@oneuptime/common 13.0.5 → 13.0.7

package/Server/Utils/SessionReplay/SessionReplayReadService.ts

@@ -18,6 +18,7 @@ import ChunkMath from "../../../Utils/Rum/ChunkMath";
 import {
   SessionReplayTabEndFacts,
   hasSessionRecordingEnded,
+  hasTabRecordingEnded,
 } from "../../../Utils/Rum/SessionReplayRecordingEnded";
 import {
   MAX_SESSION_REPLAY_CHUNKS_PER_READ,
@@ -539,6 +540,24 @@ export interface SessionReplayManifestTab {
   totalPayloadBytes: number;
   /* Where this tab's footage begins on the session clock. */
   firstChunkStartOffsetMs: number;
+  /*
+   * Whether THIS tab has stopped recording, so the player can list open
+   * tabs before closed ones. A session id is shared by every tab and every
+   * page load of a multi-page app (the recorder mints a new tab id per
+   * load), so the header's hasRecordingEnded - "every tab has ended" -
+   * cannot say which of them is still open.
+   *
+   * - A finalized header: true for every tab, with no extra read.
+   * - Otherwise judged by getManifest from the same grouped chunk read as
+   *   the header's hasRecordingEnded: true when the session as a whole has
+   *   ended, or when hasTabRecordingEnded holds for this tab's facts. There
+   *   is no grace per tab: the grace exists because a NEW tab id may still
+   *   be about to register, which says nothing about whether this one
+   *   sealed.
+   * - No facts for the tab, or a failed read: false, the same "report it
+   *   as still recording" fallback the header uses.
+   */
+  hasRecordingEnded: boolean;
 }
 
 export interface SessionReplayManifest {
@@ -1192,6 +1211,59 @@ const TAB_END_FACT_AGGREGATES: Array<AggregatedColumn> = [
   },
 ];
 
+/* One tab-end-facts row, read with the defensive readers above. */
+function readTabEndFacts(row: JSONObject): SessionReplayTabEndFacts {
+  return {
+    hasFinalChunk: readBoolean(row, TAB_HAS_FINAL_CHUNK_ALIAS),
+    finalChunkEndUnixMs: readMeasuredNumber(row, TAB_FINAL_CHUNK_END_ALIAS),
+    lastChunkStartUnixMs: readMeasuredNumber(row, TAB_LAST_CHUNK_START_ALIAS),
+    maxChunkIndex: readMeasuredNumber(row, TAB_MAX_CHUNK_INDEX_ALIAS),
+    lastChunkStoredAtUnixMs: readMeasuredNumber(
+      row,
+      TAB_LAST_CHUNK_STORED_AT_ALIAS,
+    ),
+  };
+}
+
+/*
+ * GROUP BY sessionId, tabId makes every (session, tab) pair one row, so
+ * this only ever runs on a result that repeats a pair. It folds the two
+ * rows with the same maxima the GROUP BY applies, which is what one group
+ * over both rows' chunks would have answered. A value that was not
+ * measured on either side stays unmeasured (NaN), so a fold can never
+ * read as "ended" on less evidence than its rows had.
+ */
+function foldTabEndFacts(
+  first: SessionReplayTabEndFacts,
+  second: SessionReplayTabEndFacts,
+): SessionReplayTabEndFacts {
+  const maxMeasured: (a: number, b: number) => number = (
+    a: number,
+    b: number,
+  ): number => {
+    return Number.isFinite(a) && Number.isFinite(b)
+      ? Math.max(a, b)
+      : Number.NaN;
+  };
+
+  return {
+    hasFinalChunk: first.hasFinalChunk || second.hasFinalChunk,
+    finalChunkEndUnixMs: maxMeasured(
+      first.finalChunkEndUnixMs,
+      second.finalChunkEndUnixMs,
+    ),
+    lastChunkStartUnixMs: maxMeasured(
+      first.lastChunkStartUnixMs,
+      second.lastChunkStartUnixMs,
+    ),
+    maxChunkIndex: maxMeasured(first.maxChunkIndex, second.maxChunkIndex),
+    lastChunkStoredAtUnixMs: maxMeasured(
+      first.lastChunkStoredAtUnixMs,
+      second.lastChunkStoredAtUnixMs,
+    ),
+  };
+}
+
 /*
  * The capability list chunk 0 declared, filtered to the vocabulary this
  * build knows so a stored typo never reaches the player as a capability.
@@ -2286,23 +2358,48 @@ export default class SessionReplayReadService {
      * a truncated manifest would lose a tab's newest chunks - exactly the
      * rows that say whether it kept recording after its final chunk. A
      * finalized header is authoritative and runs no second read. The
-     * helper never rejects (a failure answers "not ended"), so it cannot
-     * fail the manifest. The manifest statement is issued first.
+     * helper never rejects (a failure answers "no facts", which is "not
+     * ended"), so it cannot fail the manifest. The manifest statement is
+     * issued first.
+     *
+     * The same one read also answers each tab's own hasRecordingEnded:
+     * it is already grouped per tab, because the session rule is per tab.
      */
     const manifestResultPromise: Promise<Results> =
       RumSessionChunkService.executeQuery(statement);
 
