@oneuptime/common 12.0.12 → 12.0.13

package/Server/API/TelemetryAPI.ts

@@ -95,6 +95,10 @@ import ResourceFacetResolver, {
   ResolvedFacetValue,
   ResourceFacetSpec,
 } from "../Utils/Telemetry/ResourceFacetResolver";
+import ResourceEntityFilter, {
+  ResourceEntityScope,
+} from "../Utils/Telemetry/ResourceEntityFilter";
+import { ResourceEntityFacetSelections } from "../../Types/Telemetry/ResourceEntityFacet";
 import Label from "../../Models/DatabaseModels/Label";
 import RumApplication from "../../Models/DatabaseModels/RumApplication";
 import RumApplicationService from "../Services/RumApplicationService";
@@ -456,6 +460,9 @@ router.post(
           ? (body["attributes"] as Record<string, string | Array<string>>)
           : undefined;
 
+      const resourceScopes: Array<ResourceEntityScope> | undefined =
+        await resolveResourceScopesFromBody(body, databaseProps.tenantId);
+
       const request: HistogramRequest = {
         projectId: databaseProps.tenantId,
         startTime,
@@ -463,6 +470,7 @@ router.post(
         bucketSizeInMinutes,
         serviceIds,
         entityKeys,
+        resourceScopes,
         severityTexts,
         bodySearchText,
         traceIds,
@@ -573,6 +581,9 @@ router.post(
        */
       const projectId: ObjectID = databaseProps.tenantId;
 
+      const resourceScopes: Array<ResourceEntityScope> | undefined =
+        await resolveResourceScopesFromBody(body, projectId);
+
       /*
        * Run facet queries in parallel so a slow individual facet can't
        * starve the endpoint. Per-facet errors degrade gracefully to [].
@@ -592,6 +603,7 @@ router.post(
                   limit,
                   serviceIds,
                   entityKeys,
+                  resourceScopes,
                   severityTexts,
                   bodySearchText,
                   traceIds,
@@ -656,6 +668,41 @@ router.post(
   },
 );
 
+/**
+ * Resolve the `resourceFilters` field — the explorers' non-Service resource
+ * facet selections (Kubernetes cluster / host / docker host / podman host),
+ * sent as Postgres ids — into the scopes the aggregation services compile.
+ *
+ * Kept out of the sync body parsers because turning an id into an entity
+ * key needs a Postgres round trip: the id names a row whose identifying
+ * value (`clusterIdentifier` / `hostIdentifier`) is what ingest hashed into
+ * `entityKeys`.
+ *
+ * Returns undefined when nothing was selected so the request field stays
+ * absent rather than becoming an empty array.
+ */
+async function resolveResourceScopesFromBody(
+  body: JSONObject,
+  projectId: ObjectID,
+): Promise<Array<ResourceEntityScope> | undefined> {
+  const selections: ResourceEntityFacetSelections =
+    ResourceEntityFilter.parseSelections(
+      body["resourceFilters"] as JSONObject | undefined,
+    );
+
+  if (Object.keys(selections).length === 0) {
+    return undefined;
+  }
+
+  const scopes: Array<ResourceEntityScope> =
+    await ResourceEntityFilter.resolveScopes({
+      projectId,
+      selections,
+    });
+
+  return scopes.length > 0 ? scopes : undefined;
+}
+
 /*
  * Shared body parsing for every trace aggregation endpoint (histogram,
  * facets, analytics). Defensive about shapes: arrays are validated and
@@ -844,7 +891,13 @@ router.post(
         (body["bucketSizeInMinutes"] as number) ||
         computeDefaultBucketSize(startTime, endTime);
 
-      const traceFilters: TraceFilters = parseTraceFilterBody(body);
+      const traceFilters: TraceFilters = {
+        ...parseTraceFilterBody(body),
+        resourceScopes: await resolveResourceScopesFromBody(
+          body,
+          databaseProps.tenantId,
+        ),
+      };
 
       const request: TraceHistogramRequest = {
         projectId: databaseProps.tenantId,
@@ -904,7 +957,13 @@ router.post(
 
       const limit: number = (body["limit"] as number) || 500;
 
