@shipfox/api-runners 2.0.0

package/src/presentation/routes/list-active-runners.test.ts

@@ -0,0 +1,366 @@
+import {
+  AUTH_LEASED_JOB,
+  AUTH_PROVISIONER_TOKEN,
+  AUTH_RUNNER_REGISTRATION_TOKEN,
+  AUTH_RUNNER_SESSION,
+  AUTH_USER,
+  buildUserContext,
+  setUserContext,
+  type UserContextMembership,
+} from '@shipfox/api-auth-context';
+import type {AuthMethod} from '@shipfox/node-fastify';
+import {ClientError, closeApp, createApp} from '@shipfox/node-fastify';
+import type {FastifyInstance, FastifyRequest} from 'fastify';
+import {db} from '#db/db.js';
+import {provisionedRunners} from '#db/schema/provisioned-runners.js';
+import {runningJobExecutions} from '#db/schema/running-job-executions.js';
+import {runnerSessionFactory} from '#test/index.js';
+import {runnerRoutes} from './index.js';
+
+let authenticatedMemberships: ReadonlyArray<UserContextMembership> = [];
+
+const fakeUserAuth: AuthMethod = {
+  name: AUTH_USER,
+  authenticate: (request: FastifyRequest) => {
+    if (request.headers.authorization !== 'Bearer user') {
+      throw new ClientError('Invalid user token', 'unauthorized', {status: 401});
+    }
+
+    setUserContext(
+      request,
+      buildUserContext({
+        userId: 'user-1',
+        email: 'user@example.com',
+        memberships: authenticatedMemberships,
+      }),
+    );
+    return Promise.resolve();
+  },
+};
+
+const passthroughAuth = (name: string): AuthMethod => ({
+  name,
+  authenticate: () => Promise.resolve(),
+});
+
+describe('GET /workspaces/:workspaceId/runners/active', () => {
+  let app: FastifyInstance;
+  let workspaceId: string;
+
+  beforeEach(async () => {
+    await closeApp();
+    workspaceId = crypto.randomUUID();
+    authenticatedMemberships = [{workspaceId, role: 'admin'}];
+    app = await createApp({
+      auth: [
+        fakeUserAuth,
+        passthroughAuth(AUTH_RUNNER_REGISTRATION_TOKEN),
+        passthroughAuth(AUTH_RUNNER_SESSION),
+        passthroughAuth(AUTH_LEASED_JOB),
+        passthroughAuth(AUTH_PROVISIONER_TOKEN),
+      ],
+      routes: runnerRoutes,
+      swagger: false,
+    });
+    await app.ready();
+  });
+
+  afterEach(async () => {
+    await closeApp();
+  });
+
+  it('returns active provisioned runners merged with running jobs by runner session', async () => {
+    const runnerSession = await runnerSessionFactory.create({workspaceId});
+    const runnerSessionId = runnerSession.id;
+    await db()
+      .insert(provisionedRunners)
+      .values({
+        workspaceId,
+        provisionerId: crypto.randomUUID(),
+        provisionedRunnerId: 'provisioned-runner-1',
+        labels: ['linux'],
+        state: 'running',
+        runnerSessionId,
+        providerKind: 'docker',
+        reportedAt: new Date(),
+      });
+    await db()
+      .insert(runningJobExecutions)
+      .values({
+        workspaceId,
+        jobId: crypto.randomUUID(),
+        jobExecutionId: crypto.randomUUID(),
+        workflowRunId: crypto.randomUUID(),
+        workflowRunAttemptId: crypto.randomUUID(),
+        projectId: crypto.randomUUID(),
+        runnerSessionId,
+        requiredLabels: ['linux'],
+        runnerLabels: ['linux'],
+      });
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/runners/active`,
+      headers: {authorization: 'Bearer user'},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json().runners).toEqual([
+      expect.objectContaining({
+        runner_session_id: runnerSessionId,
+        provisioned_runner_id: 'provisioned-runner-1',
+        state: 'busy',
+        labels: ['linux'],
+      }),
+    ]);
+  });
+
+  it('returns every active job for the same runner session', async () => {
+    const runnerSession = await runnerSessionFactory.create({workspaceId});
