@andrian.yablonskyy/thub-coordinator 1.0.39 → 1.0.40

package/test/agent-visibility.test.js

@@ -0,0 +1,85 @@
+/**
+ * @file        packages/coordinator/test/agent-visibility.test.js
+ * @description Tests: which jobs an agent token may see — a cli token only its own, a ci token all
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+test('a cli agent sees only its own jobs (others look like unknown ids); a ci agent sees all', async (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-vis-')),
+    file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({ dataDir: path.join(dir, 'data'), updates: { checkIntervalMin: 0 } }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  await new Promise((r) => server.on('listening', r));
+  services.registry.registerAuto({ clientId: 'c1', name: 'lab-sw-01', type: 'sw', labels: [] });
+
+  const base = `http://127.0.0.1:${server.address().port}/api/v1`,
+    alice = services.agents.create({ name: 'alice', kind: 'cli' }).token,
+    bob = services.agents.create({ name: 'bob', kind: 'cli' }).token,
+    ci = services.agents.create({ name: 'pipeline', kind: 'ci' }).token,
+    call = async (token, method, url, body) => {
+      const res = await fetch(`${base}${url}`, {
+        method,
+        headers: { authorization: `Bearer ${token}`, ...(body ? { 'content-type': 'application/json' } : {}) },
+        body: body ? JSON.stringify(body) : undefined
+      });
+      return { status: res.status, body: res.headers.get('content-type')?.includes('json') ? await res.json() : await res.text() };
+    },
+    submit = async (token) => (await call(token, 'POST', '/jobs', { target: { type: 'sw' }, command: './t.sh' })).body.jobId,
+    aliceJob = await submit(alice),
+    bobJob = await submit(bob),
+    ciJob = await submit(ci);
+
+  // Alice: her own job, every way of reading it.
+  assert.equal((await call(alice, 'GET', `/jobs/${aliceJob}`)).status, 200);
+  assert.equal((await call(alice, 'GET', `/jobs/${aliceJob}/logs`)).status, 200);
+  assert.equal((await call(alice, 'GET', `/jobs/${aliceJob}/artifacts`)).status, 200);
+
+  // Anyone else's job (a colleague's, a pipeline's): exactly like an id that doesn't exist.
+  const unknown = await call(alice, 'GET', '/jobs/M-99999');
+  for (const id of [bobJob, ciJob]){
+    for (const url of [`/jobs/${id}`, `/jobs/${id}/logs`, `/jobs/${id}/logs/stream`, `/jobs/${id}/artifacts`]){
+      const r = await call(alice, 'GET', url);
+      assert.equal(r.status, 404, url);
+      assert.deepEqual(r.body, unknown.body, url);
+    }
+    assert.equal((await call(alice, 'POST', `/jobs/${id}/cancel`)).status, 404);
+  }
+  assert.equal(services.jobs.get(bobJob).state, 'QUEUED'); // untouched
+
+  // Her list is her own jobs, --mine or not.
+  const ids = async (token, q = '') => (await call(token, 'GET', `/jobs${q}`)).body.jobs.map((j) => j.id).sort();
+  assert.deepEqual(await ids(alice), [aliceJob]);
+  assert.deepEqual(await ids(alice, '?mine=true'), [aliceJob]);
+
+  // A ci agent reads every job (and lists them all, or its own with --mine)…
+  assert.equal((await call(ci, 'GET', `/jobs/${aliceJob}`)).status, 200);
+  assert.equal((await call(ci, 'GET', `/jobs/${bobJob}/logs`)).status, 200);
+  assert.deepEqual(await ids(ci), [aliceJob, bobJob, ciJob].sort());
+  assert.deepEqual(await ids(ci, '?mine=1'), [ciJob]);
+  // …but still cancels only its own.
+  assert.equal((await call(ci, 'POST', `/jobs/${aliceJob}/cancel`)).status, 403);
+  assert.equal((await call(alice, 'POST', `/jobs/${aliceJob}/cancel`)).status, 200);
+});

