@oneuptime/common 13.0.4 → 13.0.5

package/build/dist/Server/Services/SecurityEventConnectionService.js

@@ -0,0 +1,356 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/SecurityEventConnection";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import { isSecurityEventConnectorProvider, } from "../../Types/SecurityEvent/Connectors/SecurityEventConnectorProvider";
+import { getSecurityEventConnectorDefinition, } from "../../Types/SecurityEvent/Connectors/SecurityEventConnectorCatalog";
+import DataSourceEgressGuard from "../Utils/DataSource/EgressGuard";
+import SecurityEventConnectorRegistry from "../Utils/SecurityEvent/Connectors/SecurityEventConnectorRegistry";
+/*
+ * Validation happens at save time so a connection that stores is a
+ * connection the poller can use: a wrong key, a missing secret or an
+ * unsupported URL surfaces to the person configuring it, not as a
+ * lastError on the cron an hour later.
+ */
+export class Service extends DatabaseService {
+    constructor() {
+        super(Model);
+    }
+    /*
+     * Parse the JSON a form submits for `config`/`secrets`. Both may arrive
+     * as an object or as a JSON string; anything else is a 400.
+     */
+    static parseJsonObject(value, fieldName) {
+        if (value === undefined || value === null || value === "") {
+            return {};
+        }
+        let parsed = value;
+        if (typeof value === "string") {
+            try {
+                parsed = JSON.parse(value);
+            }
+            catch (_a) {
+                throw new BadDataException(`${fieldName} must be a JSON object.`);
+            }
+        }
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new BadDataException(`${fieldName} must be a JSON object.`);
+        }
+        return parsed;
+    }
+    /*
+     * Keys are the catalog's; values are strings, numbers or booleans. Unknown
+     * keys are rejected rather than stored, so a typo in a field key cannot
+     * silently become "the setting was never provided".
+     */
+    static validateFields(data) {
+        const knownKeys = new Set(data.fields.map((field) => {
+            return field.key;
+        }));
+        for (const key of Object.keys(data.values)) {
+            if (!knownKeys.has(key)) {
+                throw new BadDataException(`${data.label} contains an unknown setting "${key}" for ${data.definition.title}.`);
+            }
+            const value = data.values[key];
+            if (value !== null &&
+                value !== undefined &&
+                typeof value !== "string" &&
+                typeof value !== "number" &&
+                typeof value !== "boolean") {
+                throw new BadDataException(`${data.label} setting "${key}" must be a string, number or boolean.`);
+            }
+        }
+        for (const field of data.fields) {
+            const raw = data.values[field.key];
+            const isEmpty = raw === undefined ||
+                raw === null ||
+                (typeof raw === "string" && raw.trim() === "");
+            if (isEmpty) {
+                if (field.required && data.requireRequiredFields) {
+                    throw new BadDataException(`${field.title} is required for ${data.definition.title}.`);
+                }
+                continue;
+            }
+            if (field.type === "dropdown" && field.options) {
+                const allowed = field.options.map((option) => {
+                    return option.value;
+                });
+                if (!allowed.includes(String(raw))) {
+                    throw new BadDataException(`${field.title} must be one of: ${allowed.join(", ")}.`);
+                }
+            }
+            if (field.type === "number") {
+                const numeric = Number(raw);
+                if (!Number.isFinite(numeric)) {
+                    throw new BadDataException(`${field.title} must be a number.`);
+                }
+            }
+            if (field.type === "toggle" && typeof raw !== "boolean") {
+                throw new BadDataException(`${field.title} must be true or false.`);
+            }
+            if (field.type === "url") {
+                let parsed;
+                try {
+                    parsed = new URL(String(raw));
+                }
+                catch (_a) {
+                    throw new BadDataException(`${field.title} must be an absolute https URL.`);
+                }
+                if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+                    throw new BadDataException(`${field.title} must be an http or https URL.`);
+                }
+                if (parsed.username || parsed.password) {
+                    throw new BadDataException(`${field.title} must not embed credentials in the URL.`);
+                }
+            }
+        }
+    }
+    /*
+     * Tenant-chosen hosts go through the same egress policy every other
+     * outbound connector uses. Validated here so a blocked address is a
+     * form error rather than a poll that fails forever.
