@oneuptime/common 10.8.1 → 11.0.0

package/Server/API/TelemetryAPI.ts

@@ -4,6 +4,7 @@ import Express, {
   ExpressResponse,
   ExpressRouter,
   NextFunction,
+  RequestHandler,
 } from "../Utils/Express";
 import Response from "../Utils/Response";
 import BadDataException from "../../Types/Exception/BadDataException";
@@ -28,6 +29,12 @@ import TraceAggregationService, {
   HistogramRequest as TraceHistogramRequest,
   FacetValue as TraceFacetValue,
   MultiFacetRequest as TraceMultiFacetRequest,
+  TraceFilters,
+  TraceAnalyticsChartType,
+  TraceAnalyticsRequest,
+  TraceAnalyticsTimeseriesRow,
+  TraceAnalyticsTopItem,
+  TraceAnalyticsTableRow,
 } from "../Services/TraceAggregationService";
 import ExceptionAggregationService, {
   HistogramBucket as ExceptionHistogramBucket,
@@ -41,9 +48,13 @@ import MetricAggregationService, {
 } from "../Services/MetricAggregationService";
 import ProfileAggregationService, {
   FlamegraphRequest,
+  FlamegraphResult,
   FunctionListRequest,
-  FunctionListItem,
-  ProfileFlamegraphNode,
+  FunctionListResult,
+  FunctionFocusRequest,
+  FunctionFocusResult,
+  BreakdownRequest,
+  BreakdownResult,
   DiffFlamegraphRequest,
   DiffFlamegraphNode,
   ServiceActivityRequest,
@@ -58,6 +69,7 @@ import ProfileSample from "../../Models/AnalyticsModels/ProfileSample";
 import ProfileService from "../Services/ProfileService";
 import ProfileSampleService from "../Services/ProfileSampleService";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
+import Permission from "../../Types/Permission";
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
 import { JSONObject } from "../../Types/JSON";
@@ -68,9 +80,81 @@ import ResourceFacetResolver, {
 
 const router: ExpressRouter = Express.getRouter();
 
+/*
+ * Shared guards for every bespoke telemetry route in this file. These routes
+ * don't go through BaseAnalyticsAPI, so nothing downstream re-checks
+ * authorization: the tenantId comes straight from a caller-controlled header
+ * and UserMiddleware lets tokenless requests through as Public. Every route
+ * must therefore demand an authenticated principal that holds a
+ * telemetry-read permission on that tenant before any data is queried.
+ * Each guard's permission list mirrors the table-level read access control
+ * declared on the corresponding analytics model, keeping these routes
+ * exactly as permissive as the model-backed CRUD APIs for the same signal.
+ *
+ * Guards are declared before any route registration: route registration
+ * executes at module load, and spreading a const declared further down the
+ * file would throw at startup (temporal dead zone).
+ */
+type TelemetryReadAccessGuardFactory = (
+  signalReadPermission: Permission,
+) => Array<RequestHandler>;
+
+const createTelemetryReadAccessGuard: TelemetryReadAccessGuardFactory = (
+  signalReadPermission: Permission,
+): Array<RequestHandler> => {
+  return [
+    UserMiddleware.getUserMiddleware,
+    UserMiddleware.requireUserAuthentication,
+    UserMiddleware.requirePermission({
+      permissions: [
+        Permission.ProjectOwner,
+        Permission.ProjectAdmin,
+        Permission.ProjectMember,
+        Permission.Viewer,
+        Permission.TelemetryAdmin,
+        Permission.TelemetryMember,
+        Permission.TelemetryViewer,
+        signalReadPermission,
+      ],
+    }),
+  ];
+};
+
+// Mirrors the read access control declared on the Log analytics model.
+const requireLogReadAccess: Array<RequestHandler> =
+  createTelemetryReadAccessGuard(Permission.ReadTelemetryServiceLog);
+
+// Mirrors the read access control declared on the Span analytics model.
+const requireTraceReadAccess: Array<RequestHandler> =
+  createTelemetryReadAccessGuard(Permission.ReadTelemetryServiceTraces);
+
+/*
+ * Mirrors the read access control declared on the Metric analytics model,
+ * whose table-level read list grants ReadTelemetryServiceTraces rather than
+ * ReadTelemetryServiceMetrics. The guard follows the model declaration so
+ * these routes stay in lockstep with the model-backed CRUD API; if the model
+ * ever switches to ReadTelemetryServiceMetrics this must change with it.
+ */
+const requireMetricReadAccess: Array<RequestHandler> =
+  createTelemetryReadAccessGuard(Permission.ReadTelemetryServiceTraces);
+
+/*
+ * Mirrors the read access control declared on the ExceptionInstance
+ * analytics model.
+ */
+const requireExceptionReadAccess: Array<RequestHandler> =
+  createTelemetryReadAccessGuard(Permission.ReadTelemetryException);
+
+/*
+ * Mirrors the read access control declared on the Profile / ProfileSample
+ * analytics models.
+ */
+const requireProfileReadAccess: Array<RequestHandler> =
+  createTelemetryReadAccessGuard(Permission.ReadTelemetryServiceProfiles);
+
 router.post(
   "/telemetry/metrics/get-attributes",
-  UserMiddleware.getUserMiddleware,
+  ...requireMetricReadAccess,
   async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
     return getAttributes(req, res, next, TelemetryType.Metric);
   },
@@ -78,7 +162,7 @@ router.post(
 
