@shipfox/api-runners 10.2.0 → 12.0.0

package/src/db/rate-limits.ts

@@ -1,28 +1,25 @@
+import {
+  type ConsumeRateLimitParams,
+  type ConsumeRateLimitResult,
+  createRateLimitPersistence,
+} from '@shipfox/node-rate-limit';
 import {lt, sql} from 'drizzle-orm';
 import {db} from './db.js';
 import {runnersRateLimits} from './schema/rate-limits.js';
 
-export interface ConsumeRunnersRateLimitParams {
-  action: string;
-  scope: string;
-  identifierHmac: string;
-  windowStart: Date;
-  expiresAt: Date;
-  timeoutMs: number;
-}
-
-export interface ConsumeRunnersRateLimitResult {
-  count: number;
-  expiresAt: Date;
-}
-
-export async function consumeRunnersRateLimit(
-  params: ConsumeRunnersRateLimitParams,
-): Promise<ConsumeRunnersRateLimitResult> {
-  return await db().transaction(async (tx) => {
-    await tx.execute(sql`select set_config('statement_timeout', ${`${params.timeoutMs}ms`}, true)`);
-
-    const rows = await tx
+type RunnersRateLimitTransaction = Parameters<
+  Parameters<ReturnType<typeof db>['transaction']>[0]
+>[0];
+
+const persistence = createRateLimitPersistence<RunnersRateLimitTransaction>({
+  transaction: (callback) => db().transaction(callback),
+  setStatementTimeout: async (transaction, timeoutMs) => {
+    await transaction.execute(
+      sql`select set_config('statement_timeout', ${`${timeoutMs}ms`}, true)`,
+    );
+  },
+  consume: async (transaction, params) => {
+    const rows = await transaction
       .insert(runnersRateLimits)
       .values({
         action: params.action,
@@ -46,24 +43,15 @@ export async function consumeRunnersRateLimit(
       })
       .returning({count: runnersRateLimits.count, expiresAt: runnersRateLimits.expiresAt});
 
-    const row = rows[0];
-    if (!row) throw new Error('Rate limit upsert returned no rows');
-    return row;
-  });
-}
-
-let nextPruneAt = 0;
-
-export async function pruneExpiredRunnersRateLimits(
-  params: {now?: Date | undefined; minIntervalMs?: number | undefined} = {},
-): Promise<number | undefined> {
-  const now = params.now ?? new Date();
-  const minIntervalMs = params.minIntervalMs ?? 60_000;
-  if (minIntervalMs > 0 && now.getTime() < nextPruneAt) return undefined;
-
-  nextPruneAt = now.getTime() + minIntervalMs;
-
-  const result = await db().delete(runnersRateLimits).where(lt(runnersRateLimits.expiresAt, now));
-
-  return result.rowCount ?? 0;
-}
+    return rows[0];
+  },
+  prune: async (now) => {
+    const result = await db().delete(runnersRateLimits).where(lt(runnersRateLimits.expiresAt, now));
+    return result.rowCount ?? 0;
+  },
+});
+
+export type ConsumeRunnersRateLimitParams = ConsumeRateLimitParams<string, string>;
+export type ConsumeRunnersRateLimitResult = ConsumeRateLimitResult;
+export const consumeRunnersRateLimit = persistence.consume;
+export const pruneExpiredRunnersRateLimits = persistence.prune;

package/src/presentation/routes/heartbeat.test.ts

@@ -6,7 +6,7 @@ import {eq} from 'drizzle-orm';
 import type {FastifyInstance} from 'fastify';
 import {claimJobExecution} from '#core/job-executions.js';
 import {db} from '#db/db.js';
-import {requestJobExecutionCancellation} from '#db/job-executions.js';
+import {reconcileTerminalJobExecution} from '#db/job-executions.js';
 import {runnerSessions} from '#db/schema/runner-sessions.js';
 import {runningJobExecutions} from '#db/schema/running-job-executions.js';
 import {createRunnerRegistrationTokenAuthMethod} from '#presentation/auth/index.js';
@@ -223,10 +223,10 @@ describe('POST /runners/jobs/:jobId/heartbeat', () => {
     expect(session?.toolCapabilitiesReportedAt).toEqual(new Date('2026-01-01T00:00:00.000Z'));
   });
 