+     */
+    static async assertUrlsAllowed(definition, config) {
+        for (const field of definition.configFields) {
+            if (field.type !== "url") {
+                continue;
+            }
+            const value = config[field.key];
+            if (typeof value !== "string" || !value.trim()) {
+                continue;
+            }
+            await DataSourceEgressGuard.assertUrlAllowed(value.trim());
+        }
+    }
+    static getDefinitionOrThrow(provider) {
+        if (!isSecurityEventConnectorProvider(provider)) {
+            throw new BadDataException("Provider must be one of the supported security event connectors.");
+        }
+        const definition = getSecurityEventConnectorDefinition(provider);
+        if (!definition) {
+            throw new BadDataException("Provider must be one of the supported security event connectors.");
+        }
+        return definition;
+    }
+    /*
+     * Full validation of unsaved settings: catalog shape, provider-specific
+     * rules and egress policy. Used on create, on update (with the merged
+     * secrets) and by the synchronous connection test for settings that were
+     * never stored.
+     */
+    static async validateSettings(data) {
+        const definition = this.getDefinitionOrThrow(data.provider);
+        this.validateFields({
+            definition,
+            fields: definition.configFields,
+            values: data.config,
+            label: "Configuration",
+            requireRequiredFields: true,
+        });
+        this.validateFields({
+            definition,
+            fields: definition.secretFields,
+            values: data.secrets,
+            label: "Credentials",
+            requireRequiredFields: data.requireRequiredSecrets,
+        });
+        const settings = {
+            provider: definition.provider,
+            config: data.config,
+            secrets: data.secrets,
+            alertingOnly: data.alertingOnly,
+        };
+        SecurityEventConnectorRegistry.getConnector(definition.provider).validateSettings(settings);
+        await this.assertUrlsAllowed(definition, data.config);
+        return settings;
+    }
+    /*
+     * Secrets are write-only, so an edit form cannot echo them back and a
+     * rotation may replace only one key. Each submitted key is read as:
+     *   - a non-empty value: replaces the stored one;
+     *   - "" or undefined: keeps the stored one (an untouched password input);
+     *   - null: removes the stored key.
+     * Without the null case nothing could ever clear an optional credential,
+     * and a stale one keeps winning downstream: a leftover AWS session token
+     * is sent with a new long-lived key, a revoked Splunk token outranks the
+     * username and password now on the form (review finding
+     * optional-secret-cannot-be-cleared).
+     *
+     * The result is not validated here. Callers validate the merged object,
+     * so clearing a required secret fails with that field's "is required"
+     * message. A null for a key that is neither a credential of this
+     * provider nor stored is refused, so a typo in a clear request is not
+     * silently a no-op that leaves the credential in place.
