@oneuptime/common 13.0.1 → 13.0.3

package/Types/Rules/RuleCriteriaFieldRegistry.ts

@@ -0,0 +1,437 @@
+/**
+ * The complete API allowlist for configurable rule criteria.
+ *
+ * Keep this registry in lockstep with the dashboard forms and runtime
+ * evaluators. The source-contract suite checks both sides so a newly exposed
+ * action field can never become a match predicate by accident.
+ */
+export const RULE_CRITERIA_FIELDS_BY_MODEL: Readonly<
+  Record<string, ReadonlyArray<string>>
+> = {
+  AlertEpisodeLabelRule: [
+    "alertSeverities",
+    "episodeLabels",
+    "episodeTitlePattern",
+    "episodeDescriptionPattern",
+  ],
+  AlertEpisodeOnCallRule: [
+    "alertSeverities",
+    "episodeLabels",
+    "episodeTitlePattern",
+    "episodeDescriptionPattern",
+  ],
+  AlertEpisodeOwnerRule: [
+    "alertSeverities",
+    "episodeLabels",
+    "episodeTitlePattern",
+    "episodeDescriptionPattern",
+  ],
+  AlertEpisodePrivacyRule: [
+    "alertSeverities",
+    "episodeLabels",
+    "episodeTitlePattern",
+    "episodeDescriptionPattern",
+  ],
+  AlertGroupingRule: [
+    "monitors",
+    "alertSeverities",
+    "alertLabels",
+    "monitorLabels",
+    "alertTitlePattern",
+    "alertDescriptionPattern",
+    "monitorNamePattern",
+    "monitorDescriptionPattern",
+  ],
+  AlertLabelRule: [
+    "monitors",
+    "alertSeverities",
+    "alertLabels",
+    "monitorLabels",
+    "alertTitlePattern",
+    "alertDescriptionPattern",
+    "monitorNamePattern",
+    "monitorDescriptionPattern",
+  ],
+  AlertOnCallRule: [
+    "monitors",
+    "alertSeverities",
+    "alertLabels",
+    "monitorLabels",
+    "alertTitlePattern",
+    "alertDescriptionPattern",
+    "monitorNamePattern",
+    "monitorDescriptionPattern",
+  ],
+  AlertOwnerRule: [
+    "monitors",
+    "alertSeverities",
+    "alertLabels",
+    "monitorLabels",
+    "alertTitlePattern",
+    "alertDescriptionPattern",
+    "monitorNamePattern",
+    "monitorDescriptionPattern",
+  ],
+  AlertPrivacyRule: [
+    "monitors",
+    "alertSeverities",
+    "alertLabels",
+    "monitorLabels",
+    "alertTitlePattern",
+    "alertDescriptionPattern",
+    "monitorNamePattern",
+    "monitorDescriptionPattern",
+  ],
+  AlertReminderRule: ["alertSeverities", "labels"],
+  AutoRemediationRule: [
+    "monitors",
+    "incidentSeverities",
+    "alertSeverities",
+    "labels",
+    "monitorLabels",
+    "titlePattern",
+    "descriptionPattern",
+  ],
+  CephClusterLabelRule: [
+    "cephClusterLabels",
+    "cephClusterNamePattern",
+    "cephClusterDescriptionPattern",
+  ],
+  CephClusterOwnerRule: [
+    "cephClusterLabels",
+    "cephClusterNamePattern",
+    "cephClusterDescriptionPattern",
+  ],
+  CloudResourceLabelRule: [
+    "matchLabels",
+    "nameRegexPattern",
+    "descriptionRegexPattern",
+  ],
+  CloudResourceOwnerRule: [
+    "matchLabels",
+    "nameRegexPattern",
+    "descriptionRegexPattern",
+  ],
+  DashboardLabelRule: [
+    "dashboardLabels",
+    "dashboardNamePattern",
+    "dashboardDescriptionPattern",
+  ],
+  DashboardOwnerRule: [
+    "dashboardLabels",
+    "dashboardNamePattern",
+    "dashboardDescriptionPattern",
+  ],
+  DockerHostLabelRule: [
+    "dockerHostLabels",
+    "dockerHostNamePattern",
+    "dockerHostDescriptionPattern",
+  ],
+  DockerHostOwnerRule: [
+    "dockerHostLabels",
+    "dockerHostNamePattern",
+    "dockerHostDescriptionPattern",
+  ],
+  DockerSwarmClusterLabelRule: [
+    "dockerSwarmClusterLabels",
+    "dockerSwarmClusterNamePattern",
+    "dockerSwarmClusterDescriptionPattern",
+  ],
+  DockerSwarmClusterOwnerRule: [
+    "dockerSwarmClusterLabels",
+    "dockerSwarmClusterNamePattern",
+    "dockerSwarmClusterDescriptionPattern",
+  ],
+  HostLabelRule: ["hostLabels", "hostNamePattern", "hostDescriptionPattern"],
