@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.11

package/dist/telemetry/connection/telemetry-connection-test.service.js

@@ -0,0 +1,187 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var TelemetryConnectionTestService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TelemetryConnectionTestService = void 0;
+const common_1 = require("@nestjs/common");
+const pg_1 = require("pg");
+const blank_secret_1 = require("../internal/blank-secret");
+const greptime_client_1 = require("../stores/greptime/greptime.client");
+const greptime_host_1 = require("../stores/greptime/greptime-host");
+const telemetry_connection_service_1 = require("./telemetry-connection.service");
+/** How long `end()` may take before a probe stops waiting for it. */
+const PROBE_END_GRACE_MS = 1_000;
+let TelemetryConnectionTestService = TelemetryConnectionTestService_1 = class TelemetryConnectionTestService {
+    connection;
+    logger = new common_1.Logger(TelemetryConnectionTestService_1.name);
+    constructor(connection) {
+        this.connection = connection;
+    }
+    async test(input, userId) {
+        const automatic = input.host === null || input.host === undefined;
+        const candidate = automatic ? this.deploymentCandidate() : await this.customCandidate(input);
+        const { target } = candidate;
+        const resolveStarted = Date.now();
+        const hostNotFound = await this.resolveHost(target.host, { automatic });
+        const hostFailure = (message) => ({
+            success: false,
+            latencyMs: Date.now() - resolveStarted,
+            error: message,
+        });
+        const reader = candidate.readerProblem
+            ? failure(candidate.readerProblem)
+            : hostNotFound
+                ? hostFailure(hostNotFound)
+                : await this.probe('reader', target, candidate.readerUser, candidate.readerPassword, 'SELECT version()');
+        let admin;
+        if (candidate.adminUser === null) {
+            admin = { skipped: true };
+        }
+        else {
+            admin = candidate.adminProblem
+                ? failure(candidate.adminProblem)
+                : hostNotFound
+                    ? hostFailure(hostNotFound)
+                    : await this.probe('admin', target, candidate.adminUser, candidate.adminPassword, `SHOW CREATE DATABASE ${(0, greptime_client_1.quoteIdent)(target.database)}`);
+        }
+        this.logger.log(`Telemetry connection test by user ${userId} (host=${target.host} hostMode=${automatic ? 'auto' : 'custom'}): ` +
+            `reader=${reader.success ? 'ok' : 'failed'} ` +
+            `admin=${'skipped' in admin ? 'skipped' : admin.success ? 'ok' : 'failed'}`);
+        return { host: target.host, hostMode: automatic ? 'auto' : 'custom', reader, admin };
+    }
+    /** Builds a client. A seam for tests; production code never overrides it. */
+    createClient(config) {
+        return new pg_1.Client(config);
+    }
+    /**
+     * `null` when `host` resolves (or the check is inconclusive), else why it
+     * does not. A seam for tests; production code never overrides it.
+     */
+    resolveHost(host, options) {
+        return (0, greptime_host_1.checkHostResolves)(host, undefined, undefined, options);
+    }
+    // ---------------------------------------------------------------------------
+    /**
+     * AUTOMATIC (issue #570): the GreptimeDB deployed with this application, with
+     * the deployment's host, port, database, logins and passwords — whatever the
+     * request carried. An administrator never supplies them, so a guess typed
+     * into the form can neither be tested here nor mask a working deployment.
+     */
+    deploymentCandidate() {
+        const deployment = this.connection.describeDeployment();
+        const readerPassword = this.connection.deploymentPassword('reader');
+        const adminPassword = this.connection.deploymentPassword('admin');
+        return {
+            target: { host: deployment.host, automatic: true, pgPort: deployment.pgPort, database: deployment.database },
+            readerUser: deployment.readerUser,
+            readerPassword,
+            readerProblem: deployment.readerUser && readerPassword ? null : telemetry_connection_service_1.DEPLOYMENT_READER_MISSING_MESSAGE,
+            // No admin user at all: nothing to check, as for a custom candidate
+            // with `adminUser: null`. A user without its password is a gap.
+            adminUser: deployment.adminUser,
+            adminPassword,
+            adminProblem: adminPassword ? null : telemetry_connection_service_1.DEPLOYMENT_ADMIN_MISSING_MESSAGE,
+        };
+    }
+    /** CUSTOM: the submitted connection; a blank password is the one in force. */
+    async customCandidate(input) {
+        const readerPassword = await this.passwordFor('reader', input.readerPassword);
+        const adminUser = input.adminUser ?? null;
+        const adminPassword = adminUser === null ? null : await this.passwordFor('admin', input.adminPassword);
+        return {
+            target: { host: input.host, automatic: false, pgPort: input.pgPort, database: input.database },
+            // The schema requires readerUser for a custom host.
+            readerUser: input.readerUser ?? '',
+            readerPassword,
+            readerProblem: readerPassword ? null : missingPasswordMessage('reader'),
+            adminUser,
+            adminPassword,
+            adminProblem: adminPassword ? null : missingPasswordMessage('admin'),
+        };
+    }
+    async passwordFor(role, supplied) {
+        if (!(0, blank_secret_1.isBlankSecret)(supplied))
+            return supplied;
+        return this.connection.currentPassword(role);
+    }
+    async probe(role, target, user, password, sql) {
+        const started = Date.now();
+        const client = this.createClient({
+            host: target.host,
+            port: target.pgPort,
+            database: target.database,
+            user,
+            password,
+            application_name: `api-telemetry-${role}-test`,
+            connectionTimeoutMillis: greptime_client_1.GREPTIME_CONNECT_TIMEOUT_MS,
+            query_timeout: greptime_client_1.GREPTIME_PING_TIMEOUT_MS,
+        });
+        // A socket dying after connect emits `error` on the client; unhandled,
+        // that is an uncaught exception.