+     */
+    static mergeSecrets(data) {
+        const knownKeys = new Set(data.definition.secretFields.map((field) => {
+            return field.key;
+        }));
+        const merged = Object.assign({}, data.stored);
+        for (const key of Object.keys(data.provided)) {
+            const value = data.provided[key];
+            if (value === null) {
+                if (!knownKeys.has(key) &&
+                    !Object.prototype.hasOwnProperty.call(data.stored, key)) {
+                    throw new BadDataException(`Credentials contains an unknown setting "${key}" for ${data.definition.title}.`);
+                }
+                delete merged[key];
+                continue;
+            }
+            if (value === undefined || value === "") {
+                continue;
+            }
+            merged[key] = value;
+        }
+        return merged;
+    }
+    static validatePollInterval(value) {
+        if (value === undefined) {
+            return;
+        }
+        if (typeof value !== "number" ||
+            !Number.isInteger(value) ||
+            value < 1 ||
+            value > 1440) {
+            throw new BadDataException("Poll interval must be a whole number of minutes between 1 and 1440.");
+        }
+    }
+    async onBeforeCreate(createBy) {
+        const definition = Service.getDefinitionOrThrow(createBy.data.provider);
+        const config = Service.parseJsonObject(createBy.data.config, "Configuration");
+        const secrets = Service.parseJsonObject(createBy.data.secrets, "Credentials");
+        Service.validatePollInterval(createBy.data.pollIntervalInMinutes);
+        if (createBy.data.alertingOnly !== undefined &&
+            typeof createBy.data.alertingOnly !== "boolean") {
+            throw new BadDataException("Alerting records only must be true or false.");
+        }
+        await Service.validateSettings({
+            provider: definition.provider,
+            config,
+            secrets,
+            alertingOnly: createBy.data.alertingOnly !== false,
+            requireRequiredSecrets: true,
+        });
+        createBy.data.config = config;
+        createBy.data.secrets = JSON.stringify(secrets);
+        if (createBy.data.pollIntervalInMinutes === undefined) {
+            createBy.data.pollIntervalInMinutes =
+                definition.defaultPollIntervalInMinutes;
+        }
+        return { createBy, carryForward: null };
+    }
+    /*
+     * Provided secrets are merged over the stored ones by mergeSecrets (a
+     * value replaces, "" or undefined keeps, null removes); the merged object
+     * is what gets validated and re-encrypted.
+     */
+    async onBeforeUpdate(updateBy) {
+        /*
+         * Read through a plain JSON view: the typed partial of a model with JSON
+         * columns is recursive enough that TypeScript gives up instantiating it
+         * ("excessively deep"), and the values are validated by hand anyway.
+         */
+        const incoming = updateBy.data;
+        if (incoming["provider"] !== undefined) {
+            throw new BadDataException("The provider of a connection cannot be changed. Create a new connection instead.");
+        }
+        Service.validatePollInterval(incoming["pollIntervalInMinutes"]);
+        if (incoming["alertingOnly"] !== undefined &&
+            typeof incoming["alertingOnly"] !== "boolean") {
+            throw new BadDataException("Alerting records only must be true or false.");
+        }
+        const touchesSettings = incoming["config"] !== undefined || incoming["secrets"] !== undefined;
+        if (!touchesSettings) {
+            return { updateBy, carryForward: null };
+        }
+        const idFromQuery = updateBy.query["_id"];
+        const connectionId = typeof idFromQuery === "string"
+            ? idFromQuery
+            : idFromQuery instanceof ObjectID
+                ? idFromQuery.toString()
+                : undefined;
+        if (!connectionId || !ObjectID.isValidUUID(connectionId)) {
+            throw new BadDataException("Configuration and credentials can only be updated one connection at a time.");
+        }
+        const current = await this.findOneById({
+            id: new ObjectID(connectionId),
+            select: {
+                _id: true,
+                provider: true,
+                config: true,
+                secrets: true,
+                alertingOnly: true,
+            },
+            props: { isRoot: true },
+        });
+        if (!current || !current.provider) {
+            throw new BadDataException("The connection no longer exists.");
+        }
+        const config = incoming["config"] !== undefined
+            ? Service.parseJsonObject(incoming["config"], "Configuration")
+            : Service.parseJsonObject(current.config, "Configuration");
+        const storedSecrets = Service.parseJsonObject(current.secrets, "Credentials");
+        const providedSecrets = incoming["secrets"] !== undefined
+            ? Service.parseJsonObject(incoming["secrets"], "Credentials")
+            : {};
+        const mergedSecrets = Service.mergeSecrets({
+            definition: Service.getDefinitionOrThrow(current.provider),
+            stored: storedSecrets,
+            provided: providedSecrets,
+        });
+        await Service.validateSettings({
+            provider: current.provider,
+            config,
+            secrets: mergedSecrets,
+            alertingOnly: typeof incoming["alertingOnly"] === "boolean"
+                ? incoming["alertingOnly"]
+                : current.alertingOnly !== false,
+            requireRequiredSecrets: true,
+        });
+        incoming["config"] = config;
+        incoming["secrets"] = JSON.stringify(mergedSecrets);
+        return { updateBy, carryForward: null };
+    }
+    /*
+     * Decrypted settings for the poller and the tester. Root read; the
+     * returned object must never be serialized into a response or a log.
