@andrian.yablonskyy/thub-coordinator 1.1.1 → 1.1.2

package/README.md

@@ -14,7 +14,7 @@ This gives you two global commands: `thub-coordinator` (the server itself) and `
 
 - `~/.config/thub/coordinator.json` with every default option (see Configuration below), if it doesn't exist yet.
 - `~/var/lib/thub` (the `dataDir`: SQLite DB, uploaded artifacts, avatars) with its `artifacts/`, `avatars/` and `work/` subdirectories.
-- On Linux as root: `/etc/systemd/system/thub-coordinator.service`, enabled and started, so the Coordinator runs now and on every boot. A re-install/upgrade restarts it on the new code.
+- On Linux as root: `/etc/systemd/system/thub-coordinator.service` (`ProtectSystem=strict` with a private writable `/tmp`, which SQLite needs), enabled and started, so the Coordinator runs now and on every boot. A re-install/upgrade restarts it on the new code.
 
 Under `sudo`, `~` means the home of the user who ran `sudo` (`SUDO_USER`), not `/root`. That user owns the config and data and the service runs as them. Without root the config and directories are still created; the systemd step is skipped.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andrian.yablonskyy/thub-coordinator",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "TestHub Coordinator — job queue, resource registry, scheduler, heartbeat monitor, log/artifact store and web dashboard",
   "main": "src/server.js",
   "engines": {

package/src/web/routes.js

@@ -1189,10 +1189,12 @@ function createWebRouter({ services, config }){
   // the page the action returns — never stored anywhere.
   // Searched (?q=), filtered by role (?role=user|maintainer|admin|blocked),
   // sorted and paged like the other lists (§10.1).
-  const USER_ROLE_FILTERS = ['user', 'maintainer', 'admin', 'blocked'],
+  const USER_ROLE_FILTERS = ['admin', 'maintainer', 'user', 'blocked'],
     ROLE_ORDER = { user: 0, maintainer: 1, admin: 2 },
+    // What the User column shows: first and last name, else the username.
+    userDisplayName = (u) => `${u.firstName || ''} ${u.lastName || ''}`.trim() || u.username,
     USER_SORT_VALUE = {
-      username: (u) => u.username.toLowerCase(),
+      username: (u) => userDisplayName(u).toLowerCase(),
       role: (u) => ROLE_ORDER[u.role],
       status: (u) => (u.blocked ? 1 : 0),
       used: (u) => u.key?.lastUsedAt || null
@@ -1230,6 +1232,7 @@ function createWebRouter({ services, config }){
       total: searched.length,
       roleFilter: role,
       roleFilters: USER_ROLE_FILTERS,
+      userDisplayName,
       roleCounts,
       list: { ...view, pagination, pageUrl, q },
       q,

package/systemd/thub-coordinator.service

@@ -16,6 +16,10 @@ Restart=always
 RestartSec=2
 NoNewPrivileges=yes
 ProtectSystem=strict
+# A private, writable /tmp: ProtectSystem=strict makes the shared one
+# read-only, and SQLite needs temp files for big sorts (a migration that
+# rebuilds a table and its index) — without them: SQLITE_IOERR_GETTEMPPATH.
+PrivateTmp=yes
 ReadWritePaths=/var/lib/thub/var/lib/thub
 
 [Install]

package/test/systemd-unit.test.js

@@ -0,0 +1,25 @@
+/**
+ * @file        packages/coordinator/test/systemd-unit.test.js
+ * @description Tests: the shipped systemd unit lets SQLite write its temp files
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  path = require('node:path');
+
+test('systemd unit: ProtectSystem=strict comes with a private writable /tmp (SQLITE_IOERR_GETTEMPPATH)', () => {
+  const unit = fs.readFileSync(path.join(__dirname, '../systemd/thub-coordinator.service'), 'utf8');
+  assert.match(unit, /^ProtectSystem=strict$/m);
+  assert.match(unit, /^PrivateTmp=yes$/m);
+});

package/test/users.test.js

@@ -245,7 +245,7 @@ test('Users page: quick filter by role with counts, sorting and pages; role desc
       method: 'POST', body: new URLSearchParams({ username: 'root', password: 'pw' }), redirect: 'manual'
     })).headers.get('set-cookie').split(';')[0],
     page = (q) => fetch(`${base}/admin/users${q}`, { headers: { cookie } }).then((r) => r.text()),
-    names = (html) => [...html.matchAll(/<div class="fw-medium">([^<]+)/g)].map((m) => m[1]),
+    names = (html) => [...html.matchAll(/<a class="fw-medium" href="#editUser-[^"]+"[^>]*>([^<]+)/g)].map((m) => m[1]),
 