-    const endedSessionIdsPromise: Promise<Set<string>> = data.header.isFinalized
-      ? Promise.resolve(new Set<string>())
-      : SessionReplayReadService.readRecordingEndedSessionIds({
-          projectId: data.projectId,
-          rumApplicationId: data.rumApplicationId,
-          sessionIds: [data.sessionId],
-          nowUnixMs: data.nowUnixMs ?? Date.now(),
-        });
+    const tabEndFactsPromise: Promise<Map<string, SessionReplayTabEndFacts>> =
+      data.header.isFinalized
+        ? Promise.resolve(new Map<string, SessionReplayTabEndFacts>())
+        : SessionReplayReadService.readTabEndFactsBySession({
+            projectId: data.projectId,
+            rumApplicationId: data.rumApplicationId,
+            sessionIds: [data.sessionId],
+          }).then(
+            (
+              factsBySessionId: Map<
+                string,
+                Map<string, SessionReplayTabEndFacts>
+              >,
+            ): Map<string, SessionReplayTabEndFacts> => {
+              return (
+                factsBySessionId.get(data.sessionId) ||
+                new Map<string, SessionReplayTabEndFacts>()
+              );
+            },
+          );
 
-    const [dbResult, endedSessionIds]: [Results, Set<string>] =
-      await Promise.all([manifestResultPromise, endedSessionIdsPromise]);
+    const [dbResult, tabEndFactsByTabId]: [
+      Results,
+      Map<string, SessionReplayTabEndFacts>,
+    ] = await Promise.all([manifestResultPromise, tabEndFactsPromise]);
+
+    const hasRecordingEnded: boolean =
+      !data.header.isFinalized &&
+      hasSessionRecordingEnded(
+        Array.from(tabEndFactsByTabId.values()),
+        data.nowUnixMs ?? Date.now(),
+      );
     const response: DbJSONResponse = await dbResult.json<{
       data?: Array<JSONObject>;
     }>();
@@ -2396,6 +2493,13 @@ export default class SessionReplayReadService {
           },
           Number.POSITIVE_INFINITY,
         ),
+        hasRecordingEnded: SessionReplayReadService.isManifestTabRecordingEnded(
+          {
+            isSessionFinalized: data.header.isFinalized,
+            hasSessionRecordingEnded: hasRecordingEnded,
+            tabEndFacts: tabEndFactsByTabId.get(tabId),
+          },
+        ),
       });
     }
 
@@ -2412,7 +2516,7 @@ export default class SessionReplayReadService {
         liveDurationMs: liveDurationMs,
         liveEventCount: liveEventCount,
         liveMaxChunkIndex: liveMaxChunkIndex,
-        hasRecordingEnded: endedSessionIds.has(data.sessionId),
+        hasRecordingEnded: hasRecordingEnded,
       }),
       tabs: tabs,
       isChunkIndexTruncated: rows.length >= MAX_MANIFEST_ROWS,
@@ -2472,11 +2576,78 @@ export default class SessionReplayReadService {
     };
   }
 
