@oneuptime/common 12.0.8 → 12.0.9

package/build/dist/Server/API/TeamComplianceAPI.js

@@ -3,10 +3,47 @@ import TeamComplianceService from "../Services/TeamComplianceService";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
 import CommonAPI from "./CommonAPI";
-import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import Team from "../../Models/DatabaseModels/Team";
 import TeamService from "../Services/TeamService";
+/*
+ * `/team/compliance-status/:teamId` - who on this team cannot be paged, and why.
+ *
+ * AUTHORISATION, and why it is written out here rather than assumed.
+ *
+ * This route is mounted with UserMiddleware.getUserMiddleware, and that
+ * middleware is not an authorisation gate: it admits an unauthenticated request
+ * as UserType.Public and calls next(), and the tenant id it attaches is read
+ * from the caller-supplied `tenantid` header before any authorisation runs.
+ * Everything underneath then reads with `isRoot: true`, because a compliance
+ * page necessarily reports on people the reader may not be permitted to read
+ * individually. The handler is therefore the only gate that exists.
+ *
+ * Until this change the handler checked only that the header carried SOME
+ * project id, so anyone at all could send a `tenantid` and a team id and be told
+ * which of that team's responders are unreachable, by name and email. That is a
+ * roster of who to phone during an outage and who will never pick up, and it
+ * predates Phase 2 - it is not a regression introduced by the readiness work,
+ * but the readiness work rebuilt this service, so it is closed here.
+ *
+ * Two assertions now, in this order:
+ *
+ *   1. the caller is a logged-in member of the project they named
+ *      (CommonAPI.assertAuthenticatedProjectMember), and
+ *   2. the team in the path belongs to that same project - otherwise a member of
+ *      project A reads project B's roster simply by sending their own header
+ *      alongside a borrowed team id.
+ *
+ * TeamComplianceService scopes its own team read to the project as well, and the
+ * duplication is deliberate for the same reason OnCallReadinessAPI duplicates
+ * its service's guards: the service's scoping answers "no such team" (a 400),
+ * whereas a member of project A reaching for project B's team id is an
+ * authorisation failure and should be answered as one - and an endpoint's
+ * authorisation should be legible in the endpoint, not inferred from what some
+ * service happens to do today. The wording of the refusal is identical to the
+ * one a nonexistent team gets, so the route cannot be used to enumerate team ids
+ * across tenants.
+ */
 export default class TeamComplianceAPI extends BaseAPI {
     constructor() {
         var _a;
@@ -15,14 +52,36 @@ export default class TeamComplianceAPI extends BaseAPI {
         this.router.get(`${(_a = new this.entityType().getCrudApiPath()) === null || _a === void 0 ? void 0 : _a.toString()}/compliance-status/:teamId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
             try {
                 const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
-                const projectId = databaseProps.tenantId;
-                const teamId = new ObjectID(req.params["teamId"]);
-                if (!projectId) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("Invalid projectId."));
-                }
-                if (!teamId) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("Invalid teamId."));
-                }
+                const projectId = CommonAPI.assertAuthenticatedProjectMember(databaseProps);
+                /*
+                 * ObjectID's constructor accepts any string, so an unparseable path
+                 * segment would otherwise travel all the way to a query that matches
+                 * nothing and be reported as "this team does not exist" rather than as
+                 * "you sent nonsense". The guard this replaces was `if (!teamId)`,
+                 * which could never fire: `new ObjectID(...)` is always truthy, so a
+                 * malformed id was accepted silently.
+                 */
+                const rawTeamId = req.params["teamId"] || "";
+                ObjectID.validateUUID(rawTeamId);
+                const teamId = new ObjectID(rawTeamId);
+                /*
+                 * The team id arrives from the caller and everything downstream reads
+                 * as root, so the team's OWN projectId - not the header - is what has
+                 * to agree with the project the caller was authorised for.
