a.size) : '—'
+              td.text-nowrap= a.timestamp ? fmtDate(a.timestamp) : '—'
+              td.text-end
+                a.btn.btn-sm.btn-outline-secondary(
+                  href=a.link
+                  target="_blank"
+                  rel="noopener noreferrer"
+                  aria-label=`Download ${a.name}`
+                  data-bs-toggle="tooltip"
+                  data-bs-title=a.link
+                )
+                  i.bi.bi-download
+  else if jobActive
+    p.small.text-body-secondary.mb-0 Listed here when the job finishes, if it reports any.
   else
-    p.text-body-secondary No artifacts yet.
+    p.small.text-body-secondary.mb-0.
+      None reported. A job lists the files it published (to Artifactory, S3, a file server…) in
+      #[code $THUB_ARTIFACTS_FILE] as #[code [{"name", "size", "link", "timestamp"}]].
 
   h2.h6.mt-4 Log
   +logViewer(job.id, jobActive)

package/views/layout.pug

@@ -43,6 +43,8 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
               if user.role === 'admin'
                 li.nav-item
                   a.nav-link(href="/admin/agents" class=active === 'agents' ? 'active' : '') Agents
+                li.nav-item
+                  a.nav-link(href="/admin/settings" class=active === 'settings' ? 'active' : '') Settings
           ul.navbar-nav
             if user && liveTopics
               //- Live-update status, driven by public/js/live.js.
@@ -64,7 +66,7 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
                   | Help
             if user && user.role === 'admin'
               li.nav-item.d-flex.align-items-center.me-2
-                form(method="post" action="/updates/check" onsubmit="this.querySelector('button').disabled = true; this.querySelector('i').className = 'spinner-border spinner-border-sm';")
+                form(method="post" action="/updates/check" data-submit-busy)
                   input(type="hidden" name="returnTo" value=currentPath)
                   button.btn.btn-sm.btn-outline-secondary(
                     type="submit"
@@ -192,6 +194,7 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
     script(src="/js/copy-to-clipboard.js")
     script(src="/js/confirm.js")
     script(src="/js/list-search.js")
+    script(src="/js/actions.js")
     if user && liveTopics
       script(src="/js/live.js")
     if user && user.role === 'admin' && updates.coordinatorPending

package/views/mixins/client-config.pug

@@ -88,8 +88,8 @@ mixin capabilitiesStatus(r)
         span.badge.text-bg-danger(data-bs-toggle="tooltip" data-bs-title=r.config_error) refused by the Client
 
 //- The Client's config, as tabs of the resource card next to Details:
-//- HW — ST-Link, UART, DUT USB (its hw-devices section); both — Reboot (the
-//- schedule, its own Save). An SW Client has no settings of its own. The
+//- HW — ST-Link, UART, DUT USB (its hw-devices section); both — Groups
+//- (membership, its own Save) and Reboot (the schedule, its own Save). An SW Client has no settings of its own. The
 //- device tabs share one form and one "Save capabilities"; a tab with
 //- unsaved changes shows ⚠ (public/js/client-config.js).
 mixin configTabItems(r)
@@ -97,9 +97,70 @@ mixin configTabItems(r)
   if r.type === 'hw'
     each t in [['stlinks', 'ST-Link'], ['uarts', 'UART'], ['usbs', 'DUT USB']]
       +configTab(p, t[0], t[1])
+  +configTab(p, 'groups', 'Groups')
   +configTab(p, 'reboot', 'Reboot')
 
