@obsunified/collector 2.0.1 → 2.1.1

package/src/plugins/dashboard-routes.test.ts

@@ -0,0 +1,120 @@
+/**
+ * Dashboard auth used to guard `/dashboard/login` itself, and the SPA
+ * fallback redirected `/dashboard/*` to `/dashboard/` — which it also
+ * matched. A browser hitting `/` on a collector without an assets binding
+ * bounced forever. These tests follow the redirect chain by hand.
+ */
+
+import { describe, expect, it } from "vitest";
+import { createDashboardAuth } from "../auth/dashboard-auth";
+import {
+	createTelemetryCollectorApp,
+	isDashboardLoginPath,
+} from "../framework/collector";
+import type { CollectorEnv } from "../framework/env";
+import { MemSqlDb } from "../lib/test-utils/mem-sql-db";
+import { dashboardRoutesPlugin } from "./dashboard-routes";
+
+const HTML = { Accept: "text/html,application/xhtml+xml" };
+
+const makeApp = (auth: Parameters<typeof createDashboardAuth>[0]) =>
+	createTelemetryCollectorApp({
+		plugins: [dashboardRoutesPlugin],
+		dashboardAuth: createDashboardAuth(auth),
+	});
+
+const env = (extra: Record<string, unknown> = {}) =>
+	({ DB: new MemSqlDb(), ...extra }) as unknown as CollectorEnv;
+
+/** Follow same-origin redirects; returns every path visited plus the final response. */
+const follow = async (
+	app: ReturnType<typeof makeApp>,
+	path: string,
+	headers: Record<string, string>,
+	maxHops = 6,
+) => {
+	const visited: string[] = [];
+	let current = path;
+	for (let hop = 0; hop < maxHops; hop += 1) {
+		visited.push(current);
+		const res = await app.request(current, { headers }, env());
+		const location = res.headers.get("Location");
+		if (res.status < 300 || res.status >= 400 || !location) {
+			return { visited, res };
+		}
+		current = location;
+	}
+	throw new Error(`redirect loop: ${visited.join(" -> ")}`);
+};
+
+describe("dashboard routes + auth", () => {
+	it("isDashboardLoginPath matches the login page and its sub-routes only", () => {
+		expect(isDashboardLoginPath("/dashboard/login")).toBe(true);
+		expect(isDashboardLoginPath("/dashboard/login/")).toBe(true);
+		expect(isDashboardLoginPath("/dashboard/login/forgot")).toBe(true);
+		expect(isDashboardLoginPath("/dashboard/loginx")).toBe(false);
+		expect(isDashboardLoginPath("/dashboard/")).toBe(false);
+		expect(isDashboardLoginPath("/internal/login")).toBe(false);
+	});
+
+	it("an unauthenticated browser at / reaches the login page without looping", async () => {
+		const app = makeApp({ password: "pw" });
+		const { visited, res } = await follow(app, "/", HTML);
+		expect(visited).toEqual(["/", "/dashboard/", "/dashboard/login"]);
+		// No assets binding: the login page cannot be served here, but the
+		// chain must end instead of bouncing back to /dashboard/.
+		expect(res.status).toBe(404);
+		expect(res.headers.get("Location")).toBeNull();
+		await expect(res.json()).resolves.toMatchObject({
+			error: expect.stringContaining("Dashboard assets are not configured"),
+		});
+	});
+
+	it("still redirects unauthenticated HTML requests for other dashboard pages to login", async () => {
+		const app = makeApp({ password: "pw" });
+		const res = await app.request(
+			"/dashboard/traces",
+			{ headers: HTML },
+			env(),
+		);
+		expect(res.status).toBe(302);
+		expect(res.headers.get("Location")).toBe("/dashboard/login");
+	});
+
+	it("does not redirect /dashboard/login to itself", async () => {
+		const app = makeApp({ password: "pw" });
+		const res = await app.request("/dashboard/login", { headers: HTML }, env());
+		expect(res.status).toBe(404);
+		expect(res.headers.get("Location")).toBeNull();
+	});
+
+	it("an authenticated request without assets does not loop on /dashboard/", async () => {
+		const app = makeApp({ token: "tok" });
+		const headers = { ...HTML, Authorization: "Bearer tok" };
+		const { visited, res } = await follow(app, "/", headers);
+		expect(visited).toEqual(["/", "/dashboard/"]);
+		expect(res.status).toBe(404);
+	});
+
+	it("serves the SPA entrypoint from the assets binding for deep links", async () => {
+		const app = makeApp({ token: "tok" });
+		const fetched: string[] = [];
+		const assets = {
+			fetch: async (req: Request) => {
+				fetched.push(new URL(req.url).pathname);
+				return new Response("<html>spa</html>", {
+					status: 200,
+					headers: { "content-type": "text/html" },
+				});
+			},
+		};
+		const res = await app.request(
+			"/dashboard/traces/abc",
+			{ headers: { ...HTML, Authorization: "Bearer tok" } },
+			env({ ASSETS: assets }),
+		);
+		expect(res.status).toBe(200);
+		expect(await res.text()).toBe("<html>spa</html>");
+		expect(fetched).toEqual(["/dashboard/"]);
+	});
+});

