@oneuptime/common 12.0.4 → 12.0.6

package/Tests/Server/API/DashboardPublicResourceListAPI.test.ts

@@ -1,8 +1,8 @@
 import Dashboard from "../../../Models/DatabaseModels/Dashboard";
 import DashboardAPI from "../../../Server/API/DashboardAPI";
-import DashboardService from "../../../Server/Services/DashboardService";
 import AlertService from "../../../Server/Services/AlertService";
 import CephResourceService from "../../../Server/Services/CephResourceService";
+import DashboardService from "../../../Server/Services/DashboardService";
 import DockerHostService from "../../../Server/Services/DockerHostService";
 import DockerResourceService from "../../../Server/Services/DockerResourceService";
 import DockerSwarmResourceService from "../../../Server/Services/DockerSwarmResourceService";
@@ -16,20 +16,25 @@ import PodmanHostService from "../../../Server/Services/PodmanHostService";
 import PodmanResourceService from "../../../Server/Services/PodmanResourceService";
 import ProxmoxResourceService from "../../../Server/Services/ProxmoxResourceService";
 import SpanService from "../../../Server/Services/SpanService";
+import PublicDashboardResourceListPolicy, {
+  BuildPublicDashboardResourceListPolicyData,
+  PublicDashboardResourceListPolicyResult,
+} from "../../../Server/Utils/Dashboard/PublicDashboardResourceListPolicy";
 import {
   ExpressRequest,
   ExpressResponse,
   NextFunction,
 } from "../../../Server/Utils/Express";
+import InBetween from "../../../Types/BaseDatabase/InBetween";
 import Includes from "../../../Types/BaseDatabase/Includes";
 import SortOrder from "../../../Types/BaseDatabase/SortOrder";
 import DashboardComponentType from "../../../Types/Dashboard/DashboardComponentType";
 import DashboardViewConfig from "../../../Types/Dashboard/DashboardViewConfig";
-import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import { DashboardVariableType } from "../../../Types/Dashboard/DashboardVariable";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import NotFoundException from "../../../Types/Exception/NotFoundException";
-import { JSONObject } from "../../../Types/JSON";
+import { JSONObject, JSONValue } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
 import { mockRouter } from "./Helpers";
 import {
@@ -40,6 +45,7 @@ import {
   expect,
   it,
 } from "@jest/globals";
+import { FindOperator } from "typeorm";
 
 jest.mock("../../../Server/Utils/Express", () => {
   return {
@@ -70,419 +76,221 @@ jest.mock("../../../Server/Utils/Response", () => {
 const RESOURCE_LIST_ROUTE: string =
   "/dashboard/resource-list/:dashboardId/:resourceType";
 
-/*
- * Structural view of the model services the registry lists through — just
- * enough to spy on findBy and read back the arguments the API handed it.
- */
 type ListService = {
   findBy: (findBy: never) => Promise<Array<unknown>>;
 };
 
-/*
- * Every public resource type, the widget that unlocks it, the `kind` that
- * widget renders, one filter the widget legitimately sends, one the widget
- * never sends (and which therefore must be dropped), a column of the fixed
- * select (sortable) and a column outside it (never sortable).
- */
-interface ResourceCase {
+interface BuiltWidget {
+  widget: JSONObject;
+  componentId: ObjectID;
+}
+
+interface BuildWidgetData {
+  componentType: DashboardComponentType;
+  argumentsObject?: JSONObject | undefined;
+  componentId?: ObjectID | undefined;
+  storedIdShape?: "object" | "string" | "serialized" | undefined;
+}
+
+interface CallRouteData {
+  resourceType: string;
+  body?: JSONObject | undefined;
+  query?: JSONObject | undefined;
+}
+
+interface ResourceRouteCase {
   resourceType: string;
   componentType: DashboardComponentType;
   service: ListService;
   kind: string | null;
-  allowedQueryKey: string;
-  forbiddenQueryKey: string;
-  selectColumn: string;
-  nonSelectColumn: string;
-  selectKeys: Array<string>;
 }
 
