@obsunified/collector 2.0.1 → 2.2.0

package/src/lib/alerts-store.ts

@@ -21,6 +21,12 @@ import { EVIDENCE_REFERENCE_CONTRACT } from "@obsunified/types";
 import { alertEvidenceReferences } from "./evidence-references";
 import { randomHex } from "./hash";
 import type { SqlDb } from "./sql-db";
+import { assertSafeWebhookUrl, WebhookUrlError } from "./webhook-url";
+
+export interface AlertsStoreOptions {
+	/** Permit webhook targets on loopback / private / link-local hosts. */
+	allowPrivateWebhookTargets?: boolean;
+}
 
 const parseJsonField = <T>(value: unknown): T => {
 	if (typeof value === "string") return JSON.parse(value) as T;
@@ -79,7 +85,10 @@ export function compareValue(
 }
 
 export class AlertsStore {
-	constructor(private readonly db: SqlDb) {}
+	constructor(
+		private readonly db: SqlDb,
+		private readonly options: AlertsStoreOptions = {},
+	) {}
 
 	validateInput(input: AlertRuleInput): void {
 		if (!input.name?.trim()) throw new Error("name is required");
@@ -96,8 +105,16 @@ export class AlertsStore {
 		for (const ch of input.channels) {
 			if (ch.type !== "webhook")
 				throw new Error(`unknown channel type: ${ch.type}`);
-			if (!ch.url || !/^https?:\/\//.test(ch.url))
+			if (!ch.url || typeof ch.url !== "string")
 				throw new Error("channel.url must be http(s)://");
+			try {
+				assertSafeWebhookUrl(ch.url, {
+					allowPrivateNetworks: this.options.allowPrivateWebhookTargets,
+				});
+			} catch (err) {
+				if (err instanceof WebhookUrlError) throw new Error(err.message);
+				throw err;
+			}
 		}
 	}
 
@@ -217,18 +234,30 @@ export class AlertsStore {
 	}
 
 	async deleteRule(id: string, projectId: string): Promise<boolean> {
-		const result = await this.db
-			.prepare(`DELETE FROM alert_rules WHERE id = ? AND project_id = ?`)
+		// Only a rule the caller's project owns takes its state and
+		// evaluations with it; a miss must not touch another project's rows.
+		// Children go first because alert_state / alert_evaluations reference
+		// alert_rules(id) and SQLite enforces that on D1 and node:sqlite.
+		const owned = await this.db
+			.prepare(
+				`SELECT 1 AS ok FROM alert_rules WHERE id = ? AND project_id = ?`,
+			)
 			.bind(id, projectId)
-			.run();
-		// Also clean up state and evaluations for this rule.
+			.first<{ ok: number }>();
+		if (!owned) return false;
 		await this.db
-			.prepare(`DELETE FROM alert_state WHERE rule_id = ?`)
-			.bind(id)
+			.prepare(`DELETE FROM alert_state WHERE rule_id = ? AND project_id = ?`)
+			.bind(id, projectId)
 			.run();
 		await this.db
-			.prepare(`DELETE FROM alert_evaluations WHERE rule_id = ?`)
-			.bind(id)
+			.prepare(
+				`DELETE FROM alert_evaluations WHERE rule_id = ? AND project_id = ?`,
+			)
+			.bind(id, projectId)
+			.run();
+		const result = await this.db
+			.prepare(`DELETE FROM alert_rules WHERE id = ? AND project_id = ?`)
+			.bind(id, projectId)
 			.run();
 		return (result.meta?.changes ?? 0) > 0;
 	}
@@ -242,28 +271,85 @@ export class AlertsStore {
 
 	// ── State ──
 
-	async getState(ruleId: string): Promise<AlertStateRow | null> {
+	async getState(
+		ruleId: string,
+		projectId: string,
+	): Promise<AlertStateRow | null> {
 		const row = await this.db
-			.prepare(`SELECT * FROM alert_state WHERE rule_id = ?`)
-			.bind(ruleId)
+			.prepare(`SELECT * FROM alert_state WHERE rule_id = ? AND project_id = ?`)
+			.bind(ruleId, projectId)
 			.first<AlertStateRow>();
 		return row ?? null;
 	}
 
