@shipfox/api-runners 7.0.2 → 8.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-runners",
   "license": "MIT",
-  "version": "7.0.2",
+  "version": "8.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -25,21 +25,22 @@
     "@temporalio/workflow": "1.18.1",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@shipfox/api-auth-context": "6.0.0",
-    "@shipfox/api-auth-dto": "6.0.0",
+    "@shipfox/api-auth-context": "7.1.0",
+    "@shipfox/api-auth-dto": "7.1.0",
     "@shipfox/api-runners-dto": "7.0.1",
-    "@shipfox/api-workflows-dto": "6.0.0",
+    "@shipfox/api-workflows-dto": "8.0.0",
     "@shipfox/config": "1.2.2",
     "@shipfox/inter-module": "0.2.0",
     "@shipfox/node-drizzle": "0.3.2",
+    "@shipfox/node-error-monitoring": "0.2.0",
     "@shipfox/node-auth-root-key": "0.2.1",
-    "@shipfox/node-fastify": "0.2.4",
-    "@shipfox/node-module": "0.4.0",
-    "@shipfox/node-opentelemetry": "0.5.2",
+    "@shipfox/node-fastify": "0.3.0",
+    "@shipfox/node-module": "0.5.0",
+    "@shipfox/node-opentelemetry": "0.6.0",
     "@shipfox/node-outbox": "0.2.4",
     "@shipfox/node-postgres": "0.4.2",
     "@shipfox/node-rate-limit": "0.3.0",
-    "@shipfox/node-temporal": "0.3.2",
+    "@shipfox/node-temporal": "0.4.0",
     "@shipfox/node-tokens": "0.3.0",
     "@shipfox/runner-labels": "0.1.1"
   },

package/src/core/runner-sessions.test.ts

@@ -1,4 +1,3 @@
-import {verifyRunnerSessionToken} from '@shipfox/api-auth';
 import {and, eq} from 'drizzle-orm';
 import {db} from '#db/db.js';
 import {ephemeralRegistrationTokens} from '#db/schema/ephemeral-registration-tokens.js';
@@ -7,6 +6,7 @@ import {providerRunners} from '#db/schema/runner-instances.js';
 import {runnerSessions} from '#db/schema/runner-sessions.js';
 import {
   ephemeralRegistrationTokenFactory,
+  getRunnerSessionTokenClaims,
   manualRegistrationTokenFactory,
   providerRunnerFactory,
   runnersTestAuthClient,
@@ -51,7 +51,7 @@ describe('registerRunnerSession', () => {
       .where(eq(runnerSessions.id, result.session.id));
     expect(rows[0]?.labels).toEqual(['linux', 'x64']);
 
-    const claims = await verifyRunnerSessionToken(result.sessionToken);
+    const claims = getRunnerSessionTokenClaims(result.sessionToken);
     expect(claims?.labels).toEqual(['linux', 'x64']);
     expect(claims?.maxClaims).toBeNull();
   });
@@ -104,7 +104,7 @@ describe('registerRunnerSession', () => {
     expect(session?.provisionerId).toBe(token.provisionerId);
     expect(session?.providerRunnerId).toBe(token.providerRunnerId);
 
-    const claims = await verifyRunnerSessionToken(result.sessionToken);
+    const claims = getRunnerSessionTokenClaims(result.sessionToken);
     expect(claims?.maxClaims).toBe(1);
   });
 

package/src/db/job-executions.test.ts

@@ -1,4 +1,3 @@
-import {verifyJobLeaseToken} from '@shipfox/api-auth';
 import {
   RUNNER_JOB_CLAIMED,
   RUNNER_JOB_LEASE_EXPIRED,
@@ -8,7 +7,12 @@ import {eq, sql} from 'drizzle-orm';
 import {EmptyRequiredLabelsError, RunnerSessionExhaustedError} from '#core/errors.js';
 import {claimJobExecution} from '#core/job-executions.js';
 import {detectAndExpireStuckJobs} from '#core/maintenance.js';
-import {pendingJobFactory, runnerSessionFactory, runnersTestAuthClient} from '#test/index.js';
+import {
+  getLeaseTokenClaims,
+  pendingJobFactory,
+  runnerSessionFactory,
+  runnersTestAuthClient,
+} from '#test/index.js';
 import {db} from './db.js';
 import {
   cancelRunnerJobs,
@@ -770,7 +774,7 @@ describe('claimJobExecution', () => {
     expect(claimed?.workflowRunAttemptId).toBe(created.workflowRunAttemptId);
     expect(claimed).not.toHaveProperty('steps');
 