+    const runnerSessionId = runnerSession.id;
+    const firstJobId = crypto.randomUUID();
+    const secondJobId = crypto.randomUUID();
+    await db()
+      .insert(provisionedRunners)
+      .values({
+        workspaceId,
+        provisionerId: crypto.randomUUID(),
+        provisionedRunnerId: 'provisioned-runner-1',
+        labels: ['linux'],
+        state: 'running',
+        runnerSessionId,
+        providerKind: 'docker',
+        reportedAt: new Date(),
+      });
+    await db()
+      .insert(runningJobExecutions)
+      .values([
+        {
+          workspaceId,
+          jobId: firstJobId,
+          jobExecutionId: crypto.randomUUID(),
+          workflowRunId: crypto.randomUUID(),
+          workflowRunAttemptId: crypto.randomUUID(),
+          projectId: crypto.randomUUID(),
+          runnerSessionId,
+          requiredLabels: ['linux'],
+          runnerLabels: ['linux'],
+        },
+        {
+          workspaceId,
+          jobId: secondJobId,
+          jobExecutionId: crypto.randomUUID(),
+          workflowRunId: crypto.randomUUID(),
+          workflowRunAttemptId: crypto.randomUUID(),
+          projectId: crypto.randomUUID(),
+          runnerSessionId,
+          requiredLabels: ['linux'],
+          runnerLabels: ['linux'],
+        },
+      ]);
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/runners/active`,
+      headers: {authorization: 'Bearer user'},
+    });
+
+    const body = res.json();
+    expect(res.statusCode).toBe(200);
+    expect(body.runners).toHaveLength(2);
+    expect(body.runners).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          runner_session_id: runnerSessionId,
+          provisioned_runner_id: 'provisioned-runner-1',
+          state: 'busy',
+          job_id: firstJobId,
+        }),
+        expect.objectContaining({
+          runner_session_id: runnerSessionId,
+          provisioned_runner_id: 'provisioned-runner-1',
+          state: 'busy',
+          job_id: secondJobId,
+        }),
+      ]),
+    );
+  });
+
+  it('merges active jobs by provisioned-runner link when the session id is not reported', async () => {
+    const provisionerId = crypto.randomUUID();
+    const runnerSession = await runnerSessionFactory.create({workspaceId});
+    const runnerSessionId = runnerSession.id;
+    const jobId = crypto.randomUUID();
+    await db()
+      .insert(provisionedRunners)
+      .values({
+        workspaceId,
+        provisionerId,
+        provisionedRunnerId: 'provisioned-runner-1',
+        labels: ['linux'],
+        state: 'running',
+        runnerSessionId: null,
+        providerKind: 'docker',
+        reportedAt: new Date(),
+      });
+    await db()
+      .insert(runningJobExecutions)
+      .values({
+        workspaceId,
+        jobId,
+        jobExecutionId: crypto.randomUUID(),
+        workflowRunId: crypto.randomUUID(),
+        workflowRunAttemptId: crypto.randomUUID(),
+        projectId: crypto.randomUUID(),
+        runnerSessionId,
+        provisionerId,
+        provisionedRunnerId: 'provisioned-runner-1',
+        requiredLabels: ['linux'],
+        runnerLabels: ['linux'],
+      });
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/runners/active`,
+      headers: {authorization: 'Bearer user'},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json().runners).toEqual([
+      expect.objectContaining({
+        runner_session_id: runnerSessionId,
+        provisioned_runner_id: 'provisioned-runner-1',
+        provisioner_id: provisionerId,
+        state: 'busy',
+        job_id: jobId,
+      }),
+    ]);
+  });
+
+  it('surfaces the job link for a busy runner without an active provisioned-runner row', async () => {