-  it('returns 200 + cancel:true after requestJobExecutionCancellation', async () => {
+  it('returns 200 + cancel:true after reconcileTerminalJobExecution', async () => {
     const {jobId, jobExecutionId, workflowRunId, workflowRunAttemptId, leaseToken} =
       await claimAvailableJob();
-    await requestJobExecutionCancellation({jobExecutionId});
+    await reconcileTerminalJobExecution({jobExecutionId});
 
     const res = await app.inject({
       method: 'POST',

package/src/presentation/routes/list-active-runners.test.ts

@@ -50,7 +50,7 @@ describe('GET /workspaces/:workspaceId/runners/active', () => {
   beforeEach(async () => {
     await closeApp();
     workspaceId = crypto.randomUUID();
-    authenticatedMemberships = [{workspaceId, role: 'admin'}];
+    authenticatedMemberships = [{workspaceId, role: 'admin', workspaceStatus: 'active'}];
     app = await createApp({
       auth: [
         fakeUserAuth,
@@ -353,7 +353,13 @@ describe('GET /workspaces/:workspaceId/runners/active', () => {
   });
 
   it('returns 403 when the user is not a workspace member', async () => {
-    authenticatedMemberships = [{workspaceId: crypto.randomUUID(), role: 'admin'}];
+    authenticatedMemberships = [
+      {
+        workspaceId: crypto.randomUUID(),
+        role: 'admin',
+        workspaceStatus: 'active',
+      },
+    ];
 
     const res = await app.inject({
       method: 'GET',

package/src/presentation/routes/manual-registration-tokens.test.ts

@@ -58,7 +58,7 @@ describe('manual registration token routes', () => {
   beforeEach(async () => {
     await closeApp();
     workspaceId = crypto.randomUUID();
-    authenticatedMemberships = [{workspaceId, role: 'admin'}];
+    authenticatedMemberships = [{workspaceId, role: 'admin', workspaceStatus: 'active'}];
     app = await createApp({
       auth: [
         fakeUserAuth,
@@ -109,7 +109,13 @@ describe('manual registration token routes', () => {
     });
 
     it('returns 403 when the user is not a workspace member', async () => {
-      authenticatedMemberships = [{workspaceId: crypto.randomUUID(), role: 'admin'}];
+      authenticatedMemberships = [
+        {
+          workspaceId: crypto.randomUUID(),
+          role: 'admin',
+          workspaceStatus: 'active',
+        },
+      ];
 
       const res = await app.inject({
         method: 'GET',

package/src/presentation/routes/provisioner-tokens.test.ts

@@ -45,7 +45,7 @@ describe('provisioner token routes', () => {
   beforeEach(async () => {
     await closeApp();
     workspaceId = crypto.randomUUID();
-    authenticatedMemberships = [{workspaceId, role: 'admin'}];
+    authenticatedMemberships = [{workspaceId, role: 'admin', workspaceStatus: 'active'}];
     app = await createApp({
       auth: [fakeUserAuth, createProvisionerTokenAuthMethod()],
       routes: provisionerRoutes,
@@ -74,7 +74,13 @@ describe('provisioner token routes', () => {
     });
 
     it('returns 403 when the user is not a workspace member', async () => {
-      authenticatedMemberships = [{workspaceId: crypto.randomUUID(), role: 'admin'}];
+      authenticatedMemberships = [
+        {
+          workspaceId: crypto.randomUUID(),
+          role: 'admin',
+          workspaceStatus: 'active',
+        },
+      ];
 
       const res = await app.inject({
         method: 'GET',

package/src/presentation/routes/rate-limit.ts

@@ -1,11 +1,8 @@
 import {requireProvisionerContext} from '@shipfox/api-auth-context';
 import {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';
+import {enforceRateLimit as enforceSharedRateLimit} from '@shipfox/node-rate-limit';
 import {config} from '#config.js';
-import {
-  checkRunnersRateLimit,
-  RunnersRateLimitExceededError,
-  RunnersRateLimitUnavailableError,
-} from '#core/rate-limit.js';
+import {checkRunnersRateLimit} from '#core/rate-limit.js';
 import {getRunnerContext} from '#presentation/auth/index.js';
 