-const RESOURCE_CASES: Array<ResourceCase> = [
+const RESOURCE_ROUTE_CASES: Array<ResourceRouteCase> = [
   {
     resourceType: "incident",
     componentType: DashboardComponentType.IncidentList,
     service: IncidentService,
     kind: null,
-    allowedQueryKey: "incidentSeverityId",
-    forbiddenQueryKey: "description",
-    selectColumn: "createdAt",
-    nonSelectColumn: "description",
-    selectKeys: [
-      "_id",
-      "title",
-      "createdAt",
-      "currentIncidentState",
-      "incidentSeverity",
-    ],
   },
   {
     resourceType: "alert",
     componentType: DashboardComponentType.AlertList,
     service: AlertService,
     kind: null,
-    allowedQueryKey: "alertSeverityId",
-    forbiddenQueryKey: "description",
-    selectColumn: "createdAt",
-    nonSelectColumn: "description",
-    selectKeys: [
-      "_id",
-      "title",
-      "createdAt",
-      "currentAlertState",
-      "alertSeverity",
-    ],
   },
   {
     resourceType: "monitor",
     componentType: DashboardComponentType.MonitorList,
     service: MonitorService,
     kind: null,
-    allowedQueryKey: "monitorType",
-    forbiddenQueryKey: "monitorSteps",
-    selectColumn: "name",
-    nonSelectColumn: "monitorSteps",
-    selectKeys: ["_id", "name", "monitorType", "currentMonitorStatus"],
   },
   {
-    /*
-     * The Network Map draws a FLAT set of pins, so the hierarchy columns
-     * (parentSiteId, materializedPath, depth) are deliberately outside both
-     * the allowlist and the select — structure an anonymous viewer would be
-     * able to walk but the map never shows them.
-     */
     resourceType: "network-site",
     componentType: DashboardComponentType.NetworkMap,
     service: NetworkSiteService,
     kind: null,
-    allowedQueryKey: "networkSiteTypeId",
-    forbiddenQueryKey: "parentSiteId",
-    selectColumn: "name",
-    nonSelectColumn: "address",
-    selectKeys: [
-      "_id",
-      "name",
-      "networkSiteType",
-      "latitude",
-      "longitude",
-      "currentMonitorStatus",
-    ],
   },
   {
     resourceType: "host",
     componentType: DashboardComponentType.HostList,
     service: HostService,
     kind: null,
-    allowedQueryKey: "otelCollectorStatus",
-    forbiddenQueryKey: "createdAt",
-    selectColumn: "name",
-    nonSelectColumn: "createdAt",
-    selectKeys: [
-      "_id",
-      "name",
-      "hostIdentifier",
-      "otelCollectorStatus",
-      "osType",
-      "osVersion",
-      "cpuCores",
-      "totalMemoryBytes",
-      "lastSeenAt",
-    ],
   },
   {
     resourceType: "kubernetes-resource",
     componentType: DashboardComponentType.KubernetesPodList,
     service: KubernetesResourceService,
     kind: "Pod",
-    allowedQueryKey: "namespaceKey",
-    forbiddenQueryKey: "createdAt",
-    selectColumn: "name",
-    nonSelectColumn: "createdAt",
-    selectKeys: [
-      "_id",
-      "name",
-      "namespaceKey",
-      "kind",
-      "phase",
-      "isReady",
-      "hasMemoryPressure",
-      "hasDiskPressure",
-      "hasPidPressure",
-      "containerCount",
-      "latestCpuPercent",
-      "latestMemoryBytes",
-      "controllerDeploymentName",
-      "controllerCronJobName",
-      "resourceCreationTimestamp",
-      "lastSeenAt",
-      "kubernetesClusterId",
-      "kubernetesCluster",
-    ],
+  },
+  {
+    resourceType: "kubernetes-resource",
+    componentType: DashboardComponentType.KubernetesNodeList,
+    service: KubernetesResourceService,
+    kind: "Node",
+  },
+  {
+    resourceType: "kubernetes-resource",
+    componentType: DashboardComponentType.KubernetesNamespaceList,
+    service: KubernetesResourceService,
+    kind: "Namespace",
+  },
+  {
+    resourceType: "kubernetes-resource",
+    componentType: DashboardComponentType.KubernetesDeploymentList,
+    service: KubernetesResourceService,
+    kind: "Deployment",
+  },
+  {
+    resourceType: "kubernetes-resource",
+    componentType: DashboardComponentType.KubernetesStatefulSetList,
+    service: KubernetesResourceService,
+    kind: "StatefulSet",
+  },
+  {
+    resourceType: "kubernetes-resource",
+    componentType: DashboardComponentType.KubernetesDaemonSetList,
+    service: KubernetesResourceService,
+    kind: "DaemonSet",
+  },
+  {
+    resourceType: "kubernetes-resource",
+    componentType: DashboardComponentType.KubernetesJobList,
+    service: KubernetesResourceService,
+    kind: "Job",
+  },
+  {
+    resourceType: "kubernetes-resource",
+    componentType: DashboardComponentType.KubernetesCronJobList,
+    service: KubernetesResourceService,
+    kind: "CronJob",
   },
   {
     resourceType: "docker-host",
     componentType: DashboardComponentType.DockerHostList,
     service: DockerHostService,
     kind: null,
-    allowedQueryKey: "otelCollectorStatus",
-    forbiddenQueryKey: "createdAt",
-    selectColumn: "name",
-    nonSelectColumn: "createdAt",
-    selectKeys: [
-      "_id",
-      "name",
-      "otelCollectorStatus",
-      "containersRunning",
-      "containersStopped",
-      "containersPaused",
-      "osType",
-      "osVersion",
-    ],
   },
   {
     resourceType: "docker-container",
     componentType: DashboardComponentType.DockerContainerList,
     service: DockerResourceService,
     kind: "Container",
-    allowedQueryKey: "imageName",
-    forbiddenQueryKey: "createdAt",
-    selectColumn: "name",
-    nonSelectColumn: "createdAt",
-    selectKeys: [
-      "_id",
-      "name",
-      "imageName",
-      "state",
-      "latestCpuPercent",
-      "latestMemoryBytes",
-      "dockerHostId",
-      "dockerHost",
-    ],
   },
   {
     resourceType: "docker-image",
     componentType: DashboardComponentType.DockerImageList,
     service: DockerResourceService,
     kind: "Image",
-    allowedQueryKey: "dockerHostId",
-    forbiddenQueryKey: "state",
-    selectColumn: "name",
-    nonSelectColumn: "state",
-    selectKeys: ["_id", "name", "containerId", "dockerHostId", "dockerHost"],
   },
   {
     resourceType: "docker-network",
     componentType: DashboardComponentType.DockerNetworkList,
     service: DockerResourceService,
     kind: "Network",
-    allowedQueryKey: "dockerHostId",
-    forbiddenQueryKey: "imageName",
-    selectColumn: "name",
-    nonSelectColumn: "imageName",
-    selectKeys: ["_id", "name", "state", "dockerHostId", "dockerHost"],
   },
   {
     resourceType: "docker-volume",
     componentType: DashboardComponentType.DockerVolumeList,
     service: DockerResourceService,
     kind: "Volume",
-    allowedQueryKey: "dockerHostId",
-    forbiddenQueryKey: "imageName",
-    selectColumn: "name",
-    nonSelectColumn: "imageName",
-    selectKeys: ["_id", "name", "state", "dockerHostId", "dockerHost"],
   },
   {
     resourceType: "podman-host",
     componentType: DashboardComponentType.PodmanHostList,
     service: PodmanHostService,
     kind: null,
-    allowedQueryKey: "otelCollectorStatus",
-    forbiddenQueryKey: "createdAt",
-    selectColumn: "name",
-    nonSelectColumn: "createdAt",
-    selectKeys: [
-      "_id",
-      "name",
-      "otelCollectorStatus",
-      "containersRunning",
-      "containersStopped",
-      "containersPaused",
-      "osType",
-      "osVersion",
-    ],
   },
   {
     resourceType: "podman-container",
     componentType: DashboardComponentType.PodmanContainerList,
     service: PodmanResourceService,
     kind: "Container",
-    allowedQueryKey: "imageName",
-    forbiddenQueryKey: "createdAt",
-    selectColumn: "name",
-    nonSelectColumn: "createdAt",
-    selectKeys: [
-      "_id",
-      "name",
-      "imageName",
-      "state",
-      "latestCpuPercent",
-      "latestMemoryBytes",
-      "podmanHostId",
-      "podmanHost",
-    ],
   },
   {
     resourceType: "podman-image",
     componentType: DashboardComponentType.PodmanImageList,
     service: PodmanResourceService,
     kind: "Image",
-    allowedQueryKey: "podmanHostId",
-    forbiddenQueryKey: "state",
-    selectColumn: "name",
-    nonSelectColumn: "state",
-    selectKeys: ["_id", "name", "containerId", "podmanHostId", "podmanHost"],
   },
   {
     resourceType: "podman-network",
     componentType: DashboardComponentType.PodmanNetworkList,
     service: PodmanResourceService,
     kind: "Network",
-    allowedQueryKey: "podmanHostId",
-    forbiddenQueryKey: "imageName",
-    selectColumn: "name",
-    nonSelectColumn: "imageName",
-    selectKeys: ["_id", "name", "state", "podmanHostId", "podmanHost"],
   },
   {
     resourceType: "podman-volume",
     componentType: DashboardComponentType.PodmanVolumeList,
     service: PodmanResourceService,
     kind: "Volume",
-    allowedQueryKey: "podmanHostId",
-    forbiddenQueryKey: "imageName",
-    selectColumn: "name",
-    nonSelectColumn: "imageName",
-    selectKeys: ["_id", "name", "state", "podmanHostId", "podmanHost"],
   },
   {
     resourceType: "proxmox-resource",
     componentType: DashboardComponentType.ProxmoxNodeList,
     service: ProxmoxResourceService,
     kind: "Node",
-    allowedQueryKey: "proxmoxClusterId",
-    forbiddenQueryKey: "createdAt",
-    selectColumn: "name",
-    nonSelectColumn: "createdAt",
-    selectKeys: [
-      "_id",
-      "name",
-      "externalId",
-      "kind",
-      "vmid",
-      "guestType",
-      "parentNodeName",
-      "isUp",
-      "haState",
-      "latestCpuPercent",
-      "latestMemoryPercent",
-      "lastSeenAt",
-      "proxmoxClusterId",
-      "proxmoxCluster",
-    ],
+  },
+  {
+    resourceType: "proxmox-resource",
+    componentType: DashboardComponentType.ProxmoxGuestList,
+    service: ProxmoxResourceService,
+    kind: "Guest",
   },
   {
     resourceType: "ceph-resource",
     componentType: DashboardComponentType.CephOsdList,
     service: CephResourceService,
     kind: "Osd",
-    allowedQueryKey: "cephClusterId",
-    forbiddenQueryKey: "createdAt",
-    selectColumn: "externalId",
-    nonSelectColumn: "createdAt",
-    selectKeys: [
-      "_id",
-      "name",
-      "externalId",
-      "kind",
-      "hostname",
-      "deviceClass",
-      "isUp",
-      "isIn",
-      "statBytes",
-      "statBytesUsed",
-      "storedBytes",
-      "maxAvailBytes",
-      "objects",
-      "lastSeenAt",
-      "cephClusterId",
-      "cephCluster",
-    ],
+  },
+  {
+    resourceType: "ceph-resource",
+    componentType: DashboardComponentType.CephPoolList,
+    service: CephResourceService,
+    kind: "Pool",
   },
   {
     resourceType: "docker-swarm-resource",
     componentType: DashboardComponentType.DockerSwarmNodeList,
     service: DockerSwarmResourceService,
     kind: "Node",
-    allowedQueryKey: "role",
-    forbiddenQueryKey: "createdAt",
-    selectColumn: "name",
-    nonSelectColumn: "createdAt",
-    selectKeys: [
-      "_id",
-      "name",
-      "externalId",
-      "kind",
-      "role",
-      "state",
-      "serviceMode",
-      "desiredReplicas",
-      "runningReplicas",
-      "image",
-      "isReady",
-      "latestCpuPercent",
-      "latestMemoryPercent",
-      "lastSeenAt",
-      "dockerSwarmClusterId",
-      "dockerSwarmCluster",
-    ],
+  },
+  {
+    resourceType: "docker-swarm-resource",
+    componentType: DashboardComponentType.DockerSwarmServiceList,
+    service: DockerSwarmResourceService,
+    kind: "Service",
   },
   {
     resourceType: "span",
     componentType: DashboardComponentType.TraceList,
     service: SpanService,
     kind: null,
-    allowedQueryKey: "statusCode",
-    forbiddenQueryKey: "traceId",
-    selectColumn: "startTime",
-    nonSelectColumn: "attributes",
-    selectKeys: [
-      "startTime",
-      "name",
-      "statusCode",
-      "durationUnixNano",
-      "traceId",
-      "spanId",
-      "kind",
-      "primaryEntityId",
-    ],
   },
   {
     resourceType: "log",
     componentType: DashboardComponentType.LogStream,
     service: LogService,
     kind: null,
-    allowedQueryKey: "severityText",
-    forbiddenQueryKey: "traceId",
-    selectColumn: "time",
-    nonSelectColumn: "severityNumber",
-    selectKeys: [
-      "time",
-      "severityText",
-      "body",
-      "primaryEntityId",
-      "traceId",
-      "spanId",
-      "attributes",
-    ],
   },
 ];
 
