@oneuptime/common 10.8.2 → 11.0.0

package/build/dist/Server/API/TelemetryAPI.js

@@ -14,32 +14,73 @@ import PprofEncoder from "../Utils/Profile/PprofEncoder";
 import ProfileService from "../Services/ProfileService";
 import ProfileSampleService from "../Services/ProfileSampleService";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
+import Permission from "../../Types/Permission";
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
 import ResourceFacetResolver from "../Utils/Telemetry/ResourceFacetResolver";
 const router = Express.getRouter();
-router.post("/telemetry/metrics/get-attributes", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+const createTelemetryReadAccessGuard = (signalReadPermission) => {
+    return [
+        UserMiddleware.getUserMiddleware,
+        UserMiddleware.requireUserAuthentication,
+        UserMiddleware.requirePermission({
+            permissions: [
+                Permission.ProjectOwner,
+                Permission.ProjectAdmin,
+                Permission.ProjectMember,
+                Permission.Viewer,
+                Permission.TelemetryAdmin,
+                Permission.TelemetryMember,
+                Permission.TelemetryViewer,
+                signalReadPermission,
+            ],
+        }),
+    ];
+};
+// Mirrors the read access control declared on the Log analytics model.
+const requireLogReadAccess = createTelemetryReadAccessGuard(Permission.ReadTelemetryServiceLog);
+// Mirrors the read access control declared on the Span analytics model.
+const requireTraceReadAccess = createTelemetryReadAccessGuard(Permission.ReadTelemetryServiceTraces);
+/*
+ * Mirrors the read access control declared on the Metric analytics model,
+ * whose table-level read list grants ReadTelemetryServiceTraces rather than
+ * ReadTelemetryServiceMetrics. The guard follows the model declaration so
+ * these routes stay in lockstep with the model-backed CRUD API; if the model
+ * ever switches to ReadTelemetryServiceMetrics this must change with it.
+ */
+const requireMetricReadAccess = createTelemetryReadAccessGuard(Permission.ReadTelemetryServiceTraces);
+/*
+ * Mirrors the read access control declared on the ExceptionInstance
+ * analytics model.
+ */
+const requireExceptionReadAccess = createTelemetryReadAccessGuard(Permission.ReadTelemetryException);
+/*
+ * Mirrors the read access control declared on the Profile / ProfileSample
+ * analytics models.
+ */
+const requireProfileReadAccess = createTelemetryReadAccessGuard(Permission.ReadTelemetryServiceProfiles);
+router.post("/telemetry/metrics/get-attributes", ...requireMetricReadAccess, async (req, res, next) => {
     return getAttributes(req, res, next, TelemetryType.Metric);
 });
-router.post("/telemetry/metrics/get-attribute-values", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/metrics/get-attribute-values", ...requireMetricReadAccess, async (req, res, next) => {
     return getAttributeValues(req, res, next, TelemetryType.Metric);
 });
-router.post("/telemetry/logs/get-attributes", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/logs/get-attributes", ...requireLogReadAccess, async (req, res, next) => {
     return getAttributes(req, res, next, TelemetryType.Log);
 });
-router.post("/telemetry/logs/get-attribute-values", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/logs/get-attribute-values", ...requireLogReadAccess, async (req, res, next) => {
     return getAttributeValues(req, res, next, TelemetryType.Log);
 });
-router.post("/telemetry/traces/get-attributes", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/traces/get-attributes", ...requireTraceReadAccess, async (req, res, next) => {
     return getAttributes(req, res, next, TelemetryType.Trace);
 });
-router.post("/telemetry/traces/get-attribute-values", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/traces/get-attribute-values", ...requireTraceReadAccess, async (req, res, next) => {
     return getAttributeValues(req, res, next, TelemetryType.Trace);
 });
-router.post("/telemetry/exceptions/get-attributes", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/exceptions/get-attributes", ...requireExceptionReadAccess, async (req, res, next) => {
     return getAttributes(req, res, next, TelemetryType.Exception);
 });
-router.post("/telemetry/exceptions/get-attribute-values", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/exceptions/get-attribute-values", ...requireExceptionReadAccess, async (req, res, next) => {
     return getAttributeValues(req, res, next, TelemetryType.Exception);
 });
 const getAttributes = async (req, res, next, telemetryType) => {
@@ -104,7 +145,7 @@ const getAttributeValues = async (req, res, next, telemetryType) => {
     }
 };
 // --- Log Histogram Endpoint ---
-router.post("/telemetry/logs/histogram", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/logs/histogram", ...requireLogReadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
         if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
@@ -124,6 +165,9 @@ router.post("/telemetry/logs/histogram", UserMiddleware.getUserMiddleware, async
                 return new ObjectID(id);
             })
             : undefined;