package/src/plugins/dashboard-routes.ts

@@ -29,8 +29,17 @@ export const dashboardRoutesPlugin: CollectorPlugin = {
 				url.pathname = "/dashboard/";
 				return assets.fetch(new Request(url.toString(), c.req.raw));
 			}
-			// Fallback: redirects to SPA root
-			return c.redirect("/dashboard/");
+			// No assets binding: there is nothing to serve. Redirecting to
+			// `/dashboard/` here would match this same route and loop forever
+			// (and bounce unauthenticated browsers between `/dashboard/` and
+			// `/dashboard/login` endlessly).
+			return c.json(
+				{
+					error:
+						"Dashboard assets are not configured on this collector. Serve @obsunified/dashboard separately or bind [assets] in wrangler.toml.",
+				},
+				404,
+			);
 		});
 
 		// Root redirect: visiting the collector root goes to dashboard

package/src/plugins/eval-cases-routes.ts

@@ -19,6 +19,7 @@ import { sourceLinkEvidenceReferences } from "../lib/evidence-references";
 import { randomHex } from "../lib/hash";
 import { sqlDbFor } from "../lib/sql-db";
 import { getProjectId } from "./_context";
+import { readJsonObject } from "./_json";
 
 interface EvalCaseRequestBody {
 	sourceEntityType?: unknown;
@@ -123,12 +124,8 @@ export const evalCasesRoutesPlugin: CollectorPlugin = {
 	name: "eval-cases-routes",
 	register(app) {
 		app.post("/internal/eval-cases", async (c) => {
-			let body: EvalCaseRequestBody;
-			try {
-				body = (await c.req.json()) as EvalCaseRequestBody;
-			} catch {
-				return c.json(badRequest("body must be JSON"), 400);
-			}
+			const body = await readJsonObject<EvalCaseRequestBody>(c);
+			if (!body) return c.json(badRequest("body must be a JSON object"), 400);
 
 			const sourceType = body.sourceEntityType ?? body.source?.type;
 			if (!isEvalCaseSourceType(sourceType)) {
@@ -236,12 +233,8 @@ export const evalCasesRoutesPlugin: CollectorPlugin = {
 		});
 
 		app.post("/internal/eval-runs", async (c) => {
-			let body: EvalRunRequestBody;
-			try {
-				body = (await c.req.json()) as EvalRunRequestBody;
-			} catch {
-				return c.json(badRequest("body must be JSON"), 400);
-			}
+			const body = await readJsonObject<EvalRunRequestBody>(c);
+			if (!body) return c.json(badRequest("body must be a JSON object"), 400);
 
 			const id = asOptionalString(body.id ?? body.runId)?.trim();
 			if ((body.id ?? body.runId) !== undefined && !id) {
@@ -378,11 +371,9 @@ export const evalCasesRoutesPlugin: CollectorPlugin = {
 				actualOutcome?: unknown;
 				details?: unknown;
 			};
-			try {
-				body = (await c.req.json()) as typeof body;
-			} catch {
-				return c.json(badRequest("body must be JSON"), 400);
-			}
+			const parsed = await readJsonObject<typeof body>(c);
+			if (!parsed) return c.json(badRequest("body must be a JSON object"), 400);
+			body = parsed;
 
 			if (body.passed === undefined || typeof body.passed !== "boolean") {
 				return c.json(badRequest("passed must be a boolean"), 400);

