@shipfox/api-runners 5.0.0 → 6.0.0

package/src/presentation/routes/{report-provisioned-runners.test.ts → report-runner-instances.test.ts}

@@ -17,11 +17,11 @@ import {vi} from '@shipfox/vitest/vi';
 import {and, eq} from 'drizzle-orm';
 import type {FastifyInstance, FastifyRequest} from 'fastify';
 import {db} from '#db/db.js';
-import {provisionedRunners} from '#db/schema/provisioned-runners.js';
+import {providerRunners} from '#db/schema/runner-instances.js';
 import {runningJobExecutions} from '#db/schema/running-job-executions.js';
-import {provisionedRunnerTerminateIntentHonoredCount} from '#metrics/instance.js';
-import {provisionedRunnerFactory, runnerSessionFactory} from '#test/index.js';
-import {runnerRoutes} from './index.js';
+import {providerRunnerTerminateIntentHonoredCount} from '#metrics/instance.js';
+import {providerRunnerFactory, runnerSessionFactory, runnersTestAuthClient} from '#test/index.js';
+import {createRunnerRoutes} from './index.js';
 
 const VALID_PROVISIONER_TOKEN = 'valid-provisioner-token';
 
@@ -30,7 +30,7 @@ const passthroughAuth = (name: string): AuthMethod => ({
   authenticate: () => Promise.resolve(),
 });
 
-describe('POST /provisioners/provisioned-runners/report', () => {
+describe('POST /provisioners/runner-instances/report', () => {
   let app: FastifyInstance;
   let workspaceId: string;
   let provisionerTokenId: string;
@@ -42,7 +42,7 @@ describe('POST /provisioners/provisioned-runners/report', () => {
       if (rawToken !== VALID_PROVISIONER_TOKEN) {
         throw new ClientError('Invalid provisioner token', 'unauthorized', {status: 401});
       }
-      setProvisionerContext(request, {workspaceId, provisionerTokenId});
+      setProvisionerContext(request, {scope: 'workspace', workspaceId, provisionerTokenId});
       return Promise.resolve();
     },
   };
@@ -56,7 +56,7 @@ describe('POST /provisioners/provisioned-runners/report', () => {
         passthroughAuth(AUTH_LEASED_JOB),
         fakeProvisionerAuth,
       ],
-      routes: runnerRoutes,
+      routes: createRunnerRoutes(runnersTestAuthClient),
       swagger: false,
     });
     await app.ready();
@@ -76,12 +76,12 @@ describe('POST /provisioners/provisioned-runners/report', () => {
 
     const res = await app.inject({
       method: 'POST',
-      url: '/provisioners/provisioned-runners/report',
+      url: '/provisioners/runner-instances/report',
       headers: {authorization: `Bearer ${VALID_PROVISIONER_TOKEN}`},
       payload: {
         events: [
           {
-            provisioned_runner_id: 'provisioned-runner-1',
+            provider_runner_id: 'provisioned-runner-1',
             labels: ['linux'],
             state: 'starting',
             reported_at: reportedAt,
@@ -93,11 +93,11 @@ describe('POST /provisioners/provisioned-runners/report', () => {
 
     const rows = await db()
       .select()
-      .from(provisionedRunners)
+      .from(providerRunners)
       .where(
         and(
-          eq(provisionedRunners.workspaceId, workspaceId),
-          eq(provisionedRunners.provisionerId, provisionerTokenId),
+          eq(providerRunners.workspaceId, workspaceId),
+          eq(providerRunners.provisionerId, provisionerTokenId),
         ),
       );
     expect(res.statusCode).toBe(200);
@@ -105,7 +105,7 @@ describe('POST /provisioners/provisioned-runners/report', () => {
     expect(rows[0]).toMatchObject({
       workspaceId,
       provisionerId: provisionerTokenId,
-      provisionedRunnerId: 'provisioned-runner-1',
+      providerRunnerId: 'provisioned-runner-1',
       state: 'starting',
       labels: ['linux'],
       providerKind: 'docker',
@@ -115,7 +115,7 @@ describe('POST /provisioners/provisioned-runners/report', () => {
 
   it('returns 400 when the batch exceeds the DTO limit', async () => {
     const event = {
-      provisioned_runner_id: 'provisioned-runner-1',
+      provider_runner_id: 'provisioned-runner-1',
       labels: ['linux'],
       state: 'running',
       reported_at: new Date().toISOString(),
@@ -123,12 +123,12 @@ describe('POST /provisioners/provisioned-runners/report', () => {
 
