@oneuptime/common 12.0.25 → 12.0.26

package/Models/DatabaseModels/UserOnCallLog.ts

@@ -747,6 +747,7 @@ export default class UserOnCallLog extends BaseModel {
   @TableColumn({
     manyToOneRelationColumn: "acknowledgedByUserId",
     type: TableColumnType.Entity,
+    modelType: User,
     title: "Acknowledged by User",
     description:
       "Relation to User who acknowledged this policy execution (if this policy was acknowledged by a User)",

package/Models/DatabaseModels/UserTotpAuth.ts

@@ -172,6 +172,7 @@ class UserTotpAuth extends BaseModel {
   @TableColumn({
     manyToOneRelationColumn: "userId",
     type: TableColumnType.Entity,
+    modelType: User,
     title: "User",
     description: "Relation to User who owns this TOTP authentication",
   })

package/Models/DatabaseModels/UserWebAuthn.ts

@@ -207,6 +207,7 @@ class UserWebAuthn extends BaseModel {
   @TableColumn({
     manyToOneRelationColumn: "userId",
     type: TableColumnType.Entity,
+    modelType: User,
     title: "User",
     description: "Relation to User who owns this WebAuthn credential",
   })

package/Server/API/AlertAPI.ts

@@ -18,7 +18,11 @@ import {
 } from "../Utils/Express";
 import CommonAPI from "./CommonAPI";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
-import AIService, { AILogRequest, AILogResponse } from "../Services/AIService";
+import AIService, {
+  AILogRequest,
+  AILogResponse,
+  INTERACTIVE_AI_GENERATION_TIMEOUT_IN_MS,
+} from "../Services/AIService";
 import AlertAIContextBuilder, {
   AIGenerationContext,
   AlertContextData,
@@ -120,6 +124,15 @@ export default class AlertAPI extends BaseAPI<Alert, AlertServiceType> {
       throw new NotFoundException("Alert not found");
     }
 
+    /*
+     * Project AI kill switch. Checked here: after the row that names the
+     * project is in hand, and before the context builder runs or any provider
+     * tokens are spent. executeWithLogging meters and bills this call but does
+     * not consult Project.enableAi, so this is the only thing standing between
+     * a project that has switched AI off and a provider bill.
+     */
+    await AIService.assertProjectAIEnabled(alert.projectId);
+
     // Build alert context
     const contextData: AlertContextData =
       await AlertAIContextBuilder.buildAlertContext({
@@ -138,6 +151,15 @@ export default class AlertAPI extends BaseAPI<Alert, AlertServiceType> {
       messages: aiContext.messages,
       maxTokens: 4096,
       temperature: 0.2,
+      /*
+       * This request holds the browser's connection open across the whole
+       * completion, behind nginx's 300s budget for /api. Bound the provider
+       * call below that and take a single attempt, so a slow or broken
+       * provider answers with its own error instead of the proxy's gateway
+       * timeout — see INTERACTIVE_AI_GENERATION_TIMEOUT_IN_MS.
+       */
+      requestTimeoutInMs: INTERACTIVE_AI_GENERATION_TIMEOUT_IN_MS,
+      requestRetries: 0,
       /*
        * G8: the prompt embeds incident/alert/maintenance context whose read
        * ACLs are narrower than LlmLog's — do not store previews.

