@oneuptime/common 13.0.1 → 13.0.4

package/Server/API/TelemetryAPI.ts

@@ -118,6 +118,7 @@ import RumApplicationService from "../Services/RumApplicationService";
 import Project from "../../Models/DatabaseModels/Project";
 import ProjectService from "../Services/ProjectService";
 import SessionReplayIdentity from "../Utils/SessionReplay/SessionReplayIdentity";
+import SessionIdentity from "../../Utils/Rum/SessionIdentity";
 import SessionReplayTargeting from "../Utils/SessionReplay/SessionReplayTargeting";
 import SessionReplayUsage from "../Utils/SessionReplay/SessionReplayUsage";
 import RumSessionReplayView from "../../Models/DatabaseModels/RumSessionReplayView";
@@ -126,8 +127,10 @@ import RumSessionReplayViewService, {
 } from "../Services/RumSessionReplayViewService";
 import SessionReplayReadService, {
   DEFAULT_SESSION_REPLAY_LIST_LIMIT,
+  DEFAULT_SESSION_REPLAY_USERS_LIMIT,
   MAX_SESSION_REPLAY_FOR_EXCEPTION_LIMIT,
   MAX_SESSION_REPLAY_LIST_LIMIT,
+  MAX_SESSION_REPLAY_USERS_LIMIT,
   SESSION_REPLAY_EXCEPTION_WINDOW_PADDING_MS,
   SessionReplayApplicationActivitySummary,
   SessionReplayChunkReadResult,
@@ -139,6 +142,8 @@ import SessionReplayReadService, {
   SessionReplayManifest,
   SessionReplaySessionHeader,
   SessionReplaySessionIdentity,
+  SessionReplayUsersCursor,
+  SessionReplayUsersResult,
 } from "../Utils/SessionReplay/SessionReplayReadService";
 import SessionReplayHealthCounters, {
   SessionReplayDropCount,
@@ -163,6 +168,8 @@ import {
   parseSessionReplayListCursor,
 } from "../../Types/Rum/SessionReplayApi";
 import { SessionReplayRefusalCount } from "../../Types/Rum/SessionReplayHealth";
+import zlib from "zlib";
+import { promisify } from "util";
 
 const router: ExpressRouter = Express.getRouter();
 
@@ -4857,6 +4864,32 @@ router.post(
         );
       }
 
+      /*
+       * "Every session from this browser". The visitor id is the
+       * recorder's own random per-browser token, and the list already
+       * hands it to every caller on every row, so - like the digest filter
+       * below - it needs no identity gate: filtering by it discloses
+       * nothing the caller does not have. But a value that is not one
+       * (the shape is strict; there is no legitimate "almost" visitor id)
+       * can match nothing, and a silently unfiltered list is the wrong
+       * answer to that question too.
+       */
+      const rawVisitorId: unknown = rawFilters["visitorId"];
+
+      if (
+        rawVisitorId !== undefined &&
+        rawVisitorId !== null &&
+        !SessionIdentity.isVisitorId(rawVisitorId)
+      ) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException(
+            "visitorId must be a 32-character lowercase hex visitor id.",
+          ),
+        );
+      }
+
       /*
        * A filter the server understood but did not apply, named in the
        * response.
@@ -4947,6 +4980,10 @@ router.post(
               "identifiedUserKey",
             ),
           }),
+        /* Validated above; not identity-gated, for the reason given there. */
+        ...(SessionIdentity.isVisitorId(rawVisitorId) && {
+          visitorId: rawVisitorId,
+        }),
         ...(readBoundedStringFromBody(rawFilters, "route") && {
           route: readBoundedStringFromBody(rawFilters, "route"),
         }),
@@ -5096,6 +5133,182 @@ router.post(
   },
 );
 
