@oneuptime/common 12.0.24 → 12.0.25

package/Models/AnalyticsModels/Span.ts

@@ -1150,6 +1150,80 @@ export default class Span extends AnalyticsBaseModel {
         accessControl: llmColumnAccessControl,
       });
 
+    /*
+     * Employee identity columns. Denormalized at ingest from the OTel general
+     * semantic-convention identity attributes (user.id / user.email / team.id)
+     * and the gateway + coding-agent fallbacks — see
+     * LlmUserIdAttributeKeys in Common/Types/Telemetry/LlmConventions.ts.
+     *
+     * These answer the question the trace-only LLM feature could not: which
+     * PERSON, and which cost centre, does this spend belong to. They are
+     * populated only on LLM spans (the extractor gates them on isLlmSpan), so
+     * the RUM and HTTP fleet — which also carries user.id — pays nothing for
+     * them.
+     *
+     * They hold real identifying data, so TraceScrubRuleService.scrubSpan
+     * applies the project's Attributes-scoped scrub rules to them just as it
+     * does to the attribute they were derived from.
+     */
+    const llmUserIdColumn: AnalyticsTableColumn = new AnalyticsTableColumn({
+      key: "llmUserId",
+      isLowCardinality: true,
+      title: "LLM User ID",
+      description:
+        "Id of the employee / internal actor who made this LLM call (user.id, enduser.id, or the gateway / coding-agent equivalent). NOT the caller's own downstream customer — that identity is deliberately never mapped here. '' when the instrumentation reports none.",
+      required: false,
+      type: TableColumnType.Text,
+      /*
+       * Set index sized like idx_llm_request_model: a project's employee
+       * roster is in the hundreds-to-low-thousands, so 1000 distinct values
+       * per granule keeps the index useful for the "one person's spend"
+       * query without degenerating into a per-granule scan.
+       */
+      skipIndex: {
+        name: "idx_llm_user_id",
+        type: SkipIndexType.Set,
+        params: [1000],
+        granularity: 4,
+      },
+      accessControl: llmColumnAccessControl,
+    });
+
+    const llmUserEmailColumn: AnalyticsTableColumn = new AnalyticsTableColumn({
+      key: "llmUserEmail",
+      isLowCardinality: true,
+      title: "LLM User Email",
+      description:
+        "Email of the employee / internal actor who made this LLM call (user.email, emitted natively by Claude Code, Gemini CLI and Codex). Subject to the project's Attributes-scoped trace scrub rules. '' when the instrumentation reports none.",
+      required: false,
+      type: TableColumnType.Text,
+      // Same sizing rationale as idx_llm_user_id — one row per employee.
+      skipIndex: {
+        name: "idx_llm_user_email",
+        type: SkipIndexType.Set,
+        params: [1000],
+        granularity: 4,
+      },
+      accessControl: llmColumnAccessControl,
+    });
+
+    const llmTeamColumn: AnalyticsTableColumn = new AnalyticsTableColumn({
+      key: "llmTeam",
+      isLowCardinality: true,
+      title: "LLM Team",
+      description:
+        "Team / cost centre the LLM spend charges to (team.id, cost_center, department — conventionally set via OTEL_RESOURCE_ATTRIBUTES). '' when none is reported.",
+      required: false,
+      type: TableColumnType.Text,
+      /*
+       * No skip index, mirroring llmResponseModel. Teams number in the tens:
+       * a Set index would match nearly every granule and cost more to read
+       * than the filter it saves, and the LowCardinality dictionary already
+       * makes the column cheap to scan.
+       */
+      accessControl: llmColumnAccessControl,
+    });
+
     const retentionDateColumn: AnalyticsTableColumn = new AnalyticsTableColumn({
       key: "retentionDate",
       codec: [{ codec: "DoubleDelta" }, { codec: "ZSTD", level: 1 }],
@@ -1245,6 +1319,9 @@ export default class Span extends AnalyticsBaseModel {
         llmTotalTokensColumn,
         llmCostColumn,
         llmConversationIdColumn,
+        llmUserIdColumn,
+        llmUserEmailColumn,
+        llmTeamColumn,
         retentionDateColumn,
       ],
       projections: [
@@ -1574,4 +1651,28 @@ export default class Span extends AnalyticsBaseModel {
   public set llmConversationId(v: string | undefined) {
     this.setColumnValue("llmConversationId", v);
   }
+
+  public get llmUserId(): string | undefined {
+    return this.getColumnValue("llmUserId") as string | undefined;
+  }
+
+  public set llmUserId(v: string | undefined) {
+    this.setColumnValue("llmUserId", v);
+  }
+
+  public get llmUserEmail(): string | undefined {
+    return this.getColumnValue("llmUserEmail") as string | undefined;
+  }
+
+  public set llmUserEmail(v: string | undefined) {
+    this.setColumnValue("llmUserEmail", v);
+  }
+
+  public get llmTeam(): string | undefined {
+    return this.getColumnValue("llmTeam") as string | undefined;
+  }
+
+  public set llmTeam(v: string | undefined) {
+    this.setColumnValue("llmTeam", v);
+  }
 }

