rails_pulse 0.2.4 → 0.2.5.pre.pre.3

data/app/javascript/rails_pulse/controllers/chart_controller.js

@@ -161,19 +161,123 @@ export default class extends Controller {
     // Remove function markers if present
     const cleanString = formatterString.replace(/__FUNCTION_START__|__FUNCTION_END__/g, '')
 
-    // If it's a function string, parse it
+    // If it's a function string, use safe formatter registry instead of eval()
     if (cleanString.trim().startsWith('function')) {
-      try {
-        // eslint-disable-next-line no-eval
-        return eval(`(${cleanString})`)
-      } catch (error) {
-        console.error('[RailsPulse] Error parsing formatter function:', error)
-        return cleanString
-      }
+      // Extract formatter logic using safe parsing
+      // Rather than eval(), we match against known safe patterns
+      return this.getSafeFormatter(cleanString)
     }
     return cleanString
   }
 
+  /**
+   * Returns a safe formatter function based on the formatter string.
+   * This prevents arbitrary code execution by using a whitelist approach.
+   *
+   * Security: Replaces eval() to prevent XSS and code injection attacks.
+   */
+  getSafeFormatter(formatterString) {
+    // Whitelist of safe formatter patterns
+    // Each pattern maps to a safe implementation
+    const SAFE_FORMATTERS = {
+      // Duration formatter (milliseconds)
+      'duration_ms': (value) => {
+        if (typeof value === 'number') {
+          return value.toFixed(2) + ' ms'
+        }
+        return value
+      },
+
+      // Percentage formatter
+      'percentage': (value) => {
+        if (typeof value === 'number') {
+          return value.toFixed(1) + '%'
+        }
+        return value
+      },
+
+      // Number with commas
+      'number_delimited': (value) => {
+        if (typeof value === 'number') {
+          return value.toLocaleString()
+        }
+        return value
+      },
+
+      // Timestamp formatter
+      'timestamp': (value) => {
+        if (typeof value === 'number' || typeof value === 'string') {
+          const date = new Date(value)
+          return date.toLocaleString()
+        }
+        return value
+      },
+
+      // Date only
+      'date': (value) => {
+        if (typeof value === 'number' || typeof value === 'string') {
+          const date = new Date(value)
+          return date.toLocaleDateString()
+        }
+        return value
+      },
+
+      // Time only
+      'time': (value) => {
+        if (typeof value === 'number' || typeof value === 'string') {
+          const date = new Date(value)
+          return date.toLocaleTimeString()
+        }
+        return value
+      },
+
+      // Bytes formatter
+      'bytes': (value) => {
+        if (typeof value !== 'number') return value
+
+        const units = ['B', 'KB', 'MB', 'GB', 'TB']
+        let size = value
+        let unitIndex = 0
+
+        while (size >= 1024 && unitIndex < units.length - 1) {
+          size /= 1024
+          unitIndex++
+        }
+
+        return size.toFixed(2) + ' ' + units[unitIndex]
+      }
+    }
+
+    // Try to match the formatter string to a known safe pattern
+    for (const [key, formatter] of Object.entries(SAFE_FORMATTERS)) {
+      if (formatterString.includes(key) ||
+          formatterString.includes(key.replace('_', ''))) {
+        return formatter
+      }
+    }
+
+    // Check for specific safe patterns in the function string
+    if (formatterString.includes('toFixed(2)') && formatterString.includes('ms')) {
+      return SAFE_FORMATTERS.duration_ms
+    }
+
+    if (formatterString.includes('toLocaleString')) {
+      return SAFE_FORMATTERS.number_delimited
+    }
+
+    if (formatterString.includes('toLocaleDateString')) {
+      return SAFE_FORMATTERS.date
+    }
+
+    if (formatterString.includes('toLocaleTimeString')) {
+      return SAFE_FORMATTERS.time
+    }
+
+    // Default: return a safe identity function that just returns the value
+    console.warn('[RailsPulse] Unknown formatter pattern, using identity function:', formatterString)
+    return (value) => value
+  }
+
   showError() {
     this.element.classList.add('chart-error')
     this.element.innerHTML = '<p class="text-subtle p-4">Chart failed to load</p>'

data/app/models/concerns/rails_pulse/taggable.rb

@@ -2,13 +2,24 @@ module RailsPulse
   module Taggable
     extend ActiveSupport::Concern
 
