rails_error_dashboard 0.13.0 → 0.14.0

data/lib/rails_error_dashboard/services/variable_serializer.rb

@@ -175,19 +175,109 @@ module RailsErrorDashboard
           return { value: label, truncated: false }
         end
 
-        # Fallback: .inspect with truncation
+        # #inspect on an unknown object is arbitrary APPLICATION code, running
+        # on the failure path. Truncating its output bounds what is STORED,
+        # not what it COSTS: an inspect that sleeps or builds a megabyte pays
+        # that in full before a single character is discarded. So the default
+        # is a safe structural summary, and inspect runs only for types the
+        # host app opted in to -- under a wall-clock budget even then.
         max_len = config.local_variable_max_string_length || 200
+
+        # A Struct is serialized MEMBER-WISE, never through its own #inspect.
+        #
+        # Struct was allowlisted because it prints its attributes cheaply --
+        # true of the container, false of what it holds. Struct#inspect calls
+        # each member's #inspect, so a Struct wrapping an unknown object ran
+        # that object's arbitrary code in full. Walking the members instead
+        # gives every one of them the same safe-summary default an unknown
+        # object already gets, so the guarantee holds by construction rather
+        # than by measuring afterwards.
+        return serialize_struct(value, config, depth, max_depth) if struct?(value)
+
+        return { value: safe_summary(value), truncated: false } unless inspectable?(value, config)
+
+        started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
         inspected = value.inspect
+        elapsed_ms = (Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000
+
+        # An OUTPUT-selection threshold, not an execution budget: the inspect
+        # above has already run to completion by the time this is measured.
+        # Only reachable for a type the host app explicitly opted in to, and
+        # that opt-in is documented as accepting unbounded execution -- the
+        # only way to interrupt arbitrary Ruby mid-call is Timeout, which is
+        # not safe on the capture path (safety rule 1).
+        budget = config.local_variable_inspect_budget_ms || 5
+        if elapsed_ms > budget
+          RailsErrorDashboard::Logger.debug(
+            "[RailsErrorDashboard] #{value.class}#inspect took #{elapsed_ms.round(1)}ms " \
+            "(budget #{budget}ms) — storing a summary instead"
+          )
+          return { value: safe_summary(value), truncated: true }
+        end
+
         if inspected.length > max_len
           { value: inspected[0, max_len], truncated: true }
         else
           { value: inspected, truncated: false }
         end
       rescue
-        { value: "#<#{value.class.name rescue "Object"}>", truncated: false }
+        { value: safe_summary(value), truncated: false }
       end
       private_class_method :serialize_object
 
+      def self.struct?(value)
+        value.is_a?(Struct)
+      rescue StandardError
+        false
+      end
+      private_class_method :struct?
+
+      # Serialize a Struct's members through the ordinary bounded path.
+      #
+      # Bounded twice over: member count is capped, and each member recurses
+      # with depth + 1, so a Struct of Structs cannot reintroduce unbounded
+      # work through recursion instead of through #inspect.
+      def self.serialize_struct(value, config, depth, max_depth)
+        max_members = config.local_variable_max_array_items || 10
+        members = value.members.first(max_members)
+        truncated = value.members.size > members.size
+
+        pairs = members.map do |member|
+          serialized = serialize_value(value[member], config, depth + 1, max_depth)
+          truncated ||= serialized[:truncated]
+          "#{member}=#{serialized[:value]}"
+        end
+
+        # An anonymous Struct has no class name; label it by shape rather than
+        # rendering "#<struct  a=1>" with a hole in it.
+        label = value.class.name.presence || "struct"
+        { value: "#<#{label} #{pairs.join(', ')}>", truncated: truncated }
+      rescue StandardError
+        { value: safe_summary(value), truncated: false }
+      end
+      private_class_method :serialize_struct
+
+      # What an object is, without asking the object. Costs one class-name read.
+      def self.safe_summary(value)
+        "#<#{value.class.name}>"
+      rescue StandardError
+        "#<Object>"
+      end
+      private_class_method :safe_summary
+
+      # True when this object's class (or an ancestor) is on the allowlist, so
+      # the host app has accepted the cost of its #inspect.
+      def self.inspectable?(value, config)
+        allowlist = Array(config.local_variable_inspect_allowlist)
+        return false if allowlist.empty?
+
+        ancestors = value.class.ancestors.map { |mod| mod.name }.compact
+        (ancestors & allowlist).any?
+      rescue StandardError
+        false
+      end
+      private_class_method :inspectable?
+
       # --- Sensitive data filtering (post-serialization) ---
       # Reuses SensitiveDataFilter.parameter_filter — same pattern as BreadcrumbCollector.
       # Applied AFTER serialization so ParameterFilter works on clean JSON-compatible values.
@@ -215,14 +305,39 @@ module RailsErrorDashboard
             info[:value] = SensitiveDataFilter.send(:filter_message, filter, info[:value])
           end
 
