relay-flow 0.3.13-alpha → 0.3.14-alpha

package/internal/task/jira/rest/client.go

@@ -113,14 +113,27 @@ func New(site, email, token string) (*HTTPClient, error) {
 }
 
 func (c *HTTPClient) ValidateCredentials(ctx context.Context) error {
+	return c.validateCredentials(ctx, 4)
+}
+
+// ValidateCredentialsStartup performs a single authenticated read, without
+// inheriting runtime retries or Retry-After delays. The shorter caller budget
+// wins over the five-second ceiling and the normal HTTP client's timeout.
+func (c *HTTPClient) ValidateCredentialsStartup(ctx context.Context) error {
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	return c.validateCredentials(ctx, 0)
+}
+
+func (c *HTTPClient) validateCredentials(ctx context.Context, maxRetries int) error {
 	var me struct {
 		AccountID string `json:"accountId"`
 	}
-	if err := c.request(ctx, http.MethodGet, "/rest/api/3/myself", nil, nil, &me, true); err != nil {
+	if err := c.requestWithRetries(ctx, http.MethodGet, "/rest/api/3/myself", nil, nil, &me, true, maxRetries); err != nil {
 		return fmt.Errorf("validate Jira credentials: %w", err)
 	}
 	if me.AccountID == "" {
-		return errors.New("validate Jira credentials: Jira returned no account ID")
+		return errors.New("validate Jira credentials: malformed response: Jira returned no account ID")
 	}
 	return nil
 }
@@ -525,6 +538,10 @@ func (c *HTTPClient) issueState(key string) issueState {
 }
 
 func (c *HTTPClient) request(ctx context.Context, method, path string, query url.Values, body any, out any, safe bool) error {
+	return c.requestWithRetries(ctx, method, path, query, body, out, safe, 4)
+}
+
+func (c *HTTPClient) requestWithRetries(ctx context.Context, method, path string, query url.Values, body any, out any, safe bool, maxRetries int) error {
 	var payload []byte
 	var err error
 	if body != nil {
@@ -554,27 +571,41 @@ func (c *HTTPClient) request(ctx context.Context, method, path string, query url
 			req.Header.Set("Content-Type", "application/json")
 		}
 		slog.Debug("jira call", "method", method, "path", path)
-		resp, callErr := c.http.Do(req)
+		client := c.http
+		if maxRetries == 0 {
+			// Startup is one authenticated read, not a redirect chain. Leave
+			// normal runtime client/redirect behavior unchanged.
+			singleAttempt := *c.http
+			singleAttempt.CheckRedirect = func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }
+			client = &singleAttempt
+		}
+		resp, callErr := client.Do(req)
 		<-requestSlots
 		if callErr != nil {
-			return fmt.Errorf("Jira %s %s: %s", method, path, redact(callErr.Error(), c.token, c.email))
+			if ctx.Err() != nil {
+				return fmt.Errorf("Jira %s %s: timeout/cancellation: %w", method, path, ctx.Err())
+			}
+			return fmt.Errorf("Jira %s %s: connection failure: %s", method, path, redact(callErr.Error(), c.token, c.email))
 		}
 		raw, readErr := readBounded(resp.Body)
 		resp.Body.Close()
 		if readErr != nil {
+			if ctx.Err() != nil {
+				return fmt.Errorf("Jira %s %s: timeout/cancellation: %w", method, path, ctx.Err())
+			}
 			return fmt.Errorf("Jira %s %s: %w", method, path, readErr)
 		}
 		if resp.StatusCode >= 200 && resp.StatusCode < 300 {
 			if out != nil && len(raw) > 0 {
 				if err := json.Unmarshal(raw, out); err != nil {
-					return fmt.Errorf("Jira %s %s: parse response: %w", method, path, err)
+					return fmt.Errorf("Jira %s %s: malformed response: %w", method, path, err)
 				}
 			}
 			slog.Info("jira outcome", "method", method, "path", path, "result", "ok")
 			return nil
 		}
 		retryable := resp.StatusCode == http.StatusTooManyRequests || (safe && resp.StatusCode >= 500)
-		if retryable && attempt < 4 {
+		if retryable && attempt < maxRetries {
 			delay := retryDelay(resp.Header.Get("Retry-After"), attempt)
 			select {
 			case <-ctx.Done():
@@ -592,6 +623,9 @@ func (c *HTTPClient) request(ctx context.Context, method, path string, query url
 			message = resp.Status
 		}
 		slog.Info("jira outcome", "method", method, "path", path, "result", "error", "status", resp.StatusCode)
+		if resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden {
+			return fmt.Errorf("Jira %s %s: authentication/permission failure: HTTP %d: %s", method, path, resp.StatusCode, message)
+		}
 		return fmt.Errorf("Jira %s %s: HTTP %d: %s", method, path, resp.StatusCode, message)
 	}
 }