+    # Tag validation constants
+    TAG_NAME_REGEX = /\A[a-z0-9_-]+\z/i
+    MAX_TAG_LENGTH = 50
+
     included do
       # Callbacks
       before_save :ensure_tags_is_array
 
       # Scopes with table name qualification to avoid ambiguity
-      scope :with_tag, ->(tag) { where("#{table_name}.tags LIKE ?", "%#{tag}%") }
-      scope :without_tag, ->(tag) { where.not("#{table_name}.tags LIKE ?", "%#{tag}%") }
+      # Note: LIKE patterns are sanitized to prevent SQL injection via wildcards
+      scope :with_tag, ->(tag) {
+        sanitized_tag = sanitize_sql_like(tag.to_s, "\\")
+        where("#{table_name}.tags LIKE ?", "%#{sanitized_tag}%")
+      }
+      scope :without_tag, ->(tag) {
+        sanitized_tag = sanitize_sql_like(tag.to_s, "\\")
+        where.not("#{table_name}.tags LIKE ?", "%#{sanitized_tag}%")
+      }
       scope :with_tags, -> { where("#{table_name}.tags IS NOT NULL AND #{table_name}.tags != '[]'") }
     end
 
@@ -26,11 +37,16 @@ module RailsPulse
     end
 
     def add_tag(tag)
+      # Validate tag format and length
+      return false unless valid_tag_name?(tag)
+
       current_tags = tag_list
       unless current_tags.include?(tag.to_s)
         current_tags << tag.to_s
         self.tag_list = current_tags
         save
+      else
+        true  # Tag already exists, return success
       end
     end
 
@@ -45,6 +61,13 @@ module RailsPulse
 
     private
 
+    def valid_tag_name?(tag)
+      return false if tag.blank?
+      return false if tag.to_s.length > MAX_TAG_LENGTH
+      return false unless tag.to_s.match?(TAG_NAME_REGEX)
+      true
+    end
+
     def parsed_tags
       return [] if tags.nil? || tags.empty?
       JSON.parse(tags)

data/app/models/rails_pulse/charts/operations_chart.rb

@@ -0,0 +1,33 @@
+module RailsPulse
+  module Charts
+    class OperationsChart
+      OperationBar = Struct.new(:operation, :duration, :left_pct, :width_pct)
+
+      attr_reader :bars, :min_start, :max_end, :total_duration
+
+      HORIZONTAL_OFFSET_PX = 20
+
+      def initialize(operations)
+        @operations = operations
+        @min_start = @operations.map(&:start_time).min || 0
+        @max_end = @operations.map { |op| op.start_time + op.duration }.max || 1
+        @total_duration = (@max_end - @min_start).nonzero? || 1
+        @bars = build_bars
+      end
+
+      private
+
+      def build_bars
+        @operations.map do |operation|
+          left_pct = ((operation.start_time - @min_start).to_f / @total_duration) * (100 - px_to_pct) + px_to_pct / 2
+          width_pct = (operation.duration.to_f / @total_duration) * (100 - px_to_pct)
+          OperationBar.new(operation, operation.duration.round(0), left_pct, width_pct)
+        end
+      end
+
+      def px_to_pct
+        (HORIZONTAL_OFFSET_PX.to_f / 1000) * 100
+      end
+    end
+  end
+end

data/app/models/rails_pulse/dashboard/charts/p95_response_time.rb

@@ -23,9 +23,8 @@ module RailsPulse
             )
 
           actual_data = summaries
-            .group_by_day(:period_start, time_zone: Time.zone)
+            .group_by_date(:period_start)
             .average(:p95_duration)
-            .transform_keys { |date| date.to_date }
             .transform_values { |avg| avg&.round(0) || 0 }
 
           # Fill in all dates with zero values for missing days

data/app/models/rails_pulse/dashboard/tables/slow_routes.rb

@@ -49,7 +49,7 @@ module RailsPulse
           # Return new structure with columns and data
           {
             columns: [
-              { field: :route_path, label: "Route", link_to: :route_link, class: "w-auto" },
+              { field: :route_path, label: "Route", link_to: :route_link, class: "w-48", cell_class: "truncate-cell" },
               { field: :average_time, label: "Average Time", class: "w-32" },
               { field: :request_count, label: "Requests", class: "w-24" },
               { field: :last_request, label: "Last Request", class: "w-32" }

