@shipfox/api-runners 2.0.0

package/src/db/provisioner-tokens.test.ts

@@ -0,0 +1,133 @@
+import {hashOpaqueToken} from '@shipfox/node-tokens';
+import {sql} from 'drizzle-orm';
+import {db} from '#db/db.js';
+import {
+  createProvisionerToken,
+  listActiveProvisionerTokens,
+  listUsableProvisionerTokensByWorkspaceId,
+  resolveProvisionerTokenByHash,
+  revokeProvisionerToken,
+  touchProvisionerLastSeen,
+} from '#db/provisioner-tokens.js';
+import {provisionerTokenFactory} from '#test/index.js';
+
+describe('provisioner token db', () => {
+  it('creates and resolves a token', async () => {
+    const workspaceId = crypto.randomUUID();
+    const rawToken = 'sf_pt_test-token';
+    const createdByUserId = crypto.randomUUID();
+    const token = await createProvisionerToken({
+      workspaceId,
+      hashedToken: hashOpaqueToken(rawToken),
+      prefix: rawToken.slice(0, 12),
+      name: 'scaler',
+      createdByUserId,
+    });
+
+    const result = await resolveProvisionerTokenByHash(hashOpaqueToken(rawToken));
+
+    expect(result?.id).toBe(token.id);
+    expect(result?.workspaceId).toBe(workspaceId);
+    expect(result?.createdByUserId).toBe(createdByUserId);
+  });
+
+  it('returns undefined when resolving an unknown token hash', async () => {
+    const result = await resolveProvisionerTokenByHash(hashOpaqueToken('sf_pt_unknown-token'));
+
+    expect(result).toBeUndefined();
+  });
+
+  it('lists usable tokens for a workspace', async () => {
+    const workspaceId = crypto.randomUUID();
+    const usable = await provisionerTokenFactory.create({workspaceId, name: 'usable'});
+    const expired = await provisionerTokenFactory.create({
+      workspaceId,
+      name: 'expired',
+      expiresAt: new Date(Date.now() - 60_000),
+    });
+    const revoked = await provisionerTokenFactory.create({workspaceId, name: 'revoked'});
+    await provisionerTokenFactory.create({
+      workspaceId: crypto.randomUUID(),
+      name: 'other workspace',
+    });
+    await revokeProvisionerToken({
+      tokenId: revoked.id,
+      workspaceId,
+      revokedByUserId: crypto.randomUUID(),
+    });
+
+    const tokens = await listUsableProvisionerTokensByWorkspaceId(workspaceId);
+
+    expect(tokens.map((token) => token.id)).toEqual([usable.id]);
+    expect(tokens.map((token) => token.id)).not.toContain(expired.id);
+  });
+
+  it('revokes a token and records the revoking user', async () => {
+    const workspaceId = crypto.randomUUID();
+    const token = await provisionerTokenFactory.create({workspaceId});
+    const revokedByUserId = crypto.randomUUID();
+
+    const revoked = await revokeProvisionerToken({tokenId: token.id, workspaceId, revokedByUserId});
+