package/src/plugins/identity-receiver.ts

@@ -2,18 +2,15 @@ import type { IdentifyInput } from "@obsunified/types";
 import type { CollectorPlugin } from "../framework/collector";
 import { dialectFor, sqlDbFor } from "../lib/sql-db";
 import { getProjectId } from "./_context";
+import { readJsonObject } from "./_json";
 
 export const identityReceiverPlugin: CollectorPlugin = {
 	name: "identity-receiver",
 	register(app) {
 		app.post("/v1/identify", async (c) => {
 			const projectId = getProjectId(c);
-			let payload: IdentifyInput;
-			try {
-				payload = await c.req.json<IdentifyInput>();
-			} catch {
-				return c.json({ error: "Invalid JSON body" }, 400);
-			}
+			const payload = await readJsonObject<IdentifyInput>(c);
+			if (!payload) return c.json({ error: "Invalid JSON body" }, 400);
 			if (!payload.userId || typeof payload.userId !== "string") {
 				return c.json({ error: "userId is required" }, 400);
 			}
@@ -51,10 +48,11 @@ export const identityReceiverPlugin: CollectorPlugin = {
 				? JSON.stringify(payload.properties)
 				: null;
 
-			// user_id is the PK today (single-tenant legacy). For MVP, we keep
-			// that contract — user_id is treated as globally unique and the
-			// first project to identify them "owns" the profile. project_id on
-			// the row reflects where the user was first seen.
+			// Profiles are keyed by (project_id, user_id) — migration 045.
+			// user_id values are caller-chosen (often an email), so two
+			// projects identifying the same id must get two independent rows;
+			// an ingest key for one project can never read or rewrite another
+			// project's profile through this endpoint.
 			//
 			// On conflict we keep the EARLIEST first_seen_at via MIN() — once
 			// observed, a user's first-seen is monotonic; an identify() call
@@ -69,7 +67,7 @@ export const identityReceiverPlugin: CollectorPlugin = {
 				.prepare(
 					`INSERT INTO user_profiles (project_id, user_id, visitor_id, email, name, properties_json, first_seen_at, last_seen_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-         ON CONFLICT(user_id) DO UPDATE SET
+         ON CONFLICT(project_id, user_id) DO UPDATE SET
            visitor_id = excluded.visitor_id,
            email = COALESCE(excluded.email, user_profiles.email),
            name = COALESCE(excluded.name, user_profiles.name),

package/src/plugins/json-body.test.ts

@@ -0,0 +1,91 @@
+/**
+ * `c.req.json()` resolves `null`, arrays and primitives for bodies such as
+ * `null` or `"x"`. Every JSON ingest and admin route used to dereference the
+ * result straight away and answer 500. They must all answer 400 now, and the
+ * replay receiver must reject a chunk before writing it to blob storage.
+ */
+
+import type { MiddlewareHandler } from "hono";
+import { describe, expect, it } from "vitest";
+import { createTelemetryCollectorApp } from "../framework/collector";
+import type { CollectorEnv } from "../framework/env";
+import { MemSqlDb } from "../lib/test-utils/mem-sql-db";
+import { aiReceiverPlugin } from "./ai-receiver";
+import { askRoutesPlugin } from "./ask-routes";
+import { evalCasesRoutesPlugin } from "./eval-cases-routes";
+import { identityReceiverPlugin } from "./identity-receiver";
+import { replayReceiverPlugin } from "./replay-receiver";
+import { usageReceiverPlugin } from "./usage-receiver";
+
+const passthrough: MiddlewareHandler<{
+	Bindings: CollectorEnv;
+	Variables: { projectId: string };
+}> = async (c, next) => {
+	c.set("projectId", "default");
+	await next();
+};
+
+const app = createTelemetryCollectorApp({
+	plugins: [
+		aiReceiverPlugin,
+		usageReceiverPlugin,
+		replayReceiverPlugin,
+		identityReceiverPlugin,
+		askRoutesPlugin,
+		evalCasesRoutesPlugin,
+	],
+	auth: { middleware: passthrough },
+	dashboardAuth: { middleware: passthrough, registerRoutes: () => {} },
+});
+
+const ROUTES = [
+	"/v1/ai",
+	"/v1/ai/evaluations",
+	"/v1/usage",
+	"/v1/replays",
+	"/v1/identify",
+	"/internal/ask",
+	"/internal/eval-cases",
+	"/internal/eval-runs",
+	"/internal/eval-cases/case-1/results",
+];
+
+const NON_OBJECT_BODIES = ["null", "[]", '"text"', "42", "true"];
+
+const post = (path: string, body: string, env: Partial<CollectorEnv> = {}) =>
+	app.request(
+		path,
+		{ method: "POST", headers: { "content-type": "application/json" }, body },
+		{ DB: new MemSqlDb() as unknown as D1Database, ...env } as CollectorEnv,
+	);
+
+describe("JSON body validation", () => {
+	for (const path of ROUTES) {
+		it(`${path} answers 400 for non-object JSON bodies`, async () => {
+			for (const body of NON_OBJECT_BODIES) {
+				const res = await post(path, body);
+				expect(res.status, `${path} <- ${body}`).toBe(400);
+				const json = (await res.json()) as { error?: string };
+				expect(typeof json.error, `${path} <- ${body}`).toBe("string");
+			}
+			const malformed = await post(path, "{not json");
+			expect(malformed.status, `${path} <- malformed`).toBe(400);
+		});
+	}
+
+	it("/v1/replays rejects a chunk without visitorId before touching blob storage", async () => {
+		const puts: string[] = [];
+		const bucket = {
+			put: async (key: string) => {
+				puts.push(key);
+			},
+		};
+		const res = await post(
+			"/v1/replays",
+			JSON.stringify({ sessionId: "sess-1", sequenceNumber: 0, events: [] }),
+			{ REPLAYS_BUCKET: bucket as unknown as R2Bucket },
+		);
+		expect(res.status).toBe(400);
+		expect(puts).toEqual([]);
+	});
+});

