@oneuptime/common 11.7.3 → 12.0.0

package/build/dist/Server/Utils/SessionReplay/SessionReplayGateCache.js

@@ -0,0 +1,378 @@
+import ProjectService from "../../Services/ProjectService";
+import RumApplicationService from "../../Services/RumApplicationService";
+import QueryHelper from "../../Types/Database/QueryHelper";
+import SessionReplayGateCacheStore, { POLICY_CACHE_TTL_MS, } from "./SessionReplayGateCacheStore";
+import Project from "../../../Models/DatabaseModels/Project";
+import RumApplication from "../../../Models/DatabaseModels/RumApplication";
+import SessionReplayCaptureTrigger from "../../../Types/Rum/SessionReplayCaptureTrigger";
+import SessionReplayConsentMode from "../../../Types/Rum/SessionReplayConsentMode";
+import { parseSessionReplayMaskingMode, } from "../../../Types/Rum/SessionReplayMaskingMode";
+import { DEFAULT_SESSION_REPLAY_RETENTION_IN_DAYS, SESSION_REPLAY_ALLOWED_RETENTION_DAYS, } from "../../../Types/Rum/SessionReplay";
+import SessionIdentity from "../../../Utils/Rum/SessionIdentity";
+/*
+ * Resolves the session-replay policy for one (project, appIdentifier) pair,
+ * which is what all three ingest-time gates need: the org-wide allow flag,
+ * the per-application enable flag, and the origin allowlist.
+ *
+ * Every default in here is the REFUSING one. An application that has never
+ * been configured, a project that has never opted in, a row whose policy
+ * columns have not been migrated yet, and a lookup that fails outright all
+ * resolve to "do not accept recordings". That is the opposite posture from
+ * the log and trace scrub loaders, which continue with empty rules on
+ * failure, and it is deliberate: a span recorded by mistake is a span, a
+ * session recorded by mistake is a video of a real person.
+ *
+ * Cache shape follows the house convention for hot-path policy (a
+ * process-local Map with a 60s TTL, as in LogScrubRuleService), with one
+ * addition: a Redis kill key checked on a 5s TTL. Without it, turning an
+ * application off would take up to the full 60s cache TTL plus the config
+ * endpoint's 300s browser cache - roughly six minutes - to stop a live
+ * recorder. With it the SERVER stops accepting within 5s and the directive
+ * on the chunk response stops the recorder within one flush window.
+ *
+ * The cache state and its invalidation live in SessionReplayGateCacheStore,
+ * which RumApplicationService and ProjectService call from their update and
+ * delete hooks. This file imports both of those services, so the store has
+ * to be a separate leaf module or the invalidation would be a cycle.
+ */
+/*
+ * Policy columns read off RumApplication and Project.
+ *
+ * These are declared as a name list rather than inline in a `select` object
+ * for one reason: this file is on the ingest hot path and must keep
+ * compiling and behaving sanely whether or not a given checkout has the
+ * Postgres columns yet. The list is intersected with the columns the model
+ * actually declares (see buildSelect), so on a model that predates the
+ * columns we simply select none of them, every field reads undefined, and
+ * the defaults below refuse the recording - which is exactly the behaviour
+ * we want from an unconfigured application anyway.
+ */
+const RUM_APPLICATION_POLICY_COLUMNS = [
+    "isSessionReplayEnabled",
+    "sessionReplayMaskingMode",
+    "sessionReplayMaskSelectors",
+    "sessionReplayBlockSelectors",
+    "sessionReplayAllowedOrigins",
+    "sessionReplayConsentMode",
+    "sessionReplayCaptureTrigger",
+    "sessionReplaySamplePercentage",
+    "sessionReplayCaptureUserIdentity",
+    "sessionReplayCaptureGeo",
+    "sessionReplayRecordCanvas",
+    "sessionReplayRetentionInDays",
+    "sessionReplayMonthlyBudgetInGB",
+    "sessionReplayIgnoreErrorPatterns",
+    "sessionReplayTracePropagationOrigins",
+    "sessionReplayLcpBudgetMs",
+    "sessionReplayLongTaskBudgetMs",
+    "sessionReplaySlowRequestBudgetMs",
+];
+const PROJECT_POLICY_COLUMNS = [
+    "isSessionReplayAllowed",
+];
+export default class SessionReplayGateCache {
+    /*
+     * Resolve the policy for one application.
