@obsunified/collector 2.0.1 → 2.2.0

package/src/otlp/decode/body.ts

@@ -1,5 +1,10 @@
 import type { JsonValue } from "@bufbuild/protobuf";
 import type { Context } from "hono";
+import {
+	DEFAULT_MAX_BODY_BYTES,
+	DEFAULT_MAX_DECOMPRESSED_BYTES,
+	parseByteLimit,
+} from "../../framework/limits";
 
 export type OtlpWireFormat = "json" | "protobuf";
 
@@ -11,25 +16,50 @@ export interface ReadBodyResult {
 export class OtlpDecodeError extends Error {
 	constructor(
 		message: string,
-		public readonly status: 400 | 415,
+		public readonly status: 400 | 413 | 415,
 	) {
 		super(message);
 	}
 }
 
+export interface ReadBodyLimits {
+	/** Raw (compressed) body cap; defaults to `MAX_BODY_BYTES` / 10 MiB. */
+	maxBodyBytes?: number;
+	/** Gunzipped payload cap; defaults to 32 MiB. */
+	maxDecompressedBytes?: number;
+}
+
 /**
  * Reads and decompresses an OTLP request body, returning the raw bytes plus
  * the inferred wire format. Throws `OtlpDecodeError` for unsupported content-
- * types or malformed gzip.
+ * types, malformed gzip, or bodies over the raw / decompressed caps (413).
+ * The framework's body-limit middleware normally refuses oversized raw
+ * bodies first; the raw check here keeps the reader safe on its own, and
+ * the decompressed cap is what stops a gzip bomb.
  */
-export const readOtlpBody = async (c: Context): Promise<ReadBodyResult> => {
+export const readOtlpBody = async (
+	c: Context,
+	limits: ReadBodyLimits = {},
+): Promise<ReadBodyResult> => {
 	const contentType = (c.req.header("content-type") ?? "").toLowerCase();
 	const wireFormat = detectWireFormat(contentType);
+	const env = (c.env ?? {}) as { MAX_BODY_BYTES?: string };
+	const maxBodyBytes =
+		limits.maxBodyBytes ??
+		parseByteLimit(env.MAX_BODY_BYTES, DEFAULT_MAX_BODY_BYTES);
+	const maxDecompressedBytes =
+		limits.maxDecompressedBytes ?? DEFAULT_MAX_DECOMPRESSED_BYTES;
 
 	let body = await c.req.arrayBuffer();
+	if (body.byteLength > maxBodyBytes) {
+		throw new OtlpDecodeError(
+			`Payload too large (max ${maxBodyBytes} bytes)`,
+			413,
+		);
+	}
 	const encoding = (c.req.header("content-encoding") ?? "").toLowerCase();
 	if (encoding === "gzip") {
-		body = await gunzip(body);
+		body = await gunzip(body, maxDecompressedBytes);
 	} else if (encoding && encoding !== "identity") {
 		throw new OtlpDecodeError(`Unsupported content-encoding: ${encoding}`, 415);
 	}
@@ -46,12 +76,43 @@ const detectWireFormat = (contentType: string): OtlpWireFormat => {
 	);
 };
 
-const gunzip = async (input: ArrayBuffer): Promise<ArrayBuffer> => {
+/** Gunzip with a hard cap on output size; stops reading once exceeded. */
+const gunzip = async (
+	input: ArrayBuffer,
+	maxBytes: number,
+): Promise<ArrayBuffer> => {
 	const stream = new Response(input).body?.pipeThrough(
 		new DecompressionStream("gzip"),
 	);
 	if (!stream) throw new OtlpDecodeError("Empty gzip body", 400);
-	return new Response(stream).arrayBuffer();
+	const reader = stream.getReader();
+	const chunks: Uint8Array[] = [];
+	let total = 0;
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			total += value.byteLength;
+			if (total > maxBytes) {
+				await reader.cancel().catch(() => {});
+				throw new OtlpDecodeError(
+					`Decompressed payload too large (max ${maxBytes} bytes)`,
+					413,
+				);
+			}
+			chunks.push(value);
+		}
+	} catch (err) {
+		if (err instanceof OtlpDecodeError) throw err;
+		throw new OtlpDecodeError("Malformed gzip body", 400);
+	}
+	const out = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		out.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return out.buffer;
 };
 