+        const entityKeys = body["entityKeys"]
+            ? body["entityKeys"]
+            : undefined;
         const severityTexts = body["severityTexts"]
             ? body["severityTexts"]
             : undefined;
@@ -145,6 +189,7 @@ router.post("/telemetry/logs/histogram", UserMiddleware.getUserMiddleware, async
             endTime,
             bucketSizeInMinutes,
             serviceIds,
+            entityKeys,
             severityTexts,
             bodySearchText,
             traceIds,
@@ -161,7 +206,7 @@ router.post("/telemetry/logs/histogram", UserMiddleware.getUserMiddleware, async
     }
 });
 // --- Log Facets Endpoint ---
-router.post("/telemetry/logs/facets", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/logs/facets", ...requireLogReadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
         if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
@@ -170,7 +215,7 @@ router.post("/telemetry/logs/facets", UserMiddleware.getUserMiddleware, async (r
         const body = req.body;
         const facetKeys = body["facetKeys"]
             ? body["facetKeys"]
-            : ["severityText", "serviceId"];
+            : ["severityText", "primaryEntityId"];
         const startTime = body["startTime"]
             ? OneUptimeDate.fromString(body["startTime"])
             : OneUptimeDate.addRemoveHours(OneUptimeDate.getCurrentDate(), -1);
@@ -183,6 +228,9 @@ router.post("/telemetry/logs/facets", UserMiddleware.getUserMiddleware, async (r
                 return new ObjectID(id);
             })
             : undefined;
+        const entityKeys = body["entityKeys"]
+            ? body["entityKeys"]
+            : undefined;
         const severityTexts = body["severityTexts"]
             ? body["severityTexts"]
             : undefined;
@@ -200,9 +248,9 @@ router.post("/telemetry/logs/facets", UserMiddleware.getUserMiddleware, async (r
             : undefined;
         /*
          * Per-facet partial-match filter applied at the Postgres source-of-truth
-         * lookup stage. Only consulted for resource facets (serviceId / hostId /
-         * dockerHostId / kubernetesClusterId) — other facets continue to filter
-         * client-side over the loaded value list.
+         * lookup stage. Only consulted for resource facets (primaryEntityId /
+         * hostId / dockerHostId / kubernetesClusterId) — other facets continue
+         * to filter client-side over the loaded value list.
          */
         const facetSearchText = body["facetSearchText"]
             ? body["facetSearchText"]
@@ -225,6 +273,7 @@ router.post("/telemetry/logs/facets", UserMiddleware.getUserMiddleware, async (r
                     facetKey,
                     limit,
                     serviceIds,
+                    entityKeys,
                     severityTexts,
                     bodySearchText,
                     traceIds,
@@ -276,8 +325,103 @@ router.post("/telemetry/logs/facets", UserMiddleware.getUserMiddleware, async (r
         next(err);
     }
 });
+/*
+ * Shared body parsing for every trace aggregation endpoint (histogram,
+ * facets, analytics). Defensive about shapes: arrays are validated and
+ * filtered to strings, booleans/numbers use strict typeof checks (JSON null
+ * or a stringly-typed value must mean "no filter", never an active
+ * predicate).
+ */
+function parseTraceFilterBody(body) {
+    var _a;
+    const serviceIds = Array.isArray(body["serviceIds"])
+        ? body["serviceIds"]
+            .filter((v) => {
+            return typeof v === "string";
+        })
+            .map((id) => {
+            return new ObjectID(id);
+        })
+        : undefined;
+    const stringArray = (key) => {
+        return Array.isArray(body[key])
+            ? body[key].filter((v) => {
+                return typeof v === "string";
+            })
+            : undefined;
+    };
+    /*
+     * Numeric strings are coerced (stringly-typed clients worked before the
+     * parsing was centralized) — dropping them would silently widen the
+     * filter to all statuses.
+     */
+    const statusCodes = Array.isArray(body["statusCodes"])
+        ? body["statusCodes"]
+            .map((v) => {
+            return typeof v === "number" ? v : Number(v);
+        })
+            .filter((v) => {
+            return Number.isFinite(v);
+        })
+        : undefined;
+    const stringRecord = (key) => {
+        const raw = body[key];
+        if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+            return undefined;
+        }
+        const entries = Object.entries(raw).filter((entry) => {
+            return typeof entry[1] === "string";
+        });
+        if (entries.length === 0) {
+            return undefined;
+        }
+        return Object.fromEntries(entries);
+    };
+    return {
+        serviceIds,
+        entityKeys: stringArray("entityKeys"),
+        statusCodes,
+        spanKinds: stringArray("spanKinds"),
+        spanNames: stringArray("spanNames"),
+        /*
+         * spanNameSearches is the only multiplicative filter (one ILIKE
+         * predicate per entry) — cap it. The dashboard sends at most one.