 router.post(
   "/telemetry/metrics/get-attribute-values",
-  UserMiddleware.getUserMiddleware,
+  ...requireMetricReadAccess,
   async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
     return getAttributeValues(req, res, next, TelemetryType.Metric);
   },
@@ -86,7 +170,7 @@ router.post(
 
 router.post(
   "/telemetry/logs/get-attributes",
-  UserMiddleware.getUserMiddleware,
+  ...requireLogReadAccess,
   async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
     return getAttributes(req, res, next, TelemetryType.Log);
   },
@@ -94,7 +178,7 @@ router.post(
 
 router.post(
   "/telemetry/logs/get-attribute-values",
-  UserMiddleware.getUserMiddleware,
+  ...requireLogReadAccess,
   async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
     return getAttributeValues(req, res, next, TelemetryType.Log);
   },
@@ -102,7 +186,7 @@ router.post(
 
 router.post(
   "/telemetry/traces/get-attributes",
-  UserMiddleware.getUserMiddleware,
+  ...requireTraceReadAccess,
   async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
     return getAttributes(req, res, next, TelemetryType.Trace);
   },
@@ -110,7 +194,7 @@ router.post(
 
 router.post(
   "/telemetry/traces/get-attribute-values",
-  UserMiddleware.getUserMiddleware,
+  ...requireTraceReadAccess,
   async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
     return getAttributeValues(req, res, next, TelemetryType.Trace);
   },
@@ -118,7 +202,7 @@ router.post(
 
 router.post(
   "/telemetry/exceptions/get-attributes",
-  UserMiddleware.getUserMiddleware,
+  ...requireExceptionReadAccess,
   async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
     return getAttributes(req, res, next, TelemetryType.Exception);
   },
@@ -126,7 +210,7 @@ router.post(
 
 router.post(
   "/telemetry/exceptions/get-attribute-values",
-  UserMiddleware.getUserMiddleware,
+  ...requireExceptionReadAccess,
   async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
     return getAttributeValues(req, res, next, TelemetryType.Exception);
   },
@@ -262,7 +346,7 @@ const getAttributeValues: GetAttributeValuesFunction = async (
 
 router.post(
   "/telemetry/logs/histogram",
-  UserMiddleware.getUserMiddleware,
+  ...requireLogReadAccess,
   async (
     req: ExpressRequest,
     res: ExpressResponse,
@@ -300,6 +384,10 @@ router.post(
           })
         : undefined;
 
+      const entityKeys: Array<string> | undefined = body["entityKeys"]
+        ? (body["entityKeys"] as Array<string>)
+        : undefined;
+
       const severityTexts: Array<string> | undefined = body["severityTexts"]
         ? (body["severityTexts"] as Array<string>)
         : undefined;
@@ -326,6 +414,7 @@ router.post(
         endTime,
         bucketSizeInMinutes,
         serviceIds,
+        entityKeys,
         severityTexts,
         bodySearchText,
         traceIds,
@@ -349,7 +438,7 @@ router.post(
 
 router.post(
   "/telemetry/logs/facets",
-  UserMiddleware.getUserMiddleware,
+  ...requireLogReadAccess,
   async (
     req: ExpressRequest,
     res: ExpressResponse,
@@ -371,7 +460,7 @@ router.post(
 
       const facetKeys: Array<string> = body["facetKeys"]
         ? (body["facetKeys"] as Array<string>)
-        : ["severityText", "serviceId"];
+        : ["severityText", "primaryEntityId"];
 
       const startTime: Date = body["startTime"]
         ? OneUptimeDate.fromString(body["startTime"] as string)
@@ -389,6 +478,10 @@ router.post(
           })
         : undefined;
 
+      const entityKeys: Array<string> | undefined = body["entityKeys"]
+        ? (body["entityKeys"] as Array<string>)
+        : undefined;
+
       const severityTexts: Array<string> | undefined = body["severityTexts"]
         ? (body["severityTexts"] as Array<string>)
         : undefined;
@@ -411,9 +504,9 @@ router.post(
 
       /*
        * Per-facet partial-match filter applied at the Postgres source-of-truth
-       * lookup stage. Only consulted for resource facets (serviceId / hostId /
-       * dockerHostId / kubernetesClusterId) — other facets continue to filter
-       * client-side over the loaded value list.
+       * lookup stage. Only consulted for resource facets (primaryEntityId /
+       * hostId / dockerHostId / kubernetesClusterId) — other facets continue
+       * to filter client-side over the loaded value list.
        */
       const facetSearchText: Record<string, string> | undefined = body[
         "facetSearchText"
@@ -445,6 +538,7 @@ router.post(
                   facetKey,
                   limit,
                   serviceIds,
+                  entityKeys,
                   severityTexts,
                   bodySearchText,
                   traceIds,
@@ -508,11 +602,127 @@ router.post(
   },
 );
 
