@shipfox/api-runners 12.0.0 → 12.2.0

package/src/presentation/routes/register.test.ts

@@ -1,11 +1,12 @@
 import {AUTH_PROVISIONER_TOKEN, AUTH_USER} from '@shipfox/api-auth-context';
 import type {RunnerToolCapabilitiesDto} from '@shipfox/api-runners-dto';
 import type {AuthMethod} from '@shipfox/node-fastify';
-import {closeApp, createApp} from '@shipfox/node-fastify';
+import {ClientError, closeApp, createApp} from '@shipfox/node-fastify';
 import {generateOpaqueToken} from '@shipfox/node-tokens';
 import {eq, sql} from 'drizzle-orm';
-import type {FastifyInstance} from 'fastify';
+import type {FastifyInstance, FastifyReply, FastifyRequest} from 'fastify';
 import {config} from '#config.js';
+import {RunnerLabelsReservedError} from '#core/errors.js';
 import {hashRunnersRateLimitIdentifier} from '#core/rate-limit.js';
 import {db} from '#db/db.js';
 import {revokeManualRegistrationToken} from '#db/manual-registration-tokens.js';
@@ -19,9 +20,11 @@ import {
   fakeRunnerSessionAuthMethod,
   getRunnerSessionTokenClaims,
   manualRegistrationTokenFactory,
+  provisionerTokenFactory,
   runnersTestAuthClient,
 } from '#test/index.js';
 import {createRunnerRoutes} from './index.js';
+import {createRegisterRoute} from './register.js';
 
 const fakeUserAuth: AuthMethod = {
   name: AUTH_USER,
@@ -123,6 +126,38 @@ describe('POST /runners/register', () => {
     expect(session?.toolCapabilitiesReportedAt).toBeInstanceOf(Date);
   });
 
+  it('strips reserved labels from manual registration', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/runners/register',
+      headers: {authorization: `Bearer ${rawToken}`},
+      payload: {labels: ['linux', 'shipfox-managed', 'x64']},
+    });
+
+    const [session] = await db()
+      .select()
+      .from(runnerSessions)
+      .where(eq(runnerSessions.id, res.json().session_id));
+
+    expect(res.statusCode).toBe(200);
+    expect(session?.labels).toEqual(['linux', 'x64']);
+  });
+
+  it('returns a distinct error when all manual registration labels are reserved', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/runners/register',
+      headers: {authorization: `Bearer ${rawToken}`},
+      payload: {labels: ['shipfox-managed']},
+    });
+
+    expect(res.statusCode).toBe(400);
+    expect(res.json()).toMatchObject({
+      code: 'runner-labels-reserved',
+      details: {labels: ['shipfox-managed']},
+    });
+  });
+
   it('exchanges an ephemeral registration token for a one-claim runner session', async () => {
     const ephemeralRawToken = generateOpaqueToken('ephemeralRegistrationToken');
     const token = await ephemeralRegistrationTokenFactory.create(
@@ -165,6 +200,65 @@ describe('POST /runners/register', () => {
     expect(consumed?.consumedSessionId).toBe(body.session_id);
   });
 