-      const traceFilters: TraceFilters = parseTraceFilterBody(body);
+      const traceFilters: TraceFilters = {
+        ...parseTraceFilterBody(body),
+        resourceScopes: await resolveResourceScopesFromBody(
+          body,
+          databaseProps.tenantId,
+        ),
+      };
 
       /*
        * Per-facet partial-match filter applied at the Postgres source-of-truth
@@ -1195,7 +1254,13 @@ router.post(
         ? Math.min(Math.max(Math.trunc(rawLimit), 1), 1000)
         : undefined;
 
-      const traceFilters: TraceFilters = parseTraceFilterBody(body);
+      const traceFilters: TraceFilters = {
+        ...parseTraceFilterBody(body),
+        resourceScopes: await resolveResourceScopesFromBody(
+          body,
+          databaseProps.tenantId,
+        ),
+      };
 
       const request: TraceAnalyticsRequest = {
         projectId: databaseProps.tenantId,
@@ -1800,6 +1865,9 @@ router.post(
         ? (body["limit"] as number)
         : undefined;
 
+      const resourceScopes: Array<ResourceEntityScope> | undefined =
+        await resolveResourceScopesFromBody(body, databaseProps.tenantId);
+
       const request: AnalyticsRequest = {
         projectId: databaseProps.tenantId,
         startTime,
@@ -1810,6 +1878,7 @@ router.post(
         aggregation,
         aggregationField,
         serviceIds,
+        resourceScopes,
         severityTexts,
         bodySearchText,
         traceIds,

package/Server/Infrastructure/Postgres/SchemaMigrations/1787500000000-AddEnableSearchEngineIndexingToStatusPage.ts

@@ -0,0 +1,30 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Status page owners can now keep their page out of Google/Bing while it stays
+ * reachable by link. Indexing stays on unless it is turned off, so the column
+ * defaults to true.
+ *
+ * ADD COLUMN ... NOT NULL DEFAULT true populates every existing row with true
+ * in the same statement, so no backfill is needed and every status page that
+ * exists today keeps being indexed exactly as it is now. That matters because
+ * the renderers treat "not false" as indexable: a NULL row would read as
+ * indexable anyway, but there is no reason to leave that to interpretation.
+ */
+export class AddEnableSearchEngineIndexingToStatusPage1787500000000
+  implements MigrationInterface
+{
+  public name = "AddEnableSearchEngineIndexingToStatusPage1787500000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" ADD "enableSearchEngineIndexing" boolean NOT NULL DEFAULT true`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" DROP COLUMN "enableSearchEngineIndexing"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1787600000000-AddNetworkDeviceReachabilityColumns.ts

@@ -0,0 +1,47 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Reachability becomes the OUTCOME of the last poll instead of the age of
+ * the last success.
+ *
+ * "lastSeenAt within 15 minutes = up" could not tell "the device did not
+ * answer" apart from "the probe has not asked recently", so any fleet whose
+ * real poll cadence exceeded 15 minutes — and any device configured with a
+ * polling interval of 15 minutes or more — read as permanently down while
+ * its own interface inventory, written by those same successful walks, read
+ * as up.
+ *
+ * lastPolledAt records every ATTEMPT and isReachable records its result;
+ * lastSeenAt keeps its existing meaning (last successful walk).
+ *
+ * Backfill: an existing row with a lastSeenAt did answer the last walk we
+ * have any record of — there is no record of a failure — so it is seeded
+ * reachable, with that timestamp as its last attempt. Rows that were never
+ * seen stay NULL and read as Pending, exactly as they did before.
+ */
+export class AddNetworkDeviceReachabilityColumns1787600000000
+  implements MigrationInterface
+{
+  public name = "AddNetworkDeviceReachabilityColumns1787600000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "lastPolledAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "isReachable" boolean`,
+    );
+    await queryRunner.query(
+      `UPDATE "NetworkDevice" SET "lastPolledAt" = "lastSeenAt", "isReachable" = true WHERE "lastSeenAt" IS NOT NULL`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "isReachable"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "lastPolledAt"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -528,6 +528,8 @@ import { AddAIConversationPageContext1787100000000 } from "./1787100000000-AddAI
 import { AddAIChatMessageFeedback1787200000000 } from "./1787200000000-AddAIChatMessageFeedback";
 import { AddEpisodeMemberNotifyIndexes1787300000000 } from "./1787300000000-AddEpisodeMemberNotifyIndexes";
 import { AddDeviceRoleAndDeclaredLinkParent1787400000000 } from "./1787400000000-AddDeviceRoleAndDeclaredLinkParent";
+import { AddEnableSearchEngineIndexingToStatusPage1787500000000 } from "./1787500000000-AddEnableSearchEngineIndexingToStatusPage";
+import { AddNetworkDeviceReachabilityColumns1787600000000 } from "./1787600000000-AddNetworkDeviceReachabilityColumns";
 
