@oneuptime/common 13.0.4 → 13.0.5

package/Tests/Server/Utils/Telemetry/KubernetesResourceAttributes.test.ts

@@ -0,0 +1,162 @@
+import { describe, expect, test } from "@jest/globals";
+import {
+  deploymentNameFromPodName,
+  getKubernetesResourceAttributes,
+} from "../../../../Server/Utils/Telemetry/KubernetesResourceAttributes";
+import InventoryItem from "../../../../Server/Utils/Telemetry/TelemetryEntity";
+import EntityType from "../../../../Types/Telemetry/EntityType";
+import Dictionary from "../../../../Types/Dictionary";
+
+/*
+ * OneUptime's own pods used to report nothing but host.name — the pod
+ * hostname — and were therefore registered as hundreds of "hosts". These
+ * tests pin the Kubernetes identity the process now reports, and that the
+ * entity model turns it into a pod rather than a host.
+ */
+
+const noNamespaceFile: () => string | null = (): string | null => {
+  return null;
+};
+
+describe("getKubernetesResourceAttributes", () => {
+  test("reports nothing outside Kubernetes", () => {
+    expect(
+      getKubernetesResourceAttributes({
+        env: { HOSTNAME: "laptop" },
+        hostname: "laptop",
+        readServiceAccountNamespace: () => {
+          return "should-not-be-read";
+        },
+      }),
+    ).toEqual({});
+  });
+
+  test("uses the downward API variables the chart sets", () => {
+    expect(
+      getKubernetesResourceAttributes({
+        env: {
+          POD_NAME: "oneuptime-app-6d4f8b9c7d-x2k9p",
+          POD_NAMESPACE: "oneuptime",
+          NODE_NAME: "gke-pool-a-7x2k",
+          POD_UID: "5f3c1a2e-0000-4000-8000-000000000001",
+          K8S_DEPLOYMENT_NAME: "oneuptime-app",
+          K8S_CLUSTER_NAME: "production-eu",
+        },
+        hostname: "ignored-when-pod-name-is-set",
+        readServiceAccountNamespace: noNamespaceFile,
+      }),
+    ).toEqual({
+      "k8s.pod.name": "oneuptime-app-6d4f8b9c7d-x2k9p",
+      "k8s.namespace.name": "oneuptime",
+      "k8s.node.name": "gke-pool-a-7x2k",
+      "k8s.pod.uid": "5f3c1a2e-0000-4000-8000-000000000001",
+      "k8s.deployment.name": "oneuptime-app",
+      "k8s.cluster.name": "production-eu",
+    });
+  });
+
+  test("falls back to the hostname and service account namespace inside a pod", () => {
+    expect(
+      getKubernetesResourceAttributes({
+        env: { KUBERNETES_SERVICE_HOST: "10.96.0.1" },
+        hostname: "oneuptime-worker-7b9d6c5f48-q8zwm",
+        readServiceAccountNamespace: () => {
+          return "oneuptime\n";
+        },
+      }),
+    ).toEqual({
+      "k8s.pod.name": "oneuptime-worker-7b9d6c5f48-q8zwm",
+      "k8s.namespace.name": "oneuptime",
+      "k8s.deployment.name": "oneuptime-worker",
+    });
+  });
+
+  test("a broken namespace file costs only the namespace", () => {
+    expect(
+      getKubernetesResourceAttributes({
+        env: { KUBERNETES_SERVICE_HOST: "10.96.0.1" },
+        hostname: "web-0",
+        readServiceAccountNamespace: () => {
+          throw new Error("EACCES");
+        },
+      }),
+    ).toEqual({ "k8s.pod.name": "web-0" });
+  });
+
+  test("ignores blank variables", () => {
+    expect(
+      getKubernetesResourceAttributes({
+        env: {
+          POD_NAME: "api-0",
+          POD_NAMESPACE: "  ",
+          NODE_NAME: "",
+          K8S_CLUSTER_NAME: " ",
+        },
+        hostname: "",
+        readServiceAccountNamespace: noNamespaceFile,
+      }),
+    ).toEqual({ "k8s.pod.name": "api-0" });
+  });
+});
+
+describe("deploymentNameFromPodName", () => {
+  test.each([
+    ["oneuptime-app-6d4f8b9c7d-x2k9p", "oneuptime-app"],
+    ["oneuptime-probe-one-7c8d9f5b6-bq2zt", "oneuptime-probe-one"],
+    ["api-685856b7d7-48xkt", "api"],
+  ])("%s belongs to %s", (pod: string, deployment: string) => {
+    expect(deploymentNameFromPodName(pod)).toBe(deployment);
+  });
+
+  test.each([
+    ["web-0"], // StatefulSet
+    ["node-exporter-x2k9p"], // DaemonSet
+    ["build-server-01"], // a real host
+    ["api-6d4f8b9c7d-aeiou"], // vowels never appear in generated suffixes
+  ])("%s is not a Deployment pod", (pod: string) => {
+    expect(deploymentNameFromPodName(pod)).toBeNull();
+  });
+});
+
+describe("the entity model classifies the reported identity as a pod", () => {
+  const projectId: string = "8a4c5b1e-2b3f-4c1d-9e8f-1a2b3c4d5e6f";
+
+  test("a OneUptime pod is a pod in a deployment, not a host", () => {
+    const attributes: Dictionary<string> = {
+      "service.name": "api",
+      "host.name": "oneuptime-app-6d4f8b9c7d-x2k9p",
+      ...getKubernetesResourceAttributes({
+        env: {
+          POD_NAME: "oneuptime-app-6d4f8b9c7d-x2k9p",
+          POD_NAMESPACE: "oneuptime",
+          NODE_NAME: "gke-pool-a-7x2k",
+          K8S_DEPLOYMENT_NAME: "oneuptime-app",
+        },
+        hostname: "oneuptime-app-6d4f8b9c7d-x2k9p",
+        readServiceAccountNamespace: noNamespaceFile,
+      }),
+    };
+    const types: Array<EntityType> = InventoryItem.extractEntities({
+      projectId,
+      attributes,
+    }).map((entity: { entityType: EntityType }) => {
+      return entity.entityType;
+    });
+    expect(types).toEqual(
+      expect.arrayContaining([
+        EntityType.Service,
+        EntityType.KubernetesPod,
+        EntityType.KubernetesNamespace,
+        EntityType.KubernetesNode,
+        EntityType.KubernetesDeployment,
+      ]),
+    );
+    expect(types).not.toContain(EntityType.Host);
+
+    // And the legacy host row that pod once minted is retired.
+    expect(
+      InventoryItem.extractEntitiesWithRetirements({ projectId, attributes })
+        .retiredEntities?.[0]?.entityType,
+    ).toBe(EntityType.Host);
+  });
+});

