@squiz/job-runner-lib 2.4.0 → 2.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@squiz/job-runner-lib",
-  "version": "2.4.0",
+  "version": "2.5.1",
   "description": "",
   "main": "lib/index.js",
   "private": false,
@@ -38,7 +38,7 @@
     "@squiz/dx-json-schema-lib": "1.78.1",
     "@squiz/dx-logger-lib": "^1.64.0",
     "@squiz/optimization-logger": "^1.9.0",
-    "axios": "^1.13.6",
+    "axios": "^1.15.0",
     "cli-color": "^2.0.4",
     "fs-extra": "11.1.0",
     "immer": "^10.1.3",

package/src/domains/job/S3Repository/S3RepositoryBase.ts

@@ -31,6 +31,20 @@ export class S3RepositoryBase {
     this.bucketName = bucketName;
   }
 
+  /**
+   * Validates S3 key to prevent malicious input
+   * @param {string} key The S3 object key to validate
+   * @private
+   */
+  private validateS3Key(key: string): void {
+    if (!key || typeof key !== 'string') {
+      throw new Error('Invalid S3 key: must be a non-empty string');
+    }
+    if (key.includes('..') || key.startsWith('/')) {
+      throw new Error('Invalid S3 key: contains suspicious patterns');
+    }
+  }
+
   /**
    * Save object into S3.
    * @param {string} key The S3 object key.
@@ -39,6 +53,7 @@ export class S3RepositoryBase {
    * @memberof S3RepositoryBase
    */
   async put(key: string, body: PutObjectCommandInput['Body']): Promise<void> {
+    this.validateS3Key(key);
     await this.s3Client.send(
       new PutObjectCommand({
         Bucket: this.bucketName,
@@ -55,6 +70,7 @@ export class S3RepositoryBase {
    * @memberof S3RepositoryBase
    */
   public async delete(key: string): Promise<void> {
+    this.validateS3Key(key);
     await this.s3Client.send(
       new DeleteObjectCommand({
         Bucket: this.bucketName,
@@ -70,6 +86,7 @@ export class S3RepositoryBase {
    * @memberof S3RepositoryBase
    */
   async get(key: string): Promise<string | null> {
+    this.validateS3Key(key);
     const s3Object = await this.s3Client.send(
       new GetObjectCommand({
         Bucket: this.bucketName,
@@ -87,6 +104,7 @@ export class S3RepositoryBase {
    * @memberof S3RepositoryBase
    */
   async check(key: string): Promise<HeadObjectCommandOutput> {
+    this.validateS3Key(key);
     return this.s3Client.send(
       new HeadObjectCommand({
         Bucket: this.bucketName,
@@ -96,6 +114,7 @@ export class S3RepositoryBase {
   }
 
   async getS3SignedUrl(key: string): Promise<string> {
+    this.validateS3Key(key);
     const command = new GetObjectCommand({
       Bucket: this.bucketName,
       Key: key,

package/src/domains/job/services/JobExecutionTaskService/JobExecutionTaskService.defs.ts

@@ -16,7 +16,6 @@ export interface RunJobTaskParams {
   shortRegion: string;
   shortEnvironment: string;
   clusterArn: string;
-  subnets: Array<string>;
   taskDefinitionArn: string;
   tenantId: string;
 }

package/src/domains/job/services/JobExecutionTaskService/JobExecutionTaskService.spec.ts

@@ -1,17 +1,17 @@
-import 'aws-sdk-client-mock-jest';
-import { AwsClientStub, mockClient } from 'aws-sdk-client-mock';
-import { ConflictException, ResourceNotFoundException, ECSClient, RunTaskCommand } from '@aws-sdk/client-ecs';
+import { ConflictException, ECSClient, ResourceNotFoundException, RunTaskCommand } from '@aws-sdk/client-ecs';
 import { faker } from '@faker-js/faker';
-import { JobExecutionTaskService } from './JobExecutionTaskService';
-import { JobManifestService } from '../JobManifestService/JobManifestService';
-import { JobContextService } from '../JobContextService/JobContextService';
+import { AwsClientStub, mockClient } from 'aws-sdk-client-mock';
+import 'aws-sdk-client-mock-jest';
 import { JobDetailsRepository, JobUploadsRepository } from '../../S3Repository';
-import { createMockJobExecution } from '../../model/JobExecution';
-import { createMockJobContext } from '../../model/JobContext';
+import { JOB_EXECUTION_STATUS } from '../../constants/JobExecutionStatus.constants';
 import { createMockJobManifest } from '../../manifest';
-import { RunJobTaskParams } from './JobExecutionTaskService.defs';
+import { createMockJobContext } from '../../model/JobContext';
+import { createMockJobExecution } from '../../model/JobExecution';
 import { JobExecutionRepository } from '../../repository';
-import { JOB_EXECUTION_STATUS } from '../../constants/JobExecutionStatus.constants';
+import { JobContextService } from '../JobContextService/JobContextService';
+import { JobManifestService } from '../JobManifestService/JobManifestService';
+import { JobExecutionTaskService } from './JobExecutionTaskService';
+import { RunJobTaskParams } from './JobExecutionTaskService.defs';
 
 describe('JobExecutionTaskService', () => {
   let mockEcsClient: AwsClientStub<ECSClient>;
@@ -30,7 +30,6 @@ describe('JobExecutionTaskService', () => {
     shortRegion: 'au',
     shortEnvironment: 'dev',
     clusterArn: `clusterArn`,
-    subnets: ['subnet1'],
     taskDefinitionArn: `taskDefinitionArn`,
     tenantId: 'some_tenant',
   };
@@ -124,8 +123,6 @@ describe('JobExecutionTaskService', () => {
       expect(response).toBe(mockArn);
       expect(mockEcsClient).toHaveReceivedCommandWith(RunTaskCommand, {
         cluster: 'clusterArn',
-        launchType: 'FARGATE',
-        networkConfiguration: { awsvpcConfiguration: { subnets: ['subnet1'] } },
         overrides: {
           containerOverrides: [
             {
@@ -268,6 +265,59 @@ describe('JobExecutionTaskService', () => {
       expect(response).toBe(undefined);
     });
 
+    it('should handle when ECS returns no task ARNs or failures', async () => {
+      const jobContext = createMockJobContext();
+      const jobManifest = createMockJobManifest();
+      const jobExecution = createMockJobExecution({
+        id: `20250917T005949395Z-9602417782`,
+        jobName: 'jobName',
+        version: 'jobVersion',
+      });
+
+      mockJobContextService.findJobContext.mockResolvedValue(jobContext);
+      mockJobManifestService.findJobManifest.mockResolvedValue(jobManifest);
+      mockEcsClient.on(RunTaskCommand).resolves({ tasks: [], failures: [] });
+
+      const response = await jobExecutionTaskService.runJobExecutionTask({
+        ...defaultRunJobTaskParams,
+        jobExecution: jobExecution,
+      });
+
+      // Similar to a ConflictException being thrown. ECS appears to sometimes return an empty tasks and failures
+      // array when the idempotency key is used.
+      expect(response).toBe(undefined);
+    });
+
+    it('should throw when ECS returns no task ARNs and has failures', async () => {
+      const jobContext = createMockJobContext();
+      const jobManifest = createMockJobManifest();
+      const jobExecution = createMockJobExecution({
+        id: `20250917T005949395Z-9602417782`,
+        jobName: 'jobName',
+        version: 'jobVersion',
+      });
+      const failures = [
+        {
+          arn: faker.string.uuid(),
+          detail: 'Insufficient capacity to start job',
+          reason: faker.lorem.words(),
+        },
+      ];
+
+      mockJobContextService.findJobContext.mockResolvedValue(jobContext);
+      mockJobManifestService.findJobManifest.mockResolvedValue(jobManifest);
+      mockEcsClient.on(RunTaskCommand).resolves({ tasks: [], failures });
+
+      await expect(
+        jobExecutionTaskService.runJobExecutionTask({
+          ...defaultRunJobTaskParams,
+          jobExecution: jobExecution,
+        }),
+      ).rejects.toThrow(
+        `Execution start failed: ${JSON.stringify(failures)} (id: "20250917T005949395Z-9602417782", job: jobName, tenant: some_tenant)`,
+      );
+    });
+
     it('should re-throw unhandled errors when starting a task', async () => {
       const expectedError = new ResourceNotFoundException({ message: faker.lorem.words(), $metadata: {} });
       const jobContext = createMockJobContext();

package/src/domains/job/services/JobExecutionTaskService/JobExecutionTaskService.ts

@@ -3,7 +3,7 @@
  * Copyright Squiz Australia Pty Ltd. All Rights Reserved.
  */
 
-import { ConflictException, ECSClient, LaunchType, RunTaskCommand } from '@aws-sdk/client-ecs';
+import { ConflictException, ECSClient, RunTaskCommand } from '@aws-sdk/client-ecs';
 import { createHash } from 'node:crypto';
 import { JobDetailsRepository, JobUploadsRepository } from '../../S3Repository';
 import { JOB_EXECUTION_STATUS } from '../../constants/JobExecutionStatus.constants';
@@ -104,12 +104,6 @@ export class JobExecutionTaskService {
       const result = await this.ecsClient.send(
         new RunTaskCommand({
           cluster: params.clusterArn,
-          networkConfiguration: {
-            awsvpcConfiguration: {
-              subnets: params.subnets,
-            },
-          },
-          launchType: LaunchType.FARGATE,
           taskDefinition: params.taskDefinitionArn,
           overrides: {
             containerOverrides: [
@@ -127,6 +121,30 @@ export class JobExecutionTaskService {
         }),
       );
 
+      if (!result.tasks?.length) {
+        if (result.failures?.length) {
+          // Task has probably already started.
+          // ECS can sometimes return no tasks/failures if attempting to start
+          // the same task multiple times in quick succession:
+          //   * {"tasks":[],"failures":[],"$metadata":{"httpStatusCode":200,...}}
+          throw new Error(
+            `Execution start failed: ${JSON.stringify(result.failures)} ` +
+              `(id: "${params.jobExecution.id}", job: ${params.jobExecution.jobName}, tenant: ${params.tenantId})`,
+          );
+        } else {
+          // Task has probably already started.
+          // ECS can sometimes return no tasks/failures if attempting to start
+          // the same task multiple times in quick succession:
+          //   * {"tasks":[],"failures":[],"$metadata":{"httpStatusCode":200,...}}
+          console.warn(
+            `Execution start returned no ECS task ID` +
+              ` (id: "${params.jobExecution.id}", job: ${params.jobExecution.jobName}, tenant: ${params.tenantId})`,
+            JSON.stringify(result),
+          );
+          return undefined;
+        }
+      }
+
       // This task ARN can be used to terminate the job task.
       // If no error is returned, assume task has started.
       // eslint-disable-next-line @typescript-eslint/no-non-null-assertion