refactor(apps): retire network update jobs

Author: DorianZheng

apps/api/src/box/dto/job-type-map.dto.ts

@@ -25,9 +25,6 @@ export interface JobTypeMap {
   [JobType.DESTROY_BOX]: {
     resourceType: [ResourceType.BOX]
   }
-  [JobType.UPDATE_BOX_NETWORK_SETTINGS]: {
-    resourceType: [ResourceType.BOX]
-  }
   [JobType.EXPORT_BOX]: {
     resourceType: [ResourceType.BOX]
   }

apps/api/src/box/enums/job-type.enum.spec.ts

@@ -13,7 +13,6 @@ describe('JobType', () => {
       'START_BOX',
       'STOP_BOX',
       'DESTROY_BOX',
-      'UPDATE_BOX_NETWORK_SETTINGS',
       'EXPORT_BOX',
       'IMPORT_BOX',
       'ROLLBACK_EXPORT_BOX',

apps/api/src/box/enums/job-type.enum.ts

@@ -9,7 +9,6 @@ export enum JobType {
   START_BOX = 'START_BOX',
   STOP_BOX = 'STOP_BOX',
   DESTROY_BOX = 'DESTROY_BOX',
-  UPDATE_BOX_NETWORK_SETTINGS = 'UPDATE_BOX_NETWORK_SETTINGS',
   EXPORT_BOX = 'EXPORT_BOX',
   IMPORT_BOX = 'IMPORT_BOX',
   ROLLBACK_EXPORT_BOX = 'ROLLBACK_EXPORT_BOX',

apps/api/src/box/runner-adapter/runnerAdapter.v2.ts

@@ -17,7 +17,6 @@ import { JobStatus } from '../enums/job-status.enum'
 import { ResourceType } from '../enums/resource-type.enum'
 import { JobService } from '../services/job.service'
 import { BoxRepository } from '../repositories/box.repository'
-import { UpdateNetworkSettingsDTO } from '@boxlite-ai/runner-api-client'
 
 /**
  * RunnerAdapterV2 implements RunnerAdapter for v2 runners.
@@ -184,26 +183,11 @@ export class RunnerAdapterV2 implements RunnerAdapter {
   }
 
   async updateNetworkSettings(
-    boxId: string,
-    networkBlockAll?: boolean,
-    networkAllowList?: string,
-    networkLimitEgress?: boolean,
+    _boxId: string,
+    _networkBlockAll?: boolean,
+    _networkAllowList?: string,
+    _networkLimitEgress?: boolean,
   ): Promise<void> {
-    const payload: UpdateNetworkSettingsDTO = {
-      networkBlockAll: networkBlockAll,
-      networkAllowList: networkAllowList,
-      networkLimitEgress: networkLimitEgress,
-    }
-
-    await this.jobService.createJob(
-      null,
-      JobType.UPDATE_BOX_NETWORK_SETTINGS,
-      this.runner.id,
-      ResourceType.BOX,
-      boxId,
-      payload,
-    )
-
-    this.logger.debug(`Created UPDATE_BOX_NETWORK_SETTINGS job for box ${boxId} on runner ${this.runner.id}`)
+    throw new Error('Live network settings updates with runner API version 2 are not supported')
   }
 }

apps/api/src/box/services/box.service.spec.ts

@@ -294,6 +294,7 @@ describe('BoxService network tunnel URLs', () => {
 describe('BoxService public defaults', () => {
   function makeCreateService() {
     const boxRepository = { insert: jest.fn(async (box: any) => box) } as any
+    const warmPoolService = { fetchWarmPoolBox: jest.fn().mockResolvedValue(undefined) }
     const runner = { id: 'runner-1', draining: false, state: RunnerState.READY }
     const runnerService = {
       getRandomAvailableRunner: jest.fn().mockResolvedValue(runner),
@@ -315,15 +316,33 @@ describe('BoxService public defaults', () => {
         rollbackPendingUsage: jest.fn().mockResolvedValue(undefined),
       },
       redis: { exists: jest.fn().mockResolvedValue(1) },
+      warmPoolService,
       runnerService,
       redisLockProvider,
       boxRepository,
       eventEmitter: { emitAsync: jest.fn().mockResolvedValue(undefined) },
       toBoxDto: jest.fn((box) => box),
     })
-    return { service, boxRepository, runnerService, redisLockProvider }
+    return { service, boxRepository, runnerService, redisLockProvider, warmPoolService }
   }
 
+  it.each([
+    [{ networkBlockAll: true }, { boxLimitedNetworkEgress: false }, { networkBlockAll: true }],
+    [{ networkAllowList: '10.0.0.0/8' }, { boxLimitedNetworkEgress: false }, { networkAllowList: '10.0.0.0/8' }],
+    [{}, { boxLimitedNetworkEgress: true }, { networkBlockAll: true }],
+  ])('creates a fresh box instead of claiming a warm box when network policy is required', async (request, org, expected) => {
+    const { service, boxRepository, warmPoolService } = makeCreateService()
+    ;(service as any).redis.exists.mockResolvedValue(0)
+
+    await service.create(
+      { name: 'restricted-box', image: 'base', ...request } as any,
+      { id: 'org-1', ...org } as any,
+    )
+
+    expect(warmPoolService.fetchWarmPoolBox).not.toHaveBeenCalled()
+    expect(boxRepository.insert).toHaveBeenCalledWith(expect.objectContaining(expected))
+  })
+
   it.each([
     [undefined, true],
     [false, false],

apps/api/src/box/services/box.service.ts

@@ -223,6 +223,10 @@ export class BoxService {
       // Restrict box creation to the supported pinned images; reject anything else
       // at the request boundary (defaults undefined -> base image).
       const image = assertSupportedImage(createBoxDto.image)
+      const requiresFreshBoxForNetworkPolicy =
+        createBoxDto.networkBlockAll !== undefined ||
+        createBoxDto.networkAllowList !== undefined ||
+        organization.boxLimitedNetworkEgress
 
       this.organizationService.assertOrganizationIsNotSuspended(organization)
 