+    expect(revoked?.id).toBe(token.id);
+    expect(revoked?.revokedAt).toBeInstanceOf(Date);
+    expect(revoked?.revokedByUserId).toBe(revokedByUserId);
+  });
+
+  it('preserves the original revocation audit fields on repeat revoke', async () => {
+    const workspaceId = crypto.randomUUID();
+    const token = await provisionerTokenFactory.create({workspaceId});
+    const firstRevokedByUserId = crypto.randomUUID();
+    const secondRevokedByUserId = crypto.randomUUID();
+
+    const first = await revokeProvisionerToken({
+      tokenId: token.id,
+      workspaceId,
+      revokedByUserId: firstRevokedByUserId,
+    });
+    const second = await revokeProvisionerToken({
+      tokenId: token.id,
+      workspaceId,
+      revokedByUserId: secondRevokedByUserId,
+    });
+
+    expect(second?.id).toBe(token.id);
+    expect(second?.revokedAt?.toISOString()).toBe(first?.revokedAt?.toISOString());
+    expect(second?.revokedByUserId).toBe(firstRevokedByUserId);
+  });
+
+  it('touches last seen only after the throttle window', async () => {
+    const workspaceId = crypto.randomUUID();
+    const token = await provisionerTokenFactory.create({workspaceId});
+
+    await touchProvisionerLastSeen({tokenId: token.id, throttleSeconds: 10});
+    const first = await resolveProvisionerTokenByHash(token.hashedToken);
+    await touchProvisionerLastSeen({tokenId: token.id, throttleSeconds: 10});
+    const second = await resolveProvisionerTokenByHash(token.hashedToken);
+
+    expect(first?.lastSeenAt).toBeInstanceOf(Date);
+    expect(second?.lastSeenAt?.toISOString()).toBe(first?.lastSeenAt?.toISOString());
+  });
+
+  it('lists active usable provisioner tokens', async () => {
+    const workspaceId = crypto.randomUUID();
+    const active = await provisionerTokenFactory.create({workspaceId, name: 'active'});
+    const stale = await provisionerTokenFactory.create({workspaceId, name: 'stale'});
+    const revoked = await provisionerTokenFactory.create({workspaceId, name: 'revoked'});
+    await touchProvisionerLastSeen({tokenId: active.id, throttleSeconds: 10});
+    await touchProvisionerLastSeen({tokenId: stale.id, throttleSeconds: 10});
+    await touchProvisionerLastSeen({tokenId: revoked.id, throttleSeconds: 10});
+    await db().execute(
+      sql`UPDATE runners_provisioner_tokens SET last_seen_at = now() - interval '10 minutes' WHERE id = ${stale.id}`,
+    );
+    await revokeProvisionerToken({
+      tokenId: revoked.id,
+      workspaceId,
+      revokedByUserId: crypto.randomUUID(),
+    });
+
+    const tokens = await listActiveProvisionerTokens({workspaceId, windowSeconds: 120});
+
+    expect(tokens.map((token) => token.id)).toEqual([active.id]);
+  });
+});