-    const claims = await verifyJobLeaseToken(claimed?.leaseToken as string);
+    const claims = getLeaseTokenClaims(claimed?.leaseToken as string);
     expect(claims).toMatchObject({
       jobId: created.jobId,
       workflowRunAttemptId: created.workflowRunAttemptId,

package/src/db/runner-instances.test.ts

@@ -1822,6 +1822,53 @@ describe('reconcileRunnerInstances', () => {
 });
 
 describe('runner instance provider attachment', () => {
+  it('updates the pre-created runner instance before its first lifecycle report', async () => {
+    const provisionerId = crypto.randomUUID();
+    const providerRunnerId = 'ec2-runner-1';
+    const [instance] = await db()
+      .insert(providerRunners)
+      .values({
+        provisionerId,
+        providerKind: 'ec2',
+        templateKey: 'linux',
+        labels: ['linux'],
+        state: 'starting',
+        reportedAt: new Date(),
+      })
+      .returning({id: providerRunners.id});
+    if (!instance) throw new Error('Runner instance insert returned no row');
+
+    const attached = await attachRunnerInstanceProviderId({
+      runnerInstanceId: instance.id,
+      provisionerId,
+      providerRunnerId,
+    });
+    await reportRunnerInstances({
+      workspaceId: null,
+      provisionerId,
+      events: [
+        {
+          providerRunnerId,
+          reservationId: null,
+          templateKey: 'linux',
+          labels: ['linux'],
+          state: 'starting',
+          reason: null,
+          runnerSessionId: null,
+          providerKind: 'ec2',
+          reportedAt: new Date(),
+        },
+      ],
+    });
+    const rows = await db()
+      .select()
+      .from(providerRunners)
+      .where(eq(providerRunners.provisionerId, provisionerId));
+
+    expect(attached).toBe(true);
+    expect(rows).toMatchObject([{id: instance.id, providerRunnerId, state: 'starting'}]);
+  });
+
   it('belongs to its provisioner until it receives one provider runner identity', async () => {
     const provisionerId = crypto.randomUUID();
     const [instance] = await db()

package/src/presentation/routes/heartbeat.test.ts

@@ -1,10 +1,3 @@
-import {
-  createLeaseTokenAuthMethod,
-  createRunnerSessionAuthMethod,
-  issueJobLeaseToken,
-  jobLeaseParamsFrom,
-  verifyJobLeaseToken,
-} from '@shipfox/api-auth';
 import {AUTH_PROVISIONER_TOKEN, AUTH_USER} from '@shipfox/api-auth-context';
 import type {RunnerToolCapabilitiesDto} from '@shipfox/api-runners-dto';
 import type {AuthMethod} from '@shipfox/node-fastify';
@@ -17,7 +10,15 @@ import {requestJobExecutionCancellation} from '#db/job-executions.js';
 import {runnerSessions} from '#db/schema/runner-sessions.js';
 import {runningJobExecutions} from '#db/schema/running-job-executions.js';
 import {createRunnerRegistrationTokenAuthMethod} from '#presentation/auth/index.js';
-import {pendingJobFactory, runnerSessionFactory, runnersTestAuthClient} from '#test/index.js';
+import {
+  fakeLeaseTokenAuthMethod,
+  fakeRunnerSessionAuthMethod,
+  getLeaseTokenClaims,
+  mintLeaseToken,
+  pendingJobFactory,
+  runnerSessionFactory,
+  runnersTestAuthClient,
+} from '#test/index.js';
 import {createRunnerRoutes} from './index.js';
 