+  it('strips reserved labels from ephemeral registration', async () => {
+    const ephemeralRawToken = generateOpaqueToken('ephemeralRegistrationToken');
+    const provisioner = await provisionerTokenFactory.create({
+      scope: 'workspace',
+      workspaceId,
+    });
+    const token = await ephemeralRegistrationTokenFactory.create(
+      {workspaceId, provisionerId: provisioner.id},
+      {transient: {rawToken: ephemeralRawToken}},
+    );
+
+    const res = await app.inject({
+      method: 'POST',
+      url: '/runners/register',
+      headers: {authorization: `Bearer ${ephemeralRawToken}`},
+      payload: {labels: ['linux', 'shipfox-managed']},
+    });
+
+    const [session] = await db()
+      .select()
+      .from(runnerSessions)
+      .where(eq(runnerSessions.id, res.json().session_id));
+
+    expect(res.statusCode).toBe(200);
+    expect(session).toMatchObject({
+      id: res.json().session_id,
+      provisionerId: token.provisionerId,
+      labels: ['linux'],
+    });
+  });
+
+  it('preserves reserved labels for installation-scope ephemeral registration', async () => {
+    const ephemeralRawToken = generateOpaqueToken('ephemeralRegistrationToken');
+    const provisioner = await provisionerTokenFactory.create({scope: 'installation'});
+    const token = await ephemeralRegistrationTokenFactory.create(
+      {workspaceId, provisionerId: provisioner.id},
+      {transient: {rawToken: ephemeralRawToken}},
+    );
+
+    const res = await app.inject({
+      method: 'POST',
+      url: '/runners/register',
+      headers: {authorization: `Bearer ${ephemeralRawToken}`},
+      payload: {labels: ['linux', 'shipfox-managed']},
+    });
+
+    const [session] = await db()
+      .select()
+      .from(runnerSessions)
+      .where(eq(runnerSessions.id, res.json().session_id));
+
+    expect(res.statusCode).toBe(200);
+    expect(session).toMatchObject({
+      id: res.json().session_id,
+      provisionerId: token.provisionerId,
+      labels: ['linux', 'shipfox-managed'],
+    });
+  });
+
   it('rejects malformed capability reports without creating a runner session', async () => {
     const res = await app.inject({
       method: 'POST',
@@ -418,6 +512,26 @@ describe('POST /runners/register', () => {
     expect(res.statusCode).toBe(200);
   });
 
+  it('maps reserved-label-only registration failures to a public error code', () => {
+    const route = createRegisterRoute(runnersTestAuthClient);
+
+    try {
+      route.errorHandler?.(
+        new RunnerLabelsReservedError(['shipfox-managed']),
+        {} as FastifyRequest,
+        {} as FastifyReply,
+      );
+      throw new Error('Expected register route error handler to throw');
+    } catch (error) {
+      expect(error).toBeInstanceOf(ClientError);
+      expect(error).toMatchObject({
+        code: 'runner-labels-reserved',
+        details: {labels: ['shipfox-managed']},
+        status: 400,
+      });
+    }
+  });
+
   async function seedEphemeralRegisterRateLimit(
     tokenId: string,
     seedCount: number,

package/src/presentation/routes/register.ts

@@ -5,6 +5,7 @@ import {
   EmptyRunnerLabelsError,
   RegistrationTokenConsumedError,
   RegistrationTokenExpiredError,
+  RunnerLabelsReservedError,
 } from '#core/errors.js';
 import {registerRunnerSession} from '#core/runner-sessions.js';
 import {getRunnerContext} from '#presentation/auth/index.js';
@@ -23,6 +24,12 @@ export function createRegisterRoute(auth: AuthInterModuleClient) {
     },
     preHandler: createEphemeralRegisterRateLimitPreHandler(),
     errorHandler: (error, request) => {
+      if (error instanceof RunnerLabelsReservedError) {
+        throw new ClientError(error.message, 'runner-labels-reserved', {
+          details: {labels: error.labels},
+          status: 400,
+        });
+      }
       if (error instanceof EmptyRunnerLabelsError) {
         throw new ClientError(error.message, 'empty-runner-labels', {status: 400});
       }

package/src/presentation/routes/report-runner-instances.test.ts

@@ -113,6 +113,39 @@ describe('POST /provisioners/runner-instances/report', () => {
     expect(rows[0]?.reportedAt.toISOString()).toBe(reportedAt);
   });
 
+  it('strips reserved labels from workspace runner reports', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/provisioners/runner-instances/report',
+      headers: {authorization: `Bearer ${VALID_PROVISIONER_TOKEN}`},
+      payload: {
+        events: [
+          {
+            provider_runner_id: 'provisioned-runner-reserved-label',
+            labels: ['linux', 'shipfox-managed'],
+            state: 'starting',
+            reported_at: new Date('2025-01-01T00:00:00.000Z').toISOString(),
+            provider_kind: 'docker',
+          },
+        ],
+      },
+    });
+
+    const [row] = await db()
+      .select()
+      .from(providerRunners)
+      .where(
+        and(
+          eq(providerRunners.workspaceId, workspaceId),
+          eq(providerRunners.provisionerId, provisionerTokenId),
+          eq(providerRunners.providerRunnerId, 'provisioned-runner-reserved-label'),
+        ),
+      );
+
+    expect(res.statusCode).toBe(200);
+    expect(row?.labels).toEqual(['linux']);
+  });
+
   it('returns 400 when the batch exceeds the DTO limit', async () => {
     const event = {
       provider_runner_id: 'provisioned-runner-1',