+  HostOwnerRule: ["hostLabels", "hostNamePattern", "hostDescriptionPattern"],
+  IncidentEpisodeLabelRule: [
+    "incidentSeverities",
+    "episodeLabels",
+    "episodeTitlePattern",
+    "episodeDescriptionPattern",
+  ],
+  IncidentEpisodeOnCallRule: [
+    "incidentSeverities",
+    "episodeLabels",
+    "episodeTitlePattern",
+    "episodeDescriptionPattern",
+  ],
+  IncidentEpisodeOwnerRule: [
+    "incidentSeverities",
+    "episodeLabels",
+    "episodeTitlePattern",
+    "episodeDescriptionPattern",
+  ],
+  IncidentEpisodePrivacyRule: [
+    "incidentSeverities",
+    "episodeLabels",
+    "episodeTitlePattern",
+    "episodeDescriptionPattern",
+  ],
+  IncidentGroupingRule: [
+    "monitors",
+    "incidentSeverities",
+    "incidentLabels",
+    "monitorLabels",
+    "incidentTitlePattern",
+    "incidentDescriptionPattern",
+    "monitorNamePattern",
+    "monitorDescriptionPattern",
+  ],
+  IncidentLabelRule: [
+    "monitors",
+    "incidentSeverities",
+    "incidentLabels",
+    "monitorLabels",
+    "incidentTitlePattern",
+    "incidentDescriptionPattern",
+    "monitorNamePattern",
+    "monitorDescriptionPattern",
+  ],
+  IncidentOnCallRule: [
+    "monitors",
+    "incidentSeverities",
+    "incidentLabels",
+    "monitorLabels",
+    "incidentTitlePattern",
+    "incidentDescriptionPattern",
+    "monitorNamePattern",
+    "monitorDescriptionPattern",
+  ],
+  IncidentOwnerRule: [
+    "monitors",
+    "incidentSeverities",
+    "incidentLabels",
+    "monitorLabels",
+    "incidentTitlePattern",
+    "incidentDescriptionPattern",
+    "monitorNamePattern",
+    "monitorDescriptionPattern",
+  ],
+  IncidentPrivacyRule: [
+    "monitors",
+    "incidentSeverities",
+    "incidentLabels",
+    "monitorLabels",
+    "incidentTitlePattern",
+    "incidentDescriptionPattern",
+    "monitorNamePattern",
+    "monitorDescriptionPattern",
+  ],
+  IncidentReminderRule: ["incidentSeverities", "labels"],
+  IncidentSlaRule: [
+    "monitors",
+    "incidentSeverities",
+    "incidentLabels",
+    "monitorLabels",
+    "incidentTitlePattern",
+    "incidentDescriptionPattern",
+  ],
+  IncomingCallPolicyLabelRule: [
+    "incomingCallPolicyLabels",
+    "incomingCallPolicyNamePattern",
+    "incomingCallPolicyDescriptionPattern",
+  ],
+  IncomingCallPolicyOwnerRule: [
+    "incomingCallPolicyLabels",
+    "incomingCallPolicyNamePattern",
+    "incomingCallPolicyDescriptionPattern",
+  ],
+  IoTFleetLabelRule: [
+    "iotFleetLabels",
+    "iotFleetNamePattern",
+    "iotFleetDescriptionPattern",
+  ],
+  IoTFleetOwnerRule: [
+    "iotFleetLabels",
+    "iotFleetNamePattern",
+    "iotFleetDescriptionPattern",
+  ],
+  KubernetesClusterLabelRule: [
+    "kubernetesClusterLabels",
+    "kubernetesClusterNamePattern",
+    "kubernetesClusterDescriptionPattern",
+  ],
+  KubernetesClusterOwnerRule: [
+    "kubernetesClusterLabels",
+    "kubernetesClusterNamePattern",
+    "kubernetesClusterDescriptionPattern",
+  ],
+  MonitorLabelRule: [
+    "monitorLabels",
+    "monitorNamePattern",
+    "monitorDescriptionPattern",
+  ],
+  MonitorOwnerRule: [
+    "monitorLabels",
+    "monitorNamePattern",
+    "monitorDescriptionPattern",
+  ],
+  NetworkDeviceAutoImportRule: [
+    "ipMatchTarget",
+    "sysNamePattern",
+    "sysDescrPattern",
+    "sysObjectIdPattern",
+  ],
+  NetworkDeviceLabelRule: [
+    "networkDeviceLabels",
+    "networkDeviceNamePattern",
+    "networkDeviceDescriptionPattern",
+  ],
+  NetworkDeviceOwnerRule: [
+    "networkDeviceLabels",
+    "networkDeviceNamePattern",
+    "networkDeviceDescriptionPattern",
+  ],
+  NetworkSiteAssignmentRule: ["subnetCidr", "hostnamePattern"],
+  OnCallDutyPolicyLabelRule: [
+    "onCallDutyPolicyLabels",
+    "onCallDutyPolicyNamePattern",
+    "onCallDutyPolicyDescriptionPattern",