-          # Filter nested hash keys recursively
-          if info[:value].is_a?(Hash)
-            info[:value] = filter_hash_recursive(filter, info[:value])
-          end
-
-          # Filter nested array items
-          if info[:value].is_a?(Array)
-            info[:value] = filter_array_recursive(filter, info[:value])
+          # Path-aware filtering, in ONE call for every container type.
+          #
+          # The value is wrapped back under its own variable name so the filter
+          # sees the SAME key path Rails sees for request params. A dotted
+          # pattern like "profile.private_note" is a path, not a name: dropping
+          # the "profile" segment means the value Rails redacts in params stays
+          # readable here. Unwrapping afterwards leaves the stored shape
+          # unchanged.
+          #
+          # This must NOT ask "what shape is this?" first. Wrapping only Hashes
+          # and sending Arrays straight to the recursive walker is exactly how
+          # `profile = [{ private_note: ... }]` leaked while the identical
+          # request params were redacted: ParameterFilter already traverses
+          # arbitrary nesting of Hash and Array, so one wrap covers every shape
+          # and a new container type cannot reintroduce the gap.
+          #
+          # Parity with Rails is the contract in both directions -- a pattern
+          # that Rails does NOT match (profile.list.private_note, or a bare
+          # scalar) must survive here too. Over-redaction silently destroys
+          # data a developer needs to debug.
+          if info[:value].is_a?(Hash) || info[:value].is_a?(Array)
+            scoped = filter.filter(var_name => info[:value])[var_name]
+
+            # The recursive pass stays, and runs AFTER the path-aware filter:
+            # it scrubs sensitive CONTENT inside strings (credit-card and
+            # key=value patterns), which ParameterFilter does not do -- it only
+            # matches keys.
+            info[:value] =
+              case scoped
+              when Hash  then filter_hash_recursive(filter, scoped)
+              when Array then filter_array_recursive(filter, scoped)
+              else scoped
+              end
           end
         end
 

data/lib/rails_error_dashboard/subscribers/breadcrumb_subscriber.rb

@@ -16,6 +16,18 @@ module RailsErrorDashboard
     class BreadcrumbSubscriber
       SQL_MESSAGE_MAX = 200
 
+      # Where a failing job's trail waits for the reporter.
+      #
+      # ActiveJob reports a job error OUTSIDE the frame that runs
+      # `run_callbacks :perform`: perform_now's `rescue Exception` is one frame
+      # out (activejob execution.rb), and the report itself fires two frames
+      # further out still, from the :execute around-callback that the railtie
+      # registers (ExecutionWrapper.wrap's `rescue Exception` ->
+      # error_reporter.report). By the time LogError runs, our ensure has
+      # already cleared the buffer. So we snapshot on the way out and leave the
+      # snapshot here for LogError to pick up.
+      JOB_TRAIL_KEY = :rails_error_dashboard_job_breadcrumb_trail
+
       # Event subscriptions managed by this class
       @subscriptions = []
 
@@ -38,6 +50,105 @@ module RailsErrorDashboard
           @subscriptions
         end
 