     const res = await app.inject({
       method: 'POST',
-      url: '/provisioners/provisioned-runners/report',
+      url: '/provisioners/runner-instances/report',
       headers: {authorization: `Bearer ${VALID_PROVISIONER_TOKEN}`},
       payload: {
         events: Array.from({length: 1001}, (_, index) => ({
           ...event,
-          provisioned_runner_id: `provisioned-runner-${index}`,
+          provider_runner_id: `provisioned-runner-${index}`,
         })),
       },
     });
@@ -137,12 +137,12 @@ describe('POST /provisioners/provisioned-runners/report', () => {
   });
 
   it('increments the honored terminate-intent metric once for a terminated report', async () => {
-    const honoredSpy = vi.spyOn(provisionedRunnerTerminateIntentHonoredCount, 'add');
+    const honoredSpy = vi.spyOn(providerRunnerTerminateIntentHonoredCount, 'add');
     const runnerSession = await runnerSessionFactory.create({workspaceId});
-    await provisionedRunnerFactory.create({
+    await providerRunnerFactory.create({
       workspaceId,
       provisionerId: provisionerTokenId,
-      provisionedRunnerId: 'provisioned-runner-1',
+      providerRunnerId: 'provisioned-runner-1',
       state: 'running',
     });
     await db()
@@ -156,7 +156,7 @@ describe('POST /provisioners/provisioned-runners/report', () => {
         projectId: crypto.randomUUID(),
         runnerSessionId: runnerSession.id,
         provisionerId: provisionerTokenId,
-        provisionedRunnerId: 'provisioned-runner-1',
+        providerRunnerId: 'provisioned-runner-1',
         requiredLabels: ['linux'],
         runnerLabels: ['linux'],
         startedAt: new Date('2025-01-01T00:00:00.000Z'),
@@ -167,12 +167,12 @@ describe('POST /provisioners/provisioned-runners/report', () => {
 
     const first = await app.inject({
       method: 'POST',
-      url: '/provisioners/provisioned-runners/report',
+      url: '/provisioners/runner-instances/report',
       headers: {authorization: `Bearer ${VALID_PROVISIONER_TOKEN}`},
       payload: {
         events: [
           {
-            provisioned_runner_id: 'provisioned-runner-1',
+            provider_runner_id: 'provisioned-runner-1',
             labels: ['linux'],
             state: 'terminated',
             reported_at: new Date().toISOString(),
@@ -182,12 +182,12 @@ describe('POST /provisioners/provisioned-runners/report', () => {
     });
     const second = await app.inject({
       method: 'POST',
-      url: '/provisioners/provisioned-runners/report',
+      url: '/provisioners/runner-instances/report',
       headers: {authorization: `Bearer ${VALID_PROVISIONER_TOKEN}`},
       payload: {
         events: [
           {
-            provisioned_runner_id: 'provisioned-runner-1',
+            provider_runner_id: 'provisioned-runner-1',
             labels: ['linux'],
             state: 'terminated',
             reported_at: new Date().toISOString(),
@@ -210,12 +210,12 @@ describe('POST /provisioners/provisioned-runners/report', () => {
   it('returns 400 for provider-sensitive extra fields', async () => {
     const res = await app.inject({
       method: 'POST',
-      url: '/provisioners/provisioned-runners/report',
+      url: '/provisioners/runner-instances/report',
       headers: {authorization: `Bearer ${VALID_PROVISIONER_TOKEN}`},
       payload: {
         events: [
           {
-            provisioned_runner_id: 'provisioned-runner-1',
+            provider_runner_id: 'provisioned-runner-1',
             labels: ['linux'],
             state: 'running',
             reported_at: new Date().toISOString(),
@@ -231,11 +231,11 @@ describe('POST /provisioners/provisioned-runners/report', () => {
   it('returns 401 without provisioner auth', async () => {
     const res = await app.inject({
       method: 'POST',
-      url: '/provisioners/provisioned-runners/report',
+      url: '/provisioners/runner-instances/report',
       payload: {
         events: [
           {
-            provisioned_runner_id: 'provisioned-runner-1',
+            provider_runner_id: 'provisioned-runner-1',
             labels: ['linux'],
             state: 'running',
             reported_at: new Date().toISOString(),

package/src/presentation/routes/{report-provisioned-runners.ts → report-runner-instances.ts}