-mixin configPanes(r, returnTo)
+//- Groups tab: which resource groups this Client belongs to (thub run
+//- --group). Saved as a config revision the Client writes to its config
+//- file's `groups` (registry.setClientGroups); in effect on the Coordinator
+//- at once.
+mixin groupsPane(r, returnTo, groupsById)
+  - const p = `cfg-${r.id}`
+  - const canEdit = user.role === 'admin'
+  - const pending = r.config_import && r.config_import.revision > r.config_applied_revision && r.config_import.fields && r.config_import.fields.groups
+  - const all = Object.values(groupsById).sort((a, b) => a.name.localeCompare(b.name))
+  - const unknown = r.group_ids.filter((id) => !groupsById[id])
+  +configPane(p, 'groups')
+    if pending || r.config_error
+      .d-flex.justify-content-end.gap-1.mb-2
+        if pending
+          span.badge.text-bg-warning(
+            data-bs-toggle="tooltip"
+            data-bs-title="In effect on the Coordinator; the Client writes it to its config file on its next heartbeat, then restarts once idle"
+          ) not written to the Client yet
+        if r.config_error
+          span.badge.text-bg-danger(data-bs-toggle="tooltip" data-bs-title=r.config_error) refused by the Client
+    if !r.client_config_file
+      p.small.text-body-secondary This Client is too old to take its groups from the dashboard — update it, or set #[code groups] in its config file.
+    if !all.length && !unknown.length
+      p.small.text-body-secondary.mb-0
+        | No groups exist yet.
+        if canEdit
+          |  Create one on #[a(href="/groups") Groups].
+    else
+      form(
+        method="post"
+        action=`/resources/${r.id}/groups`
+        data-confirm=`Save the groups of ${r.name}? They apply at once; the Client also writes them to its config file and restarts once it has no job running.`
+        data-confirm-title="Save Client groups?"
+        data-confirm-ok="Save"
+        data-confirm-tone="primary"
+      )
+        input(type="hidden" name="returnTo" value=returnTo)
+        fieldset(disabled=!canEdit || !r.client_config_file)
+          .list-group.mb-2
+            each g in all
+              label.list-group-item.d-flex.gap-2.align-items-start
+                input.form-check-input.flex-shrink-0.mt-1(type="checkbox" name="groups" value=g.id checked=r.group_ids.includes(g.id))
+                span
+                  span.fw-medium= g.name
+                  if g.comment
+                    span.small.text-body-secondary= ` — ${g.comment}`
+                  br
+                  code.small.text-body-secondary= g.id
+            each id in unknown
+              label.list-group-item.d-flex.gap-2.align-items-start
+                input.form-check-input.flex-shrink-0.mt-1(type="checkbox" name="groups" value=id checked)
+                span
+                  span.text-body-secondary (deleted group)
+                  br
+                  code.small.text-body-secondary= id
+          .form-text A job run with #[code thub run --group <id>] is scheduled only on Clients in that group; one that asks for no group can run on any Client.
+          if canEdit && r.client_config_file
+            .d-flex.justify-content-end.mt-3
+              button.btn.btn-sm.btn-primary(type="submit") Save groups
+
+mixin configPanes(r, returnTo, groupsById)
   - const p = `cfg-${r.id}`
   - const current = r.config_desired || r.client_config
   - const canEdit = user.role === 'admin'
@@ -137,6 +198,7 @@ mixin configPanes(r, returnTo)
           +deviceTable('usbs', 'DUT USB devices', current.usbs || [], ['Device', 'udev devpath'])
           .form-text Device: a udev index 1–8 (→ /dev/thub/dut<N>-usb) or a /dev path. udev devpath: the USB port it's plugged into.
           +saveCapabilities(canEdit)
+  +groupsPane(r, returnTo, groupsById || {})
   +configPane(p, 'reboot')
     dl.row.mb-0
       +rebootScheduleRow(r, returnTo)

package/views/mixins/list-controls.pug

@@ -11,7 +11,7 @@ mixin pageSizePicker(list)
     label.small.text-body-secondary.mb-0.text-nowrap(for="list-page-size") Show
     select.form-select.form-select-sm.w-auto#list-page-size(
       aria-label="Records per page"
-      onchange="location.href = this.value"
+      data-navigate
     )
       each s in list.pageSizes
         option(value=list.urlFor({ size: s }) selected=list.prefs.size === s)= s === 'all' ? 'All' : s