+/*
+ * Shared body parsing for every trace aggregation endpoint (histogram,
+ * facets, analytics). Defensive about shapes: arrays are validated and
+ * filtered to strings, booleans/numbers use strict typeof checks (JSON null
+ * or a stringly-typed value must mean "no filter", never an active
+ * predicate).
+ */
+function parseTraceFilterBody(body: JSONObject): TraceFilters {
+  const serviceIds: Array<ObjectID> | undefined = Array.isArray(
+    body["serviceIds"],
+  )
+    ? (body["serviceIds"] as Array<unknown>)
+        .filter((v: unknown): v is string => {
+          return typeof v === "string";
+        })
+        .map((id: string) => {
+          return new ObjectID(id);
+        })
+    : undefined;
+
+  const stringArray: (key: string) => Array<string> | undefined = (
+    key: string,
+  ): Array<string> | undefined => {
+    return Array.isArray(body[key])
+      ? (body[key] as Array<unknown>).filter((v: unknown): v is string => {
+          return typeof v === "string";
+        })
+      : undefined;
+  };
+
+  /*
+   * Numeric strings are coerced (stringly-typed clients worked before the
+   * parsing was centralized) — dropping them would silently widen the
+   * filter to all statuses.
+   */
+  const statusCodes: Array<number> | undefined = Array.isArray(
+    body["statusCodes"],
+  )
+    ? (body["statusCodes"] as Array<unknown>)
+        .map((v: unknown): number => {
+          return typeof v === "number" ? v : Number(v);
+        })
+        .filter((v: number): boolean => {
+          return Number.isFinite(v);
+        })
+    : undefined;
+
+  const stringRecord: (key: string) => Record<string, string> | undefined = (
+    key: string,
+  ): Record<string, string> | undefined => {
+    const raw: unknown = body[key];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      return undefined;
+    }
+    const entries: Array<[string, string]> = Object.entries(
+      raw as Record<string, unknown>,
+    ).filter((entry: [string, unknown]): entry is [string, string] => {
+      return typeof entry[1] === "string";
+    });
+    if (entries.length === 0) {
+      return undefined;
+    }
+    return Object.fromEntries(entries);
+  };
+
+  return {
+    serviceIds,
+    entityKeys: stringArray("entityKeys"),
+    statusCodes,
+    spanKinds: stringArray("spanKinds"),
+    spanNames: stringArray("spanNames"),
+    /*
+     * spanNameSearches is the only multiplicative filter (one ILIKE
+     * predicate per entry) — cap it. The dashboard sends at most one.
+     */
+    spanNameSearches: stringArray("spanNameSearches")?.slice(0, 10),
+    spanIds: stringArray("spanIds"),
+    traceIds: stringArray("traceIds"),
+    nameSearchText:
+      typeof body["nameSearchText"] === "string" && body["nameSearchText"]
+        ? (body["nameSearchText"] as string)
+        : undefined,
+    statusMessageSearchText:
+      typeof body["statusMessageSearchText"] === "string" &&
+      body["statusMessageSearchText"]
+        ? (body["statusMessageSearchText"] as string)
+        : undefined,
+    statusMessages: stringArray("statusMessages"),
+    /*
+     * Strict boolean check — unlike rootOnly, a coerced `false` is a
+     * meaningful predicate here (JSON null must mean "no filter", not
+     * "exclude exception spans").
+     */
+    hasException:
+      typeof body["hasException"] === "boolean"
+        ? (body["hasException"] as boolean)
+        : undefined,
+    minDurationNano:
+      typeof body["minDurationNano"] === "number"
+        ? (body["minDurationNano"] as number)
+        : undefined,
+    maxDurationNano:
+      typeof body["maxDurationNano"] === "number"
+        ? (body["maxDurationNano"] as number)
+        : undefined,
+    exactDurationNano:
+      typeof body["exactDurationNano"] === "number"
+        ? (body["exactDurationNano"] as number)
+        : undefined,
+    rootOnly:
+      body["rootOnly"] === undefined ? undefined : Boolean(body["rootOnly"]),
+    attributes: stringRecord("attributes"),
+    attributeSearches: stringRecord("attributeSearches"),
+  };
+}
+
 // --- Trace Histogram Endpoint ---
 
 router.post(
   "/telemetry/traces/histogram",
-  UserMiddleware.getUserMiddleware,
+  ...requireTraceReadAccess,
   async (
     req: ExpressRequest,
     res: ExpressResponse,
@@ -544,52 +754,14 @@ router.post(
         (body["bucketSizeInMinutes"] as number) ||
         computeDefaultBucketSize(startTime, endTime);
 