     users = await page('?role=user&size=10');
   assert.match(users, /Showing 1–10 of 12 users/); // before the two below are added
@@ -259,6 +259,9 @@ test('Users page: quick filter by role with counts, sorting and pages; role desc
   assert.match(users, /href="\/admin\/users\?role=user&amp;size=10&amp;sort=username&amp;dir=asc&amp;page=2"/); // pages keep the filter
   assert.deepEqual(names(await page('?role=blocked')), ['mo']);
   assert.match(users, />Maintainer<span class="badge/); // filter buttons
+  const filterNav = users.slice(users.indexOf('aria-label="Filter by role"'), users.indexOf('</nav>', users.indexOf('aria-label="Filter by role"')));
+  assert.deepEqual([...filterNav.matchAll(/<a [^>]*>([^<]+)</g)].map((m) => m[1].trim()), ['All', 'Admin', 'Maintainer', 'User', 'Blocked']);
+  assert.doesNotMatch(users, /d1@example\.com<\/div>|>Edit<\/button>/); // the name only; it opens Edit
   assert.match(users, /href="[^"]*role=maintainer/); // …while values stay lowercase
   assert.deepEqual(names(await page('?role=admin&size=all')), ['root']);
   assert.deepEqual(names(await page('?role=&sort=role&dir=desc&size=all')).slice(0, 2), ['root', 'mo']); // admin, maintainer, users…
@@ -267,3 +270,19 @@ test('Users page: quick filter by role with counts, sorting and pages; role desc
   assert.match(users, /<option value="user" selected="selected" data-help="Agent only[^"]*">User<\/option>/);
   assert.match(users, /<div class="form-text" id="new-role-help" aria-live="polite">Agent only/);
 });
+
+test('Users page: the User column shows first and last name, sorts by it, and opens Edit', async (t) => {
+  const { base, services } = await start(t),
+    u = services.adminUsers;
+  u.create({ username: 'root', email: 'r@example.com', role: 'admin', password: 'pw' });
+  const zed = u.create({ username: 'aaa', email: 'a@example.com', role: 'user', firstName: 'Zed', lastName: 'Young' });
+  u.create({ username: 'zzz', email: 'z@example.com', role: 'user', firstName: 'Ann' });
+  const cookie = (await fetch(`${base}/login`, {
+      method: 'POST', body: new URLSearchParams({ username: 'root', password: 'pw' }), redirect: 'manual'
+    })).headers.get('set-cookie').split(';')[0],
+    html = await (await fetch(`${base}/admin/users?sort=username&dir=asc&size=all`, { headers: { cookie } })).text(),
+    cells = [...html.matchAll(/<a class="fw-medium" href="#editUser-([^"]+)"[^>]*>([^<]+)/g)];
+  assert.deepEqual(cells.map((m) => m[2]), ['Ann', 'root', 'Zed Young']); // no name → the username
+  assert.equal(cells[2][1], zed.id);
+  assert.match(html, new RegExp(`id="editUser-${zed.id}"`)); // the modal it opens
+});

package/views/admin/users.pug

@@ -68,17 +68,10 @@ block content
     tbody
       each u in users
         tr(class=u.blocked ? 'opacity-50' : '')
+          //- Just the name (the username until one is set); it opens Edit,
+          //- where the username, email and the rest are.
           td
-            .fw-medium
-              = u.username
-              if u.id === me.id
-                span.badge.text-bg-light.border.ms-1 you
-            if u.firstName || u.lastName
-              .small= `${u.firstName || ''} ${u.lastName || ''}`.trim()
-            if u.email
-              .small.text-body-secondary= u.email
-            else
-              span.badge.text-bg-warning(data-bs-toggle="tooltip" data-bs-title="Every user needs an email — add it with Edit") no email
+            a.fw-medium(href=`#editUser-${u.id}` data-bs-toggle="modal" role="button")= userDisplayName(u)
           td
             span.badge(class=`text-bg-${roleTone[u.role]}` data-bs-toggle="tooltip" data-bs-title=roleHelp[u.role])= roleLabel(u.role)
           td
@@ -98,8 +91,7 @@ block content
             else
               span.text-body-secondary none
           td.text-end.text-nowrap
-            button.btn.btn-sm.btn-outline-secondary(type="button" data-bs-toggle="modal" data-bs-target=`#editUser-${u.id}` aria-label=`Edit ${u.username}`) Edit
-            form.d-inline.ms-1(
+            form.d-inline(
               method="post"
               action=`/admin/users/${u.id}/key`
               data-confirm=u.key ? `Issue a new access key for ${u.username}? Their current key stops working at once.` : `Create an access key for ${u.username}?`