+     *
+     * Returns null when the recording must be refused for a reason the
+     * client cannot fix by retrying: unknown application, project not opted
+     * in, or application not enabled. THROWS when the lookup itself failed
+     * (Postgres unreachable, Redis error), because those two outcomes must
+     * produce different HTTP answers - a terminal 204 that stops the
+     * recorder, versus a retryable 503 that does not silently discard a
+     * recording during a database blip.
+     */
+    static async getPolicy(data) {
+        const appIdentifier = data.appIdentifier.trim();
+        if (!appIdentifier) {
+            return null;
+        }
+        const cacheKey = `${data.projectId.toString()}:${appIdentifier.toLowerCase()}`;
+        const cached = SessionReplayGateCacheStore.getPolicyEntry(cacheKey);
+        if (cached && Date.now() - cached.loadedAt < POLICY_CACHE_TTL_MS) {
+            /*
+             * The kill key is consulted even on a cache hit - that is the whole
+             * point of it. A cached "enabled" policy is only honoured while the
+             * project has not been switched off in the last few seconds.
+             */
+            if (cached.policy &&
+                (await SessionReplayGateCacheStore.isProjectKilled(data.projectId))) {
+                return null;
+            }
+            return cached.policy;
+        }
+        const policy = await this.loadPolicy({
+            projectId: data.projectId,
+            appIdentifier: appIdentifier,
+        });
+        SessionReplayGateCacheStore.setPolicyEntry(cacheKey, policy);
+        if (policy &&
+            (await SessionReplayGateCacheStore.isProjectKilled(data.projectId))) {
+            return null;
+        }
+        return policy;
+    }
+    static async loadPolicy(data) {
+        const project = await ProjectService.findOneBy({
+            query: {
+                _id: data.projectId.toString(),
+            },
+            select: this.buildSelect(new Project(), PROJECT_POLICY_COLUMNS),
+            props: {
+                isRoot: true,
+            },
+        });
+        if (!project) {
+            return null;
+        }
+        const projectView = project;
+        const isProjectAllowed = projectView["isSessionReplayAllowed"] === true;
+        let app = await RumApplicationService.findOneBy({
+            query: {
+                projectId: data.projectId,
+                appIdentifier: QueryHelper.findWithSameText(data.appIdentifier),
+            },
+            select: this.buildSelect(new RumApplication(), RUM_APPLICATION_POLICY_COLUMNS),
+            props: {
+                isRoot: true,
+            },
+        });
+        /*
+         * Create the application on first sight, the same way OTel RUM telemetry
+         * does via findOrCreateByAppIdentifier.
+         *
+         * Without this, session replay cannot bootstrap itself at all: there is no
+         * "create application" button in the Dashboard - RUM applications appear
+         * only once telemetry arrives - so a customer who pastes the recorder
+         * snippet and nothing else would get enabled:false forever, with the
+         * recorder silently declining to record and no way to fix it from the UI.
+         *
+         * Only reached behind an authenticated, project-scoped ingestion key, and
+         * only for a project that already allows session replay, so this creates
+         * exactly the row the customer's own traffic implies.
+         */
+        if (!app) {
+            if (!isProjectAllowed) {
+                return null;
+            }
+            await RumApplicationService.findOrCreateByAppIdentifier({
+                projectId: data.projectId,
+                appIdentifier: data.appIdentifier,
+            });
+            app = await RumApplicationService.findOneBy({
+                query: {
+                    projectId: data.projectId,
+                    appIdentifier: QueryHelper.findWithSameText(data.appIdentifier),
+                },
+                select: this.buildSelect(new RumApplication(), RUM_APPLICATION_POLICY_COLUMNS),
+                props: {
+                    isRoot: true,
+                },
+            });
+        }
+        if (!app || !app.id) {
+            return null;
+        }
+        const appView = app;
+        const isAppEnabled = appView["isSessionReplayEnabled"] === true;
+        /*
+         * Both flags are required. Returning null rather than a disabled policy
+         * keeps every caller from having to remember to check them: if this
+         * function hands back an object at all, recording is permitted.