package/Server/API/BaseAPI.ts

@@ -147,18 +147,6 @@ export default class BaseAPI<
       },
     );
 
-    router.get(
-      `${new this.entityType().getCrudApiPath()?.toString()}/:id/update-item`,
-      UserMiddleware.getUserMiddleware,
-      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
-        try {
-          await this.updateItem(req, res);
-        } catch (err) {
-          next(err);
-        }
-      },
-    );
-
     // Delete
     router.delete(
       `${new this.entityType().getCrudApiPath()?.toString()}/:id`,
@@ -184,18 +172,6 @@ export default class BaseAPI<
       },
     );
 
-    router.get(
-      `${new this.entityType().getCrudApiPath()?.toString()}/:id/delete-item`,
-      UserMiddleware.getUserMiddleware,
-      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
-        try {
-          await this.deleteItem(req, res);
-        } catch (err) {
-          next(err);
-        }
-      },
-    );
-
     this.router = router;
     this.service = service;
   }

package/Server/API/SlackAPI.ts

@@ -592,7 +592,6 @@ export default class SlackAPI {
           "Slack Interactive Auth Result: ",
           getLogAttributesFromRequest(req as any),
         );
-        logger.debug(authResult, getLogAttributesFromRequest(req as any));
 
         // if slack uninstall app then,
         if (authResult.payloadType === "app_uninstall") {
@@ -886,7 +885,6 @@ export default class SlackAPI {
           "Slack Events API Request received",
           getLogAttributesFromRequest(req as any),
         );
-        logger.debug(req.body, getLogAttributesFromRequest(req as any));
 
         const payload: JSONObject = req.body;
 

package/Server/Middleware/SlackAuthorization.ts

@@ -1,10 +1,13 @@
 import {
   ExpressResponse,
+  headerValueToString,
   NextFunction,
   OneUptimeRequest,
 } from "../Utils/Express";
+import GlobalCache from "../Infrastructure/GlobalCache";
 import Response from "../Utils/Response";
 import BadDataException from "../../Types/Exception/BadDataException";
+import ServiceUnavailableException from "../../Types/Exception/ServiceUnavailableException";
 import { SlackAppSigningSecret } from "../EnvironmentConfig";
 import crypto from "crypto";
 import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
@@ -21,6 +24,9 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
  */
 const SIGNATURE_PREFIX: string = "v0=";
 const HEX_DIGEST_REGEX: RegExp = /^[a-f0-9]{64}$/i;
+const UNIX_TIMESTAMP_REGEX: RegExp = /^\d+$/;
+const MAX_REQUEST_AGE_IN_SECONDS: number = 5 * 60;
+const REPLAY_CACHE_NAMESPACE: string = "slack-request-replay";
 
 export default class SlackAuthorization {
   @CaptureSpan()
@@ -51,25 +57,41 @@ export default class SlackAuthorization {
     // validate slack signing secret
     const slackSigningSecret: string = SlackAppSigningSecret.toString();
 