 const fakeUserAuth: AuthMethod = {
@@ -53,8 +54,8 @@ describe('POST /runners/jobs/:jobId/heartbeat', () => {
       auth: [
         fakeUserAuth,
         createRunnerRegistrationTokenAuthMethod(),
-        createRunnerSessionAuthMethod(),
-        createLeaseTokenAuthMethod(),
+        fakeRunnerSessionAuthMethod,
+        fakeLeaseTokenAuthMethod,
         fakeProvisionerAuth,
       ],
       routes: createRunnerRoutes(runnersTestAuthClient),
@@ -120,7 +121,7 @@ describe('POST /runners/jobs/:jobId/heartbeat', () => {
     expect(res.statusCode).toBe(200);
     const body = res.json<{cancel: boolean; lease_token: string}>();
     expect(body).toEqual({cancel: false, lease_token: expect.any(String)});
-    const refreshedLease = await verifyJobLeaseToken(body.lease_token);
+    const refreshedLease = getLeaseTokenClaims(body.lease_token);
     expect(refreshedLease).toMatchObject({
       jobId,
       jobExecutionId,
@@ -236,7 +237,7 @@ describe('POST /runners/jobs/:jobId/heartbeat', () => {
     expect(res.statusCode).toBe(200);
     const body = res.json<{cancel: boolean; lease_token: string}>();
     expect(body).toEqual({cancel: true, lease_token: expect.any(String)});
-    const refreshedLease = await verifyJobLeaseToken(body.lease_token);
+    const refreshedLease = getLeaseTokenClaims(body.lease_token);
     expect(refreshedLease).toMatchObject({
       jobId,
       jobExecutionId,
@@ -248,10 +249,10 @@ describe('POST /runners/jobs/:jobId/heartbeat', () => {
 
   it('preserves current step scope when renewing a step-scoped lease', async () => {
     const {jobId, leaseToken} = await claimAvailableJob();
-    const lease = await verifyJobLeaseToken(leaseToken);
+    const lease = getLeaseTokenClaims(leaseToken);
     if (!lease) throw new Error('Expected valid lease token');
     const stepScope = {currentStepId: crypto.randomUUID(), currentStepAttempt: 3};
-    const stepScopedLeaseToken = await issueJobLeaseToken(jobLeaseParamsFrom(lease, stepScope));
+    const stepScopedLeaseToken = mintLeaseToken({...lease, ...stepScope});
 
     const res = await app.inject({
       method: 'POST',
@@ -261,14 +262,14 @@ describe('POST /runners/jobs/:jobId/heartbeat', () => {
 
     expect(res.statusCode).toBe(200);
     const body = res.json<{cancel: boolean; lease_token: string}>();
-    const refreshedLease = await verifyJobLeaseToken(body.lease_token);
+    const refreshedLease = getLeaseTokenClaims(body.lease_token);
     expect(refreshedLease).toMatchObject(stepScope);
   });
 
   it('returns 404 when the jobId is unknown', async () => {
     const jobId = crypto.randomUUID();
     const jobExecutionId = crypto.randomUUID();
-    const leaseToken = await issueJobLeaseToken({
+    const leaseToken = mintLeaseToken({
       jobId,
       jobExecutionId,
       workflowRunId: crypto.randomUUID(),
@@ -291,7 +292,7 @@ describe('POST /runners/jobs/:jobId/heartbeat', () => {
   it('returns 404 when the job belongs to a different session', async () => {
     const {jobId, jobExecutionId} = await claimAvailableJob();
     const otherSession = await runnerSessionFactory.create({workspaceId});
-    const leaseToken = await issueJobLeaseToken({
+    const leaseToken = mintLeaseToken({
       jobId,
       jobExecutionId,
       workflowRunId: crypto.randomUUID(),

package/src/presentation/routes/manual-registration-tokens.test.ts

@@ -1,4 +1,3 @@
-import {createLeaseTokenAuthMethod, createRunnerSessionAuthMethod} from '@shipfox/api-auth';
 import {
   AUTH_LEASED_JOB,
   AUTH_PROVISIONER_TOKEN,
@@ -18,7 +17,12 @@ import {db} from '#db/db.js';
 import {revokeManualRegistrationToken} from '#db/manual-registration-tokens.js';
 import {manualRegistrationTokens} from '#db/schema/manual-registration-tokens.js';
 import {createRunnerRegistrationTokenAuthMethod} from '#presentation/auth/index.js';
-import {manualRegistrationTokenFactory, runnersTestAuthClient} from '#test/index.js';
+import {
+  fakeLeaseTokenAuthMethod,
+  fakeRunnerSessionAuthMethod,
+  manualRegistrationTokenFactory,
+  runnersTestAuthClient,
+} from '#test/index.js';
 import {createRunnerRoutes} from './index.js';
 
 let authenticatedMemberships: ReadonlyArray<UserContextMembership> = [];
@@ -59,8 +63,8 @@ describe('manual registration token routes', () => {
       auth: [
         fakeUserAuth,
         createRunnerRegistrationTokenAuthMethod(),
-        createRunnerSessionAuthMethod(),
-        createLeaseTokenAuthMethod(),
+        fakeRunnerSessionAuthMethod,
+        fakeLeaseTokenAuthMethod,
         fakeProvisionerAuth,
       ],
       routes: createRunnerRoutes(runnersTestAuthClient),