-      const serviceIds: Array<ObjectID> | undefined = body["serviceIds"]
-        ? (body["serviceIds"] as Array<string>).map((id: string) => {
-            return new ObjectID(id);
-          })
-        : undefined;
-
-      const statusCodes: Array<number> | undefined = body["statusCodes"]
-        ? (body["statusCodes"] as Array<number>)
-        : undefined;
-
-      const spanKinds: Array<string> | undefined = body["spanKinds"]
-        ? (body["spanKinds"] as Array<string>)
-        : undefined;
-
-      const spanNames: Array<string> | undefined = body["spanNames"]
-        ? (body["spanNames"] as Array<string>)
-        : undefined;
-
-      const traceIds: Array<string> | undefined = body["traceIds"]
-        ? (body["traceIds"] as Array<string>)
-        : undefined;
-
-      const nameSearchText: string | undefined = body["nameSearchText"]
-        ? (body["nameSearchText"] as string)
-        : undefined;
-
-      const rootOnly: boolean | undefined =
-        body["rootOnly"] === undefined ? undefined : Boolean(body["rootOnly"]);
-
-      const attributes: Record<string, string> | undefined = body["attributes"]
-        ? (body["attributes"] as Record<string, string>)
-        : undefined;
+      const traceFilters: TraceFilters = parseTraceFilterBody(body);
 
       const request: TraceHistogramRequest = {
         projectId: databaseProps.tenantId,
         startTime,
         endTime,
         bucketSizeInMinutes,
-        serviceIds,
-        statusCodes,
-        spanKinds,
-        spanNames,
-        traceIds,
-        nameSearchText,
-        rootOnly,
-        attributes,
+        ...traceFilters,
       };
 
       const buckets: Array<TraceHistogramBucket> =
@@ -608,7 +780,7 @@ router.post(
 
 router.post(
   "/telemetry/traces/facets",
-  UserMiddleware.getUserMiddleware,
+  ...requireTraceReadAccess,
   async (
     req: ExpressRequest,
     res: ExpressResponse,
@@ -630,7 +802,7 @@ router.post(
 
       const facetKeys: Array<string> = body["facetKeys"]
         ? (body["facetKeys"] as Array<string>)
-        : ["serviceId", "statusCode", "kind", "name"];
+        : ["primaryEntityId", "statusCode", "kind", "name"];
 
       const startTime: Date = body["startTime"]
         ? OneUptimeDate.fromString(body["startTime"] as string)
@@ -642,44 +814,13 @@ router.post(
 
       const limit: number = (body["limit"] as number) || 500;
 
-      const serviceIds: Array<ObjectID> | undefined = body["serviceIds"]
-        ? (body["serviceIds"] as Array<string>).map((id: string) => {
-            return new ObjectID(id);
-          })
-        : undefined;
-
-      const statusCodes: Array<number> | undefined = body["statusCodes"]
-        ? (body["statusCodes"] as Array<number>)
-        : undefined;
-
-      const spanKinds: Array<string> | undefined = body["spanKinds"]
-        ? (body["spanKinds"] as Array<string>)
-        : undefined;
-
-      const spanNames: Array<string> | undefined = body["spanNames"]
-        ? (body["spanNames"] as Array<string>)
-        : undefined;
-
-      const traceIds: Array<string> | undefined = body["traceIds"]
-        ? (body["traceIds"] as Array<string>)
-        : undefined;
-
-      const nameSearchText: string | undefined = body["nameSearchText"]
-        ? (body["nameSearchText"] as string)
-        : undefined;
-
-      const rootOnly: boolean | undefined =
-        body["rootOnly"] === undefined ? undefined : Boolean(body["rootOnly"]);
-
-      const attributes: Record<string, string> | undefined = body["attributes"]
-        ? (body["attributes"] as Record<string, string>)
-        : undefined;
+      const traceFilters: TraceFilters = parseTraceFilterBody(body);
 
       /*
        * Per-facet partial-match filter applied at the Postgres source-of-truth
-       * lookup stage. Only consulted for resource facets (serviceId / hostId /
-       * dockerHostId / kubernetesClusterId) — other facets continue to filter
-       * client-side over the loaded value list.
+       * lookup stage. Only consulted for resource facets (primaryEntityId /
+       * hostId / dockerHostId / kubernetesClusterId) — other facets continue
+       * to filter client-side over the loaded value list.
        */
       const facetSearchText: Record<string, string> | undefined = body[
         "facetSearchText"
@@ -699,19 +840,13 @@ router.post(
         endTime,
         facetKeys,
         limit,
-        serviceIds,
-        statusCodes,
-        spanKinds,
-        spanNames,
-        traceIds,
-        nameSearchText,
-        rootOnly,
-        attributes,
+        ...traceFilters,
       };
 
       /*
-       * Resource facets (serviceId / hostId / dockerHostId / k8s cluster ...)
-       * and statusCode are counted with an exact, projection-backed GROUP BY
+       * Resource facets (primaryEntityId / hostId / dockerHostId / k8s
+       * cluster ...) and statusCode are counted with an exact,
+       * projection-backed GROUP BY
        * in getResourceFacetCounts(). The recent-N sample below saturates with
        * whichever service is chattiest right now and reports 0 for every other
        * service regardless of its true volume over the window — the "top 1000"
@@ -781,8 +916,8 @@ router.post(
       /*
        * Replace resource-facet results with the Postgres source-of-truth list
        * (filtered by facetSearchText and enriched with displayName). Every
-       * resource facet shares the same exact serviceId -> count map; resource
-       * ids are globally unique, so each facet only ever resolves its own
+       * resource facet shares the same exact primaryEntityId -> count map;
+       * resource ids are globally unique, so each facet only ever resolves its own
        * entities. Entities with no telemetry in the window surface with count
        * 0 instead of being hidden, and the search box can find resources
        * beyond the loaded subset.
@@ -822,11 +957,134 @@ router.post(
   },
 );
 