package/Tests/Server/Utils/Telemetry/ResourceEntityFilter.test.ts

@@ -6,20 +6,33 @@ import {
 } from "../../../../Server/Utils/AnalyticsDatabase/Statement";
 import TableColumnType from "../../../../Types/AnalyticsDatabase/TableColumnType";
 import {
+  keyForCephCluster,
+  keyForDockerSwarmCluster,
   keyForHost,
   keyForKubernetesCluster,
+  keyForProxmoxCluster,
+  keyForVMwareVCenter,
 } from "../../../../Utils/Telemetry/EntityKey";
+import { RESOURCE_FACET_CATALOG_KEYS } from "../../../../Types/Telemetry/ResourceFacetCatalog";
 
 /*
- * The four resource tables are mocked at module level: the unit under test
- * is the id -> identifier -> entity-key translation, not Postgres. Each
- * mock records the query it was handed so the tests can assert the lookup
- * is project-scoped (a cluster id from another tenant must not resolve).
+ * The resource tables are mocked at module level: the unit under test is
+ * the id -> identifier -> entity-key translation, not Postgres. Each mock
+ * records the query it was handed so the tests can assert the lookup is
+ * project-scoped (a cluster id from another tenant must not resolve).
  */
 const hostFindBy: jest.Mock = jest.fn();
 const dockerHostFindBy: jest.Mock = jest.fn();
 const podmanHostFindBy: jest.Mock = jest.fn();
 const kubernetesClusterFindBy: jest.Mock = jest.fn();
+const dockerSwarmClusterFindBy: jest.Mock = jest.fn();
+const proxmoxClusterFindBy: jest.Mock = jest.fn();
+const vmwareVCenterFindBy: jest.Mock = jest.fn();
+const cephClusterFindBy: jest.Mock = jest.fn();
+const serverlessFunctionFindBy: jest.Mock = jest.fn();
+const iotFleetFindBy: jest.Mock = jest.fn();
+const cloudResourceFindBy: jest.Mock = jest.fn();
+const rumApplicationFindBy: jest.Mock = jest.fn();
 