@@ -516,54 +324,68 @@ describe("DashboardAPI public resource-list", () => {
     new DashboardAPI();
   });
 
-  type BuildViewConfigFunction = (
-    componentTypes: Array<string>,
-  ) => DashboardViewConfig;
+  const buildWidget: (data: BuildWidgetData) => BuiltWidget = (
+    data: BuildWidgetData,
+  ): BuiltWidget => {
+    const componentId: ObjectID = data.componentId || ObjectID.generate();
+    let storedComponentId: JSONValue = componentId;
+
+    if (data.storedIdShape === "string") {
+      storedComponentId = componentId.toString();
+    } else if (data.storedIdShape === "serialized") {
+      storedComponentId = componentId.toJSON();
+    }
 
-  const buildViewConfig: BuildViewConfigFunction = (
-    componentTypes: Array<string>,
-  ): DashboardViewConfig => {
     return {
+      componentId,
+      widget: {
+        _type: "DashboardComponent",
+        componentId: storedComponentId,
+        componentType: data.componentType,
+        topInDashboardUnits: 0,
+        leftInDashboardUnits: 0,
+        widthInDashboardUnits: 12,
+        heightInDashboardUnits: 6,
+        minWidthInDashboardUnits: 1,
+        minHeightInDashboardUnits: 1,
+        arguments: data.argumentsObject || {},
+      },
+    };
+  };
+
+  const setDashboardWidgets: (
+    widgets: Array<JSONObject>,
+    variables?: Array<JSONObject>,
+  ) => void = (
+    widgets: Array<JSONObject>,
+    variables?: Array<JSONObject>,
+  ): void => {
+    dashboard.dashboardViewConfig = {
       _type: "DashboardViewConfig",
       heightInDashboardUnits: 24,
-      components: componentTypes.map(
-        (componentType: string, index: number): JSONObject => {
-          return {
-            _type: "DashboardComponent",
-            componentId: ObjectID.generate().toString(),
-            componentType: componentType,
-            topInDashboardUnits: index,
-            leftInDashboardUnits: 0,
-            widthInDashboardUnits: 12,
-            heightInDashboardUnits: 6,
-            minWidthInDashboardUnits: 1,
-            minHeightInDashboardUnits: 1,
-            arguments: {},
-          };
-        },
-      ),
+      components: widgets,
+      ...(variables ? { variables } : {}),
     } as unknown as DashboardViewConfig;
   };
 
-  type SetDashboardWidgetsFunction = (componentTypes: Array<string>) => void;
+  const telemetryQuery: (resourceType: string) => JSONObject = (
+    resourceType: string,
+  ): JSONObject => {
+    const start: Date = new Date("2026-08-09T10:00:00.000Z");
+    const end: Date = new Date("2026-08-09T11:00:00.000Z");
 
-  const setDashboardWidgets: SetDashboardWidgetsFunction = (
-    componentTypes: Array<string>,
-  ): void => {
-    dashboard.dashboardViewConfig = buildViewConfig(componentTypes);
+    if (resourceType === "log") {
+      return { time: new InBetween<Date>(start, end).toJSON() };
+    }
+    if (resourceType === "span") {
+      return { startTime: new InBetween<Date>(start, end).toJSON() };
+    }
+    return {};
   };
 
-  type CallRouteFunction = (data: {
-    resourceType: string;
-    body?: JSONObject;
-    query?: JSONObject;
-  }) => Promise<void>;
-
-  const callRoute: CallRouteFunction = async (data: {
-    resourceType: string;
-    body?: JSONObject;
-    query?: JSONObject;
-  }): Promise<void> => {
+  const callRoute: (data: CallRouteData) => Promise<void> = async (
+    data: CallRouteData,
+  ): Promise<void> => {
     const request: ExpressRequest = {
       params: {
         dashboardId: dashboardId.toString(),
@@ -582,33 +404,25 @@ describe("DashboardAPI public resource-list", () => {
       .handlerFunction(request, mockResponse, nextFunction);
   };
 
-  type GetFindByArgsFunction = (service: ListService) => JSONObject;
-
-  const getFindByArgs: GetFindByArgsFunction = (
+  const getFindByArgs: (service: ListService) => JSONObject = (
     service: ListService,
   ): JSONObject => {
     const calls: Array<Array<unknown>> = (service.findBy as jest.Mock).mock
       .calls as Array<Array<unknown>>;
 
     expect(calls.length).toBe(1);
-
     return calls[0]![0] as JSONObject;
   };
 
-  type GetThrownErrorFunction = () => unknown;
-
-  const getThrownError: GetThrownErrorFunction = (): unknown => {
+  const getThrownError: () => unknown = (): unknown => {
     const calls: Array<Array<unknown>> = (nextFunction as jest.Mock).mock
       .calls as Array<Array<unknown>>;
 
     expect(calls.length).toBe(1);
-
     return calls[0]![0];
   };
 