+     */
+    async getConnectorSettings(connection) {
+        let secretsJson = connection.secrets;
+        let config = connection.config;
+        let provider = connection.provider;
+        let alertingOnly = connection.alertingOnly !== false;
+        if ((secretsJson === undefined ||
+            config === undefined ||
+            provider === undefined) &&
+            connection.id) {
+            const loaded = await this.findOneById({
+                id: connection.id,
+                select: {
+                    _id: true,
+                    provider: true,
+                    config: true,
+                    secrets: true,
+                    alertingOnly: true,
+                },
+                props: { isRoot: true },
+            });
+            if (!loaded) {
+                throw new BadDataException("The connection no longer exists.");
+            }
+            secretsJson = loaded.secrets;
+            config = loaded.config;
+            provider = loaded.provider;
+            alertingOnly = loaded.alertingOnly !== false;
+        }
+        const definition = Service.getDefinitionOrThrow(provider);
+        return {
+            provider: definition.provider,
+            config: Service.parseJsonObject(config, "Configuration"),
+            secrets: Service.parseJsonObject(secretsJson, "Credentials"),
+            alertingOnly,
+        };
+    }
+}
+export default new Service();
+//# sourceMappingURL=SecurityEventConnectionService.js.map

package/build/dist/Server/Services/SecurityEventConnectionService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityEventConnectionService.js","sourceRoot":"","sources":["../../../../Server/Services/SecurityEventConnectionService.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,qDAAqD,CAAC;AAIxE,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AAEtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAuC,EACrC,gCAAgC,GACjC,MAAM,qEAAqE,CAAC;AAC7E,OAAO,EAGL,mCAAmC,GACpC,MAAM,oEAAoE,CAAC;AAC5E,OAAO,qBAAqB,MAAM,iCAAiC,CAAC;AACpE,OAAO,8BAA8B,MAAM,kEAAkE,CAAC;AAG9G;;;;;GAKG;AACH,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,eAAe,CAAC,KAAc,EAAE,SAAiB;QAC7D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC1D,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,MAAM,GAAY,KAAK,CAAC;QAE5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,IAAI,gBAAgB,CAAC,GAAG,SAAS,yBAAyB,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,gBAAgB,CAAC,GAAG,SAAS,yBAAyB,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,MAAoB,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,cAAc,CAAC,IAM5B;QACC,MAAM,SAAS,GAAgB,IAAI,GAAG,CACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAqB,EAAU,EAAE;YAChD,OAAO,KAAK,CAAC,GAAG,CAAC;QACnB,CAAC,CAAC,CACH,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,KAAK,iCAAiC,GAAG,SAAS,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CACnF,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAc,IAAI,CAAC,MAAM,CAAC,GAAG,CAAc,CAAC;YAEvD,IACE,KAAK,KAAK,IAAI;gBACd,KAAK,KAAK,SAAS;gBACnB,OAAO,KAAK,KAAK,QAAQ;gBACzB,OAAO,KAAK,KAAK,QAAQ;gBACzB,OAAO,KAAK,KAAK,SAAS,EAC1B,CAAC;gBACD,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,KAAK,aAAa,GAAG,wCAAwC,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,GAAG,GAA0B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1D,MAAM,OAAO,GACX,GAAG,KAAK,SAAS;gBACjB,GAAG,KAAK,IAAI;gBACZ,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAEjD,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBACjD,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,CAAC,KAAK,oBAAoB,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAC3D,CAAC;gBACJ,CAAC;gBAED,SAAS;YACX,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC/C,MAAM,OAAO,GAAkB,KAAK,CAAC,OAAO,CAAC,GAAG,CAC9C,CAAC,MAAyB,EAAU,EAAE;oBACpC,OAAO,MAAM,CAAC,KAAK,CAAC;gBACtB,CAAC,CACF,CAAC;gBAEF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,CAAC,KAAK,