@shipfox/annotations 2.0.0

package/src/presentation/routes/read-annotations.test.ts

@@ -0,0 +1,279 @@
+import {AUTH_USER, buildUserContext, setUserContext} from '@shipfox/api-auth-context';
+import {type AuthMethod, ClientError, closeApp, createApp} from '@shipfox/node-fastify';
+import type {FastifyRequest} from 'fastify';
+import {annotationFactory} from '#test/index.js';
+import {readAnnotationsRoute} from './read-annotations.js';
+
+const fakeUserAuth: AuthMethod = {
+  name: AUTH_USER,
+  authenticate: (request: FastifyRequest) => {
+    if (request.headers.authorization !== 'Bearer user') {
+      throw new ClientError('Invalid user token', 'unauthorized', {status: 401});
+    }
+
+    const header = request.headers['x-test-workspaces'];
+    const rawWorkspaceIds = Array.isArray(header) ? header.join(',') : (header ?? '');
+    const memberships = rawWorkspaceIds
+      .split(',')
+      .filter((workspaceId) => workspaceId.length > 0)
+      .map((workspaceId) => ({workspaceId, role: 'admin' as const}));
+
+    setUserContext(
+      request,
+      buildUserContext({
+        userId: 'user-1',
+        email: 'user@example.com',
+        memberships,
+      }),
+    );
+    return Promise.resolve();
+  },
+};
+
+describe('GET /annotations', () => {
+  let app: Awaited<ReturnType<typeof createApp>>;
+
+  beforeAll(async () => {
+    app = await createApp({
+      auth: [fakeUserAuth],
+      routes: [{prefix: '/annotations', auth: AUTH_USER, routes: [readAnnotationsRoute]}],
+      swagger: false,
+    });
+    await app.ready();
+  });
+
+  afterAll(async () => {
+    await closeApp();
+  });
+
+  function readUrl(params: {
+    workflowRunId: string;
+    attempt: number;
+    jobExecutionId?: string | undefined;
+    cursor?: string | undefined;
+    limit?: number | undefined;
+  }) {
+    const search = new URLSearchParams({
+      workflow_run_id: params.workflowRunId,
+      attempt: String(params.attempt),
+    });
+    if (params.jobExecutionId) search.set('job_execution_id', params.jobExecutionId);
+    if (params.cursor) search.set('cursor', params.cursor);
+    if (params.limit !== undefined) search.set('limit', String(params.limit));
+    return `/annotations?${search.toString()}`;
+  }
+
+  it('rejects a request without a session token', async () => {
+    const res = await app.inject({
+      method: 'GET',
+      url: readUrl({workflowRunId: crypto.randomUUID(), attempt: 1}),
+    });
+
+    expect(res.statusCode).toBe(401);
+  });
+
+  it('returns annotations converted to DTOs for a visible run attempt', async () => {
+    const workspaceId = crypto.randomUUID();
+    const workflowRunId = crypto.randomUUID();
+    const jobId = crypto.randomUUID();
+    const jobExecutionId = crypto.randomUUID();
+    const originStepId = crypto.randomUUID();
+    const annotation = await annotationFactory.create({
+      workspaceId,
+      workflowRunId,
+      workflowRunAttempt: 2,
+      jobId,
+      jobExecutionId,
+      originStepId,
+      originStepAttempt: 3,
+      context: 'deploy',
+      style: 'success',
+      sequence: 4,
+      body: 'Deployed **v42**',
+      bodyBytes: Buffer.byteLength('Deployed **v42**'),
+    });
+
+    const res = await app.inject({
+      method: 'GET',
+      url: readUrl({workflowRunId, attempt: 2}),
+      headers: {authorization: 'Bearer user', 'x-test-workspaces': workspaceId},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({
+      annotations: [
+        {
+          id: annotation.id,
+          job_id: jobId,
+          job_execution_id: jobExecutionId,
+          origin_step_id: originStepId,
+          origin_step_attempt: 3,
+          context: 'deploy',
+          style: 'success',
+          sequence: 4,
+          body: 'Deployed **v42**',
+        },
+      ],
+      has_more: false,
+      next_cursor: null,
+    });
+  });
+
+  it('returns an empty list when no rows match the run attempt', async () => {
+    const res = await app.inject({
+      method: 'GET',
+      url: readUrl({workflowRunId: crypto.randomUUID(), attempt: 1}),
+      headers: {authorization: 'Bearer user', 'x-test-workspaces': crypto.randomUUID()},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({annotations: [], has_more: false, next_cursor: null});
+  });
+
+  it('returns an empty list for annotations outside the user workspaces', async () => {
+    const workflowRunId = crypto.randomUUID();
