@oneuptime/common 13.0.1 → 13.0.3

package/build/dist/Server/API/TelemetryAPI.js

@@ -31,15 +31,18 @@ import ResourceEntityFilter from "../Utils/Telemetry/ResourceEntityFilter";
 import RumApplicationService from "../Services/RumApplicationService";
 import ProjectService from "../Services/ProjectService";
 import SessionReplayIdentity from "../Utils/SessionReplay/SessionReplayIdentity";
+import SessionIdentity from "../../Utils/Rum/SessionIdentity";
 import SessionReplayTargeting from "../Utils/SessionReplay/SessionReplayTargeting";
 import SessionReplayUsage from "../Utils/SessionReplay/SessionReplayUsage";
 import RumSessionReplayViewService, { normalizeSecondsWatched, } from "../Services/RumSessionReplayViewService";
-import SessionReplayReadService, { DEFAULT_SESSION_REPLAY_LIST_LIMIT, MAX_SESSION_REPLAY_FOR_EXCEPTION_LIMIT, MAX_SESSION_REPLAY_LIST_LIMIT, SESSION_REPLAY_EXCEPTION_WINDOW_PADDING_MS, } from "../Utils/SessionReplay/SessionReplayReadService";
+import SessionReplayReadService, { DEFAULT_SESSION_REPLAY_LIST_LIMIT, DEFAULT_SESSION_REPLAY_USERS_LIMIT, MAX_SESSION_REPLAY_FOR_EXCEPTION_LIMIT, MAX_SESSION_REPLAY_LIST_LIMIT, MAX_SESSION_REPLAY_USERS_LIMIT, SESSION_REPLAY_EXCEPTION_WINDOW_PADDING_MS, } from "../Utils/SessionReplay/SessionReplayReadService";
 import SessionReplayHealthCounters from "../Utils/SessionReplay/SessionReplayHealthCounters";
 import { isSessionErased } from "../Utils/SessionReplay/SessionReplayErasureTombstone";
 import NotFoundException from "../../Types/Exception/NotFoundException";
 import { DEFAULT_SESSION_REPLAY_MAX_BYTES_PER_PROJECT_PER_DAY, MAX_SESSION_REPLAY_CHUNKS_PER_READ, MAX_SESSION_REPLAY_READ_BYTES, SESSION_REPLAY_LIST_SEARCH_MAX_LENGTH, SESSION_REPLAY_LIST_SEARCH_MAX_WINDOW_DAYS, SESSION_REPLAY_MAX_SESSION_MS, SESSION_REPLAY_MAX_TAG_KEYS, SESSION_REPLAY_MAX_TAG_KEY_LENGTH, SESSION_REPLAY_MAX_TAG_VALUE_LENGTH, SESSION_REPLAY_MAX_USER_REF_LENGTH, } from "../../Types/Rum/SessionReplay";
 import { SESSION_REPLAY_SORT_BY_VALUES, parseSessionReplayListCursor, } from "../../Types/Rum/SessionReplayApi";
+import zlib from "zlib";
+import { promisify } from "util";
 const router = Express.getRouter();
 const createTelemetryReadAccessGuard = (signalReadPermission) => {
     return [
@@ -2774,6 +2777,22 @@ router.post("/telemetry/rum/session-replay/list", ...requireSessionReplayListAcc
             !SessionReplayIdentity.isUsableUserRef(rawFilters["identifiedUserRef"])) {
             return Response.sendErrorResponse(req, res, new BadDataException(`identifiedUserRef must be a non-empty string of at most ${SESSION_REPLAY_MAX_USER_REF_LENGTH} characters.`));
         }
+        /*
+         * "Every session from this browser". The visitor id is the
+         * recorder's own random per-browser token, and the list already
+         * hands it to every caller on every row, so - like the digest filter
+         * below - it needs no identity gate: filtering by it discloses
+         * nothing the caller does not have. But a value that is not one
+         * (the shape is strict; there is no legitimate "almost" visitor id)
+         * can match nothing, and a silently unfiltered list is the wrong
+         * answer to that question too.