package/src/presentation/routes/poll-demand.ts

@@ -4,7 +4,9 @@ import {
 } from '@shipfox/api-auth-context';
 import type {PollDemandTemplateDto} from '@shipfox/api-runners-dto';
 import {pollDemandBodySchema, pollDemandResponseSchema} from '@shipfox/api-runners-dto';
+import {reportError} from '@shipfox/node-error-monitoring';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {logger} from '@shipfox/node-opentelemetry';
 import {config} from '#config.js';
 import {pollDemand, releaseReservationGrants} from '#core/demand.js';
 import {publishWorkspaceProvisionerCapabilitySnapshot} from '#db/provisioner-capability-snapshots.js';
@@ -50,7 +52,17 @@ export function createPollDemandRoute(options: CreateRunnersModuleOptions = {})
       reply.raw.on('close', () => {
         if (!responseFinished) {
           abortController.abort();
-          void releaseReservationGrants(responseReservations).catch(() => undefined);
+          void releaseReservationGrants(responseReservations).catch((error) => {
+            logger().error(
+              {err: error, reservationCount: responseReservations.length},
+              'Failed to release reservations after provisioner disconnect',
+            );
+            reportError(error, {
+              boundary: 'runners.cleanup',
+              operation: 'release-disconnected-reservations',
+              extra: {reservationCount: responseReservations.length},
+            });
+          });
         }
       });
       const provisionerContext = requireProvisionerContext(request);

package/src/presentation/routes/register.test.ts

@@ -1,8 +1,3 @@
-import {
-  createLeaseTokenAuthMethod,
-  createRunnerSessionAuthMethod,
-  verifyRunnerSessionToken,
-} from '@shipfox/api-auth';
 import {AUTH_PROVISIONER_TOKEN, AUTH_USER} from '@shipfox/api-auth-context';
 import type {RunnerToolCapabilitiesDto} from '@shipfox/api-runners-dto';
 import type {AuthMethod} from '@shipfox/node-fastify';
@@ -20,6 +15,9 @@ import {runnerSessions} from '#db/schema/runner-sessions.js';
 import {createRunnerRegistrationTokenAuthMethod} from '#presentation/auth/index.js';
 import {
   ephemeralRegistrationTokenFactory,
+  fakeLeaseTokenAuthMethod,
+  fakeRunnerSessionAuthMethod,
+  getRunnerSessionTokenClaims,
   manualRegistrationTokenFactory,
   runnersTestAuthClient,
 } from '#test/index.js';
@@ -52,8 +50,8 @@ describe('POST /runners/register', () => {
       auth: [
         fakeUserAuth,
         createRunnerRegistrationTokenAuthMethod(),
-        createRunnerSessionAuthMethod(),
-        createLeaseTokenAuthMethod(),
+        fakeRunnerSessionAuthMethod,
+        fakeLeaseTokenAuthMethod,
         fakeProvisionerAuth,
       ],
       routes: createRunnerRoutes(runnersTestAuthClient),
@@ -87,7 +85,7 @@ describe('POST /runners/register', () => {
     expect(body.mode).toBe('manual');
     expect(body.max_claims).toBeNull();
 
-    const claims = await verifyRunnerSessionToken(body.session_token);
+    const claims = getRunnerSessionTokenClaims(body.session_token);
     expect(claims).toMatchObject({
       runnerSessionId: body.session_id,
       workspaceId,
@@ -144,7 +142,7 @@ describe('POST /runners/register', () => {
     expect(body.mode).toBe('ephemeral');
     expect(body.max_claims).toBe(1);
 
-    const claims = await verifyRunnerSessionToken(body.session_token);
+    const claims = getRunnerSessionTokenClaims(body.session_token);
     expect(claims?.maxClaims).toBe(1);
 
     const [session] = await db()