package/test/groups-tab.test.js

@@ -0,0 +1,97 @@
+/**
+ * @file        packages/coordinator/test/groups-tab.test.js
+ * @description Tests: a Client's group membership set from the resource card's Groups tab
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+async function start(t){
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-grp-')),
+    file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({ dataDir: path.join(dir, 'data'), updates: { checkIntervalMin: 0 }, rateLimit: { loginPerMinute: 0 } }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  await new Promise((r) => server.on('listening', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+  services.adminUsers.create({ username: 'view', password: 'pw', role: 'viewer' });
+  const login = async (u) => (await fetch(`${base}/login`, {
+    method: 'POST', body: new URLSearchParams({ username: u, password: 'pw' }), redirect: 'manual'
+  })).headers.get('set-cookie').split(';')[0];
+  return { base, services, admin: await login('admin'), viewer: await login('view') };
+}
+
+// A Client recent enough to report its config file (what Import needs too).
+const register = (services, name, { configFile = { name, type: 'sw' } } = {}) => services.registry.registerAuto({
+  clientId: `id-${name}`, name, type: 'sw', labels: [], config: {}, ...(configFile ? { configFile } : {})
+}).resourceId;
+
+test('Groups tab: in effect at once, sent to the Client as its next config revision', async (t) => {
+  const { base, services, admin, viewer } = await start(t),
+    nightly = services.groups.create({ name: 'nightly' }),
+    pr = services.groups.create({ name: 'pr-pool', comment: 'pull requests' }),
+    id = register(services, 'lab-sw-01'),
+    save = (cookie, groups) => fetch(`${base}/resources/${id}/groups`, {
+      method: 'POST', headers: { cookie }, body: new URLSearchParams([...groups.map((g) => ['groups', g]), ['returnTo', '/resources']]), redirect: 'manual'
+    }),
+    page = async () => (await fetch(`${base}/resources`, { headers: { cookie: admin } })).text();
+
+  assert.equal((await save(viewer, [nightly.id])).status, 403);
+  assert.equal((await save(admin, [nightly.id, pr.id])).status, 302);
+  const r = services.registry.get(id);
+  assert.deepEqual(r.group_ids.sort(), [nightly.id, pr.id].sort()); // scheduling follows now
+  const pending = services.registry.pendingConfig(id);
+  assert.equal(pending.revision, 1);
+  assert.deepEqual(pending.file.groups.sort(), [nightly.id, pr.id].sort()); // the Client writes it to its file
+  assert.match(await page(), /Groups of lab-sw-01 saved: 2 group\(s\) — in effect now/);
+
+  // The tab, with every group as a checkbox; no Groups line on Details any more.
+  const html = await page();
+  assert.match(html, new RegExp(`name="groups" value="${pr.id}" checked`));
+  assert.match(html, /data-config-tab="groups"/);
+  assert.match(html, /not written to the Client yet/);
+  assert.doesNotMatch(html, /<dt class="col-sm-4">Groups<\/dt>/);
+
+  // None at all: allowed.
+  await save(admin, []);
+  assert.deepEqual(services.registry.get(id).group_ids, []);
+});
+
+test('Groups tab: keeps other pending changes; refuses unknown groups and Clients too old for it', async (t) => {
+  const { services } = await start(t),
+    g = services.groups.create({ name: 'g' }),
+    id = register(services, 'lab-sw-02');
+
+  // An Import not applied yet: its fields go along with the groups.
+  services.registry.importClientConfig(id, { labels: ['board:x'] }, { by: 'admin' });
+  services.registry.setClientGroups(id, [g.id], { by: 'admin', knownGroupIds: [g.id] });
+  assert.deepEqual(services.registry.pendingConfig(id).file, { labels: ['board:x'], groups: [g.id] });
+  // A device save meanwhile doesn't drop them either.
+  services.registry.setClientConfig(id, {}, { by: 'admin' });
+  assert.deepEqual(services.registry.pendingConfig(id).file.groups, [g.id]);
+
+  assert.throws(() => services.registry.setClientGroups(id, ['no-such-group'], { knownGroupIds: [g.id] }), /Unknown group/);
+  const old = register(services, 'lab-old', { configFile: null });
+  assert.throws(() => services.registry.setClientGroups(old, [g.id], { knownGroupIds: [g.id] }), /too old to take its groups/);
+});

