@andrian.yablonskyy/thub-coordinator 1.1.7 → 1.1.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andrian.yablonskyy/thub-coordinator",
-  "version": "1.1.7",
+  "version": "1.1.8",
   "description": "TestHub Coordinator — job queue, resource registry, scheduler, heartbeat monitor, log/artifact store and web dashboard",
   "main": "src/server.js",
   "engines": {

package/src/db/migrations/029_agent_deleted.sql

@@ -0,0 +1,3 @@
+-- Deleting a CI token (dashboard): its token stops working and it leaves the
+-- CI tokens list, but the row stays — its jobs reference it and keep its name.
+ALTER TABLE agents ADD COLUMN deleted_at TEXT;

package/src/services/agents.js

@@ -29,8 +29,8 @@ function createAgentsService(db, { events }){
   }
 
   function list(){
-    return db.prepare('SELECT id, name, kind, user_id, group_id, version, update_to, created_at, last_used_at, revoked_at FROM agents ORDER BY created_at DESC')
-      .all();
+    return db.prepare(`SELECT id, name, kind, user_id, group_id, version, update_to, created_at, last_used_at, revoked_at, token_created_at
+                       FROM agents WHERE deleted_at IS NULL ORDER BY created_at DESC`).all();
   }
 
   function create({ name, kind }){
@@ -79,6 +79,39 @@ function createAgentsService(db, { events }){
     return get(id);
   }
 
+  // CI tokens page: a new token for the same agent — the old one stops
+  // working at once (a revoked token comes back with it). Returned once;
+  // the row, and so its jobs and name, stay the same.
+  function rotateToken(id){
+    const agent = get(id);
+    if (!agent || agent.deleted_at){
+      throw Object.assign(new Error('Unknown agent'), { status: 404 });
+    }
+    if (agent.user_id){
+      throw Object.assign(new Error('A user\'s key is replaced on Users, not here'), { status: 400 });
+    }
+    const token = generateToken('agt');
+    db.prepare('UPDATE agents SET token_hash = ?, token_created_at = ?, revoked_at = NULL WHERE id = ?').run(hashToken(token), new Date().toISOString(), id);
+    events.record('agent', id, 'agent.token_rotated', { name: agent.name });
+    return token;
+  }
+
+  // CI tokens page: gone from the list, its token revoked; the row stays for
+  // the jobs that reference it (they keep showing its name).
+  function remove(id){
+    const agent = get(id);
+    if (!agent || agent.deleted_at){
+      throw Object.assign(new Error('Unknown agent'), { status: 404 });
+    }
+    if (agent.user_id){
+      throw Object.assign(new Error('A user\'s key is managed on Users, not here'), { status: 400 });
+    }
+    const now = new Date().toISOString();
+    db.prepare('UPDATE agents SET deleted_at = ?, revoked_at = COALESCE(revoked_at, ?), update_to = NULL WHERE id = ?').run(now, now, id);
+    events.record('agent', id, 'agent.deleted', { name: agent.name });
+    return agent;
+  }
+
   function revoke(id){
     db.prepare('UPDATE agents SET revoked_at = ? WHERE id = ?').run(new Date().toISOString(), id);
     events.record('agent', id, 'agent.revoked', {});
@@ -116,7 +149,7 @@ function createAgentsService(db, { events }){
     return ids.length;
   }
 
-  return { get, getByTokenHash, list, create, rename, setGroup, revoke, touchLastUsed, setUpdateTo, requestUpdateAll };
+  return { get, getByTokenHash, list, create, rename, setGroup, rotateToken, remove, revoke, touchLastUsed, setUpdateTo, requestUpdateAll };
 }
 
 module.exports = { createAgentsService };

package/src/web/routes.js

@@ -1478,6 +1478,29 @@ function createWebRouter({ services, config }){
     res.redirect(returnTo(req, '/admin/agents'));
   });
 
+  router.post('/admin/agents/:id/token', (req, res) => {
+    try {
+      const agent = services.agents.get(req.params.id),
+        token = services.agents.rotateToken(req.params.id);
+      return renderAgents(req, res, { newToken: token, newTokenFor: agent.name });
+    }
+    catch (err){
+      flash(req, 'danger', err.message);
+    }
+    res.redirect(returnTo(req, '/admin/agents'));
+  });
+
+  router.post('/admin/agents/:id/delete', (req, res) => {
+    try {
+      const agent = services.agents.remove(req.params.id);
+      flash(req, 'success', `Deleted CI token "${agent.name}". Its jobs stay, listed under its name.`);
+    }
+    catch (err){
+      flash(req, 'danger', err.message);
+    }
+    res.redirect(returnTo(req, '/admin/agents'));
+  });
+
   router.post('/admin/agents/:id/revoke', (req, res) => {
     services.agents.revoke(req.params.id);
     res.redirect(returnTo(req, '/admin/agents'));

package/test/groups-tab.test.js

@@ -243,3 +243,35 @@ test('agent groups are set on the dashboard (Users, CI tokens) and shown by name
     assert.ok(!text.includes(g.id), 'a group id shows as text');
   }
 });
+
+test('CI tokens: the name opens Edit; a new token replaces the old one; delete keeps its jobs', async (t) => {
+  const { base, services, admin } = await start(t),
+    form = (p, body = {}) => fetch(`${base}${p}`, { method: 'POST', headers: { cookie: admin }, body: new URLSearchParams(body), redirect: 'manual' }),
+    { agent, token } = services.agents.create({ name: 'ci-fw', kind: 'ci' }),
+    me = (tok) => fetch(`${base}/api/v1/me`, { headers: { authorization: `Bearer ${tok}` } });
+  services.registry.registerAuto({ clientId: 'sw7', name: 'lab-sw-07', type: 'sw', labels: [] });
+  const job = services.jobs.create({ agentId: agent.id, source: 'ci', spec: { target: { type: 'sw', labels: [] }, command: './t.sh' } });
+
+  let html = await (await fetch(`${base}/admin/agents`, { headers: { cookie: admin } })).text();
+  assert.match(html, new RegExp(`<a class="fw-medium" href="#editAgentModal-${agent.id}" data-bs-toggle="modal" role="button">ci-fw</a>`));
+  assert.doesNotMatch(html, />Edit<\/button>/);
+
+  // New token: shown once, the old one stops at once.
+  const res = await form(`/admin/agents/${agent.id}/token`);
+  html = await res.text();
+  const fresh = /value="(agt_[^"]+)" readonly/.exec(html)?.[1];
+  assert.ok(fresh, 'the new token is shown');
+  assert.match(html, /New token for ci-fw \(shown once — the old one has stopped working\)/);
+  assert.equal((await me(token)).status, 401);
+  assert.equal((await me(fresh)).status, 200);
+
+  // Delete: gone from the list and from the API; its job keeps its name.
+  await form(`/admin/agents/${agent.id}/delete`);
+  html = await (await fetch(`${base}/admin/agents`, { headers: { cookie: admin } })).text();
+  assert.match(html, /Deleted CI token &quot;ci-fw&quot;|Deleted CI token "ci-fw"/); // the flash
+  assert.doesNotMatch(html.slice(html.indexOf('<tbody')), /ci-fw/); // the list
+  assert.equal((await me(fresh)).status, 401);
+  assert.ok((await (await fetch(`${base}/jobs?q=ci-fw`, { headers: { cookie: admin } })).text()).includes(job.id)); // still found by its name
+  assert.match(await (await form(`/admin/agents/${agent.id}/token`)).headers.get('location'), /agents/); // can't come back
+  assert.equal(services.agents.get(agent.id).revoked_at !== null, true);
+});

package/test/users.test.js

@@ -358,7 +358,7 @@ test('maintainers manage Agent-only users, their own account and CI tokens — n
 
   // CI tokens: issue, rename, revoke.
   page = await post('/admin/agents', { name: 'ci-nightly' });
-  assert.match(page, /Token \(shown once\):[\s\S]*?<code>agt_/);
+  assert.match(page, /Token \(shown once\):[\s\S]*?value="agt_/);
   const ci = services.agents.list().find((a) => a.name === 'ci-nightly');
   await post(`/admin/agents/${ci.id}/rename`, { name: 'ci-night' });
   await post(`/admin/agents/${ci.id}/revoke`);
@@ -423,7 +423,7 @@ test('audit log: Timestamp, User (who did it — always), Action — from the da
     log = html.slice(html.indexOf('Recent activity'), html.indexOf('id="addUserModal"')),
     rows = [...log.matchAll(/<tr><td[^>]*>[^<]*<\/td><td[^>]*>([^<]*)<\/td><td>([^<]*)<\/td><\/tr>/g)]
       .map((m) => [m[1], m[2].replace(/&#39;/g, '\'').replace(/&gt;/g, '>')]).reverse(); // oldest first
-  assert.match(log, /<th class="text-nowrap">Timestamp<\/th><th>User<\/th><th>Action<\/th>/);
+  assert.match(log, /<th[^>]*>Timestamp<\/th><th>User<\/th><th>Action<\/th>/);
   assert.deepEqual(rows, [
     ['root', 'Created root (Admin)'],
     ['root', 'Created dev (User)'],