package/src/plugins/onboarding-routes.test.ts

@@ -0,0 +1,105 @@
+import type { StoredSpan } from "@obsunified/types";
+import type { MiddlewareHandler } from "hono";
+import { describe, expect, it } from "vitest";
+import { createTelemetryCollectorApp } from "../framework/collector";
+import type { CollectorEnv } from "../framework/env";
+import { ingestTelemetrySpans } from "../lib/store/ingest";
+import { createMigratedSqliteDb } from "../lib/test-utils/node-sqlite-db";
+import { onboardingRoutesPlugin } from "./onboarding-routes";
+
+const NOW = new Date().toISOString();
+const LATER = new Date(Date.now() + 3_600_000).toISOString();
+
+const span = (
+	projectId: string,
+	spanId: string,
+	interactionId: string | null,
+) =>
+	({
+		projectId,
+		traceId: `trace-${projectId}`,
+		spanId,
+		parentSpanId: null,
+		traceState: null,
+		serviceName: "web",
+		scopeName: null,
+		scopeVersion: null,
+		spanName: "GET /",
+		spanKind: 2,
+		statusCode: 1,
+		statusMessage: null,
+		startTime: NOW,
+		endTime: NOW,
+		durationMs: 1,
+		attributesJson: "{}",
+		droppedAttributesCount: 0,
+		resourceAttributesJson: "{}",
+		eventsJson: "[]",
+		droppedEventsCount: 0,
+		linksJson: "[]",
+		droppedLinksCount: 0,
+		receivedAt: NOW,
+		expiresAt: LATER,
+		sessionId: null,
+		interactionId,
+	}) satisfies StoredSpan;
+
+describe("/internal/onboarding/counts", () => {
+	it("counts only the caller's project", async () => {
+		const db = createMigratedSqliteDb();
+		await ingestTelemetrySpans(db, [
+			span("alpha", "a1", "click-1"),
+			span("alpha", "a2", null),
+			span("beta", "b1", null),
+		]);
+		db.raw
+			.prepare(
+				`INSERT INTO user_profiles (project_id, user_id, visitor_id, first_seen_at, last_seen_at)
+				 VALUES ('beta', 'u1', 'v1', ?, ?)`,
+			)
+			.run(NOW, NOW);
+
+		const setProject: MiddlewareHandler<{
+			Bindings: CollectorEnv;
+			Variables: { projectId: string };
+		}> = async (c, next) => {
+			const header = c.req.header("x-project-id");
+			if (header) c.set("projectId", header);
+			await next();
+		};
+		const app = createTelemetryCollectorApp({
+			plugins: [onboardingRoutesPlugin],
+			dashboardAuth: { middleware: setProject, registerRoutes: () => {} },
+		});
+		const counts = async (projectId: string) => {
+			const res = await app.request(
+				"/internal/onboarding/counts",
+				{ headers: { "x-project-id": projectId } },
+				{ DB: db as unknown as D1Database } as CollectorEnv,
+			);
+			expect(res.status).toBe(200);
+			return res.json();
+		};
+
+		expect(await counts("alpha")).toMatchObject({
+			spans: 2,
+			spansWithInteraction: 1,
+			identifiedUsers: 0,
+		});
+		expect(await counts("beta")).toMatchObject({
+			spans: 1,
+			spansWithInteraction: 0,
+			identifiedUsers: 1,
+		});
+		expect(await counts("gamma")).toMatchObject({
+			spans: 0,
+			logs: 0,
+			usageEvents: 0,
+			identifiedUsers: 0,
+			aiCalls: 0,
+			replayChunks: 0,
+			spansWithInteraction: 0,
+		});
+		db.close();
+	});
+});