@@ -1,29 +1,29 @@
 import {requireProvisionerContext} from '@shipfox/api-auth-context';
 import {
-  reportProvisionedRunnersBodySchema,
-  reportProvisionedRunnersResponseSchema,
+  reportRunnerInstancesBodySchema,
+  reportRunnerInstancesResponseSchema,
 } from '@shipfox/api-runners-dto';
 import {defineRoute} from '@shipfox/node-fastify';
-import {reportProvisionedRunners} from '#core/index.js';
-import {toReportProvisionedRunnersResponseDto} from '#presentation/dto/index.js';
+import {reportRunnerInstances} from '#core/index.js';
+import {toReportRunnerInstancesResponseDto} from '#presentation/dto/index.js';
 
-export const reportProvisionedRunnersRoute = defineRoute({
+export const reportRunnerInstancesRoute = defineRoute({
   method: 'POST',
-  path: '/provisioned-runners/report',
+  path: '/runner-instances/report',
   description: 'Report provisioned runner lifecycle state',
   schema: {
-    body: reportProvisionedRunnersBodySchema,
+    body: reportRunnerInstancesBodySchema,
     response: {
-      200: reportProvisionedRunnersResponseSchema,
+      200: reportRunnerInstancesResponseSchema,
     },
   },
   handler: async (request) => {
-    const {provisionerTokenId, workspaceId} = requireProvisionerContext(request);
-    const result = await reportProvisionedRunners({
-      workspaceId,
-      provisionerId: provisionerTokenId,
+    const context = requireProvisionerContext(request);
+    const result = await reportRunnerInstances({
+      workspaceId: context.scope === 'workspace' ? context.workspaceId : null,
+      provisionerId: context.provisionerTokenId,
       events: request.body.events.map((event) => ({
-        provisionedRunnerId: event.provisioned_runner_id,
+        providerRunnerId: event.provider_runner_id,
         reservationId: event.reservation_id ?? null,
         templateKey: event.template_key ?? null,
         labels: event.labels,
@@ -35,6 +35,6 @@ export const reportProvisionedRunnersRoute = defineRoute({
       })),
     });
 
-    return toReportProvisionedRunnersResponseDto(result);
+    return toReportRunnerInstancesResponseDto(result);
   },
 });

package/src/presentation/routes/request-job.test.ts

@@ -5,6 +5,7 @@ import {
 } from '@shipfox/api-auth';
 import {AUTH_PROVISIONER_TOKEN, AUTH_USER} from '@shipfox/api-auth-context';
 import {RUNNER_SESSION_TOKEN_AUDIENCE} from '@shipfox/api-auth-dto';
+import {runnerSessionTokenKey} from '@shipfox/node-auth-root-key';
 import type {AuthMethod} from '@shipfox/node-fastify';
 import {closeApp, createApp} from '@shipfox/node-fastify';
 import {signHs256} from '@shipfox/node-jwt';
@@ -15,8 +16,9 @@ import {
   ephemeralRegistrationTokenFactory,
   manualRegistrationTokenFactory,
   pendingJobFactory,
+  runnersTestAuthClient,
 } from '#test/index.js';
-import {runnerRoutes} from './index.js';
+import {createRunnerRoutes} from './index.js';
 
 const fakeUserAuth: AuthMethod = {
   name: AUTH_USER,
@@ -44,7 +46,7 @@ describe('POST /runners/jobs/request', () => {
         createLeaseTokenAuthMethod(),
         fakeProvisionerAuth,
       ],
-      routes: runnerRoutes,
+      routes: createRunnerRoutes(runnersTestAuthClient),
       swagger: false,
     });
     await app.ready();
@@ -206,7 +208,7 @@ describe('POST /runners/jobs/request', () => {
         labels: ['linux', 'x64'],
         maxClaims: null,
       },
-      secret: process.env.AUTH_RUNNER_SESSION_TOKEN_SECRET ?? 'test-runner-session-secret',
+      secret: runnerSessionTokenKey(),
       expiresIn: '-1s',
       audience: RUNNER_SESSION_TOKEN_AUDIENCE,
     });

package/src/presentation/routes/request-job.ts

@@ -1,47 +1,51 @@
 import {requireRunnerSessionContext} from '@shipfox/api-auth-context';
+import type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';
 import {claimedJobResponseSchema} from '@shipfox/api-runners-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {RunnerSessionExhaustedError} from '#core/errors.js';
 import {claimJobExecution} from '#core/job-executions.js';
 