package/src/presentation/routes/report-runner-instances.ts

@@ -20,6 +20,7 @@ export const reportRunnerInstancesRoute = defineRoute({
   handler: async (request) => {
     const context = requireProvisionerContext(request);
     const result = await reportRunnerInstances({
+      scope: context.scope,
       workspaceId: context.scope === 'workspace' ? context.workspaceId : null,
       provisionerId: context.provisionerTokenId,
       events: request.body.events.map((event) => ({

package/src/presentation/routes/runner-enrollment.test.ts

@@ -20,6 +20,7 @@ import {
 import {
   fakeLeaseTokenAuthMethod,
   fakeRunnerSessionAuthMethod,
+  provisionerTokenFactory,
   runnersTestAuthClient,
 } from '#test/index.js';
 import {createRunnerRoutes} from './index.js';
@@ -29,15 +30,27 @@ import {
 } from './runner-enrollment.js';
 
 const token = 'provisioner-test-token';
+const workspaceToken = 'workspace-provisioner-test-token';
 const fakeUserAuth: AuthMethod = {name: AUTH_USER, authenticate: () => Promise.resolve()};
 
 describe('runner enrollment control plane', () => {
   let app: FastifyInstance;
   let provisionerId: string;
+  let workspaceProvisionerId: string;
+  let workspaceProvisionerWorkspaceId: string;
   const provisionerAuth: AuthMethod = {
     name: AUTH_PROVISIONER_TOKEN,
     authenticate: (request: FastifyRequest) => {
-      if (extractBearerToken(request.headers.authorization) !== token)
+      const rawToken = extractBearerToken(request.headers.authorization);
+      if (rawToken === workspaceToken) {
+        setProvisionerContext(request, {
+          scope: 'workspace',
+          workspaceId: workspaceProvisionerWorkspaceId,
+          provisionerTokenId: workspaceProvisionerId,
+        });
+        return Promise.resolve();
+      }
+      if (rawToken !== token)
         throw new ClientError('Invalid provisioner token', 'unauthorized', {status: 401});
       setProvisionerContext(request, {scope: 'installation', provisionerTokenId: provisionerId});
       return Promise.resolve();
@@ -64,8 +77,17 @@ describe('runner enrollment control plane', () => {
     await closeApp();
   });
 
-  beforeEach(() => {
-    provisionerId = crypto.randomUUID();
+  beforeEach(async () => {
+    const provisioner = await provisionerTokenFactory.create({scope: 'installation'});
+    const workspaceProvisioner = await provisionerTokenFactory.create({
+      scope: 'workspace',
+    });
+    if (workspaceProvisioner.scope !== 'workspace') {
+      throw new Error('Expected a workspace provisioner token');
+    }
+    provisionerId = provisioner.id;
+    workspaceProvisionerId = workspaceProvisioner.id;
+    workspaceProvisionerWorkspaceId = workspaceProvisioner.workspaceId;
   });
 
   it('uses the requested assignment wait below the server cap and caps larger requests', () => {
@@ -112,7 +134,11 @@ describe('runner enrollment control plane', () => {
       method: 'POST',
       url: '/runner-control/enrollment',
       headers: {authorization: `Bearer ${controlToken}`},
-      payload: {labels: ['Linux', 'linux'], provider_kind: 'docker', protocol_version: '1'},
+      payload: {
+        labels: ['Linux', 'linux', 'shipfox-managed'],
+        provider_kind: 'docker',
+        protocol_version: '1',
+      },
     });
     expect(enrolled.statusCode).toBe(200);
     expect(enrolled.json()).toEqual({activation_token: null});
@@ -131,7 +157,7 @@ describe('runner enrollment control plane', () => {
       .where(eq(providerRunners.id, runner.runner_instance_id));
     expect(instance).toMatchObject({
       provisionerId,
-      labels: ['linux'],
+      labels: ['linux', 'shipfox-managed'],
       providerRunnerId: 'container-1',
       state: 'running',
       protocolVersion: '1',
@@ -150,6 +176,40 @@ describe('runner enrollment control plane', () => {
     expect(jobs.statusCode).toBe(401);
   });
 