package/test/job-artifacts.test.js

@@ -0,0 +1,115 @@
+/**
+ * @file        packages/coordinator/test/job-artifacts.test.js
+ * @description Tests: artifacts a job reports (metadata only) — validation, storage with the result, the job page and the Agent API
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { sanitizeArtifacts, normalizeTimestamp, formatBytes, MAX_ARTIFACTS } = require('../src/services/job-artifacts'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+test('formatBytes: B, KB, MB, GB …, 1024-based', () => {
+  assert.equal(formatBytes(0), '0 B');
+  assert.equal(formatBytes(1023), '1023 B');
+  assert.equal(formatBytes(1233), '1.2 KB');
+  assert.equal(formatBytes(15 * 1024), '15 KB');
+  assert.equal(formatBytes(5.5 * 1024 ** 2), '5.5 MB');
+  assert.equal(formatBytes(3 * 1024 ** 3), '3.0 GB');
+  assert.equal(formatBytes(2 * 1024 ** 4), '2.0 TB');
+  assert.equal(formatBytes(-1), '—');
+});
+
+test('timestamps: Unix seconds, Unix milliseconds or ISO dates', () => {
+  assert.equal(normalizeTimestamp(1790000000), '2026-09-21T14:13:20.000Z');
+  assert.equal(normalizeTimestamp(1790000000123), '2026-09-21T14:13:20.123Z');
+  assert.equal(normalizeTimestamp('1790000000'), '2026-09-21T14:13:20.000Z');
+  assert.equal(normalizeTimestamp('2026-09-21T14:13:20Z'), '2026-09-21T14:13:20.000Z');
+  assert.equal(normalizeTimestamp(1234), '1970-01-01T00:20:34.000Z'); // small numbers are seconds
+  assert.equal(normalizeTimestamp('soon'), null);
+  assert.equal(normalizeTimestamp(undefined), null);
+});
+
+test('sanitizeArtifacts keeps valid entries, only http(s) links, and drops the rest', () => {
+  const { artifacts, dropped } = sanitizeArtifacts([
+    { name: 'app.bin', size: 1233, link: 'https://artifactory.example.com/fw/app.bin', timestamp: 1790000000 },
+    { name: ' report.html ', link: 'http://files.lab/r.html' }, // size/timestamp optional
+    { name: 'evil', size: 1, link: 'javascript:alert(1)' },
+    { name: 'data', link: 'data:text/html,<script>x</script>' },
+    { name: '', link: 'https://x.example/a' },
+    { name: 'no-link' },
+    { name: 'neg', size: -5, link: 'https://x.example/n' }, // bad size: kept, size unknown
+    'not an object'
+  ]);
+  assert.equal(dropped, 5);
+  assert.deepEqual(artifacts, [
+    { name: 'app.bin', size: 1233, link: 'https://artifactory.example.com/fw/app.bin', timestamp: '2026-09-21T14:13:20.000Z' },
+    { name: 'report.html', size: null, link: 'http://files.lab/r.html', timestamp: null },
+    { name: 'neg', size: null, link: 'https://x.example/n', timestamp: null }
+  ]);
+  const many = sanitizeArtifacts(Array.from({ length: MAX_ARTIFACTS + 3 }, (_, i) => ({ name: `f${i}`, link: `https://x.example/${i}` })));
+  assert.equal(many.artifacts.length, MAX_ARTIFACTS);
+  assert.equal(many.dropped, 3);
+  assert.deepEqual(sanitizeArtifacts(undefined), { artifacts: [], dropped: 0 });
+});
+
+test('a finished job\'s reported artifacts: stored with the result, on the job page and via the Agent API', async (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-art-')),
+    file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({ dataDir: path.join(dir, 'data'), updates: { checkIntervalMin: 0 }, rateLimit: { loginPerMinute: 0 } }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  await new Promise((r) => server.on('listening', r));
+  const base = `http://127.0.0.1:${server.address().port}`,
+    { resourceId, resourceToken } = services.registry.registerAuto({ clientId: 'c1', name: 'lab-sw-01', type: 'sw', labels: [] }),
+    { agent, token } = services.agents.create({ name: 'ci', kind: 'ci' }),
+    job = services.jobs.create({ agentId: agent.id, source: 'ci', spec: { target: { type: 'sw' }, command: './t.sh' } }),
+    asClient = (url, body) => fetch(`${base}/api/v1${url}`, {
+      method: 'POST', headers: { authorization: `Bearer ${resourceToken}`, 'content-type': 'application/json' }, body: JSON.stringify(body)
+    });
+  services.db.prepare('UPDATE jobs SET resource_id = ?, state = ? WHERE id = ?').run(resourceId, 'RUNNING', job.id);
+
+  const result = await asClient(`/jobs/${job.id}/result`, {
+    state: 'PASSED', exitCode: 0, summary: { total: 1, passed: 1, failed: 0, skipped: 0 },
+    artifacts: [
+      { name: 'app.bin', size: 1233, link: 'https://artifactory.example.com/fw/app.bin', timestamp: 1790000000 },
+      { name: 'x', link: 'javascript:alert(1)' }
+    ]
+  });
+  assert.equal(result.status, 200);
+  assert.deepEqual(services.jobs.get(job.id).artifacts.map((a) => a.name), ['app.bin']);
+
+  // Agent API: in the job, and on its own (with `url` for older Agents).
+  const agentGet = (url) => fetch(`${base}/api/v1${url}`, { headers: { authorization: `Bearer ${token}` } }).then((r) => r.json());
+  assert.equal((await agentGet(`/jobs/${job.id}`)).artifacts[0].link, 'https://artifactory.example.com/fw/app.bin');
+  assert.equal((await agentGet(`/jobs/${job.id}/artifacts`)).artifacts[0].url, 'https://artifactory.example.com/fw/app.bin');
+
+  // The job page.
+  services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+  const cookie = (await fetch(`${base}/login`, {
+      method: 'POST', body: new URLSearchParams({ username: 'admin', password: 'pw' }), redirect: 'manual'
+    })).headers.get('set-cookie').split(';')[0],
+    html = await (await fetch(`${base}/jobs/${job.id}`, { headers: { cookie } })).text();
+  assert.match(html, /<a href="https:\/\/artifactory\.example\.com\/fw\/app\.bin" target="_blank" rel="noopener noreferrer">app\.bin<\/a>/);
+  assert.match(html, />1\.2 KB</);
+  assert.match(html, /21\/09\/2026 14:13:20/); // the admin's time zone (UTC)
+  assert.doesNotMatch(html, /javascript:alert/);
+});

