anbaric-cloud-hosting 1.61.0 → 1.62.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.61.0",
+  "version": "1.62.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,18 +18,18 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.61.0",
-    "anbaric-plugins": "^1.61.0",
-    "anbaric-tsapi": "^1.61.0",
-    "anbaric-web": "^1.61.0",
+    "anbaric-data-store": "^1.62.0",
+    "anbaric-plugins": "^1.62.0",
+    "anbaric-tsapi": "^1.62.0",
+    "anbaric-web": "^1.62.0",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.61.0",
-    "anbaric-state-machine": "^1.61.0",
+    "anbaric-impl-cloud": "^1.62.0",
+    "anbaric-state-machine": "^1.62.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/auditing/AuditRecordStore.ts

@@ -16,6 +16,12 @@ interface AuditRecordStore {
     save(record : AuditRecord) : Promise<void>;
     list(filter : AuditFilter) : Promise<Array<AuditRecord>>;
 
+    /* Removes records older than the moment given, at most `limit` of them,
+       oldest first, and says how many went - so a backlog is cleared a batch
+       at a time rather than in one statement that holds a lock and leaves
+       every dead row behind at once. */
+    deleteBefore(before : Date, limit : number) : Promise<number>;
+
 }
 
 export type { AuditFilter, AuditRecordStore }

package/src/auditing/AuditSweep.ts

@@ -0,0 +1,67 @@
+import {AuditRecordStore} from "./AuditRecordStore";
+
+const SWEEP_INTERVAL_MS = 24 * 60 * 60_000;
+const BATCH_SIZE = 5_000;
+const BATCHES_PER_SWEEP = 200;
+
+/* How long audit records are kept unless the platform is told otherwise. A
+   year: long enough that nobody is surprised by what has gone, short enough
+   that the table does not grow for ever. Zero means keep everything. */
+const DEFAULT_RETENTION_DAYS = 365;
+
+const DAY_MS = 24 * 60 * 60_000;
+
+/* Removes audit records older than the retention, once a day and once at
+   start - a platform that restarts on every release would otherwise never
+   reach its first daily tick. Deletion is done a batch at a time rather than
+   in one statement, so clearing a backlog neither holds a lock for long nor
+   leaves more dead rows at once than autovacuum can keep up with, and each
+   sweep stops after a bounded number of batches so a very large backlog is
+   worked through over several days rather than in one sitting. */
+class AuditSweep {
+
+    private ticker? : NodeJS.Timeout;
+    private sweeping = false;
+
+    constructor(private records : AuditRecordStore,
+                private retentionDays : number = DEFAULT_RETENTION_DAYS,
+                private intervalMs : number = SWEEP_INTERVAL_MS,
+                private batchSize : number = BATCH_SIZE) {}
+
+    start() : void {
+        if (this.ticker || this.retentionDays <= 0) return;
+        void this.sweep();
+        this.ticker = setInterval(() => void this.sweep(), this.intervalMs);
+        this.ticker.unref();
+    }
+
+    async sweep() : Promise<number> {
+        if (this.sweeping || this.retentionDays <= 0) return 0;
+        this.sweeping = true;
+
+        const before = new Date(Date.now() - this.retentionDays * DAY_MS);
+        let removed = 0;
+        try {
+            for (let batch = 0; batch < BATCHES_PER_SWEEP; batch++) {
+                const went = await this.records.deleteBefore(before, this.batchSize);
+                removed += went;
+                if (went < this.batchSize) break;
+            }
+            if (removed > 0) console.log(`[audit] removed ${removed} record(s) older than ${this.retentionDays} days`);
+            return removed;
+        } catch (error) {
+            console.error(`[audit] the retention sweep failed: ${error instanceof Error ? error.message : error}`);
+            return removed;
+        } finally {
+            this.sweeping = false;
+        }
+    }
+
+    async cleanUp() : Promise<void> {
+        if (this.ticker) clearInterval(this.ticker);
+        this.ticker = undefined;
+    }
+
+}
+
+export { AuditSweep, DEFAULT_RETENTION_DAYS };

package/src/auditing/InMemoryAuditRecordStore.ts

@@ -26,6 +26,16 @@ class InMemoryAuditRecordStore implements AuditRecordStore {
             .slice(page * pageSize, (page + 1) * pageSize);
     }
 