-  type ExpectNothingListedFunction = () => void;
-
-  const expectNothingListed: ExpectNothingListedFunction = (): void => {
+  const expectNothingListed: () => void = (): void => {
     for (const service of ALL_SERVICES) {
       expect(service.findBy).not.toHaveBeenCalled();
     }
@@ -619,7 +433,6 @@ describe("DashboardAPI public resource-list", () => {
 
     dashboardId = ObjectID.generate();
     projectId = ObjectID.generate();
-
     dashboard = new Dashboard();
     dashboard.id = dashboardId;
     dashboard.projectId = projectId;
@@ -644,7 +457,6 @@ describe("DashboardAPI public resource-list", () => {
       json: jest.fn(),
       status: jest.fn().mockReturnThis(),
     } as unknown as ExpressResponse;
-
     nextFunction = jest.fn();
   });
 
@@ -652,178 +464,180 @@ describe("DashboardAPI public resource-list", () => {
     jest.restoreAllMocks();
   });
 
-  describe("widget allowlist (GHSA-qv79-j844-cc7m)", () => {
-    it("refuses to stream a project's logs from a dashboard that has no log widget", async () => {
-      // The advisory's proof of concept: a metrics-only public dashboard.
-      setDashboardWidgets([
-        DashboardComponentType.Chart,
-        DashboardComponentType.Text,
-      ]);
+  describe("exact widget authorization (GHSA-qv79-j844-cc7m)", () => {
+    it("serves every registered widget only through its own resource policy", async () => {
+      for (const routeCase of RESOURCE_ROUTE_CASES) {
+        jest.clearAllMocks();
+        const { widget, componentId } = buildWidget({
+          componentType: routeCase.componentType,
+        });
+        setDashboardWidgets([widget]);
 
-      await callRoute({
-        resourceType: "log",
-        body: {
-          query: {
-            severityText: "Error",
+        await callRoute({
+          resourceType: routeCase.resourceType,
+          body: {
+            componentId: componentId.toString(),
+            query: telemetryQuery(routeCase.resourceType),
           },
-        },
-      });
-
-      const error: unknown = getThrownError();
-
-      expect(error).toBeInstanceOf(BadDataException);
-      expect((error as BadDataException).message).toBe(
-        "This resource is not part of this dashboard.",
-      );
-      expectNothingListed();
-    });
-
-    it("refuses to list incidents from a dashboard that only shows monitors", async () => {
-      setDashboardWidgets([DashboardComponentType.MonitorList]);
-
-      await callRoute({ resourceType: "incident" });
-
-      expect(getThrownError()).toBeInstanceOf(BadDataException);
-      expect(IncidentService.findBy).not.toHaveBeenCalled();
-    });
-
-    it("refuses every resource type on a dashboard with no widgets at all", async () => {
-      for (const resourceCase of RESOURCE_CASES) {
-        jest.clearAllMocks();
-        setDashboardWidgets([]);
+        });
 
-        await callRoute({ resourceType: resourceCase.resourceType });
+        expect(nextFunction).not.toHaveBeenCalled();
+        const findByArgs: JSONObject = getFindByArgs(routeCase.service);
+        const query: JSONObject = findByArgs["query"] as JSONObject;
 
-        expect(getThrownError()).toBeInstanceOf(BadDataException);
-        expectNothingListed();
+        expect(query["projectId"]).toBe(projectId);
+        if (routeCase.kind) {
+          expect(query["kind"]).toBe(routeCase.kind);
+        }
+        const expectedSelect: JSONObject =
+          PublicDashboardResourceListPolicy.build({
+            widget,
+            dashboardViewConfig: dashboard.dashboardViewConfig,
+            requestedVariables: [],
+            requestedQuery: telemetryQuery(routeCase.resourceType),
+          }).select;
+        expect(findByArgs["select"]).toEqual(expectedSelect);
+        expect(findByArgs["skip"]).toBe(0);
       }
     });
 
-    it("refuses every resource type when the stored view config is missing or malformed", async () => {
-      const malformedConfigs: Array<unknown> = [
-        null,
-        undefined,
-        "not-an-object",
-        42,
-        {},
-        { components: null },
-        { components: "not-an-array" },
-        { components: [null, 7, "widget"] },
-        { components: [{ componentType: 123 }] },
-        { components: [{ componentType: "" }] },
+    it("does not return sibling-only Proxmox or Swarm fields", async () => {
+      const cases: Array<{
+        resourceType: string;
+        componentType: DashboardComponentType;
+        service: ListService;
+        included: string;
+        excluded: string;
+      }> = [
+        {
+          resourceType: "proxmox-resource",
+          componentType: DashboardComponentType.ProxmoxGuestList,
+          service: ProxmoxResourceService,
+          included: "vmid",
+          excluded: "latestCpuPercent",
+        },
+        {
+          resourceType: "proxmox-resource",
+          componentType: DashboardComponentType.ProxmoxNodeList,
+          service: ProxmoxResourceService,
+          included: "latestCpuPercent",
+          excluded: "vmid",
+        },
+        {
+          resourceType: "docker-swarm-resource",
+          componentType: DashboardComponentType.DockerSwarmServiceList,
+          service: DockerSwarmResourceService,
+          included: "desiredReplicas",
+          excluded: "latestCpuPercent",
+        },
+        {
+          resourceType: "docker-swarm-resource",
+          componentType: DashboardComponentType.DockerSwarmNodeList,
+          service: DockerSwarmResourceService,
+          included: "latestCpuPercent",
+          excluded: "desiredReplicas",
+        },
       ];
 
-      for (const config of malformedConfigs) {
-        jest.clearAllMocks();
-        dashboard.dashboardViewConfig = config as DashboardViewConfig;
-
-        await callRoute({ resourceType: "log" });
-
-        expect(getThrownError()).toBeInstanceOf(BadDataException);
-        expectNothingListed();
-      }
-    });
-
-    it("serves each resource type once its own widget is on the dashboard", async () => {
-      for (const resourceCase of RESOURCE_CASES) {
+      for (const testCase of cases) {
         jest.clearAllMocks();
-        setDashboardWidgets([resourceCase.componentType]);
+        const selectedWidget: BuiltWidget = buildWidget({
+          componentType: testCase.componentType,
+        });
+        setDashboardWidgets([selectedWidget.widget]);
 
-        await callRoute({ resourceType: resourceCase.resourceType });
+        await callRoute({
+          resourceType: testCase.resourceType,
+          body: { componentId: selectedWidget.componentId.toString() },
+        });
 
-        expect(nextFunction).not.toHaveBeenCalled();
-        expect(resourceCase.service.findBy).toHaveBeenCalledTimes(1);
+        const select: JSONObject = getFindByArgs(testCase.service)[
+          "select"
+        ] as JSONObject;
+        expect(select[testCase.included]).toBe(true);
+        expect(select[testCase.excluded]).toBeUndefined();
       }
     });
 
-    it("does not let one widget unlock a sibling resource served by the same model", async () => {
-      // A Docker volume list must not become a Docker container reader.
-      setDashboardWidgets([DashboardComponentType.DockerVolumeList]);
+    it("fails closed when the dashboard has no matching top-level widget", async () => {
+      const monitor: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.MonitorList,
+        argumentsObject: {
+          nestedImpostor: buildWidget({
+            componentType: DashboardComponentType.LogStream,
+          }).widget,
+        },
+      });
+      setDashboardWidgets([monitor.widget]);
 