+// --- Trace Analytics Endpoint ---
+
+router.post(
+  "/telemetry/traces/analytics",
+  ...requireTraceReadAccess,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const databaseProps: DatabaseCommonInteractionProps =
+        await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+      if (!databaseProps?.tenantId) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid Project ID"),
+        );
+      }
+
+      const body: JSONObject = req.body as JSONObject;
+
+      const chartType: TraceAnalyticsChartType =
+        (body["chartType"] as TraceAnalyticsChartType) || "timeseries";
+
+      if (!["timeseries", "toplist", "table"].includes(chartType)) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid chartType"),
+        );
+      }
+
+      const metric: string = (body["metric"] as string) || "count";
+
+      if (!TraceAggregationService.isValidAnalyticsMetric(metric)) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid metric"),
+        );
+      }
+
+      const startTime: Date = body["startTime"]
+        ? OneUptimeDate.fromString(body["startTime"] as string)
+        : OneUptimeDate.addRemoveHours(OneUptimeDate.getCurrentDate(), -1);
+
+      const endTime: Date = body["endTime"]
+        ? OneUptimeDate.fromString(body["endTime"] as string)
+        : OneUptimeDate.getCurrentDate();
+
+      const rawBucketSize: number = Number(body["bucketSizeInMinutes"]);
+      const bucketSizeInMinutes: number =
+        Number.isFinite(rawBucketSize) && rawBucketSize >= 1
+          ? Math.trunc(rawBucketSize)
+          : computeDefaultBucketSize(startTime, endTime);
+
+      const groupBy: Array<string> | undefined = Array.isArray(body["groupBy"])
+        ? (body["groupBy"] as Array<unknown>).filter(
+            (v: unknown): v is string => {
+              return typeof v === "string" && v.length > 0;
+            },
+          )
+        : undefined;
+
+      /*
+       * Clamp to a sane integer range — `limit` flows into LIMIT and the
+       * timeseries series cap, so negative/fractional values would 500 in
+       * ClickHouse and huge values would explode the result set. Numeric
+       * strings are accepted (dashboard widget arguments are stored as
+       * strings).
+       */
+      const rawLimit: number = Number(body["limit"]);
+      const limit: number | undefined = Number.isFinite(rawLimit)
+        ? Math.min(Math.max(Math.trunc(rawLimit), 1), 1000)
+        : undefined;
+
+      const traceFilters: TraceFilters = parseTraceFilterBody(body);
+
+      const request: TraceAnalyticsRequest = {
+        projectId: databaseProps.tenantId,
+        startTime,
+        endTime,
+        bucketSizeInMinutes,
+        chartType,
+        metric,
+        groupBy,
+        limit,
+        ...traceFilters,
+      };
+
+      if (chartType === "timeseries") {
+        const data: Array<TraceAnalyticsTimeseriesRow> =
+          await TraceAggregationService.getAnalyticsTimeseries(request);
+
+        return Response.sendJsonObjectResponse(req, res, {
+          data: data as unknown as JSONObject,
+        });
+      }
+
+      if (chartType === "toplist") {
+        const data: Array<TraceAnalyticsTopItem> =
+          await TraceAggregationService.getAnalyticsTopList(request);
+
+        return Response.sendJsonObjectResponse(req, res, {
+          data: data as unknown as JSONObject,
+        });
+      }
+
+      const data: Array<TraceAnalyticsTableRow> =
+        await TraceAggregationService.getAnalyticsTable(request);
+
+      return Response.sendJsonObjectResponse(req, res, {
+        data: data as unknown as JSONObject,
+      });
+    } catch (err: unknown) {
+      next(err);
+    }
+  },
+);
+
 // --- Exception Histogram Endpoint ---
 
 router.post(
   "/telemetry/exceptions/histogram",
-  UserMiddleware.getUserMiddleware,
+  ...requireExceptionReadAccess,
   async (
     req: ExpressRequest,
     res: ExpressResponse,
@@ -917,7 +1175,7 @@ router.post(
 
 router.post(
   "/telemetry/exceptions/facets",
-  UserMiddleware.getUserMiddleware,
+  ...requireExceptionReadAccess,
   async (
     req: ExpressRequest,
     res: ExpressResponse,
@@ -940,7 +1198,7 @@ router.post(
       const facetKeys: Array<string> = body["facetKeys"]
         ? (body["facetKeys"] as Array<string>)
         : [
-            "serviceId",
+            "primaryEntityId",
             "hostId",
             "dockerHostId",
             "kubernetesClusterId",
@@ -1085,7 +1343,7 @@ router.post(
 
 router.post(
   "/telemetry/metrics/facets",
-  UserMiddleware.getUserMiddleware,
+  ...requireMetricReadAccess,
   async (
     req: ExpressRequest,
     res: ExpressResponse,
@@ -1107,7 +1365,7 @@ router.post(
 