package/views/mixins/log-viewer.pug

@@ -1,6 +1,7 @@
 mixin logViewer(jobId, jobActive)
   //- Stream filter + search (public/js/log-viewer.js): matches are
   //- highlighted; Enter / Shift+Enter or the arrows step through them.
+  //- The log loads from its end; earlier lines load as you scroll up.
   .d-flex.flex-wrap.align-items-center.gap-2.mb-2
     select#stream-filter.form-select.form-select-sm.w-auto(aria-label="Log stream")
       option(value="") all streams
@@ -28,6 +29,19 @@ mixin logViewer(jobId, jobActive)
     .form-check.form-check-inline.small.mb-0
       input#log-search-only.form-check-input(type="checkbox")
       label.form-check-label(for="log-search-only") Display only matching lines
+    a.btn.btn-sm.btn-outline-secondary.ms-auto(
+      href=`/jobs/${jobId}/log.txt`
+      target="_blank"
+      rel="noopener"
+      data-bs-toggle="tooltip"
+      data-bs-title="Open the full log as plain text in a new tab"
+    )
+      i.bi.bi-file-earmark-text.me-1
+      | Raw
+  //- "Showing the last 1,000 of 5,321 lines · Load all" (log-viewer.js).
+  .d-flex.flex-wrap.align-items-center.gap-2.small.text-body-secondary.mb-1(aria-live="polite")
+    span#log-info Loading log…
+    button#log-load-all.btn.btn-link.btn-sm.p-0.align-baseline(type="button" hidden) Load all
   pre#log-viewer.bg-body-tertiary.p-3.rounded.position-relative(
     style="height: 420px; overflow-y: auto;"
     data-job-id=jobId

package/views/mixins/resource.pug

@@ -324,7 +324,7 @@ mixin resourceCard(r, groupsById, returnTo)
           .tab-content
             .tab-pane.fade.show.active(id=`rc-${r.id}-details` role="tabpanel" aria-labelledby=`rc-${r.id}-details-tab` tabindex="0" data-live=`rc-details-${r.id}`)
               +resourceDetails(r, groupsById, returnTo, local, external)
-            +configPanes(r, returnTo)
+            +configPanes(r, returnTo, groupsById)
             .tab-pane.fade(id=`rc-${r.id}-usb` role="tabpanel" aria-labelledby=`rc-${r.id}-usb-tab` tabindex="0")
               +usbScanPane(r)
 
@@ -509,13 +509,6 @@ mixin resourceDetails(r, groupsById, returnTo, local, external)
           span.badge.text-bg-light.border.me-1= l
       else
         span.text-body-secondary —
-    dt.col-sm-4 Groups
-    dd.col-sm-8
-      if r.group_ids.length
-        each gid in r.group_ids
-          span.badge.text-bg-info.me-1(data-bs-toggle="tooltip" data-bs-title=gid)= groupsById[gid] ? groupsById[gid].name : `(unknown: ${gid})`
-      else
-        span.text-body-secondary —
     dt.col-sm-4 Busy source / reason
     dd.col-sm-8= r.busy_source ? `${r.busy_source}${r.busy_reason ? ' — ' + r.busy_reason : ''}` : '—'
     dt.col-sm-4 Last heartbeat