-      await callRoute({ resourceType: "docker-container" });
+      await callRoute({
+        resourceType: "log",
+        body: { query: telemetryQuery("log") },
+      });
 
       expect(getThrownError()).toBeInstanceOf(BadDataException);
-      expect(DockerResourceService.findBy).not.toHaveBeenCalled();
-    });
-
-    it("rejects a resource type that is not in the registry at all", async () => {
-      setDashboardWidgets([DashboardComponentType.LogStream]);
-
-      await callRoute({ resourceType: "user" });
-
-      const error: unknown = getThrownError();
-
-      expect(error).toBeInstanceOf(BadDataException);
-      expect((error as BadDataException).message).toBe(
-        "Unsupported dashboard resource type: user",
-      );
       expectNothingListed();
     });
-  });
 
-  describe("authorization", () => {
-    it("rejects a dashboard that is not public before reading anything", async () => {
-      dashboard.isPublicDashboard = false;
-      setDashboardWidgets([DashboardComponentType.LogStream]);
-
-      await callRoute({ resourceType: "log" });
-
-      expect(getThrownError()).toBeInstanceOf(NotAuthenticatedException);
-      expectNothingListed();
-    });
-
-    /*
-     * A missing dashboard never reaches the resource lookup: hasReadAccess
-     * fails closed first, so the viewer is told they have no access rather
-     * than whether the id exists.
-     */
-    it("rejects a dashboard that cannot be found", async () => {
-      setDashboardWidgets([DashboardComponentType.LogStream]);
-      jest.spyOn(DashboardService, "findOneById").mockResolvedValue(null);
+    it("auto-binds only when exactly one widget matches the resource", async () => {
+      const log: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.LogStream,
+        argumentsObject: { severityFilter: "Error" },
+      });
+      const monitor: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.MonitorList,
+      });
+      setDashboardWidgets([log.widget, monitor.widget]);
 
-      await callRoute({ resourceType: "log" });
+      await callRoute({
+        resourceType: "log",
+        body: { query: telemetryQuery("log") },
+      });
 
-      expect(getThrownError()).toBeInstanceOf(NotAuthenticatedException);
-      expectNothingListed();
+      expect(nextFunction).not.toHaveBeenCalled();
+      expect(
+        (getFindByArgs(LogService)["query"] as JSONObject)["severityText"],
+      ).toBe("Error");
     });
 
-    it("rejects a dashboard with no project", async () => {
-      setDashboardWidgets([DashboardComponentType.LogStream]);
-      delete dashboard.projectId;
+    it("requires componentId when several matching widgets have different policies", async () => {
+      const first: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.LogStream,
+        argumentsObject: { severityFilter: "Error" },
+      });
+      const second: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.LogStream,
+        argumentsObject: { severityFilter: "Warning" },
+      });
+      setDashboardWidgets([first.widget, second.widget]);
 
-      await callRoute({ resourceType: "log" });
+      await callRoute({
+        resourceType: "log",
+        body: { query: telemetryQuery("log") },
+      });
 
-      expect(getThrownError()).toBeInstanceOf(NotFoundException);
+      expect(getThrownError()).toBeInstanceOf(BadDataException);
       expectNothingListed();
     });
-  });
 
-  describe("project scoping", () => {
-    it("pins every resource type to the dashboard's own project", async () => {
-      for (const resourceCase of RESOURCE_CASES) {
-        jest.clearAllMocks();
-        setDashboardWidgets([resourceCase.componentType]);
-
-        await callRoute({ resourceType: resourceCase.resourceType });
-
-        const findByArgs: JSONObject = getFindByArgs(resourceCase.service);
-        const query: JSONObject = findByArgs["query"] as JSONObject;
-
-        expect(query["projectId"]).toBe(projectId);
-      }
-    });
-
-    it("ignores a client-supplied projectId pointing at another tenant", async () => {
-      const otherProjectId: ObjectID = ObjectID.generate();
-
-      setDashboardWidgets([DashboardComponentType.LogStream]);
+    it("uses the exact selected widget when several widgets share a resource", async () => {
+      const first: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.LogStream,
+        argumentsObject: { severityFilter: "Error" },
+      });
+      const second: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.LogStream,
+        argumentsObject: { severityFilter: "Warning" },
+      });
+      setDashboardWidgets([first.widget, second.widget]);
 
       await callRoute({
         resourceType: "log",
         body: {
+          componentId: second.componentId.toString(),
           query: {
-            projectId: otherProjectId.toString(),
-            severityText: "Error",
+            ...telemetryQuery("log"),
+            severityText: "Debug",
           },
         },
       });
@@ -831,483 +645,431 @@ describe("DashboardAPI public resource-list", () => {
       const query: JSONObject = getFindByArgs(LogService)[
         "query"
       ] as JSONObject;
-
-      expect(query["projectId"]).toBe(projectId);
-      expect(query["projectId"]).not.toBe(otherProjectId.toString());
-      expect(query["severityText"]).toBe("Error");
-    });
-  });
-
-  describe("query allowlist", () => {
-    it("keeps the widget's own filter and drops everything else", async () => {
-      for (const resourceCase of RESOURCE_CASES) {
-        jest.clearAllMocks();
-        setDashboardWidgets([resourceCase.componentType]);
-
-        await callRoute({
-          resourceType: resourceCase.resourceType,
-          body: {
-            query: {
-              [resourceCase.allowedQueryKey]: "allowed-value",
-              [resourceCase.forbiddenQueryKey]: "smuggled-value",
-              deletedAt: null,
-              password: "smuggled-value",
-            },
-          },
-        });
-
-        const query: JSONObject = getFindByArgs(resourceCase.service)[
-          "query"
-        ] as JSONObject;
-
-        expect(query[resourceCase.allowedQueryKey]).toBe("allowed-value");
-        expect(Object.keys(query)).not.toContain(
-          resourceCase.forbiddenQueryKey,
-        );
-        expect(Object.keys(query)).not.toContain("deletedAt");
-        expect(Object.keys(query)).not.toContain("password");
-      }
+      expect(query["severityText"]).toBe("Warning");
     });
 
-    it("preserves deserialized query operators on allowed keys", async () => {
-      const severityIds: Array<string> = [
-        ObjectID.generate().toString(),
-        ObjectID.generate().toString(),
-      ];
-
-      setDashboardWidgets([DashboardComponentType.IncidentList]);
+    it("rejects a componentId belonging to a different resource", async () => {
+      const log: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.LogStream,
+      });
+      const monitor: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.MonitorList,
+      });
+      setDashboardWidgets([log.widget, monitor.widget]);
 
       await callRoute({
-        resourceType: "incident",
+        resourceType: "log",
         body: {
-          query: {
-            incidentSeverityId: new Includes(severityIds).toJSON(),
-            currentIncidentState: {
-              isResolvedState: false,
-            },
-          },
+          componentId: monitor.componentId.toString(),
+          query: telemetryQuery("log"),
         },
       });
 
-      const query: JSONObject = getFindByArgs(IncidentService)[
-        "query"
-      ] as JSONObject;
+      expect(getThrownError()).toBeInstanceOf(BadDataException);
+      expectNothingListed();
+    });
 
-      expect(query["incidentSeverityId"]).toBeInstanceOf(Includes);
-      expect((query["incidentSeverityId"] as Includes).values).toEqual(
-        severityIds,
-      );
-      expect(query["currentIncidentState"]).toEqual({
-        isResolvedState: false,
+    it("requires the requested componentId to be a string UUID", async () => {
+      const log: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.LogStream,
       });
-    });
+      setDashboardWidgets([log.widget]);
 