package/src/presentation/routes/request-job.test.ts

@@ -1,19 +1,14 @@
-import {
-  createLeaseTokenAuthMethod,
-  createRunnerSessionAuthMethod,
-  verifyJobLeaseToken,
-} from '@shipfox/api-auth';
 import {AUTH_PROVISIONER_TOKEN, AUTH_USER} from '@shipfox/api-auth-context';
-import {RUNNER_SESSION_TOKEN_AUDIENCE} from '@shipfox/api-auth-dto';
-import {runnerSessionTokenKey} from '@shipfox/node-auth-root-key';
 import type {AuthMethod} from '@shipfox/node-fastify';
 import {closeApp, createApp} from '@shipfox/node-fastify';
-import {signHs256} from '@shipfox/node-jwt';
 import {generateOpaqueToken} from '@shipfox/node-tokens';
 import type {FastifyInstance} from 'fastify';
 import {createRunnerRegistrationTokenAuthMethod} from '#presentation/auth/index.js';
 import {
   ephemeralRegistrationTokenFactory,
+  fakeLeaseTokenAuthMethod,
+  fakeRunnerSessionAuthMethod,
+  getLeaseTokenClaims,
   manualRegistrationTokenFactory,
   pendingJobFactory,
   runnersTestAuthClient,
@@ -42,8 +37,8 @@ describe('POST /runners/jobs/request', () => {
       auth: [
         fakeUserAuth,
         createRunnerRegistrationTokenAuthMethod(),
-        createRunnerSessionAuthMethod(),
-        createLeaseTokenAuthMethod(),
+        fakeRunnerSessionAuthMethod,
+        fakeLeaseTokenAuthMethod,
         fakeProvisionerAuth,
       ],
       routes: createRunnerRoutes(runnersTestAuthClient),
@@ -116,7 +111,7 @@ describe('POST /runners/jobs/request', () => {
     expect(body.job_name).toBeUndefined();
     expect(body.steps).toBeUndefined();
 
-    const claims = await verifyJobLeaseToken(body.lease_token);
+    const claims = getLeaseTokenClaims(body.lease_token);
     expect(claims).toMatchObject({
       jobId: created.jobId,
       workflowRunId: created.workflowRunId,
@@ -200,18 +195,7 @@ describe('POST /runners/jobs/request', () => {
   });
 
   it('returns 401 when the runner session token is expired', async () => {
-    const expiredSessionToken = await signHs256({
-      payload: {
-        runnerSessionId,
-        workspaceId,
-        scope: 'workspace',
-        labels: ['linux', 'x64'],
-        maxClaims: null,
-      },
-      secret: runnerSessionTokenKey(),
-      expiresIn: '-1s',
-      audience: RUNNER_SESSION_TOKEN_AUDIENCE,
-    });
+    const expiredSessionToken = 'invalid';
 
     const res = await app.inject({
       method: 'POST',

package/src/presentation/routes/runner-enrollment.test.ts

@@ -1,4 +1,3 @@
-import {createLeaseTokenAuthMethod, createRunnerSessionAuthMethod} from '@shipfox/api-auth';
 import {AUTH_PROVISIONER_TOKEN, AUTH_USER, setProvisionerContext} from '@shipfox/api-auth-context';
 import {
   type AuthMethod,
@@ -18,7 +17,11 @@ import {
   createRunnerControlSessionAuthMethod,
   createRunnerRegistrationTokenAuthMethod,
 } from '#presentation/auth/index.js';
-import {runnersTestAuthClient} from '#test/index.js';
+import {
+  fakeLeaseTokenAuthMethod,
+  fakeRunnerSessionAuthMethod,
+  runnersTestAuthClient,
+} from '#test/index.js';
 import {createRunnerRoutes} from './index.js';
 
 const token = 'provisioner-test-token';
@@ -44,8 +47,8 @@ describe('runner enrollment control plane', () => {
         provisionerAuth,
         createRunnerRegistrationTokenAuthMethod(),
         createRunnerControlSessionAuthMethod(),
-        createRunnerSessionAuthMethod(),
-        createLeaseTokenAuthMethod(),
+        fakeRunnerSessionAuthMethod,
+        fakeLeaseTokenAuthMethod,
       ],
       routes: createRunnerRoutes(runnersTestAuthClient),
       swagger: false,

package/test/fixtures/auth-inter-module.ts

@@ -1,30 +1 @@
-import {JOB_LEASE_TOKEN_AUDIENCE, RUNNER_SESSION_TOKEN_AUDIENCE} from '@shipfox/api-auth-dto';
-import type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';
-import {jobLeaseTokenKey, runnerSessionTokenKey} from '@shipfox/node-auth-root-key';
-import {signHs256} from '@shipfox/node-jwt';
-
-const leaseSecret = jobLeaseTokenKey();
-const runnerSessionSecret = runnerSessionTokenKey();
-
-export const runnersTestAuthClient: AuthInterModuleClient = {
-  async mintRunnerSessionToken(claims) {
-    return {
-      token: await signHs256({
-        payload: claims,
-        secret: runnerSessionSecret,
-        expiresIn: '1h',
-        audience: RUNNER_SESSION_TOKEN_AUDIENCE,
-      }),
-    };
-  },
-  async mintJobLeaseToken(claims) {
-    return {
-      token: await signHs256({
-        payload: claims,
-        secret: leaseSecret,
-        expiresIn: '90m',
-        audience: JOB_LEASE_TOKEN_AUDIENCE,
-      }),
-    };
-  },
-};
+export {runnersTestAuthClient} from './auth.js';