+  ],
+  OnCallDutyPolicyOwnerRule: [
+    "onCallDutyPolicyLabels",
+    "onCallDutyPolicyNamePattern",
+    "onCallDutyPolicyDescriptionPattern",
+  ],
+  OnCallDutyPolicyScheduleLabelRule: [
+    "onCallDutyPolicyScheduleLabels",
+    "onCallDutyPolicyScheduleNamePattern",
+    "onCallDutyPolicyScheduleDescriptionPattern",
+  ],
+  OnCallDutyPolicyScheduleOwnerRule: [
+    "onCallDutyPolicyScheduleLabels",
+    "onCallDutyPolicyScheduleNamePattern",
+    "onCallDutyPolicyScheduleDescriptionPattern",
+  ],
+  PodmanHostLabelRule: [
+    "podmanHostLabels",
+    "podmanHostNamePattern",
+    "podmanHostDescriptionPattern",
+  ],
+  PodmanHostOwnerRule: [
+    "podmanHostLabels",
+    "podmanHostNamePattern",
+    "podmanHostDescriptionPattern",
+  ],
+  ProxmoxClusterLabelRule: [
+    "proxmoxClusterLabels",
+    "proxmoxClusterNamePattern",
+    "proxmoxClusterDescriptionPattern",
+  ],
+  ProxmoxClusterOwnerRule: [
+    "proxmoxClusterLabels",
+    "proxmoxClusterNamePattern",
+    "proxmoxClusterDescriptionPattern",
+  ],
+  RumApplicationLabelRule: [
+    "matchLabels",
+    "nameRegexPattern",
+    "descriptionRegexPattern",
+  ],
+  RumApplicationOwnerRule: [
+    "matchLabels",
+    "nameRegexPattern",
+    "descriptionRegexPattern",
+  ],
+  RunbookLabelRule: [
+    "runbookLabels",
+    "runbookNamePattern",
+    "runbookDescriptionPattern",
+  ],
+  RunbookOwnerRule: [
+    "runbookLabels",
+    "runbookNamePattern",
+    "runbookDescriptionPattern",
+  ],
+  RunbookRule: ["titlePattern", "descriptionPattern"],
+  ScheduledMaintenanceLabelRule: [
+    "monitors",
+    "scheduledMaintenanceLabels",
+    "monitorLabels",
+    "titlePattern",
+    "descriptionPattern",
+    "monitorNamePattern",
+    "monitorDescriptionPattern",
+  ],
+  ScheduledMaintenanceOwnerRule: [
+    "monitors",
+    "scheduledMaintenanceLabels",
+    "monitorLabels",
+    "titlePattern",
+    "descriptionPattern",
+    "monitorNamePattern",
+    "monitorDescriptionPattern",
+  ],
+  ScheduledMaintenanceReminderRule: ["labels"],
+  ServerlessFunctionLabelRule: [
+    "matchLabels",
+    "nameRegexPattern",
+    "descriptionRegexPattern",
+  ],
+  ServerlessFunctionOwnerRule: [
+    "matchLabels",
+    "nameRegexPattern",
+    "descriptionRegexPattern",
+  ],
+  ServiceLabelRule: [
+    "serviceLabels",
+    "serviceNamePattern",
+    "serviceDescriptionPattern",
+  ],
+  ServiceOwnerRule: [
+    "serviceLabels",
+    "serviceNamePattern",
+    "serviceDescriptionPattern",
+  ],
+  StatusPageLabelRule: [
+    "statusPageLabels",
+    "statusPageNamePattern",
+    "statusPageDescriptionPattern",
+  ],
+  StatusPageMonitorRule: [
+    "monitorLabels",
+    "monitorNamePattern",
+    "monitorDescriptionPattern",
+  ],
+  StatusPageOwnerRule: [
+    "statusPageLabels",
+    "statusPageNamePattern",
+    "statusPageDescriptionPattern",
+  ],
+  VMwareVCenterLabelRule: [
+    "vmwareVCenterLabels",
+    "vmwareVCenterNamePattern",
+    "vmwareVCenterDescriptionPattern",
+  ],
+  VMwareVCenterOwnerRule: [
+    "vmwareVCenterLabels",
+    "vmwareVCenterNamePattern",
+    "vmwareVCenterDescriptionPattern",
+  ],
+  WorkflowLabelRule: [
+    "workflowLabels",
+    "workflowNamePattern",
+    "workflowDescriptionPattern",
+  ],
+  WorkflowOwnerRule: [
+    "workflowLabels",
+    "workflowNamePattern",
+    "workflowDescriptionPattern",
+  ],
+} as const;
+
+export type RegisteredRuleCriteriaModelName =
+  keyof typeof RULE_CRITERIA_FIELDS_BY_MODEL;
+
+const RULE_CRITERIA_FIELD_LOOKUP: Readonly<
+  Record<string, ReadonlyArray<string>>
+> = RULE_CRITERIA_FIELDS_BY_MODEL;
+
+export function getRuleCriteriaFieldsForModel(
+  modelName: string,
+): ReadonlyArray<string> | undefined {
+  return RULE_CRITERIA_FIELD_LOOKUP[modelName];
+}
+
+export default RULE_CRITERIA_FIELDS_BY_MODEL;