 jest.mock("../../../../Server/Services/HostService", () => {
   return { __esModule: true, default: { findBy: hostFindBy } };
@@ -33,6 +46,30 @@ jest.mock("../../../../Server/Services/PodmanHostService", () => {
 jest.mock("../../../../Server/Services/KubernetesClusterService", () => {
   return { __esModule: true, default: { findBy: kubernetesClusterFindBy } };
 });
+jest.mock("../../../../Server/Services/DockerSwarmClusterService", () => {
+  return { __esModule: true, default: { findBy: dockerSwarmClusterFindBy } };
+});
+jest.mock("../../../../Server/Services/ProxmoxClusterService", () => {
+  return { __esModule: true, default: { findBy: proxmoxClusterFindBy } };
+});
+jest.mock("../../../../Server/Services/VMwareVCenterService", () => {
+  return { __esModule: true, default: { findBy: vmwareVCenterFindBy } };
+});
+jest.mock("../../../../Server/Services/CephClusterService", () => {
+  return { __esModule: true, default: { findBy: cephClusterFindBy } };
+});
+jest.mock("../../../../Server/Services/ServerlessFunctionService", () => {
+  return { __esModule: true, default: { findBy: serverlessFunctionFindBy } };
+});
+jest.mock("../../../../Server/Services/IoTFleetService", () => {
+  return { __esModule: true, default: { findBy: iotFleetFindBy } };
+});
+jest.mock("../../../../Server/Services/CloudResourceService", () => {
+  return { __esModule: true, default: { findBy: cloudResourceFindBy } };
+});
+jest.mock("../../../../Server/Services/RumApplicationService", () => {
+  return { __esModule: true, default: { findBy: rumApplicationFindBy } };
+});
 
 import ResourceEntityFilter, {
   ResourceEntityScope,
@@ -45,18 +82,68 @@ const PROJECT_ID: ObjectID = new ObjectID(
 const CLUSTER_ID: string = "8c0f2f1e-2e4f-4a8c-9a1a-2f5b6c7d8e9f";
 const OTHER_CLUSTER_ID: string = "1a2b3c4d-5e6f-4071-8293-a4b5c6d7e8f9";
 const HOST_ID: string = "5f4e3d2c-1b0a-4998-8776-655443322110";
+const RESOURCE_ID: string = "7a6b5c4d-3e2f-4a1b-8c9d-0e1f2a3b4c5d";
+const OTHER_RESOURCE_ID: string = "2b3c4d5e-6f70-4812-9a3b-4c5d6e7f8091";
+
+const ALL_FIND_BY_MOCKS: Array<jest.Mock> = [
+  hostFindBy,
+  dockerHostFindBy,
+  podmanHostFindBy,
+  kubernetesClusterFindBy,
+  dockerSwarmClusterFindBy,
+  proxmoxClusterFindBy,
+  vmwareVCenterFindBy,
+  cephClusterFindBy,
+  serverlessFunctionFindBy,
+  iotFleetFindBy,
+  cloudResourceFindBy,
+  rumApplicationFindBy,
+];
+
+/*
+ * The cluster-shaped types whose identity is the Postgres row's `name`:
+ * ingest writes the row with findOrCreateByName and hashes
+ * `<type>.name` into entityKeys, so the scope carries both the key and
+ * the attribute fallback.
+ */
+const NAME_KEYED_CLUSTERS: Array<{
+  facetKey: string;
+  findBy: jest.Mock;
+  attributeKey: string;
+  keyFor: (projectId: string, name: string) => string;
+}> = [
+  {
+    facetKey: "dockerSwarmClusterId",
+    findBy: dockerSwarmClusterFindBy,
+    attributeKey: "resource.docker.swarm.cluster.name",
+    keyFor: keyForDockerSwarmCluster,
+  },
+  {
+    facetKey: "proxmoxClusterId",
+    findBy: proxmoxClusterFindBy,
+    attributeKey: "resource.proxmox.cluster.name",
+    keyFor: keyForProxmoxCluster,
+  },
+  {
+    facetKey: "vmwareVCenterId",
+    findBy: vmwareVCenterFindBy,
+    attributeKey: "resource.vmware.vcenter.name",
+    keyFor: keyForVMwareVCenter,
+  },
+  {
+    facetKey: "cephClusterId",
+    findBy: cephClusterFindBy,
+    attributeKey: "resource.ceph.cluster.name",
+    keyFor: keyForCephCluster,
+  },
+];
 