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxD,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAW,MAAM,CAAC,GAAG,CAAC,CAAC;gBAEpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC9B,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,CAAC,KAAK,oBAAoB,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,SAAS,EAAE,CAAC;gBACxD,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,CAAC,KAAK,yBAAyB,CAAC,CAAC;YACtE,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBACzB,IAAI,MAAW,CAAC;gBAEhB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChC,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,CAAC,KAAK,iCAAiC,CAChD,CAAC;gBACJ,CAAC;gBAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;oBAChE,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,CAAC,KAAK,gCAAgC,CAC/C,CAAC;gBACJ,CAAC;gBAED,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACvC,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,CAAC,KAAK,yCAAyC,CACxD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,KAAK,CAAC,iBAAiB,CACpC,UAA4C,EAC5C,MAAkB;QAElB,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;YAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAA0B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAEvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC/C,SAAS;YACX,CAAC;YAED,MAAM,qBAAqB,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,oBAAoB,CAChC,QAAiB;QAEjB,IAAI,CAAC,gCAAgC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,gBAAgB,CACxB,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GACd,mCAAmC,CAAC,QAAQ,CAAC,CAAC;QAEhD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,gBAAgB,CACxB,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAMpC;QACC,MAAM,UAAU,GACd,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE3C,IAAI,CAAC,cAAc,CAAC;YAClB,UAAU;YACV,MAAM,EAAE,UAAU,CAAC,YAAY;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,eAAe;YACtB,qBAAqB,EAAE,IAAI;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,CAAC;YAClB,UAAU;YACV,MAAM,EAAE,UAAU,CAAC,YAAY;YAC/B,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,KAAK,EAAE,aAAa;YACpB,qBAAqB,EAAE,IAAI,CAAC,sBAAsB;SACnD,CAAC,CAAC;QAEH,MAAM,QAAQ,GAA8B;YAC1C,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;QAEF,8BAA8B,CAAC,YAAY,CACzC,UAAU,CAAC,QAAQ,CACpB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAE7B,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,MAAM,CAAC,YAAY,CAAC,IAI1B;QACC,MAAM,SAAS,GAAgB,IAAI,GAAG,CACpC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAqB,EAAU,EAAE;YACjE,OAAO,KAAK,CAAC,GAAG,CAAC;QACnB,CAAC,CAAC,CACH,CAAC;QACF,MAAM,MAAM,qBAAoB,IAAI,CAAC,MAAM,CAAE,CAAC;QAE9C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,MAAM,KAAK,GAA0B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAExD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,IACE,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;oBACnB,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,EACvD,CAAC;oBACD,MAAM,IAAI,gBAAgB,CACxB,4CAA4C,GAAG,SAAS,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CACjF,CAAC;gBACJ,CAAC;gBAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YAED,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACxC,SAAS;YACX,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,oBAAoB,CAAC,KAAc;QAChD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;YACxB,KAAK,GAAG,CAAC;YACT,KAAK,GAAG,IAAI,EACZ,CAAC;YACD,MAAM,IAAI,gBAAgB,CACxB,qEAAqE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,MAAM,UAAU,GACd,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAe,OAAO,CAAC,eAAe,CAChD,QAAQ,CAAC,IAAI,CAAC,MAAM,EACpB,eAAe,CAChB,CAAC;QACF,MAAM,OAAO,GAAe,OAAO,CAAC,eAAe,CACjD,QAAQ,CAAC,IAAI,CAAC,OAAO,EACrB,aAAa,CACd,CAAC;QAEF,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAElE,IACE,QAAQ,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS;YACxC,OAAO,QAAQ,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,EAC/C,CAAC;YACD,MAAM,IAAI,gBAAgB,CACxB,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,CAAC,gBAAgB,CAAC;YAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,MAAM;YACN,OAAO;YACP,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,KAAK,KAAK;YAClD,sBAAsB,EAAE,IAAI;SAC7B,CAAC,CAAC;QAEH,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAEhD,IAAI,QAAQ,CAAC,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACtD,QAAQ,CAAC,IAAI,CAAC,qBAAqB;gBACjC,UAAU,CAAC,4BAA4B,CAAC;QAC5C,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACgB,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB;;;;WAIG;QACH,MAAM,QAAQ,GAAe,QAAQ,CAAC,IAA6B,CAAC;QAEpE,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,gBAAgB,CACxB,kFAAkF,CACnF,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAEhE,IACE,QAAQ,CAAC,cAAc,CAAC,KAAK,SAAS;YACtC,OAAO,QAAQ,CAAC,cAAc,CAAC,KAAK,SAAS,EAC7C,CAAC;YACD,MAAM,IAAI,gBAAgB,CACxB,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GACnB,QAAQ,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC;QAExE,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,WAAW,GAAa,QAAQ,CAAC,KAAoB,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,YAAY,GAChB,OAAO,WAAW,KAAK,QAAQ;YAC7B,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,WAAW,YAAY,QAAQ;gBAC/B,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE;gBACxB,CAAC,CAAC,SAAS,CAAC;QAElB,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,gBAAgB,CACxB,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAiB,MAAM,IAAI,CAAC,WAAW,CAAC;YACnD,EAAE,EAAE,IAAI,QAAQ,CAAC,YAAY,CAAC;YAC9B,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,IAAI;aACnB;YACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,gBAAgB,CAAC,kCAAkC,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,MAAM,GACV,QAAQ,CAAC,QAAQ,CAAC,KAAK,SAAS;YAC9B,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;YAC9D,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAE/D,MAAM,aAAa,GAAe,OAAO,CAAC,eAAe,CACvD,OAAO,CAAC,OAAO,EACf,aAAa,CACd,CAAC;QACF,MAAM,eAAe,GACnB,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS;YAC/B,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;YAC7D,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,aAAa,GAAe,OAAO,CAAC,YAAY,CAAC;YACrD,UAAU,EAAE,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC1D,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,eAAe;SAC1B,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,gBAAgB,CAAC;YAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM;YACN,OAAO,EAAE,aAAa;YACtB,YAAY,EACV,OAAO,QAAQ,CAAC,cAAc,CAAC,KAAK,SAAS;gBAC3C,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAC1B,CAAC,CAAC,OAAO,CAAC,YAAY,KAAK,KAAK;YACpC,sBAAsB,EAAE,IAAI;SAC7B,CAAC,CAAC;QAEH,QAAQ,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAEpD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,oBAAoB,CAC/B,UAAiB;QAEjB,IAAI,WAAW,GAAuB,UAAU,CAAC,OAAO,CAAC;QACzD,IAAI,MAAM,GAA2B,UAAU,CAAC,MAAM,CAAC;QACvD,IAAI,QAAQ,GACV,UAAU,CAAC,QAAQ,CAAC;QACtB,IAAI,YAAY,GAAY,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC;QAE9D,IACE,CAAC,WAAW,KAAK,SAAS;YACxB,MAAM,KAAK,SAAS;YACpB,QAAQ,KAAK,SAAS,CAAC;YACzB,UAAU,CAAC,EAAE,EACb,CAAC;YACD,MAAM,MAAM,GAAiB,MAAM,IAAI,CAAC,WAAW,CAAC;gBAClD,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,IAAI;oBACb,YAAY,EAAE,IAAI;iBACnB;gBACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,gBAAgB,CAAC,kCAAkC,CAAC,CAAC;YACjE,CAAC;YAED,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC;YAC7B,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACvB,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,YAAY,GAAG,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC;QAC/C,CAAC;QAED,MAAM,UAAU,GACd,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAEzC,OAAO;YACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC;YACxD,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC;YAC5D,YAAY;SACb,CAAC;IACJ,CAAC;CACF;AAED,eAAe,IAAI,OAAO,EAAE,CAAC"}

package/build/dist/Server/Services/TraceAggregationService.js

@@ -13,12 +13,14 @@ import { getQuerySettings } from "../Utils/AnalyticsDatabase/QuerySettingsHelper