package/internal/task/jira/rest/startup_redirect_test.go

@@ -0,0 +1,23 @@
+package rest
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+func TestStartupCredentialsDoesNotFollowRedirects(t *testing.T) {
+	s := newJiraServer(t, func(w http.ResponseWriter, r *http.Request, _ []byte) {
+		if r.URL.Path != "/rest/api/3/myself" {
+			t.Errorf("startup followed redirect to %s", r.URL.Path)
+			writeJSON(w, map[string]any{"accountId": "account"})
+			return
+		}
+		http.Redirect(w, r, "/unrelated-endpoint", http.StatusFound)
+	})
+	err := s.client(t).ValidateCredentialsStartup(context.Background())
+	if err == nil || !strings.Contains(err.Error(), "HTTP 302") || s.count(http.MethodGet, "/rest/api/3/myself") != 1 || s.count(http.MethodGet, "/unrelated-endpoint") != 0 {
+		t.Fatalf("startup redirect = %v", err)
+	}
+}

package/internal/task/jira/rest/startup_test.go

@@ -0,0 +1,133 @@
+package rest
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestStartupCredentialsUsesOneAuthenticatedMyselfRead(t *testing.T) {
+	s := newJiraServer(t, func(w http.ResponseWriter, r *http.Request, _ []byte) {
+		if r.Method != http.MethodGet || r.URL.Path != "/rest/api/3/myself" || r.URL.RawQuery != "" {
+			t.Errorf("unexpected startup request: %s %s", r.Method, r.URL)
+		}
+		writeJSON(w, map[string]any{"accountId": "account"})
+	})
+	if err := s.client(t).ValidateCredentialsStartup(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if s.count(http.MethodGet, "/rest/api/3/myself") != 1 {
+		t.Fatal("startup did not make exactly one credential request")
+	}
+}
+
+func TestStartupCredentialsNeverRetriesRateLimitsOrServerErrors(t *testing.T) {
+	for _, status := range []int{http.StatusTooManyRequests, http.StatusInternalServerError, http.StatusServiceUnavailable} {
+		t.Run(http.StatusText(status), func(t *testing.T) {
+			s := newJiraServer(t, func(w http.ResponseWriter, _ *http.Request, _ []byte) {
+				w.Header().Set("Retry-After", "60")
+				http.Error(w, "unavailable", status)
+			})
+			start := time.Now()
+			if err := s.client(t).ValidateCredentialsStartup(context.Background()); err == nil {
+				t.Fatal("startup accepted failed credentials check")
+			}
+			if s.count(http.MethodGet, "/rest/api/3/myself") != 1 || time.Since(start) > time.Second {
+				t.Fatal("startup inherited runtime retry count or delay")
+			}
+		})
+	}
+}
+
+func TestStartupCredentialFailureCategoriesAndRedaction(t *testing.T) {
+	for _, tc := range []struct {
+		name, body, want string
+		status           int
+	}{
+		{"unauthorized", "secret bot@example.com", "authentication", http.StatusUnauthorized},
+		{"forbidden", "secret bot@example.com", "authentication", http.StatusForbidden},
+		{"invalid-json", "not-json", "malformed", http.StatusOK},
+		{"missing-account", `{}`, "malformed", http.StatusOK},
+		{"empty-response", "", "malformed", http.StatusOK},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			s := newJiraServer(t, func(w http.ResponseWriter, _ *http.Request, _ []byte) {
+				w.WriteHeader(tc.status)
+				_, _ = w.Write([]byte(tc.body))
+			})
+			err := s.client(t).ValidateCredentialsStartup(context.Background())
+			if err == nil || !strings.Contains(err.Error(), tc.want) {
+				t.Fatalf("%s = %v, want category %s", tc.name, err, tc.want)
+			}
+			if strings.Contains(err.Error(), "secret") || strings.Contains(err.Error(), "bot@example.com") {
+				t.Fatalf("credentials leaked: %v", err)
+			}
+		})
+	}
+	t.Run("connection", func(t *testing.T) {
+		s := httptest.NewServer(http.NotFoundHandler())
+		s.Close()
+		c, err := New(s.URL, "bot@example.com", "secret")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := c.ValidateCredentialsStartup(context.Background()); err == nil || !strings.Contains(err.Error(), "connection") {
+			t.Fatalf("connection failure = %v", err)
+		}
+	})
+}
+
+func TestStartupCredentialsHonorsEarlierDeadlineAndCancellation(t *testing.T) {
+	var calls atomic.Int32
+	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls.Add(1)
+		<-r.Context().Done()
+	}))
+	defer s.Close()
+	c, err := New(s.URL, "bot@example.com", "secret")
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Millisecond)
+	defer cancel()
+	start := time.Now()
+	if err := c.ValidateCredentialsStartup(ctx); !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("deadline = %v", err)
+	}
+	if time.Since(start) > time.Second || calls.Load() != 1 {
+		t.Fatalf("timeout exceeded caller budget or retried: calls=%d", calls.Load())
+	}
+	ctx, cancelNow := context.WithCancel(context.Background())
+	cancelNow()
+	if err := c.ValidateCredentialsStartup(ctx); !errors.Is(err, context.Canceled) || calls.Load() != 1 {
+		t.Fatalf("cancellation = %v, calls=%d", err, calls.Load())
+	}
+}
+
+type deadlineTransport struct {
+	deadline time.Time
+}
+
+func (d *deadlineTransport) RoundTrip(r *http.Request) (*http.Response, error) {
+	d.deadline, _ = r.Context().Deadline()
+	return nil, errors.New("transport unavailable")
+}
+
+func TestStartupCredentialsCapsRequestDeadlineAtFiveSeconds(t *testing.T) {
+	c, err := New("https://jira.example.invalid", "bot@example.com", "secret")
+	if err != nil {
+		t.Fatal(err)
+	}
+	transport := &deadlineTransport{}
+	c.http.Transport = transport
+	start := time.Now()
+	_ = c.ValidateCredentialsStartup(context.Background())
+	if transport.deadline.IsZero() || transport.deadline.After(start.Add(5*time.Second+time.Millisecond)) {
+		t.Fatalf("request deadline = %v", transport.deadline)
+	}
+}