+	/**
+	 * Record a state transition with its notification still outstanding
+	 * (`notified = 0`); `markNotified` flips it once a channel accepts the
+	 * alert. On a database that has not applied migration 049 the column is
+	 * missing: the transition is still written (legacy statement) so alerting
+	 * keeps working through a rolling deploy, and the evaluator treats a row
+	 * without the column as delivered.
+	 */
 	async transitionState(
 		ruleId: string,
 		projectId: string,
 		newState: AlertState,
 		now: string,
 	): Promise<void> {
-		await this.db
-			.prepare(
-				`INSERT INTO alert_state (rule_id, project_id, current_state, last_state_change)
+		try {
+			await this.db
+				.prepare(
+					`INSERT INTO alert_state (rule_id, project_id, current_state, last_state_change, notified)
+         VALUES (?, ?, ?, ?, 0)
+         ON CONFLICT(rule_id) DO UPDATE SET
+           current_state = excluded.current_state,
+           last_state_change = excluded.last_state_change,
+           notified = 0`,
+				)
+				.bind(ruleId, projectId, newState, now)
+				.run();
+		} catch (err) {
+			if (!isMissingNotifiedColumn(err)) throw err;
+			await this.db
+				.prepare(
+					`INSERT INTO alert_state (rule_id, project_id, current_state, last_state_change)
          VALUES (?, ?, ?, ?)
-         ON CONFLICT(rule_id) DO UPDATE SET current_state = excluded.current_state, last_state_change = excluded.last_state_change`,
-			)
-			.bind(ruleId, projectId, newState, now)
-			.run();
+         ON CONFLICT(rule_id) DO UPDATE SET
+           current_state = excluded.current_state,
+           last_state_change = excluded.last_state_change`,
+				)
+				.bind(ruleId, projectId, newState, now)
+				.run();
+		}
+	}
+
+	/**
+	 * Mark the transition `(state, lastStateChange)` as delivered. Scoped to
+	 * the exact transition the caller notified for: if the rule changed state
+	 * again while the webhook was in flight, the newer transition keeps its
+	 * own outstanding flag. Returns false when nothing matched (stale or
+	 * already marked). On a pre-049 schema there is nothing to mark.
+	 */
+	async markNotified(
+		ruleId: string,
+		projectId: string,
+		state: AlertState,
+		lastStateChange: string,
+	): Promise<boolean> {
+		try {
+			const result = await this.db
+				.prepare(
+					`UPDATE alert_state SET notified = 1
+				 WHERE rule_id = ? AND project_id = ? AND current_state = ?
+				   AND last_state_change = ? AND notified = 0`,
+				)
+				.bind(ruleId, projectId, state, lastStateChange)
+				.run();
+			return (result.meta?.changes ?? 0) > 0;
+		} catch (err) {
+			if (isMissingNotifiedColumn(err)) return false;
+			throw err;
+		}
 	}
 
 	async recordEvaluation(
@@ -448,7 +534,9 @@ export class AlertsStore {
 			sql += ` AND model_name = ?`;
 			binds.push(q.model);
 		}
-		if (q.isError === true) sql += ` AND is_error = 1`;
+		// Bare boolean test: INTEGER 0/1 on D1, BOOLEAN on Postgres (where
+		// `is_error = 1` is a type error).
+		if (q.isError === true) sql += ` AND is_error`;
 		const row = await this.db
 			.prepare(sql)
 			.bind(...binds)
@@ -456,3 +544,16 @@ export class AlertsStore {
 		return row?.c ?? 0;
 	}
 }
+
+/**
+ * SQLite: "table alert_state has no column named notified" / "no such column:
+ * notified"; Postgres: `column "notified" of relation "alert_state" does not
+ * exist` (42703). Anything else is a real failure.
+ */
+const isMissingNotifiedColumn = (err: unknown): boolean => {
+	const message = err instanceof Error ? err.message : String(err);
+	return (
+		/notified/i.test(message) &&
+		/no such column|has no column|does not exist/i.test(message)
+	);
+};