 import SpanService from "./SpanService";
 import TableColumnType from "../../Types/AnalyticsDatabase/TableColumnType";
 import { ObjectType } from "../../Types/JSON";
+import ObjectID from "../../Types/ObjectID";
 import BadDataException from "../../Types/Exception/BadDataException";
 import Includes from "../../Types/BaseDatabase/Includes";
 import AnalyticsTableName from "../../Types/AnalyticsDatabase/AnalyticsTableName";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger from "../Utils/Logger";
 import ServiceType from "../../Types/Telemetry/ServiceType";
+import { getResourceFacetServiceTypeMap } from "../../Types/Telemetry/ResourceFacetCatalog";
 import { appendResourceScopeFilters, } from "../Utils/Telemetry/ResourceEntityFilter";
 import ResourceFacetResolver from "../Utils/Telemetry/ResourceFacetResolver";
 export class TraceAggregationService {
@@ -250,8 +252,8 @@ export class TraceAggregationService {
      *
      * primaryEntityId is intentionally NOT disambiguated by primaryEntityType
      * here. Resource IDs are globally unique, so a single primaryEntityId ->
-     * count map correctly serves the service / host / docker host / k8s cluster
-     * facets once merged against each Postgres source-of-truth list (a host id
+     * count map correctly serves the service facet and every resource facet
+     * once merged against each Postgres source-of-truth list (a host id
      * never collides with a service id, so an unrelated entry is simply never
      * looked up). Omitting the primaryEntityType predicate keeps the query
      * projection-eligible.
@@ -586,10 +588,41 @@ export class TraceAggregationService {
         }));
         return statement;
     }
+    /*
+     * The spans behind one exception group's occurrences. The subquery is
+     * pinned to the request's project; without a project the filter matches
+     * nothing rather than widening to every span. GLOBAL IN because both tables
+     * are Distributed and shard on different keys: a plain IN is rejected on
+     * multi-shard clusters (Code 288) and would be wrong shard-locally.
+     */
+    static appendExceptionScopeFilter(statement, request) {
+        if (!request.exceptionScope) {
+            return;
+        }
+        if (!request.projectId) {
+            statement.append(" AND 0");
+            return;
+        }
+        statement.append(SQL ` AND (traceId, spanId) GLOBAL IN (SELECT traceId, spanId FROM ${AnalyticsTableName.ExceptionInstance} WHERE projectId = ${{
+            type: TableColumnType.ObjectID,
+            value: request.projectId,
+        }} AND fingerprint = ${{
+            type: TableColumnType.Text,
+            value: request.exceptionScope.fingerprint,
+        }}`);
+        if (request.exceptionScope.primaryEntityId) {
+            statement.append(SQL ` AND primaryEntityId = ${{
+                type: TableColumnType.ObjectID,
+                value: new ObjectID(request.exceptionScope.primaryEntityId),
+            }}`);
+        }
+        statement.append(")");
+    }
     static appendCommonFilters(statement, request) {
         if (request.rootOnly) {
             statement.append(" AND isRootSpan = 1");
         }
+        TraceAggregationService.appendExceptionScopeFilter(statement, request);
         if (request.serviceIds && request.serviceIds.length > 0) {
             statement.append(SQL ` AND primaryEntityId IN (${{
                 type: TableColumnType.ObjectID,
@@ -842,18 +875,19 @@ export class TraceAggregationService {
         /*
          * Both memberships are required, and the two sets genuinely differ:
          *
-         * - `proxmoxClusterId` / `vmwareVCenterId` / `cephClusterId` are
-         *   resource dimensions here but have no branch in
-         *   ResourceFacetResolver.resolveOne, which returns [] for them. Asking
-         *   anyway would cost a round-trip and still leave the cell raw.