-    const slackSignature: string | undefined = req.headers[
-      "x-slack-signature"
-    ] as string | undefined;
-    const timestamp: string = req.headers[
-      "x-slack-request-timestamp"
-    ] as string;
+    const slackSignature: string | undefined = headerValueToString(
+      req.headers["x-slack-signature"],
+    );
+    const timestamp: string =
+      headerValueToString(req.headers["x-slack-request-timestamp"]) || "";
     // Use rawBody for both JSON and URL-encoded requests, fallback to rawFormUrlEncodedBody for backward compatibility
     const requestBody: string =
       (req as OneUptimeRequest).rawBody ||
       (req as OneUptimeRequest).rawFormUrlEncodedBody ||
       "";
 
-    logger.debug(
-      `slackSignature: ${slackSignature}`,
-      getLogAttributesFromRequest(req),
-    );
-    logger.debug(`timestamp: ${timestamp}`, getLogAttributesFromRequest(req));
-    logger.debug(`requestBody: `, getLogAttributesFromRequest(req));
-    logger.debug(requestBody, getLogAttributesFromRequest(req));
+    /*
+     * Slack signs the timestamp specifically so a captured request cannot be
+     * replayed indefinitely. Verify the documented five-minute freshness
+     * window before doing any signature work. The strict decimal check keeps
+     * Number parsing from accepting partial values such as "123abc".
+     */
+    const timestampInSeconds: number = Number(timestamp);
+    const nowInSeconds: number = Math.floor(Date.now() / 1000);
+
+    if (
+      !UNIX_TIMESTAMP_REGEX.test(timestamp) ||
+      !Number.isSafeInteger(timestampInSeconds) ||
+      Math.abs(nowInSeconds - timestampInSeconds) > MAX_REQUEST_AGE_IN_SECONDS
+    ) {
+      logger.error(
+        "Slack request has a missing, malformed, or stale X-Slack-Request-Timestamp header.",
+        getLogAttributesFromRequest(req),
+      );
+      return Response.sendErrorResponse(
+        req,
+        res,
+        new BadDataException("Slack Signature Verification Failed."),
+      );
+    }
 
     const providedDigest: string =
       slackSignature && slackSignature.startsWith(SIGNATURE_PREFIX)
@@ -94,11 +116,6 @@ export default class SlackAuthorization {
       .update(baseString)
       .digest("hex");
 
-    logger.debug(
-      `Generated signature: ${SIGNATURE_PREFIX}${expectedDigest}`,
-      getLogAttributesFromRequest(req),
-    );
-
     /*
      * Both sides are decoded from 64 validated hex characters, so both
      * buffers are 32 bytes and timingSafeEqual cannot throw here.
@@ -120,6 +137,67 @@ export default class SlackAuthorization {
       );
     }
 
+    /*
+     * URL verification and options loading have no side effects and need their
+     * normal response on every valid delivery. All other signed Slack routes
+     * are processed at most once.
+     */
+    const isNaturallyIdempotentRequest: boolean =
+      req.route?.path === "/slack/options-load" ||
+      req.body?.["type"] === "url_verification";
+
+    if (isNaturallyIdempotentRequest) {
+      next();
+      return;
+    }
+
+    /*
+     * Freshness bounds replay to a small window; this atomic cache claim closes
+     * that remaining window across every application replica. The expiry lasts
+     * until this timestamp can no longer pass the freshness check. That can be
+     * almost ten minutes when a sender clock is five minutes ahead.
+     */
+    const replayCacheTtlInSeconds: number = Math.max(
+      timestampInSeconds + MAX_REQUEST_AGE_IN_SECONDS - nowInSeconds + 1,
+      1,
+    );
+
+    let isFirstDelivery: boolean;
+
+    try {
+      isFirstDelivery = await GlobalCache.setStringIfNotExists(
+        REPLAY_CACHE_NAMESPACE,
+        expectedDigest,
+        timestamp,
+        { expiresInSeconds: replayCacheTtlInSeconds },
+      );
+    } catch {
+      /*
+       * Replay protection is part of authentication, so cache failure must
+       * fail closed. Letting the request through would silently restore the
+       * vulnerability whenever Redis is unavailable.
+       */
+      logger.error(
+        "Slack replay protection is unavailable.",
+        getLogAttributesFromRequest(req),
+      );
+      return Response.sendErrorResponse(
+        req,
+        res,
+        new ServiceUnavailableException(
+          "Slack request verification is temporarily unavailable.",
+        ),
+      );
+    }
+
+    if (!isFirstDelivery) {
+      logger.debug(
+        "Duplicate Slack request acknowledged without reprocessing.",
+        getLogAttributesFromRequest(req),
+      );
+      return Response.sendTextResponse(req, res, "");
+    }
+
     logger.debug(
       "Slack request authorized successfully",
       getLogAttributesFromRequest(req),