package/src/lib/analyses-runner.test.ts

@@ -0,0 +1,75 @@
+/**
+ * `runAllDueAnalyses` used to hard-code project `default`, so analyses for
+ * every other project never refreshed and alert rules bound to them always
+ * evaluated against nothing. These tests run the orchestrator against the
+ * real migrated schema and against a database whose projects table fails.
+ */
+
+import { describe, expect, it } from "vitest";
+import type { CollectorEnv } from "../framework/env";
+import { runAllDueAnalyses } from "./analyses-runner";
+import { ProjectsStore } from "./projects-store";
+import { MemSqlDb } from "./test-utils/mem-sql-db";
+import { createMigratedSqliteDb } from "./test-utils/node-sqlite-db";
+
+const silent = { debug() {}, info() {}, warn() {}, error() {} };
+
+describe("runAllDueAnalyses", () => {
+	it("refreshes and runs analyses for every project, not just default", async () => {
+		const db = createMigratedSqliteDb();
+		const beta = await new ProjectsStore(db).createProject({
+			name: "Beta",
+			slug: "beta",
+		});
+
+		const summary = await runAllDueAnalyses({
+			env: { DB: db } as unknown as CollectorEnv,
+			retentionHours: 24,
+			logger: silent,
+		});
+
+		expect(summary.failed).toBe(0);
+		expect(summary.ran).toBeGreaterThan(0);
+		const projects = await db
+			.prepare(
+				`SELECT DISTINCT project_id FROM analysis_results ORDER BY project_id`,
+			)
+			.all<{ project_id: string }>();
+		const ids = projects.results.map((r) => r.project_id);
+		// 011 seeds `default`, 026 seeds `obs-dashboard`.
+		expect(ids).toEqual(
+			expect.arrayContaining(["default", "obs-dashboard", beta.id]),
+		);
+
+		const perProject = await db
+			.prepare(
+				`SELECT project_id, COUNT(*) AS n FROM analysis_results GROUP BY project_id`,
+			)
+			.all<{ project_id: string; n: number }>();
+		const counts = new Map(perProject.results.map((r) => [r.project_id, r.n]));
+		expect(counts.get(beta.id)).toBe(counts.get("default"));
+		db.close();
+	});
+
+	it("falls back to the default project when projects cannot be listed", async () => {
+		const db = new MemSqlDb({
+			all: (sql) => {
+				if (sql.includes("FROM projects")) throw new Error("no projects table");
+				return [];
+			},
+			first: () => null,
+		});
+
+		const summary = await runAllDueAnalyses({
+			env: { DB: db } as unknown as CollectorEnv,
+			retentionHours: 24,
+			logger: silent,
+		});
+
+		expect(summary).toMatchObject({ ran: 0, failed: 0 });
+		expect(summary.refreshed).toBeGreaterThan(0);
+		const due = db.callsMatching("FROM analysis_definitions");
+		expect(due.length).toBeGreaterThan(0);
+		expect(due.every((c) => c.binds[0] === "default")).toBe(true);
+	});
+});

package/src/lib/analyses-runner.ts

@@ -36,12 +36,14 @@ import {
 	type Logger,
 } from "../framework/logger";
 import { AnalysesStore } from "./analyses-store";
+import { openOrDeduplicateIncident } from "./autosre-remediation-gate";
 import { generateNarrative, LlmCallError, type LlmConfig } from "./llm";
 import {
 	computeSignature,
 	evaluateGate,
 	type NarrativeIntent,
 } from "./narrate-gate";
+import { ProjectsStore } from "./projects-store";
 import { type SqlDb, sqlDbFor } from "./sql-db";
 