+    await annotationFactory.create({workflowRunId, workspaceId: crypto.randomUUID()});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: readUrl({workflowRunId, attempt: 1}),
+      headers: {authorization: 'Bearer user', 'x-test-workspaces': crypto.randomUUID()},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({annotations: [], has_more: false, next_cursor: null});
+  });
+
+  it('returns an empty list when the job execution filter has no matches', async () => {
+    const workspaceId = crypto.randomUUID();
+    const workflowRunId = crypto.randomUUID();
+    await annotationFactory.create({workspaceId, workflowRunId});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: readUrl({
+        workflowRunId,
+        attempt: 1,
+        jobExecutionId: crypto.randomUUID(),
+      }),
+      headers: {authorization: 'Bearer user', 'x-test-workspaces': workspaceId},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({annotations: [], has_more: false, next_cursor: null});
+  });
+
+  it('limits the returned annotations and returns a continuation cursor', async () => {
+    const workspaceId = crypto.randomUUID();
+    const workflowRunId = crypto.randomUUID();
+    const first = await annotationFactory.create({
+      workspaceId,
+      workflowRunId,
+      jobExecutionId: crypto.randomUUID(),
+      context: 'first',
+      sequence: 1,
+    });
+    const second = await annotationFactory.create({
+      workspaceId,
+      workflowRunId,
+      jobExecutionId: crypto.randomUUID(),
+      context: 'second',
+      sequence: 2,
+    });
+
+    const firstPage = await app.inject({
+      method: 'GET',
+      url: readUrl({workflowRunId, attempt: 1, limit: 1}),
+      headers: {authorization: 'Bearer user', 'x-test-workspaces': workspaceId},
+    });
+    expect(firstPage.statusCode).toBe(200);
+    const firstBody = firstPage.json();
+    expect(firstBody).toMatchObject({
+      annotations: [
+        {
+          id: first.id,
+          context: 'first',
+          sequence: 1,
+        },
+      ],
+      has_more: true,
+    });
+    expect(typeof firstBody.next_cursor).toBe('string');
+
+    const secondPage = await app.inject({
+      method: 'GET',
+      url: readUrl({
+        workflowRunId,
+        attempt: 1,
+        cursor: firstBody.next_cursor,
+        limit: 1,
+      }),
+      headers: {authorization: 'Bearer user', 'x-test-workspaces': workspaceId},
+    });
+
+    expect(secondPage.statusCode).toBe(200);
+    expect(secondPage.json()).toMatchObject({
+      annotations: [
+        {
+          id: second.id,
+          context: 'second',
+          sequence: 2,
+        },
+      ],
+      has_more: false,
+      next_cursor: null,
+    });
+  });
+
+  it('rejects malformed query values', async () => {
+    const res = await app.inject({
+      method: 'GET',
+      url: '/annotations?workflow_run_id=not-a-uuid&attempt=0',
+      headers: {authorization: 'Bearer user', 'x-test-workspaces': crypto.randomUUID()},
+    });
+
+    expect(res.statusCode).toBe(400);
+  });
+
+  it('rejects attempts outside the database integer range', async () => {
+    const res = await app.inject({
+      method: 'GET',
+      url: readUrl({workflowRunId: crypto.randomUUID(), attempt: 2_147_483_648}),
+      headers: {authorization: 'Bearer user', 'x-test-workspaces': crypto.randomUUID()},
+    });
+
+    expect(res.statusCode).toBe(400);
+  });
+
+  it('rejects limits above the server response cap', async () => {
+    const res = await app.inject({
+      method: 'GET',
+      url: readUrl({workflowRunId: crypto.randomUUID(), attempt: 1, limit: 501}),
+      headers: {authorization: 'Bearer user', 'x-test-workspaces': crypto.randomUUID()},
+    });
+
+    expect(res.statusCode).toBe(400);
+  });
+
+  it('rejects malformed continuation cursors', async () => {
+    const res = await app.inject({
+      method: 'GET',
+      url: readUrl({workflowRunId: crypto.randomUUID(), attempt: 1, cursor: 'not-a-cursor'}),
+      headers: {authorization: 'Bearer user', 'x-test-workspaces': crypto.randomUUID()},
+    });
+
+    expect(res.statusCode).toBe(400);
+    expect(res.json().code).toBe('invalid-cursor');
+  });
+
+  it('rejects empty continuation cursors', async () => {
+    const res = await app.inject({
+      method: 'GET',
+      url: `${readUrl({workflowRunId: crypto.randomUUID(), attempt: 1})}&cursor=`,
+      headers: {authorization: 'Bearer user', 'x-test-workspaces': crypto.randomUUID()},
+    });
+
+    expect(res.statusCode).toBe(400);
+    expect(res.json().code).toBe('invalid-cursor');
+  });
+});