+        # Open a breadcrumb buffer around every Active Job perform, so a job
+        # that fails outside a request still has an activity trail.
+        #
+        # Idempotent: the callback list belongs to ActiveJob::Base, and a
+        # second registration would open and close the buffer twice per job.
+        #
+        # The config check is INSIDE the callback, not around this method.
+        # enable_breadcrumbs defaults to false and the callback list is fixed
+        # once the class loads, so gating registration would permanently
+        # disable job breadcrumbs for any host that enables the feature in an
+        # initializer running after the engine's.
+        # @return [Boolean] true when the callback was installed
+        def install_job_buffer!
+          return false if @job_buffer_installed
+          return false unless defined?(ActiveJob::Base)
+
+          @job_buffer_installed = true
+          ActiveSupport.on_load(:active_job) do
+            around_perform do |job, block|
+              collector = RailsErrorDashboard::Services::BreadcrumbCollector
+              subscriber = RailsErrorDashboard::Subscribers::BreadcrumbSubscriber
+
+              # Drop any snapshot a previous perform on this pooled thread left
+              # behind. This, not the ensure below, is what bounds the leak:
+              # discard_on (and a host rescue_from) can swallow an exception so
+              # that nothing is ever reported and nothing ever consumes the
+              # snapshot. At most one job's serialized trail survives, and only
+              # until this thread's very next perform.
+              Thread.current[subscriber::JOB_TRAIL_KEY] = nil
+
+              owned =
+                if RailsErrorDashboard.configuration.enable_breadcrumbs &&
+                   !subscriber.capture_job?(job)
+                  collector.init_buffer_unless_present
+                else
+                  false
+                end
+
+              completed = false
+              begin
+                block.call
+                completed = true
+              ensure
+                # Snapshot BEFORE clearing, and only when the job did not
+                # finish normally -- see JOB_TRAIL_KEY: the error is reported
+                # two frames outside this one, long after the clear.
+                #
+                # `completed`, not a `rescue Exception`, because retry_on and
+                # discard_on with `report: true` report the error and then
+                # return normally: no exception passes through here, yet the
+                # capture still needs the trail.
+                #
+                # Gated on `owned`: a job running inline inside a request must
+                # not copy out -- or clear -- a buffer the request owns.
+                if owned && !completed
+                  begin
+                    trail = collector.current_breadcrumbs
+                    Thread.current[subscriber::JOB_TRAIL_KEY] = trail if trail.is_a?(Array) && trail.any?
+                  rescue StandardError
+                    nil # never raise from the capture path
+                  end
+                end
+
+                # ensure, always: a worker pool reuses threads, and a
+                # thread-local left behind would leak one job's trail into the
+                # next (safety rule 4).
+                collector.clear_buffer_if_owned(owned)
+              end
+            end
+          end
+          true
+        rescue StandardError => e
+          RailsErrorDashboard::Logger.debug(
+            "[RailsErrorDashboard] install_job_buffer! failed: #{e.class} - #{e.message}"
+          )
+          false
+        end
+
+        # Is the job now performing one of the gem's OWN capture jobs?
+        #
+        # AsyncErrorLoggingJob descends from ActiveJob::Base, so it runs
+        # through the around_perform above like any host job. Opening a buffer
+        # for it collects the gem's own write traffic -- its cache reads for
+        # the application record, its SAVEPOINT/RELEASE SAVEPOINT pairs -- and
+        # the anti-recursion filter does not catch those (it is a substring
+        # test for "rails_error_dashboard_" against the SQL text, and
+        # transaction control carries no table name).
+        #
+        # Today that noise is discarded because the envelope wins in LogError.
+        # Once a failing job's buffer is snapshotted and stored, it would
+        # become the trail on the gem's own failure path. Never open one.
+        # @param job [ActiveJob::Base]
+        # @return [Boolean]
+        def capture_job?(job)
+          job.class.name.to_s.start_with?("RailsErrorDashboard::")
+        rescue StandardError
+          false
+        end
+
         # Remove all breadcrumb subscribers
         def unsubscribe!
           @subscriptions.each do |sub|

data/lib/rails_error_dashboard/value_objects/error_context.rb

@@ -7,7 +7,8 @@ module RailsErrorDashboard
     class ErrorContext
       attr_reader :user_id, :request_url, :request_params, :user_agent, :ip_address, :platform,
                   :controller_name, :action_name, :request_id, :session_id,
-                  :http_method, :hostname, :content_type, :request_duration_ms, :environment
+                  :http_method, :hostname, :content_type, :request_duration_ms, :environment,
+                  :occurred_at, :app_version
 
       def initialize(context, source = nil)
         @context = context
@@ -23,6 +24,8 @@ module RailsErrorDashboard
         @action_name = extract_action_name
         @request_id = extract_request_id
         @session_id = extract_session_id
+        @occurred_at = extract_occurred_at
+        @app_version = extract_app_version
         @http_method = extract_http_method
         @hostname = extract_hostname
         @content_type = extract_content_type
@@ -52,12 +55,40 @@ module RailsErrorDashboard
           hostname: hostname,
           content_type: content_type,
           request_duration_ms: request_duration_ms,
-          environment: environment
+          environment: environment,
+          # Both belong in to_h, not only in the readers: LogError builds a
+          # SECOND ErrorContext from this hash on the async path, and a key
+          # missing here is silently dropped there. That hop is what lost
+          # request_id and session_id before.
+          occurred_at: occurred_at,
+          app_version: app_version
         }
       end
 