package/Server/Utils/Telemetry/LlmMetricSpend.ts

@@ -75,6 +75,38 @@ export default class LlmMetricSpend {
     } as AggregateBy<Metric>;
   }
 
+  /**
+   * Aggregate descriptor for the micro-USD cost sum.
+   *
+   * Identical in shape to buildCostAggregateBy, deliberately a SECOND query
+   * rather than a wider name list on the first: the two name lists carry
+   * different units, and a single Sum over both would add micro-USD figures
+   * to USD ones with no way to recover the unit afterwards. Codex spend would
+   * arrive a million times too large and trip every cost budget in the
+   * project. getCostInUSD scales this total once, via
+   * LlmMetricQuery.combineCostTotals.
+   */
+  public static buildMicroUsdCostAggregateBy(
+    scope: LlmMetricScope,
+  ): AggregateBy<Metric> {
+    return {
+      query: LlmMetricQuery.buildMicroUsdCostQuery(scope),
+      aggregationType: AggregationType.Sum,
+      aggregateColumnName: "value",
+      aggregationTimestampColumnName: "time",
+      startTimestamp: scope.startTime,
+      endTimestamp: scope.endTime,
+      aggregationInterval: AggregationInterval.Total,
+      // Same fail-loud reasoning as the USD query above.
+      timeoutOverflowMode: "throw",
+      limit: LIMIT_PER_PROJECT,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    } as AggregateBy<Metric>;
+  }
+
   /**
    * Aggregate descriptor for the token sum.
    *
@@ -106,14 +138,33 @@ export default class LlmMetricSpend {
     } as AggregateBy<Metric>;
   }
 
-  /** Metric-sourced spend in USD for the scope, or 0 when nothing matched. */
+  /**
+   * Metric-sourced spend in USD for the scope, or 0 when nothing matched.
+   *
+   * Two aggregates, not one, because the recognized cost metrics come in two
+   * UNITS: dollars (the gateways, Claude Code, Cursor) and millionths of a
+   * dollar (the Codex CLI). They are queried apart and scaled before being
+   * added, in LlmMetricQuery.combineCostTotals — the one place the 1e-6
+   * factor lives. Folding the micro-USD names into the USD query would report
+   * Codex spend a million times too high, which for a figure that gates
+   * budget alerting is far worse than reporting nothing.
+   *
+   * The two run in parallel: they hit the same table with disjoint name
+   * filters, and serializing them would double the latency of every budget
+   * evaluation for no benefit.
+   */
   @CaptureSpan()
   public static async getCostInUSD(scope: LlmMetricScope): Promise<number> {
-    const result: AggregatedResult = await MetricService.aggregateBy(
-      this.buildCostAggregateBy(scope),
-    );
+    const [usdResult, microUsdResult]: [AggregatedResult, AggregatedResult] =
+      await Promise.all([
+        MetricService.aggregateBy(this.buildCostAggregateBy(scope)),
+        MetricService.aggregateBy(this.buildMicroUsdCostAggregateBy(scope)),
+      ]);
 
-    return LlmMetricQuery.sumAggregatedRows(result?.data);
+    return LlmMetricQuery.combineCostTotals({
+      usd: LlmMetricQuery.sumAggregatedRows(usdResult?.data),
+      microUsd: LlmMetricQuery.sumAggregatedRows(microUsdResult?.data),
+    });
   }
 
   /** Metric-sourced input/output token totals for the scope. */

package/Server/Utils/Telemetry/LlmSpan.ts

@@ -14,8 +14,11 @@ import {
   LlmRequestModelAttributeKeys,
   LlmResponseModelAttributeKeys,
   LlmSystemAttributeKeys,
+  LlmTeamAttributeKeys,
   LlmToolNameAttributeKeys,
   LlmTotalTokenAttributeKeys,
+  LlmUserEmailAttributeKeys,
+  LlmUserIdAttributeKeys,
 } from "../../../Types/Telemetry/LlmConventions";
 import { AttributeType } from "./Telemetry";
 