package/src/presentation/routes/read-annotations.ts

@@ -0,0 +1,50 @@
+import {readAnnotationsQuerySchema, readAnnotationsResponseSchema} from '@shipfox/annotations-dto';
+import {requireUserContext} from '@shipfox/api-auth-context';
+import {decodeNumberIdCursor, encodeNumberIdCursor} from '@shipfox/node-drizzle';
+import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {listAnnotationsForRunAttempt} from '#db/index.js';
+import {toAnnotationDto} from '#presentation/dto/index.js';
+
+export const readAnnotationsRoute = defineRoute({
+  method: 'GET',
+  path: '/',
+  description: 'Read annotations for a workflow run attempt.',
+  schema: {
+    querystring: readAnnotationsQuerySchema,
+    response: {
+      200: readAnnotationsResponseSchema,
+    },
+  },
+  handler: async (request) => {
+    const user = requireUserContext(request);
+    const {
+      workflow_run_id: workflowRunId,
+      attempt,
+      job_execution_id: jobExecutionId,
+      cursor,
+      limit,
+    } = request.query;
+    const decodedCursor = decodeNumberIdCursor(cursor);
+    if (cursor !== undefined && !decodedCursor) {
+      throw new ClientError('Invalid cursor', 'invalid-cursor', {status: 400});
+    }
+
+    const workspaceIds = user.memberships.map((membership) => membership.workspaceId);
+    const result = await listAnnotationsForRunAttempt({
+      workflowRunId,
+      workflowRunAttempt: attempt,
+      workspaceIds,
+      jobExecutionId,
+      after: decodedCursor ? {sequence: decodedCursor.value, id: decodedCursor.id} : undefined,
+      limit,
+    });
+
+    return {
+      annotations: result.annotations.map(toAnnotationDto),
+      has_more: result.hasMore,
+      next_cursor: result.nextCursor
+        ? encodeNumberIdCursor({value: result.nextCursor.sequence, id: result.nextCursor.id})
+        : null,
+    };
+  },
+});

