Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .server-changes/remove-unused-trace-sync-route.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
---
area: webapp
type: fix
---

Removed an unused internal dashboard sync route that is no longer part of any product surface.
95 changes: 0 additions & 95 deletions apps/webapp/app/routes/sync.traces.$traceId.ts

This file was deleted.

117 changes: 0 additions & 117 deletions apps/webapp/app/routes/sync.traces.runs.$traceId.ts

This file was deleted.

44 changes: 0 additions & 44 deletions apps/webapp/app/v3/electricShape.server.ts
Original file line number Diff line number Diff line change
@@ -1,47 +1,3 @@
import { z } from "zod";

/**
* OTel trace IDs are 32 lowercase hex chars. The traceparent parser only
* checks the dash-delimited format, so crafted ids can be persisted and later
* interpolated into shape `where` clauses. Validate here to close the SQLi vector.
*/
export const OtelTraceIdSchema = z
.string()
.regex(/^[0-9a-f]{32}$/, "traceId must be 32 lowercase hex characters");

/** Params the sync routes set themselves; stripped from incoming requests. */
export const RESERVED_ELECTRIC_SHAPE_PARAMS = new Set(["where", "table", "columns"]);

const CUID_LIKE = /^[a-z][a-z0-9_]*$/i;

/**
* Tenant column a trace shape is scoped by. TaskEvent scopes by non-null
* organizationId; TaskRun scopes by non-null projectId (its organizationId is
* nullable). The column is from this fixed union, never user input, so it's
* safe to interpolate.
*/
export type TraceScope =
| { column: "organizationId"; id: string }
| { column: "projectId"; id: string };

/**
* Build the Electric Shape `where` clause for the trace sync routes. Both ids
* are re-validated as defense-in-depth so a missed call site can't bypass scope.
*/
export function buildElectricTraceWhereClause(args: {
traceId: string;
scope: TraceScope;
}): string {
const { traceId, scope } = args;
if (!OtelTraceIdSchema.safeParse(traceId).success) {
throw new Error("buildElectricTraceWhereClause: unsafe traceId");
}
if (!CUID_LIKE.test(scope.id)) {
throw new Error("buildElectricTraceWhereClause: unsafe scope id");
}
return `"traceId"='${traceId}' AND "${scope.column}"='${scope.id}'`;
}

/**
* Characters rejected in realtime tag values — the single source of truth
* shared by the apiBuilder Zod refine (`realtime.v1.runs.ts`) and the runtime
Expand Down
Loading