@squiz/job-runner-lib 2.5.0 → 2.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@squiz/job-runner-lib",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "description": "",
   "main": "lib/index.js",
   "private": false,
@@ -38,7 +38,7 @@
     "@squiz/dx-json-schema-lib": "1.78.1",
     "@squiz/dx-logger-lib": "^1.64.0",
     "@squiz/optimization-logger": "^1.9.0",
-    "axios": "^1.13.6",
+    "axios": "^1.15.0",
     "cli-color": "^2.0.4",
     "fs-extra": "11.1.0",
     "immer": "^10.1.3",

package/src/domains/job/S3Repository/S3RepositoryBase.ts

@@ -31,6 +31,20 @@ export class S3RepositoryBase {
     this.bucketName = bucketName;
   }
 
+  /**
+   * Validates S3 key to prevent malicious input
+   * @param {string} key The S3 object key to validate
+   * @private
+   */
+  private validateS3Key(key: string): void {
+    if (!key || typeof key !== 'string') {
+      throw new Error('Invalid S3 key: must be a non-empty string');
+    }
+    if (key.includes('..') || key.startsWith('/')) {
+      throw new Error('Invalid S3 key: contains suspicious patterns');
+    }
+  }
+
   /**
    * Save object into S3.
    * @param {string} key The S3 object key.
@@ -39,6 +53,7 @@ export class S3RepositoryBase {
    * @memberof S3RepositoryBase
    */
   async put(key: string, body: PutObjectCommandInput['Body']): Promise<void> {
+    this.validateS3Key(key);
     await this.s3Client.send(
       new PutObjectCommand({
         Bucket: this.bucketName,
@@ -55,6 +70,7 @@ export class S3RepositoryBase {
    * @memberof S3RepositoryBase
    */
   public async delete(key: string): Promise<void> {
+    this.validateS3Key(key);
     await this.s3Client.send(
       new DeleteObjectCommand({
         Bucket: this.bucketName,
@@ -70,6 +86,7 @@ export class S3RepositoryBase {
    * @memberof S3RepositoryBase
    */
   async get(key: string): Promise<string | null> {
+    this.validateS3Key(key);
     const s3Object = await this.s3Client.send(
       new GetObjectCommand({
         Bucket: this.bucketName,
@@ -87,6 +104,7 @@ export class S3RepositoryBase {
    * @memberof S3RepositoryBase
    */
   async check(key: string): Promise<HeadObjectCommandOutput> {
+    this.validateS3Key(key);
     return this.s3Client.send(
       new HeadObjectCommand({
         Bucket: this.bucketName,
@@ -96,6 +114,7 @@ export class S3RepositoryBase {
   }
 
   async getS3SignedUrl(key: string): Promise<string> {
+    this.validateS3Key(key);
     const command = new GetObjectCommand({
       Bucket: this.bucketName,
       Key: key,

package/src/domains/job/services/JobExecutionTaskService/JobExecutionTaskService.spec.ts

@@ -265,6 +265,59 @@ describe('JobExecutionTaskService', () => {
       expect(response).toBe(undefined);
     });
 
+    it('should handle when ECS returns no task ARNs or failures', async () => {
+      const jobContext = createMockJobContext();
+      const jobManifest = createMockJobManifest();
+      const jobExecution = createMockJobExecution({
+        id: `20250917T005949395Z-9602417782`,
+        jobName: 'jobName',
+        version: 'jobVersion',
+      });
+
+      mockJobContextService.findJobContext.mockResolvedValue(jobContext);
+      mockJobManifestService.findJobManifest.mockResolvedValue(jobManifest);
+      mockEcsClient.on(RunTaskCommand).resolves({ tasks: [], failures: [] });
+
+      const response = await jobExecutionTaskService.runJobExecutionTask({
+        ...defaultRunJobTaskParams,
+        jobExecution: jobExecution,
+      });
+
+      // Similar to a ConflictException being thrown. ECS appears to sometimes return an empty tasks and failures
+      // array when the idempotency key is used.
+      expect(response).toBe(undefined);
+    });
+
+    it('should throw when ECS returns no task ARNs and has failures', async () => {
+      const jobContext = createMockJobContext();
+      const jobManifest = createMockJobManifest();
+      const jobExecution = createMockJobExecution({
+        id: `20250917T005949395Z-9602417782`,
+        jobName: 'jobName',
+        version: 'jobVersion',
+      });
+      const failures = [
+        {
+          arn: faker.string.uuid(),
+          detail: 'Insufficient capacity to start job',
+          reason: faker.lorem.words(),
+        },
+      ];
+
+      mockJobContextService.findJobContext.mockResolvedValue(jobContext);
+      mockJobManifestService.findJobManifest.mockResolvedValue(jobManifest);
+      mockEcsClient.on(RunTaskCommand).resolves({ tasks: [], failures });
+
+      await expect(
+        jobExecutionTaskService.runJobExecutionTask({
+          ...defaultRunJobTaskParams,
+          jobExecution: jobExecution,
+        }),
+      ).rejects.toThrow(
+        `Execution start failed: ${JSON.stringify(failures)} (id: "20250917T005949395Z-9602417782", job: jobName, tenant: some_tenant)`,
+      );
+    });
+
     it('should re-throw unhandled errors when starting a task', async () => {
       const expectedError = new ResourceNotFoundException({ message: faker.lorem.words(), $metadata: {} });
       const jobContext = createMockJobContext();

package/src/domains/job/services/JobExecutionTaskService/JobExecutionTaskService.ts

@@ -121,6 +121,30 @@ export class JobExecutionTaskService {
         }),
       );
 
+      if (!result.tasks?.length) {
+        if (result.failures?.length) {
+          // Task has probably already started.
+          // ECS can sometimes return no tasks/failures if attempting to start
+          // the same task multiple times in quick succession:
+          //   * {"tasks":[],"failures":[],"$metadata":{"httpStatusCode":200,...}}
+          throw new Error(
+            `Execution start failed: ${JSON.stringify(result.failures)} ` +
+              `(id: "${params.jobExecution.id}", job: ${params.jobExecution.jobName}, tenant: ${params.tenantId})`,
+          );
+        } else {
+          // Task has probably already started.
+          // ECS can sometimes return no tasks/failures if attempting to start
+          // the same task multiple times in quick succession:
+          //   * {"tasks":[],"failures":[],"$metadata":{"httpStatusCode":200,...}}
+          console.warn(
+            `Execution start returned no ECS task ID` +
+              ` (id: "${params.jobExecution.id}", job: ${params.jobExecution.jobName}, tenant: ${params.tenantId})`,
+            JSON.stringify(result),
+          );
+          return undefined;
+        }
+      }
+
       // This task ARN can be used to terminate the job task.
       // If no error is returned, assume task has started.
       // eslint-disable-next-line @typescript-eslint/no-non-null-assertion