+         */
+        spanNameSearches: (_a = stringArray("spanNameSearches")) === null || _a === void 0 ? void 0 : _a.slice(0, 10),
+        spanIds: stringArray("spanIds"),
+        traceIds: stringArray("traceIds"),
+        nameSearchText: typeof body["nameSearchText"] === "string" && body["nameSearchText"]
+            ? body["nameSearchText"]
+            : undefined,
+        statusMessageSearchText: typeof body["statusMessageSearchText"] === "string" &&
+            body["statusMessageSearchText"]
+            ? body["statusMessageSearchText"]
+            : undefined,
+        statusMessages: stringArray("statusMessages"),
+        /*
+         * Strict boolean check — unlike rootOnly, a coerced `false` is a
+         * meaningful predicate here (JSON null must mean "no filter", not
+         * "exclude exception spans").
+         */
+        hasException: typeof body["hasException"] === "boolean"
+            ? body["hasException"]
+            : undefined,
+        minDurationNano: typeof body["minDurationNano"] === "number"
+            ? body["minDurationNano"]
+            : undefined,
+        maxDurationNano: typeof body["maxDurationNano"] === "number"
+            ? body["maxDurationNano"]
+            : undefined,
+        exactDurationNano: typeof body["exactDurationNano"] === "number"
+            ? body["exactDurationNano"]
+            : undefined,
+        rootOnly: body["rootOnly"] === undefined ? undefined : Boolean(body["rootOnly"]),
+        attributes: stringRecord("attributes"),
+        attributeSearches: stringRecord("attributeSearches"),
+    };
+}
 // --- Trace Histogram Endpoint ---
-router.post("/telemetry/traces/histogram", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/traces/histogram", ...requireTraceReadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
         if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
@@ -292,44 +436,10 @@ router.post("/telemetry/traces/histogram", UserMiddleware.getUserMiddleware, asy
             : OneUptimeDate.getCurrentDate();
         const bucketSizeInMinutes = body["bucketSizeInMinutes"] ||
             computeDefaultBucketSize(startTime, endTime);
-        const serviceIds = body["serviceIds"]
-            ? body["serviceIds"].map((id) => {
-                return new ObjectID(id);
-            })
-            : undefined;
-        const statusCodes = body["statusCodes"]
-            ? body["statusCodes"]
-            : undefined;
-        const spanKinds = body["spanKinds"]
-            ? body["spanKinds"]
-            : undefined;
-        const spanNames = body["spanNames"]
-            ? body["spanNames"]
-            : undefined;
-        const traceIds = body["traceIds"]
-            ? body["traceIds"]
-            : undefined;
-        const nameSearchText = body["nameSearchText"]
-            ? body["nameSearchText"]
-            : undefined;
-        const rootOnly = body["rootOnly"] === undefined ? undefined : Boolean(body["rootOnly"]);
-        const attributes = body["attributes"]
-            ? body["attributes"]
-            : undefined;
-        const request = {
-            projectId: databaseProps.tenantId,
-            startTime,
+        const traceFilters = parseTraceFilterBody(body);
+        const request = Object.assign({ projectId: databaseProps.tenantId, startTime,
             endTime,
-            bucketSizeInMinutes,
-            serviceIds,
-            statusCodes,
-            spanKinds,
-            spanNames,
-            traceIds,
-            nameSearchText,
-            rootOnly,
-            attributes,
-        };
+            bucketSizeInMinutes }, traceFilters);
         const buckets = await TraceAggregationService.getHistogram(request);
         return Response.sendJsonObjectResponse(req, res, {
             buckets: buckets,
@@ -340,7 +450,7 @@ router.post("/telemetry/traces/histogram", UserMiddleware.getUserMiddleware, asy
     }
 });
 // --- Trace Facets Endpoint ---
-router.post("/telemetry/traces/facets", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/traces/facets", ...requireTraceReadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
         if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
@@ -349,7 +459,7 @@ router.post("/telemetry/traces/facets", UserMiddleware.getUserMiddleware, async
         const body = req.body;