 function routeName(request: FastifyRequest): string {
@@ -21,65 +18,37 @@ async function enforceRateLimit(params: {
   limit: number;
   windowSeconds: number;
 }): Promise<void> {
-  try {
-    await checkRunnersRateLimit({
-      action: params.action,
-      scope: params.scope,
-      identifier: params.identifier,
-      limit: params.limit,
-      windowSeconds: params.windowSeconds,
-    });
-  } catch (error) {
-    if (error instanceof RunnersRateLimitExceededError) {
-      params.request.log.warn(
-        {
-          action: error.action,
-          scope: error.scope,
-          route: routeName(params.request),
-          retryAfterSeconds: error.retryAfterSeconds,
-          identifierHmacPrefix: error.identifierHmacPrefix,
-        },
-        'Runners rate limit blocked request',
-      );
-      params.reply.header('Retry-After', String(error.retryAfterSeconds));
-      throw new ClientError('Rate limit exceeded', 'rate-limited', {
-        status: 429,
-        details: {retry_after_seconds: error.retryAfterSeconds},
-        data: {
-          action: error.action,
-          scope: error.scope,
-          route: routeName(params.request),
-          identifierHmacPrefix: error.identifierHmacPrefix,
-        },
-        cause: error,
-      });
-    }
-
-    if (error instanceof RunnersRateLimitUnavailableError) {
-      params.request.log.error(
-        {
-          action: error.action,
-          scope: error.scope,
-          route: routeName(params.request),
-          identifierHmacPrefix: error.identifierHmacPrefix,
-          err: error,
-        },
-        'Runners rate limiter unavailable',
-      );
-      throw new ClientError('Runners rate limiter unavailable', 'runners-rate-limit-unavailable', {
-        status: 503,
-        data: {
-          action: error.action,
-          scope: error.scope,
-          route: routeName(params.request),
-          identifierHmacPrefix: error.identifierHmacPrefix,
-        },
-        cause: error,
-      });
-    }
-
-    throw error;
-  }
+  await enforceSharedRateLimit({
+    request: params.request,
+    reply: params.reply,
+    check: () =>
+      checkRunnersRateLimit({
+        action: params.action,
+        scope: params.scope,
+        identifier: params.identifier,
+        limit: params.limit,
+        windowSeconds: params.windowSeconds,
+      }),
+    route: routeName(params.request),
+    unavailableCode: 'runners-rate-limit-unavailable',
+    unavailableMessage: 'Runners rate limiter unavailable',
+    setRetryAfter: (reply, retryAfterSeconds) => {
+      reply.header('Retry-After', String(retryAfterSeconds));
+    },
+    logWarn: (request, context) => {
+      request.log.warn(context, 'Runners rate limit blocked request');
+    },
+    logError: (request, context) => {
+      request.log.error(context, 'Runners rate limiter unavailable');
+    },
+    createClientError: (presentation, cause) =>
+      new ClientError(presentation.message, presentation.code, {
+        status: presentation.status,
+        ...(presentation.details ? {details: presentation.details} : {}),
+        data: presentation.data,
+        cause,
+      }),
+  });
 }
 
 export function createProvisionerMintRateLimitPreHandler() {

package/src/presentation/subscribers/on-workflows-job-execution-timed-out.test.ts

@@ -2,6 +2,7 @@ import type {WorkflowsJobExecutionTimedOutEventDto} from '@shipfox/api-workflows
 import {eq} from 'drizzle-orm';
 import {db} from '#db/db.js';
 import {claimPendingJobExecution} from '#db/job-executions.js';
+import {pendingJobExecutions} from '#db/schema/pending-job-executions.js';
 import {runningJobExecutions} from '#db/schema/running-job-executions.js';
 import {pendingJobFactory, runnerSessionFactory} from '#test/index.js';
 import {onWorkflowsJobExecutionTimedOut} from './on-workflows-job-execution-timed-out.js';
@@ -24,6 +25,21 @@ describe('onWorkflowsJobExecutionTimedOut', () => {
     runnerSessionId = runnerSession.id;
   });
 
+  it('deletes an unclaimed pending execution', async () => {
+    const pending = await pendingJobFactory.create({workspaceId});
+
+    await onWorkflowsJobExecutionTimedOut(
+      buildPayload(pending.jobId, pending.jobExecutionId, pending.workflowRunAttemptId),
+    );
+
+    expect(
+      await db()
+        .select()
+        .from(pendingJobExecutions)
+        .where(eq(pendingJobExecutions.jobExecutionId, pending.jobExecutionId)),
+    ).toHaveLength(0);
+  });
+
   it('sets cancellation_requested_at on the matching running_jobs row', async () => {
     await pendingJobFactory.create({workspaceId});
     const claimed = await claimPendingJobExecution({

package/src/presentation/subscribers/on-workflows-job-execution-timed-out.ts

@@ -1,6 +1,6 @@
 import type {WorkflowsJobExecutionTimedOutEventDto} from '@shipfox/api-workflows-dto';
 import {logger} from '@shipfox/node-opentelemetry';
-import {requestJobExecutionCancellation} from '#db/job-executions.js';
+import {reconcileTerminalJobExecution} from '#db/job-executions.js';
 
 export async function onWorkflowsJobExecutionTimedOut(
   payload: WorkflowsJobExecutionTimedOutEventDto,
@@ -11,7 +11,7 @@ export async function onWorkflowsJobExecutionTimedOut(
       jobExecutionId: payload.jobExecutionId,
       workflowRunAttemptId: payload.workflowRunAttemptId,
     },
-    'Requesting runner cancellation for timed-out job execution',
+    'Reconciling runner state for timed-out job execution',
   );
-  await requestJobExecutionCancellation({jobExecutionId: payload.jobExecutionId});
+  await reconcileTerminalJobExecution({jobExecutionId: payload.jobExecutionId});
 }