+         */
+        if (!isProjectAllowed || !isAppEnabled) {
+            return null;
+        }
+        const requestedRetentionDays = this.readNumber(appView["sessionReplayRetentionInDays"], DEFAULT_SESSION_REPLAY_RETENTION_IN_DAYS);
+        return {
+            projectId: data.projectId,
+            rumApplicationId: app.id,
+            isProjectAllowed: true,
+            isAppEnabled: true,
+            allowedOrigins: this.readStringArray(appView["sessionReplayAllowedOrigins"]),
+            maskingMode: parseSessionReplayMaskingMode(appView["sessionReplayMaskingMode"]),
+            consentMode: appView["sessionReplayConsentMode"] ===
+                SessionReplayConsentMode.NotRequired
+                ? SessionReplayConsentMode.NotRequired
+                : SessionReplayConsentMode.RequireExplicit,
+            captureTrigger: appView["sessionReplayCaptureTrigger"] ===
+                SessionReplayCaptureTrigger.Always
+                ? SessionReplayCaptureTrigger.Always
+                : SessionReplayCaptureTrigger.OnErrorOrFrustration,
+            samplePercentage: this.readNumber(appView["sessionReplaySamplePercentage"], 0),
+            maskSelectors: this.readStringArray(appView["sessionReplayMaskSelectors"]),
+            blockSelectors: this.readStringArray(appView["sessionReplayBlockSelectors"]),
+            recordCanvas: appView["sessionReplayRecordCanvas"] === true,
+            captureUserIdentity: appView["sessionReplayCaptureUserIdentity"] === true,
+            captureGeo: appView["sessionReplayCaptureGeo"] === true,
+            retentionInDays: SessionIdentity.clampRetentionDays(requestedRetentionDays, SESSION_REPLAY_ALLOWED_RETENTION_DAYS, DEFAULT_SESSION_REPLAY_RETENTION_IN_DAYS),
+            monthlyBudgetInGB: this.readNullableNumber(appView["sessionReplayMonthlyBudgetInGB"]),
+            ignoreErrorPatterns: this.readStringArray(appView["sessionReplayIgnoreErrorPatterns"]),
+            tracePropagationOrigins: this.readStringArray(appView["sessionReplayTracePropagationOrigins"]),
+            lcpBudgetMs: this.readNumber(appView["sessionReplayLcpBudgetMs"], 0),
+            longTaskBudgetMs: this.readNumber(appView["sessionReplayLongTaskBudgetMs"], 0),
+            slowRequestBudgetMs: this.readNumber(appView["sessionReplaySlowRequestBudgetMs"], 0),
+            configEpoch: this.getConfigEpoch(app),
+        };
+    }
+    /*
+     * Is `origin` covered by the application's allowlist?
+     *
+     * Exact origin match, case-insensitive, plus a single leading "*." host
+     * wildcard so a customer with per-tenant subdomains does not have to
+     * enumerate thousands of them. Deliberately no scheme wildcard and no
+     * path matching: an allowlist entry is an origin, and anything looser
+     * would defeat the point of having one.
+     */
+    static isOriginAllowed(policy, origin) {
+        /*
+         * An empty allowlist means "any origin", not "no origin".
+         *
+         * Be aware of what this gives up. TelemetryIngestionKey has no expiry, no
+         * scope and no origin binding, and the install instructions put it in
+         * plain sight in the customer's browser JavaScript. The allowlist was the
+         * only control preventing anyone who scraped that key from writing
+         * recordings into the victim's project, so with it empty a project is
+         * open to forged sessions until someone fills it in.
+         *
+         * Populate sessionReplayAllowedOrigins per application in production. The
+         * rate limit and the per-project byte budget still bound the damage, but
+         * they bound volume, not authenticity.
+         */
+        if (policy.allowedOrigins.length === 0) {
+            return true;
+        }
+        /*
+         * A configured allowlist is still enforced strictly: once the customer has
+         * named their origins, a request without an Origin header is refused
+         * rather than waved through.