package/test/login-guard.test.js

@@ -0,0 +1,139 @@
+/**
+ * @file        packages/coordinator/test/login-guard.test.js
+ * @description Tests: sign-in protection — backoff per IP and per username, async password checks, no username enumeration by timing
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { createLoginGuard } = require('../src/login-guard'),
+  { openDb } = require('../src/db'),
+  { createAdminUsersService } = require('../src/services/admin-users'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+test('backoff: per IP from the 5th failure, doubling up to 15 min; a success clears it', () => {
+  let t = 0;
+  const guard = createLoginGuard({ now: () => t });
+  for (let i = 0; i < 4; i++){
+    guard.failure('10.0.0.1', `u${i}`); // different names: only the IP counts up
+    assert.equal(guard.check('10.0.0.1', 'any').ok, true);
+  }
+  guard.failure('10.0.0.1', 'u4'); // 5th
+  assert.deepEqual(guard.check('10.0.0.1', 'any'), { ok: false, reason: 'backoff', retryAfterSec: 1 });
+  assert.equal(guard.check('10.0.0.2', 'any').ok, true); // another address isn't affected
+  t += 1000;
+  guard.failure('10.0.0.1', 'u5'); // 6th: 2 s
+  assert.equal(guard.check('10.0.0.1', 'any').retryAfterSec, 2);
+  for (let i = 0; i < 20; i++){
+    guard.failure('10.0.0.1', `v${i}`);
+  }
+  assert.equal(guard.check('10.0.0.1', 'any').retryAfterSec, 15 * 60); // capped
+  guard.success('10.0.0.1', 'admin');
+  assert.equal(guard.check('10.0.0.1', 'any').ok, true);
+});
+
+test('backoff: per username from the 10th failure, from any address, up to 5 min; forgotten after an hour', () => {
+  let t = 0;
+  const guard = createLoginGuard({ now: () => t });
+  for (let i = 0; i < 9; i++){
+    guard.failure(`10.0.1.${i}`, 'Admin'); // one guess per address
+  }
+  assert.equal(guard.check('10.0.9.9', 'admin').ok, true);
+  guard.failure('10.0.1.9', ' ADMIN '); // 10th, any spelling
+  assert.equal(guard.check('10.0.9.9', 'admin').ok, false); // even from a fresh address
+  for (let i = 0; i < 30; i++){
+    guard.failure(`10.0.2.${i}`, 'admin');
+  }
+  assert.equal(guard.check('10.0.9.9', 'admin').retryAfterSec, 5 * 60); // capped, its owner isn't locked out for long
+  t += 61 * 60 * 1000;
+  assert.equal(guard.check('10.0.9.9', 'admin').ok, true);
+});
+
+test('a limit on password checks running at once', async () => {
+  const guard = createLoginGuard({ maxConcurrent: 1 });
+  let release;
+  const running = guard.run(() => new Promise((r) => (release = r)));
+  assert.deepEqual(guard.check('ip', 'u'), { ok: false, reason: 'busy', retryAfterSec: 1 });
+  release();
+  await running;
+  assert.equal(guard.check('ip', 'u').ok, true);
+});
+
+test('password checks don\'t block the event loop, and an unknown user takes as long as a wrong password', async () => {
+  const users = createAdminUsersService(openDb(':memory:'));
+  users.create({ username: 'alice', password: 'correct horse', role: 'admin' });
+
+  // Timers keep firing while four checks run (scryptSync would stall them all).
+  let last = performance.now(),
+    worstGap = 0;
+  const ticker = setInterval(() => {
+    const now = performance.now();
+    worstGap = Math.max(worstGap, now - last);
+    last = now;
+  }, 5);
+  await Promise.all([1, 2, 3, 4].map(() => users.verify('alice', 'wrong')));