package/src/db/provisioner-tokens.ts

@@ -0,0 +1,142 @@
+import {and, desc, eq, gt, isNull, or, sql} from 'drizzle-orm';
+import type {ActiveProvisionerToken, ProvisionerToken} from '#core/entities/provisioner-token.js';
+import {db} from './db.js';
+import {provisionerTokens, toProvisionerToken} from './schema/provisioner-tokens.js';
+
+export interface CreateProvisionerTokenParams {
+  workspaceId: string;
+  hashedToken: string;
+  prefix: string;
+  createdByUserId: string;
+  name?: string | undefined;
+  expiresAt?: Date | undefined;
+}
+
+export async function createProvisionerToken(
+  params: CreateProvisionerTokenParams,
+): Promise<ProvisionerToken> {
+  const rows = await db()
+    .insert(provisionerTokens)
+    .values({
+      workspaceId: params.workspaceId,
+      hashedToken: params.hashedToken,
+      prefix: params.prefix,
+      createdByUserId: params.createdByUserId,
+      name: params.name ?? null,
+      expiresAt: params.expiresAt ?? null,
+    })
+    .returning();
+
+  const row = rows[0];
+  if (!row) throw new Error('Insert returned no rows');
+  return toProvisionerToken(row);
+}
+
+export async function listUsableProvisionerTokensByWorkspaceId(
+  workspaceId: string,
+): Promise<ProvisionerToken[]> {
+  const now = new Date();
+  const rows = await db()
+    .select()
+    .from(provisionerTokens)
+    .where(
+      and(
+        eq(provisionerTokens.workspaceId, workspaceId),
+        isNull(provisionerTokens.revokedAt),
+        or(isNull(provisionerTokens.expiresAt), gt(provisionerTokens.expiresAt, now)),
+      ),
+    )
+    .orderBy(desc(provisionerTokens.createdAt), desc(provisionerTokens.id));
+
+  return rows.map(toProvisionerToken);
+}
+
+export async function resolveProvisionerTokenByHash(
+  hashedToken: string,
+): Promise<ProvisionerToken | undefined> {
+  const rows = await db()
+    .select()
+    .from(provisionerTokens)
+    .where(eq(provisionerTokens.hashedToken, hashedToken))
+    .limit(1);
+
+  const row = rows[0];
+  if (!row) return undefined;
+  return toProvisionerToken(row);
+}
+
+export async function revokeProvisionerToken(params: {
+  tokenId: string;
+  workspaceId: string;
+  revokedByUserId: string;
+}): Promise<ProvisionerToken | undefined> {
+  const rows = await db()
+    .update(provisionerTokens)
+    .set({revokedAt: new Date(), revokedByUserId: params.revokedByUserId, updatedAt: new Date()})
+    .where(
+      and(
+        eq(provisionerTokens.id, params.tokenId),
+        eq(provisionerTokens.workspaceId, params.workspaceId),
+        isNull(provisionerTokens.revokedAt),
+      ),
+    )
+    .returning();
+
+  const row = rows[0];
+  if (row) return toProvisionerToken(row);
+
+  const existingRows = await db()
+    .select()
+    .from(provisionerTokens)
+    .where(
+      and(
+        eq(provisionerTokens.id, params.tokenId),
+        eq(provisionerTokens.workspaceId, params.workspaceId),
+      ),
+    )
+    .limit(1);
+
+  const existingRow = existingRows[0];
+  if (!existingRow) return undefined;
+  return toProvisionerToken(existingRow);
+}
+
+export async function touchProvisionerLastSeen(params: {
+  tokenId: string;
+  throttleSeconds: number;
+}): Promise<void> {
+  await db()
+    .update(provisionerTokens)
+    .set({lastSeenAt: sql`now()`, updatedAt: sql`now()`})
+    .where(
+      and(
+        eq(provisionerTokens.id, params.tokenId),
+        or(
+          isNull(provisionerTokens.lastSeenAt),
+          sql`${provisionerTokens.lastSeenAt} < now() - (${params.throttleSeconds} || ' seconds')::interval`,
+        ),
+      ),
+    );
+}
+
+export async function listActiveProvisionerTokens(params: {
+  workspaceId: string;
+  windowSeconds: number;
+}): Promise<ActiveProvisionerToken[]> {
+  const rows = await db()
+    .select()
+    .from(provisionerTokens)
+    .where(
+      and(
+        eq(provisionerTokens.workspaceId, params.workspaceId),
+        isNull(provisionerTokens.revokedAt),
+        or(isNull(provisionerTokens.expiresAt), gt(provisionerTokens.expiresAt, sql`now()`)),
+        sql`${provisionerTokens.lastSeenAt} > now() - (${params.windowSeconds} || ' seconds')::interval`,
+      ),
+    )
+    .orderBy(desc(provisionerTokens.lastSeenAt), desc(provisionerTokens.id));
+
+  return rows.map(toProvisionerToken).filter((token): token is ActiveProvisionerToken => {
+    return token.lastSeenAt !== null;
+  });
+}