@@ -237,7 +241,7 @@ export class BoxService {
       if (createBoxDto.volumes && createBoxDto.volumes.length > 0) {
         const volumeIdOrNames = createBoxDto.volumes.map((v) => v.volumeId)
         await this.volumeService.validateVolumes(organization.id, volumeIdOrNames)
-      } else if (image) {
+      } else if (image && !requiresFreshBoxForNetworkPolicy) {
         //  No volumes requested — try to claim a pre-warmed box matching this image/spec
         //  before creating a fresh one.
         const skipWarmPool = (await this.redis.exists(`warm-pool:skip:${image}`)) === 1
@@ -283,6 +287,8 @@ export class BoxService {
 
       if (createBoxDto.networkBlockAll !== undefined) {
         box.networkBlockAll = createBoxDto.networkBlockAll
+      } else if (organization.boxLimitedNetworkEgress) {
+        box.networkBlockAll = true
       }
 
       if (createBoxDto.networkAllowList !== undefined) {
@@ -375,21 +381,6 @@ export class BoxService {
       throw new BoxError('Runner not found for warm pool box')
     }
 
-    if (
-      createBoxDto.networkBlockAll !== undefined ||
-      createBoxDto.networkAllowList !== undefined ||
-      organization.boxLimitedNetworkEgress
-    ) {
-      const runner = await this.runnerService.findOneOrFail(warmPoolBox.runnerId)
-      const runnerAdapter = await this.runnerAdapterFactory.create(runner)
-      await runnerAdapter.updateNetworkSettings(
-        warmPoolBox.id,
-        createBoxDto.networkBlockAll,
-        createBoxDto.networkAllowList,
-        organization.boxLimitedNetworkEgress,
-      )
-    }
-
     // Resolve the name at persist time. A caller-provided name updates in one
     // shot (reusing the pre-fetched entity). A generated default falls back to
     // "{name}-{boxId}" on collision and omits `entity` so each attempt re-reads

apps/api/src/migrations/pre-deploy/1786300000000-retire-unused-job-types-migration.spec.ts

@@ -14,5 +14,6 @@ describe('RetireUnusedJobTypes1786300000000', () => {
     expect(query.mock.calls[0][0]).toContain(`WHERE "state" = 'resizing'`)
     expect(query.mock.calls[0][0]).toContain(`"job"."type" = 'RESIZE_BOX'`)
     expect(query.mock.calls[1][0]).toContain(`UPDATE "job" SET "status" = 'FAILED'`)
+    expect(query.mock.calls[1][0]).toContain(`'UPDATE_BOX_NETWORK_SETTINGS'`)
   })
 })

apps/api/src/migrations/pre-deploy/1786300000000-retire-unused-job-types-migration.ts

@@ -13,7 +13,7 @@ export class RetireUnusedJobTypes1786300000000 implements MigrationInterface {
       `UPDATE "box" SET "state" = CASE "desiredState" WHEN 'started' THEN 'started'::"public"."box_state_enum" WHEN 'stopped' THEN 'stopped'::"public"."box_state_enum" ELSE 'error'::"public"."box_state_enum" END, "pending" = false, "errorReason" = CASE WHEN "desiredState" IN ('started', 'stopped') THEN "errorReason" ELSE 'Legacy resize job had an invalid desired state' END, "updatedAt" = NOW() WHERE "state" = 'resizing' AND EXISTS (SELECT 1 FROM "job" WHERE "job"."resourceId" = "box"."id" AND "job"."type" = 'RESIZE_BOX' AND "job"."completedAt" IS NULL)`,
     )
     await queryRunner.query(
-      `UPDATE "job" SET "status" = 'FAILED', "completedAt" = NOW(), "updatedAt" = NOW(), "errorMessage" = 'Job type is no longer supported' WHERE "completedAt" IS NULL AND "type" IN ('RESIZE_BOX', 'CREATE_BACKUP', 'PULL_ARTIFACT', 'RECOVER_BOX', 'INSPECT_ARTIFACT_IN_REGISTRY', 'REMOVE_ARTIFACT')`,
+      `UPDATE "job" SET "status" = 'FAILED', "completedAt" = NOW(), "updatedAt" = NOW(), "errorMessage" = 'Job type is no longer supported' WHERE "completedAt" IS NULL AND "type" IN ('RESIZE_BOX', 'CREATE_BACKUP', 'PULL_ARTIFACT', 'RECOVER_BOX', 'INSPECT_ARTIFACT_IN_REGISTRY', 'REMOVE_ARTIFACT', 'UPDATE_BOX_NETWORK_SETTINGS')`,
     )
   }
 

apps/libs/api-client-go/api/openapi.yaml

@@ -6181,7 +6181,6 @@ components:
       - START_BOX
       - STOP_BOX
       - DESTROY_BOX
-      - UPDATE_BOX_NETWORK_SETTINGS
       - EXPORT_BOX
       - IMPORT_BOX
       - ROLLBACK_EXPORT_BOX