+         */
+        if (!origin) {
+            return false;
+        }
+        const normalizedOrigin = origin.trim().toLowerCase();
+        if (!normalizedOrigin) {
+            return false;
+        }
+        for (const allowed of policy.allowedOrigins) {
+            const normalizedAllowed = allowed.trim().toLowerCase();
+            if (!normalizedAllowed) {
+                continue;
+            }
+            if (normalizedAllowed === normalizedOrigin) {
+                return true;
+            }
+            const wildcardIndex = normalizedAllowed.indexOf("://*.");
+            if (wildcardIndex === -1) {
+                continue;
+            }
+            const scheme = normalizedAllowed.substring(0, wildcardIndex + 3);
+            const suffix = normalizedAllowed.substring(wildcardIndex + 4);
+            /*
+             * suffix keeps its leading dot, so "https://*.example.com" matches
+             * "https://a.example.com" but NOT "https://evilexample.com".
+             */
+            if (normalizedOrigin.startsWith(scheme) &&
+                normalizedOrigin.endsWith(suffix) &&
+                normalizedOrigin.length > scheme.length + suffix.length) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /*
+     * Invalidation. Delegated to the leaf store so the services that own the
+     * policy rows can call the same code without importing this resolver.
+     */
+    static async markProjectDisabled(projectId) {
+        return await SessionReplayGateCacheStore.markProjectDisabled(projectId);
+    }
+    static async clearProjectDisabled(projectId) {
+        return await SessionReplayGateCacheStore.clearProjectDisabled(projectId);
+    }
+    /* Drop cached policy for one project, or for everything. */
+    static clearCache(projectId) {
+        SessionReplayGateCacheStore.clearCache(projectId);
+    }
+    /*
+     * Build a `select` restricted to the columns the model instance actually
+     * declares. Model properties are initialised to `undefined` in their
+     * declarations, so Object.keys on a fresh instance is an accurate list of
+     * what exists in this checkout - which keeps a column that has not landed
+     * yet out of the generated SQL instead of producing an unknown-column
+     * error on every ingest request.
+     */
+    static buildSelect(instance, optionalColumns) {
+        const declared = new Set(Object.keys(instance));
+        /*
+         * Only _id is universal. projectId and updatedAt are guarded like every
+         * other column because this helper is used for BOTH Project and
+         * RumApplication, and Project has no projectId of its own - selecting it
+         * there asks the ORM for a column that does not exist, which yields no
+         * row rather than an error, so the policy silently resolved to null and
+         * session replay reported itself disabled with nothing in the logs.
+         */
+        const select = {
+            _id: true,
+        };
+        for (const column of ["projectId", "updatedAt", ...optionalColumns]) {
+            if (declared.has(column)) {
+                select[column] = true;
+            }
+        }
+        return select;
+    }
+    /*
+     * Config epoch is the application row's last-update time in millis. It
+     * is monotonic per row, free to compute, and changes on exactly the event
+     * a recorder cares about.
+     */
+    static getConfigEpoch(app) {
+        const updatedAt = app.updatedAt;
+        if (!updatedAt) {
+            return 0;
+        }
+        const millis = new Date(updatedAt).getTime();
+        return Number.isFinite(millis) ? millis : 0;
+    }
+    static readNumber(value, fallback) {
+        if (typeof value === "number" && Number.isFinite(value)) {
+            return value;
+        }
+        if (typeof value === "string") {
+            const parsed = Number(value);
+            if (Number.isFinite(parsed)) {
+                return parsed;
+            }
+        }
+        return fallback;
+    }
+    static readNullableNumber(value) {
+        if (value === null || value === undefined) {
+            return null;
+        }