package/internal/task/jira/startup.go

@@ -0,0 +1,22 @@
+package jira
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/rajpopat27/relay-flow/internal/config"
+)
+
+// probeStartup uses system-wide credentials once, even without registered
+// repositories. It does not need project, component, assignee or status data.
+func probeStartup(ctx context.Context, _ config.RawValues, _ map[string]config.Repo) error {
+	creds, err := loadCredentialsDefault()
+	if err != nil {
+		return fmt.Errorf("jira startup credentials: %w", err)
+	}
+	client, err := sharedClient(creds.Site, creds.Email, creds.Token)
+	if err != nil {
+		return fmt.Errorf("jira startup credentials: %w", err)
+	}
+	return client.ValidateCredentialsStartup(ctx)
+}

package/internal/task/jira/startup_test.go

@@ -0,0 +1,78 @@
+package jira
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	"github.com/rajpopat27/relay-flow/internal/config"
+	"github.com/rajpopat27/relay-flow/internal/task"
+)
+
+func TestSelectedJiraStartupValidatesSystemCredentialsOnceEvenWithoutRepos(t *testing.T) {
+	for _, withRepos := range []bool{false, true} {
+		t.Run(map[bool]string{false: "no-repos", true: "many-repos"}[withRepos], func(t *testing.T) {
+			root := t.TempDir()
+			t.Setenv("RELAY_FLOW_HOME", root)
+			var calls atomic.Int32
+			s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				calls.Add(1)
+				user, token, ok := r.BasicAuth()
+				if !ok || user != "bot@example.com" || token != "secret" || r.Method != "GET" || r.URL.Path != "/rest/api/3/myself" {
+					t.Errorf("unexpected credential request: %s %s", r.Method, r.URL.Path)
+					http.Error(w, "invalid request", http.StatusBadRequest)
+					return
+				}
+				_, _ = w.Write([]byte(`{"accountId":"account"}`))
+			}))
+			defer s.Close()
+			path := filepath.Join(root, "credentials.yaml")
+			if err := saveCredentials(path, credentials{Site: s.URL, Email: "bot@example.com", Token: "secret"}); err != nil {
+				t.Fatal(err)
+			}
+			before, err := os.ReadFile(path)
+			if err != nil {
+				t.Fatal(err)
+			}
+			var repos map[string]config.Repo
+			if withRepos {
+				// Probe must not construct/validate dummy repo mappings or queries.
+				repos = map[string]config.Repo{"one": {Path: "/absent/one"}, "two": {Path: "/absent/two"}}
+			}
+			if err := task.ProbeStartup(context.Background(), "jira", config.RawValues{"assignee": "unverified-assignee"}, repos); err != nil {
+				t.Fatal(err)
+			}
+			if calls.Load() != 1 {
+				t.Fatalf("system credential requests = %d", calls.Load())
+			}
+			after, err := os.ReadFile(path)
+			if err != nil || string(after) != string(before) {
+				t.Fatalf("startup changed credentials: %v", err)
+			}
+		})
+	}
+}
+
+func TestSelectedJiraStartupRejectsMissingAndInvalidCredentials(t *testing.T) {
+	root := t.TempDir()
+	t.Setenv("RELAY_FLOW_HOME", root)
+	if err := task.ProbeStartup(context.Background(), "jira", nil, nil); err == nil || !strings.Contains(err.Error(), "credentials") {
+		t.Fatalf("missing credentials = %v", err)
+	}
+	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, "secret bot@example.com", http.StatusUnauthorized)
+	}))
+	defer s.Close()
+	if err := saveCredentials(filepath.Join(root, "credentials.yaml"), credentials{Site: s.URL, Email: "bot@example.com", Token: "secret"}); err != nil {
+		t.Fatal(err)
+	}
+	err := task.ProbeStartup(context.Background(), "jira", nil, nil)
+	if err == nil || !strings.Contains(err.Error(), "authentication") || strings.Contains(err.Error(), "secret") || strings.Contains(err.Error(), "bot@example.com") {
+		t.Fatalf("invalid credentials not safely rejected: %v", err)
+	}
+}

