@oneuptime/common 12.0.24 → 12.0.26

package/build/dist/Server/API/TelemetryAPI.js

@@ -5,6 +5,8 @@ import BadDataException from "../../Types/Exception/BadDataException";
 import CommonAPI from "./CommonAPI";
 import TelemetryType from "../../Types/Telemetry/TelemetryType";
 import TelemetryAttributeService from "../Services/TelemetryAttributeService";
+import TelemetrySourceMapService from "../Services/TelemetrySourceMapService";
+import SourceMapResolver from "../Utils/Telemetry/SourceMapResolver";
 import LogAggregationService from "../Services/LogAggregationService";
 import TraceAggregationService from "../Services/TraceAggregationService";
 import ExceptionAggregationService from "../Services/ExceptionAggregationService";
@@ -103,6 +105,54 @@ router.post("/telemetry/exceptions/get-attributes", ...requireExceptionReadAcces
 router.post("/telemetry/exceptions/get-attribute-values", ...requireExceptionReadAccess, async (req, res, next) => {
     return getAttributeValues(req, res, next, TelemetryType.Exception);
 });
+/*
+ * Lazily resolves an exception's parsed stack frames against the source
+ * maps uploaded for its (service, release) pair — see the TelemetrySourceMap
+ * model. Guarded by exception read access, not source-map read access, on
+ * purpose: anyone who may see the exception may see the few original source
+ * lines around its crash site (the snippets in the response). Bulk access to
+ * whole maps stays restricted by the model's own column ACL on `content`.
+ * That is a deliberate trade-off, not an oversight: a caller with exception
+ * read access could reconstruct larger stretches of sourcesContent by
+ * probing many line/column pairs across requests, exactly as they could in
+ * Sentry or Elastic. The content column ACL exists to prevent trivial bulk
+ * export, not to be an information-flow boundary against a team member who
+ * is already trusted to read the project's exceptions.
+ *
+ * Tenant safety: source maps are queried by (tenantId from the authorized
+ * request, serviceId from the body). A serviceId belonging to a different
+ * project simply matches no maps — nothing cross-tenant can be read.
+ */
+router.post("/telemetry/exceptions/resolve-stack-trace", ...requireExceptionReadAccess, async (req, res, next) => {
+    try {
+        const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
+            return Response.sendErrorResponse(req, res, new BadDataException("Invalid Project ID"));
+        }
+        const body = req.body;
+        if (!body["serviceId"] || typeof body["serviceId"] !== "string") {
+            return Response.sendErrorResponse(req, res, new BadDataException("serviceId is required"));
+        }
+        if (!body["serviceVersion"] ||
+            typeof body["serviceVersion"] !== "string") {
+            return Response.sendErrorResponse(req, res, new BadDataException("serviceVersion is required"));
+        }
+        if (!Array.isArray(body["frames"])) {
+            return Response.sendErrorResponse(req, res, new BadDataException("frames must be an array of stack frames"));
+        }
+        const frames = SourceMapResolver.sanitizeMinifiedStackFrames(body["frames"]);
+        const result = await TelemetrySourceMapService.resolveFramesForService({
+            projectId: databaseProps.tenantId,
+            serviceId: new ObjectID(body["serviceId"]),
+            serviceVersion: body["serviceVersion"],
+            frames: frames,
+        });
+        return Response.sendJsonObjectResponse(req, res, result);
+    }
+    catch (err) {
+        return next(err);
+    }
+});
 /*
  * Security events flatten their whole source payload into `attributes`, so
  * these are what backs the "add an attribute column" picker on the security
@@ -393,6 +443,52 @@ async function resolveResourceScopesFromBody(body, projectId) {
     });
     return scopes.length > 0 ? scopes : undefined;
 }
+/*
+ * Parse the `attributes` body field.
+ *
+ * Three shapes are legal: a single value (`= v`), a list of values
+ * (`IN (...)`, what a multi-select dashboard variable resolves to), and a
+ * serialized QueryOperator (`{_type: "Wildcard", value: ["api-*"]}`) for
+ * every other operator the search grammar can produce. Everything else is
+ * dropped, and an array left empty by the string filtering is dropped too so
+ * it cannot narrow to nothing.
