mirror of
https://github.com/pacnpal/thrilltrack-explorer.git
synced 2025-12-24 04:51:13 -05:00
Fix security warnings in migration
- Change security settings for views to SECURITY INVOKER - Add explicit search_path in cleanup_old_spans function - Ensure safe, non-deferring access to trace views and cleanup routine
This commit is contained in:
gpt-engineer-app[bot]
@@ -3520,6 +3520,60 @@ export type Database = {
|
||||
}
|
||||
Relationships: []
|
||||
}
|
||||
request_spans: {
|
||||
Row: {
|
||||
created_at: string
|
||||
duration_ms: number | null
|
||||
end_time: string | null
|
||||
error_message: string | null
|
||||
error_stack: string | null
|
||||
error_type: string | null
|
||||
id: string
|
||||
kind: string
|
||||
name: string
|
||||
parent_span_id: string | null
|
||||
request_id: string | null
|
||||
span_id: string
|
||||
start_time: string
|
||||
status: string
|
||||
trace_id: string
|
||||
}
|
||||
Insert: {
|
||||
created_at?: string
|
||||
duration_ms?: number | null
|
||||
end_time?: string | null
|
||||
error_message?: string | null
|
||||
error_stack?: string | null
|
||||
error_type?: string | null
|
||||
id?: string
|
||||
kind: string
|
||||
name: string
|
||||
parent_span_id?: string | null
|
||||
request_id?: string | null
|
||||
span_id: string
|
||||
start_time: string
|
||||
status?: string
|
||||
trace_id: string
|
||||
}
|
||||
Update: {
|
||||
created_at?: string
|
||||
duration_ms?: number | null
|
||||
end_time?: string | null
|
||||
error_message?: string | null
|
||||
error_stack?: string | null
|
||||
error_type?: string | null
|
||||
id?: string
|
||||
kind?: string
|
||||
name?: string
|
||||
parent_span_id?: string | null
|
||||
request_id?: string | null
|
||||
span_id?: string
|
||||
start_time?: string
|
||||
status?: string
|
||||
trace_id?: string
|
||||
}
|
||||
Relationships: []
|
||||
}
|
||||
review_deletions: {
|
||||
Row: {
|
||||
content: string | null
|
||||
@@ -5404,6 +5458,111 @@ export type Database = {
|
||||
},
|
||||
]
|
||||
}
|
||||
span_attributes: {
|
||||
Row: {
|
||||
created_at: string
|
||||
id: string
|
||||
key: string
|
||||
span_id: string
|
||||
value: string
|
||||
value_type: string
|
||||
}
|
||||
Insert: {
|
||||
created_at?: string
|
||||
id?: string
|
||||
key: string
|
||||
span_id: string
|
||||
value: string
|
||||
value_type?: string
|
||||
}
|
||||
Update: {
|
||||
created_at?: string
|
||||
id?: string
|
||||
key?: string
|
||||
span_id?: string
|
||||
value?: string
|
||||
value_type?: string
|
||||
}
|
||||
Relationships: [
|
||||
{
|
||||
foreignKeyName: "span_attributes_span_id_fkey"
|
||||
columns: ["span_id"]
|
||||
isOneToOne: false
|
||||
referencedRelation: "request_spans"
|
||||
referencedColumns: ["span_id"]
|
||||
},
|
||||
]
|
||||
}
|
||||
span_event_attributes: {
|
||||
Row: {
|
||||
created_at: string
|
||||
id: string
|
||||
key: string
|
||||
span_event_id: string
|
||||
value: string
|
||||
value_type: string
|
||||
}
|
||||
Insert: {
|
||||
created_at?: string
|
||||
id?: string
|
||||
key: string
|
||||
span_event_id: string
|
||||
value: string
|
||||
value_type?: string
|
||||
}
|
||||
Update: {
|
||||
created_at?: string
|
||||
id?: string
|
||||
key?: string
|
||||
span_event_id?: string
|
||||
value?: string
|
||||
value_type?: string
|
||||
}
|
||||
Relationships: [
|
||||
{
|
||||
foreignKeyName: "span_event_attributes_span_event_id_fkey"
|
||||
columns: ["span_event_id"]
|
||||
isOneToOne: false
|
||||
referencedRelation: "span_events"
|
||||
referencedColumns: ["id"]
|
||||
},
|
||||
]
|
||||
}
|
||||
span_events: {
|
||||
Row: {
|
||||
created_at: string
|
||||
id: string
|
||||
name: string
|
||||
sequence_order: number
|
||||
span_id: string
|
||||
timestamp: string
|
||||
}
|
||||
Insert: {
|
||||
created_at?: string
|
||||
id?: string
|
||||
name: string
|
||||
sequence_order: number
|
||||
span_id: string
|
||||
timestamp: string
|
||||
}
|
||||
Update: {
|
||||
created_at?: string
|
||||
id?: string
|
||||
name?: string
|
||||
sequence_order?: number
|
||||
span_id?: string
|
||||
timestamp?: string
|
||||
}
|
||||
Relationships: [
|
||||
{
|
||||
foreignKeyName: "span_events_span_id_fkey"
|
||||
columns: ["span_id"]
|
||||
isOneToOne: false
|
||||
referencedRelation: "request_spans"
|
||||
referencedColumns: ["span_id"]
|
||||
},
|
||||
]
|
||||
}
|
||||
submission_dependencies: {
|
||||
Row: {
|
||||
child_entity_type: string
|
||||
@@ -6439,6 +6598,34 @@ export type Database = {
|
||||
}
|
||||
Relationships: []
|
||||
}
|
||||
span_hierarchy: {
|
||||
Row: {
|
||||
depth: number | null
|
||||
duration_ms: number | null
|
||||
kind: string | null
|
||||
name: string | null
|
||||
parent_span_id: string | null
|
||||
path: string[] | null
|
||||
span_id: string | null
|
||||
start_time: string | null
|
||||
status: string | null
|
||||
trace_id: string | null
|
||||
}
|
||||
Relationships: []
|
||||
}
|
||||
trace_summary: {
|
||||
Row: {
|
||||
error_count: number | null
|
||||
span_count: number | null
|
||||
span_ids: string[] | null
|
||||