+  /*
+   * One manifest tab's hasRecordingEnded (see
+   * SessionReplayManifestTab.hasRecordingEnded). A finalized session or one
+   * that has ended as a whole ends every tab, including a tab the grouped
+   * read has no facts for (its rows can land in the manifest read and not
+   * yet in the facts read, or the other way round). Otherwise the tab is
+   * judged on its own facts, and no facts is "not known to have ended".
+   */
+  private static isManifestTabRecordingEnded(data: {
+    isSessionFinalized: boolean;
+    hasSessionRecordingEnded: boolean;
+    tabEndFacts: SessionReplayTabEndFacts | undefined;
+  }): boolean {
+    if (data.isSessionFinalized || data.hasSessionRecordingEnded) {
+      return true;
+    }
+
+    if (!data.tabEndFacts) {
+      return false;
+    }
+
+    return hasTabRecordingEnded(data.tabEndFacts);
+  }
+
   /*
    * Which of these unfinalized sessions have stopped recording, judged by
    * the shared rule (Common/Utils/Rum/SessionReplayRecordingEnded.ts) over
-   * their chunk rows. The one helper behind both the list badge and the
-   * player's Live pill.
+   * the tab end facts readTabEndFactsBySession reads. The list badge's
+   * helper; getManifest reads the same facts itself because it also judges
+   * each tab, and applies the same rule to the same one read, so the list
+   * badge and the player's Live pill can never disagree about a session.
+   *
+   * Best-effort, like the read: a failure answers "nothing has ended".
+   */
+  private static async readRecordingEndedSessionIds(data: {
+    projectId: ObjectID;
+    rumApplicationId: ObjectID;
+    sessionIds: Array<string>;
+    /* Server unix ms the grace is measured against. */
+    nowUnixMs: number;
+  }): Promise<Set<string>> {
+    const endedSessionIds: Set<string> = new Set<string>();
+
+    const factsBySessionId: Map<
+      string,
+      Map<string, SessionReplayTabEndFacts>
+    > = await SessionReplayReadService.readTabEndFactsBySession({
+      projectId: data.projectId,
+      rumApplicationId: data.rumApplicationId,
+      sessionIds: data.sessionIds,
+    });
+
+    for (const [sessionId, tabEndFactsByTabId] of factsBySessionId) {
+      if (
+        hasSessionRecordingEnded(
+          Array.from(tabEndFactsByTabId.values()),
+          data.nowUnixMs,
+        )
+      ) {
+        endedSessionIds.add(sessionId);
+      }
+    }
+
+    return endedSessionIds;
+  }
+
+  /*
+   * The per-tab end facts of these sessions, keyed by sessionId and then
+   * tabId, for the shared rule in
+   * Common/Utils/Rum/SessionReplayRecordingEnded.ts. The one read behind
+   * the list badge, the player's Live pill and each manifest tab's own
+   * hasRecordingEnded.
    *
    * One statement for any number of sessions:
    *
@@ -2514,21 +2685,24 @@ export default class SessionReplayReadService {
    * rows' version against this process's Date.now()). The list, the player
    * and the finalizer therefore call a session ended at the same moment,
    * give or take the finalizer's one-minute schedule, and none of them
-   * depends on Redis for it.
+   * depends on Redis for it. The grace is judged by the callers; this read
+   * only returns the facts it is judged on.
    *
-   * Best-effort. A failure logs a warning and answers "nothing has ended",
-   * which is what the Dashboard showed before this existed; neither the
-   * list nor the manifest may fail because of it. A session with no chunk
-   * rows has no tabs, and no tabs is "not known", never "ended".
+   * Best-effort. Never rejects: a failure logs a warning and answers an
+   * empty map, which every caller reads as "nothing has ended" - what the
+   * Dashboard showed before this existed; neither the list nor the
+   * manifest may fail because of it. A session with no chunk rows is
+   * absent from the map, and no tabs is "not known", never "ended".
    */
-  private static async readRecordingEndedSessionIds(data: {
+  private static async readTabEndFactsBySession(data: {
     projectId: ObjectID;
     rumApplicationId: ObjectID;
     sessionIds: Array<string>;
-    /* Server unix ms the grace is measured against. */
-    nowUnixMs: number;
-  }): Promise<Set<string>> {
-    const endedSessionIds: Set<string> = new Set<string>();
+  }): Promise<Map<string, Map<string, SessionReplayTabEndFacts>>> {
+    const factsBySessionId: Map<
+      string,
+      Map<string, SessionReplayTabEndFacts>
+    > = new Map<string, Map<string, SessionReplayTabEndFacts>>();
 
     const sessionIds: Array<string> = Array.from(
       new Set<string>(
@@ -2539,7 +2713,7 @@ export default class SessionReplayReadService {
     );
 
     if (sessionIds.length === 0) {
-      return endedSessionIds;
+      return factsBySessionId;
     }
 
     const statement: Statement = SQL`
@@ -2586,14 +2760,10 @@ export default class SessionReplayReadService {
       );
       logger.warn(err);
 
-      return endedSessionIds;
+      return factsBySessionId;
     }
 
     const requested: Set<string> = new Set<string>(sessionIds);
-    const tabsBySessionId: Map<
-      string,
-      Array<SessionReplayTabEndFacts>
-    > = new Map<string, Array<SessionReplayTabEndFacts>>();
 
     for (const row of rows) {
       const sessionId: string = readString(row, "sessionId");
@@ -2603,37 +2773,28 @@ export default class SessionReplayReadService {
         continue;
       }
 