-export const requestJobRoute = defineRoute({
-  method: 'POST',
-  path: '/request',
-  description: 'Claim the next available job execution and receive its lease token',
-  schema: {
-    response: {
-      200: claimedJobResponseSchema,
+export function createRequestJobRoute(auth: AuthInterModuleClient) {
+  return defineRoute({
+    method: 'POST',
+    path: '/request',
+    description: 'Claim the next available job execution and receive its lease token',
+    schema: {
+      response: {
+        200: claimedJobResponseSchema,
+      },
     },
-  },
-  errorHandler: (error) => {
-    if (error instanceof RunnerSessionExhaustedError) {
-      throw new ClientError('Runner session claim limit exhausted', 'runner-session-exhausted', {
-        status: 409,
-      });
-    }
-    throw error;
-  },
-  handler: async (_request, reply) => {
-    const runner = requireRunnerSessionContext(_request);
+    errorHandler: (error) => {
+      if (error instanceof RunnerSessionExhaustedError) {
+        throw new ClientError('Runner session claim limit exhausted', 'runner-session-exhausted', {
+          status: 409,
+        });
+      }
+      throw error;
+    },
+    handler: async (_request, reply) => {
+      const runner = requireRunnerSessionContext(_request);
 
-    const jobExecution = await claimJobExecution({
-      workspaceId: runner.workspaceId,
-      runnerSessionId: runner.runnerSessionId,
-      sessionLabels: runner.labels,
-      maxClaims: runner.maxClaims,
-    });
+      const jobExecution = await claimJobExecution({
+        auth,
+        workspaceId: runner.workspaceId,
+        runnerSessionId: runner.runnerSessionId,
+        sessionLabels: runner.labels,
+        maxClaims: runner.maxClaims,
+      });
 
-    if (!jobExecution) {
-      reply.status(204);
-      return;
-    }
+      if (!jobExecution) {
+        reply.status(204);
+        return;
+      }
 
-    return {
-      workflow_run_id: jobExecution.workflowRunId,
-      workflow_run_attempt_id: jobExecution.workflowRunAttemptId,
-      job_id: jobExecution.jobId,
-      job_execution_id: jobExecution.jobExecutionId,
-      lease_token: jobExecution.leaseToken,
-    };
-  },
-});
+      return {
+        workflow_run_id: jobExecution.workflowRunId,
+        workflow_run_attempt_id: jobExecution.workflowRunAttemptId,
+        job_id: jobExecution.jobId,
+        job_execution_id: jobExecution.jobExecutionId,
+        lease_token: jobExecution.leaseToken,
+      };
+    },
+  });
+}

