@oneuptime/common 10.4.11 → 10.4.13

package/Server/Services/AnalyticsDatabaseService.ts

@@ -2,6 +2,7 @@ import { WorkflowHostname } from "../EnvironmentConfig";
 import ClickhouseDatabase, {
   ClickhouseAppInstance,
   ClickhouseClient,
+  ClickhouseIngestInstance,
 } from "../Infrastructure/ClickhouseDatabase";
 import ClusterKeyAuthorization from "../Middleware/ClusterKeyAuthorization";
 import CountBy from "../Types/AnalyticsDatabase/CountBy";
@@ -67,13 +68,16 @@ export default class AnalyticsDatabaseService<
 > extends BaseService {
   public modelType!: { new (): TBaseModel };
   public database!: ClickhouseDatabase;
+  public ingestDatabase!: ClickhouseDatabase;
   public model!: TBaseModel;
   public databaseClient!: ClickhouseClient | null;
+  public ingestDatabaseClient!: ClickhouseClient | null;
   public statementGenerator!: StatementGenerator<TBaseModel>;
 
   public constructor(data: {
     modelType: { new (): TBaseModel };
     database?: ClickhouseDatabase | undefined;
+    ingestDatabase?: ClickhouseDatabase | undefined;
   }) {
     super();
     this.modelType = data.modelType;
@@ -84,7 +88,14 @@ export default class AnalyticsDatabaseService<
       this.database = ClickhouseAppInstance; // default database
     }
 
+    if (data.ingestDatabase) {
+      this.ingestDatabase = data.ingestDatabase;
+    } else {
+      this.ingestDatabase = ClickhouseIngestInstance;
+    }
+
     this.databaseClient = this.database.getDataSource();
+    this.ingestDatabaseClient = this.ingestDatabase.getDataSource();
 
     this.statementGenerator = new StatementGenerator<TBaseModel>({
       modelType: this.modelType,
@@ -98,7 +109,7 @@ export default class AnalyticsDatabaseService<
       return;
     }
 
-    const client: ClickhouseClient = this.getDatabaseClient();
+    const client: ClickhouseClient = this.getIngestClient();
 
     const tableName: string = this.model.tableName;
 
@@ -1040,6 +1051,8 @@ export default class AnalyticsDatabaseService<
   public useDefaultDatabase(): void {
     this.database = ClickhouseAppInstance;
     this.databaseClient = this.database.getDataSource();
+    this.ingestDatabase = ClickhouseIngestInstance;
+    this.ingestDatabaseClient = this.ingestDatabase.getDataSource();
   }
 
   @CaptureSpan()
@@ -1100,6 +1113,25 @@ export default class AnalyticsDatabaseService<
     return this.databaseClient;
   }
 
+  private getIngestClient(): ClickhouseClient {
+    if (!this.ingestDatabase) {
+      this.useDefaultDatabase();
+    }
+
+    if (!this.ingestDatabaseClient && this.ingestDatabase) {
+      this.ingestDatabaseClient = this.ingestDatabase.getDataSource();
+    }
+
+    if (!this.ingestDatabaseClient) {
+      throw new Exception(
+        ExceptionCode.DatabaseNotConnectedException,
+        "ClickHouse ingest client is not connected",
+      );
+    }
+
+    return this.ingestDatabaseClient;
+  }
+
   protected async onUpdateSuccess(
     onUpdate: OnUpdate<TBaseModel>,
     _updatedItemIds: Array<ObjectID>

package/Server/Services/OnCallDutyPolicyEscalationRuleScheduleService.ts

@@ -77,6 +77,9 @@ export class Service extends DatabaseService<Model> {
     const userOnSchedule: ObjectID | null =
       await OnCallDutyPolicyScheduleService.getCurrentUserIdInSchedule(
         createdModel.onCallDutyPolicyScheduleId,
+        {
+          onCallDutyPolicyId: createdModel.onCallDutyPolicy?.id || undefined,
+        },
       );
 
     if (!userOnSchedule) {
@@ -277,6 +280,9 @@ export class Service extends DatabaseService<Model> {
       const userOnSchedule: ObjectID | null =
         await OnCallDutyPolicyScheduleService.getCurrentUserIdInSchedule(
           deletedItem.onCallDutyPolicyScheduleId!,
+          {
+            onCallDutyPolicyId: deletedItem.onCallDutyPolicy?.id || undefined,
+          },
         );
 