+    const provisionerId = crypto.randomUUID();
+    const runnerSession = await runnerSessionFactory.create({workspaceId});
+    const runnerSessionId = runnerSession.id;
+    const jobId = crypto.randomUUID();
+    await db()
+      .insert(runningJobExecutions)
+      .values({
+        workspaceId,
+        jobId,
+        jobExecutionId: crypto.randomUUID(),
+        workflowRunId: crypto.randomUUID(),
+        workflowRunAttemptId: crypto.randomUUID(),
+        projectId: crypto.randomUUID(),
+        runnerSessionId,
+        provisionerId,
+        provisionedRunnerId: 'provisioned-runner-1',
+        requiredLabels: ['linux'],
+        runnerLabels: ['linux'],
+      });
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/runners/active`,
+      headers: {authorization: 'Bearer user'},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json().runners).toEqual([
+      expect.objectContaining({
+        runner_session_id: runnerSessionId,
+        provisioned_runner_id: 'provisioned-runner-1',
+        provisioner_id: provisionerId,
+        state: 'busy',
+        job_id: jobId,
+      }),
+    ]);
+  });
+
+  it('keeps a provisioned runner visible when its session fallback job was already merged', async () => {
+    const provisionerId = crypto.randomUUID();
+    const runnerSession = await runnerSessionFactory.create({workspaceId});
+    const runnerSessionId = runnerSession.id;
+    const jobId = crypto.randomUUID();
+    const older = new Date(Date.now() - 1000);
+    const newer = new Date();
+    await db()
+      .insert(provisionedRunners)
+      .values([
+        {
+          workspaceId,
+          provisionerId,
+          provisionedRunnerId: 'provisioned-runner-b',
+          labels: ['linux'],
+          state: 'running',
+          runnerSessionId,
+          providerKind: 'docker',
+          reportedAt: older,
+          updatedAt: older,
+        },
+        {
+          workspaceId,
+          provisionerId,
+          provisionedRunnerId: 'provisioned-runner-a',
+          labels: ['linux'],
+          state: 'running',
+          runnerSessionId: null,
+          providerKind: 'docker',
+          reportedAt: newer,
+          updatedAt: newer,
+        },
+      ]);
+    await db()
+      .insert(runningJobExecutions)
+      .values({
+        workspaceId,
+        jobId,
+        jobExecutionId: crypto.randomUUID(),
+        workflowRunId: crypto.randomUUID(),
+        workflowRunAttemptId: crypto.randomUUID(),
+        projectId: crypto.randomUUID(),
+        runnerSessionId,
+        provisionerId,
+        provisionedRunnerId: 'provisioned-runner-a',
+        requiredLabels: ['linux'],
+        runnerLabels: ['linux'],
+      });
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/runners/active`,
+      headers: {authorization: 'Bearer user'},
+    });
+
+    const body = res.json();
+    expect(res.statusCode).toBe(200);
+    expect(body.runners).toHaveLength(2);
+    expect(body.runners).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          runner_session_id: runnerSessionId,
+          provisioned_runner_id: 'provisioned-runner-a',
+          state: 'busy',
+          job_id: jobId,
+        }),
+        expect.objectContaining({
+          runner_session_id: runnerSessionId,
+          provisioned_runner_id: 'provisioned-runner-b',
+          state: 'running',
+          job_id: null,
+        }),
+      ]),
+    );
+  });
+
+  it('returns 403 when the user is not a workspace member', async () => {
+    authenticatedMemberships = [{workspaceId: crypto.randomUUID(), role: 'admin'}];
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/runners/active`,