data/app/models/rails_pulse/job.rb

@@ -0,0 +1,85 @@
+module RailsPulse
+  class Job < RailsPulse::ApplicationRecord
+    include Taggable
+
+    self.table_name = "rails_pulse_jobs"
+
+    has_many :runs,
+             class_name: "RailsPulse::JobRun",
+             foreign_key: :job_id,
+             inverse_of: :job,
+             dependent: :destroy
+
+    validates :name, presence: true, uniqueness: true
+
+    def self.ransackable_attributes(auth_object = nil)
+      %w[id name queue_name runs_count failures_count retries_count avg_duration]
+    end
+
+    def self.ransackable_associations(auth_object = nil)
+      %w[runs]
+    end
+
+    scope :by_queue, ->(queue) { where(queue_name: queue) }
+    scope :with_failures, -> { where("failures_count > 0") }
+    scope :ordered_by_runs, -> { order(runs_count: :desc) }
+
+    def apply_run!(run)
+      return unless run.duration
+
+      duration = run.duration.to_f
+
+      with_lock do
+        reload
+        total_runs = runs_count.to_i
+        previous_total = [ total_runs - 1, 0 ].max
+        previous_average = avg_duration.to_f
+
+        new_average = if previous_total.zero?
+          duration
+        else
+          ((previous_average * previous_total) + duration) / (previous_total + 1)
+        end
+
+        updates = { avg_duration: new_average }
+        if run.failure_like_status?
+          updates[:failures_count] = failures_count + 1
+        end
+        if run.status == "retried"
+          updates[:retries_count] = retries_count + 1
+        end
+
+        update!(updates)
+      end
+    end
+
+    def failure_rate
+      return 0.0 if runs_count.zero?
+
+      ((failures_count.to_f / runs_count) * 100).round(2)
+    end
+
+    def performance_status
+      thresholds = RailsPulse.configuration.job_thresholds
+      duration = avg_duration.to_f
+
+      if duration < thresholds[:slow]
+        :fast
+      elsif duration < thresholds[:very_slow]
+        :slow
+      elsif duration < thresholds[:critical]
+        :very_slow
+      else
+        :critical
+      end
+    end
+
+    def to_param
+      id.to_s
+    end
+
+    def to_breadcrumb
+      name
+    end
+  end
+end

data/app/models/rails_pulse/job_run.rb

@@ -0,0 +1,76 @@
+module RailsPulse
+  class JobRun < RailsPulse::ApplicationRecord
+    include Taggable
+
+    self.table_name = "rails_pulse_job_runs"
+
+    STATUSES = %w[enqueued running success failed discarded retried].freeze
+    FINAL_STATUSES = %w[success failed discarded retried].freeze
+
+    belongs_to :job,
+               class_name: "RailsPulse::Job",
+               counter_cache: :runs_count,
+               inverse_of: :runs
+    has_many :operations,
+             class_name: "RailsPulse::Operation",
+             foreign_key: :job_run_id,
+             inverse_of: :job_run,
+             dependent: :destroy
+
+    validates :run_id, presence: true, uniqueness: true
+    validates :status, inclusion: { in: STATUSES }
+    validates :occurred_at, presence: true
+
+    def self.ransackable_attributes(auth_object = nil)
+      %w[id job_id run_id status occurred_at duration attempts adapter]
+    end
+
+    def self.ransackable_associations(auth_object = nil)
+      %w[job operations]
+    end
+
+    scope :successful, -> { where(status: "success") }
+    scope :failed, -> { where(status: %w[failed discarded]) }
+    scope :recent, -> { order(occurred_at: :desc) }
+    scope :by_adapter, ->(adapter) { where(adapter: adapter) }
+
+    after_commit :apply_to_job_caches, on: %i[create update], if: :finalized?
+
+    def all_tags
+      (job.tag_list + tag_list).uniq
+    end
+
+    def performance_status
+      thresholds = RailsPulse.configuration.job_thresholds
+      duration = self.duration.to_f
+
+      if duration < thresholds[:slow]
+        :fast
+      elsif duration < thresholds[:very_slow]
+        :slow
+      elsif duration < thresholds[:critical]
+        :very_slow
+      else
+        :critical
+      end
+    end
+
+    def failure_like_status?
+      FINAL_STATUSES.include?(status) && status != "success"
+    end
+
+    def finalized?
+      change = previous_changes["status"]
+      return false unless change
+
+      previous_state, new_state = change
+      FINAL_STATUSES.include?(new_state) && !FINAL_STATUSES.include?(previous_state)
+    end
+
+    private
+
+    def apply_to_job_caches
+      job.apply_run!(self)
+    end
+  end
+end