         const facetKeys = body["facetKeys"]
             ? body["facetKeys"]
-            : ["serviceId", "statusCode", "kind", "name"];
+            : ["primaryEntityId", "statusCode", "kind", "name"];
         const startTime = body["startTime"]
             ? OneUptimeDate.fromString(body["startTime"])
             : OneUptimeDate.addRemoveHours(OneUptimeDate.getCurrentDate(), -1);
@@ -357,35 +467,12 @@ router.post("/telemetry/traces/facets", UserMiddleware.getUserMiddleware, async
             ? OneUptimeDate.fromString(body["endTime"])
             : OneUptimeDate.getCurrentDate();
         const limit = body["limit"] || 500;
-        const serviceIds = body["serviceIds"]
-            ? body["serviceIds"].map((id) => {
-                return new ObjectID(id);
-            })
-            : undefined;
-        const statusCodes = body["statusCodes"]
-            ? body["statusCodes"]
-            : undefined;
-        const spanKinds = body["spanKinds"]
-            ? body["spanKinds"]
-            : undefined;
-        const spanNames = body["spanNames"]
-            ? body["spanNames"]
-            : undefined;
-        const traceIds = body["traceIds"]
-            ? body["traceIds"]
-            : undefined;
-        const nameSearchText = body["nameSearchText"]
-            ? body["nameSearchText"]
-            : undefined;
-        const rootOnly = body["rootOnly"] === undefined ? undefined : Boolean(body["rootOnly"]);
-        const attributes = body["attributes"]
-            ? body["attributes"]
-            : undefined;
+        const traceFilters = parseTraceFilterBody(body);
         /*
          * Per-facet partial-match filter applied at the Postgres source-of-truth
-         * lookup stage. Only consulted for resource facets (serviceId / hostId /
-         * dockerHostId / kubernetesClusterId) — other facets continue to filter
-         * client-side over the loaded value list.
+         * lookup stage. Only consulted for resource facets (primaryEntityId /
+         * hostId / dockerHostId / kubernetesClusterId) — other facets continue
+         * to filter client-side over the loaded value list.
          */
         const facetSearchText = body["facetSearchText"]
             ? body["facetSearchText"]
@@ -396,24 +483,14 @@ router.post("/telemetry/traces/facets", UserMiddleware.getUserMiddleware, async
          * and the recent-N sample (kind + attribute facets, which have no cheap
          * exact path).
          */
-        const multiRequest = {
-            projectId: databaseProps.tenantId,
-            startTime,
+        const multiRequest = Object.assign({ projectId: databaseProps.tenantId, startTime,
             endTime,
             facetKeys,
-            limit,
-            serviceIds,
-            statusCodes,
-            spanKinds,
-            spanNames,
-            traceIds,
-            nameSearchText,
-            rootOnly,
-            attributes,
-        };
+            limit }, traceFilters);
         /*
-         * Resource facets (serviceId / hostId / dockerHostId / k8s cluster ...)
-         * and statusCode are counted with an exact, projection-backed GROUP BY
+         * Resource facets (primaryEntityId / hostId / dockerHostId / k8s
+         * cluster ...) and statusCode are counted with an exact,
+         * projection-backed GROUP BY
          * in getResourceFacetCounts(). The recent-N sample below saturates with
          * whichever service is chattiest right now and reports 0 for every other
          * service regardless of its true volume over the window — the "top 1000"
@@ -466,8 +543,8 @@ router.post("/telemetry/traces/facets", UserMiddleware.getUserMiddleware, async
         /*
          * Replace resource-facet results with the Postgres source-of-truth list
          * (filtered by facetSearchText and enriched with displayName). Every
-         * resource facet shares the same exact serviceId -> count map; resource
-         * ids are globally unique, so each facet only ever resolves its own
+         * resource facet shares the same exact primaryEntityId -> count map;
+         * resource ids are globally unique, so each facet only ever resolves its own
          * entities. Entities with no telemetry in the window surface with count
          * 0 instead of being hidden, and the search box can find resources
          * beyond the loaded subset.