       if (!userOnSchedule) {

package/Server/Services/OnCallDutyPolicyEscalationRuleService.ts

@@ -460,6 +460,7 @@ export class Service extends DatabaseService<Model> {
       const userIdInSchedule: ObjectID | null =
         await OnCallDutyPolicyScheduleService.getCurrentUserIdInSchedule(
           scheduleRule.onCallDutyPolicyScheduleId!,
+          { onCallDutyPolicyId: options.onCallPolicyId },
         );
 
       if (!userIdInSchedule) {

package/Server/Services/OnCallDutyPolicyScheduleService.ts

@@ -1052,17 +1052,28 @@ export class Service extends DatabaseService<OnCallDutyPolicySchedule> {
     scheduleUserIds: Array<ObjectID>;
     windowStart: Date;
     windowEnd: Date;
+    currentOnCallDutyPolicyId?: ObjectID | undefined;
   }): Promise<Array<UserOverrideRecord>> {
     if (data.scheduleUserIds.length === 0) {
       return [];
     }
 
+    /*
+     * When a policy context is provided, include overrides scoped to that
+     * policy plus global overrides. Without a policy context (e.g. schedule
+     * roster refresh, dashboard preview, incoming-call routing), only global
+     * overrides apply — a policy-specific override from one policy must not
+     * affect schedule resolution for a different policy.
+     */
     const overrides: Array<OnCallDutyPolicyUserOverride> =
       await OnCallDutyPolicyUserOverrideService.findBy({
         query: {
           projectId: data.projectId,
           startsAt: QueryHelper.lessThanEqualTo(data.windowEnd),
           endsAt: QueryHelper.greaterThanEqualTo(data.windowStart),
+          onCallDutyPolicyId: data.currentOnCallDutyPolicyId
+            ? QueryHelper.equalToOrNull(data.currentOnCallDutyPolicyId)
+            : QueryHelper.isNull(),
         },
         select: {
           startsAt: true,
@@ -1106,6 +1117,7 @@ export class Service extends DatabaseService<OnCallDutyPolicySchedule> {
   public async getEventByIndexInSchedule(data: {
     scheduleId: ObjectID;
     getNumberOfEvents: number; // which event would you like to get. First event, second event, etc.
+    onCallDutyPolicyId?: ObjectID | undefined;
   }): Promise<Array<CalendarEvent>> {
     logger.debug(
       "getEventByIndexInSchedule called with data: " + JSON.stringify(data),
@@ -1169,12 +1181,14 @@ export class Service extends DatabaseService<OnCallDutyPolicySchedule> {
           scheduleUserIds,
           windowStart: currentStartTime,
           windowEnd: currentEndTime,
+          currentOnCallDutyPolicyId: data.onCallDutyPolicyId,
         });
 
       if (overrides.length > 0) {
         events = UserOverrideUtil.applyOverridesToEvents({
           events,
           overrides,
+          currentOnCallDutyPolicyId: data.onCallDutyPolicyId?.toString(),
         });
       }
     }
@@ -1189,6 +1203,7 @@ export class Service extends DatabaseService<OnCallDutyPolicySchedule> {
   @CaptureSpan()
   public async getCurrentUserIdInSchedule(
     scheduleId: ObjectID,
+    options?: { onCallDutyPolicyId?: ObjectID | undefined } | undefined,
   ): Promise<ObjectID | null> {
     const { layerProps, projectId, scheduleUserIds } =
       await this.getScheduleLayerProps({
@@ -1223,12 +1238,14 @@ export class Service extends DatabaseService<OnCallDutyPolicySchedule> {
           scheduleUserIds,
           windowStart: currentStartTime,
           windowEnd: currentEndTime,
+          currentOnCallDutyPolicyId: options?.onCallDutyPolicyId,
         });
 
       if (overrides.length > 0) {
         events = UserOverrideUtil.applyOverridesToEvents({
           events,
           overrides,
+          currentOnCallDutyPolicyId: options?.onCallDutyPolicyId?.toString(),
         });
       }
     }