data/app/models/rails_pulse/jobs/cards/average_duration.rb

@@ -0,0 +1,85 @@
+module RailsPulse
+  module Jobs
+    module Cards
+      class AverageDuration < Base
+        def initialize(job: nil)
+          @job = job
+        end
+
+        def to_metric_card
+          base_query = RailsPulse::Summary
+            .where(
+              summarizable_type: "RailsPulse::Job",
+              period_type: "day",
+              period_start: range_start..now
+            )
+          base_query = base_query.where(summarizable_id: @job.id) if @job
+
+          metrics = base_query.select(
+            "SUM(avg_duration * count) AS total_weighted_duration",
+            "SUM(count) AS total_runs",
+            "SUM(CASE WHEN period_start >= #{quote(current_window_start)} THEN avg_duration * count ELSE 0 END) AS current_weighted_duration",
+            "SUM(CASE WHEN period_start >= #{quote(current_window_start)} THEN count ELSE 0 END) AS current_runs",
+            "SUM(CASE WHEN period_start >= #{quote(range_start)} AND period_start < #{quote(current_window_start)} THEN avg_duration * count ELSE 0 END) AS previous_weighted_duration",
+            "SUM(CASE WHEN period_start >= #{quote(range_start)} AND period_start < #{quote(current_window_start)} THEN count ELSE 0 END) AS previous_runs"
+          ).take
+
+          total_runs = metrics&.total_runs.to_i
+          total_weighted_duration = metrics&.total_weighted_duration.to_f
+          current_runs = metrics&.current_runs.to_i
+          current_weighted_duration = metrics&.current_weighted_duration.to_f
+          previous_runs = metrics&.previous_runs.to_i
+          previous_weighted_duration = metrics&.previous_weighted_duration.to_f
+
+          average_duration = average_for(total_weighted_duration, total_runs)
+          current_average = average_for(current_weighted_duration, current_runs)
+          previous_average = average_for(previous_weighted_duration, previous_runs)
+
+          trend_icon, trend_amount = trend_for(current_average, previous_average)
+
+          grouped_weighted = base_query
+            .group_by_date(:period_start)
+            .sum(Arel.sql("avg_duration * count"))
+
+          grouped_counts = base_query
+            .group_by_date(:period_start)
+            .sum(:count)
+
+          sparkline_data = sparkline_from_averages(grouped_weighted, grouped_counts)
+
+          {
+            id: "jobs_average_duration",
+            context: "jobs",
+            title: "Average Duration",
+            summary: format_duration(average_duration),
+            chart_data: sparkline_data,
+            trend_icon: trend_icon,
+            trend_amount: trend_amount,
+            trend_text: "Compared to previous week"
+          }
+        end
+
+        private
+
+        def average_for(weighted_duration, total_runs)
+          return 0.0 if total_runs.zero?
+
+          (weighted_duration.to_f / total_runs).round(1)
+        end
+
+        def sparkline_from_averages(weighted_by_day, counts_by_day)
+          start_date = range_start.to_date
+          end_date = now.to_date
+
+          (start_date..end_date).each_with_object({}) do |day, hash|
+            weighted = weighted_by_day[day].to_f
+            count = counts_by_day[day].to_f
+            avg = count.zero? ? 0.0 : (weighted / count).round(1)
+            label = day.strftime("%b %-d")
+            hash[label] = { value: avg }
+          end
+        end
+      end
+    end
+  end
+end