package/test/fixtures/auth.ts

@@ -0,0 +1,85 @@
+import {
+  AUTH_LEASED_JOB,
+  AUTH_RUNNER_SESSION,
+  setLeasedJobContext,
+  setRunnerSessionContext,
+} from '@shipfox/api-auth-context';
+import {
+  JOB_LEASE_TOKEN_AUDIENCE,
+  type JobLeaseTokenClaims,
+  RUNNER_SESSION_TOKEN_AUDIENCE,
+  type RunnerSessionTokenClaims,
+} from '@shipfox/api-auth-dto';
+import type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';
+import {type AuthMethod, ClientError, extractBearerToken} from '@shipfox/node-fastify';
+
+const leaseClaims = new Map<string, JobLeaseTokenClaims>();
+const sessionClaims = new Map<string, RunnerSessionTokenClaims>();
+
+function opaqueToken(): string {
+  return `test-auth-${crypto.randomUUID()}`;
+}
+
+export function mintLeaseToken(claims: Omit<JobLeaseTokenClaims, 'aud' | 'iat' | 'exp'>): string {
+  const token = opaqueToken();
+  leaseClaims.set(token, {
+    ...claims,
+    aud: JOB_LEASE_TOKEN_AUDIENCE,
+    iat: 0,
+    exp: Number.MAX_SAFE_INTEGER,
+  });
+  return token;
+}
+
+export function mintRunnerSessionToken(
+  claims: Omit<RunnerSessionTokenClaims, 'aud' | 'iat' | 'exp'>,
+): string {
+  const token = opaqueToken();
+  sessionClaims.set(token, {
+    ...claims,
+    aud: RUNNER_SESSION_TOKEN_AUDIENCE,
+    iat: 0,
+    exp: Number.MAX_SAFE_INTEGER,
+  });
+  return token;
+}
+
+export function getLeaseTokenClaims(token: string): JobLeaseTokenClaims | undefined {
+  return leaseClaims.get(token);
+}
+
+export function getRunnerSessionTokenClaims(token: string): RunnerSessionTokenClaims | undefined {
+  return sessionClaims.get(token);
+}
+
+function requireClaims<T>(claims: Map<string, T>, authorization: string | undefined): T {
+  const token = extractBearerToken(authorization);
+  const context = token ? claims.get(token) : undefined;
+  if (!context) throw new ClientError('Authentication required', 'unauthorized', {status: 401});
+  return context;
+}
+
+export const fakeLeaseTokenAuthMethod: AuthMethod = {
+  name: AUTH_LEASED_JOB,
+  authenticate: (request) => {
+    setLeasedJobContext(request, requireClaims(leaseClaims, request.headers.authorization));
+    return Promise.resolve();
+  },
+};
+
+export const fakeRunnerSessionAuthMethod: AuthMethod = {
+  name: AUTH_RUNNER_SESSION,
+  authenticate: (request) => {
+    setRunnerSessionContext(request, requireClaims(sessionClaims, request.headers.authorization));
+    return Promise.resolve();
+  },
+};
+
+export const runnersTestAuthClient: AuthInterModuleClient = {
+  mintRunnerSessionToken(claims) {
+    return Promise.resolve({token: mintRunnerSessionToken(claims)});
+  },
+  mintJobLeaseToken(claims) {
+    return Promise.resolve({token: mintLeaseToken(claims)});
+  },
+};

package/test/index.ts

@@ -14,4 +14,12 @@ export {
 export {reservationFactory} from './factories/reservation.js';
 export {providerRunnerFactory} from './factories/runner-instance.js';
 export {runnerSessionFactory} from './factories/runner-session.js';
+export {
+  fakeLeaseTokenAuthMethod,
+  fakeRunnerSessionAuthMethod,
+  getLeaseTokenClaims,
+  getRunnerSessionTokenClaims,
+  mintLeaseToken,
+  mintRunnerSessionToken,
+} from './fixtures/auth.js';
 export {runnersTestAuthClient} from './fixtures/auth-inter-module.js';