@obsunified/collector 2.0.1 → 2.2.0

package/src/plugins/onboarding-routes.test.ts

@@ -0,0 +1,105 @@
+import type { StoredSpan } from "@obsunified/types";
+import type { MiddlewareHandler } from "hono";
+import { describe, expect, it } from "vitest";
+import { createTelemetryCollectorApp } from "../framework/collector";
+import type { CollectorEnv } from "../framework/env";
+import { ingestTelemetrySpans } from "../lib/store/ingest";
+import { createMigratedSqliteDb } from "../lib/test-utils/node-sqlite-db";
+import { onboardingRoutesPlugin } from "./onboarding-routes";
+
+const NOW = new Date().toISOString();
+const LATER = new Date(Date.now() + 3_600_000).toISOString();
+
+const span = (
+	projectId: string,
+	spanId: string,
+	interactionId: string | null,
+) =>
+	({
+		projectId,
+		traceId: `trace-${projectId}`,
+		spanId,
+		parentSpanId: null,
+		traceState: null,
+		serviceName: "web",
+		scopeName: null,
+		scopeVersion: null,
+		spanName: "GET /",
+		spanKind: 2,
+		statusCode: 1,
+		statusMessage: null,
+		startTime: NOW,
+		endTime: NOW,
+		durationMs: 1,
+		attributesJson: "{}",
+		droppedAttributesCount: 0,
+		resourceAttributesJson: "{}",
+		eventsJson: "[]",
+		droppedEventsCount: 0,
+		linksJson: "[]",
+		droppedLinksCount: 0,
+		receivedAt: NOW,
+		expiresAt: LATER,
+		sessionId: null,
+		interactionId,
+	}) satisfies StoredSpan;
+
+describe("/internal/onboarding/counts", () => {
+	it("counts only the caller's project", async () => {
+		const db = createMigratedSqliteDb();
+		await ingestTelemetrySpans(db, [
+			span("alpha", "a1", "click-1"),
+			span("alpha", "a2", null),
+			span("beta", "b1", null),
+		]);
+		db.raw
+			.prepare(
+				`INSERT INTO user_profiles (project_id, user_id, visitor_id, first_seen_at, last_seen_at)
+				 VALUES ('beta', 'u1', 'v1', ?, ?)`,
+			)
+			.run(NOW, NOW);
+
+		const setProject: MiddlewareHandler<{
+			Bindings: CollectorEnv;
+			Variables: { projectId: string };
+		}> = async (c, next) => {
+			const header = c.req.header("x-project-id");
+			if (header) c.set("projectId", header);
+			await next();
+		};
+		const app = createTelemetryCollectorApp({
+			plugins: [onboardingRoutesPlugin],
+			dashboardAuth: { middleware: setProject, registerRoutes: () => {} },
+		});
+		const counts = async (projectId: string) => {
+			const res = await app.request(
+				"/internal/onboarding/counts",
+				{ headers: { "x-project-id": projectId } },
+				{ DB: db as unknown as D1Database } as CollectorEnv,
+			);
+			expect(res.status).toBe(200);
+			return res.json();
+		};
+
+		expect(await counts("alpha")).toMatchObject({
+			spans: 2,
+			spansWithInteraction: 1,
+			identifiedUsers: 0,
+		});
+		expect(await counts("beta")).toMatchObject({
+			spans: 1,
+			spansWithInteraction: 0,
+			identifiedUsers: 1,
+		});
+		expect(await counts("gamma")).toMatchObject({
+			spans: 0,
+			logs: 0,
+			usageEvents: 0,
+			identifiedUsers: 0,
+			aiCalls: 0,
+			replayChunks: 0,
+			spansWithInteraction: 0,
+		});
+		db.close();
+	});
+});

package/src/plugins/onboarding-routes.ts

@@ -1,5 +1,6 @@
 import type { CollectorPlugin } from "../framework/collector";
 import { sqlDbFor } from "../lib/sql-db";
+import { getProjectId } from "./_context";
 
 /**
  * Drives the in-dashboard Onboarding tab — returns counts of signal
@@ -14,17 +15,23 @@ export const onboardingRoutesPlugin: CollectorPlugin = {
 	register(app) {
 		app.get("/internal/onboarding/counts", async (c) => {
 			const db = sqlDbFor(c.env);
-			const counts = await Promise.all([
-				safeCount(db, "SELECT COUNT(*) AS n FROM telemetry_spans"),
-				safeCount(db, "SELECT COUNT(*) AS n FROM logs"),
-				safeCount(db, "SELECT COUNT(*) AS n FROM usage_events"),
-				safeCount(db, "SELECT COUNT(*) AS n FROM user_profiles"),
-				safeCount(db, "SELECT COUNT(*) AS n FROM ai_calls"),
-				safeCount(db, "SELECT COUNT(*) AS n FROM session_replay_metadata"),
+			// Every signal table is project-scoped; counting across tenants
+			// would leak other projects' volumes and hide an empty project.
+			const projectId = getProjectId(c);
+			const count = (table: string, extra = "") =>
 				safeCount(
 					db,
-					"SELECT COUNT(*) AS n FROM telemetry_spans WHERE interaction_id IS NOT NULL",
-				),
+					`SELECT COUNT(*) AS n FROM ${table} WHERE project_id = ?${extra}`,
+					projectId,
+				);
+			const counts = await Promise.all([
+				count("telemetry_spans"),
+				count("logs"),
+				count("usage_events"),
+				count("user_profiles"),
+				count("ai_calls"),
+				count("session_replay_metadata"),
+				count("telemetry_spans", " AND interaction_id IS NOT NULL"),
 			]);
 
 			return c.json({
@@ -41,11 +48,19 @@ export const onboardingRoutesPlugin: CollectorPlugin = {
 };
 
 async function safeCount(
-	db: { prepare: (sql: string) => { first: <T>() => Promise<T | null> } },
+	db: {
+		prepare: (sql: string) => {
+			bind: (...args: unknown[]) => { first: <T>() => Promise<T | null> };
+		};
+	},
 	sql: string,
+	...binds: unknown[]
 ): Promise<number> {
 	try {
-		const row = await db.prepare(sql).first<{ n: number }>();
+		const row = await db
+			.prepare(sql)
+			.bind(...binds)
+			.first<{ n: number }>();
 		return Number(row?.n ?? 0);
 	} catch {
 		// Table doesn't exist yet — fresh DB, no signals of this type.

package/src/plugins/projects-routes.ts

@@ -81,9 +81,10 @@ export const projectsRoutesPlugin: CollectorPlugin = {
 		});
 
 		app.delete("/internal/projects/:id/keys/:keyId", async (c) => {
+			const projectId = c.req.param("id");
 			const keyId = c.req.param("keyId");
 			const store = new ProjectsStore(sqlDbFor(c.env));
-			const revoked = await store.revokeKey(keyId);
+			const revoked = await store.revokeKey(keyId, projectId);
 			if (!revoked)
 				return c.json({ error: "Key not found or already revoked" }, 404);
 			return c.json({ success: true });