package/Server/API/BaseAPI.ts

@@ -23,6 +23,7 @@ import {
 } from "../../Types/Database/LimitMax";
 import PartialEntity from "../../Types/Database/PartialEntity";
 import { coerceNumericColumnsInJSON } from "../../Types/Database/NumericColumnValue";
+import { coerceDateColumnsInJSON } from "../../Types/Database/DateColumnValue";
 import BadDataException from "../../Types/Exception/BadDataException";
 import BadRequestException from "../../Types/Exception/BadRequestException";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
@@ -468,10 +469,20 @@ export default class BaseAPI<
      * coerce them — a sample percentage of "10" was rejected as "not a
      * number" on a form that had one filled in.
      * github.com/OneUptime/oneuptime/issues/3027
+     *
+     * Date columns have the same problem for the same reason: an
+     * `<input type="date">` posts "2027-01-01", and a hook that reads the
+     * column back gets a string where it expects a Date. See
+     * Types/Database/DateColumnValue.
      */
-    const item: PartialEntity<TBaseModel> = coerceNumericColumnsInJSON(
-      JSONFunctions.deserialize(dataInBody as JSONObject),
-      new this.entityType(),
+    const entityModel: TBaseModel = new this.entityType();
+
+    const item: PartialEntity<TBaseModel> = coerceDateColumnsInJSON(
+      coerceNumericColumnsInJSON(
+        JSONFunctions.deserialize(dataInBody as JSONObject),
+        entityModel,
+      ),
+      entityModel,
     ) as PartialEntity<TBaseModel>;
 
     delete (item as any)["_id"];

package/Server/API/IncidentAPI.ts

@@ -19,7 +19,11 @@ import {
 } from "../Utils/Express";
 import CommonAPI from "./CommonAPI";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
-import AIService, { AILogRequest, AILogResponse } from "../Services/AIService";
+import AIService, {
+  AILogRequest,
+  AILogResponse,
+  INTERACTIVE_AI_GENERATION_TIMEOUT_IN_MS,
+} from "../Services/AIService";
 import IncidentAIContextBuilder, {
   AIGenerationContext,
   IncidentContextData,
@@ -223,6 +227,15 @@ export default class IncidentAPI extends BaseAPI<
       throw new NotFoundException("Incident not found");
     }
 
+    /*
+     * Project AI kill switch. Checked here: after the row that names the
+     * project is in hand, and before the context builder runs or any provider
+     * tokens are spent. executeWithLogging meters and bills this call but does
+     * not consult Project.enableAi, so this is the only thing standing between
+     * a project that has switched AI off and a provider bill.
+     */
+    await AIService.assertProjectAIEnabled(incident.projectId);
+
     // Build incident context
     const contextData: IncidentContextData =
       await IncidentAIContextBuilder.buildIncidentContext({
@@ -246,6 +259,15 @@ export default class IncidentAPI extends BaseAPI<
       messages: aiContext.messages,
       maxTokens: 8192,
       temperature: 0.2,
+      /*
+       * This request holds the browser's connection open across the whole
+       * completion, behind nginx's 300s budget for /api. Bound the provider
+       * call below that and take a single attempt, so a slow or broken
+       * provider answers with its own error instead of the proxy's gateway
+       * timeout — see INTERACTIVE_AI_GENERATION_TIMEOUT_IN_MS.
+       */
+      requestTimeoutInMs: INTERACTIVE_AI_GENERATION_TIMEOUT_IN_MS,
+      requestRetries: 0,
       /*
        * G8: the prompt embeds incident/alert/maintenance context whose read
        * ACLs are narrower than LlmLog's — do not store previews.
@@ -353,6 +375,15 @@ export default class IncidentAPI extends BaseAPI<
       throw new NotFoundException("Incident not found");
     }
 
+    /*
+     * Project AI kill switch. Checked here: after the row that names the
+     * project is in hand, and before the context builder runs or any provider
+     * tokens are spent. executeWithLogging meters and bills this call but does
+     * not consult Project.enableAi, so this is the only thing standing between
+     * a project that has switched AI off and a provider bill.
+     */
+    await AIService.assertProjectAIEnabled(incident.projectId);
+
     // Build incident context
     const contextData: IncidentContextData =
       await IncidentAIContextBuilder.buildIncidentContext({
@@ -380,6 +411,15 @@ export default class IncidentAPI extends BaseAPI<
       messages: aiContext.messages,
       maxTokens: 4096,
       temperature: 0.2,
+      /*
+       * This request holds the browser's connection open across the whole
+       * completion, behind nginx's 300s budget for /api. Bound the provider
+       * call below that and take a single attempt, so a slow or broken
+       * provider answers with its own error instead of the proxy's gateway
+       * timeout — see INTERACTIVE_AI_GENERATION_TIMEOUT_IN_MS.
+       */
+      requestTimeoutInMs: INTERACTIVE_AI_GENERATION_TIMEOUT_IN_MS,
+      requestRetries: 0,
       /*
        * G8: the prompt embeds incident/alert/maintenance context whose read
        * ACLs are narrower than LlmLog's — do not store previews.