package/views/admin/agents.pug

@@ -15,10 +15,13 @@ block content
       +pageSizePicker(list)
 
   if newToken
-    .alert.alert-warning
-      strong Token (shown once):
-      |
-      code= newToken
+    //- Shown once: nothing below keeps it.
+    .alert.alert-warning(role="alert")
+      strong= newTokenFor ? `New token for ${newTokenFor} (shown once — the old one has stopped working):` : 'Token (shown once):'
+      .input-group.input-group-sm.mt-2
+        input.form-control.font-monospace(type="text" value=newToken readonly aria-label="Token")
+        button.btn.btn-outline-secondary(type="button" data-copy=newToken aria-label="Copy token")
+          i.bi.bi-clipboard
 
   div(data-live="list-toolbar")
     +listToolbar(list, 'agents')
@@ -37,7 +40,9 @@ block content
     tbody(data-live="rows")
       each a in agents
         tr(class=a.revoked_at ? 'opacity-50' : '')
-          td= a.name
+          //- The name opens Edit (name and group).
+          td
+            a.fw-medium(href=`#editAgentModal-${a.id}` data-bs-toggle="modal" role="button")= a.name
           td.text-uppercase= a.kind
           td
             if a.group_id && groupsById[a.group_id]
@@ -50,13 +55,18 @@ block content
           td= fmtDate(a.last_used_at, 'never')
           td= a.revoked_at ? 'revoked' : 'active'
           td
-            .d-flex.justify-content-end
-              button.btn.btn-sm.btn-outline-secondary(
-                type="button"
-                data-bs-toggle="modal"
-                data-bs-target=`#editAgentModal-${a.id}`
-                aria-label=`Edit agent ${a.name}`
-              ) Edit
+            .d-flex.justify-content-end.text-nowrap
+              form(
+                method="post"
+                action=`/admin/agents/${a.id}/token`
+                data-confirm=a.revoked_at ? `Issue a new token for "${a.name}"? It becomes active again with it.` : `Issue a new token for "${a.name}"? Its current token stops working at once — update it wherever it's used (a CI secret).`
+                data-confirm-title="Issue a new token?"
+                data-confirm-ok="Issue token"
+                data-confirm-tone="primary"
+              )
+                input(type="hidden" name="returnTo" value=list.pageUrl())
+                button.btn.btn-sm.btn-outline-primary(type="submit" aria-label=`New token for ${a.name}` data-bs-toggle="tooltip" data-bs-title="Issue a new token (the old one stops working; shown once)")
+                  i.bi.bi-key
               if !a.revoked_at
                 form.ms-1(
                   method="post"
@@ -66,7 +76,18 @@ block content
                   data-confirm-ok="Revoke"
                 )
                   input(type="hidden" name="returnTo" value=list.pageUrl())
-                  button.btn.btn-sm.btn-outline-danger(type="submit") Revoke
+                  button.btn.btn-sm.btn-outline-warning(type="submit" aria-label=`Revoke ${a.name}` data-bs-toggle="tooltip" data-bs-title="Revoke the token (a new one can be issued later)")
+                    i.bi.bi-key-fill
+              form.ms-1(
+                method="post"
+                action=`/admin/agents/${a.id}/delete`
+                data-confirm=`Delete CI token "${a.name}"? Its token stops working and it leaves this list for good; its jobs stay, listed under its name.`
+                data-confirm-title="Delete CI token?"
+                data-confirm-ok="Delete"
+              )
+                input(type="hidden" name="returnTo" value=list.pageUrl())
+                button.btn.btn-sm.btn-outline-danger(type="submit" aria-label=`Delete ${a.name}` data-bs-toggle="tooltip" data-bs-title="Delete the CI token")
+                  i.bi.bi-trash
 
             .modal(tabindex="-1" id=`editAgentModal-${a.id}` aria-labelledby=`editAgentTitle-${a.id}`)
               .modal-dialog

package/views/admin/users.pug

@@ -212,13 +212,13 @@ block content
       table.table.table-sm.small.align-middle
         thead
           tr
-            th.text-nowrap Timestamp
+            th Timestamp
             th User
             th Action
         tbody
           each e in audit
             tr
-              td.text-nowrap.text-body-secondary= fmtDate(e.ts)
+              td.text-body-secondary= fmtDate(e.ts)
               td.text-nowrap= e.by
               td= e.action
   else