+        client.on('error', () => undefined);
+        try {
+            await withTimeout(client.connect(), greptime_client_1.GREPTIME_CONNECT_TIMEOUT_MS, 'Connecting to GreptimeDB timed out');
+            const result = await withTimeout(client.query({ text: sql, rowMode: 'array' }), greptime_client_1.GREPTIME_PING_TIMEOUT_MS, 'GreptimeDB did not answer in time');
+            const first = result.rows?.[0]?.[0];
+            return {
+                success: true,
+                latencyMs: Date.now() - started,
+                ...(role === 'reader' && typeof first === 'string' ? { version: first } : {}),
+            };
+        }
+        catch (error) {
+            const message = (0, greptime_host_1.isDnsError)(error)
+                ? (0, greptime_host_1.hostNotFoundMessage)(target.host, error, { automatic: target.automatic })
+                : error instanceof Error
+                    ? error.message
+                    : String(error);
+            return {
+                success: false,
+                latencyMs: Date.now() - started,
+                error: mask(message, password),
+            };
+        }
+        finally {
+            await withTimeout(client.end(), PROBE_END_GRACE_MS, 'end').catch(() => undefined);
+        }
+    }
+};
+exports.TelemetryConnectionTestService = TelemetryConnectionTestService;
+exports.TelemetryConnectionTestService = TelemetryConnectionTestService = TelemetryConnectionTestService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [telemetry_connection_service_1.TelemetryConnectionService])
+], TelemetryConnectionTestService);
+function missingPasswordMessage(role) {
+    return `No ${role} password was supplied and none is configured for the current connection.`;
+}
+function failure(error) {
+    return { success: false, latencyMs: 0, error };
+}
+function mask(message, password) {
+    return password ? message.split(password).join('••••') : message;
+}
+async function withTimeout(promise, ms, message) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(message)), ms);
+        timer.unref?.();
+    });
+    // The loser of the race must not become an unhandled rejection.
+    promise.catch(() => undefined);
+    try {
+        return await Promise.race([promise, timeout]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=telemetry-connection-test.service.js.map

package/dist/telemetry/connection/telemetry-connection-test.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-connection-test.service.js","sourceRoot":"","sources":["../../../src/telemetry/connection/telemetry-connection-test.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,2BAA+C;AAE/C,2DAAyD;AAMzD,wEAAuH;AACvH,oEAA6H;AAE7H,iFAIwC;AAyFxC,qEAAqE;AACrE,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAG1B,IAAM,8BAA8B,sCAApC,MAAM,8BAA8B;IAGZ;IAFZ,MAAM,GAAG,IAAI,eAAM,CAAC,gCAA8B,CAAC,IAAI,CAAC,CAAC;IAE1E,YAA6B,UAAsC;QAAtC,eAAU,GAAV,UAAU,CAA4B;IAAG,CAAC;IAEvE,KAAK,CAAC,IAAI,CAAC,KAAmC,EAAE,MAAc;QAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;QAClE,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC7F,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAE7B,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,CAAC,OAAe,EAA4B,EAAE,CAAC,CAAC;YAClE,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;YACtC,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa;YACpC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC;YAClC,CAAC,CAAC,YAAY;gBACZ,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC;gBAC3B,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,cAAwB,EAAE,kBAAkB,CAAC,CAAC;QAEvH,IAAI,KAA6C,CAAC;QAElD,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACjC,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,SAAS,CAAC,YAAY;gBAC5B,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC;gBACjC,CAAC,CAAC,YAAY;oBACZ,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC;oBAC3B,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd,OAAO,EACP,MAAM,EACN,SAAS,CAAC,SAAS,EACnB,SAAS,CAAC,aAAuB,EACjC,wBAAwB,IAAA,4BAAU,EAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CACtD,CAAC;QACV,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,qCAAqC,MAAM,UAAU,MAAM,CAAC,IAAI,aAAa,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK;YAC7G,UAAU,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,GAAG;YAC7C,SAAS,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAC9E,CAAC;QAEF,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACvF,CAAC;IAED,6EAA6E;IACnE,YAAY,CAAC,MAAoB;QACzC,OAAO,IAAI,WAAM,CAAC,MAAM,CAAoC,CAAC;IAC/D,CAAC;IAED;;;OAGG;IACO,WAAW,CAAC,IAAY,EAAE,OAAyB;QAC3D,OAAO,IAAA,iCAAiB,EAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,8EAA8E;IAE9E;;;;;OAKG;IACK,mBAAmB;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACxD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAElE,OAAO;YACL,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE;YAC5G,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,cAAc;YACd,aAAa,EAAE,UAAU,CAAC,UAAU,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gEAAiC;YACjG,oEAAoE;YACpE,gEAAgE;YAChE,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,aAAa;YACb,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,+DAAgC;SACtE,CAAC;IACJ,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,eAAe,CAAC,KAAmC;QAC/D,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC;QAC1C,MAAM,aAAa,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAEvG,OAAO;YACL,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAc,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;YACxG,oDAAoD;YACpD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE;YAClC,cAAc;YACd,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC;YACvE,SAAS;YACT,aAAa;YACb,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC;SACrE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAA6B,EAAE,QAA4B;QACnF,IAAI,CAAC,IAAA,4BAAa,EAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QAE9C,OAAO,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,IAA6B,EAC7B,MAAmB,EACnB,IAAY,EACZ,QAAgB,EAChB,GAAW;QAEX,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;YAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,MAAM;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI;YACJ,QAAQ;YACR,gBAAgB,EAAE,iBAAiB,IAAI,OAAO;YAC9C,uBAAuB,EAAE,6CAA2B;YACpD,aAAa,EAAE,0CAAwB;SACxC,CAAC,CAAC;QAEH,uEAAuE;QACvE,iCAAiC;QACjC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,6CAA2B,EAAE,oCAAoC,CAAC,CAAC;YAEvG,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAC7C,0CAAwB,EACxB,mCAAmC,CACpC,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAEpC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAC/B,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9E,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAA,0BAAU,EAAC,KAAK,CAAC;gBAC/B,CAAC,CAAC,IAAA,mCAAmB,EAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC1E,CAAC,CAAC,KAAK,YAAY,KAAK;oBACtB,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEpB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAC/B,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;aAC/B,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;CACF,CAAA;AAzKY,wEAA8B;yCAA9B,8BAA8B;IAD1C,IAAA,mBAAU,GAAE;qCAI8B,yDAA0B;GAHxD,8BAA8B,CAyK1C;AAED,SAAS,sBAAsB,CAAC,IAA6B;IAC3D,OAAO,MAAM,IAAI,2EAA2E,CAAC;AAC/F,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,IAAI,CAAC,OAAe,EAAE,QAAgB;IAC7C,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,WAAW,CAAI,OAAmB,EAAE,EAAU,EAAE,OAAe;IAC5E,IAAI,KAAiC,CAAC;IAEtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC/C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,gEAAgE;IAChE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE/B,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC"}

package/dist/telemetry/connection/telemetry-connection.controller.d.ts

@@ -0,0 +1,14 @@
+import { Type } from '@nestjs/common';
+import type { ResolvedTelemetryModuleOptions } from '../telemetry.options';
+/**
+ * Creates the `TelemetryConnectionController` class for one set of module options: its routes
+ * guarded by the app's access decorators (`options.host.access`), the caller
+ * resolved by `options.actorId`. `TelemetryModule.forRoot()` calls it.