@@ -498,8 +575,79 @@ router.post("/telemetry/traces/facets", UserMiddleware.getUserMiddleware, async
         next(err);
     }
 });
+// --- Trace Analytics Endpoint ---
+router.post("/telemetry/traces/analytics", ...requireTraceReadAccess, async (req, res, next) => {
+    try {
+        const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
+            return Response.sendErrorResponse(req, res, new BadDataException("Invalid Project ID"));
+        }
+        const body = req.body;
+        const chartType = body["chartType"] || "timeseries";
+        if (!["timeseries", "toplist", "table"].includes(chartType)) {
+            return Response.sendErrorResponse(req, res, new BadDataException("Invalid chartType"));
+        }
+        const metric = body["metric"] || "count";
+        if (!TraceAggregationService.isValidAnalyticsMetric(metric)) {
+            return Response.sendErrorResponse(req, res, new BadDataException("Invalid metric"));
+        }
+        const startTime = body["startTime"]
+            ? OneUptimeDate.fromString(body["startTime"])
+            : OneUptimeDate.addRemoveHours(OneUptimeDate.getCurrentDate(), -1);
+        const endTime = body["endTime"]
+            ? OneUptimeDate.fromString(body["endTime"])
+            : OneUptimeDate.getCurrentDate();
+        const rawBucketSize = Number(body["bucketSizeInMinutes"]);
+        const bucketSizeInMinutes = Number.isFinite(rawBucketSize) && rawBucketSize >= 1
+            ? Math.trunc(rawBucketSize)
+            : computeDefaultBucketSize(startTime, endTime);
+        const groupBy = Array.isArray(body["groupBy"])
+            ? body["groupBy"].filter((v) => {
+                return typeof v === "string" && v.length > 0;
+            })
+            : undefined;
+        /*
+         * Clamp to a sane integer range — `limit` flows into LIMIT and the
+         * timeseries series cap, so negative/fractional values would 500 in
+         * ClickHouse and huge values would explode the result set. Numeric
+         * strings are accepted (dashboard widget arguments are stored as
+         * strings).
+         */
+        const rawLimit = Number(body["limit"]);
+        const limit = Number.isFinite(rawLimit)
+            ? Math.min(Math.max(Math.trunc(rawLimit), 1), 1000)
+            : undefined;
+        const traceFilters = parseTraceFilterBody(body);
+        const request = Object.assign({ projectId: databaseProps.tenantId, startTime,
+            endTime,
+            bucketSizeInMinutes,
+            chartType,
+            metric,
+            groupBy,
+            limit }, traceFilters);
+        if (chartType === "timeseries") {
+            const data = await TraceAggregationService.getAnalyticsTimeseries(request);
+            return Response.sendJsonObjectResponse(req, res, {
+                data: data,
+            });
+        }
+        if (chartType === "toplist") {
+            const data = await TraceAggregationService.getAnalyticsTopList(request);
+            return Response.sendJsonObjectResponse(req, res, {
+                data: data,
+            });
+        }
+        const data = await TraceAggregationService.getAnalyticsTable(request);
+        return Response.sendJsonObjectResponse(req, res, {
+            data: data,
+        });
+    }
+    catch (err) {
+        next(err);
+    }
+});
 // --- Exception Histogram Endpoint ---
-router.post("/telemetry/exceptions/histogram", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/exceptions/histogram", ...requireExceptionReadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
         if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
@@ -558,7 +706,7 @@ router.post("/telemetry/exceptions/histogram", UserMiddleware.getUserMiddleware,
     }
 });
 // --- Exception Facets Endpoint ---
-router.post("/telemetry/exceptions/facets", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/exceptions/facets", ...requireExceptionReadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
         if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
@@ -568,7 +716,7 @@ router.post("/telemetry/exceptions/facets", UserMiddleware.getUserMiddleware, as
         const facetKeys = body["facetKeys"]
             ? body["facetKeys"]
             : [
-                "serviceId",
+                "primaryEntityId",
                 "hostId",
                 "dockerHostId",
                 "kubernetesClusterId",
@@ -676,7 +824,7 @@ router.post("/telemetry/exceptions/facets", UserMiddleware.getUserMiddleware, as
     }
 });
 // --- Metric Facets Endpoint ---
-router.post("/telemetry/metrics/facets", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/metrics/facets", ...requireMetricReadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
         if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
@@ -685,7 +833,7 @@ router.post("/telemetry/metrics/facets", UserMiddleware.getUserMiddleware, async
         const body = req.body;
         const facetKeys = body["facetKeys"]
             ? body["facetKeys"]
-            : ["serviceId", "hostId", "dockerHostId", "kubernetesClusterId"];
+            : ["primaryEntityId", "hostId", "dockerHostId", "kubernetesClusterId"];
         const startTime = body["startTime"]
             ? OneUptimeDate.fromString(body["startTime"])
             : OneUptimeDate.addRemoveHours(OneUptimeDate.getCurrentDate(), -1);
@@ -764,7 +912,7 @@ router.post("/telemetry/metrics/facets", UserMiddleware.getUserMiddleware, async
     }
 });
 // --- Log Analytics Endpoint ---
-router.post("/telemetry/logs/analytics", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/logs/analytics", ...requireLogReadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
         if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
@@ -852,7 +1000,7 @@ router.post("/telemetry/logs/analytics", UserMiddleware.getUserMiddleware, async