+// --- Session Replay Users Endpoint ---
+
+/*
+ * The cursor /users emits and accepts: the last row's "last seen" clock
+ * and its group key as the tiebreak. A cursor that is present but not
+ * this shape is a bad request rather than a driver error - a non-finite
+ * or negative clock cannot be bound, and an unbounded key would reach
+ * ClickHouse as a parameter on a per-group predicate. The EMPTY key is
+ * valid: it is the anonymous bucket's own key, and that bucket can be the
+ * last row of a page like any other.
+ */
+const MAX_SESSION_REPLAY_USERS_GROUP_KEY_LENGTH: number = 128;
+
+type ParseSessionReplayUsersCursorFunction = (
+  value: unknown,
+) => SessionReplayUsersCursor | null;
+
+const parseSessionReplayUsersCursor: ParseSessionReplayUsersCursorFunction = (
+  value: unknown,
+): SessionReplayUsersCursor | null => {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+
+  const row: JSONObject = value as JSONObject;
+  const lastSeenUnixMs: unknown = row["lastSeenUnixMs"];
+  const groupKey: unknown = row["groupKey"];
+
+  if (
+    typeof lastSeenUnixMs !== "number" ||
+    !Number.isFinite(lastSeenUnixMs) ||
+    lastSeenUnixMs < 0
+  ) {
+    return null;
+  }
+
+  if (
+    typeof groupKey !== "string" ||
+    groupKey.length > MAX_SESSION_REPLAY_USERS_GROUP_KEY_LENGTH
+  ) {
+    return null;
+  }
+
+  return { lastSeenUnixMs: lastSeenUnixMs, groupKey: groupKey };
+};
+
+/*
+ * The session list rolled up by person - "who had trouble" where /list
+ * answers "what happened". One row per identified user, one per linked
+ * browser, and at most one anonymous bucket; see
+ * SessionReplayReadService.listUsers for why it is its own read rather
+ * than a client-side fold of a list page.
+ *
+ * Same guard, same prologue and same identity decision as /list: it
+ * projects nothing the list does not, only grouped. The identity pair is
+ * named at neither level of the statement unless canReadIdentifiedUserLabel
+ * passes for the application the caller was just authorized against.
+ */
+router.post(
+  "/telemetry/rum/session-replay/users",
+  ...requireSessionReplayListAccess,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const databaseProps: DatabaseCommonInteractionProps =
+        await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+      if (!databaseProps?.tenantId) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid Project ID"),
+        );
+      }
+
+      assertSessionReplayPlan(databaseProps);
+
+      const projectId: ObjectID = databaseProps.tenantId;
+      const body: JSONObject = req.body as JSONObject;
+
+      const rumApplicationId: ObjectID = readObjectIdFromBody(
+        body,
+        "rumApplicationId",
+      );
+
+      /*
+       * Caller-supplied, and safe for the reason it is on /list: it is
+       * the thing being authorized, and the query is tenant-pinned
+       * regardless.
+       */
+      const application: RumApplication =
+        await assertSessionReplayApplicationAccess({
+          projectId: projectId,
+          rumApplicationId: rumApplicationId,
+          databaseProps: databaseProps,
+          permissions: SESSION_REPLAY_LIST_PERMISSIONS,
+        });
+
+      const startTime: Date =
+        readOptionalDateFromBody(body, "startTime") ||
+        OneUptimeDate.addRemoveDays(OneUptimeDate.getCurrentDate(), -7);
+
+      const endTime: Date =
+        readOptionalDateFromBody(body, "endTime") ||
+        OneUptimeDate.getCurrentDate();
+
+      /* An inverted window matches nothing; say so rather than answer []. */
+      if (startTime.getTime() > endTime.getTime()) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("startTime must not be after endTime"),
+        );
+      }
+
+      const limit: number = readLimitFromBody(
+        body,
+        DEFAULT_SESSION_REPLAY_USERS_LIMIT,
+        MAX_SESSION_REPLAY_USERS_LIMIT,
+      );
+
+      /*
+       * Decided against the application the access check loaded, exactly
+       * as on /list, and enforced by not naming the columns.
+       */
+      const includeIdentifiedUserLabel: boolean = canReadIdentifiedUserLabel({
+        databaseProps: databaseProps,
+        application: application,
+      });
+
+      const cursor: SessionReplayUsersCursor | null | undefined =
+        body["cursor"] !== undefined && body["cursor"] !== null
+          ? parseSessionReplayUsersCursor(body["cursor"])
+          : undefined;
+
+      if (cursor === null) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException(
+            "cursor must be the nextCursor of a previous page.",
+          ),
+        );
+      }
+
+      const result: SessionReplayUsersResult =
+        await SessionReplayReadService.listUsers({
+          projectId: projectId,
+          rumApplicationId: rumApplicationId,
+          startTime: startTime,
+          endTime: endTime,
+          limit: limit,
+          ...(cursor !== undefined && { cursor }),
+          includeIdentifiedUserLabel: includeIdentifiedUserLabel,
+        });
+
+      const nextCursor: JSONObject | null = result.nextCursor
+        ? {
+            lastSeenUnixMs: result.nextCursor.lastSeenUnixMs,
+            groupKey: result.nextCursor.groupKey,
+          }
+        : null;
+
+      return Response.sendJsonObjectResponse(req, res, {
+        users: result.users as unknown as JSONObject,
+        nextCursor: nextCursor,
+      });
+    } catch (err: unknown) {
+      next(err);
+    }
+  },
+);
+
 // --- Session Replay Manifest Endpoint ---
 