-      const tab: SessionReplayTabEndFacts = {
-        hasFinalChunk: readBoolean(row, TAB_HAS_FINAL_CHUNK_ALIAS),
-        finalChunkEndUnixMs: readMeasuredNumber(row, TAB_FINAL_CHUNK_END_ALIAS),
-        lastChunkStartUnixMs: readMeasuredNumber(
-          row,
-          TAB_LAST_CHUNK_START_ALIAS,
-        ),
-        maxChunkIndex: readMeasuredNumber(row, TAB_MAX_CHUNK_INDEX_ALIAS),
-        lastChunkStoredAtUnixMs: readMeasuredNumber(
-          row,
-          TAB_LAST_CHUNK_STORED_AT_ALIAS,
-        ),
-      };
+      const tabId: string = readString(row, "tabId");
+      const facts: SessionReplayTabEndFacts = readTabEndFacts(row);
 
-      const existing: Array<SessionReplayTabEndFacts> | undefined =
-        tabsBySessionId.get(sessionId);
+      let tabEndFactsByTabId:
+        | Map<string, SessionReplayTabEndFacts>
+        | undefined = factsBySessionId.get(sessionId);
 
-      if (existing) {
-        existing.push(tab);
-      } else {
-        tabsBySessionId.set(sessionId, [tab]);
+      if (!tabEndFactsByTabId) {
+        tabEndFactsByTabId = new Map<string, SessionReplayTabEndFacts>();
+        factsBySessionId.set(sessionId, tabEndFactsByTabId);
       }
-    }
 
-    for (const [sessionId, tabs] of tabsBySessionId) {
-      if (hasSessionRecordingEnded(tabs, data.nowUnixMs)) {
-        endedSessionIds.add(sessionId);
-      }
+      const existing: SessionReplayTabEndFacts | undefined =
+        tabEndFactsByTabId.get(tabId);
+
+      tabEndFactsByTabId.set(
+        tabId,
+        existing ? foldTabEndFacts(existing, facts) : facts,
+      );
     }
 