       const facetKeys: Array<string> = body["facetKeys"]
         ? (body["facetKeys"] as Array<string>)
-        : ["serviceId", "hostId", "dockerHostId", "kubernetesClusterId"];
+        : ["primaryEntityId", "hostId", "dockerHostId", "kubernetesClusterId"];
 
       const startTime: Date = body["startTime"]
         ? OneUptimeDate.fromString(body["startTime"] as string)
@@ -1217,7 +1475,7 @@ router.post(
 
 router.post(
   "/telemetry/logs/analytics",
-  UserMiddleware.getUserMiddleware,
+  ...requireLogReadAccess,
   async (
     req: ExpressRequest,
     res: ExpressResponse,
@@ -1357,7 +1615,7 @@ router.post(
 
 router.post(
   "/telemetry/logs/export",
-  UserMiddleware.getUserMiddleware,
+  ...requireLogReadAccess,
   async (
     req: ExpressRequest,
     res: ExpressResponse,
@@ -1427,7 +1685,7 @@ router.post(
 
       if (format === "csv") {
         const header: string =
-          "time,serviceId,severityText,severityNumber,body,traceId,spanId,attributes";
+          "time,primaryEntityId,severityText,severityNumber,body,traceId,spanId,attributes";
         const csvRows: Array<string> = rows.map((row: JSONObject) => {
           const escapeCsv: (val: unknown) => string = (
             val: unknown,
@@ -1442,7 +1700,7 @@ router.post(
 
           return [
             escapeCsv(row["time"]),
-            escapeCsv(row["serviceId"]),
+            escapeCsv(row["primaryEntityId"]),
             escapeCsv(row["severityText"]),
             escapeCsv(row["severityNumber"]),
             escapeCsv(row["body"]),
@@ -1479,7 +1737,7 @@ router.post(
 
 router.post(
   "/telemetry/logs/context",
-  UserMiddleware.getUserMiddleware,
+  ...requireLogReadAccess,
   async (
     req: ExpressRequest,
     res: ExpressResponse,
@@ -1500,16 +1758,16 @@ router.post(
       const body: JSONObject = req.body as JSONObject;
 
       const logId: string | undefined = body["logId"] as string | undefined;
-      const serviceId: string | undefined = body["serviceId"] as
-        | string
-        | undefined;
+      // `serviceId` is the pre-rename alias kept for stale clients.
+      const primaryEntityId: string | undefined = (body["primaryEntityId"] ||
+        body["serviceId"]) as string | undefined;
       const time: string | undefined = body["time"] as string | undefined;
 
-      if (!logId || !serviceId || !time) {
+      if (!logId || !primaryEntityId || !time) {
         return Response.sendErrorResponse(
           req,
           res,
-          new BadDataException("logId, serviceId, and time are required"),
+          new BadDataException("logId, primaryEntityId, and time are required"),
         );
       }
 
@@ -1520,7 +1778,7 @@ router.post(
         after: Array<JSONObject>;
       } = await LogAggregationService.getLogContext({
         projectId: databaseProps.tenantId,
-        serviceId: new ObjectID(serviceId),
+        primaryEntityId: new ObjectID(primaryEntityId),
         time: OneUptimeDate.fromString(time),
         logId,
         count,
@@ -1540,7 +1798,7 @@ router.post(
 
 router.post(
   "/telemetry/logs/drop-filter-estimate",
-  UserMiddleware.getUserMiddleware,
+  ...requireLogReadAccess,
   async (
     req: ExpressRequest,
     res: ExpressResponse,
@@ -1647,7 +1905,7 @@ function computeDefaultBucketSize(startTime: Date, endTime: Date): number {
 
 router.post(
   "/telemetry/profiles/get-attributes",
-  UserMiddleware.getUserMiddleware,
+  ...requireProfileReadAccess,
   async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
     return getAttributes(req, res, next, TelemetryType.Profile);
   },
@@ -1657,7 +1915,7 @@ router.post(
 
 router.post(
   "/telemetry/profiles/flamegraph",
-  UserMiddleware.getUserMiddleware,
+  ...requireProfileReadAccess,
   async (
     req: ExpressRequest,
     res: ExpressResponse,
@@ -1730,11 +1988,12 @@ router.post(
           profileTypes.length > 0 && { profileTypes }),
       };
 
-      const flamegraph: ProfileFlamegraphNode =
+      const result: FlamegraphResult =
         await ProfileAggregationService.getFlamegraph(request);
 
       return Response.sendJsonObjectResponse(req, res, {
-        flamegraph: flamegraph as unknown as JSONObject,
+        flamegraph: result.flamegraph as unknown as JSONObject,
+        truncated: result.truncated,
       });
     } catch (err: unknown) {
       next(err);
@@ -1746,7 +2005,7 @@ router.post(
 
 router.post(
   "/telemetry/profiles/function-list",
-  UserMiddleware.getUserMiddleware,
+  ...requireProfileReadAccess,
   async (
     req: ExpressRequest,
     res: ExpressResponse,
@@ -1766,13 +2025,37 @@ router.post(
 
       const body: JSONObject = req.body as JSONObject;
 