+         */
+        const rawVisitorId = rawFilters["visitorId"];
+        if (rawVisitorId !== undefined &&
+            rawVisitorId !== null &&
+            !SessionIdentity.isVisitorId(rawVisitorId)) {
+            return Response.sendErrorResponse(req, res, new BadDataException("visitorId must be a 32-character lowercase hex visitor id."));
+        }
         /*
          * A filter the server understood but did not apply, named in the
          * response.
@@ -2796,7 +2815,7 @@ router.post("/telemetry/rum/session-replay/list", ...requireSessionReplayListAcc
             SessionReplayIdentity.isUsableUserRef(rawFilters["identifiedUserRef"])) {
             ignoredFilters.push("identifiedUserRef");
         }
-        const filters = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (typeof rawFilters["hasError"] === "boolean" && {
+        const filters = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (typeof rawFilters["hasError"] === "boolean" && {
             hasError: rawFilters["hasError"],
         })), (typeof rawFilters["hasFrustration"] === "boolean" && {
             hasFrustration: rawFilters["hasFrustration"],
@@ -2821,6 +2840,8 @@ router.post("/telemetry/rum/session-replay/list", ...requireSessionReplayListAcc
         })), (readBoundedStringFromBody(rawFilters, "identifiedUserKey") &&
             !SessionReplayIdentity.isUsableUserRef(rawFilters["identifiedUserRef"]) && {
             identifiedUserKey: readBoundedStringFromBody(rawFilters, "identifiedUserKey"),
+        })), (SessionIdentity.isVisitorId(rawVisitorId) && {
+            visitorId: rawVisitorId,
         })), (readBoundedStringFromBody(rawFilters, "route") && {
             route: readBoundedStringFromBody(rawFilters, "route"),
         })), (typeof rawFilters["minDurationMs"] === "number" &&
@@ -2910,6 +2931,107 @@ router.post("/telemetry/rum/session-replay/list", ...requireSessionReplayListAcc
         next(err);
     }
 });
+// --- Session Replay Users Endpoint ---
+/*
+ * The cursor /users emits and accepts: the last row's "last seen" clock
+ * and its group key as the tiebreak. A cursor that is present but not
+ * this shape is a bad request rather than a driver error - a non-finite
+ * or negative clock cannot be bound, and an unbounded key would reach
+ * ClickHouse as a parameter on a per-group predicate. The EMPTY key is
+ * valid: it is the anonymous bucket's own key, and that bucket can be the
+ * last row of a page like any other.
+ */
+const MAX_SESSION_REPLAY_USERS_GROUP_KEY_LENGTH = 128;
+const parseSessionReplayUsersCursor = (value) => {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    const row = value;
+    const lastSeenUnixMs = row["lastSeenUnixMs"];
+    const groupKey = row["groupKey"];
+    if (typeof lastSeenUnixMs !== "number" ||
+        !Number.isFinite(lastSeenUnixMs) ||
+        lastSeenUnixMs < 0) {
+        return null;
+    }
+    if (typeof groupKey !== "string" ||
+        groupKey.length > MAX_SESSION_REPLAY_USERS_GROUP_KEY_LENGTH) {
+        return null;
+    }
+    return { lastSeenUnixMs: lastSeenUnixMs, groupKey: groupKey };
+};
+/*
+ * The session list rolled up by person - "who had trouble" where /list
+ * answers "what happened". One row per identified user, one per linked
+ * browser, and at most one anonymous bucket; see
+ * SessionReplayReadService.listUsers for why it is its own read rather
+ * than a client-side fold of a list page.
+ *
+ * Same guard, same prologue and same identity decision as /list: it
+ * projects nothing the list does not, only grouped. The identity pair is
+ * named at neither level of the statement unless canReadIdentifiedUserLabel
+ * passes for the application the caller was just authorized against.