+                 */
+                const team = await TeamService.findOneById({
+                    id: teamId,
+                    select: {
+                        projectId: true,
+                    },
+                    props: {
+                        isRoot: true,
+                    },
+                });
+                CommonAPI.assertResourceBelongsToProject({
+                    resourceProjectId: team === null || team === void 0 ? void 0 : team.projectId,
+                    projectId: projectId,
+                });
                 const complianceStatus = await TeamComplianceService.getTeamComplianceStatus(teamId, projectId);
                 // Convert ObjectIDs to strings for JSON response
                 const responseData = {

package/build/dist/Server/API/TeamComplianceAPI.js.map

@@ -1 +1 @@
-{"version":3,"file":"TeamComplianceAPI.js","sourceRoot":"","sources":["../../../../Server/API/TeamComplianceAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,qBAGN,MAAM,mCAAmC,CAAC;AAM3C,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,SAAS,MAAM,aAAa,CAAC;AAEpC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,IAAI,MAAM,kCAAkC,CAAC;AACpD,OAAO,WAEN,MAAM,yBAAyB,CAAC;AAGjC,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,OAA8B;IAC3E;;QACE,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAEzB,6BAA6B;QAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,4BAA4B,EACjF,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,aAAa,GACjB,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;gBAEzD,MAAM,SAAS,GAAa,aAAa,CAAC,QAAoB,CAAC;gBAE/D,MAAM,MAAM,GAAa,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAW,CAAC,CAAC;gBAEtE,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAC3C,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,gBAAgB,GACpB,MAAM,qBAAqB,CAAC,uBAAuB,CACjD,MAAM,EACN,SAAS,CACV,CAAC;gBAEJ,iDAAiD;gBACjD,MAAM,YAAY,GAkBd;oBACF,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE;oBAC1C,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;oBACnC,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;oBACvD,sBAAsB,EAAE,gBAAgB,CAAC,sBAAsB,CAAC,GAAG,CACjE,CAAC,IAA0B,EAAE,EAAE;;wBAC7B,OAAO;4BACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;4BAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;4BACvB,SAAS,EAAE,IAAI,CAAC,SAAS;4BACzB,oBAAoB,EAAE,MAAA,IAAI,CAAC,oBAAoB,0CAAE,QAAQ,EAAE;4BAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;4BAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;yBAC1C,CAAC;oBACJ,CAAC,CACF;iBACF,CAAC;gBAEF,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"TeamComplianceAPI.js","sourceRoot":"","sources":["../../../../Server/API/TeamComplianceAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,qBAGN,MAAM,mCAAmC,CAAC;AAM3C,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,SAAS,MAAM,aAAa,CAAC;AAEpC,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,IAAI,MAAM,kCAAkC,CAAC;AACpD,OAAO,WAEN,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,OAA8B;IAC3E;;QACE,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAEzB,6BAA6B;QAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,4BAA4B,EACjF,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,aAAa,GACjB,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;gBAEzD,MAAM,SAAS,GACb,SAAS,CAAC,gCAAgC,CAAC,aAAa,CAAC,CAAC;gBAE5D;;;;;;;mBAOG;gBACH,MAAM,SAAS,GAAY,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAY,IAAI,EAAE,CAAC;gBACjE,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;gBACjC,MAAM,MAAM,GAAa,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAEjD;;;;mBAIG;gBACH,MAAM,IAAI,GAAgB,MAAM,WAAW,CAAC,WAAW,CAAC;oBACtD,EAAE,EAAE,MAAM;oBACV,MAAM,EAAE;wBACN,SAAS,EAAE,IAAI;qBAChB;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,SAAS,CAAC,8BAA8B,CAAC;oBACvC,iBAAiB,EAAE,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,SAAS;oBAClC,SAAS,EAAE,SAAS;iBACrB,CAAC,CAAC;gBAEH,MAAM,gBAAgB,GACpB,MAAM,qBAAqB,CAAC,uBAAuB,CACjD,MAAM,EACN,SAAS,CACV,CAAC;gBAEJ,iDAAiD;gBACjD,MAAM,YAAY,GAkBd;oBACF,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE;oBAC1C,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;oBACnC,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;oBACvD,sBAAsB,EAAE,gBAAgB,CAAC,sBAAsB,CAAC,GAAG,CACjE,CAAC,IAA0B,EAAE,EAAE;;wBAC7B,OAAO;4BACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;4BAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;4BACvB,SAAS,EAAE,IAAI,CAAC,SAAS;4BACzB,oBAAoB,EAAE,MAAA,IAAI,CAAC,oBAAoB,0CAAE,QAAQ,EAAE;4BAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;4BAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;yBAC1C,CAAC;oBACJ,CAAC,CACF;iBACF,CAAC;gBAEF,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Server/API/TelemetryAPI.js