-      const startTime: Date = body["startTime"]
+      const profileId: string | undefined = body["profileId"]
+        ? (body["profileId"] as string)
+        : undefined;
+
+      /*
+       * Only default the window when no profileId is given: a profile's
+       * samples are bounded by the profile itself, and a defaulted
+       * last-hour window would silently exclude any profile captured
+       * before the window started.
+       */
+      const startTime: Date | undefined = body["startTime"]
         ? OneUptimeDate.fromString(body["startTime"] as string)
-        : OneUptimeDate.addRemoveHours(OneUptimeDate.getCurrentDate(), -1);
+        : profileId
+          ? undefined
+          : OneUptimeDate.addRemoveHours(OneUptimeDate.getCurrentDate(), -1);
 
-      const endTime: Date = body["endTime"]
+      const endTime: Date | undefined = body["endTime"]
         ? OneUptimeDate.fromString(body["endTime"] as string)
-        : OneUptimeDate.getCurrentDate();
+        : profileId
+          ? undefined
+          : OneUptimeDate.getCurrentDate();
+
+      if (!profileId && !startTime) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException(
+            "Either profileId or startTime must be provided",
+          ),
+        );
+      }
 
       const serviceIds: Array<ObjectID> | undefined = body["serviceIds"]
         ? (body["serviceIds"] as Array<string>).map((id: string) => {
@@ -1805,8 +2088,9 @@ router.post(
 
       const request: FunctionListRequest = {
         projectId: databaseProps.tenantId,
-        startTime,
-        endTime,
+        ...(startTime !== undefined && { startTime }),
+        ...(endTime !== undefined && { endTime }),
+        ...(profileId !== undefined && { profileId }),
         ...(serviceIds !== undefined && { serviceIds }),
         ...(profileType !== undefined && { profileType }),
         ...(profileTypes !== undefined &&
@@ -1815,11 +2099,13 @@ router.post(
         ...(sortBy !== undefined && { sortBy }),
       };
 
-      const functions: Array<FunctionListItem> =
+      const result: FunctionListResult =
         await ProfileAggregationService.getFunctionList(request);
 
       return Response.sendJsonObjectResponse(req, res, {
-        functions: functions as unknown as JSONObject,
+        functions: result.functions as unknown as JSONObject,
+        windowTotal: result.windowTotal,
+        truncated: result.truncated,
       });
     } catch (err: unknown) {
       next(err);
@@ -1831,7 +2117,7 @@ router.post(
 
 router.post(
   "/telemetry/profiles/service-activity",
-  UserMiddleware.getUserMiddleware,
+  ...requireProfileReadAccess,
   async (
     req: ExpressRequest,
     res: ExpressResponse,
@@ -1898,7 +2184,7 @@ router.post(
 
 router.get(
   "/telemetry/profiles/:profileId/pprof",
-  UserMiddleware.getUserMiddleware,
+  ...requireProfileReadAccess,
   async (
     req: ExpressRequest,
     res: ExpressResponse,
@@ -2027,7 +2313,7 @@ router.get(
 
 router.post(
   "/telemetry/profiles/diff-flamegraph",
-  UserMiddleware.getUserMiddleware,
+  ...requireProfileReadAccess,
   async (
     req: ExpressRequest,
     res: ExpressResponse,
@@ -2110,11 +2396,240 @@ router.post(
           profileTypes.length > 0 && { profileTypes }),
       };
 
-      const diffFlamegraph: DiffFlamegraphNode =
+      const result: { diffFlamegraph: DiffFlamegraphNode; truncated: boolean } =
         await ProfileAggregationService.getDiffFlamegraph(request);
 