package/Server/API/IncidentEpisodeAPI.ts

@@ -18,7 +18,11 @@ import {
 } from "../Utils/Express";
 import CommonAPI from "./CommonAPI";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
-import AIService, { AILogRequest, AILogResponse } from "../Services/AIService";
+import AIService, {
+  AILogRequest,
+  AILogResponse,
+  INTERACTIVE_AI_GENERATION_TIMEOUT_IN_MS,
+} from "../Services/AIService";
 import IncidentEpisodeAIContextBuilder, {
   IncidentEpisodeContextData,
 } from "../Utils/AI/IncidentEpisodeAIContextBuilder";
@@ -127,6 +131,15 @@ export default class IncidentEpisodeAPI extends BaseAPI<
       throw new NotFoundException("Episode not found");
     }
 
+    /*
+     * Project AI kill switch. Checked here: after the row that names the
+     * project is in hand, and before the context builder runs or any provider
+     * tokens are spent. executeWithLogging meters and bills this call but does
+     * not consult Project.enableAi, so this is the only thing standing between
+     * a project that has switched AI off and a provider bill.
+     */
+    await AIService.assertProjectAIEnabled(episode.projectId);
+
     // Build episode context
     const contextData: IncidentEpisodeContextData =
       await IncidentEpisodeAIContextBuilder.buildEpisodeContext({
@@ -149,6 +162,15 @@ export default class IncidentEpisodeAPI extends BaseAPI<
       messages: aiContext.messages,
       maxTokens: 8192,
       temperature: 0.2,
+      /*
+       * This request holds the browser's connection open across the whole
+       * completion, behind nginx's 300s budget for /api. Bound the provider
+       * call below that and take a single attempt, so a slow or broken
+       * provider answers with its own error instead of the proxy's gateway
+       * timeout — see INTERACTIVE_AI_GENERATION_TIMEOUT_IN_MS.
+       */
+      requestTimeoutInMs: INTERACTIVE_AI_GENERATION_TIMEOUT_IN_MS,
+      requestRetries: 0,
       /*
        * G8: the prompt embeds incident/alert/maintenance context whose read
        * ACLs are narrower than LlmLog's — do not store previews.

package/Server/API/MicrosoftTeamsAPI.ts

@@ -987,7 +987,22 @@ export default class MicrosoftTeamsAPI {
       },
     );
 
-    // Test endpoint to verify Bot Framework setup
+    /*
+     * Echoes this deployment's bot configuration.
+     *
+     * It reads local environment variables and nothing else — it does not call
+     * Azure, so it cannot tell you the Azure Bot resource exists, that its
+     * messaging endpoint points back here, that the Teams channel is enabled, or
+     * that the installed Teams app package belongs to this deployment. It used
+     * to answer "Bot Framework endpoint is configured", which admins reasonably
+     * read as "the bot works" — and then spent days debugging a setup this
+     * endpoint had already blessed. It now says what it checked and, more
+     * importantly, what it did not.
+     *
+     * The one genuinely useful thing here is botId: it is the value that must
+     * appear in the installed Teams app package, and comparing the two is what
+     * settles the most common self-hosted failure.
+     */
     router.get(
       "/microsoft-bot/test",
       async (req: ExpressRequest, res: ExpressResponse) => {
@@ -1004,9 +1019,23 @@ export default class MicrosoftTeamsAPI {
         }
 