package/src/presentation/routes/runner-enrollment.test.ts

@@ -0,0 +1,259 @@
+import {createLeaseTokenAuthMethod, createRunnerSessionAuthMethod} from '@shipfox/api-auth';
+import {AUTH_PROVISIONER_TOKEN, AUTH_USER, setProvisionerContext} from '@shipfox/api-auth-context';
+import {
+  type AuthMethod,
+  ClientError,
+  closeApp,
+  createApp,
+  extractBearerToken,
+} from '@shipfox/node-fastify';
+import {eq} from 'drizzle-orm';
+import type {FastifyInstance, FastifyRequest} from 'fastify';
+import {db} from '#db/db.js';
+import {runnerActivationTokens} from '#db/schema/runner-activation-tokens.js';
+import {runnerBootstrapTokens, runnerControlSessions} from '#db/schema/runner-control-sessions.js';
+import {providerRunners} from '#db/schema/runner-instances.js';
+import {
+  createRunnerControlSessionAuthMethod,
+  createRunnerRegistrationTokenAuthMethod,
+} from '#presentation/auth/index.js';
+import {runnersTestAuthClient} from '#test/index.js';
+import {createRunnerRoutes} from './index.js';
+
+const token = 'provisioner-test-token';
+const fakeUserAuth: AuthMethod = {name: AUTH_USER, authenticate: () => Promise.resolve()};
+
+describe('runner enrollment control plane', () => {
+  let app: FastifyInstance;
+  let provisionerId: string;
+  const provisionerAuth: AuthMethod = {
+    name: AUTH_PROVISIONER_TOKEN,
+    authenticate: (request: FastifyRequest) => {
+      if (extractBearerToken(request.headers.authorization) !== token)
+        throw new ClientError('Invalid provisioner token', 'unauthorized', {status: 401});
+      setProvisionerContext(request, {scope: 'installation', provisionerTokenId: provisionerId});
+      return Promise.resolve();
+    },
+  };
+
+  beforeAll(async () => {
+    app = await createApp({
+      auth: [
+        fakeUserAuth,
+        provisionerAuth,
+        createRunnerRegistrationTokenAuthMethod(),
+        createRunnerControlSessionAuthMethod(),
+        createRunnerSessionAuthMethod(),
+        createLeaseTokenAuthMethod(),
+      ],
+      routes: createRunnerRoutes(runnersTestAuthClient),
+      swagger: false,
+    });
+    await app.ready();
+  });
+
+  afterAll(async () => {
+    await closeApp();
+  });
+
+  beforeEach(() => {
+    provisionerId = crypto.randomUUID();
+  });
+
+  it('creates a hashed one-use bootstrap token and restricts its control session to its instance', async () => {
+    const created = await app.inject({
+      method: 'POST',
+      url: '/provisioners/runner-instances/batch',
+      headers: {authorization: `Bearer ${token}`},
+      payload: {provider_kind: 'docker', runner_instances: [{template_key: 'linux'}]},
+    });
+
+    expect(created.statusCode).toBe(200);
+    const runner = created.json().runner_instances[0];
+    const [storedBootstrap] = await db()
+      .select()
+      .from(runnerBootstrapTokens)
+      .where(eq(runnerBootstrapTokens.runnerInstanceId, runner.runner_instance_id));
+    expect(storedBootstrap?.hashedToken).not.toBe(runner.bootstrap_token);
+    expect(storedBootstrap?.consumedAt).toBeNull();
+
+    const exchanged = await app.inject({
+      method: 'POST',
+      url: '/runner-enrollment/exchange',
+      payload: {bootstrap_token: runner.bootstrap_token},
+    });
+
+    expect(exchanged.statusCode).toBe(200);
+    const controlToken = exchanged.json().control_session_token;
+    const reused = await app.inject({
+      method: 'POST',
+      url: '/runner-enrollment/exchange',
+      payload: {bootstrap_token: runner.bootstrap_token},
+    });
+    expect(reused.statusCode).toBe(401);
+
+    const enrolled = await app.inject({
+      method: 'POST',
+      url: '/runner-control/enrollment',
+      headers: {authorization: `Bearer ${controlToken}`},
+      payload: {labels: ['Linux', 'linux'], provider_kind: 'docker', protocol_version: '1'},
+    });
+    expect(enrolled.statusCode).toBe(204);
+
+    const attached = await app.inject({
+      method: 'POST',
+      url: '/runner-control/provider-runner',
+      headers: {authorization: `Bearer ${controlToken}`},
+      payload: {provider_runner_id: 'container-1'},
+    });
+    expect(attached.json()).toEqual({attached: true});
+
+    const [instance] = await db()
+      .select()
+      .from(providerRunners)
+      .where(eq(providerRunners.id, runner.runner_instance_id));
+    expect(instance).toMatchObject({
+      provisionerId,
+      labels: ['linux'],
+      providerRunnerId: 'container-1',
+      state: 'running',
+      protocolVersion: '1',
+    });
+    const [session] = await db()
+      .select()
+      .from(runnerControlSessions)
+      .where(eq(runnerControlSessions.runnerInstanceId, runner.runner_instance_id));
+    expect(session?.hashedToken).not.toBe(controlToken);
+
+    const jobs = await app.inject({