 describe("ResourceEntityFilter", () => {
   beforeEach(() => {
-    hostFindBy.mockReset();
-    dockerHostFindBy.mockReset();
-    podmanHostFindBy.mockReset();
-    kubernetesClusterFindBy.mockReset();
-
-    hostFindBy.mockResolvedValue([]);
-    dockerHostFindBy.mockResolvedValue([]);
-    podmanHostFindBy.mockResolvedValue([]);
-    kubernetesClusterFindBy.mockResolvedValue([]);
+    for (const findBy of ALL_FIND_BY_MOCKS) {
+      findBy.mockReset();
+      findBy.mockResolvedValue([]);
+    }
   });
 
   describe("resolveScopes", () => {
@@ -228,6 +315,290 @@ describe("ResourceEntityFilter", () => {
 
       expect(scopes).toEqual([]);
     });
+
+    test("a key outside the catalog is ignored entirely", async () => {
+      const scopes: Array<ResourceEntityScope> =
+        await ResourceEntityFilter.resolveScopes({
+          projectId: PROJECT_ID,
+          selections: {
+            primaryEntityId: [RESOURCE_ID],
+            iotDeviceId: [RESOURCE_ID],
+          },
+        });
+
+      expect(scopes).toEqual([]);
+      for (const findBy of ALL_FIND_BY_MOCKS) {
+        expect(findBy).not.toHaveBeenCalled();
+      }
+    });
+
+    test("every catalog resource type yields exactly one scope that keeps its ids", async () => {
+      for (const facetKey of RESOURCE_FACET_CATALOG_KEYS) {
+        const scopes: Array<ResourceEntityScope> =
+          await ResourceEntityFilter.resolveScopes({
+            projectId: PROJECT_ID,
+            selections: { [facetKey]: [RESOURCE_ID] },
+          });
+
+        expect(scopes).toHaveLength(1);
+        expect(scopes[0]!.entityIds).toEqual([RESOURCE_ID]);
+      }
+    });
+  });
+
+  describe("resolveScopes — name-keyed clusters (Docker Swarm / Proxmox / vCenter / Ceph)", () => {
+    for (const cluster of NAME_KEYED_CLUSTERS) {
+      test(`${cluster.facetKey} resolves to the ${cluster.attributeKey} entity key and attribute`, async () => {
+        cluster.findBy.mockResolvedValue([{ name: "Prod-EU" }]);
+
+        const scopes: Array<ResourceEntityScope> =
+          await ResourceEntityFilter.resolveScopes({
+            projectId: PROJECT_ID,
+            selections: { [cluster.facetKey]: [RESOURCE_ID] },
+          });
+
+        expect(scopes).toEqual([
+          {
+            entityIds: [RESOURCE_ID],
+            entityKeys: [cluster.keyFor(PROJECT_ID.toString(), "Prod-EU")],
+            attributeKey: cluster.attributeKey,
+            // The attribute match is exact, so the stored casing is kept.
+            attributeValues: ["Prod-EU"],
+          },
+        ]);
+      });
+
+      test(`${cluster.facetKey} looks up the row's name, scoped to the project`, async () => {
+        cluster.findBy.mockResolvedValue([{ name: "prod-eu" }]);
+
+        await ResourceEntityFilter.resolveScopes({
+          projectId: PROJECT_ID,
+          selections: { [cluster.facetKey]: [RESOURCE_ID, OTHER_RESOURCE_ID] },
+        });
+
+        expect(cluster.findBy).toHaveBeenCalledTimes(1);
+
+        const call: Record<string, any> = cluster.findBy.mock
+          .calls[0]![0] as Record<string, any>;
+
+        expect(call["query"]["projectId"]).toBe(PROJECT_ID);
+        expect(call["query"]["_id"].values.map(String)).toEqual([
+          RESOURCE_ID,
+          OTHER_RESOURCE_ID,
+        ]);
+        expect(call["select"]).toEqual({ name: true });
+        expect(call["props"]).toEqual({ isRoot: true });
+        expect(call["limit"].toNumber()).toBe(2);
+        expect(call["skip"].toNumber()).toBe(0);
+
+        // Only this facet's table is consulted.
+        for (const findBy of ALL_FIND_BY_MOCKS) {
+          if (findBy !== cluster.findBy) {
+            expect(findBy).not.toHaveBeenCalled();
+          }