+  clearInterval(ticker);
+  assert.ok(worstGap < 60, `event loop stalled for ${worstGap.toFixed(0)} ms`);
+
+  const time = async (name) => {
+      const start = performance.now();
+      for (let i = 0; i < 4; i++){
+        assert.equal(await users.verify(name, 'wrong'), null);
+      }
+      return performance.now() - start;
+    },
+    known = await time('alice'),
+    unknown = await time('nobody');
+  assert.ok(unknown > known * 0.5 && unknown < known * 2, `unknown user ${unknown.toFixed(0)} ms vs wrong password ${known.toFixed(0)} ms`);
+  assert.ok((await users.verify('alice', 'correct horse')).id);
+});
+
+test('sign-in page: a locked-out guesser gets 429 with Retry-After, before any password is checked', async (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-guard-')),
+    file = path.join(dir, 'coordinator.json');
+  // The per-IP sign-in budget off, to see the backoff on its own.
+  fs.writeFileSync(file, JSON.stringify({ dataDir: path.join(dir, 'data'), updates: { checkIntervalMin: 0 }, rateLimit: { loginPerMinute: 0 } }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  await new Promise((r) => server.on('listening', r));
+  services.adminUsers.create({ username: 'admin', password: 'right', role: 'admin' });
+  const base = `http://127.0.0.1:${server.address().port}`,
+    // The test reaches the Coordinator over loopback, which trustProxy
+    // trusts: X-Forwarded-For stands in for different client addresses.
+    login = (ip, username, password) => fetch(`${base}/login`, {
+      method: 'POST', headers: { 'X-Forwarded-For': ip }, body: new URLSearchParams({ username, password }), redirect: 'manual'
+    }),
+    verify = t.mock.method(services.adminUsers, 'verify');
+
+  for (let i = 0; i < 5; i++){
+    assert.equal((await login('203.0.113.7', `guess${i}`, 'x')).status, 401);
+  }
+  const locked = await login('203.0.113.7', 'admin', 'right'); // even the right password waits
+  assert.equal(locked.status, 429);
+  assert.equal(locked.headers.get('retry-after'), '1');
+  assert.match(await locked.text(), /Too many failed sign-ins — try again in 1 s/);
+  assert.equal(verify.mock.callCount(), 5); // the 6th never reached a password check
+
+  assert.equal((await login('198.51.100.1', 'admin', 'right')).status, 302); // the owner, elsewhere, signs in
+  await new Promise((r) => setTimeout(r, 1100));
+  assert.equal((await login('203.0.113.7', 'admin', 'right')).status, 302); // after the wait, and a success clears it
+  assert.equal((await login('203.0.113.7', 'nobody', 'x')).status, 401); // counting starts over
+});

package/test/logs.test.js

@@ -113,7 +113,7 @@ test('RAW: the whole log as plain text, for as long as the job exists', async (t
 test('artifacts are gone: old Clients\' uploads are discarded, old Agents get none, the store is removed', async (t) => {
   const { base, services, job } = await setup(t, 3),
     { resourceId, resourceToken } = services.registry.registerAuto({ clientId: 'c9', name: 'lab-hw-09', type: 'hw', labels: [] }),
-    { token: agentToken } = services.agents.create({ name: 'old-agent', kind: 'cli' });
+    { token: agentToken } = services.agents.create({ name: 'old-agent', kind: 'ci' });
   services.db.prepare('UPDATE jobs SET resource_id = ? WHERE id = ?').run(resourceId, job.id);
 