data/app/models/rails_pulse/jobs/cards/base.rb

@@ -0,0 +1,70 @@
+require "active_support/number_helper"
+
+module RailsPulse
+  module Jobs
+    module Cards
+      class Base
+        RANGE_DAYS = 14
+        WINDOW_DAYS = 7
+
+        private
+
+        def now
+          @now ||= Time.current
+        end
+
+        def previous_window_start
+          (now - (WINDOW_DAYS * 2).days).beginning_of_day
+        end
+
+        def current_window_start
+          (now - WINDOW_DAYS.days).beginning_of_day
+        end
+
+        def range_start
+          previous_window_start
+        end
+
+        def quote(time)
+          RailsPulse::Summary.connection.quote(time)
+        end
+
+        def sparkline_from(grouped_values)
+          start_date = range_start.to_date
+          end_date = now.to_date
+
+          (start_date..end_date).each_with_object({}) do |day, hash|
+            label = day.strftime("%b %-d")
+            hash[label] = { value: grouped_values[day] || 0 }
+          end
+        end
+
+        def trend_for(current_value, previous_value, precision: 1)
+          percentage = previous_value.zero? ? 0.0 : ((current_value - previous_value) / previous_value.to_f * 100).round(precision)
+
+          icon = if percentage.abs < 0.1
+            "move-right"
+          elsif percentage.positive?
+            "trending-up"
+          else
+            "trending-down"
+          end
+
+          [ icon, format_percentage(percentage.abs, precision) ]
+        end
+
+        def format_percentage(value, precision)
+          "#{value.round(precision)}%"
+        end
+
+        def format_number(value)
+          ActiveSupport::NumberHelper.number_to_delimited(value)
+        end
+
+        def format_duration(value)
+          "#{value.round(0)} ms"
+        end
+      end
+    end
+  end
+end

data/app/models/rails_pulse/jobs/cards/failure_rate.rb

@@ -0,0 +1,85 @@
+module RailsPulse
+  module Jobs
+    module Cards
+      class FailureRate < Base
+        def initialize(job: nil)
+          @job = job
+        end
+
+        def to_metric_card
+          base_query = RailsPulse::Summary
+            .where(
+              summarizable_type: "RailsPulse::Job",
+              period_type: "day",
+              period_start: range_start..now
+            )
+          base_query = base_query.where(summarizable_id: @job.id) if @job
+
+          metrics = base_query.select(
+            "SUM(count) AS total_count",
+            "SUM(error_count) AS total_errors",
+            "SUM(CASE WHEN period_start >= #{quote(current_window_start)} THEN count ELSE 0 END) AS current_count",
+            "SUM(CASE WHEN period_start >= #{quote(current_window_start)} THEN error_count ELSE 0 END) AS current_errors",
+            "SUM(CASE WHEN period_start >= #{quote(range_start)} AND period_start < #{quote(current_window_start)} THEN count ELSE 0 END) AS previous_count",
+            "SUM(CASE WHEN period_start >= #{quote(range_start)} AND period_start < #{quote(current_window_start)} THEN error_count ELSE 0 END) AS previous_errors"
+          ).take
+
+          total_runs = metrics&.total_count.to_i
+          total_errors = metrics&.total_errors.to_i
+          current_runs = metrics&.current_count.to_i
+          current_errors = metrics&.current_errors.to_i
+          previous_runs = metrics&.previous_count.to_i
+          previous_errors = metrics&.previous_errors.to_i
+
+          failure_rate = rate_for(total_errors, total_runs)
+          current_rate = rate_for(current_errors, current_runs)
+          previous_rate = rate_for(previous_errors, previous_runs)
+
+          trend_icon, trend_amount = trend_for(current_rate, previous_rate)
+
+          grouped_errors = base_query
+            .group_by_date(:period_start)
+            .sum(:error_count)
+
+          grouped_counts = base_query
+            .group_by_date(:period_start)
+            .sum(:count)
+
+          sparkline_data = sparkline_from_failure_rates(grouped_errors, grouped_counts)
+
+          {
+            id: "jobs_failure_rate",
+            context: "jobs",
+            title: "Failure Rate",
+            summary: "#{format_percentage(failure_rate, 1)}",
+            chart_data: sparkline_data,
+            trend_icon: trend_icon,
+            trend_amount: trend_amount,
+            trend_text: "Compared to previous week"
+          }
+        end
+
+        private
+
+        def rate_for(errors, total)
+          return 0.0 if total.zero?
+
+          (errors.to_f / total * 100).round(1)
+        end
+
+        def sparkline_from_failure_rates(errors_by_day, counts_by_day)
+          start_date = range_start.to_date
+          end_date = now.to_date
+
+          (start_date..end_date).each_with_object({}) do |day, hash|
+            errors = errors_by_day[day].to_f
+            total = counts_by_day[day].to_f
+            rate = total.zero? ? 0.0 : (errors / total * 100).round(1)
+            label = day.strftime("%b %-d")
+            hash[label] = { value: rate }
+          end
+        end
+      end
+    end
+  end
+end