package/src/services/artifacts.js

@@ -1,149 +0,0 @@
-/**
- * @file        packages/coordinator/src/services/artifacts.js
- * @description Job artifact storage: saves uploaded files and generates download links
- *
- * @author      Andrian Yablonskyy
- * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
- *
- * This file is part of TestHub and is proprietary and confidential.
- * Unauthorized copying, modification, distribution, or use of this file,
- * via any medium, is strictly prohibited without prior written permission
- * from AdSystem.PRO.
- */
-
-'use strict';
-
-const fs = require('node:fs'),
-  path = require('node:path'),
-  crypto = require('node:crypto');
-
-// §3.1 / §12: stores uploaded result files under artifacts/<jobId>/ and
-// generates HMAC-signed, time-limited download links (no server-side
-// session needed for the Agent/CI to fetch them).
-function createArtifactsService(db, { config }){
-  const secret = config.sessionSecret;
-
-  function jobDir(jobId){
-    const dir = path.join(config.artifactsDir, jobId);
-    fs.mkdirSync(dir, { recursive: true });
-    return dir;
-  }
-
-  function sha256File(filePath){
-    const hash = crypto.createHash('sha256');
-    hash.update(fs.readFileSync(filePath));
-    return hash.digest('hex');
-  }
-
-  // `files` are multer file objects already written to a temp path.
-  function storeUploaded(jobId, files){
-    const dir = jobDir(jobId),
-      stored = [];
-    for (const file of files){
-      const dest = path.join(dir, path.basename(file.originalname));
-      fs.renameSync(file.path, dest);
-      const sha256 = sha256File(dest),
-        size = fs.statSync(dest).size,
-        info = db
-          .prepare(
-            `INSERT INTO artifacts (job_id, name, path, size, sha256, content_type, created_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?)`
-          )
-          .run(jobId, file.originalname, dest, size, sha256, file.mimetype, new Date().toISOString());
-      stored.push(get(info.lastInsertRowid));
-    }
-    return stored;
-  }
-
-  function storeGenerated(jobId, name, buffer, contentType){
-    const dir = jobDir(jobId),
-      dest = path.join(dir, name);
-    fs.writeFileSync(dest, buffer);
-    const info = db
-      .prepare(
-        `INSERT INTO artifacts (job_id, name, path, size, sha256, content_type, created_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?)`
-      )
-      .run(jobId, name, dest, buffer.length, sha256File(dest), contentType, new Date().toISOString());
-    return get(info.lastInsertRowid);
-  }
-
-  function get(id){
-    return db.prepare('SELECT * FROM artifacts WHERE id = ?').get(id);
-  }
-
-  function listForJob(jobId){
-    return db.prepare('SELECT * FROM artifacts WHERE job_id = ? ORDER BY id ASC').all(jobId);
-  }
-
-  function sign(artifactId, ttlHours = config.artifacts.linkTtlHours){
-    const expiresAt = Date.now() + ttlHours * 3600 * 1000,
-      payload = `${artifactId}.${expiresAt}`,
-      mac = crypto.createHmac('sha256', secret).update(payload).digest('base64url');
-    return `${payload}.${mac}`;
-  }
-
-  function verify(token){
-    const [artifactId, expiresAt, mac] = String(token).split('.');
-    if (!artifactId || !expiresAt || !mac){
-      throw invalidLink();
-    }
-    const payload = `${artifactId}.${expiresAt}`,
-      expectedMac = crypto.createHmac('sha256', secret).update(payload).digest('base64url');
-    if (!crypto.timingSafeEqual(Buffer.from(mac), Buffer.from(expectedMac))){
-      throw invalidLink();
-    }
-    if (Date.now() > Number(expiresAt)){
-      throw invalidLink('Link expired');
-    }
-    const artifact = get(Number(artifactId));
-    if (!artifact){
-      throw invalidLink();
-    }
-    return artifact;
-  }
-
-  function invalidLink(message = 'Invalid or expired link'){
-    return Object.assign(new Error(message), { status: 403 });
-  }
-
-  function signedUrl(artifact){
-    return `${config.publicUrl}/artifacts/download/${sign(artifact.id)}`;
-  }
-
-  // Removes a job's artifact files from disk (not the DB rows — the
-  // caller, jobs.js's cleanHistory, deletes those as part of the same
-  // transaction that also deletes the job itself).
-  function deleteJobArtifacts(jobId){
-    fs.rmSync(path.join(config.artifactsDir, jobId), { recursive: true, force: true });
-  }
-
-  function purgeOlderThan(days){
-    const cutoff = new Date(Date.now() - days * 86400 * 1000).toISOString(),
-      stale = db
-        .prepare(
-          `SELECT a.* FROM artifacts a JOIN jobs j ON j.id = a.job_id
-         WHERE j.finished_at IS NOT NULL AND j.finished_at <= ?`
-        )
-        .all(cutoff);
-    for (const artifact of stale){
-      fs.rmSync(artifact.path, { force: true });
-      db.prepare('DELETE FROM artifacts WHERE id = ?').run(artifact.id);
-    }
-  }
-
-  return {
-    storeUploaded,
-    storeGenerated,
-    get,
-    listForJob,
-    sign,
-    verify,
-    signedUrl,
-    purgeOlderThan,
-    deleteJobArtifacts,
-    jobDir
-  };
-}
-
-module.exports = { createArtifactsService };