package/src/presentation/routes/write-annotations.test.ts

@@ -0,0 +1,188 @@
+import {createLeaseTokenAuthMethod} from '@shipfox/api-auth';
+import {AUTH_LEASED_JOB} from '@shipfox/api-auth-context';
+import {closeApp, createApp, type FastifyInstance} from '@shipfox/node-fastify';
+import {eq} from 'drizzle-orm';
+import {db} from '#db/db.js';
+import {annotations} from '#db/schema/annotations.js';
+import {mintLeaseToken} from '#test/index.js';
+import {writeAnnotationsRoute} from './write-annotations.js';
+
+function annotationsUrl(): string {
+  return '/runs/jobs/current/annotations';
+}
+
+function mintTestLeaseToken(params: {
+  jobId?: string;
+  jobExecutionId?: string;
+  stepId?: string;
+  attempt?: number;
+}): Promise<string> {
+  return mintLeaseToken({
+    jobId: params.jobId ?? crypto.randomUUID(),
+    jobExecutionId: params.jobExecutionId ?? crypto.randomUUID(),
+    ...(params.stepId
+      ? {currentStepId: params.stepId, currentStepAttempt: params.attempt ?? 1}
+      : {}),
+  });
+}
+
+describe('POST /runs/jobs/current/annotations', () => {
+  let app: FastifyInstance;
+
+  beforeAll(async () => {
+    app = await createApp({
+      auth: [createLeaseTokenAuthMethod()],
+      routes: [
+        {prefix: '/runs/jobs/current', auth: AUTH_LEASED_JOB, routes: [writeAnnotationsRoute]},
+      ],
+      swagger: false,
+    });
+    await app.ready();
+  });
+
+  afterAll(async () => {
+    await closeApp();
+  });
+
+  it('rejects a request without a lease token', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: annotationsUrl(),
+      payload: {step_id: crypto.randomUUID(), attempt: 1, annotations: []},
+    });
+
+    expect(res.statusCode).toBe(401);
+    expect(res.json().code).toBe('unauthorized');
+  });
+
+  it('accepts a scoped lease and writes annotations from lease identity', async () => {
+    const stepId = crypto.randomUUID();
+    const jobId = crypto.randomUUID();
+    const jobExecutionId = crypto.randomUUID();
+    const token = await mintTestLeaseToken({jobId, jobExecutionId, stepId});
+
+    const res = await app.inject({
+      method: 'POST',
+      url: annotationsUrl(),
+      headers: {authorization: `Bearer ${token}`},
+      payload: {
+        step_id: stepId,
+        attempt: 1,
+        annotations: [{context: 'deploy', style: 'success', op: 'replace', body: 'done'}],
+      },
+    });
+
+    const rows = await db()
+      .select()
+      .from(annotations)
+      .where(eq(annotations.jobExecutionId, jobExecutionId));
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toMatchObject({
+      annotations: [{context: 'deploy', id: rows[0]?.id}],
+      accounting: {annotation_count: 1, total_body_bytes: 4},
+    });
+    expect(rows[0]).toMatchObject({
+      jobId,
+      originStepId: stepId,
+      originStepAttempt: 1,
+      context: 'deploy',
+      body: 'done',
+    });
+  });
+
+  it('rejects writes for a step outside the leased execution', async () => {
+    const token = await mintTestLeaseToken({stepId: crypto.randomUUID()});
+
+    const res = await app.inject({
+      method: 'POST',
+      url: annotationsUrl(),
+      headers: {authorization: `Bearer ${token}`},
+      payload: {
+        step_id: crypto.randomUUID(),
+        attempt: 1,
+        annotations: [{context: 'deploy', body: 'wrong step'}],
+      },
+    });
+
+    expect(res.statusCode).toBe(404);
+    expect(res.json().code).toBe('step-not-found');
+  });
+
+  it('rejects writes for a different attempt than the leased step scope', async () => {
+    const stepId = crypto.randomUUID();
+    const token = await mintTestLeaseToken({stepId, attempt: 1});
+
+    const res = await app.inject({
+      method: 'POST',
+      url: annotationsUrl(),
+      headers: {authorization: `Bearer ${token}`},
+      payload: {
+        step_id: stepId,
+        attempt: 2,
+        annotations: [{context: 'deploy', body: 'wrong attempt'}],
+      },
+    });
+
+    expect(res.statusCode).toBe(404);
+    expect(res.json().code).toBe('step-not-found');
+  });
+
+  it('rejects writes with a job-scoped lease token', async () => {
+    const token = await mintLeaseToken({
+      jobId: crypto.randomUUID(),
+      jobExecutionId: crypto.randomUUID(),
+    });
+
+    const res = await app.inject({
+      method: 'POST',
+      url: annotationsUrl(),
+      headers: {authorization: `Bearer ${token}`},
+      payload: {
+        step_id: crypto.randomUUID(),
+        attempt: 1,
+        annotations: [{context: 'deploy', body: 'job scoped'}],
+      },
+    });
+
+    expect(res.statusCode).toBe(404);
+    expect(res.json().code).toBe('step-not-found');
+  });
+
+  it('accepts an empty operation list and returns current accounting', async () => {
+    const stepId = crypto.randomUUID();
+    const token = await mintTestLeaseToken({stepId});
+
+    const res = await app.inject({
+      method: 'POST',
+      url: annotationsUrl(),
+      headers: {authorization: `Bearer ${token}`},
+      payload: {step_id: stepId, attempt: 1, annotations: []},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({
+      annotations: [],
+      accounting: {annotation_count: 0, total_body_bytes: 0},
+    });
+  });
+
+  it('maps annotation count budget failures to a specific client code', async () => {
+    const stepId = crypto.randomUUID();
+    const token = await mintTestLeaseToken({stepId});
+    const operations = Array.from({length: 51}, (_, index) => ({
+      context: `context-${index}`,
+      op: 'replace',
+      body: 'x',
+    }));
+
+    const res = await app.inject({
+      method: 'POST',
+      url: annotationsUrl(),
+      headers: {authorization: `Bearer ${token}`},
+      payload: {step_id: stepId, attempt: 1, annotations: operations},
+    });
+
+    expect(res.statusCode).toBe(413);
+    expect(res.json().code).toBe('annotation-count-limit-exceeded');
+  });
+});