package/Server/Services/TelemetryIngestionKeyService.ts

@@ -1,11 +1,30 @@
 import CreateBy from "../Types/Database/CreateBy";
-import { OnCreate } from "../Types/Database/Hooks";
+import DeleteBy from "../Types/Database/DeleteBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import DatabaseService from "./DatabaseService";
 import ObjectID from "../../Types/ObjectID";
 import Model from "../../Models/DatabaseModels/TelemetryIngestionKey";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
+import { createHash } from "crypto";
+
+/*
+ * 60s is the worst-case staleness on any single API node after a key is
+ * revoked from the dashboard. We invalidate in-process immediately on
+ * delete/update; this TTL is the upper bound for *other* processes.
+ */
+const POSITIVE_TTL_MS: number = 60 * 1000;
+/*
+ * Short TTL on misses so an invalid-token flood can't pin entries in the
+ * bounded cache for long while still absorbing repeat hits.
+ */
+const NEGATIVE_TTL_MS: number = 10 * 1000;
 
 export class Service extends DatabaseService<Model> {
+  private projectIdCache: InMemoryTTLCache<string | null> =
+    new InMemoryTTLCache(10_000);
+
   public constructor() {
     super(Model);
   }
@@ -20,6 +39,76 @@ export class Service extends DatabaseService<Model> {
 
     return { createBy, carryForward: null };
   }
+
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    /*
+     * We don't know which secretKey(s) are being deleted without an extra
+     * query; clear the whole cache. Key deletes are rare so this is cheap.
+     */
+    this.projectIdCache.clear();
+    return { deleteBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    /*
+     * Same reasoning as onBeforeDelete. secretKey is not user-editable today
+     * but projectId could change, so be conservative.
+     */
+    this.projectIdCache.clear();
+    return { updateBy, carryForward: null };
+  }
+
+  /**
+   * Resolve an ingestion token to its projectId, with a short-lived
+   * in-process cache to keep the hot ingest path off Postgres. Returns null
+   * for unknown, malformed, or revoked tokens (also cached, for a shorter
+   * TTL).
+   */
+  @CaptureSpan()
+  public async getProjectIdFromSecretKey(
+    secretKey: string,
+  ): Promise<ObjectID | null> {
+    const cacheKey: string = createHash("sha256")
+      .update(secretKey)
+      .digest("hex");
+
+    const cached: string | null | undefined = this.projectIdCache.get(cacheKey);
+    if (cached !== undefined) {
+      return cached === null ? null : new ObjectID(cached);
+    }
+
+    let secretKeyObjectId: ObjectID;
+    try {
+      secretKeyObjectId = new ObjectID(secretKey);
+    } catch {
+      this.projectIdCache.set(cacheKey, null, NEGATIVE_TTL_MS);
+      return null;
+    }
+
+    const token: Model | null = await this.findOneBy({
+      query: { secretKey: secretKeyObjectId },
+      select: { projectId: true },
+      props: { isRoot: true },
+    });
+
+    const projectId: ObjectID | undefined = token?.projectId as
+      | ObjectID
+      | undefined;
+
+    if (!projectId) {
+      this.projectIdCache.set(cacheKey, null, NEGATIVE_TTL_MS);
+      return null;
+    }
+
+    this.projectIdCache.set(cacheKey, projectId.toString(), POSITIVE_TTL_MS);
+    return projectId;
+  }
 }
 
 export default new Service();