 export const decodeJsonBody = (bytes: Uint8Array): JsonValue => {

package/src/plugins/_json.ts

@@ -0,0 +1,21 @@
+/**
+ * Parse a request body that must be a JSON object. `c.req.json()` happily
+ * returns `null`, arrays and primitives for bodies like `null` or `"x"`, and
+ * the first property access in the handler then threw a TypeError that
+ * surfaced as a 500. Returns `null` for anything that is not a plain object
+ * so routes can answer 400 uniformly.
+ */
+export async function readJsonObject<T extends object>(c: {
+	req: { json(): Promise<unknown> };
+}): Promise<T | null> {
+	let parsed: unknown;
+	try {
+		parsed = await c.req.json();
+	} catch {
+		return null;
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+		return null;
+	}
+	return parsed as T;
+}

package/src/plugins/action-graph-processor.ts

@@ -907,8 +907,7 @@ export const actionGraphProcessorPlugin: CollectorPlugin = {
 							span_id, session_id, interaction_id, user_id, agent_run_id, step_id,
 							tool_call_id, prompt_version, model_name, provider, total_cost_usd, attrs_json
 						) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-						ON CONFLICT (id) DO UPDATE SET
-							project_id = excluded.project_id,
+						ON CONFLICT (project_id, id) DO UPDATE SET
 							root_action_id = excluded.root_action_id,
 							caused_by_action_id = excluded.caused_by_action_id,
 							actor_type = excluded.actor_type,
@@ -972,8 +971,7 @@ export const actionGraphProcessorPlugin: CollectorPlugin = {
 							id, project_id, agent_id, agent_name, agent_version, goal, outcome,
 							autonomy_level, status, error_message, total_cost_usd, total_duration_ms, metadata_json
 						) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-						ON CONFLICT (id) DO UPDATE SET
-							project_id = excluded.project_id,
+						ON CONFLICT (project_id, id) DO UPDATE SET
 							agent_id = excluded.agent_id,
 							agent_name = excluded.agent_name,
 							agent_version = excluded.agent_version,
@@ -1015,9 +1013,8 @@ export const actionGraphProcessorPlugin: CollectorPlugin = {
 							mcp_audit_json, mutation_before_json, mutation_after_json,
 							mutation_diff_json, mutation_artifact_id
 						) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-						ON CONFLICT (id) DO UPDATE SET
+						ON CONFLICT (project_id, id) DO UPDATE SET
 							action_id = excluded.action_id,
-							project_id = excluded.project_id,
 							tool_name = excluded.tool_name,
 							args_hash = excluded.args_hash,
 							result_hash = excluded.result_hash,
@@ -1062,9 +1059,8 @@ export const actionGraphProcessorPlugin: CollectorPlugin = {
 							id, action_id, project_id, retriever_name, query_hash, documents_json,
 							total_results, max_relevance_score, duration_ms
 						) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-						ON CONFLICT (id) DO UPDATE SET
+						ON CONFLICT (project_id, id) DO UPDATE SET
 							action_id = excluded.action_id,
-							project_id = excluded.project_id,
 							retriever_name = excluded.retriever_name,
 							query_hash = excluded.query_hash,
 							documents_json = excluded.documents_json,
@@ -1095,9 +1091,8 @@ export const actionGraphProcessorPlugin: CollectorPlugin = {
 							id, action_id, project_id, evaluator_name, evaluator_version,
 							score, passed, reasoning, rubric_json
 						) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-						ON CONFLICT (id) DO UPDATE SET
+						ON CONFLICT (project_id, id) DO UPDATE SET
 							action_id = excluded.action_id,
-							project_id = excluded.project_id,
 							evaluator_name = excluded.evaluator_name,
 							evaluator_version = excluded.evaluator_version,
 							score = excluded.score,
@@ -1128,9 +1123,8 @@ export const actionGraphProcessorPlugin: CollectorPlugin = {
 							id, action_id, project_id, artifact_name, artifact_type,
 							storage_ref, size_bytes, sha256_hash, content_preview
 						) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-						ON CONFLICT (id) DO UPDATE SET
+						ON CONFLICT (project_id, id) DO UPDATE SET
 							action_id = excluded.action_id,
-							project_id = excluded.project_id,
 							artifact_name = excluded.artifact_name,
 							artifact_type = excluded.artifact_type,
 							storage_ref = excluded.storage_ref,

package/src/plugins/ai-receiver.ts

@@ -15,18 +15,15 @@ import type { CollectorPlugin } from "../framework/collector";
 import { AIStore, type IngestEvaluation } from "../lib/ai-store";
 import { sqlDbFor } from "../lib/sql-db";
 import { getProjectId } from "./_context";
+import { readJsonObject } from "./_json";
 