package/Types/Rum/SessionReplay.ts

@@ -87,6 +87,36 @@ export const SESSION_REPLAY_FLUSH_INTERVAL_MS: number = 15 * 1000;
 export const SESSION_REPLAY_FLUSH_BYTES: number = 256 * 1024;
 export const SESSION_REPLAY_CHECKOUT_INTERVAL_MS: number = 60 * 1000;
 
+/*
+ * Recorder input-sampling cadence. These are the values handed to the
+ * recording library's `sampling` option, and they are shared with the
+ * player because the cadence is baked into every stored recording: the
+ * cursor transition the stage draws between two mouse samples has to be
+ * exactly one sample interval long, or the pointer either parks between
+ * samples (transition shorter than the gap) or lags them (longer).
+ *
+ * SESSION_REPLAY_MOUSEMOVE_SAMPLE_MS is the library default (50ms, 20Hz).
+ * Recorders before the "mousemove-50ms" capability sampled at
+ * SESSION_REPLAY_LEGACY_MOUSEMOVE_SAMPLE_MS (100ms, 10Hz); the player keeps
+ * using the legacy value for a recording that does not advertise the
+ * capability, so old footage never gets a transition shorter than its gap.
+ *
+ * Not part of the wire contract: neither SESSION_REPLAY_WIRE_VERSION nor
+ * SESSION_REPLAY_SCHEMA_VERSION changes with these.
+ */
+export const SESSION_REPLAY_MOUSEMOVE_SAMPLE_MS: number = 50;
+export const SESSION_REPLAY_LEGACY_MOUSEMOVE_SAMPLE_MS: number = 100;
+/* Scroll throttle (leading + trailing), the library default. */
+export const SESSION_REPLAY_SCROLL_SAMPLE_MS: number = 100;
+/*
+ * "all" listens to input events, so typing plays back keystroke by
+ * keystroke; "last" only listens to change events, so a typed value
+ * appeared as one snap on blur or Enter. Masked fields still collapse to a
+ * single event per typing run because the mask is constant-width and the
+ * recording library drops identical consecutive masked values.
+ */
+export const SESSION_REPLAY_INPUT_SAMPLING: "all" | "last" = "all";
+
 /*
  * Rolling pre-roll buffer held in memory before a trigger fires, and the
  * hard byte ceiling on it. The ceiling matters more than the duration:
@@ -141,6 +171,30 @@ export const SESSION_REPLAY_USER_REF_HEADER: string = "x-oneuptime-user-ref";
 export const SESSION_REPLAY_TARGET_TTL_SECONDS: number = 24 * 60 * 60;
 export const SESSION_REPLAY_MAX_USER_REF_LENGTH: number = 512;
 