@@ -61,6 +64,20 @@ export interface LlmSpanFields {
   llmToolName: string;
   // Conversation / session id grouping calls of one interaction (gen_ai.conversation.id).
   llmConversationId: string;
+  /*
+   * WHO ran the call — the EMPLOYEE / internal actor, never the caller's own
+   * downstream customer. See the block comment above
+   * LlmUserIdAttributeKeys in Common/Types/Telemetry/LlmConventions.ts for
+   * why that distinction is load-bearing rather than pedantic.
+   *
+   * "" when the instrumentation reports no identity, which is still the
+   * common case for library-instrumented server code — only the coding-agent
+   * CLIs and the gateways stamp identity by default.
+   */
+  llmUserId: string;
+  llmUserEmail: string;
+  // Team / cost centre the spend charges to (team.id, cost_center, ...).
+  llmTeam: string;
 }
 
 type SpanAttributes = Dictionary<AttributeType | Array<AttributeType>>;
@@ -83,6 +100,9 @@ export default class LlmSpanUtil {
       llmAgentName: "",
       llmToolName: "",
       llmConversationId: "",
+      llmUserId: "",
+      llmUserEmail: "",
+      llmTeam: "",
     };
   }
 
@@ -184,6 +204,32 @@ export default class LlmSpanUtil {
         attributes,
         LlmConversationIdAttributeKeys,
       );
+
+      /*
+       * Identity is gated on isLlmSpan for exactly the reason the
+       * conversation id above is. "user.id", "user.email" and "team.id" are
+       * GENERIC OTel general-semconv keys — RUM browser spans and ordinary
+       * backend HTTP spans routinely carry them, and those are the
+       * highest-volume span classes there are. Stamping them onto every such
+       * span would copy the value (and pay for its skip index) across the
+       * whole fleet to serve a reader that only ever asks "which employee
+       * spent what on LLM calls". The LLM spans are the only rows that
+       * question reads, so they are the only rows that carry the columns.
+       *
+       * The keys that carry the caller's DOWNSTREAM CUSTOMER rather than the
+       * employee (gen_ai.user, llm.user,
+       * litellm.metadata.user_api_key_end_user_id) are deliberately absent
+       * from these lists — see LlmEndUserAttributeKeys. Reading one of them
+       * here would silently misattribute internal chargeback.
+       */
+      fields.llmUserId = this.getString(attributes, LlmUserIdAttributeKeys);
+
+      fields.llmUserEmail = this.getString(
+        attributes,
+        LlmUserEmailAttributeKeys,
+      );
+
+      fields.llmTeam = this.getString(attributes, LlmTeamAttributeKeys);
     }
 
     /*

package/Server/Utils/Workspace/Slack/Actions/Auth.ts

@@ -65,8 +65,6 @@ export default class SlackAuthAction {
     const { req } = data;
 
     logger.debug("Starting Slack request authorization");
-    logger.debug(`Request body: `);
-    logger.debug(req.body);
 
     let payload: JSONObject = req.body;
 
@@ -74,9 +72,6 @@ export default class SlackAuthAction {
       payload = JSON.parse(payload["payload"]);
     }
 
-    logger.debug(`Payload: `);
-    logger.debug(payload);
-
     let slackUserId: string | undefined = (
       (payload as JSONObject)["user"] as JSONObject
     )?.["id"] as string;
@@ -216,11 +211,6 @@ export default class SlackAuthAction {
       };
 
       actions.push(action);
-      logger.debug("View values: ");
-      logger.debug(viewValues);
-
-      logger.debug("Actions: ");
-      logger.debug(actions);
     }
 
     if (payload["callback_id"]) {
@@ -296,8 +286,6 @@ export default class SlackAuthAction {
     logger.debug("Slack request authorized successfully", {
       projectId: projectId.toString(),
     });
-    logger.debug("Slack request: ");
-    logger.debug(slackRequest);
 
     return slackRequest;
   }