     }
 });
 // --- Log Export Endpoint ---
-router.post("/telemetry/logs/export", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/logs/export", ...requireLogReadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
         if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
@@ -896,7 +1044,7 @@ router.post("/telemetry/logs/export", UserMiddleware.getUserMiddleware, async (r
             spanIds,
         });
         if (format === "csv") {
-            const header = "time,serviceId,severityText,severityNumber,body,traceId,spanId,attributes";
+            const header = "time,primaryEntityId,severityText,severityNumber,body,traceId,spanId,attributes";
             const csvRows = rows.map((row) => {
                 const escapeCsv = (val) => {
                     const str = val === null || val === undefined ? "" : String(val);
@@ -907,7 +1055,7 @@ router.post("/telemetry/logs/export", UserMiddleware.getUserMiddleware, async (r
                 };
                 return [
                     escapeCsv(row["time"]),
-                    escapeCsv(row["serviceId"]),
+                    escapeCsv(row["primaryEntityId"]),
                     escapeCsv(row["severityText"]),
                     escapeCsv(row["severityNumber"]),
                     escapeCsv(row["body"]),
@@ -932,7 +1080,7 @@ router.post("/telemetry/logs/export", UserMiddleware.getUserMiddleware, async (r
     }
 });
 // --- Log Context Endpoint ---
-router.post("/telemetry/logs/context", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/logs/context", ...requireLogReadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
         if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
@@ -940,15 +1088,17 @@ router.post("/telemetry/logs/context", UserMiddleware.getUserMiddleware, async (
         }
         const body = req.body;
         const logId = body["logId"];
-        const serviceId = body["serviceId"];
+        // `serviceId` is the pre-rename alias kept for stale clients.
+        const primaryEntityId = (body["primaryEntityId"] ||
+            body["serviceId"]);
         const time = body["time"];
-        if (!logId || !serviceId || !time) {
-            return Response.sendErrorResponse(req, res, new BadDataException("logId, serviceId, and time are required"));
+        if (!logId || !primaryEntityId || !time) {
+            return Response.sendErrorResponse(req, res, new BadDataException("logId, primaryEntityId, and time are required"));
         }
         const count = body["count"] || 5;
         const result = await LogAggregationService.getLogContext({
             projectId: databaseProps.tenantId,
-            serviceId: new ObjectID(serviceId),
+            primaryEntityId: new ObjectID(primaryEntityId),
             time: OneUptimeDate.fromString(time),
             logId,
             count,
@@ -963,7 +1113,7 @@ router.post("/telemetry/logs/context", UserMiddleware.getUserMiddleware, async (
     }
 });
 // --- Drop Filter Estimate Endpoint ---
-router.post("/telemetry/logs/drop-filter-estimate", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/logs/drop-filter-estimate", ...requireLogReadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
         if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
@@ -1028,11 +1178,11 @@ function computeDefaultBucketSize(startTime, endTime) {
     return 1440;
 }
 // --- Profile Get Attributes Endpoint ---
-router.post("/telemetry/profiles/get-attributes", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/profiles/get-attributes", ...requireProfileReadAccess, async (req, res, next) => {
     return getAttributes(req, res, next, TelemetryType.Profile);
 });
 // --- Profile Flamegraph Endpoint ---
-router.post("/telemetry/profiles/flamegraph", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/profiles/flamegraph", ...requireProfileReadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
         if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
@@ -1066,9 +1216,10 @@ router.post("/telemetry/profiles/flamegraph", UserMiddleware.getUserMiddleware,
         }
         const request = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ projectId: databaseProps.tenantId }, (profileId !== undefined && { profileId })), (startTime !== undefined && { startTime })), (endTime !== undefined && { endTime })), (serviceIds !== undefined && { serviceIds })), (profileType !== undefined && { profileType })), (profileTypes !== undefined &&
             profileTypes.length > 0 && { profileTypes }));
-        const flamegraph = await ProfileAggregationService.getFlamegraph(request);
+        const result = await ProfileAggregationService.getFlamegraph(request);
         return Response.sendJsonObjectResponse(req, res, {
-            flamegraph: flamegraph,
+            flamegraph: result.flamegraph,
+            truncated: result.truncated,
         });
     }
     catch (err) {
@@ -1076,19 +1227,35 @@ router.post("/telemetry/profiles/flamegraph", UserMiddleware.getUserMiddleware,
     }
 });
 // --- Profile Function List Endpoint ---
-router.post("/telemetry/profiles/function-list", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/profiles/function-list", ...requireProfileReadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
         if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
             return Response.sendErrorResponse(req, res, new BadDataException("Invalid Project ID"));
         }
         const body = req.body;
+        const profileId = body["profileId"]
+            ? body["profileId"]
+            : undefined;
+        /*
+         * Only default the window when no profileId is given: a profile's
+         * samples are bounded by the profile itself, and a defaulted
+         * last-hour window would silently exclude any profile captured
+         * before the window started.