package/Server/Utils/Monitor/Criteria/DnssecMonitorCriteria.ts

@@ -0,0 +1,108 @@
+import DataToProcess from "../DataToProcess";
+import CompareCriteria from "./CompareCriteria";
+import {
+  CheckOn,
+  CriteriaFilter,
+  FilterType,
+} from "../../../../Types/Monitor/CriteriaFilter";
+import DnssecMonitorResponse from "../../../../Types/Monitor/DnssecMonitor/DnssecMonitorResponse";
+import ProbeMonitorResponse from "../../../../Types/Probe/ProbeMonitorResponse";
+import CaptureSpan from "../../Telemetry/CaptureSpan";
+
+export default class DnssecMonitorCriteria {
+  @CaptureSpan()
+  public static async isMonitorInstanceCriteriaFilterMet(input: {
+    dataToProcess: DataToProcess;
+    criteriaFilter: CriteriaFilter;
+  }): Promise<string | null> {
+    const dataToProcess: ProbeMonitorResponse =
+      input.dataToProcess as ProbeMonitorResponse;
+
+    const dnssecResponse: DnssecMonitorResponse | undefined =
+      dataToProcess.dnssecResponse;
+
+    if (!dnssecResponse) {
+      return null;
+    }
+
+    const isTrue: boolean = input.criteriaFilter.filterType === FilterType.True;
+    const isFalse: boolean =
+      input.criteriaFilter.filterType === FilterType.False;
+
+    if (input.criteriaFilter.checkOn === CheckOn.DnssecChainValid) {
+      if (dnssecResponse.isChainValid && isTrue) {
+        return `DNSSEC chain is valid for ${dnssecResponse.domainName}.`;
+      }
+      if (!dnssecResponse.isChainValid && isFalse) {
+        return `DNSSEC chain validation failed for ${dnssecResponse.domainName}.`;
+      }
+      return null;
+    }
+
+    if (input.criteriaFilter.checkOn === CheckOn.DnssecDnskeyExists) {
+      const exists: boolean = dnssecResponse.dnskeys.length > 0;
+      if (exists && isTrue) {
+        return `DNSKEY records present for ${dnssecResponse.domainName}.`;
+      }
+      if (!exists && isFalse) {
+        return `No DNSKEY records found for ${dnssecResponse.domainName}.`;
+      }
+      return null;
+    }
+
+    if (input.criteriaFilter.checkOn === CheckOn.DnssecDsExists) {
+      const exists: boolean = dnssecResponse.isParentDsPresent;
+      if (exists && isTrue) {
+        return `DS records present at parent zone for ${dnssecResponse.domainName}.`;
+      }
+      if (!exists && isFalse) {
+        return `No DS records found at the parent zone for ${dnssecResponse.domainName}.`;
+      }
+      return null;
+    }
+
+    if (input.criteriaFilter.checkOn === CheckOn.DnssecResolverConsensus) {
+      const consensus: boolean = dnssecResponse.resolverConsensusAd;
+      if (consensus && isTrue) {
+        return `All resolvers report DNSSEC-valid (AD flag) for ${dnssecResponse.domainName}.`;
+      }
+      if (!consensus && isFalse) {
+        return `Resolvers do not agree on DNSSEC validity for ${dnssecResponse.domainName}.`;
+      }
+      return null;
+    }
+
+    if (input.criteriaFilter.checkOn === CheckOn.DnssecNameserverConsistent) {
+      const consistent: boolean = dnssecResponse.isNameserverConsistent;
+      if (consistent && isTrue) {
+        return `Authoritative nameservers are consistent for ${dnssecResponse.domainName}.`;
+      }
+      if (!consistent && isFalse) {
+        return `Authoritative nameservers are inconsistent for ${dnssecResponse.domainName}.`;
+      }
+      return null;
+    }
+
+    if (input.criteriaFilter.checkOn === CheckOn.DnssecSignatureExpiresInDays) {
+      const threshold: number | null = CompareCriteria.convertToNumber(
+        input.criteriaFilter.value,
+      );
+
+      if (threshold === null || threshold === undefined) {
+        return null;
+      }
+
+      if (dnssecResponse.daysUntilSignatureExpiry === undefined) {
+        return null;
+      }
+
+      return CompareCriteria.compareCriteriaNumbers({
+        value: dnssecResponse.daysUntilSignatureExpiry,
+        threshold: threshold,
+        criteriaFilter: input.criteriaFilter,
+      });
+    }
+
+    return null;
+  }
+}

package/Server/Utils/Monitor/MonitorCriteriaEvaluator.ts

@@ -18,6 +18,7 @@ import ProfileMonitorCriteria from "./Criteria/ProfileMonitorCriteria";
 import SnmpMonitorCriteria from "./Criteria/SnmpMonitorCriteria";
 import DnsMonitorCriteria from "./Criteria/DnsMonitorCriteria";
 import DomainMonitorCriteria from "./Criteria/DomainMonitorCriteria";
+import DnssecMonitorCriteria from "./Criteria/DnssecMonitorCriteria";
 import ExternalStatusPageMonitorCriteria from "./Criteria/ExternalStatusPageMonitorCriteria";
 import MonitorCriteriaMessageBuilder from "./MonitorCriteriaMessageBuilder";
 import MonitorCriteriaDataExtractor from "./MonitorCriteriaDataExtractor";
@@ -761,6 +762,18 @@ ${contextBlock}
       }
     }
 