-    it("ignores a query that is not an object", async () => {
-      const badQueries: Array<unknown> = [
-        "severityText",
-        ["severityText"],
+      const invalidIds: Array<JSONValue> = [
         42,
-        true,
+        [],
+        {},
+        "not-a-uuid",
+        ObjectID.generate().toJSON(),
       ];
-
-      for (const badQuery of badQueries) {
+      for (const invalidId of invalidIds) {
         jest.clearAllMocks();
-        setDashboardWidgets([DashboardComponentType.LogStream]);
-
         await callRoute({
           resourceType: "log",
-          body: { query: badQuery as JSONObject },
+          body: {
+            componentId: invalidId,
+            query: telemetryQuery("log"),
+          },
         });
 
-        expect(nextFunction).not.toHaveBeenCalled();
-
-        const query: JSONObject = getFindByArgs(LogService)[
-          "query"
-        ] as JSONObject;
-
-        expect(Object.keys(query)).toEqual(["projectId"]);
+        expect(getThrownError()).toBeInstanceOf(BadDataException);
+        expectNothingListed();
       }
     });
 
-    it("does not carry prototype-polluting keys into the query", async () => {
-      setDashboardWidgets([DashboardComponentType.LogStream]);
-
-      /*
-       * JSON.parse (like the Express body parser) makes "__proto__" a real
-       * own key rather than setting the prototype, which is how a pollution
-       * payload actually arrives.
-       */
-      const pollutedQuery: JSONObject = JSON.parse(
-        '{"__proto__":{"polluted":true},"constructor":{"polluted":true},"severityText":"Error"}',
-      ) as JSONObject;
-
-      await callRoute({
-        resourceType: "log",
-        body: { query: pollutedQuery },
-      });
-
-      const query: JSONObject = getFindByArgs(LogService)[
-        "query"
-      ] as JSONObject;
-
-      expect(Object.keys(query).sort()).toEqual(["projectId", "severityText"]);
-      expect(({} as Record<string, unknown>)["polluted"]).toBeUndefined();
-    });
-
-    it("sends no query at all when the body is empty", async () => {
-      setDashboardWidgets([DashboardComponentType.MonitorList]);
+    it("matches legacy stored ObjectID, string, and serialized ID shapes", async () => {
+      const storedIdShapes: Array<"object" | "string" | "serialized"> = [
+        "object",
+        "string",
+        "serialized",
+      ];
 
-      await callRoute({ resourceType: "monitor" });
+      for (const storedIdShape of storedIdShapes) {
+        jest.clearAllMocks();
+        const log: BuiltWidget = buildWidget({
+          componentType: DashboardComponentType.LogStream,
+          storedIdShape,
+        });
+        setDashboardWidgets([log.widget]);
 
-      const query: JSONObject = getFindByArgs(MonitorService)[
-        "query"
-      ] as JSONObject;
+        await callRoute({
+          resourceType: "log",
+          body: {
+            componentId: log.componentId.toString(),
+            query: telemetryQuery("log"),
+          },
+        });
 
-      expect(query).toEqual({ projectId: projectId });
+        expect(nextFunction).not.toHaveBeenCalled();
+        expect(LogService.findBy).toHaveBeenCalledTimes(1);
+      }
     });
-  });
 
-  describe("kind pinning", () => {
-    it("pins the kind for every resource type whose model packs several kinds", async () => {
-      for (const resourceCase of RESOURCE_CASES) {
-        if (!resourceCase.kind) {
-          continue;
-        }
+    it("rejects malformed view configs and unsupported resource types", async () => {
+      const malformedConfigs: Array<unknown> = [
+        null,
+        "not-an-object",
+        {},
+        { components: null },
+        { components: [null, 7, { componentType: 123 }] },
+      ];
 
+      for (const config of malformedConfigs) {
         jest.clearAllMocks();
-        setDashboardWidgets([resourceCase.componentType]);
-
-        await callRoute({ resourceType: resourceCase.resourceType });
-
-        const query: JSONObject = getFindByArgs(resourceCase.service)[
-          "query"
-        ] as JSONObject;
-
-        expect(query["kind"]).toBe(resourceCase.kind);
+        dashboard.dashboardViewConfig = config as DashboardViewConfig;
+        await callRoute({ resourceType: "log" });
+        expect(getThrownError()).toBeInstanceOf(BadDataException);
+        expectNothingListed();
       }
+
+      jest.clearAllMocks();
+      setDashboardWidgets([]);
+      await callRoute({ resourceType: "user" });
+      expect(getThrownError()).toBeInstanceOf(BadDataException);
+      expectNothingListed();
     });
+  });
 
-    it("rejects a kind the dashboard's widgets do not render", async () => {
-      setDashboardWidgets([DashboardComponentType.DockerVolumeList]);
+  describe("server-owned query policy", () => {
+    it("rebuilds log filters, sort, limit, skip, and select from stored policy", async () => {
+      const log: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.LogStream,
+        argumentsObject: {
+          severityFilter: "Error",
+          bodyContains: "timeout",
+          attributeFilterQuery: "@service.name:api",
+          maxRows: 13,
+        },
+      });
+      setDashboardWidgets([log.widget]);
 
       await callRoute({
-        resourceType: "docker-volume",
+        resourceType: "log",
         body: {
+          componentId: log.componentId.toString(),
           query: {
-            kind: "Container",
+            ...telemetryQuery("log"),
+            severityText: "Debug",
+            body: "",
+            attributes: {},
+            projectId: ObjectID.generate().toString(),
           },
+          sort: { severityText: SortOrder.Ascending },
+          select: { severityNumber: true, password: true },
+          limit: 9999,
+          skip: 9999,
         },
+        query: { limit: "9999", skip: "9999" },
       });
 
-      const error: unknown = getThrownError();
+      const findByArgs: JSONObject = getFindByArgs(LogService);
+      const query: JSONObject = findByArgs["query"] as JSONObject;
 
-      expect(error).toBeInstanceOf(BadDataException);
-      expect((error as BadDataException).message).toBe(
-        "This resource is not part of this dashboard.",
-      );
-      expect(DockerResourceService.findBy).not.toHaveBeenCalled();
+      expect(query["projectId"]).toBe(projectId);
+      expect(query["severityText"]).toBe("Error");
+      expect(query["body"]).toBe("timeout");
+      expect((query["attributes"] as JSONObject)["service.name"]).toBe("api");
+      expect(query["time"]).toBeInstanceOf(InBetween);
+      expect(findByArgs["sort"]).toEqual({
+        time: SortOrder.Descending,
+      });
+      expect(findByArgs["limit"]).toBe(13);
+      expect(findByArgs["skip"]).toBe(0);
+      expect(findByArgs["select"]).toEqual({
+        time: true,
+        severityText: true,
+        body: true,
+      });
     });
 
-    it("rejects a non-string kind", async () => {
-      setDashboardWidgets([DashboardComponentType.CephPoolList]);
+    it("does not let omitted or changed request filters widen stored incident policy", async () => {
+      const severityId: ObjectID = ObjectID.generate();
+      const incident: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.IncidentList,
+        argumentsObject: {
+          stateFilter: "unresolved",
+          severityIds: [severityId.toString()],
+          maxRows: 9,
+        },
+      });
+      setDashboardWidgets([incident.widget]);
 
       await callRoute({
-        resourceType: "ceph-resource",
+        resourceType: "incident",
         body: {
+          componentId: incident.componentId.toString(),
           query: {
-            kind: { $ne: "Pool" },
+            currentIncidentState: { isResolvedState: true },
+            incidentSeverityId: [],
           },
         },
       });
 