-    return endedSessionIds;
+    return factsBySessionId;
   }
 
   /*

package/Server/Utils/Slo/SloFeedUtil.ts

@@ -0,0 +1,200 @@
+import DatabaseBaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import User from "../../../Models/DatabaseModels/User";
+import URL from "../../../Types/API/URL";
+import ObjectID from "../../../Types/ObjectID";
+import { escapeMarkdownInline } from "../../../Utils/Markdown/MarkdownEscape";
+import UserService from "../../Services/UserService";
+
+/*
+ * The server-side half of the SLO feed: the few things a feed writer needs
+ * that touch the database or the process, kept out of the pure markdown
+ * module (Common/Utils/Slo/SloFeedMarkdown.ts) so that module stays importable
+ * anywhere.
+ */
+export default class SloFeedUtil {
+  /*
+   * SLO ids whose default burn rate rules are being seeded right now, counted
+   * so that an overlapping seed of the same id can never clear the flag early.
+   */
+  private static seedingSloIds: Map<string, number> = new Map<string, number>();
+
+  /*
+   * Runs `seed` while marking the SLO as "being seeded", so the burn rate rule
+   * service can tell the two rules OneUptime adds on create from rules a
+   * person adds later - the seeded pair is already described by the SLO's own
+   * "created" item and must not post two more items underneath it.
+   *
+   * Why this signal and not the create's props: seeding writes as root with
+   * no user, but so do workflows and other automations whose rules DO deserve
+   * an item, so "root and no user" would silently drop those. This signal is
+   * exact instead. Seeding runs inside the SLO's onCreateSuccess, before the
+   * create has returned, so no API caller can know the new SLO's id yet - any
+   * burn rate rule created for that id while the flag is set came from the
+   * create path itself. The flag is per process, which is enough: the seeding
+   * call and the rule's onCreateSuccess run in the same call stack.
+   */
+  public static async runWhileSeedingDefaultBurnRateRules<T>(data: {
+    sloId: ObjectID;
+    seed: () => Promise<T>;
+  }): Promise<T> {
+    const key: string = data.sloId.toString();
+
+    SloFeedUtil.seedingSloIds.set(
+      key,
+      (SloFeedUtil.seedingSloIds.get(key) || 0) + 1,
+    );
+
+    try {
+      return await data.seed();
+    } finally {
+      const remaining: number = (SloFeedUtil.seedingSloIds.get(key) || 1) - 1;
+
+      if (remaining <= 0) {
+        SloFeedUtil.seedingSloIds.delete(key);
+      } else {
+        SloFeedUtil.seedingSloIds.set(key, remaining);
+      }
+    }
+  }
+
+  public static isSeedingDefaultBurnRateRules(
+    sloId: ObjectID | undefined | null,
+  ): boolean {
+    if (!sloId) {
+      return false;
+    }
+
+    return SloFeedUtil.seedingSloIds.has(sloId.toString());
+  }
+
+  /*
+   * The caller's query pinned to the caller's project, for the reads a feed
+   * hook makes in onBeforeUpdate / onBeforeDelete.
+   *
+   * Both hooks run BEFORE DatabaseService applies the caller's permissions to
+   * the query, so the raw query read as root there can match rows in a
+   * project the caller cannot see. Those rows are never described - the
+   * writers only post for the ids the permission-checked write touched - but
+   * they should not be read either. Without a tenant (a root automation) the
+   * query already is the whole truth and is left exactly as it is.
+   */
+  public static getTenantPinnedQuery<TQuery>(data: {
+    query: TQuery;
+    tenantId: ObjectID | undefined | null;
+  }): TQuery {
+    if (!data.tenantId) {
+      return data.query;
+    }
+
+    return {
+      ...(data.query as unknown as Record<string, unknown>),
+      projectId: data.tenantId,
+    } as unknown as TQuery;
+  }
+
+  /*
+   * The rows a delete hook read up front, narrowed to the ones the delete
+   * really removed.
+   *
+   * onBeforeDelete reads before permissions are applied, and onDeleteSuccess
+   * still runs when the permission-checked delete matched nothing. Describing
+   * every row read up front would let a delete that names another project's
+   * row - and so deletes nothing - post "removed" onto that project's SLO
+   * feed in the caller's name. DatabaseService hands onDeleteSuccess the ids
+   * it actually deleted, so only those rows are described.
+   */
+  public static getRowsActuallyDeleted<TModel extends DatabaseBaseModel>(data: {
+    rows: Array<TModel>;
+    deletedIds: Array<ObjectID>;
+  }): Array<TModel> {
+    // Postgres renders uuids lower-case whatever case a caller wrote them in.
+    const deletedIds: Set<string> = new Set<string>(
+      data.deletedIds.map((id: ObjectID): string => {
+        return id.toString().toLowerCase();
+      }),
+    );
+
+    return data.rows.filter((row: TModel): boolean => {
+      const id: string | undefined = row.id?.toString().toLowerCase();
+
+      return id !== undefined && deletedIds.has(id);
+    });
+  }
+
+  /*
+   * "Jane Doe" - or the email when the user never set a name - escaped for
+   * the middle of a markdown sentence. Empty when the user has neither.
+   */
+  public static getUserDisplayName(user: User | null | undefined): string {
+    if (!user) {
+      return "";
+    }
+
+    const name: string = user.name?.toString().trim() || "";
+    const email: string = user.email?.toString().trim() || "";
+
+    return escapeMarkdownInline(name || email).trim();
+  }
+
+  /*
+   * `[Jane Doe](<dashboard link to the user>)` for the acting user of a feed
+   * item. UserService.getUserMarkdownString interpolates the name raw, and a
+   * user's name is theirs to set - `x](https://evil)` would re-point the link
+   * in every SLO feed they touch - so the SLO feed builds its own.
+   *
+   * Returns null when there is no such user, so callers can fall back to "no
+   * user" wording rather than printing an empty link.
+   */
+  public static async getUserMarkdown(data: {
+    userId: ObjectID | undefined | null;
+    projectId: ObjectID;
+  }): Promise<string | null> {
+    /*
+     * An undefined id is not a harmless lookup: the id key would drop out of
+     * the WHERE clause and match an arbitrary user.
+     */
+    if (!data.userId) {
+      return null;
+    }
+
+    const user: User | null = await UserService.findOneById({
+      id: data.userId,
+      select: {
+        name: true,
+        email: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!user) {
+      return null;
+    }
+
+    const displayName: string = SloFeedUtil.getUserDisplayName(user) || "User";
+
+    const link: URL = await UserService.getUserLinkInDashboard(
+      data.projectId,
+      data.userId,
+    );
+
+    return `[${displayName}](${link.toString()})`;
+  }
+
+  /*
+   * Built here from the dashboard URL rather than through MonitorService, which
+   * reaches back into the SLO services through the monitor rule engine.
+   */
+  public static getMonitorLinkInDashboard(data: {
+    dashboardUrl: URL;
+    projectId: ObjectID;
+    monitorId: ObjectID | string;
+  }): string {
+    return URL.fromString(data.dashboardUrl.toString())
+      .addRoute(
+        `/${data.projectId.toString()}/monitors/${data.monitorId.toString()}`,
+      )
+      .toString();
+  }
+}