+        }
+      });
+
+      test(`${cluster.facetKey} entity keys ignore casing and surrounding whitespace, as ingest's canonicalization does`, async () => {
+        cluster.findBy.mockResolvedValue([{ name: "  PROD-eu " }]);
+
+        const scopes: Array<ResourceEntityScope> =
+          await ResourceEntityFilter.resolveScopes({
+            projectId: PROJECT_ID,
+            selections: { [cluster.facetKey]: [RESOURCE_ID] },
+          });
+
+        expect(scopes[0]!.entityKeys).toEqual([
+          cluster.keyFor(PROJECT_ID.toString(), "prod-eu"),
+        ]);
+      });
+
+      test(`${cluster.facetKey} de-duplicates keys but keeps each distinct name`, async () => {
+        cluster.findBy.mockResolvedValue([
+          { name: "prod-eu" },
+          { name: "prod-us" },
+          { name: "prod-eu" },
+        ]);
+
+        const scopes: Array<ResourceEntityScope> =
+          await ResourceEntityFilter.resolveScopes({
+            projectId: PROJECT_ID,
+            selections: {
+              [cluster.facetKey]: [RESOURCE_ID, OTHER_RESOURCE_ID],
+            },
+          });
+
+        expect(scopes[0]!.entityKeys).toEqual([
+          cluster.keyFor(PROJECT_ID.toString(), "prod-eu"),
+          cluster.keyFor(PROJECT_ID.toString(), "prod-us"),
+        ]);
+        expect(scopes[0]!.attributeValues).toEqual(["prod-eu", "prod-us"]);
+      });
+
+      test(`${cluster.facetKey} degrades to the id branch when the lookup fails`, async () => {
+        cluster.findBy.mockRejectedValue(
+          new Error("connection refused") as never,
+        );
+
+        const scopes: Array<ResourceEntityScope> =
+          await ResourceEntityFilter.resolveScopes({
+            projectId: PROJECT_ID,
+            selections: { [cluster.facetKey]: [RESOURCE_ID] },
+          });
+
+        expect(scopes).toEqual([{ entityIds: [RESOURCE_ID], entityKeys: [] }]);
+      });
+    }
+
+    test("the cluster keys are type-scoped: the same name under two types is two different keys", () => {
+      const keys: Array<string> = NAME_KEYED_CLUSTERS.map(
+        (cluster: {
+          keyFor: (projectId: string, name: string) => string;
+        }): string => {
+          return cluster.keyFor(PROJECT_ID.toString(), "prod");
+        },
+      );
+
+      expect(new Set(keys).size).toBe(NAME_KEYED_CLUSTERS.length);
+    });
+  });
+
+  describe("resolveScopes — attribute-only types (Serverless function / IoT fleet)", () => {
+    test("serverlessFunctionId matches the id or resource.faas.name, with no entity key", async () => {
+      serverlessFunctionFindBy.mockResolvedValue([
+        { functionIdentifier: "checkout-handler" },
+      ]);
+
+      const scopes: Array<ResourceEntityScope> =
+        await ResourceEntityFilter.resolveScopes({
+          projectId: PROJECT_ID,
+          selections: { serverlessFunctionId: [RESOURCE_ID] },
+        });
+
+      expect(scopes).toEqual([
+        {
+          entityIds: [RESOURCE_ID],
+          entityKeys: [],
+          attributeKey: "resource.faas.name",
+          attributeValues: ["checkout-handler"],
+        },
+      ]);
+
+      const call: Record<string, any> = serverlessFunctionFindBy.mock
+        .calls[0]![0] as Record<string, any>;
+      expect(call["query"]["projectId"]).toBe(PROJECT_ID);
+      expect(call["select"]).toEqual({ functionIdentifier: true });
+    });
+
+    test("iotFleetId matches the id or resource.iot.fleet.name, with no entity key", async () => {
+      iotFleetFindBy.mockResolvedValue([{ name: "warehouse-sensors" }]);
+
+      const scopes: Array<ResourceEntityScope> =
+        await ResourceEntityFilter.resolveScopes({
+          projectId: PROJECT_ID,
+          selections: { iotFleetId: [RESOURCE_ID] },