+ *
+ * The operator shape used to be dropped here, which is worse than rejecting
+ * it: a wildcard filter arrived as "no filter", so the chart showed the whole
+ * project beside a list narrowed to a handful of spans. `_type` is only
+ * checked for being a string — the compiler in AttributeFilterStatement
+ * answers an unknown operator with a 400.
+ */
+function parseAttributeFilterRecord(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return undefined;
+    }
+    const filters = {};
+    for (const [key, value] of Object.entries(raw)) {
+        if (typeof value === "string") {
+            filters[key] = value;
+            continue;
+        }
+        if (Array.isArray(value)) {
+            const values = value.filter((v) => {
+                return typeof v === "string";
+            });
+            if (values.length > 0) {
+                filters[key] = values;
+            }
+            continue;
+        }
+        if (value &&
+            typeof value === "object" &&
+            typeof value["_type"] === "string") {
+            filters[key] = value;
+        }
+    }
+    if (Object.keys(filters).length === 0) {
+        return undefined;
+    }
+    return filters;
+}
 /*
  * Shared body parsing for every trace aggregation endpoint (histogram,
  * facets, analytics). Defensive about shapes: arrays are validated and
@@ -445,37 +541,6 @@ function parseTraceFilterBody(body) {
         }
         return Object.fromEntries(entries);
     };
-    /*
-     * Exact attribute predicates accept a single value or a list of values
-     * (`IN (...)`) — a multi-select dashboard variable resolves to the latter.
-     * Non-string array entries are dropped, and an array left empty by that
-     * filtering is dropped entirely so it cannot narrow to nothing.
-     */
-    const attributeFilterRecord = () => {
-        const raw = body["attributes"];
-        if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-            return undefined;
-        }
-        const filters = {};
-        for (const [key, value] of Object.entries(raw)) {
-            if (typeof value === "string") {
-                filters[key] = value;
-                continue;
-            }
-            if (Array.isArray(value)) {
-                const values = value.filter((v) => {
-                    return typeof v === "string";
-                });
-                if (values.length > 0) {
-                    filters[key] = values;
-                }
-            }
-        }
-        if (Object.keys(filters).length === 0) {
-            return undefined;
-        }
-        return filters;
-    };
     return {
         serviceIds,
         entityKeys: stringArray("entityKeys"),
@@ -515,7 +580,7 @@ function parseTraceFilterBody(body) {
             ? body["exactDurationNano"]
             : undefined,
         rootOnly: body["rootOnly"] === undefined ? undefined : Boolean(body["rootOnly"]),
-        attributes: attributeFilterRecord(),
+        attributes: parseAttributeFilterRecord(body["attributes"]),
         attributeSearches: stringRecord("attributeSearches"),
     };
 }
@@ -1004,6 +1069,7 @@ router.post("/telemetry/metrics/facets", ...requireMetricReadAccess, async (req,
         const metricNames = body["metricNames"]
             ? body["metricNames"]
             : undefined;
+        const attributes = parseAttributeFilterRecord(body["attributes"]);
         const facetSearchText = body["facetSearchText"]
             ? body["facetSearchText"]
             : undefined;
@@ -1022,6 +1088,7 @@ router.post("/telemetry/metrics/facets", ...requireMetricReadAccess, async (req,
                     limit,
                     serviceIds,
                     metricNames,
+                    attributes,
                 };
                 const values = await MetricAggregationService.getFacetValues(request);
                 return [facetKey, values];
@@ -1229,9 +1296,7 @@ function parseErrorPatternFilterBody(body, projectId) {
         traceIds: stringArray(body["traceIds"]),
         spanIds: stringArray(body["spanIds"]),
         sessionIds: stringArray(body["sessionIds"]),
-        attributes: body["attributes"] && typeof body["attributes"] === "object"
-            ? body["attributes"]
-            : undefined,
+        attributes: parseAttributeFilterRecord(body["attributes"]),
     };
 }
 /*