feat: add job lifecycle controls abuse policies and retention operations

test/config.test.js

@@ -31,25 +31,29 @@ function withTempEnv(patch, run) {
 
 test("config uses defaults when env is missing", () => {
   withTempEnv({
-    PORT: undefined,
-    LOG_LEVEL: undefined,
-    APP_BASE_URL: undefined,
-    BETTER_AUTH_SECRET: undefined,
-    BETTER_AUTH_BASE_PATH: undefined,
-    QWEN_TTS_MODEL: undefined,
-    MINIO_SIGNED_URL_TTL_SEC: undefined,
-    MINIO_USE_SSL: undefined,
-    WEBHOOK_RPM: undefined,
+    PORT: "",
+    LOG_LEVEL: "",
+    APP_BASE_URL: "",
+    BETTER_AUTH_SECRET: "",
+    BETTER_AUTH_BASE_PATH: "",
+    QWEN_TTS_MODEL: "",
+    MINIO_SIGNED_URL_TTL_SEC: "",
+    MINIO_USE_SSL: "",
+    WEBHOOK_RPM: "",
   }, () => {
     const { config } = require("../src/config");
     assert.equal(config.port, 3000);
     assert.equal(config.logLevel, "info");
     assert.equal(config.appBaseUrl, "http://localhost:3000");
     assert.equal(config.betterAuthBasePath, "/api/auth");
+    assert.equal(config.internalApiToken, "");
     assert.equal(config.qwenTtsModel, "qwen-tts-latest");
     assert.equal(config.minioSignedUrlTtlSec, 3600);
     assert.equal(config.minioUseSSL, true);
     assert.equal(config.rateLimits.webhookPerMinute, 120);
+    assert.equal(config.abuse.maxJobsPerUserPerDay, 0);
+    assert.equal(config.abuse.cooldownSec, 0);
+    assert.deepEqual(config.abuse.denyUserIds, []);
   });
 });
 
@@ -61,6 +65,7 @@ test("config reads convex/qwen/minio overrides", () => {
     BETTER_AUTH_SECRET: "prod-secret",
     BETTER_AUTH_BASE_PATH: "/api/auth",
     BETTER_AUTH_DEV_PASSWORD: "xartaudio-dev-password",
+    INTERNAL_API_TOKEN: "internal-token",
     CONVEX_DEPLOYMENT_URL: "https://example.convex.cloud",
     CONVEX_AUTH_TOKEN: "convex-token",
     CONVEX_STATE_QUERY: "state:get",
@@ -72,12 +77,16 @@ test("config reads convex/qwen/minio overrides", () => {
     MINIO_BUCKET: "audio",
     MINIO_SIGNED_URL_TTL_SEC: "7200",
     WEBHOOK_RPM: "77",
+    ABUSE_MAX_JOBS_PER_USER_PER_DAY: "5",
+    ABUSE_COOLDOWN_SEC: "120",
+    ABUSE_DENY_USER_IDS: "u1,u2",
   }, () => {
     const { config } = require("../src/config");
     assert.equal(config.port, 8080);
     assert.equal(config.logLevel, "debug");
     assert.equal(config.appBaseUrl, "https://xartaudio.app");
     assert.equal(config.betterAuthSecret, "prod-secret");
+    assert.equal(config.internalApiToken, "internal-token");
     assert.equal(config.convexDeploymentUrl, "https://example.convex.cloud");
     assert.equal(config.convexAuthToken, "convex-token");
     assert.equal(config.convexStateQuery, "state:get");
@@ -89,5 +98,8 @@ test("config reads convex/qwen/minio overrides", () => {
     assert.equal(config.minioBucket, "audio");
     assert.equal(config.minioSignedUrlTtlSec, 7200);
     assert.equal(config.rateLimits.webhookPerMinute, 77);
+    assert.equal(config.abuse.maxJobsPerUserPerDay, 5);
+    assert.equal(config.abuse.cooldownSec, 120);
+    assert.deepEqual(config.abuse.denyUserIds, ["u1", "u2"]);
   });
 });