package/src/presentation/routes/write-annotations.ts

@@ -0,0 +1,76 @@
+import {
+  leasedWriteAnnotationsBodySchema,
+  leasedWriteAnnotationsResponseSchema,
+} from '@shipfox/annotations-dto';
+import {requireLeasedJobContext} from '@shipfox/api-auth-context';
+import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {
+  AnnotationBodyTooLargeError,
+  AnnotationCountLimitExceededError,
+  AnnotationTotalBytesLimitExceededError,
+} from '#core/errors.js';
+import {writeAnnotations} from '#core/write-annotations.js';
+
+export const writeAnnotationsRoute = defineRoute({
+  method: 'POST',
+  path: '/annotations',
+  description: 'Creates, updates, or removes annotations for the current leased job execution.',
+  schema: {
+    body: leasedWriteAnnotationsBodySchema,
+    response: {
+      200: leasedWriteAnnotationsResponseSchema,
+    },
+  },
+  errorHandler: (error) => {
+    if (error instanceof AnnotationBodyTooLargeError) {
+      throw new ClientError(error.message, 'annotation-body-too-large', {
+        status: 413,
+        details: {max_body_bytes: error.maxBytes},
+      });
+    }
+    if (error instanceof AnnotationCountLimitExceededError) {
+      throw new ClientError(error.message, 'annotation-count-limit-exceeded', {
+        status: 413,
+        details: {max_annotations: error.maxAnnotations},
+      });
+    }
+    if (error instanceof AnnotationTotalBytesLimitExceededError) {
+      throw new ClientError(error.message, 'annotation-total-bytes-limit-exceeded', {
+        status: 413,
+        details: {max_total_body_bytes: error.maxBytes},
+      });
+    }
+    throw error;
+  },
+  handler: async (request) => {
+    const leasedJob = requireLeasedJobContext(request);
+    const {step_id: stepId, attempt, annotations} = request.body;
+
+    if (leasedJob.currentStepId !== stepId || leasedJob.currentStepAttempt !== attempt) {
+      throw new ClientError('Step not found for leased job execution', 'step-not-found', {
+        status: 404,
+      });
+    }
+
+    const result = await writeAnnotations({
+      workspaceId: leasedJob.workspaceId,
+      projectId: leasedJob.projectId,
+      workflowRunId: leasedJob.workflowRunId,
+      workflowRunAttempt: leasedJob.workflowRunAttempt ?? 1,
+      workflowRunAttemptId: leasedJob.workflowRunAttemptId,
+      jobId: leasedJob.jobId,
+      jobExecutionId: leasedJob.jobExecutionId,
+      originStepId: stepId,
+      originStepAttempt: attempt,
+      operations: annotations,
+    });
+
+    return {
+      annotations: result.annotations,
+      accounting: {
+        annotation_count: result.accounting.annotationCount,
+        total_body_bytes: result.accounting.totalBodyBytes,
+      },
+    };
+  },
+});

package/test/env.ts

@@ -0,0 +1,5 @@
+process.env.DATABASE_URL ??= 'postgres://shipfox:shipfox@127.0.0.1:5432/api_test';
+process.env.AUTH_JWT_SECRET = 'test-jwt-secret';
+process.env.AUTH_JOB_LEASE_TOKEN_SECRET = 'test-lease-secret';
+process.env.AUTH_RUNNER_SESSION_TOKEN_SECRET = 'test-runner-session-secret';
+process.env.TZ = 'UTC';