+ */
+router.post("/telemetry/rum/session-replay/users", ...requireSessionReplayListAccess, async (req, res, next) => {
+    try {
+        const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
+            return Response.sendErrorResponse(req, res, new BadDataException("Invalid Project ID"));
+        }
+        assertSessionReplayPlan(databaseProps);
+        const projectId = databaseProps.tenantId;
+        const body = req.body;
+        const rumApplicationId = readObjectIdFromBody(body, "rumApplicationId");
+        /*
+         * Caller-supplied, and safe for the reason it is on /list: it is
+         * the thing being authorized, and the query is tenant-pinned
+         * regardless.
+         */
+        const application = await assertSessionReplayApplicationAccess({
+            projectId: projectId,
+            rumApplicationId: rumApplicationId,
+            databaseProps: databaseProps,
+            permissions: SESSION_REPLAY_LIST_PERMISSIONS,
+        });
+        const startTime = readOptionalDateFromBody(body, "startTime") ||
+            OneUptimeDate.addRemoveDays(OneUptimeDate.getCurrentDate(), -7);
+        const endTime = readOptionalDateFromBody(body, "endTime") ||
+            OneUptimeDate.getCurrentDate();
+        /* An inverted window matches nothing; say so rather than answer []. */
+        if (startTime.getTime() > endTime.getTime()) {
+            return Response.sendErrorResponse(req, res, new BadDataException("startTime must not be after endTime"));
+        }
+        const limit = readLimitFromBody(body, DEFAULT_SESSION_REPLAY_USERS_LIMIT, MAX_SESSION_REPLAY_USERS_LIMIT);
+        /*
+         * Decided against the application the access check loaded, exactly
+         * as on /list, and enforced by not naming the columns.
+         */
+        const includeIdentifiedUserLabel = canReadIdentifiedUserLabel({
+            databaseProps: databaseProps,
+            application: application,
+        });
+        const cursor = body["cursor"] !== undefined && body["cursor"] !== null
+            ? parseSessionReplayUsersCursor(body["cursor"])
+            : undefined;
+        if (cursor === null) {
+            return Response.sendErrorResponse(req, res, new BadDataException("cursor must be the nextCursor of a previous page."));
+        }
+        const result = await SessionReplayReadService.listUsers(Object.assign(Object.assign({ projectId: projectId, rumApplicationId: rumApplicationId, startTime: startTime, endTime: endTime, limit: limit }, (cursor !== undefined && { cursor })), { includeIdentifiedUserLabel: includeIdentifiedUserLabel }));
+        const nextCursor = result.nextCursor
+            ? {
+                lastSeenUnixMs: result.nextCursor.lastSeenUnixMs,
+                groupKey: result.nextCursor.groupKey,
+            }
+            : null;
+        return Response.sendJsonObjectResponse(req, res, {
+            users: result.users,
+            nextCursor: nextCursor,
+        });
+    }
+    catch (err) {
+        next(err);
+    }
+});
 // --- Session Replay Manifest Endpoint ---
 router.post("/telemetry/rum/session-replay/manifest", ...requireSessionReplayPayloadAccess, async (req, res, next) => {
     try {
@@ -3053,6 +3175,68 @@ router.post("/telemetry/rum/session-replay/manifest", ...requireSessionReplayPay
     }
 });
 // --- Session Replay Chunk Endpoint ---
+/*
+ * Chunk pages are gzipped here, in the route, rather than by nginx or a
+ * middleware. The `payload` column holds DECOMPRESSED rrweb JSON (the
+ * recorder's gzip is undone at ingest so the read cap can be judged on
+ * real bytes), so a page is 1-8 MB of highly repetitive text on the wire
+ * unless something compresses it again. Nginx cannot: the body is
+ * application/octet-stream, which is deliberately outside its gzip_types
+ * (Nginx/default.conf.template), and adding it there would also
+ * re-compress pprof downloads that are already gzip. Nothing else in the
+ * API adds response compression.
+ *
+ * Async zlib runs on the libuv threadpool, so the API event loop is never
+ * blocked by a page. Measured on a development machine: level 4 shrinks a
+ * realistic 8.4 MB page 8.7x in ~130 ms of threadpool time, which is why
+ * level 4 rather than the default 6 - the extra levels cost CPU for a few
+ * percent of size on JSON that already compresses this well.