 export default [
   InitialMigration,
@@ -1060,4 +1062,6 @@ export default [
   AddAIChatMessageFeedback1787200000000,
   AddEpisodeMemberNotifyIndexes1787300000000,
   AddDeviceRoleAndDeclaredLinkParent1787400000000,
+  AddEnableSearchEngineIndexingToStatusPage1787500000000,
+  AddNetworkDeviceReachabilityColumns1787600000000,
 ];

package/Server/Middleware/UserAuthorization.ts

@@ -449,8 +449,17 @@ export default class UserMiddleware {
         globalValue,
         null,
       );
-      res.set("global-permissions", globalValue);
-      res.set("global-permissions-hash", globalPermissionsHash);
+
+      if (
+        !(
+          req.headers &&
+          req.headers["global-permissions-hash"] &&
+          req.headers["global-permissions-hash"] === globalPermissionsHash
+        )
+      ) {
+        res.set("global-permissions", globalValue);
+        res.set("global-permissions-hash", globalPermissionsHash);
+      }
     }
 
     // set project permissions hash.

package/Server/Services/ApiKeyPermissionService.ts

@@ -1,20 +1,120 @@
 import CreateBy from "../Types/Database/CreateBy";
-import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import DeleteBy from "../Types/Database/DeleteBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import UpdateBy from "../Types/Database/UpdateBy";
 import DatabaseService from "./DatabaseService";
-import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import Model from "../../Models/DatabaseModels/ApiKeyPermission";
+import Label from "../../Models/DatabaseModels/Label";
+import ObjectID from "../../Types/ObjectID";
+import Permission from "../../Types/Permission";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
+
+/*
+ * 60s is the worst-case staleness on any single API node after a key's
+ * permissions are edited. We invalidate in-process immediately on
+ * create/update/delete; this TTL is the upper bound for *other* processes
+ * (same bound the ApiKeyService key cache accepted).
+ */
+const PERMISSIONS_TTL_MS: number = 60 * 1000;
+
+interface CachedApiKeyPermissionRow {
+  permission: Permission;
+  labelIds: Array<string>;
+  isBlockPermission: boolean | undefined;
+}
+
+export interface ApiKeyPermissionRow {
+  permission: Permission;
+  labelIds: Array<ObjectID>;
+  isBlockPermission: boolean | undefined;
+}
+
 export class Service extends DatabaseService<Model> {
+  /*
+   * Cache of `apiKeyId -> permission rows`. The API-key auth path builds the
+   * request's tenant permissions from these rows on every request; without it
+   * that's a Postgres findBy (with a labels join) per request.
+   */
+  private permissionCache: InMemoryTTLCache<Array<CachedApiKeyPermissionRow>> =
+    new InMemoryTTLCache(10_000);
+
   public constructor() {
     super(Model);
   }
 
+  public clearCache(): void {
+    this.permissionCache.clear();
+  }
+
+  /**
+   * Resolves the permission rows granted to an API key, with a short-lived
+   * in-process cache. Returns freshly built objects on every call (hit or
+   * miss), so callers never share mutable state with the cache. Use this from
+   * the auth hot path instead of calling `findBy` directly.
+   */
+  @CaptureSpan()
+  public async findPermissionsByApiKeyId(
+    apiKeyId: ObjectID,
+  ): Promise<Array<ApiKeyPermissionRow>> {
+    const cacheKey: string = apiKeyId.toString();
+
+    let cachedRows: Array<CachedApiKeyPermissionRow> | undefined =
+      this.permissionCache.get(cacheKey);
+
+    if (cachedRows === undefined) {
+      const rows: Array<Model> = await this.findBy({
+        query: {
+          apiKeyId: apiKeyId,
+        },
+        select: {
+          permission: true,
+          labels: {
+            _id: true,
+          },
+          isBlockPermission: true,
+        },
+        limit: LIMIT_MAX,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+      });
+
+      cachedRows = rows.map((row: Model): CachedApiKeyPermissionRow => {
+        return {
+          permission: row.permission!,
+          labelIds: (row.labels ?? []).map((label: Label) => {
+            return label.id!.toString();
+          }),
+          isBlockPermission: row.isBlockPermission,
+        };
+      });
+
+      this.permissionCache.set(cacheKey, cachedRows, PERMISSIONS_TTL_MS);
+    }
+
+    return cachedRows.map(
+      (row: CachedApiKeyPermissionRow): ApiKeyPermissionRow => {
+        return {
+          permission: row.permission,
+          labelIds: row.labelIds.map((id: string) => {
+            return new ObjectID(id);
+          }),
+          isBlockPermission: row.isBlockPermission,
+        };
+      },
+    );
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,
   ): Promise<OnCreate<Model>> {
+    this.clearCache();
+
     if (!createBy.data.apiKeyId) {
       throw new BadDataException("API Key ID is required to create permission");
     }
@@ -92,6 +192,12 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
+    /*
+     * We don't know which keys are being updated without a query; updates
+     * are rare so clearing is cheap.
+     */
+    this.clearCache();
+
     if (updateBy.data.labels && updateBy.data.labels.length > 0) {
       const existingPermissions: Array<Model> = await this.findBy({
         query: updateBy.query,
@@ -153,6 +259,14 @@ export class Service extends DatabaseService<Model> {
 
     return { updateBy, carryForward: null };
   }
+
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    this.clearCache();
+    return { deleteBy, carryForward: null };
+  }
 }
 
 export default new Service();

package/Server/Services/DatabaseService.ts

@@ -34,6 +34,7 @@ import Encryption from "../Utils/Encryption";
 import PasswordHash from "../Utils/PasswordHash";
 import PostgresErrorTranslator from "../Utils/Database/PostgresErrorTranslator";
 import logger, { LogAttributes } from "../Utils/Logger";
+import ConfigLogLevel from "../Types/ConfigLogLevel";
 import BaseService from "./BaseService";
 import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import { WorkflowRoute } from "../../ServiceRoute";
@@ -2268,6 +2269,14 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
        */
       const affectedItems: Array<TBaseModel> = [];
 
+      /*
+       * The per-item debug payload below is a pretty-printed JSON.stringify
+       * of every matched row; skip building it entirely unless the log level
+       * is DEBUG, since logger.debug() no-ops at any other level.
+       */
+      const isDebugLogEnabled: boolean =
+        logger.getLogLevel() === ConfigLogLevel.DEBUG;
+
       for (const item of items) {
         /*
          * _id must be set AFTER the spread: update data can carry an
@@ -2282,12 +2291,14 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
           _id: item._id!,
         } as any;
 
-        logger.debug("Updated Item", {
-          projectId: updateBy.props.tenantId?.toString(),
-        } as LogAttributes);
-        logger.debug(JSON.stringify(updatedItem, null, 2), {
-          projectId: updateBy.props.tenantId?.toString(),
-        } as LogAttributes);
+        if (isDebugLogEnabled) {
+          logger.debug("Updated Item", {
+            projectId: updateBy.props.tenantId?.toString(),
+          } as LogAttributes);
+          logger.debug(JSON.stringify(updatedItem, null, 2), {
+            projectId: updateBy.props.tenantId?.toString(),
+          } as LogAttributes);
+        }
 
         if (hasRelationUpdates) {
           await this.getRepository().save(updatedItem);

package/Server/Services/LogAggregationService.ts

@@ -10,6 +10,10 @@ import AnalyticsTableName from "../../Types/AnalyticsDatabase/AnalyticsTableName
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { DbJSONResponse, Results } from "./AnalyticsDatabaseService";
 import ServiceType from "../../Types/Telemetry/ServiceType";
+import {
+  appendResourceScopeFilters,
+  ResourceEntityScope,
+} from "../Utils/Telemetry/ResourceEntityFilter";
 
 export interface HistogramBucket {
   time: string;
@@ -27,6 +31,15 @@ export interface HistogramRequest {
   bucketSizeInMinutes: number;
   serviceIds?: Array<ObjectID> | undefined;
   entityKeys?: Array<string> | undefined;
+  /*
+   * Resource-facet selections (Kubernetes cluster / host / docker host /
+   * podman host) already resolved to their entity keys. One scope per
+   * facet: the branches inside a scope OR (a row proves membership either
+   * by being primary-keyed on the resource or by carrying its entity key),
+   * and the scopes AND with each other so two facets intersect. See
+   * ResourceEntityFilter.
+   */
+  resourceScopes?: Array<ResourceEntityScope> | undefined;
   severityTexts?: Array<string> | undefined;
   bodySearchText?: string | undefined;
   traceIds?: Array<string> | undefined;
@@ -49,6 +62,15 @@ export interface FacetRequest {
   limit?: number | undefined;
   serviceIds?: Array<ObjectID> | undefined;
   entityKeys?: Array<string> | undefined;
+  /*
+   * Resource-facet selections (Kubernetes cluster / host / docker host /
+   * podman host) already resolved to their entity keys. One scope per
+   * facet: the branches inside a scope OR (a row proves membership either
+   * by being primary-keyed on the resource or by carrying its entity key),
+   * and the scopes AND with each other so two facets intersect. See
+   * ResourceEntityFilter.
+   */
+  resourceScopes?: Array<ResourceEntityScope> | undefined;
   severityTexts?: Array<string> | undefined;
   bodySearchText?: string | undefined;
   traceIds?: Array<string> | undefined;
@@ -70,6 +92,15 @@ export interface AnalyticsRequest {
   aggregation: AnalyticsAggregation;
   aggregationField?: string | undefined;
   serviceIds?: Array<ObjectID> | undefined;
+  /*
+   * Resource-facet selections (Kubernetes cluster / host / docker host /
+   * podman host) already resolved to their entity keys. One scope per
+   * facet: the branches inside a scope OR (a row proves membership either
+   * by being primary-keyed on the resource or by carrying its entity key),
+   * and the scopes AND with each other so two facets intersect. See
+   * ResourceEntityFilter.
+   */
+  resourceScopes?: Array<ResourceEntityScope> | undefined;
   severityTexts?: Array<string> | undefined;
   bodySearchText?: string | undefined;
   traceIds?: Array<string> | undefined;
@@ -764,6 +795,7 @@ export class LogAggregationService {
       HistogramRequest,
       | "serviceIds"
       | "entityKeys"
+      | "resourceScopes"
       | "severityTexts"
       | "bodySearchText"
       | "traceIds"
@@ -794,6 +826,8 @@ export class LogAggregationService {
       );
     }
 
+    appendResourceScopeFilters(statement, request.resourceScopes);
+
     if (request.severityTexts && request.severityTexts.length > 0) {
       statement.append(
         SQL` AND severityText IN (${{

package/Server/Services/LogService.ts

@@ -1,11 +1,32 @@
 import ClickhouseDatabase from "../Infrastructure/ClickhouseDatabase";
 import AnalyticsDatabaseService from "./AnalyticsDatabaseService";
 import Log from "../../Models/AnalyticsModels/Log";
+import FindBy from "../Types/AnalyticsDatabase/FindBy";
+import { OnFind } from "../Types/AnalyticsDatabase/Hooks";
+import ResourceEntityFilter from "../Utils/Telemetry/ResourceEntityFilter";
 
 export class LogService extends AnalyticsDatabaseService<Log> {
   public constructor(clickhouseDatabase?: ClickhouseDatabase | undefined) {
     super({ modelType: Log, database: clickhouseDatabase });
   }
+
+  /*
+   * Resolve the logs explorer's resource-facet selections (a Kubernetes
+   * cluster, a host, ...) before the query is compiled. They arrive as
+   * Postgres ids under `resourceFilters`; matching them needs the
+   * resource's entity key, which only Postgres can supply. See
+   * ResourceEntityFilter.
+   */
+  protected override async onBeforeFind(
+    findBy: FindBy<Log>,
+  ): Promise<OnFind<Log>> {
+    await ResourceEntityFilter.rewriteAnalyticsQuery({
+      query: findBy.query as unknown as Record<string, unknown>,
+      projectId: findBy.props?.tenantId,
+    });
+
+    return { findBy, carryForward: null };
+  }
 }
 
 export default new LogService();