+ *
+ * @param options - the resolved module options.
+ * @returns the controller class.
+ *
+ * @stability experimental
+ */
+export declare function createTelemetryConnectionController(options: ResolvedTelemetryModuleOptions): Type<unknown>;
+//# sourceMappingURL=telemetry-connection.controller.d.ts.map

package/dist/telemetry/connection/telemetry-connection.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-connection.controller.d.ts","sourceRoot":"","sources":["../../../src/telemetry/connection/telemetry-connection.controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmF,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAYvH,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAsB3E;;;;;;;;;GASG;AACH,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,8BAA8B,GAAG,IAAI,CAAC,OAAO,CAAC,CAoH1G"}

package/dist/telemetry/connection/telemetry-connection.controller.js

@@ -0,0 +1,192 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTelemetryConnectionController = createTelemetryConnectionController;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const index_1 = require("../../core/index");
+const telemetry_connection_dto_1 = require("./dto/telemetry-connection.dto");
+const telemetry_connection_admin_service_1 = require("./telemetry-connection-admin.service");
+const telemetry_connection_test_service_1 = require("./telemetry-connection-test.service");
+const telemetry_permissions_1 = require("../telemetry.permissions");
+// =============================================================================
+// TelemetryConnectionController (issue #558, epic #528)
+// =============================================================================
+//
+//   GET    /api/admin/telemetry/connection        telemetry:read
+//   PUT    /api/admin/telemetry/connection        telemetry:write  (If-Match optional → 409)
+//   DELETE /api/admin/telemetry/connection        telemetry:write  (If-Match optional → 409)
+//   POST   /api/admin/telemetry/connection/test   telemetry:write  (always 200)
+//
+// The same permission strings as the rest of the telemetry admin surface, so
+// the one `telemetry` settings card covers it (CLAUDE.md, Settings UI Pattern
+// rule 3).
+// =============================================================================
+const IF_MATCH_DESCRIPTION = 'Expected `version` of the stored connection, for optimistic concurrency (`0` asserts ' +
+    'nothing is stored). Omit to write unconditionally. The connection has its own version ' +
+    'counter, so a concurrent save of an unrelated setting cannot conflict with it.';
+/**
+ * Creates the `TelemetryConnectionController` class for one set of module options: its routes
+ * guarded by the app's access decorators (`options.host.access`), the caller
+ * resolved by `options.actorId`. `TelemetryModule.forRoot()` calls it.
+ *
+ * @param options - the resolved module options.
+ * @returns the controller class.
+ *
+ * @stability experimental
+ */
+function createTelemetryConnectionController(options) {
+    const access = options.host.access;
+    const ActorId = options.actorIdParam;
+    let TelemetryConnectionController = class TelemetryConnectionController {
+        admin;
+        tester;
+        constructor(admin, tester) {
+            this.admin = admin;
+            this.tester = tester;
+        }
+        async getConnection() {
+            return this.admin.describeForAdmin();
+        }
+        async replaceConnection(dto, userId, ifMatch) {
+            return this.admin.replace(dto, userId, parseIfMatch(ifMatch));
+        }
+        async resetConnection(userId, ifMatch) {
+            return this.admin.reset(userId, parseIfMatch(ifMatch));
+        }
+        async testConnection(dto, userId) {
+            return this.tester.test(dto, userId);
+        }
+    };
+    __decorate([
+        (0, common_1.Get)(),
+        (access.requirePermissions([telemetry_permissions_1.TELEMETRY_PERMISSIONS.READ])),
+        (0, swagger_1.ApiOperation)({
+            summary: 'Get the telemetry store connection (Admin only)',
+            description: 'The GreptimeDB connection in force and where it comes from: `source` is `stored` ' +
+                '(saved on this page), `environment` (nothing saved: the GreptimeDB deployed with this ' +
+                'application) or `none`.\n\n' +
+                'The host mode decides who owns the whole connection. **Automatic** (`hostMode: auto`, ' +
+                '`host: null`) is the GreptimeDB deployed with this application: its host, port, database, ' +
+                'logins and passwords all come from the deployment, and `deploymentManaged` is true — ' +
+                'there are no credentials to enter. **Custom** (`hostMode: custom`, `host` a literal, ' +
+                '`source: stored`) is used wholly as saved, passwords from the credential store. ' +
+                '`effectiveHost` is the host actually used.\n\n' +
+                '`deployment` describes the GreptimeDB deployed with this application (host, port, ' +
+                'database, users, and whether it provisions a reader and an admin login) whatever is in ' +
+                'force; `problem` says, in administrator language, why a deployment-managed connection ' +
+                'cannot be used (null otherwise).\n\n' +
+                '**Passwords are never returned.** `credentials.reader` / `credentials.admin` say ' +