         return Response.sendJsonObjectResponse(req, res, {
-          status: "Bot Framework endpoint is configured",
+          status:
+            "Local configuration is present. This does NOT confirm the integration works.",
           clientId: MicrosoftTeamsAppClientId,
+          botId: MicrosoftTeamsAppClientId,
           messagingEndpoint: `${AppApiClientUrl.toString()}/microsoft-bot/messages`,
+          verified: [
+            "MICROSOFT_TEAMS_APP_CLIENT_ID is set",
+            "MICROSOFT_TEAMS_APP_CLIENT_SECRET is set",
+          ],
+          notVerified: [
+            "That an Azure Bot resource exists for this client id",
+            "That the Azure Bot's messaging endpoint points at this deployment",
+            "That the Azure Bot has the Microsoft Teams channel enabled",
+            "That the client secret is valid and has not expired",
+            "That the Teams app package installed in your teams was built from this deployment",
+          ],
+          nextStep: `Open the installed OneUptime app in Microsoft Teams and confirm its bot id is ${MicrosoftTeamsAppClientId}. If it is not, that package cannot receive messages from this deployment — download the manifest from Project Settings > Workspace > Microsoft Teams and upload that instead.`,
         });
       },
     );

package/Server/API/ScheduledMaintenanceAPI.ts

@@ -18,7 +18,11 @@ import {
 } from "../Utils/Express";
 import CommonAPI from "./CommonAPI";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
-import AIService, { AILogRequest, AILogResponse } from "../Services/AIService";
+import AIService, {
+  AILogRequest,
+  AILogResponse,
+  INTERACTIVE_AI_GENERATION_TIMEOUT_IN_MS,
+} from "../Services/AIService";
 import ScheduledMaintenanceAIContextBuilder, {
   AIGenerationContext,
   ScheduledMaintenanceContextData,
@@ -136,6 +140,15 @@ export default class ScheduledMaintenanceAPI extends BaseAPI<
       throw new NotFoundException("Scheduled Maintenance not found");
     }
 
+    /*
+     * Project AI kill switch. Checked here: after the row that names the
+     * project is in hand, and before the context builder runs or any provider
+     * tokens are spent. executeWithLogging meters and bills this call but does
+     * not consult Project.enableAi, so this is the only thing standing between
+     * a project that has switched AI off and a provider bill.
+     */
+    await AIService.assertProjectAIEnabled(scheduledMaintenance.projectId);
+
     // Build scheduled maintenance context
     const contextData: ScheduledMaintenanceContextData =
       await ScheduledMaintenanceAIContextBuilder.buildScheduledMaintenanceContext(
@@ -163,6 +176,15 @@ export default class ScheduledMaintenanceAPI extends BaseAPI<
       messages: aiContext.messages,
       maxTokens: 4096,
       temperature: 0.2,
+      /*
+       * This request holds the browser's connection open across the whole
+       * completion, behind nginx's 300s budget for /api. Bound the provider
+       * call below that and take a single attempt, so a slow or broken
+       * provider answers with its own error instead of the proxy's gateway
+       * timeout — see INTERACTIVE_AI_GENERATION_TIMEOUT_IN_MS.
+       */
+      requestTimeoutInMs: INTERACTIVE_AI_GENERATION_TIMEOUT_IN_MS,
+      requestRetries: 0,
       /*
        * G8: the prompt embeds incident/alert/maintenance context whose read
        * ACLs are narrower than LlmLog's — do not store previews.

package/Server/API/SlackAPI.ts

@@ -42,6 +42,7 @@ import WorkspaceProjectAuthToken, {
 } from "../../Models/DatabaseModels/WorkspaceProjectAuthToken";
 import UserMiddleware from "../Middleware/UserAuthorization";
 import CommonAPI from "./CommonAPI";
+import AIService, { AI_DISABLED_MESSAGE } from "../Services/AIService";
 import SlackUtil from "../Utils/Workspace/Slack/Slack";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import Dictionary from "../../Types/Dictionary";
@@ -1287,6 +1288,21 @@ export default class SlackAPI {
                 return;
               }
 