 export const aiReceiverPlugin: CollectorPlugin = {
 	name: "ai-receiver",
 	register(app, _runtime) {
 		app.post("/v1/ai", async (c) => {
 			const projectId = getProjectId(c);
-			let payload: AICallPayload;
-			try {
-				payload = await c.req.json<AICallPayload>();
-			} catch {
-				return c.json({ error: "Invalid JSON body" }, 400);
-			}
+			const payload = await readJsonObject<AICallPayload>(c);
+			if (!payload) return c.json({ error: "Invalid JSON body" }, 400);
 			if (!payload.calls || !Array.isArray(payload.calls)) {
 				return c.json({ error: "Missing calls array" }, 400);
 			}
@@ -126,12 +123,8 @@ export const aiReceiverPlugin: CollectorPlugin = {
 		// one or both of score/label, and optional explanation + metadata.
 		app.post("/v1/ai/evaluations", async (c) => {
 			const projectId = getProjectId(c);
-			let payload: AIEvaluationPayload;
-			try {
-				payload = await c.req.json<AIEvaluationPayload>();
-			} catch {
-				return c.json({ error: "Invalid JSON body" }, 400);
-			}
+			const payload = await readJsonObject<AIEvaluationPayload>(c);
+			if (!payload) return c.json({ error: "Invalid JSON body" }, 400);
 			if (!payload.evaluations || !Array.isArray(payload.evaluations)) {
 				return c.json({ error: "Missing evaluations array" }, 400);
 			}

package/src/plugins/ai-span-payloads-processor.ts

@@ -130,8 +130,7 @@ export const aiSpanPayloadsProcessorPlugin: CollectorPlugin = {
 								input_json, output_json, input_hash, output_hash, session_id, user_id,
 								received_at, expires_at, interaction_id, action_id
 							) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-							ON CONFLICT(trace_id, span_id) DO UPDATE SET
-								project_id = excluded.project_id,
+							ON CONFLICT(project_id, trace_id, span_id) DO UPDATE SET
 								span_kind = excluded.span_kind,
 								input_json = excluded.input_json,
 								output_json = excluded.output_json,