+/*
+ * ---- Anonymous visitor id. ----
+ *
+ * A session id lives for one visit (it rotates after 30 minutes of idleness
+ * or four hours, whichever comes first), so two visits from the same
+ * browser share nothing a reader could group on. The recorder therefore
+ * also mints ONE random id per browser profile, keeps it in localStorage
+ * beside the session record, and repeats it on every meta-bearing chunk.
+ * It is what lets the session list say "this visitor came back three
+ * times" and the player offer "other sessions from this visitor" for an
+ * application whose pages never call identify().
+ *
+ * It is deliberately NOT an identity: it is random, minted client-side,
+ * carries no meaning outside the recordings it links, and is forgotten by
+ * the recorder the moment consent is withdrawn - the same rules as the
+ * session id. It is stored under the ordinary session ACL for the same
+ * reason identifiedUserKey is.
+ *
+ * Same shape as a session id (32 lowercase hex characters). The server
+ * refuses anything else rather than storing a caller-controlled string.
+ */
+export const SESSION_REPLAY_VISITOR_ID_PATTERN: RegExp = /^[0-9a-f]{32}$/;
+export const SESSION_REPLAY_MAX_VISITOR_ID_LENGTH: number = 32;
+
 /*
  * Retention values a session may be clamped to. Under expiry-based
  * partitioning each distinct value creates its own partition per ingest
@@ -261,6 +315,18 @@ export const SESSION_REPLAY_RECORDER_CAPABILITIES: ReadonlyArray<string> = [
   "traits",
   "tags",
   "visibility",
+  /*
+   * The recorder mints and repeats a per-browser anonymous visitor id, so
+   * this application's sessions can be grouped by visitor even when the
+   * page never calls identify().
+   */
+  "visitor-id",
+  /*
+   * Mouse movement sampled every SESSION_REPLAY_MOUSEMOVE_SAMPLE_MS (50ms)
+   * rather than the legacy 100ms. The player derives its cursor transition
+   * from this: see ReplayStage.
+   */
+  "mousemove-50ms",
 ];
 
 /* How the payload bytes were compressed by the recorder. */
@@ -383,6 +449,15 @@ export interface SessionReplayChunkMeta {
    */
   identifiedUserRef?: string;
 
+  /*
+   * The recorder's per-browser anonymous visitor id (see
+   * SESSION_REPLAY_VISITOR_ID_PATTERN). Sent on every meta-bearing chunk so
+   * a lost chunk 0 does not lose the link; absent from a recorder that
+   * predates it. Not gated by the identity switch: it is a random token,
+   * not a reference the host page supplied.
+   */
+  visitorId?: string;
+
   /*
    * Traits the host page attached to the identified user through
    * identify(ref, traits): plan, role, tenant - never the reference itself.