+              /*
+               * The project's AI kill switch, read before we acknowledge —
+               * so a project with AI off gets one clear refusal instead of
+               * an "on it" that is never followed by anything.
+               */
+              if (!(await AIService.isProjectAIEnabled(context.projectId))) {
+                await SlackUtil.sendMessageToThread({
+                  authToken: context.projectAuthToken,
+                  channelId: slackChannelId,
+                  threadTs: threadTs,
+                  text: SlackAPI.getAiDisabledMessage(),
+                });
+                return;
+              }
+
               // Immediate acknowledgement so the user sees we are working.
               try {
                 await SlackUtil.sendMessageToThread({
@@ -1427,6 +1443,25 @@ export default class SlackAPI {
             return;
           }
 
+          /*
+           * The project's AI kill switch. Ephemeral, like every other refusal
+           * on this slash-command path — the person who typed the command is
+           * the only one who needs to know the switch is off.
+           */
+          if (!(await AIService.isProjectAIEnabled(context.projectId))) {
+            await API.post({
+              url: URL.fromString(responseUrl),
+              data: {
+                response_type: "ephemeral",
+                text: SlackAPI.getAiDisabledMessage(),
+              },
+              headers: {
+                ["Content-Type"]: "application/json",
+              },
+            });
+            return;
+          }
+
           const answerMarkdown: string = await SlackAPI.getAiOpsAnswerMarkdown({
             projectId: context.projectId,
             userId: context.userId,
@@ -1691,4 +1726,17 @@ export default class SlackAPI {
   private static getSlackAccountNotConnectedMessage(): string {
     return "Unfortunately your Slack account is not connected to OneUptime. Please log into your OneUptime account, click on User Settings and then connect your Slack account.";
   }
+
+  /*
+   * Both AI Ops entry points above run their real work in a DETACHED
+   * fire-and-forget IIFE whose .catch only logs. An exception thrown out of
+   * the assistant — including the kill-switch refusal executeWithLogging
+   * raises — therefore reaches nobody: the user is left staring at "Looking
+   * into it…" forever. So the switch is read HERE, before the assistant is
+   * started, and the refusal is posted back over the same channel the answer
+   * would have used.
+   */
+  private static getAiDisabledMessage(): string {
+    return AI_DISABLED_MESSAGE;
+  }
 }

package/Server/API/TelemetryAPI.ts

@@ -13,6 +13,12 @@ import CommonAPI from "./CommonAPI";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import TelemetryType from "../../Types/Telemetry/TelemetryType";
 import TelemetryAttributeService from "../Services/TelemetryAttributeService";
+import TelemetrySourceMapService from "../Services/TelemetrySourceMapService";
+import SourceMapResolver from "../Utils/Telemetry/SourceMapResolver";
+import {
+  MinifiedStackFrame,
+  ResolveStackTraceResult,
+} from "../../Types/Telemetry/SourceMap";
 import LogAggregationService, {
   HistogramBucket,
   HistogramRequest,
@@ -36,7 +42,6 @@ import TraceAggregationService, {
   FacetValue as TraceFacetValue,
   MultiFacetRequest as TraceMultiFacetRequest,
   TraceFilters,
-  TraceAttributeFilters,
   TraceAnalyticsChartType,
   TraceAnalyticsRequest,
   TraceAnalyticsTimeseriesRow,
@@ -52,6 +57,7 @@ import ExceptionAggregationService, {
 import MetricAggregationService, {
   FacetValue as MetricFacetValue,
   FacetRequest as MetricFacetRequest,
+  MetricAttributeFilters,
   MetricForTraceItem,
 } from "../Services/MetricAggregationService";
 import ProfileAggregationService, {
@@ -275,6 +281,91 @@ router.post(
   },
 );
 