package/src/plugins/alerts-evaluator-retention.test.ts

@@ -0,0 +1,170 @@
+/**
+ * Regression for the alert notification retry: the "still owed" decision
+ * lives on `alert_state.notified` (migration 049), not in alert_evaluations,
+ * which housekeeping purges after 720 hours. A long-lived firing rule whose
+ * evaluation history has been purged must not be re-notified every tick.
+ * Runs the real AlertsStore against the migrated SQLite schema; only the
+ * signal query and `fetch` are substituted.
+ */
+
+import type { AlertRule } from "@obsunified/types";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { AlertsStore } from "../lib/alerts-store";
+import {
+	ALERT_EVALUATIONS_MAX_AGE_HOURS,
+	purgeSecondaryRows,
+} from "../lib/housekeeping";
+import { ProjectsStore } from "../lib/projects-store";
+import { createMigratedSqliteDb } from "../lib/test-utils/node-sqlite-db";
+import { evaluateRuleBatch } from "./alerts-evaluator";
+
+type EvaluatorStore = Parameters<typeof evaluateRuleBatch>[0];
+
+const logger = { debug() {}, info() {}, warn() {}, error() {} };
+const HOUR = 3_600_000;
+
+/** Real store for state and evaluations; the signal value is injected. */
+const evaluatorOver = (
+	store: AlertsStore,
+	value: () => number,
+): EvaluatorStore => ({
+	listEnabledRules: () => store.listEnabledRules(),
+	evaluateRule: async () => value(),
+	getState: (id, project) => store.getState(id, project),
+	getAnalysisNarrative: (project, analysis) =>
+		store.getAnalysisNarrative(project, analysis),
+	transitionState: (id, project, next, now) =>
+		store.transitionState(id, project, next, now),
+	markNotified: (id, project, state, since) =>
+		store.markNotified(id, project, state, since),
+	recordEvaluation: (id, project, v, state, notified) =>
+		store.recordEvaluation(id, project, v, state, notified),
+});
+
+const setup = async () => {
+	const db = createMigratedSqliteDb();
+	const project = await new ProjectsStore(db).createProject({
+		name: "A",
+		slug: "a",
+	});
+	const store = new AlertsStore(db);
+	const rule = await store.createRule(project.id, {
+		name: "errors",
+		signal: "spans",
+		query: {},
+		threshold: 10,
+		windowMins: 5,
+		comparison: ">",
+		channels: [{ type: "webhook", url: "https://hooks.example.com/alert/x" }],
+		enabled: true,
+	});
+	const evaluations = () =>
+		db.count("alert_evaluations", "rule_id = ?", rule.id);
+	return { db, project, store, rule, evaluations };
+};
+
+const purgeAllEvaluations = async (
+	db: ReturnType<typeof createMigratedSqliteDb>,
+) =>
+	purgeSecondaryRows(db, {
+		retentionHours: 72,
+		now: () => Date.now() + (ALERT_EVALUATIONS_MAX_AGE_HOURS + 1) * HOUR,
+	});
+
+describe("alert notification retry survives evaluation retention", () => {
+	afterEach(() => {
+		vi.unstubAllGlobals();
+	});
+
+	it("does not re-send a delivered firing notification after its evaluations are purged", async () => {
+		const fetchMock = vi.fn(async () => new Response(null, { status: 200 }));
+		vi.stubGlobal("fetch", fetchMock);
+		const { db, project, store, rule, evaluations } = await setup();
+		const evaluator = evaluatorOver(store, () => 42);
+		const rules: AlertRule[] = [rule];
+
+		// Breach: state recorded, webhook accepted, flag set.
+		expect(await evaluateRuleBatch(evaluator, rules, { logger })).toEqual({
+			evaluated: 1,
+			fired: 1,
+			resolved: 0,
+			redelivered: 0,
+		});
+		expect(await store.getState(rule.id, project.id)).toMatchObject({
+			current_state: "firing",
+			notified: 1,
+		});
+		expect(fetchMock).toHaveBeenCalledTimes(1);
+
+		// Still breaching for longer than evaluation retention: history goes.
+		await evaluateRuleBatch(evaluator, rules, { logger });
+		expect(await evaluations()).toBe(2);
+		const purged = await purgeAllEvaluations(db);
+		expect(purged.alert_evaluations).toBe(2);
+		expect(await evaluations()).toBe(0);
+
+		// The flag on the state row is the source of truth: no resend.
+		for (let tick = 0; tick < 3; tick += 1) {
+			expect(await evaluateRuleBatch(evaluator, rules, { logger })).toEqual({
+				evaluated: 1,
+				fired: 0,
+				resolved: 0,
+				redelivered: 0,
+			});
+		}
+		expect(fetchMock).toHaveBeenCalledTimes(1);
+		expect(await store.getState(rule.id, project.id)).toMatchObject({
+			current_state: "firing",
+			notified: 1,
+		});
+	});
+
+	it("keeps retrying an undelivered notification across the purge until a channel accepts it", async () => {
+		const statuses = [503, 503, 200];
+		const fetchMock = vi.fn(
+			async () => new Response(null, { status: statuses.shift() ?? 200 }),
+		);
+		vi.stubGlobal("fetch", fetchMock);
+		const { db, project, store, rule } = await setup();
+		const evaluator = evaluatorOver(store, () => 42);
+		const rules: AlertRule[] = [rule];
+
+		await evaluateRuleBatch(evaluator, rules, { logger }); // 503
+		expect(await store.getState(rule.id, project.id)).toMatchObject({
+			current_state: "firing",
+			notified: 0,
+		});
+		await purgeAllEvaluations(db);
+
+		await evaluateRuleBatch(evaluator, rules, { logger }); // 503 again
+		expect(await evaluateRuleBatch(evaluator, rules, { logger })).toEqual({
+			evaluated: 1,
+			fired: 0,
+			resolved: 0,
+			redelivered: 1,
+		}); // 200
+		expect(fetchMock).toHaveBeenCalledTimes(3);
+		expect((await store.getState(rule.id, project.id))?.notified).toBe(1);
+
+		await evaluateRuleBatch(evaluator, rules, { logger });
+		expect(fetchMock).toHaveBeenCalledTimes(3);
+	});
+
+	it("listRules and getRule still expose the current state for the dashboard", async () => {
+		vi.stubGlobal(
+			"fetch",
+			vi.fn(async () => new Response(null, { status: 500 })),
+		);
+		const { project, store, rule } = await setup();
+		await evaluateRuleBatch(
+			evaluatorOver(store, () => 42),
+			[rule],
+			{ logger },
+		);
+		// Delivery failed, but the breach is visible.
+		expect((await store.getRule(rule.id, project.id))?.currentState).toBe(
+			"firing",
+		);
+		expect((await store.listRules(project.id))[0]?.currentState).toBe("firing");
+	});
+});