-      expect(getThrownError()).toBeInstanceOf(BadDataException);
-      expect(CephResourceService.findBy).not.toHaveBeenCalled();
-    });
+      const findByArgs: JSONObject = getFindByArgs(IncidentService);
+      const query: JSONObject = findByArgs["query"] as JSONObject;
 
-    it("lets a widget pick its own kind when the dashboard renders several", async () => {
-      setDashboardWidgets([
-        DashboardComponentType.KubernetesPodList,
-        DashboardComponentType.KubernetesNodeList,
+      expect(query["currentIncidentState"]).toEqual({
+        isResolvedState: false,
+      });
+      expect(query["incidentSeverityId"]).toBeInstanceOf(Includes);
+      expect((query["incidentSeverityId"] as Includes).values).toEqual([
+        severityId.toString(),
       ]);
+      expect(findByArgs["sort"]).toEqual({
+        createdAt: SortOrder.Descending,
+      });
+      expect(findByArgs["limit"]).toBe(9);
+      expect(findByArgs["skip"]).toBe(0);
+    });
+
+    it("takes kind from the selected widget policy, not from the caller", async () => {
+      const pod: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.KubernetesPodList,
+      });
+      setDashboardWidgets([pod.widget]);
 
       await callRoute({
         resourceType: "kubernetes-resource",
         body: {
-          query: {
-            kind: "Node",
-          },
+          componentId: pod.componentId.toString(),
+          query: { kind: "Node" },
         },
       });
 
       const query: JSONObject = getFindByArgs(KubernetesResourceService)[
         "query"
       ] as JSONObject;
-
-      expect(query["kind"]).toBe("Node");
-    });
-
-    it("falls back to every kind the dashboard renders when none is named", async () => {
-      setDashboardWidgets([
-        DashboardComponentType.KubernetesPodList,
-        DashboardComponentType.KubernetesNodeList,
-      ]);
-
-      await callRoute({ resourceType: "kubernetes-resource" });
-
-      const query: JSONObject = getFindByArgs(KubernetesResourceService)[
-        "query"
-      ] as JSONObject;
-
-      expect(query["kind"]).toBeInstanceOf(Includes);
-      expect((query["kind"] as Includes).values).toEqual(["Pod", "Node"]);
+      expect(query["kind"]).toBe("Pod");
     });
 
-    it("still rejects a kind that no widget on a multi-widget dashboard renders", async () => {
-      setDashboardWidgets([
-        DashboardComponentType.KubernetesPodList,
-        DashboardComponentType.KubernetesNodeList,
-      ]);
-
-      await callRoute({
-        resourceType: "kubernetes-resource",
-        body: {
-          query: {
-            kind: "Namespace",
-          },
+    it("passes only dynamic time and bounded variable selections into policy", async () => {
+      const buildSpy: ReturnType<typeof jest.spyOn> = jest.spyOn(
+        PublicDashboardResourceListPolicy,
+        "build",
+      );
+      const log: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.LogStream,
+        argumentsObject: {
+          attributeFilterQuery: "@service.name:stored-service",
         },
       });
-
-      expect(getThrownError()).toBeInstanceOf(BadDataException);
-      expect(KubernetesResourceService.findBy).not.toHaveBeenCalled();
-    });
-
-    it("does not add a kind filter to models that have no kinds", async () => {
-      setDashboardWidgets([DashboardComponentType.LogStream]);
+      const variable: JSONObject = {
+        id: "service-variable",
+        name: "Service",
+        type: DashboardVariableType.TelemetryAttribute,
+        attributeKey: "service.name",
+        defaultValue: "default-service",
+      };
+      setDashboardWidgets([log.widget], [variable]);
+      const requestedVariables: Array<JSONObject> = [
+        {
+          id: "service-variable",
+          selectedValue: "checkout",
+          selectedValues: [],
+        },
+      ];
 
       await callRoute({
         resourceType: "log",
         body: {
-          query: {
-            kind: "Volume",
-          },
+          componentId: log.componentId.toString(),
+          query: telemetryQuery("log"),
+          variables: requestedVariables,
         },
       });
 
+      expect(buildSpy).toHaveBeenCalledTimes(1);
+      const policyInput: BuildPublicDashboardResourceListPolicyData =
+        buildSpy.mock.calls[0]![0];
+      expect(policyInput.widget).toBe(log.widget);
+      expect(policyInput.dashboardViewConfig).toBe(
+        dashboard.dashboardViewConfig,
+      );
+      expect(policyInput.requestedVariables).toEqual(requestedVariables);
+      expect((policyInput.requestedQuery as JSONObject)["time"]).toBeInstanceOf(
+        InBetween,
+      );
+
       const query: JSONObject = getFindByArgs(LogService)[
         "query"
       ] as JSONObject;
-
-      expect(Object.keys(query)).not.toContain("kind");
-    });
-  });
-
-  describe("fixed select", () => {
-    it("serves exactly the columns the widget renders, whatever the client asks for", async () => {
-      for (const resourceCase of RESOURCE_CASES) {
-        jest.clearAllMocks();
-        setDashboardWidgets([resourceCase.componentType]);
-
-        await callRoute({
-          resourceType: resourceCase.resourceType,
-          body: {
-            select: {
-              [resourceCase.nonSelectColumn]: true,
-              password: true,
-            },
-          },
-        });
-
-        const select: JSONObject = getFindByArgs(resourceCase.service)[
-          "select"
-        ] as JSONObject;
-
-        expect(Object.keys(select).sort()).toEqual(
-          [...resourceCase.selectKeys].sort(),
-        );
-        expect(select[resourceCase.selectColumn]).toBe(true);
-        expect(Object.keys(select)).not.toContain("password");
-      }
+      expect((query["attributes"] as JSONObject)["service.name"]).toBe(
+        "checkout",
+      );
     });
 
-    it("never exposes a log column the log stream widget does not render", async () => {
-      setDashboardWidgets([DashboardComponentType.LogStream]);
-
-      await callRoute({ resourceType: "log" });
-
-      const select: JSONObject = getFindByArgs(LogService)[
-        "select"
-      ] as JSONObject;
-
-      expect(select).toEqual({
-        time: true,
-        severityText: true,
-        body: true,
-        primaryEntityId: true,
-        traceId: true,
-        spanId: true,
-        attributes: true,
+    it("fails closed when a telemetry request omits its time range", async () => {
+      const log: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.LogStream,
       });
-    });
-  });
-
-  describe("sort allowlist", () => {
-    it("keeps a sort on a rendered column and normalizes the order", async () => {
-      setDashboardWidgets([DashboardComponentType.LogStream]);
+      setDashboardWidgets([log.widget]);
 
       await callRoute({
         resourceType: "log",
-        body: {
-          sort: {
-            time: "DESC",
-          },
-        },
+        body: { componentId: log.componentId.toString(), query: {} },
       });
 
-      expect(getFindByArgs(LogService)["sort"]).toEqual({
-        time: SortOrder.Descending,
-      });
+      expect(getThrownError()).toBeInstanceOf(BadDataException);
+      expectNothingListed();
     });
 
-    it("accepts a lower-case sort order", async () => {
-      setDashboardWidgets([DashboardComponentType.LogStream]);
+    it("rejects a policy result for any resource other than the URL resource", async () => {
+      const log: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.LogStream,
+      });
+      setDashboardWidgets([log.widget]);
+      const mismatchedPolicy: PublicDashboardResourceListPolicyResult = {
+        resourceType: "monitor",
+        query: {},
+        select: {},
+        sort: {},
+        limit: 1,
+      };
+      jest
+        .spyOn(PublicDashboardResourceListPolicy, "build")
+        .mockReturnValue(mismatchedPolicy);
 
       await callRoute({
         resourceType: "log",
-        body: {
-          sort: {
-            time: "desc",
-          },
-        },
+        body: { componentId: log.componentId.toString() },
       });
 