+/*
+ * Lazily resolves an exception's parsed stack frames against the source
+ * maps uploaded for its (service, release) pair — see the TelemetrySourceMap
+ * model. Guarded by exception read access, not source-map read access, on
+ * purpose: anyone who may see the exception may see the few original source
+ * lines around its crash site (the snippets in the response). Bulk access to
+ * whole maps stays restricted by the model's own column ACL on `content`.
+ * That is a deliberate trade-off, not an oversight: a caller with exception
+ * read access could reconstruct larger stretches of sourcesContent by
+ * probing many line/column pairs across requests, exactly as they could in
+ * Sentry or Elastic. The content column ACL exists to prevent trivial bulk
+ * export, not to be an information-flow boundary against a team member who
+ * is already trusted to read the project's exceptions.
+ *
+ * Tenant safety: source maps are queried by (tenantId from the authorized
+ * request, serviceId from the body). A serviceId belonging to a different
+ * project simply matches no maps — nothing cross-tenant can be read.
+ */
+router.post(
+  "/telemetry/exceptions/resolve-stack-trace",
+  ...requireExceptionReadAccess,
+  async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+    try {
+      const databaseProps: DatabaseCommonInteractionProps =
+        await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+      if (!databaseProps?.tenantId) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid Project ID"),
+        );
+      }
+
+      const body: JSONObject = req.body as JSONObject;
+
+      if (!body["serviceId"] || typeof body["serviceId"] !== "string") {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("serviceId is required"),
+        );
+      }
+
+      if (
+        !body["serviceVersion"] ||
+        typeof body["serviceVersion"] !== "string"
+      ) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("serviceVersion is required"),
+        );
+      }
+
+      if (!Array.isArray(body["frames"])) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("frames must be an array of stack frames"),
+        );
+      }
+
+      const frames: Array<MinifiedStackFrame> =
+        SourceMapResolver.sanitizeMinifiedStackFrames(body["frames"]);
+
+      const result: ResolveStackTraceResult =
+        await TelemetrySourceMapService.resolveFramesForService({
+          projectId: databaseProps.tenantId,
+          serviceId: new ObjectID(body["serviceId"] as string),
+          serviceVersion: body["serviceVersion"] as string,
+          frames: frames,
+        });
+
+      return Response.sendJsonObjectResponse(
+        req,
+        res,
+        result as unknown as JSONObject,
+      );
+    } catch (err) {
+      return next(err);
+    }
+  },
+);
+
 /*
  * Security events flatten their whole source payload into `attributes`, so
  * these are what backs the "add an attribute column" picker on the security
@@ -736,6 +827,75 @@ async function resolveResourceScopesFromBody(
   return scopes.length > 0 ? scopes : undefined;
 }
 