+      method: 'POST',
+      url: '/runners/jobs/request',
+      headers: {authorization: `Bearer ${controlToken}`},
+    });
+    expect(jobs.statusCode).toBe(401);
+  });
+
+  it('rejects enrollment when the authenticated runner instance is terminal', async () => {
+    const created = await app.inject({
+      method: 'POST',
+      url: '/provisioners/runner-instances/batch',
+      headers: {authorization: `Bearer ${token}`},
+      payload: {runner_instances: [{}]},
+    });
+    const runner = created.json().runner_instances[0];
+    const exchanged = await app.inject({
+      method: 'POST',
+      url: '/runner-enrollment/exchange',
+      payload: {bootstrap_token: runner.bootstrap_token},
+    });
+    await db()
+      .update(providerRunners)
+      .set({state: 'failed'})
+      .where(eq(providerRunners.id, runner.runner_instance_id));
+
+    const enrolled = await app.inject({
+      method: 'POST',
+      url: '/runner-control/enrollment',
+      headers: {authorization: `Bearer ${exchanged.json().control_session_token}`},
+      payload: {labels: ['linux'], provider_kind: 'docker', protocol_version: '1'},
+    });
+
+    expect(enrolled.statusCode).toBe(409);
+    expect(enrolled.json()).toMatchObject({code: 'runner-control-session-invalid'});
+  });
+
+  it('returns an activation token only for its assigned runner and closes control access after registration', async () => {
+    const created = await app.inject({
+      method: 'POST',
+      url: '/provisioners/runner-instances/batch',
+      headers: {authorization: `Bearer ${token}`},
+      payload: {runner_instances: [{}]},
+    });
+    const runner = created.json().runner_instances[0];
+    const exchanged = await app.inject({
+      method: 'POST',
+      url: '/runner-enrollment/exchange',
+      payload: {bootstrap_token: runner.bootstrap_token},
+    });
+    const controlToken = exchanged.json().control_session_token;
+    const workspaceId = crypto.randomUUID();
+    await db()
+      .update(providerRunners)
+      .set({
+        workspaceId,
+        reservationId: crypto.randomUUID(),
+        providerRunnerId: 'runner-activation-test',
+        state: 'running',
+      })
+      .where(eq(providerRunners.id, runner.runner_instance_id));
+
+    const assignment = await app.inject({
+      method: 'GET',
+      url: '/runner-control/assignment',
+      headers: {authorization: `Bearer ${controlToken}`},
+    });
+    expect(assignment.statusCode).toBe(200);
+    const activationToken = assignment.json().activation_token;
+    expect(typeof activationToken).toBe('string');
+
+    const registered = await app.inject({
+      method: 'POST',
+      url: '/runners/register',
+      headers: {authorization: `Bearer ${activationToken}`},
+      payload: {labels: ['linux']},
+    });
+    expect(registered.statusCode).toBe(200);
+    expect(registered.json()).toMatchObject({mode: 'activation', max_claims: 1});
+
+    const closed = await app.inject({
+      method: 'POST',
+      url: '/runner-control/heartbeat',
+      headers: {authorization: `Bearer ${controlToken}`},
+    });
+    expect(closed.statusCode).toBe(401);
+  });
+
+  it('rejects registration with an expired activation token', async () => {
+    const created = await app.inject({
+      method: 'POST',
+      url: '/provisioners/runner-instances/batch',
+      headers: {authorization: `Bearer ${token}`},
+      payload: {runner_instances: [{}]},
+    });
+    const runner = created.json().runner_instances[0];
+    const exchanged = await app.inject({
+      method: 'POST',
+      url: '/runner-enrollment/exchange',
+      payload: {bootstrap_token: runner.bootstrap_token},
+    });
+    const workspaceId = crypto.randomUUID();
+    await db()
+      .update(providerRunners)
+      .set({
+        workspaceId,
+        reservationId: crypto.randomUUID(),
+        providerRunnerId: 'runner-expired',
+        state: 'running',
+      })
+      .where(eq(providerRunners.id, runner.runner_instance_id));
+    const assignment = await app.inject({
+      method: 'GET',
+      url: '/runner-control/assignment',
+      headers: {authorization: `Bearer ${exchanged.json().control_session_token}`},
+    });
+    const activationToken = assignment.json().activation_token;
+    await db()
+      .update(runnerActivationTokens)
+      .set({expiresAt: new Date(Date.now() - 1_000)})
+      .where(eq(runnerActivationTokens.runnerInstanceId, runner.runner_instance_id));
+
+    const registered = await app.inject({
+      method: 'POST',
+      url: '/runners/register',
+      headers: {authorization: `Bearer ${activationToken}`},
+      payload: {labels: ['linux']},
+    });
+
+    expect(registered.statusCode).toBe(401);
+  });
+});