@@ -194,6 +194,9 @@ router.post("/telemetry/logs/histogram", ...requireLogReadAccess, async (req, re
         const spanIds = body["spanIds"]
             ? body["spanIds"]
             : undefined;
+        const sessionIds = body["sessionIds"]
+            ? body["sessionIds"]
+            : undefined;
         const attributes = body["attributes"]
             ? body["attributes"]
             : undefined;
@@ -208,6 +211,7 @@ router.post("/telemetry/logs/histogram", ...requireLogReadAccess, async (req, re
             bodySearchText,
             traceIds,
             spanIds,
+            sessionIds,
             attributes,
         };
         const buckets = await LogAggregationService.getHistogram(request);
@@ -257,6 +261,9 @@ router.post("/telemetry/logs/facets", ...requireLogReadAccess, async (req, res,
         const spanIds = body["spanIds"]
             ? body["spanIds"]
             : undefined;
+        const sessionIds = body["sessionIds"]
+            ? body["sessionIds"]
+            : undefined;
         const attributes = body["attributes"]
             ? body["attributes"]
             : undefined;
@@ -292,6 +299,7 @@ router.post("/telemetry/logs/facets", ...requireLogReadAccess, async (req, res,
                     bodySearchText,
                     traceIds,
                     spanIds,
+                    sessionIds,
                     attributes,
                 };
                 const values = await LogAggregationService.getFacetValues(request);
@@ -1012,6 +1020,37 @@ router.post("/telemetry/metrics/facets", ...requireMetricReadAccess, async (req,
         next(err);
     }
 });
+// --- Metrics For Trace (reverse exemplar lookup) Endpoint ---
+router.post("/telemetry/metrics/for-trace", ...requireMetricReadAccess, async (req, res, next) => {
+    try {
+        const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
+            return Response.sendErrorResponse(req, res, new BadDataException("Invalid Project ID"));
+        }
+        const body = req.body;
+        const traceId = body["traceId"] && typeof body["traceId"] === "string"
+            ? body["traceId"]
+            : undefined;
+        if (!traceId) {
+            return Response.sendErrorResponse(req, res, new BadDataException("traceId is required"));
+        }
+        const spanIds = Array.isArray(body["spanIds"])
+            ? body["spanIds"].filter((s) => {
+                return typeof s === "string" && s.length > 0;
+            })
+            : undefined;
+        const limit = typeof body["limit"] === "number"
+            ? body["limit"]
+            : undefined;
+        const items = await MetricAggregationService.getMetricsForTrace(Object.assign(Object.assign({ projectId: databaseProps.tenantId, traceId }, (spanIds !== undefined && spanIds.length > 0 && { spanIds })), (limit !== undefined && { limit })));
+        return Response.sendJsonObjectResponse(req, res, {
+            items: items,
+        });
+    }
+    catch (err) {
+        next(err);
+    }
+});
 // --- Log Analytics Endpoint ---
 router.post("/telemetry/logs/analytics", ...requireLogReadAccess, async (req, res, next) => {
     try {
@@ -1053,6 +1092,9 @@ router.post("/telemetry/logs/analytics", ...requireLogReadAccess, async (req, re
         const spanIds = body["spanIds"]
             ? body["spanIds"]
             : undefined;
+        const sessionIds = body["sessionIds"]
+            ? body["sessionIds"]
+            : undefined;
         const groupBy = body["groupBy"]
             ? body["groupBy"]
             : undefined;
@@ -1076,6 +1118,7 @@ router.post("/telemetry/logs/analytics", ...requireLogReadAccess, async (req, re
             bodySearchText,
             traceIds,
             spanIds,
+            sessionIds,
             limit,
         };
         if (chartType === "timeseries") {
@@ -1133,6 +1176,9 @@ router.post("/telemetry/logs/export", ...requireLogReadAccess, async (req, res,
         const spanIds = body["spanIds"]
             ? body["spanIds"]
             : undefined;
+        const sessionIds = body["sessionIds"]
+            ? body["sessionIds"]
+            : undefined;
         const rows = await LogAggregationService.getExportLogs({
             projectId: databaseProps.tenantId,
             startTime,