+        if (typeof value === "number" && Number.isFinite(value)) {
+            return value;
+        }
+        if (typeof value === "string") {
+            const parsed = Number(value);
+            if (Number.isFinite(parsed)) {
+                return parsed;
+            }
+        }
+        return null;
+    }
+    static readStringArray(value) {
+        if (!Array.isArray(value)) {
+            return [];
+        }
+        const result = [];
+        for (const entry of value) {
+            if (typeof entry === "string" && entry.trim()) {
+                result.push(entry.trim());
+            }
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=SessionReplayGateCache.js.map

package/build/dist/Server/Utils/SessionReplay/SessionReplayGateCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionReplayGateCache.js","sourceRoot":"","sources":["../../../../../Server/Utils/SessionReplay/SessionReplayGateCache.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,+BAA+B,CAAC;AAC3D,OAAO,qBAAqB,MAAM,sCAAsC,CAAC;AACzE,OAAO,WAAW,MAAM,kCAAkC,CAAC;AAC3D,OAAO,2BAA2B,EAAE,EAClC,mBAAmB,GAEpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,OAAO,MAAM,wCAAwC,CAAC;AAC7D,OAAO,cAAc,MAAM,+CAA+C,CAAC;AAG3E,OAAO,2BAA2B,MAAM,gDAAgD,CAAC;AACzF,OAAO,wBAAwB,MAAM,6CAA6C,CAAC;AACnF,OAAiC,EAC/B,6BAA6B,GAC9B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,wCAAwC,EACxC,qCAAqC,GACtC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,eAAe,MAAM,oCAAoC,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,8BAA8B,GAA0B;IAC5D,wBAAwB;IACxB,0BAA0B;IAC1B,4BAA4B;IAC5B,6BAA6B;IAC7B,6BAA6B;IAC7B,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,kCAAkC;IAClC,yBAAyB;IACzB,2BAA2B;IAC3B,8BAA8B;IAC9B,gCAAgC;IAChC,kCAAkC;IAClC,sCAAsC;IACtC,0BAA0B;IAC1B,+BAA+B;IAC/B,kCAAkC;CACnC,CAAC;AAEF,MAAM,sBAAsB,GAA0B;IACpD,wBAAwB;CACzB,CAAC;AAwEF,MAAM,CAAC,OAAO,OAAO,sBAAsB;IACzC;;;;;;;;;;OAUG;IACI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAG7B;QACC,MAAM,aAAa,GAAW,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAExD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAW,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;QAEvF,MAAM,MAAM,GACV,2BAA2B,CAAC,cAAc,CACxC,QAAQ,CACT,CAAC;QAEJ,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,mBAAmB,EAAE,CAAC;YACjE;;;;eAIG;YACH,IACE,MAAM,CAAC,MAAM;gBACb,CAAC,MAAM,2BAA2B,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EACnE,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QAED,MAAM,MAAM,GAAmC,MAAM,IAAI,CAAC,UAAU,CAAC;YACnE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC;QAEH,2BAA2B,CAAC,cAAc,CACxC,QAAQ,EACR,MAAM,CACP,CAAC;QAEF,IACE,MAAM;YACN,CAAC,MAAM,2BAA2B,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EACnE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAG/B;QACC,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,SAAS,CAAC;YAC7D,KAAK,EAAE;gBACL,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE;aAC/B;YACD,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,OAAO,EAAE,EAAE,sBAAsB,CAAC;YAC/D,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GACf,OAA8C,CAAC;QAEjD,MAAM,gBAAgB,GACpB,WAAW,CAAC,wBAAwB,CAAC,KAAK,IAAI,CAAC;QAEjD,IAAI,GAAG,GAA0B,MAAM,qBAAqB,CAAC,SAAS,CAAC;YACrE,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC;aAChE;YACD,MAAM,EAAE,IAAI,CAAC,WAAW,CACtB,IAAI,cAAc,EAAE,EACpB,8BAA8B,CAC/B;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH;;;;;;;;;;;;;WAaG;QACH,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,qBAAqB,CAAC,2BAA2B,CAAC;gBACtD,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC,CAAC;YAEH,GAAG,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC;gBAC1C,KAAK,EAAE;oBACL,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,aAAa,EAAE,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC;iBAChE;gBACD,MAAM,EAAE,IAAI,CAAC,WAAW,CACtB,IAAI,cAAc,EAAE,EACpB,8BAA8B,CAC/B;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GACX,GAA0C,CAAC;QAE7C,MAAM,YAAY,GAAY,OAAO,CAAC,wBAAwB,CAAC,KAAK,IAAI,CAAC;QAEzE;;;;WAIG;QACH,IAAI,CAAC,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,sBAAsB,GAAW,IAAI,CAAC,UAAU,CACpD,OAAO,CAAC,8BAA8B,CAAC,EACvC,wCAAwC,CACzC,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,gBAAgB,EAAE,GAAG,CAAC,EAAE;YACxB,gBAAgB,EAAE,IAAI;YACtB,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI,CAAC,eAAe,CAClC,OAAO,CAAC,6BAA6B,CAAC,CACvC;YACD,WAAW,EAAE,6BAA6B,CACxC,OAAO,CAAC,0BAA0B,CAAC,CACpC;YACD,WAAW,EACT,OAAO,CAAC,0BAA0B,CAAC;gBACnC,wBAAwB,CAAC,WAAW;gBAClC,CAAC,CAAC,wBAAwB,CAAC,WAAW;gBACtC,CAAC,CAAC,wBAAwB,CAAC,eAAe;YAC9C,cAAc,EACZ,OAAO,CAAC,6BAA6B,CAAC;gBACtC,2BAA2B,CAAC,MAAM;gBAChC,CAAC,CAAC,2BAA2B,CAAC,MAAM;gBACpC,CAAC,CAAC,2BAA2B,CAAC,oBAAoB;YACtD,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAC/B,OAAO,CAAC,+BAA+B,CAAC,EACxC,CAAC,CACF;YACD,aAAa,EAAE,IAAI,CAAC,eAAe,CACjC,OAAO,CAAC,4BAA4B,CAAC,CACtC;YACD,cAAc,EAAE,IAAI,CAAC,eAAe,CAClC,OAAO,CAAC,6BAA6B,CAAC,CACvC;YACD,YAAY,EAAE,OAAO,CAAC,2BAA2B,CAAC,KAAK,IAAI;YAC3D,mBAAmB,EAAE,OAAO,CAAC,kCAAkC,CAAC,KAAK,IAAI;YACzE,UAAU,EAAE,OAAO,CAAC,yBAAyB,CAAC,KAAK,IAAI;YACvD,eAAe,EAAE,eAAe,CAAC,kBAAkB,CACjD,sBAAsB,EACtB,qCAAqC,EACrC,wCAAwC,CACzC;YACD,iBAAiB,EAAE,IAAI,CAAC,kBAAkB,CACxC,OAAO,CAAC,gCAAgC,CAAC,CAC1C;YACD,mBAAmB,EAAE,IAAI,CAAC,eAAe,CACvC,OAAO,CAAC,kCAAkC,CAAC,CAC5C;YACD,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAC3C,OAAO,CAAC,sCAAsC,CAAC,CAChD;YACD,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;YACpE,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAC/B,OAAO,CAAC,+BAA+B,CAAC,EACxC,CAAC,CACF;YACD,mBAAmB,EAAE,IAAI,CAAC,UAAU,CAClC,OAAO,CAAC,kCAAkC,CAAC,EAC3C,CAAC,CACF;YACD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;SACtC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACI,MAAM,CAAC,eAAe,CAC3B,MAA+B,EAC/B,MAA0B;QAE1B;;;;;;;;;;;;;WAaG;QACH,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;;WAIG;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,gBAAgB,GAAW,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE7D,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5C,MAAM,iBAAiB,GAAW,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAE/D,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,IAAI,iBAAiB,KAAK,gBAAgB,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,aAAa,GAAW,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAEjE,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAW,iBAAiB,CAAC,SAAS,CAAC,CAAC,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC;YACzE,MAAM,MAAM,GAAW,iBAAiB,CAAC,SAAS,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;YAEtE;;;eAGG;YACH,IACE,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC;gBACnC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACjC,gBAAgB,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EACvD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAmB;QACzD,OAAO,MAAM,2BAA2B,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC1E,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAmB;QAC1D,OAAO,MAAM,2BAA2B,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC3E,CAAC;IAED,4DAA4D;IACrD,MAAM,CAAC,UAAU,CAAC,SAAgC;QACvD,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,WAAW,CACxB,QAAgB,EAChB,eAAsC;QAEtC,MAAM,QAAQ,GAAgB,IAAI,GAAG,CAAS,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAErE;;;;;;;WAOG;QACH,MAAM,MAAM,GAA4B;YACtC,GAAG,EAAE,IAAI;SACV,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC;YACpE,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,MAA+B,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,cAAc,CAAC,GAAmB;QAC/C,MAAM,SAAS,GAAqB,GAAG,CAAC,SAAS,CAAC;QAElD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,MAAM,GAAW,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAErD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAEO,MAAM,CAAC,UAAU,CAAC,KAAc,EAAE,QAAgB;QACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC;YAErC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,MAAM,CAAC,kBAAkB,CAAC,KAAc;QAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC;YAErC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,eAAe,CAAC,KAAc;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAkB,EAAE,CAAC;QAEjC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC9C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/build/dist/Server/Utils/SessionReplay/SessionReplayGateCacheStore.js

@@ -0,0 +1,137 @@
+import Redis from "../../Infrastructure/Redis";
+import logger from "../Logger";
+/*
+ * Cache state and invalidation for the session-replay gate.