+  it('strips reserved labels when a workspace provisioner enrolls a runner', async () => {
+    const created = await app.inject({
+      method: 'POST',
+      url: '/provisioners/runner-instances/batch',
+      headers: {authorization: `Bearer ${workspaceToken}`},
+      payload: {runner_instances: [{}]},
+    });
+    const runner = created.json().runner_instances[0];
+    const exchanged = await app.inject({
+      method: 'POST',
+      url: '/runner-enrollment/exchange',
+      payload: {bootstrap_token: runner.bootstrap_token},
+    });
+
+    const enrolled = await app.inject({
+      method: 'POST',
+      url: '/runner-control/enrollment',
+      headers: {authorization: `Bearer ${exchanged.json().control_session_token}`},
+      payload: {
+        labels: ['linux', 'shipfox-managed'],
+        provider_kind: 'docker',
+        protocol_version: '1',
+      },
+    });
+
+    const [instance] = await db()
+      .select()
+      .from(providerRunners)
+      .where(eq(providerRunners.id, runner.runner_instance_id));
+
+    expect(enrolled.statusCode).toBe(200);
+    expect(instance?.labels).toEqual(['linux']);
+  });
+
   it('promotes an intended reservation during enrollment and returns its activation token', async () => {
     const workspaceId = crypto.randomUUID();
     const [reservation] = await db()

package/src/temporal/activities/maintenance-activities.test.ts

@@ -1,18 +1,3 @@
-import {
-  deleteExpiredEphemeralRegistrationTokens,
-  deleteExpiredRunnerReservations,
-  deleteExpiredRunnerSessions,
-  detectAndExpireStuckJobs,
-  reapStaleRunnerInstances,
-} from '#core/maintenance.js';
-import {
-  deleteExpiredEphemeralRegistrationTokensActivity,
-  deleteExpiredReservationsActivity,
-  deleteExpiredRunnerSessionsActivity,
-  detectAndExpireStuckJobsActivity,
-  reapStaleRunnerInstancesActivity,
-} from './maintenance-activities.js';
-
 vi.mock('#core/maintenance.js', () => ({
   deleteExpiredEphemeralRegistrationTokens: vi.fn(),
   deleteExpiredRunnerReservations: vi.fn(),
@@ -21,46 +6,52 @@ vi.mock('#core/maintenance.js', () => ({
   reapStaleRunnerInstances: vi.fn(),
 }));
 
-beforeEach(() => {
+let maintenance: typeof import('#core/maintenance.js');
+let activities: typeof import('./maintenance-activities.js');
+
+beforeEach(async () => {
+  vi.resetModules();
+  maintenance = await import('#core/maintenance.js');
+  activities = await import('./maintenance-activities.js');
   vi.clearAllMocks();
 });
 
 describe('detectAndExpireStuckJobsActivity', () => {
   it('delegates to core maintenance', async () => {
-    vi.mocked(detectAndExpireStuckJobs).mockResolvedValueOnce({expired: 2});
+    vi.mocked(maintenance.detectAndExpireStuckJobs).mockResolvedValueOnce({expired: 2});
 
-    const result = await detectAndExpireStuckJobsActivity({thresholdSeconds: 180});
+    const result = await activities.detectAndExpireStuckJobsActivity({thresholdSeconds: 180});
 
     expect(result).toEqual({expired: 2});
-    expect(detectAndExpireStuckJobs).toHaveBeenCalledWith({thresholdSeconds: 180});
+    expect(maintenance.detectAndExpireStuckJobs).toHaveBeenCalledWith({thresholdSeconds: 180});
   });
 });
 
 describe('deleteExpiredReservationsActivity', () => {
   it('delegates to core maintenance', async () => {
-    vi.mocked(deleteExpiredRunnerReservations).mockResolvedValueOnce({deleted: 3});
+    vi.mocked(maintenance.deleteExpiredRunnerReservations).mockResolvedValueOnce({deleted: 3});
 