 export interface AnalysisRunContext {
@@ -253,8 +255,10 @@ async function narratePass(
  * in-process registry (so newly-derived Tier 1 analyses become visible
  * to the dashboard within one tick), then runs whatever's due.
  *
- * Stage 1 has a single project ("default"). When a projects table is
- * available we'll iterate it here.
+ * Runs once per project in the `projects` table (falling back to the
+ * `default` project when the table is empty or unreadable), so analyses and
+ * the alert rules bound to them refresh for every tenant, not just the
+ * first one.
  */
 export async function runAllDueAnalyses(
 	ctx: {
@@ -274,7 +278,61 @@ export async function runAllDueAnalyses(
 	const logger = ctx.logger ?? consoleLogger;
 	const db = sqlDbFor(ctx.env);
 	const store = new AnalysesStore(db);
-	const projectId = "default";
+	const totals = { ran: 0, failed: 0, refreshed: 0, narrated: 0, skipped: 0 };
+	for (const projectId of await listAnalysisProjects(db, logger)) {
+		const summary = await runDueAnalysesForProject(projectId, {
+			ctx,
+			db,
+			store,
+			logger,
+		});
+		totals.ran += summary.ran;
+		totals.failed += summary.failed;
+		totals.refreshed += summary.refreshed;
+		totals.narrated += summary.narrated;
+		totals.skipped += summary.skipped ?? 0;
+	}
+	return totals;
+}
+
+/** Project ids to run analyses for; `default` when none can be listed. */
+async function listAnalysisProjects(
+	db: SqlDb,
+	logger: Logger,
+): Promise<string[]> {
+	try {
+		const ids = (await new ProjectsStore(db).listProjects())
+			.map((p) => p.id)
+			.filter((id) => typeof id === "string" && id.length > 0);
+		if (ids.length > 0) return ids;
+	} catch (error) {
+		logger.error("[analyses] failed to list projects; running default only", {
+			error: error instanceof Error ? error.message : String(error),
+		});
+	}
+	return ["default"];
+}
+
+async function runDueAnalysesForProject(
+	projectId: string,
+	deps: {
+		ctx: {
+			env: CollectorEnv;
+			retentionHours: number;
+			tracer?: ChildSpanRunner;
+		};
+		db: SqlDb;
+		store: AnalysesStore;
+		logger: Logger;
+	},
+): Promise<{
+	ran: number;
+	failed: number;
+	refreshed: number;
+	narrated: number;
+	skipped?: number;
+}> {
+	const { ctx, db, store, logger } = deps;
 	const now = Date.now();
 	const expiresAt = now + ctx.retentionHours * 3600 * 1000;
 
@@ -418,6 +476,14 @@ export async function runAllDueAnalyses(
 							if (result.narrative) narrated += 1;
 						}
 						await store.insertResult(result, expiresAt);
+						if (result.status === "critical") {
+							await openOrDeduplicateIncident(db, projectId, {
+								environment: "default",
+								targetNodeId: `analysis:${def.id}`,
+								symptomAnchorKind: "analysis",
+								symptomAnchorId: def.id,
+							}).catch(() => undefined);
+						}
 						// markRan releases the claim as a side-effect.
 						await store.markRan(projectId, def.id, result.generatedAt);
 						ran += 1;