package/internal/task/startup.go

@@ -0,0 +1,25 @@
+package task
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/rajpopat27/relay-flow/internal/config"
+)
+
+// ProbeStartup dispatches only the selected plugin's machine prerequisite
+// checks, even without registered repos. The caller supplies the aggregate
+// deadline; the adapter owns connection deduplication and per-probe limits.
+func ProbeStartup(ctx context.Context, name string, root config.RawValues, repos map[string]config.Repo) error {
+	f, err := lookup(name)
+	if err != nil {
+		return err
+	}
+	if f.ProbeStartup == nil {
+		return fmt.Errorf("task plugin %q has no startup probe", name)
+	}
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	return f.ProbeStartup(ctx, config.Merge(defaultConfig(f), root), repos)
+}

package/internal/task/startup_test.go

@@ -0,0 +1,51 @@
+package task_test
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/rajpopat27/relay-flow/internal/config"
+	"github.com/rajpopat27/relay-flow/internal/task"
+)
+
+func TestStartupDispatchCallsOnlySelectedPluginWithoutConstructingSystems(t *testing.T) {
+	selected := t.Name() + t.TempDir()
+	other := selected + "-other"
+	calls := 0
+	failure := errors.New("connection unavailable")
+	task.Register(other, task.Factory{ProbeStartup: func(context.Context, config.RawValues, map[string]config.Repo) error {
+		t.Fatal("called unselected plugin")
+		return nil
+	}})
+	task.Register(selected, task.Factory{
+		DefaultConfig: func() config.RawValues { return config.RawValues{"default": "value"} },
+		New: func(context.Context, task.RepoSpec) (task.System, error) {
+			t.Fatal("startup constructed a repo system")
+			return nil, nil
+		},
+		ProbeStartup: func(ctx context.Context, root config.RawValues, repos map[string]config.Repo) error {
+			calls++
+			if root["default"] != "value" || root["explicit"] != "override" || repos["app"].Path != "/work/app" {
+				t.Fatalf("startup inputs = %v, %v", root, repos)
+			}
+			return failure
+		},
+	})
+	err := task.ProbeStartup(context.Background(), selected, config.RawValues{"explicit": "override"}, map[string]config.Repo{"app": {Path: "/work/app"}})
+	if !errors.Is(err, failure) || calls != 1 {
+		t.Fatalf("dispatch = %v, calls=%d", err, calls)
+	}
+}
+
+func TestStartupDispatchRequiresProbeSupportEvenWithoutRepos(t *testing.T) {
+	name := t.Name() + t.TempDir()
+	task.Register(name, task.Factory{})
+	if err := task.ProbeStartup(context.Background(), name, nil, nil); err == nil || !strings.Contains(err.Error(), "startup probe") {
+		t.Fatalf("missing startup callback = %v", err)
+	}
+	if err := task.ProbeStartup(context.Background(), "unknown-startup-plugin", nil, nil); err == nil || !strings.Contains(err.Error(), "registered:") {
+		t.Fatalf("unknown plugin = %v", err)
+	}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relay-flow",
-  "version": "0.3.13-alpha",
+  "version": "0.3.14-alpha",
   "description": "Graph-based agent workflow engine — tracker-agnostic, pluggable runners",
   "bin": {
     "relay-flow": "./bin/relay-flow.js",