package/src/db/rate-limits.test.ts

@@ -0,0 +1,74 @@
+import {and, eq, sql} from 'drizzle-orm';
+import {consumeRunnersRateLimit, pruneExpiredRunnersRateLimits} from '#db/rate-limits.js';
+import {db} from './db.js';
+import {runnersRateLimits} from './schema/rate-limits.js';
+
+describe('runners rate limits db', () => {
+  it('atomically increments one bucket for concurrent attempts', async () => {
+    const identifierHmac = `hmac-${crypto.randomUUID()}`;
+    const params = {
+      action: 'provisioner-mint',
+      scope: 'provisioner',
+      identifierHmac,
+      windowStart: new Date('2026-06-23T00:00:00Z'),
+      expiresAt: new Date('2026-06-23T00:01:00Z'),
+      timeoutMs: 5_000,
+    };
+
+    await Promise.all(Array.from({length: 20}, () => consumeRunnersRateLimit(params)));
+
+    const [row] = await db()
+      .select({count: runnersRateLimits.count})
+      .from(runnersRateLimits)
+      .where(eq(runnersRateLimits.identifierHmac, identifierHmac));
+    expect(row?.count).toBe(20);
+  });
+
+  it('prunes expired counters and keeps active counters', async () => {
+    const expiredIdentifierHmac = `expired-${crypto.randomUUID()}`;
+    const activeIdentifierHmac = `active-${crypto.randomUUID()}`;
+    await db()
+      .insert(runnersRateLimits)
+      .values([
+        {
+          action: 'provisioner-mint',
+          scope: 'provisioner',
+          identifierHmac: expiredIdentifierHmac,
+          windowStart: new Date('2026-06-23T00:00:00Z'),
+          count: 1,
+          expiresAt: new Date('2026-06-23T00:01:00Z'),
+        },
+        {
+          action: 'provisioner-mint',
+          scope: 'provisioner',
+          identifierHmac: activeIdentifierHmac,
+          windowStart: new Date('2026-06-23T00:04:00Z'),
+          count: 1,
+          expiresAt: new Date('2026-06-23T00:06:00Z'),
+        },
+      ]);
+
+    const result = await pruneExpiredRunnersRateLimits({
+      now: new Date('2026-06-23T00:05:00Z'),
+      minIntervalMs: 0,
+    });
+
+    expect(result).toBeGreaterThanOrEqual(1);
+    expect(await countBucket(expiredIdentifierHmac)).toBe(0);
+    expect(await countBucket(activeIdentifierHmac)).toBe(1);
+  });
+
+  async function countBucket(identifierHmac: string): Promise<number> {
+    const [row] = await db()
+      .select({count: sql<number>`count(*)::int`})
+      .from(runnersRateLimits)
+      .where(
+        and(
+          eq(runnersRateLimits.action, 'provisioner-mint'),
+          eq(runnersRateLimits.scope, 'provisioner'),
+          eq(runnersRateLimits.identifierHmac, identifierHmac),
+        ),
+      );
+    return row?.count ?? 0;
+  }
+});

package/src/db/rate-limits.ts

@@ -0,0 +1,69 @@
+import {lt, sql} from 'drizzle-orm';
+import {db} from './db.js';
+import {runnersRateLimits} from './schema/rate-limits.js';
+
+export interface ConsumeRunnersRateLimitParams {
+  action: string;
+  scope: string;
+  identifierHmac: string;
+  windowStart: Date;
+  expiresAt: Date;
+  timeoutMs: number;
+}
+
+export interface ConsumeRunnersRateLimitResult {
+  count: number;
+  expiresAt: Date;
+}
+
+export async function consumeRunnersRateLimit(
+  params: ConsumeRunnersRateLimitParams,
+): Promise<ConsumeRunnersRateLimitResult> {
+  return await db().transaction(async (tx) => {
+    await tx.execute(sql`select set_config('statement_timeout', ${`${params.timeoutMs}ms`}, true)`);
+
+    const rows = await tx
+      .insert(runnersRateLimits)
+      .values({
+        action: params.action,
+        scope: params.scope,
+        identifierHmac: params.identifierHmac,
+        windowStart: params.windowStart,
+        count: 1,
+        expiresAt: params.expiresAt,
+      })
+      .onConflictDoUpdate({
+        target: [
+          runnersRateLimits.action,
+          runnersRateLimits.scope,
+          runnersRateLimits.identifierHmac,
+          runnersRateLimits.windowStart,
+        ],
+        set: {
+          count: sql`${runnersRateLimits.count} + 1`,
+          updatedAt: sql`now()`,
+        },
+      })
+      .returning({count: runnersRateLimits.count, expiresAt: runnersRateLimits.expiresAt});
+
+    const row = rows[0];
+    if (!row) throw new Error('Rate limit upsert returned no rows');
+    return row;
+  });
+}
+
+let nextPruneAt = 0;
+
+export async function pruneExpiredRunnersRateLimits(
+  params: {now?: Date | undefined; minIntervalMs?: number | undefined} = {},
+): Promise<number | undefined> {
+  const now = params.now ?? new Date();
+  const minIntervalMs = params.minIntervalMs ?? 60_000;
+  if (minIntervalMs > 0 && now.getTime() < nextPruneAt) return undefined;
+
+  nextPruneAt = now.getTime() + minIntervalMs;
+
+  const result = await db().delete(runnersRateLimits).where(lt(runnersRateLimits.expiresAt, now));
+
+  return result.rowCount ?? 0;
+}