+    if (input.monitor.monitorType === MonitorType.DNSSEC) {
+      const dnssecMonitorResult: string | null =
+        await DnssecMonitorCriteria.isMonitorInstanceCriteriaFilterMet({
+          dataToProcess: input.dataToProcess,
+          criteriaFilter: input.criteriaFilter,
+        });
+
+      if (dnssecMonitorResult) {
+        return dnssecMonitorResult;
+      }
+    }
+
     if (input.monitor.monitorType === MonitorType.ExternalStatusPage) {
       const externalStatusPageResult: string | null =
         await ExternalStatusPageMonitorCriteria.isMonitorInstanceCriteriaFilterMet(

package/Server/Utils/Monitor/MonitorTemplateUtil.ts

@@ -19,6 +19,7 @@ import DnsMonitorResponse, {
   DnsRecordResponse,
 } from "../../../Types/Monitor/DnsMonitor/DnsMonitorResponse";
 import DomainMonitorResponse from "../../../Types/Monitor/DomainMonitor/DomainMonitorResponse";
+import DnssecMonitorResponse from "../../../Types/Monitor/DnssecMonitor/DnssecMonitorResponse";
 import ExternalStatusPageMonitorResponse, {
   ExternalStatusPageComponentStatus,
 } from "../../../Types/Monitor/ExternalStatusPageMonitor/ExternalStatusPageMonitorResponse";
@@ -332,6 +333,30 @@ export default class MonitorTemplateUtil {
         } as JSONObject;
       }
 
+      if (data.monitorType === MonitorType.DNSSEC) {
+        const dnssecResponse: DnssecMonitorResponse | undefined = (
+          data.dataToProcess as ProbeMonitorResponse
+        ).dnssecResponse;
+
+        storageMap = {
+          isOnline: (data.dataToProcess as ProbeMonitorResponse).isOnline,
+          responseTimeInMs: dnssecResponse?.responseTimeInMs,
+          failureCause: dnssecResponse?.failureCause,
+          domainName: dnssecResponse?.domainName,
+          isZoneSigned: dnssecResponse?.isZoneSigned,
+          isParentDsPresent: dnssecResponse?.isParentDsPresent,
+          isChainValid: dnssecResponse?.isChainValid,
+          resolverConsensusAd: dnssecResponse?.resolverConsensusAd,
+          isNameserverConsistent: dnssecResponse?.isNameserverConsistent,
+          earliestSignatureExpiration:
+            dnssecResponse?.earliestSignatureExpiration,
+          daysUntilSignatureExpiry: dnssecResponse?.daysUntilSignatureExpiry,
+          dnskeyCount: dnssecResponse?.dnskeys?.length,
+          dsRecordCount: dnssecResponse?.parentDsRecords?.length,
+          rrsigCount: dnssecResponse?.rrsigs?.length,
+        } as JSONObject;
+      }
+
       if (
         data.monitorType === MonitorType.Metrics ||
         data.monitorType === MonitorType.Kubernetes ||

package/Tests/Server/Middleware/UserAuthorization.test.ts

@@ -423,7 +423,6 @@ describe("UserMiddleware", () => {
           req,
           tenantId: projectId,
           userId,
-          isGlobalLogin: true,
         },
       );
       expect(next).not.toBeCalled();
@@ -454,7 +453,6 @@ describe("UserMiddleware", () => {
           req,
           tenantId: projectId,
           userId,
-          isGlobalLogin: true,
         },
       );
     });
@@ -579,7 +577,6 @@ describe("UserMiddleware", () => {
           req: mockedRequest,
           tenantId: projectId,
           userId,
-          isGlobalLogin: true,
         },
       );
     });
@@ -609,7 +606,6 @@ describe("UserMiddleware", () => {
           req,
           tenantId: projectId,
           userId,
-          isGlobalLogin: true,
         }),
       ).rejects.toThrowError(new BadDataException("Invalid tenantId"));
       expect(spyFindOneById).toHaveBeenCalledWith({
@@ -636,7 +632,6 @@ describe("UserMiddleware", () => {
           req,
           tenantId: projectId,
           userId,
-          isGlobalLogin: true,
         }),
       ).rejects.toThrowError(new SsoAuthorizationException());
       expect(spyDoesSsoTokenForProjectExist).toHaveBeenCalledWith(
@@ -659,7 +654,6 @@ describe("UserMiddleware", () => {
           req,
           tenantId: projectId,
           userId,
-          isGlobalLogin: true,
         });
 
       expect(result).toBeNull();
@@ -686,7 +680,6 @@ describe("UserMiddleware", () => {
           req,
           tenantId: projectId,
           userId,
-          isGlobalLogin: true,
         });
 
       expect(result).toEqual(mockedUserTenantAccessPermission);