+         * - Every resource dimension here is a ResourceFacetCatalog type, and
+         *   the resolver lists every catalog type from Postgres, so all of them
+         *   (Proxmox / vCenter / Ceph / Docker Swarm / IoT fleet included) come
+         *   back with display names.
          * - `primaryEntityId` / `serviceId` are resolvable but are NOT resource
          *   dimensions here — they select the OpenTelemetry-service slot, and
          *   the traces explorer already resolves that split client-side
          *   (TracesAnalyticsView's serviceNameMap). Renaming their values
          *   server-side would change an existing surface for no gain.
          *
-         * Taking the intersection means a key becomes resolvable here the
-         * moment the resolver learns it, with no second list to update.
+         * Taking the intersection keeps a dimension this service learns before
+         * the resolver does from costing a round-trip that could only leave
+         * the cell raw.
          */
         const resourceKeys = groupByKeys.filter((key) => {
             return (TraceAggregationService.RESOURCE_FACET_KEYS.has(key) &&
@@ -1178,9 +1212,10 @@ export class TraceAggregationService {
             }
             if (key === "primaryEntityId") {
                 /*
-                 * Same restriction as the Service facet: keep host/docker/k8s
-                 * entity ids out of the "Service" dimension (they reuse the
-                 * primaryEntityId slot, disambiguated by primaryEntityType).
+                 * Same restriction as the Service facet: keep resource entity ids
+                 * (host / docker / k8s / ...) out of the "Service" dimension (they
+                 * reuse the primaryEntityId slot, disambiguated by
+                 * primaryEntityType).
                  */
                 statement.append(SQL ` AND (primaryEntityType = '' OR primaryEntityType = ${{
                     type: TableColumnType.Text,
@@ -1397,21 +1432,12 @@ TraceAggregationService.TOP_LEVEL_COLUMNS = new Set([
 ]);
 /*
  * Virtual facet keys — same scheme as LogAggregationService. The
- * `primaryEntityId` slot is reused for host / docker host / k8s cluster
- * ids, disambiguated by the `primaryEntityType` discriminator.
+ * `primaryEntityId` slot is reused for every non-Service resource id
+ * (host / docker host / k8s cluster / ... — one entry per
+ * ResourceFacetCatalog type), disambiguated by the `primaryEntityType`
+ * discriminator.
  */
-TraceAggregationService.RESOURCE_FACET_KEYS = new Map([
-    ["hostId", ServiceType.Host],
-    ["dockerHostId", ServiceType.DockerHost],
-    ["podmanHostId", ServiceType.PodmanHost],
-    ["kubernetesClusterId", ServiceType.KubernetesCluster],
-    ["proxmoxClusterId", ServiceType.ProxmoxCluster],
-    ["vmwareVCenterId", ServiceType.VMwareVCenter],
-    ["cephClusterId", ServiceType.CephCluster],
-    ["serverlessFunctionId", ServiceType.ServerlessFunction],
-    ["cloudResourceId", ServiceType.CloudResource],
-    ["rumApplicationId", ServiceType.RealUserMonitor],
-]);
+TraceAggregationService.RESOURCE_FACET_KEYS = getResourceFacetServiceTypeMap();
 TraceAggregationService.ATTRIBUTE_KEY_PATTERN = /^[a-zA-Z0-9._:/-]+$/;
 TraceAggregationService.MAX_FACET_KEY_LENGTH = 256;
 /*