 router.post(
@@ -5292,6 +5505,84 @@ router.post(
 
 // --- Session Replay Chunk Endpoint ---
 
+/*
+ * Chunk pages are gzipped here, in the route, rather than by nginx or a
+ * middleware. The `payload` column holds DECOMPRESSED rrweb JSON (the
+ * recorder's gzip is undone at ingest so the read cap can be judged on
+ * real bytes), so a page is 1-8 MB of highly repetitive text on the wire
+ * unless something compresses it again. Nginx cannot: the body is
+ * application/octet-stream, which is deliberately outside its gzip_types
+ * (Nginx/default.conf.template), and adding it there would also
+ * re-compress pprof downloads that are already gzip. Nothing else in the
+ * API adds response compression.
+ *
+ * Async zlib runs on the libuv threadpool, so the API event loop is never
+ * blocked by a page. Measured on a development machine: level 4 shrinks a
+ * realistic 8.4 MB page 8.7x in ~130 ms of threadpool time, which is why
+ * level 4 rather than the default 6 - the extra levels cost CPU for a few
+ * percent of size on JSON that already compresses this well.
+ */
+const gzipAsync: (input: Buffer, options: zlib.ZlibOptions) => Promise<Buffer> =
+  promisify(zlib.gzip);
+
+/* Mirrors nginx's gzip_min_length: a page this small gains nothing. */
+const SESSION_REPLAY_GZIP_MIN_BYTES: number = 1024;
+const SESSION_REPLAY_GZIP_LEVEL: number = 4;
+
+type AcceptsGzipEncodingFunction = (req: ExpressRequest) => boolean;
+
+/*
+ * Reads Accept-Encoding by hand instead of via req.acceptsEncodings so
+ * the route depends only on the headers object (which is all a plain
+ * request object is guaranteed to carry). Tolerates a repeated header
+ * (array), q-values, and the x-gzip alias; "gzip;q=0" is an explicit
+ * refusal and wins over any other gzip token.
+ */
+const acceptsGzipEncoding: AcceptsGzipEncodingFunction = (
+  req: ExpressRequest,
+): boolean => {
+  const raw: unknown = req.headers?.["accept-encoding"];
+
+  let headerValue: string;
+
+  if (Array.isArray(raw)) {
+    headerValue = raw.join(",");
+  } else if (typeof raw === "string") {
+    headerValue = raw;
+  } else {
+    return false;
+  }
+
+  let gzipAccepted: boolean = false;
+
+  for (const token of headerValue.toLowerCase().split(",")) {
+    const parts: Array<string> = token.split(";");
+    const coding: string = (parts[0] ?? "").trim();
+
+    if (coding !== "gzip" && coding !== "x-gzip") {
+      continue;
+    }
+
+    let quality: number = 1;
+
+    for (const parameter of parts.slice(1)) {
+      const [name, value] = parameter.split("=");
+
+      if ((name ?? "").trim() === "q") {
+        quality = Number.parseFloat((value ?? "").trim());
+      }
+    }
+
+    if (Number.isNaN(quality) || quality <= 0) {
+      return false;
+    }
+
+    gzipAccepted = true;
+  }
+
+  return gzipAccepted;
+};
+
 router.post(
   "/telemetry/rum/session-replay/chunks",
   ...requireSessionReplayPayloadAccess,
@@ -5450,8 +5741,38 @@ router.post(
 
       const responseBody: Buffer = Buffer.concat(frames);
 
+      /*
+       * The read cap and the omitted list above are judged on the
+       * uncompressed frames: they bound what the player must hold in
+       * memory, not what crosses the wire. Only the bytes sent change.
+       */
+      let bodyToSend: Buffer = responseBody;
+      let contentEncoding: string | undefined = undefined;
+
+      if (
+        responseBody.length >= SESSION_REPLAY_GZIP_MIN_BYTES &&
+        acceptsGzipEncoding(req)
+      ) {
+        bodyToSend = await gzipAsync(responseBody, {
+          level: SESSION_REPLAY_GZIP_LEVEL,
+        });
+        contentEncoding = "gzip";
+      }
+
       res.setHeader("Content-Type", "application/octet-stream");
-      res.setHeader("Content-Length", responseBody.length.toString());
+
+      /*
+       * Set on both branches: the representation depends on the request
+       * header even when the answer is identity, and it is identical to
+       * what nginx's gzip_vary would emit for a body it compressed itself.
+       */
+      res.setHeader("Vary", "Accept-Encoding");
+
+      if (contentEncoding) {
+        res.setHeader("Content-Encoding", contentEncoding);
+      }
+
+      res.setHeader("Content-Length", bodyToSend.length.toString());
 
       /*
        * Which requested chunks exist but were left out for size, so a
@@ -5473,7 +5794,7 @@ router.post(
        * shared cache, and the browser should not keep it on disk either.
        */
       res.setHeader("Cache-Control", "no-store");
-      res.send(responseBody);
+      res.send(bodyToSend);
     } catch (err: unknown) {
       next(err);
     }

package/Server/Infrastructure/Postgres/SchemaMigrations/1792400000000-AddSloBurnRateRuleIncidents.ts