package/Types/Dashboard/DashboardComponentType.ts

@@ -23,7 +23,6 @@ enum DashboardComponentType {
   DockerNetworkList = `DockerNetworkList`,
   DockerVolumeList = `DockerVolumeList`,
   HostList = `HostList`,
-  HostMetricChart = `HostMetricChart`,
 }
 
 export default DashboardComponentType;

package/Types/Dashboard/DashboardComponents/ComponentArgument.ts

@@ -11,6 +11,8 @@ export enum ComponentInputType {
   MetricsQueryConfig = "MetricsQueryConfig",
   MetricsQueryConfigs = "MetricsQueryConfigs",
   MetricsFormulaConfigs = "MetricsFormulaConfigs",
+  TableColumns = "TableColumns",
+  TableGroupBy = "TableGroupBy",
   LongText = "Long Text",
   Dropdown = "Dropdown",
   MultiSelectDropdown = "MultiSelectDropdown",

package/Types/Dashboard/DashboardComponents/DashboardTableComponent.ts

@@ -1,14 +1,87 @@
+import MetricFormulaConfigData from "../../Metrics/MetricFormulaConfigData";
 import MetricQueryConfigData from "../../Metrics/MetricQueryConfigData";
+import MetricsAggregationType from "../../Metrics/MetricsAggregationType";
 import ObjectID from "../../ObjectID";
 import DashboardComponentType from "../DashboardComponentType";
 import BaseComponent from "./DashboardBaseComponent";
 
+export enum TableReduce {
+  Last = "Last",
+  Avg = "Avg",
+  Sum = "Sum",
+  Min = "Min",
+  Max = "Max",
+}
+
+export enum TableColumnKind {
+  Metric = "Metric",
+  Formula = "Formula",
+}
+
+export interface TableColumn {
+  /*
+   * Stable identifier so React keys survive reorder and the form can
+   * match inputs to the column being edited.
+   */
+  id: string;
+  // Single-letter variable (a, b, c, ...) that formulas can reference.
+  variable: string;
+  // User-facing column header (used only when showAsColumn !== false).
+  header: string;
+  kind: TableColumnKind;
+  /*
+   * When false, the metric/formula is still fetched (so formulas can
+   * reference it by variable) but it does not render a visible column.
+   * Default: true.
+   */
+  showAsColumn?: boolean | undefined;
+  // kind === Metric:
+  metricName?: string | undefined;
+  aggregation?: MetricsAggregationType | undefined;
+  // kind === Formula: expression referencing other variables, e.g. "(a / b) * 100".
+  formula?: string | undefined;
+  // Per-cell formatting (both kinds).
+  decimals?: number | undefined;
+  /*
+   * Unit to render after each cell value (e.g. "%", "MB", "ms").
+   * Empty/undefined = Auto: for metric columns, falls back to the metric
+   * type's native unit; for formula columns, no unit is rendered.
+   */
+  unit?: string | undefined;
+}
+
+export interface TableGroupByAttribute {
+  // OTel attribute key, e.g. "host.name" or "resource.k8s.pod.name".
+  key: string;
+  // Optional user-friendly header. When unset, the key is shown as-is.
+  header?: string | undefined;
+}
+
 export default interface DashboardTableComponent extends BaseComponent {
   componentType: DashboardComponentType.Table;
   componentId: ObjectID;
   arguments: {
-    metricQueryConfig?: MetricQueryConfigData | undefined;
+    // New shape: columns + widget-level group-by.
+    columns?: Array<TableColumn> | undefined;
+    // New shape — attribute + optional custom header. Source of truth.
+    groupByAttributes?: Array<TableGroupByAttribute> | undefined;
+    /*
+     * Legacy shape from before per-attribute headers. Read at render
+     * time if `groupByAttributes` is absent. Never written by the editor.
+     */
+    groupByAttributeKeys?: Array<string> | undefined;
+    // Common display options.
     tableTitle?: string | undefined;
+    tableDescription?: string | undefined;
     maxRows?: number | undefined;
+    reduce?: TableReduce | undefined;
+    decimals?: number | undefined;
+    /*
+     * Legacy widget shape from before the columns/groupByAttributes
+     * redesign — read-only at render time, never written by the editor.
+     */
+    metricQueryConfig?: MetricQueryConfigData | undefined;
+    metricQueryConfigs?: Array<MetricQueryConfigData> | undefined;
+    metricFormulaConfigs?: Array<MetricFormulaConfigData> | undefined;
   };
 }