package/views/help/_client-setup.pug

@@ -103,7 +103,10 @@
   p.small.
     SW Clients have no settings of their own: they run whatever DUT image a job brings (#[code --docker-image]).
     Admins can also edit an HW Client's devices from its resource card (#[strong ST-Link | UART | DUT USB]
-    tabs). #[strong Connected USB devices → Import to config] fills them from the host's #[code lsusb].
+    tabs). The tabs show the config the Client runs, as it reported it at its last start, or a saved
+    change it hasn't applied yet. #[strong Connected USB devices → Import to config] fills them from the host's #[code lsusb].
+    There's no ST-Link serial field: the job's #[code --command] picks the probe
+    (#[code $THUB_DUT_STLINK_<n>]), and the Client reads each serial from its udev symlink.
 
   h3.h6 Several DUT slots on one machine
   +code('One instance per slot').

package/views/help/_coordinator.pug

@@ -13,6 +13,8 @@
     #[code ~/.config/thub/coordinator.json] (with a random #[code sessionSecret]) and
     #[code ~/var/lib/thub] (database, avatars). It installs, enables and starts
     #[code thub-coordinator.service], plus the root helper behind the navbar's #[strong Update app] button.
+    The unit uses #[code ProtectSystem=strict] with #[code PrivateTmp=yes], so the data directory and a
+    private #[code /tmp] (SQLite's temp files) are the only places the service can write.
 
   h3.h6 2. Configure
   p.small.
@@ -123,6 +125,9 @@
     thub-admin resource maintenance <resourceId> --on
     thub-admin jobs reset --yes                             # cancel every active job
     thub-admin jobs clean --yes --before "01/09/2026 00:00:00"
+  p.small.
+    On #[a(href="/admin/users") Users] (admins), click a name to edit that user. The quick filter is
+    #[strong All | Admin | Maintainer | User | Blocked]. The search box also matches usernames and emails.
   +note('warning').
     Forgot the admin password? Start the Coordinator once with #[code THUB_BOOTSTRAP_ADMIN_PASSWORD=…]
     (and optionally #[code THUB_BOOTSTRAP_ADMIN_USER], default #[code admin]). The password is reset on

package/views/help/_troubleshooting.pug

@@ -21,6 +21,7 @@
       ['429 Too Many Requests', 'A caller went over `rateLimit.requestsPerMinute` (per agent or resource token, per dashboard user, else per IP; default 500). The Agent and Client wait for `Retry-After` and retry by themselves; a script calling the API should do the same. Raise the limit in the config file or on Settings if your normal traffic needs more (a Client streaming logs makes up to ~240 requests a minute). Too many sign-in attempts from one address: wait a minute (`rateLimit.loginPerMinute`).'],
       ['Sign-in says “Too many failed sign-ins”', 'After repeated wrong passwords the Coordinator makes each further attempt wait, doubling each time: per address from the 5th failure (up to 15 min), per username from the 10th from any address (up to 5 min). Wait the time shown, or sign in from another address; a successful sign-in clears it, and an hour without failures forgets it. The Coordinator never tells whether a username exists.'],
       ['Agent says “Invalid or revoked access key” or “… is blocked”', 'The key was replaced (`thub key rotate`, an admin, your profile) or revoked, or your user is blocked. Ask an admin for a new key (Users), or create one on your profile if you can sign in. Then `thub config set key <key>`; `thub whoami` checks it.'],
+      ['The Coordinator won\'t start after an upgrade: `SqliteError: disk I/O error` (`SQLITE_IOERR_GETTEMPPATH`)', 'Its systemd unit is older than 1.1.1: it has `ProtectSystem=strict` without `PrivateTmp=yes`, so SQLite has no writable temp directory for a large migration. The migration rolls back, so no data is lost. Install the latest version with `sudo npm i -g @andrian.yablonskyy/thub-coordinator` (the dashboard can\'t update a Coordinator that\'s down), or run `sudo systemctl edit thub-coordinator`, add `[Service]` and `PrivateTmp=yes`, then `sudo systemctl restart thub-coordinator`.'],
       ['Locked out of the dashboard', 'Restart the Coordinator once with `THUB_BOOTSTRAP_ADMIN_PASSWORD=<new>` (resets the `admin` user), then unset it.']
     ]
     const withCode = (text) => text