-      expect(getFindByArgs(LogService)["sort"]).toEqual({
-        time: SortOrder.Descending,
-      });
+      expect(getThrownError()).toBeInstanceOf(BadDataException);
+      expectNothingListed();
     });
 
-    it("falls back to ascending for an unrecognised sort order", async () => {
-      setDashboardWidgets([DashboardComponentType.LogStream]);
+    it("pins projectId after policy construction", async () => {
+      const otherProjectId: ObjectID = ObjectID.generate();
+      const log: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.LogStream,
+      });
+      setDashboardWidgets([log.widget]);
+      const policy: PublicDashboardResourceListPolicyResult = {
+        resourceType: "log",
+        query: { projectId: otherProjectId },
+        select: { time: true },
+        sort: { time: SortOrder.Descending },
+        limit: 7,
+      };
+      jest
+        .spyOn(PublicDashboardResourceListPolicy, "build")
+        .mockReturnValue(policy);
 
       await callRoute({
         resourceType: "log",
-        body: {
-          sort: {
-            time: { $gt: 1 },
-          },
-        },
+        body: { componentId: log.componentId.toString() },
       });
 
-      expect(getFindByArgs(LogService)["sort"]).toEqual({
-        time: SortOrder.Ascending,
-      });
+      const query: JSONObject = getFindByArgs(LogService)[
+        "query"
+      ] as JSONObject;
+      expect(query["projectId"]).toBe(projectId);
+      expect(query["projectId"]).not.toBe(otherProjectId);
     });
+  });
+
+  describe("public incident and alert privacy", () => {
+    it("adds anonymous privacy clauses before root incident and alert reads", async () => {
+      const privacyCases: Array<{
+        resourceType: "incident" | "alert";
+        componentType: DashboardComponentType;
+        service: ListService;
+      }> = [
+        {
+          resourceType: "incident",
+          componentType: DashboardComponentType.IncidentList,
+          service: IncidentService,
+        },
+        {
+          resourceType: "alert",
+          componentType: DashboardComponentType.AlertList,
+          service: AlertService,
+        },
+      ];
 
-    it("drops a sort on a column the viewer cannot see", async () => {
-      for (const resourceCase of RESOURCE_CASES) {
+      for (const privacyCase of privacyCases) {
         jest.clearAllMocks();
-        setDashboardWidgets([resourceCase.componentType]);
+        const { widget, componentId } = buildWidget({
+          componentType: privacyCase.componentType,
+        });
+        setDashboardWidgets([widget]);
 
         await callRoute({
-          resourceType: resourceCase.resourceType,
-          body: {
-            sort: {
-              [resourceCase.nonSelectColumn]: "DESC",
-              [resourceCase.selectColumn]: "DESC",
-            },
-          },
+          resourceType: privacyCase.resourceType,
+          body: { componentId: componentId.toString() },
         });
 
-        expect(getFindByArgs(resourceCase.service)["sort"]).toEqual({
-          [resourceCase.selectColumn]: SortOrder.Descending,
-        });
+        const findByArgs: JSONObject = getFindByArgs(privacyCase.service);
+        const query: JSONObject = findByArgs["query"] as JSONObject;
+        expect(query["isPrivate"]).toBeInstanceOf(FindOperator);
+        expect(query["projectId"]).toBe(projectId);
+        expect(findByArgs["props"]).toEqual({ isRoot: true });
       }
     });
+  });
 
-    it("drops a sort on a related column that is only partially selected", async () => {
-      setDashboardWidgets([DashboardComponentType.IncidentList]);
-
-      await callRoute({
-        resourceType: "incident",
-        body: {
-          sort: {
-            currentIncidentState: "DESC",
-          },
-        },
+  describe("dashboard authorization", () => {
+    it("rejects a non-public or missing dashboard before listing", async () => {
+      const log: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.LogStream,
       });
-
-      expect(getFindByArgs(IncidentService)["sort"]).toEqual({});
-    });
-
-    it("ignores a sort that is not an object", async () => {
-      setDashboardWidgets([DashboardComponentType.LogStream]);
+      setDashboardWidgets([log.widget]);
+      dashboard.isPublicDashboard = false;
 
       await callRoute({
         resourceType: "log",
-        body: { sort: ["time"] as unknown as JSONObject },
+        body: {
+          componentId: log.componentId.toString(),
+          query: telemetryQuery("log"),
+        },
       });
+      expect(getThrownError()).toBeInstanceOf(NotAuthenticatedException);
+      expectNothingListed();
 
-      expect(getFindByArgs(LogService)["sort"]).toEqual({});
-    });
-  });
-
-  describe("pagination", () => {
-    it("defaults to the dashboard resource limit", async () => {
-      setDashboardWidgets([DashboardComponentType.LogStream]);
-
+      jest.clearAllMocks();
+      jest.spyOn(DashboardService, "findOneById").mockResolvedValue(null);
       await callRoute({ resourceType: "log" });
-
-      const findByArgs: JSONObject = getFindByArgs(LogService);
-
-      expect(findByArgs["limit"]).toBe(100);
-      expect(findByArgs["skip"]).toBe(0);
+      expect(getThrownError()).toBeInstanceOf(NotAuthenticatedException);
+      expectNothingListed();
     });
 
-    it("clamps an oversized limit to the per-project maximum", async () => {
-      setDashboardWidgets([DashboardComponentType.LogStream]);
-
-      await callRoute({
-        resourceType: "log",
-        query: { limit: "10000000" },
+    it("rejects a dashboard with no project", async () => {
+      const log: BuiltWidget = buildWidget({
+        componentType: DashboardComponentType.LogStream,
       });
-
-      expect(getFindByArgs(LogService)["limit"]).toBe(LIMIT_PER_PROJECT);
-    });
-
-    it("falls back to the default for a nonsensical limit or skip", async () => {
-      const cases: Array<{ limit: string; skip: string }> = [
-        { limit: "-5", skip: "-5" },
-        { limit: "0", skip: "not-a-number" },
-        { limit: "not-a-number", skip: "0" },
-      ];
-
-      for (const testCase of cases) {
-        jest.clearAllMocks();
-        setDashboardWidgets([DashboardComponentType.LogStream]);
-
-        await callRoute({
-          resourceType: "log",
-          query: { limit: testCase.limit, skip: testCase.skip },
-        });
-
-        const findByArgs: JSONObject = getFindByArgs(LogService);
-
-        expect(findByArgs["limit"]).toBe(100);
-        expect(findByArgs["skip"]).toBe(0);
-      }
-    });
-
-    it("honours a sensible limit and skip", async () => {
-      setDashboardWidgets([DashboardComponentType.LogStream]);
+      setDashboardWidgets([log.widget]);
+      delete dashboard.projectId;
 
       await callRoute({
         resourceType: "log",
-        query: { limit: "25", skip: "50" },
+        body: {
+          componentId: log.componentId.toString(),
+          query: telemetryQuery("log"),
+        },
       });
 
-      const findByArgs: JSONObject = getFindByArgs(LogService);
-
-      expect(findByArgs["limit"]).toBe(25);
-      expect(findByArgs["skip"]).toBe(50);
+      expect(getThrownError()).toBeInstanceOf(NotFoundException);
+      expectNothingListed();
     });
   });
 });