+ *
+ * Split out of SessionReplayGateCache so the services that OWN the policy
+ * rows (RumApplicationService, ProjectService) can invalidate it without
+ * importing the resolver. The resolver imports both of those services, so a
+ * direct import back would be a cycle; this module is a leaf that touches
+ * only Redis and the logger.
+ *
+ * Two layers, because a policy change has to be honoured on two different
+ * timescales:
+ *
+ *   - the process-local policy map, which the writing pod can drop
+ *     immediately but other pods cannot;
+ *   - a Redis kill key, which every pod consults on a 5s TTL, so "I turned
+ *     this off" stops the fleet within seconds instead of within the 60s
+ *     policy TTL plus the config endpoint's 300s browser cache.
+ */
+export const POLICY_CACHE_TTL_MS = 60 * 1000;
+export const KILL_KEY_CACHE_TTL_MS = 5 * 1000;
+const KILL_KEY_PREFIX = "replay:gate:off:";
+/*
+ * The kill key only has to outlive the policy cache it is racing. Anything
+ * longer just keeps a project switched off after the policy cache has
+ * already picked up the real setting.
+ */
+const KILL_KEY_TTL_SECONDS = 120;
+/*
+ * Untyped at this layer: the policy shape belongs to the resolver, and
+ * parameterising this module on it would reintroduce the import it exists to
+ * avoid. The resolver casts on read, which is safe because it is the only
+ * writer.
+ */
+const policyCache = new Map();
+const killKeyCache = new Map();
+export default class SessionReplayGateCacheStore {
+    static getPolicyEntry(cacheKey) {
+        return policyCache.get(cacheKey);
+    }
+    static setPolicyEntry(cacheKey, policy) {
+        policyCache.set(cacheKey, { policy: policy, loadedAt: Date.now() });
+    }
+    /*
+     * Switch a project off immediately, ahead of the policy cache.
+     *
+     * Called from the update path of the project / application settings so
+     * "I turned this off" is honoured by the server within KILL_KEY_CACHE_TTL_MS
+     * rather than within the policy cache TTL. Best-effort: a Redis outage only
+     * means the ordinary cache expiry applies.
+     */
+    static async markProjectDisabled(projectId) {
+        const client = Redis.getClient();
+        if (client && Redis.isConnected()) {
+            try {
+                await client.set(`${KILL_KEY_PREFIX}${projectId.toString()}`, "1", "EX", KILL_KEY_TTL_SECONDS);
+            }
+            catch (err) {
+                logger.warn(`SessionReplayGateCacheStore: could not set the kill key for project ${projectId.toString()}`);
+                logger.warn(err);
+            }
+        }
+        killKeyCache.set(projectId.toString(), {
+            isDisabled: true,
+            loadedAt: Date.now(),
+        });
+    }
+    /*
+     * Clear the kill key again, so re-enabling replay is honoured as promptly
+     * as disabling it was. Without this a project switched off and back on
+     * within KILL_KEY_TTL_SECONDS would keep being refused for the remainder
+     * of the key's TTL even though its policy row says yes.
+     */
+    static async clearProjectDisabled(projectId) {
+        const client = Redis.getClient();
+        if (client && Redis.isConnected()) {
+            try {
+                await client.del(`${KILL_KEY_PREFIX}${projectId.toString()}`);
+            }
+            catch (err) {
+                logger.warn(`SessionReplayGateCacheStore: could not clear the kill key for project ${projectId.toString()}`);
+                logger.warn(err);
+            }
+        }
+        killKeyCache.delete(projectId.toString());
+    }
+    /* Drop cached policy for one project, or for everything. */
+    static clearCache(projectId) {
+        if (!projectId) {
+            policyCache.clear();
+            killKeyCache.clear();
+            return;
+        }
+        const prefix = `${projectId.toString()}:`;
+        for (const key of Array.from(policyCache.keys())) {
+            if (key.startsWith(prefix)) {
+                policyCache.delete(key);
+            }
+        }
+        killKeyCache.delete(projectId.toString());
+    }
+    static async isProjectKilled(projectId) {
+        const cacheKey = projectId.toString();
+        const cached = killKeyCache.get(cacheKey);
+        if (cached && Date.now() - cached.loadedAt < KILL_KEY_CACHE_TTL_MS) {
+            return cached.isDisabled;
+        }
+        const client = Redis.getClient();
+        if (!client || !Redis.isConnected()) {
+            /*
+             * Fail OPEN on this one check only, and only because it is a
+             * fast-path override on top of a policy that already had to say yes.