+      headers: {authorization: 'Bearer user'},
+    });
+
+    expect(res.statusCode).toBe(403);
+  });
+});

package/src/presentation/routes/list-active-runners.ts

@@ -0,0 +1,25 @@
+import {activeRunnersResponseSchema} from '@shipfox/api-runners-dto';
+import {defineRoute} from '@shipfox/node-fastify';
+import {z} from 'zod';
+import {listActiveRunners} from '#core/index.js';
+import {toActiveRunnersResponseDto} from '#presentation/dto/index.js';
+import {requireManualRegistrationTokenWorkspaceMembership} from './workspace-membership.js';
+
+export const listActiveRunnersRoute = defineRoute({
+  method: 'GET',
+  path: '/',
+  description: 'List active runners and provisioned runners for a workspace',
+  schema: {
+    params: z.object({workspaceId: z.string().uuid()}),
+    response: {
+      200: activeRunnersResponseSchema,
+    },
+  },
+  handler: async (request) => {
+    const {workspaceId} = request.params;
+    requireManualRegistrationTokenWorkspaceMembership({request, workspaceId});
+
+    const runners = await listActiveRunners({workspaceId});
+    return toActiveRunnersResponseDto(runners);
+  },
+});

package/src/presentation/routes/list-manual-registration-tokens.ts

@@ -0,0 +1,25 @@
+import {listManualRegistrationTokensResponseSchema} from '@shipfox/api-runners-dto';
+import {defineRoute} from '@shipfox/node-fastify';
+import {z} from 'zod';
+import {listUsableManualRegistrationTokens} from '#core/index.js';
+import {toManualRegistrationTokenDto} from '#presentation/dto/index.js';
+import {requireManualRegistrationTokenWorkspaceMembership} from './workspace-membership.js';
+
+export const listManualRegistrationTokensRoute = defineRoute({
+  method: 'GET',
+  path: '/',
+  description: 'List currently usable manual registration tokens for a workspace',
+  schema: {
+    params: z.object({workspaceId: z.string().uuid()}),
+    response: {
+      200: listManualRegistrationTokensResponseSchema,
+    },
+  },
+  handler: async (request) => {
+    const {workspaceId} = request.params;
+    requireManualRegistrationTokenWorkspaceMembership({request, workspaceId});
+
+    const tokens = await listUsableManualRegistrationTokens(workspaceId);
+    return {manual_registration_tokens: tokens.map(toManualRegistrationTokenDto)};
+  },
+});

package/src/presentation/routes/list-provisioner-tokens.ts

@@ -0,0 +1,25 @@
+import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
+import {listProvisionerTokensResponseSchema} from '@shipfox/api-runners-dto';
+import {defineRoute} from '@shipfox/node-fastify';
+import {z} from 'zod';
+import {listUsableProvisionerTokens} from '#core/index.js';
+import {toProvisionerTokenDto} from '#presentation/dto/index.js';
+
+export const listProvisionerTokensRoute = defineRoute({
+  method: 'GET',
+  path: '/',
+  description: 'List currently usable provisioner tokens for a workspace',
+  schema: {
+    params: z.object({workspaceId: z.string().uuid()}),
+    response: {
+      200: listProvisionerTokensResponseSchema,
+    },
+  },
+  handler: async (request) => {
+    const {workspaceId} = request.params;
+    requireWorkspaceAccess({request, workspaceId});
+
+    const tokens = await listUsableProvisionerTokens(workspaceId);
+    return {tokens: tokens.map(toProvisionerTokenDto)};
+  },
+});

package/src/presentation/routes/manual-registration-tokens.test.ts

@@ -0,0 +1,213 @@
+import {createLeaseTokenAuthMethod, createRunnerSessionAuthMethod} from '@shipfox/api-auth';
+import {
+  AUTH_LEASED_JOB,
+  AUTH_PROVISIONER_TOKEN,
+  AUTH_RUNNER_REGISTRATION_TOKEN,
+  AUTH_RUNNER_SESSION,
+  AUTH_USER,
+  buildUserContext,
+  setUserContext,
+  type UserContextMembership,
+} from '@shipfox/api-auth-context';
+import type {AuthMethod} from '@shipfox/node-fastify';