package/src/lib/analyses-store-latest.test.ts

@@ -0,0 +1,61 @@
+import type { AnalysisResult } from "@obsunified/types";
+import { describe, expect, it } from "vitest";
+import { AnalysesStore } from "./analyses-store";
+import { createMigratedSqliteDb } from "./test-utils/node-sqlite-db";
+
+const result = (
+	analysisId: string,
+	generatedAt: string,
+	status: AnalysisResult["status"],
+): AnalysisResult => ({
+	analysisId,
+	projectId: "alpha",
+	generatedAt,
+	paramsHash: null,
+	status,
+	primaryValue: 1,
+	baselineValue: 0,
+	deltaPct: null,
+	payload: {},
+	narrative: null,
+	narrativeSignature: null,
+	durationMs: 1,
+});
+
+describe("AnalysesStore.getLatestResultsBulk", () => {
+	it("returns the newest result per analysis from a single bounded query", async () => {
+		const db = createMigratedSqliteDb();
+		const store = new AnalysesStore(db);
+		const expires = Date.now() + 3_600_000;
+		for (const [id, at, status] of [
+			["a", "2026-10-13T01:00:00.000Z", "ok"],
+			["a", "2026-10-13T03:00:00.000Z", "critical"],
+			["a", "2026-10-13T02:00:00.000Z", "warn"],
+			["b", "2026-10-13T02:30:00.000Z", "warn"],
+			["c", "2026-10-13T02:30:00.000Z", "ok"],
+		] as const) {
+			await store.insertResult(result(id, at, status), expires);
+		}
+		// Another project with the same ids must not bleed through.
+		await store.insertResult(
+			{ ...result("a", "2026-10-13T09:00:00.000Z", "ok"), projectId: "beta" },
+			expires,
+		);
+
+		const latest = await store.getLatestResultsBulk("alpha", ["a", "b", "zz"]);
+		expect([...latest.keys()].sort()).toEqual(["a", "b"]);
+		expect(latest.get("a")?.status).toBe("critical");
+		expect(latest.get("a")?.generatedAt).toBe("2026-10-13T03:00:00.000Z");
+		expect(latest.get("b")?.status).toBe("warn");
+
+		// The query itself must not return every retained row.
+		const rows = await db
+			.prepare(
+				`SELECT COUNT(*) AS n FROM analysis_results WHERE project_id = ? AND analysis_id = ?`,
+			)
+			.bind("alpha", "a")
+			.first<{ n: number }>();
+		expect(rows?.n).toBe(3);
+		db.close();
+	});
+});

package/src/lib/analyses-store.ts

@@ -293,20 +293,27 @@ export class AnalysesStore {
 			);
 		if (analysisIds.length === 0) return new Map();
 
-		// Pull a recent window of rows for the requested analyses then group by
-		// analysis_id, taking the row with the largest generated_at per group.
-		// One query, no per-analysis round-trips.
+		// One row per analysis: join against the per-analysis MAX(generated_at)
+		// so the database returns only the newest result for each id instead
+		// of every retained row (a 60 s refresh over a 72 h window is ~4k rows
+		// per analysis). Ties on generated_at are broken in JS below.
 		const placeholders = analysisIds.map(() => "?").join(", ");
 		const result = await this.db
 			.prepare(
-				`SELECT id, project_id, analysis_id, generated_at, params_hash,
-					status, primary_value, baseline_value, delta_pct, payload_json,
-					narrative, narrative_signature, duration_ms, expires_at
-				FROM analysis_results
-				WHERE project_id = ? AND analysis_id IN (${placeholders})
-				ORDER BY generated_at DESC`,
+				`SELECT r.id, r.project_id, r.analysis_id, r.generated_at, r.params_hash,
+					r.status, r.primary_value, r.baseline_value, r.delta_pct, r.payload_json,
+					r.narrative, r.narrative_signature, r.duration_ms, r.expires_at
+				FROM analysis_results r
+				JOIN (
+					SELECT analysis_id, MAX(generated_at) AS latest_at
+					FROM analysis_results
+					WHERE project_id = ? AND analysis_id IN (${placeholders})
+					GROUP BY analysis_id
+				) m ON m.analysis_id = r.analysis_id AND m.latest_at = r.generated_at
+				WHERE r.project_id = ?
+				ORDER BY r.generated_at DESC, r.id DESC`,
 			)
-			.bind(projectId, ...analysisIds)
+			.bind(projectId, ...analysisIds, projectId)
 			.all<ResultRow>();
 
 		const latest = new Map<string, AnalysisResult>();