+                'whether each password is present, with a masked `hint` only for a custom connection\'s ' +
+                'stored password.',
+        }),
+        (0, swagger_1.ApiResponse)({ status: 200, description: 'The telemetry store connection', type: telemetry_connection_dto_1.TelemetryConnectionResponseDto }),
+        __metadata("design:type", Function),
+        __metadata("design:paramtypes", []),
+        __metadata("design:returntype", Promise)
+    ], TelemetryConnectionController.prototype, "getConnection", null);
+    __decorate([
+        (0, common_1.Put)(),
+        (access.requirePermissions([telemetry_permissions_1.TELEMETRY_PERMISSIONS.WRITE])),
+        (0, swagger_1.ApiOperation)({
+            summary: 'Save the telemetry store connection (Admin only)',
+            description: 'Saves the GreptimeDB connection. It takes effect on this instance immediately and on ' +
+                'every other one within five seconds — no restart.\n\n' +
+                '**Automatic** — `host` omitted, null or blank: the GreptimeDB deployed with this ' +
+                'application. Only that choice is stored; the host, port, database, logins and passwords ' +
+                'all come from the deployment. Every other field is accepted and **ignored**, and any ' +
+                'stored reader/admin password is deleted. Nothing is required.\n\n' +
+                '**Custom** — a literal `host`: used wholly as saved. `readerUser` and `adminUser` (null ' +
+                'for none) are required; `pgPort` and `database` default to `4003` and `public`. ' +
+                '`readerPassword` / `adminPassword` are **write-only**: omit them or send them empty to ' +
+                'keep the stored ones. A save with no stored password to keep is a 400 — the ' +
+                'deployment\'s password is never copied into the store. `adminUser: null` removes the ' +
+                'admin login and its stored password (retention is then not applied).\n\n' +
+                'Every save re-applies the export gate and queues a `telemetry.retention.apply` job.',
+        }),
+        (0, swagger_1.ApiHeader)({ name: 'If-Match', description: IF_MATCH_DESCRIPTION, required: false }),
+        (0, swagger_1.ApiResponse)({ status: 200, description: 'The saved connection', type: telemetry_connection_dto_1.TelemetryConnectionResponseDto }),
+        (0, swagger_1.ApiResponse)({
+            status: 400,
+            description: 'Validation error, or (custom host) a required user or password is missing',
+            type: index_1.ErrorDto,
+        }),
+        (0, swagger_1.ApiResponse)({ status: 409, description: 'Version conflict', type: index_1.ErrorDto }),
+        __param(0, (0, common_1.Body)()),
+        __param(1, ActorId()),
+        __param(2, (0, common_1.Headers)('if-match')),
+        __metadata("design:type", Function),
+        __metadata("design:paramtypes", [telemetry_connection_dto_1.UpdateTelemetryConnectionDto, String, String]),
+        __metadata("design:returntype", Promise)
+    ], TelemetryConnectionController.prototype, "replaceConnection", null);
+    __decorate([
+        (0, common_1.Delete)(),
+        (access.requirePermissions([telemetry_permissions_1.TELEMETRY_PERMISSIONS.WRITE])),
+        (0, swagger_1.ApiOperation)({
+            summary: 'Reset the telemetry store connection (Admin only)',
+            description: 'Deletes the stored connection and both stored passwords, so the `GREPTIME_*` deployment ' +
+                'default applies again (or no connection, when the deployment has none). Takes effect ' +
+                'like a save: immediately here, within five seconds everywhere else.',
+        }),
+        (0, swagger_1.ApiHeader)({ name: 'If-Match', description: IF_MATCH_DESCRIPTION, required: false }),
+        (0, swagger_1.ApiResponse)({ status: 200, description: 'The connection now in force', type: telemetry_connection_dto_1.TelemetryConnectionResponseDto }),
+        (0, swagger_1.ApiResponse)({ status: 409, description: 'Version conflict', type: index_1.ErrorDto }),
+        __param(0, ActorId()),
+        __param(1, (0, common_1.Headers)('if-match')),
+        __metadata("design:type", Function),
+        __metadata("design:paramtypes", [String, String]),
+        __metadata("design:returntype", Promise)
+    ], TelemetryConnectionController.prototype, "resetConnection", null);
+    __decorate([
+        (0, common_1.Post)('test'),
+        (access.requirePermissions([telemetry_permissions_1.TELEMETRY_PERMISSIONS.WRITE])),
+        (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+        (0, swagger_1.ApiOperation)({
+            summary: 'Test a telemetry store connection (Admin only)',
+            description: 'Checks the connection **in the request body**, which does not have to have been saved: ' +
+                'the reader runs `SELECT version()`, the admin (when there is an admin user) runs ' +
+                '`SHOW CREATE DATABASE <database>`.\n\n' +
+                'A blank host is **automatic**: the GreptimeDB deployed with this application is probed ' +
+                'with the deployment\'s own port, database, logins and passwords — any submitted ones are ' +
+                'ignored — and a login the deployment does not provide is reported in the probe\'s ' +