+import {ClientError, closeApp, createApp} from '@shipfox/node-fastify';
+import {hashOpaqueToken, tokenTypeParts} from '@shipfox/node-tokens';
+import {eq} from 'drizzle-orm';
+import type {FastifyInstance, FastifyRequest} from 'fastify';
+import {db} from '#db/db.js';
+import {revokeManualRegistrationToken} from '#db/manual-registration-tokens.js';
+import {manualRegistrationTokens} from '#db/schema/manual-registration-tokens.js';
+import {createRunnerRegistrationTokenAuthMethod} from '#presentation/auth/index.js';
+import {manualRegistrationTokenFactory} from '#test/index.js';
+import {runnerRoutes} from './index.js';
+
+let authenticatedMemberships: ReadonlyArray<UserContextMembership> = [];
+
+const fakeUserAuth: AuthMethod = {
+  name: AUTH_USER,
+  authenticate: (request: FastifyRequest) => {
+    if (request.headers.authorization !== 'Bearer user') {
+      throw new ClientError('Invalid user token', 'unauthorized', {status: 401});
+    }
+
+    setUserContext(
+      request,
+      buildUserContext({
+        userId: 'user-1',
+        email: 'user@example.com',
+        memberships: authenticatedMemberships,
+      }),
+    );
+    return Promise.resolve();
+  },
+};
+
+const fakeProvisionerAuth: AuthMethod = {
+  name: AUTH_PROVISIONER_TOKEN,
+  authenticate: () => Promise.resolve(),
+};
+
+describe('manual registration token routes', () => {
+  let app: FastifyInstance;
+  let workspaceId: string;
+
+  beforeEach(async () => {
+    await closeApp();
+    workspaceId = crypto.randomUUID();
+    authenticatedMemberships = [{workspaceId, role: 'admin'}];
+    app = await createApp({
+      auth: [
+        fakeUserAuth,
+        createRunnerRegistrationTokenAuthMethod(),
+        createRunnerSessionAuthMethod(),
+        createLeaseTokenAuthMethod(),
+        fakeProvisionerAuth,
+      ],
+      routes: runnerRoutes,
+      swagger: false,
+    });
+    await app.ready();
+  });
+
+  afterEach(async () => {
+    await closeApp();
+  });
+
+  test('uses the expected auth method for each runner route group', () => {
+    expect(runnerRoutes[0]?.auth).toBe(AUTH_USER);
+    expect(runnerRoutes[1]?.auth).toBe(AUTH_USER);
+    expect(runnerRoutes[2]?.auth).toBe(AUTH_RUNNER_REGISTRATION_TOKEN);
+    expect(runnerRoutes[3]?.auth).toBe(AUTH_RUNNER_SESSION);
+    expect(runnerRoutes[4]?.auth).toBe(AUTH_LEASED_JOB);
+    expect(runnerRoutes[5]?.auth).toBe(AUTH_PROVISIONER_TOKEN);
+  });
+
+  describe('GET /workspaces/:workspaceId/runners/manual-registration-tokens', () => {
+    it('returns 401 without client auth', async () => {
+      const res = await app.inject({
+        method: 'GET',
+        url: `/workspaces/${workspaceId}/runners/manual-registration-tokens`,
+      });
+
+      expect(res.statusCode).toBe(401);
+    });
+
+    it('rejects API-key-only requests', async () => {
+      const res = await app.inject({
+        method: 'GET',
+        url: `/workspaces/${workspaceId}/runners/manual-registration-tokens`,
+        headers: {authorization: `Bearer api:${workspaceId}`},
+      });
+
+      expect(res.statusCode).toBe(401);
+      expect(res.json().code).toBe('unauthorized');
+    });
+
+    it('returns 403 when the user is not a workspace member', async () => {
+      authenticatedMemberships = [{workspaceId: crypto.randomUUID(), role: 'admin'}];
+
+      const res = await app.inject({
+        method: 'GET',
+        url: `/workspaces/${workspaceId}/runners/manual-registration-tokens`,
+        headers: {authorization: 'Bearer user'},
+      });
+
+      expect(res.statusCode).toBe(403);
+      expect(res.json().code).toBe('forbidden');
+    });
+
+    it('returns only usable tokens for the workspace', async () => {