       private
 
+      # A caller-supplied event time, e.g. a mobile client reporting a failure
+      # that happened while it was offline. Never in the future: a client clock
+      # can be wrong, and a future row would sort above every real error and
+      # never age out of a window.
+      def extract_occurred_at
+        raw = @context[:occurred_at]
+        return nil if raw.blank?
+
+        time = raw.is_a?(String) ? Time.zone.parse(raw) : raw
+        return nil unless time.respond_to?(:to_time)
+
+        [ time, Time.current ].min
+      rescue StandardError
+        nil
+      end
+
+      # The release the REPORTER was running, which for a mobile or frontend
+      # report is the whole point -- it differs from the server's version.
+      def extract_app_version
+        @context[:app_version].presence
+      end
+
       def extract_user_id
         @context[:current_user]&.id ||
           @context[:user_id] ||
@@ -120,6 +151,10 @@ module RailsErrorDashboard
         # Additional context (from mobile apps, etc.)
         params.merge!(@context[:additional_context]) if @context[:additional_context]
 
+        # Caller-supplied metadata, documented by ManualErrorReporter and
+        # previously accepted and discarded.
+        params.merge!(@context[:metadata]) if @context[:metadata].is_a?(Hash)
+
         # Pre-serialized params (from async logging or double-ErrorContext path).
         # LogError creates a second ErrorContext from error_context.to_h which
         # has :request_params as a JSON string but no :request object.

data/lib/rails_error_dashboard/version.rb

@@ -1,3 +1,3 @@
 module RailsErrorDashboard
-  VERSION = "0.13.0"
+  VERSION = "0.14.0"
 end

data/lib/rails_error_dashboard.rb

@@ -138,6 +138,9 @@ require "rails_error_dashboard/commands/flush_rack_attack_events"
 require "rails_error_dashboard/commands/scrub_invalid_encoding"
 require "rails_error_dashboard/commands/backfill_resolved_at"
 require "rails_error_dashboard/queries/errors_list"
+# Before the queries that use it: window volume is shared by dashboard and
+# analytics, and both would otherwise rescue a NameError into a silent zero.
+require "rails_error_dashboard/queries/event_volume"
 require "rails_error_dashboard/queries/dashboard_stats"
 require "rails_error_dashboard/queries/analytics_stats"
 require "rails_error_dashboard/queries/filter_options"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_error_dashboard
 version: !ruby/object:Gem::Version
-  version: 0.13.0
+  version: 0.14.0
 platform: ruby
 authors:
 - Anjan Jagirdar
@@ -309,6 +309,8 @@ files:
 - app/models/rails_error_dashboard/error_log.rb
 - app/models/rails_error_dashboard/error_logs_record.rb
 - app/models/rails_error_dashboard/error_occurrence.rb
+- app/models/rails_error_dashboard/event_count.rb
+- app/models/rails_error_dashboard/event_timing_gap.rb
 - app/models/rails_error_dashboard/rack_attack_event.rb
 - app/models/rails_error_dashboard/storm_event.rb
 - app/models/rails_error_dashboard/storm_flush_batch.rb
@@ -420,6 +422,9 @@ files:
 - db/migrate/20260915000003_add_context_provenance_to_error_logs.rb
 - db/migrate/20260915000004_create_storm_flush_batches.rb
 - db/migrate/20260917000001_add_last_notified_at_to_error_logs.rb
+- db/migrate/20260919000001_create_event_counts.rb
+- db/migrate/20260920000001_add_buckets_incomplete_to_storm_events.rb
+- db/migrate/20260920000002_create_event_timing_gaps.rb
 - lib/generators/rails_error_dashboard/install/install_generator.rb
 - lib/generators/rails_error_dashboard/install/templates/README
 - lib/generators/rails_error_dashboard/install/templates/initializer.rb
@@ -490,6 +495,7 @@ files:
 - lib/rails_error_dashboard/queries/error_cascades.rb
 - lib/rails_error_dashboard/queries/error_correlation.rb
 - lib/rails_error_dashboard/queries/errors_list.rb
+- lib/rails_error_dashboard/queries/event_volume.rb
 - lib/rails_error_dashboard/queries/filter_options.rb
 - lib/rails_error_dashboard/queries/job_health_summary.rb
 - lib/rails_error_dashboard/queries/llm_health_summary.rb
@@ -593,7 +599,7 @@ metadata:
   funding_uri: https://github.com/sponsors/AnjanJ
 post_install_message: |
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-    RED (Rails Error Dashboard) v0.13.0
+    RED (Rails Error Dashboard) v0.14.0
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 
   First install: