@oneuptime/common 12.0.20 → 12.0.21

package/Server/Utils/Telemetry/ChangeEventRow.ts

@@ -0,0 +1,228 @@
+import Dictionary from "../../../Types/Dictionary";
+import OneUptimeDate from "../../../Types/Date";
+import ObjectID from "../../../Types/ObjectID";
+import { JSONArray, JSONObject } from "../../../Types/JSON";
+/*
+ * Type-only: pulling the ingest service's runtime graph into this pure
+ * module would drag ClickHouse/DB deps into every test that touches it.
+ */
+import type { TelemetryServiceMetadata } from "../../Services/OpenTelemetryIngestService";
+
+/*
+ * Change-event ingest parsing + ClickHouse row building. Pure on purpose
+ * (no network, no request objects) so App/Tests can pin every validation
+ * rule without a server.
+ */
+
+/*
+ * Events whose source timestamp is outside this window are stamped with
+ * the ingestion time instead (original preserved in attributes). The
+ * table partitions by toYYYYMMDD(time), so a forged or garbage timestamp
+ * must not be allowed to create arbitrary partitions.
+ */
+export const MAX_CHANGE_EVENT_AGE_IN_DAYS: number = 366;
+export const MAX_CHANGE_EVENT_FUTURE_SKEW_IN_MINUTES: number = 60;
+
+// Caps keep a CI script's mistake from becoming a storage problem.
+export const MAX_CHANGE_EVENTS_PER_REQUEST: number = 100;
+export const MAX_CHANGE_EVENT_TITLE_LENGTH: number = 500;
+export const MAX_CHANGE_EVENT_DESCRIPTION_LENGTH: number = 5000;
+export const MAX_CHANGE_EVENT_TYPE_LENGTH: number = 50;
+export const MAX_CHANGE_EVENT_ATTRIBUTES: number = 50;
+
+export const DEFAULT_CHANGE_EVENT_TYPE: string = "deployment";
+
+/*
+ * Serviceless change events (project-wide markers) have no service
+ * retention ladder to consult; deploy markers are tiny and valuable for
+ * long-baseline comparisons, so keep them a year.
+ */
+export const DEFAULT_CHANGE_EVENT_RETENTION_IN_DAYS: number = 365;
+
+export interface ParsedChangeEventEntry {
+  /** null → stamp with the ingestion time. */
+  time: Date | null;
+  eventType: string;
+  title: string;
+  description: string;
+  attributes: Dictionary<string>;
+}
+
+function parseEntryTime(value: unknown): Date | null {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    /*
+     * Epoch seconds vs milliseconds: anything below 1e12 read as ms would
+     * be before 2001 — CI clocks don't say that; treat it as seconds.
+     */
+    const ms: number = value < 1e12 ? value * 1000 : value;
+    const date: Date = new Date(ms);
+    return Number.isNaN(date.getTime()) ? null : date;
+  }
+  if (typeof value === "string" && value.trim() !== "") {
+    const date: Date = new Date(value);
+    return Number.isNaN(date.getTime()) ? null : date;
+  }
+  return null;
+}
+
+/**
+ * Validate one raw ingest entry. Returns null when the entry cannot be a
+ * change event at all (no usable title); every other malformation is
+ * repaired (defaults, trims, caps) rather than rejected — CI pipelines
+ * should not fail a deploy over a long description.
+ */
+export function parseChangeEventIngestEntry(
+  entry: JSONObject,
+): ParsedChangeEventEntry | null {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+    return null;
+  }
+
+  const rawTitle: unknown = entry["title"] ?? entry["name"];
+  const title: string =
+    typeof rawTitle === "string"
+      ? rawTitle.trim().slice(0, MAX_CHANGE_EVENT_TITLE_LENGTH)
+      : "";
+
+  if (title === "") {
+    return null;
+  }
+
+  const rawEventType: unknown = entry["eventType"] ?? entry["type"];
+  const eventType: string =
+    typeof rawEventType === "string" && rawEventType.trim() !== ""
+      ? rawEventType.trim().toLowerCase().slice(0, MAX_CHANGE_EVENT_TYPE_LENGTH)
+      : DEFAULT_CHANGE_EVENT_TYPE;
+
+  const rawDescription: unknown = entry["description"];
+  const description: string =
+    typeof rawDescription === "string"
+      ? rawDescription.trim().slice(0, MAX_CHANGE_EVENT_DESCRIPTION_LENGTH)
+      : "";
+
+  const attributes: Dictionary<string> = {};
+  const rawAttributes: unknown = entry["attributes"];
+  if (
+    rawAttributes &&
+    typeof rawAttributes === "object" &&
+    !Array.isArray(rawAttributes)
+  ) {
+    for (const key of Object.keys(rawAttributes as JSONObject)) {
+      if (key.trim() === "") {
+        continue;
+      }
+      if (Object.keys(attributes).length >= MAX_CHANGE_EVENT_ATTRIBUTES) {
+        break;
+      }
+      const value: unknown = (rawAttributes as JSONObject)[key];
+      if (
+        typeof value === "string" ||
+        typeof value === "number" ||
+        typeof value === "boolean"
+      ) {
+        attributes[key] = String(value);
+      }
+    }
+  }
+
+  return {
+    time: parseEntryTime(entry["time"] ?? entry["timestamp"]),
+    eventType,
+    title,
+    description,
+    attributes,
+  };
+}
+
+/**
+ * Accept the shapes CI scripts actually send: a bare object (one event),
+ * a bare array, or { events: [...] }.
+ */
+export function extractChangeEventEntries(body: unknown): Array<JSONObject> {
+  if (!body) {
+    return [];
+  }
+
+  if (Array.isArray(body)) {
+    return (body as JSONArray).filter((item: unknown): boolean => {
+      return typeof item === "object" && item !== null && !Array.isArray(item);
+    }) as Array<JSONObject>;
+  }
+
+  if (typeof body !== "object") {
+    return [];
+  }
+
+  const asObject: JSONObject = body as JSONObject;
+  const nested: unknown = asObject["events"];
+  if (Array.isArray(nested)) {
+    return extractChangeEventEntries(nested);
+  }
+
+  // A single bare event object — but not the {events: <non-array>} shape.
+  if (nested === undefined && Object.keys(asObject).length > 0) {
+    return [asObject];
+  }
+
+  return [];
+}
+
+/**
+ * ParsedChangeEventEntry -> ChangeEvent ClickHouse row.
+ */
+export function buildChangeEventDbRow(data: {
+  parsed: ParsedChangeEventEntry;
+  projectId: ObjectID;
+  serviceMetadata: TelemetryServiceMetadata | null;
+  retentionDays: number;
+}): JSONObject {
+  const { parsed, projectId, serviceMetadata, retentionDays } = data;
+
+  const ingestionDate: Date = OneUptimeDate.getCurrentDate();
+
+  let eventTime: Date = parsed.time || ingestionDate;
+  let attributes: Dictionary<string> = { ...parsed.attributes };
+
+  const ageInDays: number = OneUptimeDate.getNumberOfDaysBetweenDates(
+    eventTime,
+    ingestionDate,
+  );
+  const futureSkewInMinutes: number =
+    (eventTime.getTime() - ingestionDate.getTime()) / (60 * 1000);
+
+  if (
+    Number.isNaN(eventTime.getTime()) ||
+    ageInDays > MAX_CHANGE_EVENT_AGE_IN_DAYS ||
+    futureSkewInMinutes > MAX_CHANGE_EVENT_FUTURE_SKEW_IN_MINUTES
+  ) {
+    attributes = {
+      ...attributes,
+      "oneuptime.original_time": String(parsed.time),
+    };
+    eventTime = ingestionDate;
+  }
+
+  const retentionDate: Date = OneUptimeDate.addRemoveDays(
+    ingestionDate,
+    retentionDays,
+  );
+
+  return {
+    _id: ObjectID.generateTimeOrdered().toString(),
+    createdAt: OneUptimeDate.toClickhouseDateTime(ingestionDate),
+    projectId: projectId.toString(),
+    ...(serviceMetadata
+      ? {
+          primaryEntityId: serviceMetadata.primaryEntityId.toString(),
+          primaryEntityType: serviceMetadata.primaryEntityType,
+        }
+      : {}),
+    time: OneUptimeDate.toClickhouseDateTime64(eventTime),
+    eventType: parsed.eventType,
+    title: parsed.title,
+    description: parsed.description,
+    attributes,
+    attributeKeys: Object.keys(attributes).sort(),
+    retentionDate: OneUptimeDate.toClickhouseDateTime(retentionDate),
+  } satisfies JSONObject;
+}

package/Server/Views/Partials/AnalyticsConsent.ejs

@@ -28,9 +28,7 @@
     the home/-prefixed page view and CTA listeners. Those are Home's alone and
     stay in head-basic.ejs. Reporting on a captured touch is handed back to
     the page through window.oneUptimeOnAttributionCaptured for the same
-    reason. The Cal booking helper does live here: it is a pure reader over
-    the shared attribution store, and splitting it from the store it reads
-    would be worse than sharing an unused function definition.
+    reason.
 -%>
 <!--
     Consent.
@@ -168,9 +166,8 @@
 
 <!--
     Attribution capture (UTM parameters + ad platform click IDs), and the
-    readers that hand it on to the two places it has to reach: the signup form
-    (through localStorage, same origin) and a Cal.com booking (through the
-    embed's metadata).
+    reader that hands it on to the signup form (through localStorage, same
+    origin).
 
     STORAGE MODEL
 
@@ -211,9 +208,6 @@
         // Mirrors MaxAttributionValueLength on the server.
         var MAX_VALUE_LENGTH = 500;
 
-        // Mirrors MAX_FIRST_TOUCH_LENGTH in App/API/CalWebhook.ts.
-        var MAX_FIRST_TOUCH_LENGTH = 4000;
-
         // Attribution seen on this page but not yet allowed to be stored.
         var pending = null;
 
@@ -384,92 +378,6 @@
             };
         };
 
-        /*
-         * The same attribution, flattened into the scalar string map Cal.com
-         * accepts as booking metadata.
-         *
-         * Keys are the snake_case wire spelling the server parses in
-         * App/API/CalWebhook.ts. The first touch is a nested object, and Cal
-         * metadata values are scalars, so it travels as one JSON string under
-         * ou_first_touch — which is exactly what the webhook expects to parse.
-         *
-         * Returns {} when there is nothing to attribute, so a caller can spread
-         * it unconditionally without sending an empty metadata bag.
-         */
-        /*
-         * `bookingKind` says which conversation this embed books. All three
-         * embeds use the same Cal event type, so without it the webhook cannot
-         * tell a support call from an enterprise demo. It travels in the same
-         * bracketed metadata bag as the attribution and is read back by
-         * App/API/CalWebhook.ts, which allowlists the value.
-         */
-        window.oneUptimeCalAttributionMetadata = function (bookingKind) {
-            var attribution = window.oneUptimeGetAttribution();
-            var config = {};
-
-            /*
-             * Cal takes booking metadata as FLAT, BRACKETED keys on the embed
-             * config — `metadata[utm_source]` — and hands them back on the
-             * webhook as payload.metadata.utm_source.
-             *
-             * Not as a nested `metadata: { utm_source: ... }` object. Cal
-             * serialises each config value into a query parameter, so a nested
-             * object becomes the string "[object Object]" and every key inside
-             * it is lost. Nothing errors; bookings keep being recorded, they
-             * just arrive attributable to nothing — which is precisely the bug
-             * this whole path exists to fix, so getting the shape wrong here
-             * would have been indistinguishable from not having done the work.
-             *
-             * https://cal.com/help/embedding/prefill-booking-form-embed
-             */
-            function put(key, value, maxLength) {
-                if (value) {
-                    config['metadata[' + key + ']'] =
-                        String(value).slice(0, maxLength || MAX_VALUE_LENGTH);
-                }
-            }
-
-            Object.keys(UTM_KEY_MAP).forEach(function (param) {
-                put(param, attribution.utm[UTM_KEY_MAP[param]]);
-            });
-
-            put('utm_url', attribution.utm.utmUrl);
-
-            Object.keys(attribution.clickIds).forEach(function (param) {
-                put(param, attribution.clickIds[param]);
-            });
-
-            if (attribution.firstTouch) {
-                var serialized = JSON.stringify(attribution.firstTouch);
-                /*
-                 * The first touch is JSON, so it gets the JSON bound, NOT the
-                 * 500-char per-value one. A realistic first touch — five UTM
-                 * values, a click id, and a landing URL that repeats them all
-                 * as query parameters — runs past 500 characters easily, and
-                 * truncating JSON produces a string the webhook's JSON.parse
-                 * rejects. It would drop the whole first touch, silently.
-                 *
-                 * Mirrors MAX_FIRST_TOUCH_LENGTH in App/API/CalWebhook.ts.
-                 */
-                if (serialized.length <= MAX_FIRST_TOUCH_LENGTH) {
-                    put('ou_first_touch', serialized, MAX_FIRST_TOUCH_LENGTH);
-                }
-            }
-
-            /*
-             * Unconditional, unlike everything above it. The attribution keys
-             * describe the visitor and are absent when there is nothing to say
-             * about them; the booking kind describes the embed, which always
-             * knows what it is. A booking from a visitor who refused
-             * attribution storage still arrives knowing it was a demo.
-             */
-            if (bookingKind) {
-                config['metadata[ou_booking_kind]'] = String(bookingKind).slice(0, MAX_VALUE_LENGTH);
-            }
-
-            return config;
-        };
-
         var touch = readTouchFromUrl();
 
         if (touch) {

package/Tests/App/Dashboard/DashboardChartWidgetZoom.test.tsx

@@ -184,6 +184,7 @@ function renderWidget(
 
 interface CapturedChartProps {
   metricViewData: MetricViewData;
+  metricResults?: Array<Record<string, unknown>> | undefined;
   onTimeRangeSelect?: ((startTime: Date, endTime: Date) => void) | undefined;
   enableSeriesActions?: boolean | undefined;
 }
@@ -288,6 +289,69 @@ describe("dashboard chart widget drag-to-zoom", () => {
     expect(lastChartProps().metricViewData.rangeToken).toBe(TimeRange.CUSTOM);
   });
 
+  test("a stale fetch response can never overwrite a newer window's data", async () => {
+    /*
+     * Zoom then Reset puts two aggregate calls in flight; if the SLOWER
+     * (zoom) response lands last, its data must be discarded — otherwise
+     * the chart paints the zoomed window's series under the dashboard
+     * window's axis.
+     */
+    const pendingFetches: Array<(value: unknown) => void> = [];
+    fetchResultsMock.mockImplementation(() => {
+      return new Promise((resolve: (value: unknown) => void) => {
+        pendingFetches.push(resolve);
+      });
+    });
+
+    renderWidget();
+
+    await waitFor(() => {
+      expect(pendingFetches.length).toBe(1);
+    });
+    act(() => {
+      pendingFetches[0]?.([{ data: [], truncated: false }]);
+    });
+    await waitFor(() => {
+      expect(screen.getByTestId("metric-charts")).toBeInTheDocument();
+    });
+
+    act(() => {
+      lastChartProps().onTimeRangeSelect?.(ZOOM_START, ZOOM_END);
+    });
+    await waitFor(() => {
+      expect(pendingFetches.length).toBe(2);
+    });
+
+    fireEvent.click(screen.getByText("Reset"));
+    await waitFor(() => {
+      expect(pendingFetches.length).toBe(3);
+    });
+
+    const staleZoomResults: Array<Record<string, unknown>> = [
+      { data: [{ marker: "stale-zoom" }], truncated: false },
+    ];
+    const freshResetResults: Array<Record<string, unknown>> = [
+      { data: [], truncated: false },
+    ];
+
+    // The newer (reset) fetch answers first…
+    act(() => {
+      pendingFetches[2]?.(freshResetResults);
+    });
+    await waitFor(() => {
+      expect(lastChartProps().metricResults).toBe(freshResetResults);
+    });
+
+    // …then the stale zoom fetch answers last and must be ignored.
+    act(() => {
+      pendingFetches[1]?.(staleZoomResults);
+    });
+    await act(async () => {
+      await Promise.resolve();
+    });
+    expect(lastChartProps().metricResults).toBe(freshResetResults);
+  });
+
   test("edit mode disables zoom and series navigation", async () => {
     renderWidget({ isEditMode: true });
 

package/Tests/App/Dashboard/EventOverlayHook.test.tsx

@@ -0,0 +1,249 @@
+import "@testing-library/jest-dom";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import { cleanup, render, screen, waitFor } from "@testing-library/react";
+import * as React from "react";
+import getJestMockFunction, { MockFunction } from "../../MockType";
+
+/*
+ * The shared event-overlay hook is what puts "what happened here" on every
+ * metric chart: incidents and alerts as solid severity-colored markers
+ * with click-through, change events (deploys) as dashed indigo markers.
+ * It must fetch nothing on public dashboards and survive any single
+ * source failing.
+ */
+
+const getListMock: MockFunction = getJestMockFunction();
+const analyticsGetListMock: MockFunction = getJestMockFunction();
+const isPublicDashboardMock: MockFunction = getJestMockFunction();
+
+/*
+ * The arrow wrappers are load bearing: jest.mock is hoisted above the
+ * compiled requires, so the mock variables above are still unassigned when
+ * the factory runs.
+ */
+jest.mock("../../../UI/Utils/ModelAPI/ModelAPI", () => {
+  return {
+    __esModule: true,
+    default: {
+      getList: (...args: Array<any>) => {
+        return getListMock(...args);
+      },
+    },
+  };
+});
+
+jest.mock("../../../UI/Utils/AnalyticsModelAPI/AnalyticsModelAPI", () => {
+  return {
+    __esModule: true,
+    default: {
+      getList: (...args: Array<any>) => {
+        return analyticsGetListMock(...args);
+      },
+    },
+  };
+});
+
+jest.mock(
+  "../../../../App/FeatureSet/Dashboard/src/Components/Dashboard/Utils/PublicDashboardContext",
+  () => {
+    return {
+      __esModule: true,
+      isPublicDashboard: (...args: Array<any>) => {
+        return isPublicDashboardMock(...args);
+      },
+    };
+  },
+);
+
+import useEventTimeReferenceLines, {
+  EventTimeReferenceLines,
+} from "../../../../App/FeatureSet/Dashboard/src/Components/Metrics/Utils/UseEventTimeReferenceLines";
+import ChartTimeReferenceLineProps from "../../../UI/Components/Charts/Types/TimeReferenceLineProps";
+import InBetween from "../../../Types/BaseDatabase/InBetween";
+import ObjectID from "../../../Types/ObjectID";
+import ProjectUtil from "../../../UI/Utils/Project";
+
+const WINDOW: InBetween<Date> = new InBetween<Date>(
+  new Date("2026-08-20T10:00:00.000Z"),
+  new Date("2026-08-20T11:00:00.000Z"),
+);
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "9e1b6b0e-0000-4000-8000-000000000011",
+);
+
+function Probe(props: {
+  enabled: boolean;
+  window: InBetween<Date> | null;
+}): React.ReactElement {
+  const { lines, markerCount }: EventTimeReferenceLines =
+    useEventTimeReferenceLines({
+      enabled: props.enabled,
+      window: props.window,
+    });
+
+  return (
+    <div>
+      <span data-testid="marker-count">{markerCount}</span>
+      {lines.map((line: ChartTimeReferenceLineProps, index: number) => {
+        return (
+          <div
+            key={index}
+            data-testid="marker"
+            data-color={line.color}
+            data-dash={line.strokeDasharray || "solid"}
+            data-clickable={line.onClick ? "yes" : "no"}
+          >
+            {line.label}
+          </div>
+        );
+      })}
+    </div>
+  );
+}
+
+beforeEach(() => {
+  getListMock.mockReset();
+  analyticsGetListMock.mockReset();
+  isPublicDashboardMock.mockReset();
+  isPublicDashboardMock.mockReturnValue(false);
+  jest.spyOn(ProjectUtil, "getCurrentProjectId").mockReturnValue(PROJECT_ID);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  cleanup();
+});
+
+describe("useEventTimeReferenceLines", () => {
+  test("maps incidents, alerts, and change events onto distinct marker styles", async () => {
+    getListMock.mockImplementation((args: { modelType: { name: string } }) => {
+      if (args.modelType.name === "Incident") {
+        return Promise.resolve({
+          data: [
+            {
+              id: new ObjectID("11111111-0000-4000-8000-000000000001"),
+              createdAt: "2026-08-20T10:10:00.000Z",
+              title: "API is down",
+              incidentSeverity: { color: "#123456" },
+            },
+          ],
+        });
+      }
+      return Promise.resolve({
+        data: [
+          {
+            id: new ObjectID("22222222-0000-4000-8000-000000000002"),
+            createdAt: "2026-08-20T10:20:00.000Z",
+            title: "High latency",
+            alertSeverity: undefined,
+          },
+        ],
+      });
+    });
+    analyticsGetListMock.mockResolvedValue({
+      data: [
+        {
+          time: "2026-08-20T10:03:00.000Z",
+          title: "v2.31.0",
+          eventType: "deployment",
+        },
+      ],
+    });
+
+    render(<Probe enabled={true} window={WINDOW} />);
+
+    await waitFor(() => {
+      expect(screen.getByTestId("marker-count").textContent).toBe("3");
+    });
+
+    const markers: Array<HTMLElement> = screen.getAllByTestId("marker");
+    const byLabel: (needle: string) => HTMLElement = (
+      needle: string,
+    ): HTMLElement => {
+      const found: HTMLElement | undefined = markers.find(
+        (marker: HTMLElement) => {
+          return (marker.textContent || "").includes(needle);
+        },
+      );
+      if (!found) {
+        throw new Error(`no marker containing ${needle}`);
+      }
+      return found;
+    };
+
+    const incident: HTMLElement = byLabel("Incident: API is down");
+    expect(incident.dataset["color"]).toBe("#123456");
+    expect(incident.dataset["dash"]).toBe("solid");
+    expect(incident.dataset["clickable"]).toBe("yes");
+
+    // Alert without a severity color falls back to amber.
+    expect(byLabel("Alert: High latency").dataset["color"]).toBe("#fbbf24");
+
+    const deploy: HTMLElement = byLabel("Deploy: v2.31.0");
+    expect(deploy.dataset["color"]).toBe("#6366f1");
+    expect(deploy.dataset["dash"]).toBe("4 4");
+    // Change events have no detail page — no dead-end click handler.
+    expect(deploy.dataset["clickable"]).toBe("no");
+  });
+
+  test("one source failing never takes the others down", async () => {
+    getListMock.mockImplementation((args: { modelType: { name: string } }) => {
+      if (args.modelType.name === "Incident") {
+        return Promise.resolve({
+          data: [
+            {
+              id: new ObjectID("11111111-0000-4000-8000-000000000001"),
+              createdAt: "2026-08-20T10:10:00.000Z",
+              title: "Still here",
+              incidentSeverity: undefined,
+            },
+          ],
+        });
+      }
+      return Promise.resolve({ data: [] });
+    });
+    analyticsGetListMock.mockRejectedValue(new Error("clickhouse hiccup"));
+
+    render(<Probe enabled={true} window={WINDOW} />);
+
+    await waitFor(() => {
+      expect(screen.getByTestId("marker-count").textContent).toBe("1");
+    });
+    expect(screen.getByText(/Incident: Still here/)).toBeInTheDocument();
+  });
+
+  test("public dashboards fetch nothing at all", async () => {
+    isPublicDashboardMock.mockReturnValue(true);
+
+    render(<Probe enabled={true} window={WINDOW} />);
+
+    // Give any (wrong) fetch a chance to fire.
+    await new Promise((resolve: (value: unknown) => void) => {
+      setTimeout(resolve, 20);
+    });
+
+    expect(getListMock).not.toHaveBeenCalled();
+    expect(analyticsGetListMock).not.toHaveBeenCalled();
+    expect(screen.getByTestId("marker-count").textContent).toBe("0");
+  });
+
+  test("disabled and windowless states fetch nothing and yield no lines", async () => {
+    render(<Probe enabled={false} window={WINDOW} />);
+    render(<Probe enabled={true} window={null} />);
+
+    await new Promise((resolve: (value: unknown) => void) => {
+      setTimeout(resolve, 20);
+    });
+
+    expect(getListMock).not.toHaveBeenCalled();
+    expect(analyticsGetListMock).not.toHaveBeenCalled();
+  });
+});