+                '`error`. For a **custom** host the body is probed as sent, and a blank password means ' +
+                'the one the connection in force uses for that login. The host actually probed is ' +
+                'returned as `host`, with `hostMode`.\n\n' +
+                '**Always 200** — read `reader.success` and `admin.success` (or `admin.skipped`). Each ' +
+                'check is bounded to five seconds to connect and five to answer.',
+        }),
+        (0, swagger_1.ApiResponse)({ status: 200, description: 'The outcome of each check', type: telemetry_connection_dto_1.TelemetryConnectionTestResultDto }),
+        (0, swagger_1.ApiResponse)({ status: 400, description: 'Validation error', type: index_1.ErrorDto }),
+        __param(0, (0, common_1.Body)()),
+        __param(1, ActorId()),
+        __metadata("design:type", Function),
+        __metadata("design:paramtypes", [telemetry_connection_dto_1.TestTelemetryConnectionDto, String]),
+        __metadata("design:returntype", Promise)
+    ], TelemetryConnectionController.prototype, "testConnection", null);
+    TelemetryConnectionController = __decorate([
+        (0, swagger_1.ApiTags)('Telemetry'),
+        (0, common_1.Controller)('admin/telemetry/connection'),
+        __param(0, (0, common_1.Inject)(telemetry_connection_admin_service_1.TelemetryConnectionAdminService)),
+        __param(1, (0, common_1.Inject)(telemetry_connection_test_service_1.TelemetryConnectionTestService)),
+        __metadata("design:paramtypes", [telemetry_connection_admin_service_1.TelemetryConnectionAdminService,
+            telemetry_connection_test_service_1.TelemetryConnectionTestService])
+    ], TelemetryConnectionController);
+    return TelemetryConnectionController;
+}
+/** An unparseable `If-Match` is treated as absent, exactly as the other admin controllers do. */
+function parseIfMatch(ifMatch) {
+    const parsed = ifMatch !== undefined ? Number.parseInt(ifMatch, 10) : NaN;
+    return Number.isInteger(parsed) ? parsed : undefined;
+}
+//# sourceMappingURL=telemetry-connection.controller.js.map

package/dist/telemetry/connection/telemetry-connection.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-connection.controller.js","sourceRoot":"","sources":["../../../src/telemetry/connection/telemetry-connection.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AA4CA,kFAoHC;AAhKD,2CAAuH;AACvH,6CAAgF;AAEhF,4CAA4C;AAC5C,6EAKwC;AACxC,6FAAuF;AACvF,2FAAqF;AAErF,oEAAiE;AAEjE,gFAAgF;AAChF,wDAAwD;AACxD,gFAAgF;AAChF,EAAE;AACF,iEAAiE;AACjE,6FAA6F;AAC7F,6FAA6F;AAC7F,gFAAgF;AAChF,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,WAAW;AACX,gFAAgF;AAEhF,MAAM,oBAAoB,GACxB,uFAAuF;IACvF,wFAAwF;IACxF,gFAAgF,CAAC;AAEnF;;;;;;;;;GASG;AACH,SAAgB,mCAAmC,CAAC,OAAuC;IACzF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC;IAErC,IAEM,6BAA6B,GAFnC,MAEM,6BAA6B;QAE2B;QACD;QAF3D,YAC4D,KAAsC,EACvC,MAAsC;YADrC,UAAK,GAAL,KAAK,CAAiC;YACvC,WAAM,GAAN,MAAM,CAAgC;QAC9F,CAAC;QAyBE,AAAN,KAAK,CAAC,aAAa;YACjB,OAAO,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACvC,CAAC;QA6BK,AAAN,KAAK,CAAC,iBAAiB,CACb,GAAiC,EAC9B,MAAc,EACJ,OAAgB;YAErC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,CAAC;QAcK,AAAN,KAAK,CAAC,eAAe,CAAY,MAAc,EAAuB,OAAgB;YACpF,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,CAAC;QAsBK,AAAN,KAAK,CAAC,cAAc,CAAS,GAA+B,EAAa,MAAc;YACrF,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;KACF,CAAA;IA9EO;QAvBL,IAAA,YAAG,GAAE;QACL,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,6CAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,IAAA,sBAAY,EAAC;YACZ,OAAO,EAAE,iDAAiD;YAC1D,WAAW,EACT,mFAAmF;gBACnF,wFAAwF;gBACxF,6BAA6B;gBAC7B,wFAAwF;gBACxF,4FAA4F;gBAC5F,uFAAuF;gBACvF,uFAAuF;gBACvF,kFAAkF;gBAClF,gDAAgD;gBAChD,oFAAoF;gBACpF,yFAAyF;gBACzF,wFAAwF;gBACxF,sCAAsC;gBACtC,mFAAmF;gBACnF,yFAAyF;gBACzF,kBAAkB;SACrB,CAAC;QACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,yDAA8B,EAAE,CAAC;;;;sEAGjH;IA6BK;QA3BL,IAAA,YAAG,GAAE;QACL,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,6CAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAA,sBAAY,EAAC;YACZ,OAAO,EAAE,kDAAkD;YAC3D,WAAW,EACT,uFAAuF;gBACvF,uDAAuD;gBACvD,mFAAmF;gBACnF,0FAA0F;gBAC1F,uFAAuF;gBACvF,mEAAmE;gBACnE,0FAA0F;gBAC1F,kFAAkF;gBAClF,yFAAyF;gBACzF,8EAA8E;gBAC9E,uFAAuF;gBACvF,0EAA0E;gBAC1E,qFAAqF;SACxF,CAAC;QACD,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACnF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,sBAAsB,EAAE,IAAI,EAAE,yDAA8B,EAAE,CAAC;QACvG,IAAA,qBAAW,EAAC;YACX,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,2EAA2E;YACxF,IAAI,EAAE,gBAAQ;SACf,CAAC;QACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,gBAAQ,EAAE,CAAC;QAE3E,WAAA,IAAA,aAAI,GAAE,CAAA;QACN,WAAA,OAAO,EAAE,CAAA;QACT,WAAA,IAAA,gBAAO,EAAC,UAAU,CAAC,CAAA;;yCAFP,uDAA4B;;0EAK1C;IAcK;QAZL,IAAA,eAAM,GAAE;QACR,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,6CAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAA,sBAAY,EAAC;YACZ,OAAO,EAAE,mDAAmD;YAC5D,WAAW,EACT,0FAA0F;gBAC1F,uFAAuF;gBACvF,qEAAqE;SACxE,CAAC;QACD,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACnF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,6BAA6B,EAAE,IAAI,EAAE,yDAA8B,EAAE,CAAC;QAC9G,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,gBAAQ,EAAE,CAAC;QACvD,WAAA,OAAO,EAAE,CAAA;QAAkB,WAAA,IAAA,gBAAO,EAAC,UAAU,CAAC,CAAA;;;;wEAEpE;IAsBK;QApBL,IAAA,aAAI,EAAC,MAAM,CAAC;QACZ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,6CAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;QACvB,IAAA,sBAAY,EAAC;YACZ,OAAO,EAAE,gDAAgD;YACzD,WAAW,EACT,yFAAyF;gBACzF,mFAAmF;gBACnF,wCAAwC;gBACxC,yFAAyF;gBACzF,2FAA2F;gBAC3F,oFAAoF;gBACpF,wFAAwF;gBACxF,mFAAmF;gBACnF,0CAA0C;gBAC1C,wFAAwF;gBACxF,iEAAiE;SACpE,CAAC;QACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,2DAAgC,EAAE,CAAC;QAC9G,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,gBAAQ,EAAE,CAAC;QACxD,WAAA,IAAA,aAAI,GAAE,CAAA;QAAmC,WAAA,OAAO,EAAE,CAAA;;yCAAtC,qDAA0B;;uEAE3D;IA1GG,6BAA6B;QAFlC,IAAA,iBAAO,EAAC,WAAW,CAAC;QACpB,IAAA,mBAAU,EAAC,4BAA4B,CAAC;QAGpC,WAAA,IAAA,eAAM,EAAC,oEAA+B,CAAC,CAAA;QACvC,WAAA,IAAA,eAAM,EAAC,kEAA8B,CAAC,CAAA;yCAD0B,oEAA+B;YAC/B,kEAA8B;OAH7F,6BAA6B,CA2GlC;IAED,OAAO,6BAA6B,CAAC;AACvC,CAAC;AAED,iGAAiG;AACjG,SAAS,YAAY,CAAC,OAA2B;IAC/C,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAE1E,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC"}

package/dist/telemetry/connection/telemetry-connection.schema.d.ts

@@ -0,0 +1,34 @@
+/** The `system_settings.key` the stored connection lives under. */
+export declare const TELEMETRY_CONNECTION_SETTINGS_KEY = "telemetry_connection";
+/**
+ * The host GreptimeDB answers on in every supported deployment: the Docker
+ * Compose service name `greptimedb`, on the API's network, in both
+ * `infra/compose/telemetry.compose.yml` and `vps.telemetry.compose.yml` (and
+ * `.env.example` ships `GREPTIME_HOST=greptimedb`). It is the last resort of
+ * the DEPLOYMENT HOST (`GREPTIME_HOST` when set and non-blank, else this), which
+ * a stored connection with an AUTOMATIC host (`host: null`, issue #562)
+ * resolves to at refresh time, so it follows the deployment instead of freezing
+ * a literal an operator never chose.
+ */
+export declare const TELEMETRY_DEFAULT_HOST = "greptimedb";
+/** GreptimeDB's Postgres-wire default port, and its default database (`TELEMETRY_CONNECTION_DEFAULTS` in the contract). */
+export declare const TELEMETRY_DEFAULT_PG_PORT: 4003;
+export declare const TELEMETRY_DEFAULT_DATABASE: "public";
+/** The deployment host: `GREPTIME_HOST` when set and non-blank, else `TELEMETRY_DEFAULT_HOST`. */
+export declare function telemetryDeploymentHost(environmentHost: string | null | undefined): string;
+/**
+ * Credential-store purpose (and cipher sub-key domain) of the two passwords.
+ * Permanent: renaming it strands both stored passwords. The app declares it in
+ * the credential purpose registry (`registerCredentialPurpose`, #735).
+ *
+ * @stability stable
+ */
+export declare const TELEMETRY_GREPTIME_CREDENTIAL_PURPOSE = "telemetry_greptime";
+/** The two logins the API uses. Also the credential names inside the purpose. */
+export declare const TELEMETRY_CONNECTION_ROLES: readonly ["reader", "admin"];
+export type TelemetryConnectionRole = (typeof TELEMETRY_CONNECTION_ROLES)[number];
+/** Admin-UI labels written alongside each credential. Non-secret. */
+export declare const TELEMETRY_GREPTIME_CREDENTIAL_LABELS: Record<TelemetryConnectionRole, string>;
+export { TELEMETRY_CONNECTION_CARRIES_NO_SECRET, TELEMETRY_DATABASE_PATTERN, telemetryAutomaticConnectionValueSchema, telemetryConnectionValueSchema, telemetryCustomConnectionValueSchema, telemetryDatabaseSchema, telemetryHostSchema, telemetryOptionalHostSchema, telemetryPgPortSchema, telemetryUserSchema, } from '@marinoscar/platform-contract/telemetry';
+export type { TelemetryAutomaticConnectionValue, TelemetryConnectionCarriesNoSecret, TelemetryConnectionValue, TelemetryCustomConnectionValue, } from '@marinoscar/platform-contract/telemetry';
+//# sourceMappingURL=telemetry-connection.schema.d.ts.map

package/dist/telemetry/connection/telemetry-connection.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-connection.schema.d.ts","sourceRoot":"","sources":["../../../src/telemetry/connection/telemetry-connection.schema.ts"],"names":[],"mappings":"AAwCA,mEAAmE;AACnE,eAAO,MAAM,iCAAiC,yBAAyB,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,eAAe,CAAC;AAEnD,2HAA2H;AAC3H,eAAO,MAAM,yBAAyB,MAAuC,CAAC;AAC9E,eAAO,MAAM,0BAA0B,UAAyC,CAAC;AAEjF,kGAAkG;AAClG,wBAAgB,uBAAuB,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAE1F;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,uBAAuB,CAAC;AAE1E,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,8BAA+B,CAAC;AACvE,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAElF,qEAAqE;AACrE,eAAO,MAAM,oCAAoC,EAAE,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAGxF,CAAC;AA0BF,OAAO,EACL,sCAAsC,EACtC,0BAA0B,EAC1B,uCAAuC,EACvC,8BAA8B,EAC9B,oCAAoC,EACpC,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,yCAAyC,CAAC;AACjD,YAAY,EACV,iCAAiC,EACjC,kCAAkC,EAClC,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,yCAAyC,CAAC"}

package/dist/telemetry/connection/telemetry-connection.schema.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.telemetryUserSchema = exports.telemetryPgPortSchema = exports.telemetryOptionalHostSchema = exports.telemetryHostSchema = exports.telemetryDatabaseSchema = exports.telemetryCustomConnectionValueSchema = exports.telemetryConnectionValueSchema = exports.telemetryAutomaticConnectionValueSchema = exports.TELEMETRY_DATABASE_PATTERN = exports.TELEMETRY_CONNECTION_CARRIES_NO_SECRET = exports.TELEMETRY_GREPTIME_CREDENTIAL_LABELS = exports.TELEMETRY_CONNECTION_ROLES = exports.TELEMETRY_GREPTIME_CREDENTIAL_PURPOSE = exports.TELEMETRY_DEFAULT_DATABASE = exports.TELEMETRY_DEFAULT_PG_PORT = exports.TELEMETRY_DEFAULT_HOST = exports.TELEMETRY_CONNECTION_SETTINGS_KEY = void 0;