+        });
+
+      expect(scopes).toEqual([
+        {
+          entityIds: [RESOURCE_ID],
+          entityKeys: [],
+          attributeKey: "resource.iot.fleet.name",
+          attributeValues: ["warehouse-sensors"],
+        },
+      ]);
+
+      const call: Record<string, any> = iotFleetFindBy.mock
+        .calls[0]![0] as Record<string, any>;
+      expect(call["query"]["projectId"]).toBe(PROJECT_ID);
+      expect(call["select"]).toEqual({ name: true });
+    });
+
+    test("a blank function identifier leaves the id branch alone", async () => {
+      serverlessFunctionFindBy.mockResolvedValue([
+        { functionIdentifier: "  " },
+        { functionIdentifier: null },
+      ]);
+
+      const scopes: Array<ResourceEntityScope> =
+        await ResourceEntityFilter.resolveScopes({
+          projectId: PROJECT_ID,
+          selections: { serverlessFunctionId: [RESOURCE_ID] },
+        });
+
+      expect(scopes).toEqual([{ entityIds: [RESOURCE_ID], entityKeys: [] }]);
+    });
+
+    test("an attribute-only scope compiles to id OR attribute, never an empty hasAny", async () => {
+      iotFleetFindBy.mockResolvedValue([{ name: "warehouse-sensors" }]);
+
+      const scopes: Array<ResourceEntityScope> =
+        await ResourceEntityFilter.resolveScopes({
+          projectId: PROJECT_ID,
+          selections: { iotFleetId: [RESOURCE_ID] },
+        });
+
+      const statement: Statement = new Statement();
+      appendResourceScopeFilters(statement, scopes);
+
+      expect(statement.query).toBe(
+        "AND (primaryEntityId IN ({p0:Array(String)}) OR attributes[{p1:String}] IN ({p2:Array(String)}))",
+      );
+      expect(statement.query).not.toContain("hasAny");
+      expect(statement.query_params).toStrictEqual({
+        p0: [RESOURCE_ID],
+        p1: "resource.iot.fleet.name",
+        p2: ["warehouse-sensors"],
+      });
+    });
+  });
+
+  describe("resolveScopes — id-only types (Cloud resource / RUM application)", () => {
+    test.each(["cloudResourceId", "rumApplicationId"])(
+      "%s stays primaryEntityId-only and costs no Postgres lookup",
+      async (facetKey: string) => {
+        const scopes: Array<ResourceEntityScope> =
+          await ResourceEntityFilter.resolveScopes({
+            projectId: PROJECT_ID,
+            selections: { [facetKey]: [RESOURCE_ID, OTHER_RESOURCE_ID] },
+          });
+
+        expect(scopes).toEqual([
+          { entityIds: [RESOURCE_ID, OTHER_RESOURCE_ID], entityKeys: [] },
+        ]);
+        expect(cloudResourceFindBy).not.toHaveBeenCalled();
+        expect(rumApplicationFindBy).not.toHaveBeenCalled();
+
+        const statement: Statement = new Statement();
+        appendResourceScopeFilters(statement, scopes);
+
+        expect(statement.query).toBe(
+          "AND (primaryEntityId IN ({p0:Array(String)}))",
+        );
+      },
+    );
+
+    test("an id-only facet still intersects with a resolved one", async () => {
+      proxmoxClusterFindBy.mockResolvedValue([{ name: "pve" }]);
+
+      const scopes: Array<ResourceEntityScope> =
+        await ResourceEntityFilter.resolveScopes({
+          projectId: PROJECT_ID,
+          selections: {
+            rumApplicationId: [RESOURCE_ID],
+            proxmoxClusterId: [OTHER_RESOURCE_ID],
+          },
+        });
+
+      expect(scopes).toHaveLength(2);
+
+      const statement: Statement = new Statement();
+      appendResourceScopeFilters(statement, scopes);
+
+      expect(statement.query).toBe(
+        "AND (primaryEntityId IN ({p0:Array(String)})) AND (primaryEntityId IN ({p1:Array(String)}) OR hasAny(entityKeys, {p2:Array(String)}) OR attributes[{p3:String}] IN ({p4:Array(String)}))",
+      );
+    });
   });
 