package/src/plugins/onboarding-routes.ts

@@ -1,5 +1,6 @@
 import type { CollectorPlugin } from "../framework/collector";
 import { sqlDbFor } from "../lib/sql-db";
+import { getProjectId } from "./_context";
 
 /**
  * Drives the in-dashboard Onboarding tab — returns counts of signal
@@ -14,17 +15,23 @@ export const onboardingRoutesPlugin: CollectorPlugin = {
 	register(app) {
 		app.get("/internal/onboarding/counts", async (c) => {
 			const db = sqlDbFor(c.env);
-			const counts = await Promise.all([
-				safeCount(db, "SELECT COUNT(*) AS n FROM telemetry_spans"),
-				safeCount(db, "SELECT COUNT(*) AS n FROM logs"),
-				safeCount(db, "SELECT COUNT(*) AS n FROM usage_events"),
-				safeCount(db, "SELECT COUNT(*) AS n FROM user_profiles"),
-				safeCount(db, "SELECT COUNT(*) AS n FROM ai_calls"),
-				safeCount(db, "SELECT COUNT(*) AS n FROM session_replay_metadata"),
+			// Every signal table is project-scoped; counting across tenants
+			// would leak other projects' volumes and hide an empty project.
+			const projectId = getProjectId(c);
+			const count = (table: string, extra = "") =>
 				safeCount(
 					db,
-					"SELECT COUNT(*) AS n FROM telemetry_spans WHERE interaction_id IS NOT NULL",
-				),
+					`SELECT COUNT(*) AS n FROM ${table} WHERE project_id = ?${extra}`,
+					projectId,
+				);
+			const counts = await Promise.all([
+				count("telemetry_spans"),
+				count("logs"),
+				count("usage_events"),
+				count("user_profiles"),
+				count("ai_calls"),
+				count("session_replay_metadata"),
+				count("telemetry_spans", " AND interaction_id IS NOT NULL"),
 			]);
 
 			return c.json({
@@ -41,11 +48,19 @@ export const onboardingRoutesPlugin: CollectorPlugin = {
 };
 
 async function safeCount(
-	db: { prepare: (sql: string) => { first: <T>() => Promise<T | null> } },
+	db: {
+		prepare: (sql: string) => {
+			bind: (...args: unknown[]) => { first: <T>() => Promise<T | null> };
+		};
+	},
 	sql: string,
+	...binds: unknown[]
 ): Promise<number> {
 	try {
-		const row = await db.prepare(sql).first<{ n: number }>();
+		const row = await db
+			.prepare(sql)
+			.bind(...binds)
+			.first<{ n: number }>();
 		return Number(row?.n ?? 0);
 	} catch {
 		// Table doesn't exist yet — fresh DB, no signals of this type.

package/src/plugins/projects-routes.ts

@@ -81,9 +81,10 @@ export const projectsRoutesPlugin: CollectorPlugin = {
 		});
 
 		app.delete("/internal/projects/:id/keys/:keyId", async (c) => {
+			const projectId = c.req.param("id");
 			const keyId = c.req.param("keyId");
 			const store = new ProjectsStore(sqlDbFor(c.env));
-			const revoked = await store.revokeKey(keyId);
+			const revoked = await store.revokeKey(keyId, projectId);
 			if (!revoked)
 				return c.json({ error: "Key not found or already revoked" }, 404);
 			return c.json({ success: true });