+      /*
+       * `truncated` is surfaced so the UI can warn that the diff was built
+       * from a capped sample set rather than the full window.
+       */
+      return Response.sendJsonObjectResponse(req, res, {
+        diffFlamegraph: result.diffFlamegraph as unknown as JSONObject,
+        truncated: result.truncated,
+      });
+    } catch (err: unknown) {
+      next(err);
+    }
+  },
+);
+
+// --- Profile Function Focus Endpoint ---
+
+router.post(
+  "/telemetry/profiles/function-focus",
+  ...requireProfileReadAccess,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const databaseProps: DatabaseCommonInteractionProps =
+        await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+      if (!databaseProps?.tenantId) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid Project ID"),
+        );
+      }
+
+      const body: JSONObject = req.body as JSONObject;
+
+      const functionName: string | undefined =
+        body["functionName"] && typeof body["functionName"] === "string"
+          ? (body["functionName"] as string)
+          : undefined;
+
+      if (!functionName) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("functionName is required"),
+        );
+      }
+
+      /*
+       * fileName participates in frame identity (frames match on
+       * functionName + fileName; line numbers are ignored so identity
+       * survives deploys) but may legitimately be empty: folded uploads
+       * produce bare frames with no file information.
+       */
+      const fileName: string =
+        typeof body["fileName"] === "string"
+          ? (body["fileName"] as string)
+          : "";
+
+      const profileId: string | undefined = body["profileId"]
+        ? (body["profileId"] as string)
+        : undefined;
+
+      const startTime: Date | undefined = body["startTime"]
+        ? OneUptimeDate.fromString(body["startTime"] as string)
+        : undefined;
+
+      const endTime: Date | undefined = body["endTime"]
+        ? OneUptimeDate.fromString(body["endTime"] as string)
+        : undefined;
+
+      const serviceIds: Array<ObjectID> | undefined = body["serviceIds"]
+        ? (body["serviceIds"] as Array<string>).map((id: string) => {
+            return new ObjectID(id);
+          })
+        : undefined;
+
+      const profileType: string | undefined = body["profileType"]
+        ? (body["profileType"] as string)
+        : undefined;
+
+      const profileTypes: Array<string> | undefined = Array.isArray(
+        body["profileTypes"],
+      )
+        ? (body["profileTypes"] as Array<string>).filter(
+            (t: unknown): t is string => {
+              return typeof t === "string" && t.length > 0;
+            },
+          )
+        : undefined;
+
+      if (!profileId && !startTime) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException(
+            "Either profileId or startTime must be provided",
+          ),
+        );
+      }
+
+      const request: FunctionFocusRequest = {
+        projectId: databaseProps.tenantId,
+        functionName,
+        fileName,
+        ...(profileId !== undefined && { profileId }),
+        ...(startTime !== undefined && { startTime }),
+        ...(endTime !== undefined && { endTime }),
+        ...(serviceIds !== undefined && { serviceIds }),
+        ...(profileType !== undefined && { profileType }),
+        ...(profileTypes !== undefined &&
+          profileTypes.length > 0 && { profileTypes }),
+      };
+
+      const result: FunctionFocusResult =
+        await ProfileAggregationService.getFunctionFocus(request);
+
+      return Response.sendJsonObjectResponse(req, res, {
+        functionName: result.functionName,
+        fileName: result.fileName,
+        totalValue: result.totalValue,
+        selfValue: result.selfValue,
+        sampleCount: result.sampleCount,
+        windowTotal: result.windowTotal,
+        callers: result.callers as unknown as JSONObject,
+        callees: result.callees as unknown as JSONObject,
+        truncated: result.truncated,
+      });
+    } catch (err: unknown) {
+      next(err);
+    }
+  },
+);
+
+// --- Profile Breakdown Endpoint ---
+
+router.post(
+  "/telemetry/profiles/breakdown",
+  ...requireProfileReadAccess,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const databaseProps: DatabaseCommonInteractionProps =
+        await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+      if (!databaseProps?.tenantId) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid Project ID"),
+        );
+      }
+
+      const body: JSONObject = req.body as JSONObject;
+
+      const startTime: Date | undefined = body["startTime"]
+        ? OneUptimeDate.fromString(body["startTime"] as string)
+        : undefined;
+
+      const endTime: Date | undefined = body["endTime"]
+        ? OneUptimeDate.fromString(body["endTime"] as string)
+        : undefined;
+
+      /*
+       * breakdownBy is either the reserved key 'service' (grouping by
+       * primaryEntityId, resolved to display names by the UI) or a Profile
+       * attribute key.
+       */
+      const breakdownBy: string | undefined =
+        body["breakdownBy"] && typeof body["breakdownBy"] === "string"
+          ? (body["breakdownBy"] as string)
+          : undefined;
+
+      if (!startTime || !endTime || !breakdownBy) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException(
+            "startTime, endTime, and breakdownBy are all required",
+          ),
+        );
+      }
+
+      const serviceIds: Array<ObjectID> | undefined = body["serviceIds"]
+        ? (body["serviceIds"] as Array<string>).map((id: string) => {
+            return new ObjectID(id);
+          })
+        : undefined;
+
+      const profileType: string | undefined = body["profileType"]
+        ? (body["profileType"] as string)
+        : undefined;
+
+      const profileTypes: Array<string> | undefined = Array.isArray(
+        body["profileTypes"],
+      )
+        ? (body["profileTypes"] as Array<string>).filter(
+            (t: unknown): t is string => {
+              return typeof t === "string" && t.length > 0;
+            },
+          )
+        : undefined;
+
+      const limit: number | undefined = body["limit"]
+        ? (body["limit"] as number)
+        : undefined;
+
+      const request: BreakdownRequest = {
+        projectId: databaseProps.tenantId,
+        startTime,
+        endTime,
+        breakdownBy,
+        ...(serviceIds !== undefined && { serviceIds }),
+        ...(profileType !== undefined && { profileType }),
+        ...(profileTypes !== undefined &&
+          profileTypes.length > 0 && { profileTypes }),
+        ...(limit !== undefined && { limit }),
+      };
+
+      const result: BreakdownResult =
+        await ProfileAggregationService.getBreakdown(request);
+
       return Response.sendJsonObjectResponse(req, res, {
-        diffFlamegraph: diffFlamegraph as unknown as JSONObject,
+        items: result.items as unknown as JSONObject,
+        totalSampleCount: result.totalSampleCount,
       });
     } catch (err: unknown) {
       next(err);