package/Server/Services/NetworkSiteService.ts

@@ -849,7 +849,16 @@ export class Service extends DatabaseService<Model> {
       select: {
         _id: true,
         currentMonitorStatusId: true,
+        /*
+         * All four reachability inputs. isReachable is the one that decides
+         * up/down; the other three only size the "polling has stopped
+         * entirely" backstop. Selecting lastSeenAt alone silently drops the
+         * rollup back to the old freshness rule.
+         */
+        isReachable: true,
+        lastPolledAt: true,
         lastSeenAt: true,
+        pollingIntervalInMinutes: true,
       },
       limit: LIMIT_MAX,
       skip: 0,
@@ -908,7 +917,10 @@ export class Service extends DatabaseService<Model> {
           monitorStatusPriority: statusId
             ? priorityByStatusId.get(statusId)
             : undefined,
+          isReachable: device.isReachable,
+          lastPolledAt: device.lastPolledAt,
           lastSeenAt: device.lastSeenAt,
+          pollingIntervalInMinutes: device.pollingIntervalInMinutes,
         };
       },
     );

package/Server/Services/SpanService.ts

@@ -14,6 +14,9 @@ import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import InBetween from "../../Types/BaseDatabase/InBetween";
 import Includes from "../../Types/BaseDatabase/Includes";
 import ObjectID from "../../Types/ObjectID";
+import FindBy from "../Types/AnalyticsDatabase/FindBy";
+import { OnFind } from "../Types/AnalyticsDatabase/Hooks";
+import ResourceEntityFilter from "../Utils/Telemetry/ResourceEntityFilter";
 
 /**
  * Columns the proj_hist_by_minute projection can answer with. If a count
@@ -35,6 +38,24 @@ export class SpanService extends AnalyticsDatabaseService<Span> {
     super({ modelType: Span, database: clickhouseDatabase });
   }
 
+  /*
+   * Resolve the traces explorer's resource-facet selections (a Kubernetes
+   * cluster, a host, ...) before the query is compiled. They arrive as
+   * Postgres ids under `resourceFilters`; matching them needs the
+   * resource's entity key, which only Postgres can supply. See
+   * ResourceEntityFilter.
+   */
+  protected override async onBeforeFind(
+    findBy: FindBy<Span>,
+  ): Promise<OnFind<Span>> {
+    await ResourceEntityFilter.rewriteAnalyticsQuery({
+      query: findBy.query as unknown as Record<string, unknown>,
+      projectId: findBy.props?.tenantId,
+    });
+
+    return { findBy, carryForward: null };
+  }
+
   /**
    * Normalize a JSON-deserialized date value to a Date instance. When a query
    * crosses the API boundary, InBetween's startValue/endValue come back as ISO

package/Server/Services/TraceAggregationService.ts

@@ -11,6 +11,10 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { DbJSONResponse, Results } from "./AnalyticsDatabaseService";
 import logger from "../Utils/Logger";
 import ServiceType from "../../Types/Telemetry/ServiceType";
+import {
+  appendResourceScopeFilters,
+  ResourceEntityScope,
+} from "../Utils/Telemetry/ResourceEntityFilter";
 import ResourceFacetResolver, {
   ResolvedFacetValue,
   ResourceFacetSpec,
@@ -33,6 +37,15 @@ export type TraceAttributeFilters = Record<string, TraceAttributeFilterValue>;
 export interface TraceFilters {
   serviceIds?: Array<ObjectID> | undefined;
   entityKeys?: Array<string> | undefined;
+  /*
+   * Resource-facet selections (Kubernetes cluster / host / docker host /
+   * podman host) already resolved to their entity keys. One scope per
+   * facet: the branches inside a scope OR (a span proves membership either
+   * by being primary-keyed on the resource or by carrying its entity key),
+   * and the scopes AND with each other so two facets intersect. See
+   * ResourceEntityFilter.
+   */
+  resourceScopes?: Array<ResourceEntityScope> | undefined;
   statusCodes?: Array<number> | undefined;
   spanKinds?: Array<string> | undefined;
   spanNames?: Array<string> | undefined;
@@ -1008,6 +1021,8 @@ export class TraceAggregationService {
       );
     }
 
+    appendResourceScopeFilters(statement, request.resourceScopes);
+
     if (request.statusCodes && request.statusCodes.length > 0) {
       statement.append(
         SQL` AND statusCode IN (${{