@@ -0,0 +1,111 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Lets an SLO burn rate rule declare an Incident, not only raise an Alert.
+ *
+ *   - shouldCreateAlert / shouldCreateIncident: what the rule declares when it
+ *     fires. `shouldCreateAlert` defaults to TRUE so every rule that already
+ *     exists keeps behaving exactly as it did, and `shouldCreateIncident`
+ *     defaults to FALSE so nobody starts declaring incidents by upgrading.
+ *
+ *   - incidentSeverityId: the severity of that incident, nullable — the worker
+ *     falls back to the project's most severe when it is not set, exactly as
+ *     the alert path already does with alertSeverityId.
+ *
+ *   - lastIncidentCreatedAt / lastIncidentResolvedAt: the incident's own
+ *     worker-owned lifecycle, deliberately separate from the alert pair. The
+ *     two outputs open, fail and resolve independently, and each one's re-fire
+ *     suppression is measured from its own resolve.
+ *
+ *   - ServiceLevelObjectiveBurnRateRuleIncidentOnCallDutyPolicy: the incident's
+ *     own escalation list, kept apart from the alert's the same way a monitor
+ *     criteria keeps CriteriaAlert.onCallPolicyIds apart from
+ *     CriteriaIncident.onCallPolicyIds.
+ *
+ * Pure addition; no backfill. Dropping the join table in down() destroys the
+ * incident escalation configuration — the standard cost of reversing a
+ * many-to-many, and the reason down() is a last resort here.
+ */
+export class AddSloBurnRateRuleIncidents1792400000000
+  implements MigrationInterface
+{
+  public name = "AddSloBurnRateRuleIncidents1792400000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "ServiceLevelObjectiveBurnRateRuleIncidentOnCallDutyPolicy" ("serviceLevelObjectiveBurnRateRuleId" uuid NOT NULL, "onCallDutyPolicyId" uuid NOT NULL, CONSTRAINT "PK_36d90c310063d3973c1a6b817d0" PRIMARY KEY ("serviceLevelObjectiveBurnRateRuleId", "onCallDutyPolicyId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_081ac216caed6ca9890944f847" ON "ServiceLevelObjectiveBurnRateRuleIncidentOnCallDutyPolicy" ("serviceLevelObjectiveBurnRateRuleId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_5366231ef8db4c5bd4507089a3" ON "ServiceLevelObjectiveBurnRateRuleIncidentOnCallDutyPolicy" ("onCallDutyPolicyId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveBurnRateRule" ADD "shouldCreateAlert" boolean NOT NULL DEFAULT true`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveBurnRateRule" ADD "shouldCreateIncident" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveBurnRateRule" ADD "incidentSeverityId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveBurnRateRule" ADD "lastIncidentCreatedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveBurnRateRule" ADD "lastIncidentResolvedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_c5d58d9e81f420a634abeb5ccc" ON "ServiceLevelObjectiveBurnRateRule" ("incidentSeverityId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveBurnRateRule" ADD CONSTRAINT "FK_c5d58d9e81f420a634abeb5ccc2" FOREIGN KEY ("incidentSeverityId") REFERENCES "IncidentSeverity"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveBurnRateRuleIncidentOnCallDutyPolicy" ADD CONSTRAINT "FK_081ac216caed6ca9890944f847a" FOREIGN KEY ("serviceLevelObjectiveBurnRateRuleId") REFERENCES "ServiceLevelObjectiveBurnRateRule"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveBurnRateRuleIncidentOnCallDutyPolicy" ADD CONSTRAINT "FK_5366231ef8db4c5bd4507089a37" FOREIGN KEY ("onCallDutyPolicyId") REFERENCES "OnCallDutyPolicy"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveBurnRateRuleIncidentOnCallDutyPolicy" DROP CONSTRAINT "FK_5366231ef8db4c5bd4507089a37"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveBurnRateRuleIncidentOnCallDutyPolicy" DROP CONSTRAINT "FK_081ac216caed6ca9890944f847a"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveBurnRateRule" DROP CONSTRAINT "FK_c5d58d9e81f420a634abeb5ccc2"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_c5d58d9e81f420a634abeb5ccc"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveBurnRateRule" DROP COLUMN "lastIncidentResolvedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveBurnRateRule" DROP COLUMN "lastIncidentCreatedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveBurnRateRule" DROP COLUMN "incidentSeverityId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveBurnRateRule" DROP COLUMN "shouldCreateIncident"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveBurnRateRule" DROP COLUMN "shouldCreateAlert"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_5366231ef8db4c5bd4507089a3"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_081ac216caed6ca9890944f847"`,
+    );
+    await queryRunner.query(
+      `DROP TABLE "ServiceLevelObjectiveBurnRateRuleIncidentOnCallDutyPolicy"`,
+    );
+  }
+}