   describe("rewriteAnalyticsQuery", () => {
@@ -331,6 +702,44 @@ describe("ResourceEntityFilter", () => {
       expect(query["resourceFilters"]).toBeUndefined();
     });
 
+    test("rewrites a Docker Swarm selection that the parser used to drop", async () => {
+      dockerSwarmClusterFindBy.mockResolvedValue([{ name: "swarm-a" }]);
+
+      const query: Record<string, unknown> = {
+        resourceFilters: { dockerSwarmClusterId: [RESOURCE_ID] },
+      };
+
+      await ResourceEntityFilter.rewriteAnalyticsQuery({
+        query,
+        projectId: PROJECT_ID,
+      });
+
+      expect(query["resourceFilters"]).toBeUndefined();
+      expect(query["resourceEntityScopes"]).toEqual([
+        {
+          entityIds: [RESOURCE_ID],
+          entityKeys: [
+            keyForDockerSwarmCluster(PROJECT_ID.toString(), "swarm-a"),
+          ],
+          attributeKey: "resource.docker.swarm.cluster.name",
+          attributeValues: ["swarm-a"],
+        },
+      ]);
+    });
+
+    test("without a tenant a new resource type keeps its ids and skips the lookup", async () => {
+      const query: Record<string, unknown> = {
+        resourceFilters: { iotFleetId: [RESOURCE_ID] },
+      };
+
+      await ResourceEntityFilter.rewriteAnalyticsQuery({ query });
+
+      expect(query["resourceEntityScopes"]).toEqual([
+        { entityIds: [RESOURCE_ID], entityKeys: [] },
+      ]);
+      expect(iotFleetFindBy).not.toHaveBeenCalled();
+    });
+
     test("an absent query is a no-op", async () => {
       await expect(
         ResourceEntityFilter.rewriteAnalyticsQuery({
@@ -416,6 +825,44 @@ describe("ResourceEntityFilter", () => {
       expect(statement.query).toBe("");
     });
 
+    test("an attribute-only scope (no entity keys) emits no hasAny branch", () => {
+      const statement: Statement = new Statement();
+
+      appendResourceScopeFilters(statement, [
+        {
+          entityIds: [],
+          entityKeys: [],
+          attributeKey: "resource.faas.name",
+          attributeValues: ["checkout-handler"],
+        },
+      ]);
+
+      expect(statement.query).toBe(
+        "AND (attributes[{p0:String}] IN ({p1:Array(String)}))",
+      );
+      expect(statement.query_params).toStrictEqual({
+        p0: "resource.faas.name",
+        p1: ["checkout-handler"],
+      });
+    });
+
+    test("blank entity keys and attribute values are dropped rather than bound", () => {
+      const statement: Statement = new Statement();
+
+      appendResourceScopeFilters(statement, [
+        {
+          entityIds: [RESOURCE_ID],
+          entityKeys: [""],
+          attributeKey: "resource.iot.fleet.name",
+          attributeValues: [""],
+        },
+      ]);
+
+      expect(statement.query).toBe(
+        "AND (primaryEntityId IN ({p0:Array(String)}))",
+      );
+    });
+
     test("the attribute fallback needs both a key and values", () => {
       const statement: Statement = new Statement();