+      const usable = await manualRegistrationTokenFactory.create({workspaceId, name: 'usable'});
+      const expired = await manualRegistrationTokenFactory.create({
+        workspaceId,
+        name: 'expired',
+        expiresAt: new Date(Date.now() - 60_000),
+      });
+      const revoked = await manualRegistrationTokenFactory.create({workspaceId, name: 'revoked'});
+      await manualRegistrationTokenFactory.create({
+        workspaceId: crypto.randomUUID(),
+        name: 'other workspace',
+      });
+      await revokeManualRegistrationToken({tokenId: revoked.id, workspaceId});
+
+      const res = await app.inject({
+        method: 'GET',
+        url: `/workspaces/${workspaceId}/runners/manual-registration-tokens`,
+        headers: {authorization: 'Bearer user'},
+      });
+
+      expect(res.statusCode).toBe(200);
+      expect(res.json().manual_registration_tokens.map((token: {id: string}) => token.id)).toEqual([
+        usable.id,
+      ]);
+      expect(
+        res.json().manual_registration_tokens.map((token: {id: string}) => token.id),
+      ).not.toContain(expired.id);
+    });
+  });
+
+  describe('POST /workspaces/:workspaceId/runners/manual-registration-tokens', () => {
+    it('returns 401 without client auth', async () => {
+      const res = await app.inject({
+        method: 'POST',
+        url: `/workspaces/${workspaceId}/runners/manual-registration-tokens`,
+        payload: {name: 'builder'},
+      });
+
+      expect(res.statusCode).toBe(401);
+    });
+
+    it('creates a workspace-scoped manual registration token and returns the raw token once', async () => {
+      const res = await app.inject({
+        method: 'POST',
+        url: `/workspaces/${workspaceId}/runners/manual-registration-tokens`,
+        headers: {authorization: 'Bearer user'},
+        payload: {name: 'builder', ttl_seconds: 3600},
+      });
+
+      expect(res.statusCode).toBe(201);
+      const body = res.json();
+      expect(body.raw_token.startsWith(`sf_${tokenTypeParts.manualRegistrationToken}_`)).toBe(true);
+      expect(body.prefix).toBe(body.raw_token.slice(0, 12));
+      expect(body.name).toBe('builder');
+      expect(body.workspace_id).toBe(workspaceId);
+      expect(body.expires_at).not.toBeNull();
+
+      const rows = await db()
+        .select()
+        .from(manualRegistrationTokens)
+        .where(eq(manualRegistrationTokens.id, body.id));
+      expect(rows[0]?.hashedToken).toBe(hashOpaqueToken(body.raw_token));
+      expect(rows[0]?.hashedToken).not.toBe(body.raw_token);
+    });
+  });
+
+  describe('POST /workspaces/:workspaceId/runners/manual-registration-tokens/:tokenId/revoke', () => {
+    it('revokes a token owned by the authenticated workspace', async () => {
+      const token = await manualRegistrationTokenFactory.create({workspaceId});
+
+      const res = await app.inject({
+        method: 'POST',
+        url: `/workspaces/${workspaceId}/runners/manual-registration-tokens/${token.id}/revoke`,
+        headers: {authorization: 'Bearer user'},
+      });
+
+      expect(res.statusCode).toBe(200);
+      expect(res.json().id).toBe(token.id);
+      expect(res.json().revoked_at).not.toBeNull();
+    });
+
+    it('returns 404 for a token owned by another workspace', async () => {
+      const token = await manualRegistrationTokenFactory.create({workspaceId: crypto.randomUUID()});
+
+      const res = await app.inject({
+        method: 'POST',
+        url: `/workspaces/${workspaceId}/runners/manual-registration-tokens/${token.id}/revoke`,
+        headers: {authorization: 'Bearer user'},
+      });
+
+      expect(res.statusCode).toBe(404);
+      expect(res.json().code).toBe('not-found');
+    });
+  });
+});