+             * Failing closed here would make a Redis blip stop replay ingest for
+             * every project that had correctly opted in.
+             */
+            killKeyCache.set(cacheKey, { isDisabled: false, loadedAt: Date.now() });
+            return false;
+        }
+        let isDisabled = false;
+        try {
+            const value = await client.get(`${KILL_KEY_PREFIX}${cacheKey}`);
+            isDisabled = value !== null;
+        }
+        catch (err) {
+            logger.warn(`SessionReplayGateCacheStore: could not read the kill key for project ${cacheKey}`);
+            logger.warn(err);
+            isDisabled = false;
+        }
+        killKeyCache.set(cacheKey, {
+            isDisabled: isDisabled,
+            loadedAt: Date.now(),
+        });
+        return isDisabled;
+    }
+}
+//# sourceMappingURL=SessionReplayGateCacheStore.js.map

package/build/dist/Server/Utils/SessionReplay/SessionReplayGateCacheStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionReplayGateCacheStore.js","sourceRoot":"","sources":["../../../../../Server/Utils/SessionReplay/SessionReplayGateCacheStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAqB,MAAM,4BAA4B,CAAC;AAC/D,OAAO,MAAM,MAAM,WAAW,CAAC;AAG/B;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAW,EAAE,GAAG,IAAI,CAAC;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAW,CAAC,GAAG,IAAI,CAAC;AAEtD,MAAM,eAAe,GAAW,kBAAkB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,oBAAoB,GAAW,GAAG,CAAC;AAYzC;;;;;GAKG;AACH,MAAM,WAAW,GAA2C,IAAI,GAAG,EAAE,CAAC;AACtE,MAAM,YAAY,GAAmC,IAAI,GAAG,EAAE,CAAC;AAE/D,MAAM,CAAC,OAAO,OAAO,2BAA2B;IACvC,MAAM,CAAC,cAAc,CAC1B,QAAgB;QAEhB,OAAO,WAAW,CAAC,GAAG,CAAC,QAAQ,CAA0C,CAAC;IAC5E,CAAC;IAEM,MAAM,CAAC,cAAc,CAC1B,QAAgB,EAChB,MAAsB;QAEtB,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAmB;QACzD,MAAM,MAAM,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC;QAEpD,IAAI,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,GAAG,CACd,GAAG,eAAe,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,EAC3C,GAAG,EACH,IAAI,EACJ,oBAAoB,CACrB,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CACT,uEAAuE,SAAS,CAAC,QAAQ,EAAE,EAAE,CAC9F,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE;YACrC,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAmB;QAC1D,MAAM,MAAM,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC;QAEpD,IAAI,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,eAAe,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CACT,yEAAyE,SAAS,CAAC,QAAQ,EAAE,EAAE,CAChG,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,4DAA4D;IACrD,MAAM,CAAC,UAAU,CAAC,SAAgC;QACvD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,EAAE,CAAC;YACpB,YAAY,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC;QAElD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,SAAmB;QACrD,MAAM,QAAQ,GAAW,SAAS,CAAC,QAAQ,EAAE,CAAC;QAE9C,MAAM,MAAM,GAAkC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEzE,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,qBAAqB,EAAE,CAAC;YACnE,OAAO,MAAM,CAAC,UAAU,CAAC;QAC3B,CAAC;QAED,MAAM,MAAM,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC;QAEpD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACpC;;;;;eAKG;YACH,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,UAAU,GAAY,KAAK,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,KAAK,GAAkB,MAAM,MAAM,CAAC,GAAG,CAC3C,GAAG,eAAe,GAAG,QAAQ,EAAE,CAChC,CAAC;YACF,UAAU,GAAG,KAAK,KAAK,IAAI,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,wEAAwE,QAAQ,EAAE,CACnF,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC;QAED,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE;YACzB,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}