+exports.telemetryDeploymentHost = telemetryDeploymentHost;
+const telemetry_1 = require("@marinoscar/platform-contract/telemetry");
+// =============================================================================
+// The stored GreptimeDB connection — `system_settings.key = 'telemetry_connection'`
+// (issue #558, epic #528)
+// =============================================================================
+//
+// WHAT IS STORED, AND WHERE
+// -----------------------------------------------------------------------------
+//
+//   system_settings row 'telemetry_connection'   custom:    host, pgPort, database,
+//                                                           readerUser, adminUser
+//                                                automatic: { host: null } only — the
+//                                                           deployment supplies the rest (#570)
+//   credentials (telemetry_greptime, reader)     the reader's password (custom host only)
+//   credentials (telemetry_greptime, admin)      the admin's password  (custom host only)
+//
+// The two passwords live in the encrypted credential store and nowhere else;
+// the row carries no field able to hold one (compile-time proof below).
+//
+// WHY A ROW OF ITS OWN, NOT A NAMESPACE INSIDE 'global'. The same reason the
+// email settings have one (`email/email-settings.service.ts`): the generic
+// `PUT/PATCH /api/system-settings` owns the 'global' row, and a key it does
+// not model is either clobbered by it or carried forward with a "preserved
+// unknown key" warning on every unrelated save. A separate row cannot be
+// touched by that endpoint at all, keeps the connection out of
+// `GET /api/system-settings`, and gives `If-Match` a version counter of its
+// own, so saving an unrelated setting cannot make this form's save conflict.
+// ABSENT ROW = NOTHING STORED, which is what selects the deployment default
+// (see `TelemetryConnectionService`).
+//
+// WHAT IS DELIBERATELY NOT HERE: THE WRITER CREDENTIAL AND THE HTTP PORT.
+// `GREPTIME_WRITER_*` and `GREPTIME_HTTP_PORT` are consumed only by the OTel
+// collector (which writes telemetry over HTTP) and the GreptimeDB container
+// (which provisions its users from them). The API never writes telemetry and
+// never speaks HTTP to GreptimeDB, so it has no use for either — and storing
+// an unused write-capable secret here would widen what a compromise of the
+// API's database yields, for nothing. They stay environment-only.
+// =============================================================================
+/** The `system_settings.key` the stored connection lives under. */
+exports.TELEMETRY_CONNECTION_SETTINGS_KEY = 'telemetry_connection';
+/**
+ * The host GreptimeDB answers on in every supported deployment: the Docker
+ * Compose service name `greptimedb`, on the API's network, in both
+ * `infra/compose/telemetry.compose.yml` and `vps.telemetry.compose.yml` (and
+ * `.env.example` ships `GREPTIME_HOST=greptimedb`). It is the last resort of
+ * the DEPLOYMENT HOST (`GREPTIME_HOST` when set and non-blank, else this), which
+ * a stored connection with an AUTOMATIC host (`host: null`, issue #562)
+ * resolves to at refresh time, so it follows the deployment instead of freezing
+ * a literal an operator never chose.
+ */
+exports.TELEMETRY_DEFAULT_HOST = 'greptimedb';
+/** GreptimeDB's Postgres-wire default port, and its default database (`TELEMETRY_CONNECTION_DEFAULTS` in the contract). */
+exports.TELEMETRY_DEFAULT_PG_PORT = telemetry_1.TELEMETRY_CONNECTION_DEFAULTS.pgPort;
+exports.TELEMETRY_DEFAULT_DATABASE = telemetry_1.TELEMETRY_CONNECTION_DEFAULTS.database;
+/** The deployment host: `GREPTIME_HOST` when set and non-blank, else `TELEMETRY_DEFAULT_HOST`. */
+function telemetryDeploymentHost(environmentHost) {
+    return environmentHost?.trim() || exports.TELEMETRY_DEFAULT_HOST;
+}
+/**
+ * Credential-store purpose (and cipher sub-key domain) of the two passwords.
+ * Permanent: renaming it strands both stored passwords. The app declares it in
+ * the credential purpose registry (`registerCredentialPurpose`, #735).
+ *
+ * @stability stable
+ */
+exports.TELEMETRY_GREPTIME_CREDENTIAL_PURPOSE = 'telemetry_greptime';
+/** The two logins the API uses. Also the credential names inside the purpose. */
+exports.TELEMETRY_CONNECTION_ROLES = ['reader', 'admin'];
+/** Admin-UI labels written alongside each credential. Non-secret. */
+exports.TELEMETRY_GREPTIME_CREDENTIAL_LABELS = {
+    reader: 'GreptimeDB read-only login (telemetry explorer, status)',
+    admin: 'GreptimeDB admin login (telemetry retention)',
+};
+// -----------------------------------------------------------------------------
+// The stored value and its field validators
+// -----------------------------------------------------------------------------
+//
+// The value schemas (`telemetryConnectionValueSchema` and its custom/automatic
+// halves), the host, port, database and user validators and the compile-time
+// proof that the stored row carries no secret
+// (`TELEMETRY_CONNECTION_CARRIES_NO_SECRET`) live in
+// `@marinoscar/platform-contract/telemetry` (#702): the admin form validates
+// with the same rules. The host rule there reproduces `net.isIP` without Node
+// (`telemetry-connection.schema.spec.ts` compares the two).