+ */
+const gzipAsync = promisify(zlib.gzip);
+/* Mirrors nginx's gzip_min_length: a page this small gains nothing. */
+const SESSION_REPLAY_GZIP_MIN_BYTES = 1024;
+const SESSION_REPLAY_GZIP_LEVEL = 4;
+/*
+ * Reads Accept-Encoding by hand instead of via req.acceptsEncodings so
+ * the route depends only on the headers object (which is all a plain
+ * request object is guaranteed to carry). Tolerates a repeated header
+ * (array), q-values, and the x-gzip alias; "gzip;q=0" is an explicit
+ * refusal and wins over any other gzip token.
+ */
+const acceptsGzipEncoding = (req) => {
+    var _a, _b;
+    const raw = (_a = req.headers) === null || _a === void 0 ? void 0 : _a["accept-encoding"];
+    let headerValue;
+    if (Array.isArray(raw)) {
+        headerValue = raw.join(",");
+    }
+    else if (typeof raw === "string") {
+        headerValue = raw;
+    }
+    else {
+        return false;
+    }
+    let gzipAccepted = false;
+    for (const token of headerValue.toLowerCase().split(",")) {
+        const parts = token.split(";");
+        const coding = ((_b = parts[0]) !== null && _b !== void 0 ? _b : "").trim();
+        if (coding !== "gzip" && coding !== "x-gzip") {
+            continue;
+        }
+        let quality = 1;
+        for (const parameter of parts.slice(1)) {
+            const [name, value] = parameter.split("=");
+            if ((name !== null && name !== void 0 ? name : "").trim() === "q") {
+                quality = Number.parseFloat((value !== null && value !== void 0 ? value : "").trim());
+            }
+        }
+        if (Number.isNaN(quality) || quality <= 0) {
+            return false;
+        }
+        gzipAccepted = true;
+    }
+    return gzipAccepted;
+};
 router.post("/telemetry/rum/session-replay/chunks", ...requireSessionReplayPayloadAccess, async (req, res, next) => {
     try {
         const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
@@ -3147,8 +3331,31 @@ router.post("/telemetry/rum/session-replay/chunks", ...requireSessionReplayPaylo
             frames.push(headerBuffer, payloadBuffer);
         }
         const responseBody = Buffer.concat(frames);
+        /*
+         * The read cap and the omitted list above are judged on the
+         * uncompressed frames: they bound what the player must hold in
+         * memory, not what crosses the wire. Only the bytes sent change.
+         */
+        let bodyToSend = responseBody;
+        let contentEncoding = undefined;
+        if (responseBody.length >= SESSION_REPLAY_GZIP_MIN_BYTES &&
+            acceptsGzipEncoding(req)) {
+            bodyToSend = await gzipAsync(responseBody, {
+                level: SESSION_REPLAY_GZIP_LEVEL,
+            });
+            contentEncoding = "gzip";
+        }
         res.setHeader("Content-Type", "application/octet-stream");
-        res.setHeader("Content-Length", responseBody.length.toString());
+        /*
+         * Set on both branches: the representation depends on the request
+         * header even when the answer is identity, and it is identical to
+         * what nginx's gzip_vary would emit for a body it compressed itself.
+         */
+        res.setHeader("Vary", "Accept-Encoding");
+        if (contentEncoding) {
+            res.setHeader("Content-Encoding", contentEncoding);
+        }
+        res.setHeader("Content-Length", bodyToSend.length.toString());
         /*
          * Which requested chunks exist but were left out for size, so a
          * client that cares can ask for them in a smaller page instead of
@@ -3166,7 +3373,7 @@ router.post("/telemetry/rum/session-replay/chunks", ...requireSessionReplayPaylo
          * shared cache, and the browser should not keep it on disk either.
          */
         res.setHeader("Cache-Control", "no-store");
-        res.send(responseBody);
+        res.send(bodyToSend);
     }
     catch (err) {
         next(err);