@@ -1143,6 +1189,7 @@ router.post("/telemetry/logs/export", ...requireLogReadAccess, async (req, res,
             bodySearchText,
             traceIds,
             spanIds,
+            sessionIds,
         });
         if (format === "csv") {
             const header = "time,primaryEntityId,severityText,severityNumber,body,traceId,spanId,attributes";
@@ -1197,12 +1244,16 @@ router.post("/telemetry/logs/context", ...requireLogReadAccess, async (req, res,
             return Response.sendErrorResponse(req, res, new BadDataException("logId, primaryEntityId, and time are required"));
         }
         const count = body["count"] || 5;
+        const sessionIds = body["sessionIds"]
+            ? body["sessionIds"]
+            : undefined;
         const result = await LogAggregationService.getLogContext({
             projectId: databaseProps.tenantId,
             primaryEntityId: new ObjectID(primaryEntityId),
             time: OneUptimeDate.fromString(time),
             logId,
             count,
+            sessionIds,
         });
         return Response.sendJsonObjectResponse(req, res, {
             before: result.before,
@@ -1312,11 +1363,23 @@ router.post("/telemetry/profiles/flamegraph", ...requireProfileReadAccess, async
                 return typeof t === "string" && t.length > 0;
             })
             : undefined;
-        if (!profileId && !startTime) {
-            return Response.sendErrorResponse(req, res, new BadDataException("Either profileId or startTime must be provided"));
+        const traceId = body["traceId"] && typeof body["traceId"] === "string"
+            ? body["traceId"]
+            : undefined;
+        const spanIds = Array.isArray(body["spanIds"])
+            ? body["spanIds"].filter((s) => {
+                return typeof s === "string" && s.length > 0;
+            })
+            : undefined;
+        /*
+         * A traceId bounds the read as tightly as a profileId (bloom-indexed
+         * point lookup), so it also satisfies the scoping requirement.
+         */
+        if (!profileId && !startTime && !traceId) {
+            return Response.sendErrorResponse(req, res, new BadDataException("Either profileId, startTime, or traceId must be provided"));
         }
-        const request = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ projectId: databaseProps.tenantId }, (profileId !== undefined && { profileId })), (startTime !== undefined && { startTime })), (endTime !== undefined && { endTime })), (serviceIds !== undefined && { serviceIds })), (profileType !== undefined && { profileType })), (profileTypes !== undefined &&
-            profileTypes.length > 0 && { profileTypes }));
+        const request = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ projectId: databaseProps.tenantId }, (profileId !== undefined && { profileId })), (startTime !== undefined && { startTime })), (endTime !== undefined && { endTime })), (serviceIds !== undefined && { serviceIds })), (profileType !== undefined && { profileType })), (profileTypes !== undefined &&
+            profileTypes.length > 0 && { profileTypes })), (traceId !== undefined && { traceId })), (spanIds !== undefined && spanIds.length > 0 && { spanIds }));
         const result = await ProfileAggregationService.getFlamegraph(request);
         return Response.sendJsonObjectResponse(req, res, {
             flamegraph: result.flamegraph,
@@ -1338,24 +1401,32 @@ router.post("/telemetry/profiles/function-list", ...requireProfileReadAccess, as
         const profileId = body["profileId"]
             ? body["profileId"]
             : undefined;
+        const traceId = body["traceId"] && typeof body["traceId"] === "string"
+            ? body["traceId"]
+            : undefined;
+        const spanIds = Array.isArray(body["spanIds"])
+            ? body["spanIds"].filter((s) => {
+                return typeof s === "string" && s.length > 0;
+            })
+            : undefined;
         /*
-         * Only default the window when no profileId is given: a profile's
-         * samples are bounded by the profile itself, and a defaulted
-         * last-hour window would silently exclude any profile captured
-         * before the window started.
+         * Only default the window when neither profileId nor traceId is
+         * given: a profile's samples are bounded by the profile itself (and
+         * a trace's by the trace), so a defaulted last-hour window would
+         * silently exclude anything captured before the window started.