package/test/factories/annotation.ts

@@ -0,0 +1,57 @@
+import {Factory} from 'fishery';
+import type {Annotation} from '#core/entities/annotation.js';
+import {db} from '#db/db.js';
+import {annotations} from '#db/schema/annotations.js';
+
+export const annotationFactory = Factory.define<Annotation>(({onCreate}) => {
+  onCreate(async (annotation) => {
+    const [row] = await db()
+      .insert(annotations)
+      .values({
+        id: annotation.id,
+        workspaceId: annotation.workspaceId,
+        projectId: annotation.projectId,
+        workflowRunId: annotation.workflowRunId,
+        workflowRunAttempt: annotation.workflowRunAttempt,
+        workflowRunAttemptId: annotation.workflowRunAttemptId,
+        jobId: annotation.jobId,
+        jobExecutionId: annotation.jobExecutionId,
+        originStepId: annotation.originStepId,
+        originStepAttempt: annotation.originStepAttempt,
+        context: annotation.context,
+        style: annotation.style,
+        body: annotation.body,
+        bodyBytes: annotation.bodyBytes,
+        sequence: annotation.sequence,
+        createdAt: annotation.createdAt,
+        updatedAt: annotation.updatedAt,
+      })
+      .returning();
+
+    if (!row) throw new Error('annotationFactory: insert returned no row');
+    return annotation;
+  });
+
+  const body = '### Summary\nAnnotation body';
+  const now = new Date();
+
+  return {
+    id: crypto.randomUUID(),
+    workspaceId: crypto.randomUUID(),
+    projectId: crypto.randomUUID(),
+    workflowRunId: crypto.randomUUID(),
+    workflowRunAttempt: 1,
+    workflowRunAttemptId: crypto.randomUUID(),
+    jobId: crypto.randomUUID(),
+    jobExecutionId: crypto.randomUUID(),
+    originStepId: crypto.randomUUID(),
+    originStepAttempt: 1,
+    context: 'default',
+    style: 'default',
+    body,
+    bodyBytes: Buffer.byteLength(body),
+    sequence: 1,
+    createdAt: now,
+    updatedAt: now,
+  };
+});

package/test/fixtures/lease-token.ts

@@ -0,0 +1,43 @@
+import {JOB_LEASE_TOKEN_AUDIENCE} from '@shipfox/api-auth-dto';
+import {signHs256} from '@shipfox/node-jwt';
+
+const SECRET = process.env.AUTH_JOB_LEASE_TOKEN_SECRET ?? 'test-lease-secret';
+
+export interface MintLeaseTokenParams {
+  jobId: string;
+  jobExecutionId: string;
+  workspaceId?: string;
+  projectId?: string;
+  workflowRunId?: string;
+  workflowRunAttempt?: number;
+  workflowRunAttemptId?: string;
+  currentStepId?: string;
+  currentStepAttempt?: number;
+  secret?: string;
+  expiresIn?: string;
+  audience?: string;
+}
+
+export function mintLeaseToken(params: MintLeaseTokenParams): Promise<string> {
+  return signHs256({
+    payload: {
+      jobId: params.jobId,
+      jobExecutionId: params.jobExecutionId,
+      workflowRunId: params.workflowRunId ?? crypto.randomUUID(),
+      workflowRunAttempt: params.workflowRunAttempt ?? 1,
+      workflowRunAttemptId: params.workflowRunAttemptId ?? crypto.randomUUID(),
+      projectId: params.projectId ?? crypto.randomUUID(),
+      workspaceId: params.workspaceId ?? crypto.randomUUID(),
+      runnerSessionId: crypto.randomUUID(),
+      ...(params.currentStepId && params.currentStepAttempt !== undefined
+        ? {
+            currentStepId: params.currentStepId,
+            currentStepAttempt: params.currentStepAttempt,
+          }
+        : {}),
+    },
+    secret: params.secret ?? SECRET,
+    expiresIn: params.expiresIn ?? '90m',
+    audience: params.audience ?? JOB_LEASE_TOKEN_AUDIENCE,
+  });
+}