-    const result = await deleteExpiredReservationsActivity({limit: 50});
+    const result = await activities.deleteExpiredReservationsActivity({limit: 50});
 
     expect(result).toEqual({deleted: 3});
-    expect(deleteExpiredRunnerReservations).toHaveBeenCalledWith({limit: 50});
+    expect(maintenance.deleteExpiredRunnerReservations).toHaveBeenCalledWith({limit: 50});
   });
 });
 
 describe('reapStaleRunnerInstancesActivity', () => {
   it('delegates to core maintenance', async () => {
-    vi.mocked(reapStaleRunnerInstances).mockResolvedValueOnce({
+    vi.mocked(maintenance.reapStaleRunnerInstances).mockResolvedValueOnce({
       reaped: 4,
       reservationsReleased: 2,
     });
 
-    const result = await reapStaleRunnerInstancesActivity({
+    const result = await activities.reapStaleRunnerInstancesActivity({
       thresholdSeconds: 300,
       limit: 100,
     });
 
     expect(result).toEqual({reaped: 4, reservationsReleased: 2});
-    expect(reapStaleRunnerInstances).toHaveBeenCalledWith({
+    expect(maintenance.reapStaleRunnerInstances).toHaveBeenCalledWith({
       thresholdSeconds: 300,
       limit: 100,
     });
@@ -69,16 +60,16 @@ describe('reapStaleRunnerInstancesActivity', () => {
 
 describe('deleteExpiredRunnerSessionsActivity', () => {
   it('delegates to core maintenance', async () => {
-    vi.mocked(deleteExpiredRunnerSessions).mockResolvedValueOnce({deleted: 4});
+    vi.mocked(maintenance.deleteExpiredRunnerSessions).mockResolvedValueOnce({deleted: 4});
 
-    const result = await deleteExpiredRunnerSessionsActivity({
+    const result = await activities.deleteExpiredRunnerSessionsActivity({
       manualRetentionDays: 30,
       ephemeralRetentionDays: 7,
       limit: 25,
     });
 
     expect(result).toEqual({deleted: 4});
-    expect(deleteExpiredRunnerSessions).toHaveBeenCalledWith({
+    expect(maintenance.deleteExpiredRunnerSessions).toHaveBeenCalledWith({
       manualRetentionDays: 30,
       ephemeralRetentionDays: 7,
       limit: 25,
@@ -88,15 +79,17 @@ describe('deleteExpiredRunnerSessionsActivity', () => {
 
 describe('deleteExpiredEphemeralRegistrationTokensActivity', () => {
   it('delegates to core maintenance', async () => {
-    vi.mocked(deleteExpiredEphemeralRegistrationTokens).mockResolvedValueOnce({deleted: 6});
+    vi.mocked(maintenance.deleteExpiredEphemeralRegistrationTokens).mockResolvedValueOnce({
+      deleted: 6,
+    });
 
-    const result = await deleteExpiredEphemeralRegistrationTokensActivity({
+    const result = await activities.deleteExpiredEphemeralRegistrationTokensActivity({
       retentionDays: 7,
       limit: 25,
     });
 
     expect(result).toEqual({deleted: 6});
-    expect(deleteExpiredEphemeralRegistrationTokens).toHaveBeenCalledWith({
+    expect(maintenance.deleteExpiredEphemeralRegistrationTokens).toHaveBeenCalledWith({
       retentionDays: 7,
       limit: 25,
     });

package/test/env.ts

@@ -4,6 +4,7 @@ process.env.POSTGRES_USERNAME ??= 'shipfox';
 process.env.POSTGRES_PASSWORD ??= 'password';
 process.env.POSTGRES_DATABASE = 'api_test';
 process.env.POSTGRES_MAX_CONNECTIONS ??= '5';
+process.env.RUNNER_RESERVED_LABELS ??= 'shipfox-managed';
 process.env.WORKSPACE_JWT_SECRET = 'test-secret';
 process.env.AUTH_ROOT_KEY = 'MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=';
 process.env.TZ = 'UTC';