          */
         const startTime = body["startTime"]
             ? OneUptimeDate.fromString(body["startTime"])
-            : profileId
+            : profileId || traceId
                 ? undefined
                 : OneUptimeDate.addRemoveHours(OneUptimeDate.getCurrentDate(), -1);
         const endTime = body["endTime"]
             ? OneUptimeDate.fromString(body["endTime"])
-            : profileId
+            : profileId || traceId
                 ? undefined
                 : OneUptimeDate.getCurrentDate();
-        if (!profileId && !startTime) {
-            return Response.sendErrorResponse(req, res, new BadDataException("Either profileId or startTime must be provided"));
+        if (!profileId && !startTime && !traceId) {
+            return Response.sendErrorResponse(req, res, new BadDataException("Either profileId, startTime, or traceId must be provided"));
         }
         const serviceIds = body["serviceIds"]
             ? body["serviceIds"].map((id) => {
@@ -1376,8 +1447,8 @@ router.post("/telemetry/profiles/function-list", ...requireProfileReadAccess, as
         const sortBy = body["sortBy"]
             ? body["sortBy"]
             : undefined;
-        const request = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ projectId: databaseProps.tenantId }, (startTime !== undefined && { startTime })), (endTime !== undefined && { endTime })), (profileId !== undefined && { profileId })), (serviceIds !== undefined && { serviceIds })), (profileType !== undefined && { profileType })), (profileTypes !== undefined &&
-            profileTypes.length > 0 && { profileTypes })), (limit !== undefined && { limit })), (sortBy !== undefined && { sortBy }));
+        const request = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ projectId: databaseProps.tenantId }, (startTime !== undefined && { startTime })), (endTime !== undefined && { endTime })), (profileId !== undefined && { profileId })), (serviceIds !== undefined && { serviceIds })), (profileType !== undefined && { profileType })), (profileTypes !== undefined &&
+            profileTypes.length > 0 && { profileTypes })), (traceId !== undefined && { traceId })), (spanIds !== undefined && spanIds.length > 0 && { spanIds })), (limit !== undefined && { limit })), (sortBy !== undefined && { sortBy }));
         const result = await ProfileAggregationService.getFunctionList(request);
         return Response.sendJsonObjectResponse(req, res, {
             functions: result.functions,
@@ -1615,12 +1686,24 @@ router.post("/telemetry/profiles/function-focus", ...requireProfileReadAccess, a
                 return typeof t === "string" && t.length > 0;
             })
             : undefined;
-        if (!profileId && !startTime) {
-            return Response.sendErrorResponse(req, res, new BadDataException("Either profileId or startTime must be provided"));
+        const traceId = body["traceId"] && typeof body["traceId"] === "string"
+            ? body["traceId"]
+            : undefined;
+        const spanIds = Array.isArray(body["spanIds"])
+            ? body["spanIds"].filter((s) => {
+                return typeof s === "string" && s.length > 0;
+            })
+            : undefined;
+        /*
+         * A traceId bounds the read as tightly as a profileId (bloom-indexed
+         * point lookup), so it also satisfies the scoping requirement.
+         */
+        if (!profileId && !startTime && !traceId) {
+            return Response.sendErrorResponse(req, res, new BadDataException("Either profileId, startTime, or traceId must be provided"));
         }
-        const request = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ projectId: databaseProps.tenantId, functionName,
+        const request = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ projectId: databaseProps.tenantId, functionName,
             fileName }, (profileId !== undefined && { profileId })), (startTime !== undefined && { startTime })), (endTime !== undefined && { endTime })), (serviceIds !== undefined && { serviceIds })), (profileType !== undefined && { profileType })), (profileTypes !== undefined &&
-            profileTypes.length > 0 && { profileTypes }));
+            profileTypes.length > 0 && { profileTypes })), (traceId !== undefined && { traceId })), (spanIds !== undefined && spanIds.length > 0 && { spanIds }));
         const result = await ProfileAggregationService.getFunctionFocus(request);
         return Response.sendJsonObjectResponse(req, res, {
             functionName: result.functionName,
@@ -1693,6 +1776,34 @@ router.post("/telemetry/profiles/breakdown", ...requireProfileReadAccess, async
         next(err);
     }
 });
+// --- Profile Trace Presence Endpoint ---
+router.post("/telemetry/profiles/trace-presence", ...requireProfileReadAccess, async (req, res, next) => {
+    try {
+        const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
+            return Response.sendErrorResponse(req, res, new BadDataException("Invalid Project ID"));
+        }
+        const body = req.body;
+        const traceId = body["traceId"] && typeof body["traceId"] === "string"
+            ? body["traceId"]
+            : undefined;
+        if (!traceId) {
+            return Response.sendErrorResponse(req, res, new BadDataException("traceId is required"));
+        }
+        const spanIds = Array.isArray(body["spanIds"])
+            ? body["spanIds"].filter((s) => {
+                return typeof s === "string" && s.length > 0;
+            })
+            : undefined;
+        const result = await ProfileAggregationService.getTracePresence(Object.assign({ projectId: databaseProps.tenantId, traceId }, (spanIds !== undefined && spanIds.length > 0 && { spanIds })));
+        return Response.sendJsonObjectResponse(req, res, {
+            sampleCount: result.sampleCount,
+        });
+    }
+    catch (err) {
+        next(err);
+    }
+});
 /*
  * ---------------------------------------------------------------------
  * Session replay playback