+/*
+ * The wire shape of an attribute filter map — the same for logs, traces and
+ * metrics, so it is structurally assignable to each service's own filter
+ * type.
+ */
+type ParsedAttributeFilters = Record<
+  string,
+  string | Array<string> | { _type: string; value?: unknown }
+>;
+
+/*
+ * Parse the `attributes` body field.
+ *
+ * Three shapes are legal: a single value (`= v`), a list of values
+ * (`IN (...)`, what a multi-select dashboard variable resolves to), and a
+ * serialized QueryOperator (`{_type: "Wildcard", value: ["api-*"]}`) for
+ * every other operator the search grammar can produce. Everything else is
+ * dropped, and an array left empty by the string filtering is dropped too so
+ * it cannot narrow to nothing.
+ *
+ * The operator shape used to be dropped here, which is worse than rejecting
+ * it: a wildcard filter arrived as "no filter", so the chart showed the whole
+ * project beside a list narrowed to a handful of spans. `_type` is only
+ * checked for being a string — the compiler in AttributeFilterStatement
+ * answers an unknown operator with a 400.
+ */
+function parseAttributeFilterRecord(
+  raw: unknown,
+): ParsedAttributeFilters | undefined {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return undefined;
+  }
+
+  const filters: ParsedAttributeFilters = {};
+
+  for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {
+    if (typeof value === "string") {
+      filters[key] = value;
+      continue;
+    }
+
+    if (Array.isArray(value)) {
+      const values: Array<string> = (value as Array<unknown>).filter(
+        (v: unknown): v is string => {
+          return typeof v === "string";
+        },
+      );
+      if (values.length > 0) {
+        filters[key] = values;
+      }
+      continue;
+    }
+
+    if (
+      value &&
+      typeof value === "object" &&
+      typeof (value as Record<string, unknown>)["_type"] === "string"
+    ) {
+      filters[key] = value as { _type: string; value?: unknown };
+    }
+  }
+
+  if (Object.keys(filters).length === 0) {
+    return undefined;
+  }
+
+  return filters;
+}
+
 /*
  * Shared body parsing for every trace aggregation endpoint (histogram,
  * facets, analytics). Defensive about shapes: arrays are validated and
@@ -801,42 +961,6 @@ function parseTraceFilterBody(body: JSONObject): TraceFilters {
     return Object.fromEntries(entries);
   };
 
-  /*
-   * Exact attribute predicates accept a single value or a list of values
-   * (`IN (...)`) — a multi-select dashboard variable resolves to the latter.
-   * Non-string array entries are dropped, and an array left empty by that
-   * filtering is dropped entirely so it cannot narrow to nothing.
-   */
-  const attributeFilterRecord: () => TraceAttributeFilters | undefined = ():
-    | TraceAttributeFilters
-    | undefined => {
-    const raw: unknown = body["attributes"];
-    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-      return undefined;
-    }
-    const filters: TraceAttributeFilters = {};
-    for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {
-      if (typeof value === "string") {
-        filters[key] = value;
-        continue;
-      }
-      if (Array.isArray(value)) {
-        const values: Array<string> = (value as Array<unknown>).filter(
-          (v: unknown): v is string => {
-            return typeof v === "string";
-          },
-        );
-        if (values.length > 0) {
-          filters[key] = values;
-        }
-      }
-    }
-    if (Object.keys(filters).length === 0) {
-      return undefined;
-    }
-    return filters;
-  };
-
   return {
     serviceIds,
     entityKeys: stringArray("entityKeys"),
@@ -883,7 +1007,7 @@ function parseTraceFilterBody(body: JSONObject): TraceFilters {
         : undefined,
     rootOnly:
       body["rootOnly"] === undefined ? undefined : Boolean(body["rootOnly"]),
-    attributes: attributeFilterRecord(),
+    attributes: parseAttributeFilterRecord(body["attributes"]),
     attributeSearches: stringRecord("attributeSearches"),
   };
 }
@@ -1651,6 +1775,9 @@ router.post(
         ? (body["metricNames"] as Array<string>)
         : undefined;
 
+      const attributes: MetricAttributeFilters | undefined =
+        parseAttributeFilterRecord(body["attributes"]);
+
       const facetSearchText: Record<string, string> | undefined = body[
         "facetSearchText"
       ]
@@ -1678,6 +1805,7 @@ router.post(
                   limit,
                   serviceIds,
                   metricNames,
+                  attributes,
                 };
                 const values: Array<MetricFacetValue> =
                   await MetricAggregationService.getFacetValues(request);
@@ -2004,10 +2132,7 @@ function parseErrorPatternFilterBody(
     traceIds: stringArray(body["traceIds"]),
     spanIds: stringArray(body["spanIds"]),
     sessionIds: stringArray(body["sessionIds"]),
-    attributes:
-      body["attributes"] && typeof body["attributes"] === "object"
-        ? (body["attributes"] as Record<string, string | Array<string>>)
-        : undefined,
+    attributes: parseAttributeFilterRecord(body["attributes"]),
   };
 }