+         */
         const startTime = body["startTime"]
             ? OneUptimeDate.fromString(body["startTime"])
-            : OneUptimeDate.addRemoveHours(OneUptimeDate.getCurrentDate(), -1);
+            : profileId
+                ? undefined
+                : OneUptimeDate.addRemoveHours(OneUptimeDate.getCurrentDate(), -1);
         const endTime = body["endTime"]
             ? OneUptimeDate.fromString(body["endTime"])
-            : OneUptimeDate.getCurrentDate();
+            : profileId
+                ? undefined
+                : OneUptimeDate.getCurrentDate();
+        if (!profileId && !startTime) {
+            return Response.sendErrorResponse(req, res, new BadDataException("Either profileId or startTime must be provided"));
+        }
         const serviceIds = body["serviceIds"]
             ? body["serviceIds"].map((id) => {
                 return new ObjectID(id);
@@ -1108,12 +1275,13 @@ router.post("/telemetry/profiles/function-list", UserMiddleware.getUserMiddlewar
         const sortBy = body["sortBy"]
             ? body["sortBy"]
             : undefined;
-        const request = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ projectId: databaseProps.tenantId, startTime,
-            endTime }, (serviceIds !== undefined && { serviceIds })), (profileType !== undefined && { profileType })), (profileTypes !== undefined &&
+        const request = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ projectId: databaseProps.tenantId }, (startTime !== undefined && { startTime })), (endTime !== undefined && { endTime })), (profileId !== undefined && { profileId })), (serviceIds !== undefined && { serviceIds })), (profileType !== undefined && { profileType })), (profileTypes !== undefined &&
             profileTypes.length > 0 && { profileTypes })), (limit !== undefined && { limit })), (sortBy !== undefined && { sortBy }));
-        const functions = await ProfileAggregationService.getFunctionList(request);
+        const result = await ProfileAggregationService.getFunctionList(request);
         return Response.sendJsonObjectResponse(req, res, {
-            functions: functions,
+            functions: result.functions,
+            windowTotal: result.windowTotal,
+            truncated: result.truncated,
         });
     }
     catch (err) {
@@ -1121,7 +1289,7 @@ router.post("/telemetry/profiles/function-list", UserMiddleware.getUserMiddlewar
     }
 });
 // --- Profile Service Activity Endpoint ---
-router.post("/telemetry/profiles/service-activity", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/profiles/service-activity", ...requireProfileReadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
         if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
@@ -1155,7 +1323,7 @@ router.post("/telemetry/profiles/service-activity", UserMiddleware.getUserMiddle
     }
 });
 // --- Profile pprof Export Endpoint ---
-router.get("/telemetry/profiles/:profileId/pprof", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.get("/telemetry/profiles/:profileId/pprof", ...requireProfileReadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
         if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
@@ -1244,7 +1412,7 @@ router.get("/telemetry/profiles/:profileId/pprof", UserMiddleware.getUserMiddlew
     }
 });
 // --- Profile Diff Flamegraph Endpoint ---
-router.post("/telemetry/profiles/diff-flamegraph", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+router.post("/telemetry/profiles/diff-flamegraph", ...requireProfileReadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
         if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
@@ -1287,9 +1455,137 @@ router.post("/telemetry/profiles/diff-flamegraph", UserMiddleware.getUserMiddlew
             comparisonStartTime,
             comparisonEndTime }, (serviceIds !== undefined && { serviceIds })), (profileType !== undefined && { profileType })), (profileTypes !== undefined &&
             profileTypes.length > 0 && { profileTypes }));
-        const diffFlamegraph = await ProfileAggregationService.getDiffFlamegraph(request);
+        const result = await ProfileAggregationService.getDiffFlamegraph(request);
+        /*
+         * `truncated` is surfaced so the UI can warn that the diff was built
+         * from a capped sample set rather than the full window.
+         */
+        return Response.sendJsonObjectResponse(req, res, {
+            diffFlamegraph: result.diffFlamegraph,
+            truncated: result.truncated,
+        });
+    }
+    catch (err) {
+        next(err);
+    }
+});
+// --- Profile Function Focus Endpoint ---
+router.post("/telemetry/profiles/function-focus", ...requireProfileReadAccess, async (req, res, next) => {
+    try {
+        const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
+            return Response.sendErrorResponse(req, res, new BadDataException("Invalid Project ID"));
+        }
+        const body = req.body;
+        const functionName = body["functionName"] && typeof body["functionName"] === "string"
+            ? body["functionName"]
+            : undefined;
+        if (!functionName) {
+            return Response.sendErrorResponse(req, res, new BadDataException("functionName is required"));
+        }
+        /*
+         * fileName participates in frame identity (frames match on
+         * functionName + fileName; line numbers are ignored so identity
+         * survives deploys) but may legitimately be empty: folded uploads
+         * produce bare frames with no file information.