package/Types/Rum/SessionReplayApi.ts

@@ -108,6 +108,14 @@ export interface SessionReplayListFiltersDto {
   /* (not finalized OR has chunks) AND not recording-lost. */
   isPlayable?: boolean;
   hasTraces?: boolean;
+  /*
+   * Exact match on the recorder-minted anonymous visitor id (see
+   * SESSION_REPLAY_VISITOR_ID_PATTERN): "every session from this
+   * browser". Like identifiedUserKey it is a random token the list already
+   * returns to every caller, so it needs no identity gate. Refused with a
+   * 400 when it is not a visitor id shape.
+   */
+  visitorId?: string;
 }
 
 export interface SessionReplayListRequestDto {
@@ -177,6 +185,12 @@ export interface SessionReplayListItemDto {
   endTimeUnixMs?: number;
   /* Identity-gated like identifiedUserLabel. */
   identifiedUserTraits?: Record<string, string>;
+  /*
+   * The recorder's per-browser anonymous visitor id; "" for a session an
+   * older recorder produced. What the list groups anonymous sessions by
+   * and what the player's "other sessions from this visitor" reads.
+   */
+  visitorId?: string;
 }
 
 export interface SessionReplayListResponseDto {
@@ -195,6 +209,76 @@ export interface SessionReplayListResponseDto {
   ignoredFilters?: Array<string>;
 }
 
+/* ---- /users ---- */
+
+/*
+ * The session list rolled up by person: one row per identified user, one
+ * per anonymous visitor (a browser the recorder linked with a visitor id)
+ * and at most one "anonymous" bucket for sessions an older recorder left
+ * with neither key. It answers "who had trouble" where the flat list
+ * answers "what happened"; the two are different reads of the same
+ * headers, and a keyset page of sessions cannot be grouped client-side
+ * without lying at the page boundary, which is why this is its own route.
+ */
+export type SessionReplayUserKind = "identified" | "visitor" | "anonymous";
+
+/* Keyset cursor: the last row's sort key and its group key as the tiebreak. */
+export interface SessionReplayUsersCursorDto {
+  lastSeenUnixMs: number;
+  groupKey: string;
+}
+
+export interface SessionReplayUsersRequestDto {
+  rumApplicationId: string;
+  /* ISO-8601. Defaults server-side to the past 7 days, like /list. */
+  startTime?: string;
+  endTime?: string;
+  limit?: number;
+  cursor?: SessionReplayUsersCursorDto;
+}
+
+export interface SessionReplayUserRollupDto {
+  /*
+   * "u:<identifiedUserKey>" for an identified person, "v:<visitorId>" for
+   * a linked browser, "" for the anonymous bucket. Opaque to the client:
+   * it is the cursor tiebreak and the row key, nothing more.
+   */
+  groupKey: string;
+  kind: SessionReplayUserKind;
+  /* "" unless kind is "identified". */
+  identifiedUserKey: string;
+  /* The visitor id of the newest session in the group; "" when it had none. */
+  visitorId: string;
+  /* Present only when the caller holds the identity permission. */
+  identifiedUserLabel?: string;
+  identifiedUserTraits?: Record<string, string>;
+  sessionCount: number;
+  /* Sessions still being recorded (not finalized). */
+  liveSessionCount: number;
+  firstSeenUnixMs: number;
+  lastSeenUnixMs: number;
+  totalDurationMs: number;
+  /* Sums over the group's sessions. */
+  errorCount: number;
+  frustrationCount: number;
+  errorSessionCount: number;
+  pageCount: number;
+  /* The newest session, so "Watch latest" needs no second request. */
+  lastSessionId: string;
+  lastEntryUrl: string;
+  /* Device facts of the newest session. */
+  browserName: string;
+  browserVersion: string;
+  osName: string;
+  deviceType: string;
+  countryCode: string;
+}
+
+export interface SessionReplayUsersResponseDto {
+  users: Array<SessionReplayUserRollupDto>;
+  nextCursor: SessionReplayUsersCursorDto | null;
+}
+
 /* ---- /manifest ---- */
 
 export interface SessionReplayManifestRequestDto {
@@ -342,6 +426,15 @@ export interface SessionReplayManifestHeaderDto {
    * could not capture. Empty for recordings that predate the field.
    */
   recorderCapabilities?: Array<string>;
+  /*
+   * The pseudonymous identity key ("" when the page never identified the
+   * user) and the per-browser visitor id ("" from an older recorder). Both
+   * are what the player hands back to /list to find this person's other
+   * sessions; neither is identity-gated, because the list already returns
+   * both to every list-capable caller and neither names anyone.
+   */
+  identifiedUserKey?: string;
+  visitorId?: string;
 }
 
 export interface SessionReplayManifestTabDto {