   // An old Client still uploads its results after the job: accepted (so the

package/test/rate-limit.test.js

@@ -0,0 +1,106 @@
+/**
+ * @file        packages/coordinator/test/rate-limit.test.js
+ * @description Tests: request rate limiting — token buckets per credential (IP without one), the sign-in limit, configuration
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { createBuckets } = require('../src/rate-limit'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+test('token bucket: a burst up to the limit, then refills at limit per minute', () => {
+  const b = createBuckets(),
+    t0 = 1_000_000;
+  for (let i = 0; i < 5; i++){
+    assert.equal(b.take('k', 5, t0).ok, true);
+  }
+  const refused = b.take('k', 5, t0);
+  assert.equal(refused.ok, false);
+  assert.equal(refused.retryAfterSec, 12); // one token per 60/5 s
+  assert.equal(b.take('k', 5, t0 + 12_000).ok, true); // refilled one
+  assert.equal(b.take('k', 5, t0 + 12_000).ok, false);
+  assert.equal(b.take('other', 5, t0).ok, true); // its own bucket
+  b.prune(() => 5, t0 + 120_000); // full again = forgotten
+  assert.equal(b.size(), 0);
+});
+
+async function start(t, rateLimit){
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-rl-')),
+    file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({
+    dataDir: path.join(dir, 'data'), sessionSecret: 'test-secret-test-secret', updates: { checkIntervalMin: 0 }, rateLimit
+  }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  await new Promise((r) => server.on('listening', r));
+  return { base: `http://127.0.0.1:${server.address().port}`, services, config };
+}
+
+test('per credential: each token has its own budget, even from one IP; unknown tokens count by IP', async (t) => {
+  const { base, services } = await start(t, { requestsPerMinute: 3, loginPerMinute: 0 }),
+    tokenA = services.agents.create({ name: 'a', kind: 'ci' }).token,
+    tokenB = services.agents.create({ name: 'b', kind: 'ci' }).token,
+    get = (token) => fetch(`${base}/api/v1/resources`, { headers: token ? { authorization: `Bearer ${token}` } : {} });
+
+  for (let i = 0; i < 3; i++){
+    assert.equal((await get(tokenA)).status, 200);
+  }
+  const refused = await get(tokenA);
+  assert.equal(refused.status, 429);
+  assert.equal(refused.headers.get('retry-after'), '20');
+  assert.equal(refused.headers.get('ratelimit-limit'), '3');
+  assert.match((await refused.json()).error, /Too many requests: try again in 20 s/);
+  assert.equal((await get(tokenB)).status, 200); // a Client behind the same NAT isn't affected
+
+  // Random tokens all land in the one IP bucket — no dodging the limit.
+  for (let i = 0; i < 3; i++){
+    assert.equal((await get(`agt_fake${i}`)).status, 401);
+  }
+  assert.equal((await get('agt_fake9')).status, 429);
+});
+
+test('sign-in attempts have their own small limit; 0 turns limits off; a dashboard change applies at once', async (t) => {
+  const { base, services, config } = await start(t, { requestsPerMinute: 500, loginPerMinute: 3 }),
+    login = () => fetch(`${base}/login`, { method: 'POST', body: new URLSearchParams({ username: 'x', password: 'y' }), redirect: 'manual' });
+  for (let i = 0; i < 3; i++){
+    assert.equal((await login()).status, 401);
+  }
+  const refused = await login();
+  assert.equal(refused.status, 429);
+  assert.match(await refused.text(), /Too many sign-in attempts/);
+  assert.equal((await fetch(`${base}/login`)).status, 200); // viewing the page isn't an attempt
+
+  services.settings.save({ changes: { 'rateLimit.loginPerMinute': '0', 'rateLimit.requestsPerMinute': '0' } });
+  assert.equal(config.rateLimit.loginPerMinute, 0);
+  assert.equal((await login()).status, 401); // no longer limited
+  assert.equal((await fetch(`${base}/login`)).headers.get('ratelimit-limit'), null);
+});
+
+test('config: rateLimit values must be whole numbers, 0 or more', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-rl-')),
+    file = path.join(dir, 'coordinator.json'),
+    write = (rateLimit) => fs.writeFileSync(file, JSON.stringify({ dataDir: path.join(dir, 'data'), rateLimit }));
+  write(undefined);
+  assert.deepEqual(loadConfig(file).rateLimit, { requestsPerMinute: 500, loginPerMinute: 10 });
+  write({ requestsPerMinute: -1 });
+  assert.throws(() => loadConfig(file), /rateLimit\.requestsPerMinute must be a whole number/);
+});