+//
+// The database name is held to a plain identifier because the retention job
+// interpolates it UNQUOTED into `ALTER DATABASE` (GreptimeDB resolves a quoted
+// name literally there) and refuses anything else — see `PLAIN_IDENTIFIER` in
+// `handlers/telemetry-retention.handler.ts`. Accepting more would save a
+// connection whose retention can never be applied.
+//
+// Adding a `readerPassword` (or any secret-like name) to the value schemas
+// makes the proof resolve to `never` and the contract stops compiling. The
+// passwords belong in `CredentialsService` under
+// `TELEMETRY_GREPTIME_CREDENTIAL_PURPOSE`, never in a row whose value the
+// audit trail copies.
+var telemetry_2 = require("@marinoscar/platform-contract/telemetry");
+Object.defineProperty(exports, "TELEMETRY_CONNECTION_CARRIES_NO_SECRET", { enumerable: true, get: function () { return telemetry_2.TELEMETRY_CONNECTION_CARRIES_NO_SECRET; } });
+Object.defineProperty(exports, "TELEMETRY_DATABASE_PATTERN", { enumerable: true, get: function () { return telemetry_2.TELEMETRY_DATABASE_PATTERN; } });
+Object.defineProperty(exports, "telemetryAutomaticConnectionValueSchema", { enumerable: true, get: function () { return telemetry_2.telemetryAutomaticConnectionValueSchema; } });
+Object.defineProperty(exports, "telemetryConnectionValueSchema", { enumerable: true, get: function () { return telemetry_2.telemetryConnectionValueSchema; } });
+Object.defineProperty(exports, "telemetryCustomConnectionValueSchema", { enumerable: true, get: function () { return telemetry_2.telemetryCustomConnectionValueSchema; } });
+Object.defineProperty(exports, "telemetryDatabaseSchema", { enumerable: true, get: function () { return telemetry_2.telemetryDatabaseSchema; } });
+Object.defineProperty(exports, "telemetryHostSchema", { enumerable: true, get: function () { return telemetry_2.telemetryHostSchema; } });
+Object.defineProperty(exports, "telemetryOptionalHostSchema", { enumerable: true, get: function () { return telemetry_2.telemetryOptionalHostSchema; } });
+Object.defineProperty(exports, "telemetryPgPortSchema", { enumerable: true, get: function () { return telemetry_2.telemetryPgPortSchema; } });
+Object.defineProperty(exports, "telemetryUserSchema", { enumerable: true, get: function () { return telemetry_2.telemetryUserSchema; } });
+//# sourceMappingURL=telemetry-connection.schema.js.map

package/dist/telemetry/connection/telemetry-connection.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-connection.schema.js","sourceRoot":"","sources":["../../../src/telemetry/connection/telemetry-connection.schema.ts"],"names":[],"mappings":";;;AA4DA,0DAEC;AA9DD,uEAAwF;AAExF,gFAAgF;AAChF,oFAAoF;AACpF,0BAA0B;AAC1B,gFAAgF;AAChF,EAAE;AACF,4BAA4B;AAC5B,gFAAgF;AAChF,EAAE;AACF,oFAAoF;AACpF,kFAAkF;AAClF,sFAAsF;AACtF,gGAAgG;AAChG,0FAA0F;AAC1F,0FAA0F;AAC1F,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,yEAAyE;AACzE,+DAA+D;AAC/D,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,sCAAsC;AACtC,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,kEAAkE;AAClE,gFAAgF;AAEhF,mEAAmE;AACtD,QAAA,iCAAiC,GAAG,sBAAsB,CAAC;AAExE;;;;;;;;;GASG;AACU,QAAA,sBAAsB,GAAG,YAAY,CAAC;AAEnD,2HAA2H;AAC9G,QAAA,yBAAyB,GAAG,yCAA6B,CAAC,MAAM,CAAC;AACjE,QAAA,0BAA0B,GAAG,yCAA6B,CAAC,QAAQ,CAAC;AAEjF,kGAAkG;AAClG,SAAgB,uBAAuB,CAAC,eAA0C;IAChF,OAAO,eAAe,EAAE,IAAI,EAAE,IAAI,8BAAsB,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACU,QAAA,qCAAqC,GAAG,oBAAoB,CAAC;AAE1E,iFAAiF;AACpE,QAAA,0BAA0B,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAU,CAAC;AAGvE,qEAAqE;AACxD,QAAA,oCAAoC,GAA4C;IAC3F,MAAM,EAAE,yDAAyD;IACjE,KAAK,EAAE,8CAA8C;CACtD,CAAC;AAEF,gFAAgF;AAChF,4CAA4C;AAC5C,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,8CAA8C;AAC9C,qDAAqD;AACrD,6EAA6E;AAC7E,8EAA8E;AAC9E,4DAA4D;AAC5D,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,yEAAyE;AACzE,mDAAmD;AACnD,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,iDAAiD;AACjD,0EAA0E;AAC1E,sBAAsB;AAEtB,qEAWiD;AAV/C,mIAAA,sCAAsC,OAAA;AACtC,uHAAA,0BAA0B,OAAA;AAC1B,oIAAA,uCAAuC,OAAA;AACvC,2HAAA,8BAA8B,OAAA;AAC9B,iIAAA,oCAAoC,OAAA;AACpC,oHAAA,uBAAuB,OAAA;AACvB,gHAAA,mBAAmB,OAAA;AACnB,wHAAA,2BAA2B,OAAA;AAC3B,kHAAA,qBAAqB,OAAA;AACrB,gHAAA,mBAAmB,OAAA"}