+    async deleteBefore(before : Date, limit : number) : Promise<number> {
+        const stale = this.records
+            .filter(record => new Date(record.at ?? 0) < before)
+            .sort((left, right) => String(left.at).localeCompare(String(right.at)))
+            .slice(0, limit);
+
+        this.records = this.records.filter(record => ! stale.includes(record));
+        return stale.length;
+    }
+
 }
 
 export { InMemoryAuditRecordStore }

package/src/data-store/PlatformMigrations.ts

@@ -256,6 +256,12 @@ const PLATFORM_MIGRATIONS : Array<Migration> = [
             ON entitlement_invites (email, COALESCE(app_id, ''), entitlement_id)`,
     ),
 
+    // Audit records are weeded by age, which without this is a scan of the
+    // whole table every day.
+    statements("006-audit-records-by-age",
+        "CREATE INDEX IF NOT EXISTS audit_records_at ON anbaric_system.audit_records (at)",
+    ),
+
 ];
 
 export { PLATFORM_MIGRATIONS };

package/src/data-store/PostgresAuditRecordStore.ts

@@ -92,6 +92,21 @@ class PostgresAuditRecordStore implements AuditRecordStore {
         }));
     }
 
+    /* Oldest first and bounded, so the sweep that calls this can work through
+       a large backlog a batch at a time. The subquery is what the index on
+       `at` serves; the delete itself goes by primary key. */
+    async deleteBefore(before : Date, limit : number) : Promise<number> {
+        const result = await this.pool.query(
+            `DELETE FROM anbaric_system.audit_records
+             WHERE id IN (
+                 SELECT id FROM anbaric_system.audit_records
+                 WHERE at < $1 ORDER BY at, id LIMIT $2
+             )`,
+            [before, limit],
+        );
+        return result.rowCount ?? 0;
+    }
+
 }
 
 export { PostgresAuditRecordStore }

package/src/main.ts

@@ -18,6 +18,7 @@ import {S3FileStorage} from "./data-store/S3FileStorage";
 import {PostgresJobRunSchedulePersistence} from "./data-store/PostgresJobRunSchedulePersistence";
 import {PostgresJobPersistence} from "./data-store/PostgresJobPersistence";
 import {StallSweep} from "./data-store/StallSweep";
+import {AuditSweep, DEFAULT_RETENTION_DAYS} from "./auditing/AuditSweep";
 import {PostgresJsonStore} from "./data-store/PostgresJsonStore";
 import {PostgresQueue} from "./queuing/PostgresQueue";
 import {DockerBuildLayer} from "./app-management/DockerBuildLayer";
@@ -130,9 +131,10 @@ const fileStorageFor = (appId : string) : FileStorage =>
         : new LocalFileSystemStorage(join(process.env.ANBARIC_FILE_STORAGE_PATH ?? join(tmpdir(), "anbaric", "files"), appId));
 
 const jobs = new PostgresJobPersistence(pool);
+const auditRecords = new PostgresAuditRecordStore(pool);
 const server = new HostingServer(jobs, queue, registry, buildLayer,
     (appId, collection) => new PostgresJsonStore(pool, appId, collection), secretStoreFor, authenticator, cliAuthorizer,
-    tokenAuthenticator, process.env.ANBARIC_TENANT, new PostgresAuditRecordStore(pool), plugins,
+    tokenAuthenticator, process.env.ANBARIC_TENANT, auditRecords, plugins,
     new PostgresJobRunSchedulePersistence(pool), await loadNotifier(process.env.ANBARIC_NOTIFIER_MODULE),
     new PostgresEntitlementStore(pool), new PostgresUserDirectory(pool), memberships,
     (appId) => new PostgresPromptManager(pool, appId), fileStorageFor, subdomains);
@@ -169,4 +171,8 @@ if (buildLayer && subdomains) {
 // Jobs whose long-running step stopped saying it was alive are marked, not touched.
 new StallSweep(jobs).start();
 
+/* Audit records older than the retention are removed, daily. The retention is
+   in days; zero keeps everything, and an unset value keeps a year. */
+new AuditSweep(auditRecords, Number(process.env.ANBARIC_AUDIT_RETENTION_DAYS ?? DEFAULT_RETENTION_DAYS)).start();
+
 console.log(`anbaric-cloud-hosting listening on port ${port}, internal entry point on ${internal}`);