+         */
+        const fileName = typeof body["fileName"] === "string"
+            ? body["fileName"]
+            : "";
+        const profileId = body["profileId"]
+            ? body["profileId"]
+            : undefined;
+        const startTime = body["startTime"]
+            ? OneUptimeDate.fromString(body["startTime"])
+            : undefined;
+        const endTime = body["endTime"]
+            ? OneUptimeDate.fromString(body["endTime"])
+            : undefined;
+        const serviceIds = body["serviceIds"]
+            ? body["serviceIds"].map((id) => {
+                return new ObjectID(id);
+            })
+            : undefined;
+        const profileType = body["profileType"]
+            ? body["profileType"]
+            : undefined;
+        const profileTypes = Array.isArray(body["profileTypes"])
+            ? body["profileTypes"].filter((t) => {
+                return typeof t === "string" && t.length > 0;
+            })
+            : undefined;
+        if (!profileId && !startTime) {
+            return Response.sendErrorResponse(req, res, new BadDataException("Either profileId or startTime must be provided"));
+        }
+        const request = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ projectId: databaseProps.tenantId, functionName,
+            fileName }, (profileId !== undefined && { profileId })), (startTime !== undefined && { startTime })), (endTime !== undefined && { endTime })), (serviceIds !== undefined && { serviceIds })), (profileType !== undefined && { profileType })), (profileTypes !== undefined &&
+            profileTypes.length > 0 && { profileTypes }));
+        const result = await ProfileAggregationService.getFunctionFocus(request);
+        return Response.sendJsonObjectResponse(req, res, {
+            functionName: result.functionName,
+            fileName: result.fileName,
+            totalValue: result.totalValue,
+            selfValue: result.selfValue,
+            sampleCount: result.sampleCount,
+            windowTotal: result.windowTotal,
+            callers: result.callers,
+            callees: result.callees,
+            truncated: result.truncated,
+        });
+    }
+    catch (err) {
+        next(err);
+    }
+});
+// --- Profile Breakdown Endpoint ---
+router.post("/telemetry/profiles/breakdown", ...requireProfileReadAccess, async (req, res, next) => {
+    try {
+        const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
+            return Response.sendErrorResponse(req, res, new BadDataException("Invalid Project ID"));
+        }
+        const body = req.body;
+        const startTime = body["startTime"]
+            ? OneUptimeDate.fromString(body["startTime"])
+            : undefined;
+        const endTime = body["endTime"]
+            ? OneUptimeDate.fromString(body["endTime"])
+            : undefined;
+        /*
+         * breakdownBy is either the reserved key 'service' (grouping by
+         * primaryEntityId, resolved to display names by the UI) or a Profile
+         * attribute key.
+         */
+        const breakdownBy = body["breakdownBy"] && typeof body["breakdownBy"] === "string"
+            ? body["breakdownBy"]
+            : undefined;
+        if (!startTime || !endTime || !breakdownBy) {
+            return Response.sendErrorResponse(req, res, new BadDataException("startTime, endTime, and breakdownBy are all required"));
+        }
+        const serviceIds = body["serviceIds"]
+            ? body["serviceIds"].map((id) => {
+                return new ObjectID(id);
+            })
+            : undefined;
+        const profileType = body["profileType"]
+            ? body["profileType"]
+            : undefined;
+        const profileTypes = Array.isArray(body["profileTypes"])
+            ? body["profileTypes"].filter((t) => {
+                return typeof t === "string" && t.length > 0;
+            })
+            : undefined;
+        const limit = body["limit"]
+            ? body["limit"]
+            : undefined;
+        const request = Object.assign(Object.assign(Object.assign(Object.assign({ projectId: databaseProps.tenantId, startTime,
+            endTime,
+            breakdownBy }, (serviceIds !== undefined && { serviceIds })), (profileType !== undefined && { profileType })), (profileTypes !== undefined &&
+            profileTypes.length > 0 && { profileTypes })), (limit !== undefined && { limit }));
+        const result = await ProfileAggregationService.getBreakdown(request);
         return Response.sendJsonObjectResponse(req, res, {
-            diffFlamegraph: diffFlamegraph,
+            items: result.items,
+            totalSampleCount: result.totalSampleCount,
         });
     }
     catch (err) {