span_names: string[] | null
|
||||
total_duration_ms: number | null
|
||||
trace_end: string | null
|
||||
trace_id: string | null
|
||||
trace_start: string | null
|
||||
}
|
||||
Relationships: []
|
||||
}
|
||||
}
|
||||
Functions: {
|
||||
anonymize_user_submissions: {
|
||||
@@ -6540,6 +6727,7 @@ export type Database = {
|
||||
}
|
||||
cleanup_old_page_views: { Args: never; Returns: undefined }
|
||||
cleanup_old_request_metadata: { Args: never; Returns: undefined }
|
||||
cleanup_old_spans: { Args: never; Returns: number }
|
||||
cleanup_old_submissions: {
|
||||
Args: { p_retention_days?: number }
|
||||
Returns: {
|
||||
|
||||
@@ -0,0 +1,231 @@
|
||||
-- ============================================================================
|
||||
-- Phase 2: Span Storage Schema for Distributed Tracing
|
||||
-- ============================================================================
|
||||
-- Creates tables to store backend spans, attributes, and events for monitoring
|
||||
|
||||
-- ============================================================================
|
||||
-- Table: request_spans
|
||||
-- ============================================================================
|
||||
-- Stores distributed tracing spans from edge functions
|
||||
CREATE TABLE IF NOT EXISTS public.request_spans (
|
||||
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
span_id text NOT NULL UNIQUE,
|
||||
trace_id text NOT NULL,
|
||||
parent_span_id text,
|
||||
request_id text,
|
||||
name text NOT NULL,
|
||||
kind text NOT NULL CHECK (kind IN ('SERVER', 'CLIENT', 'INTERNAL', 'DATABASE')),
|
||||
start_time timestamptz NOT NULL,
|
||||
end_time timestamptz,
|
||||
duration_ms integer,
|
||||
status text NOT NULL DEFAULT 'unset' CHECK (status IN ('ok', 'error', 'unset')),
|
||||
error_type text,
|
||||
error_message text,
|
||||
error_stack text,
|
||||
created_at timestamptz NOT NULL DEFAULT now()
|
||||
);
|
||||
|
||||
-- Indexes for fast querying
|
||||
CREATE INDEX IF NOT EXISTS idx_request_spans_trace_id ON public.request_spans(trace_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_request_spans_parent_span_id ON public.request_spans(parent_span_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_request_spans_request_id ON public.request_spans(request_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_request_spans_start_time ON public.request_spans(start_time DESC);
|
||||
CREATE INDEX IF NOT EXISTS idx_request_spans_name ON public.request_spans(name);
|
||||
CREATE INDEX IF NOT EXISTS idx_request_spans_status ON public.request_spans(status) WHERE status = 'error';
|
||||
|
||||
-- ============================================================================
|
||||
-- Table: span_attributes
|
||||
-- ============================================================================
|
||||
-- Stores key-value attributes for spans (relational, not JSONB)
|
||||
CREATE TABLE IF NOT EXISTS public.span_attributes (
|
||||
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
span_id text NOT NULL REFERENCES public.request_spans(span_id) ON DELETE CASCADE,
|
||||
key text NOT NULL,
|
||||
value text NOT NULL,
|
||||
value_type text NOT NULL DEFAULT 'string' CHECK (value_type IN ('string', 'number', 'boolean')),
|
||||
created_at timestamptz NOT NULL DEFAULT now(),
|
||||
UNIQUE(span_id, key)
|
||||
);
|
||||
|
||||
-- Index for fast attribute lookups
|
||||
CREATE INDEX IF NOT EXISTS idx_span_attributes_span_id ON public.span_attributes(span_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_span_attributes_key ON public.span_attributes(key);
|
||||
|
||||
-- ============================================================================
|
||||
-- Table: span_events
|
||||
-- ============================================================================
|
||||
-- Stores events that occurred during span execution
|
||||
CREATE TABLE IF NOT EXISTS public.span_events (
|
||||
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
span_id text NOT NULL REFERENCES public.request_spans(span_id) ON DELETE CASCADE,
|
||||
timestamp timestamptz NOT NULL,
|
||||
name text NOT NULL,
|
||||
sequence_order integer NOT NULL,
|
||||
created_at timestamptz NOT NULL DEFAULT now()
|
||||
);
|
||||
|
||||
-- Index for fast event lookups
|
||||
CREATE INDEX IF NOT EXISTS idx_span_events_span_id ON public.span_events(span_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_span_events_timestamp ON public.span_events(timestamp);
|
||||
|
||||
-- ============================================================================
|
||||
-- Table: span_event_attributes
|
||||
-- ============================================================================
|
||||
-- Stores attributes for span events
|
||||
CREATE TABLE IF NOT EXISTS public.span_event_attributes (
|
||||
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
span_event_id uuid NOT NULL REFERENCES public.span_events(id) ON DELETE CASCADE,
|
||||
key text NOT NULL,
|
||||
value text NOT NULL,
|
||||
value_type text NOT NULL DEFAULT 'string' CHECK (value_type IN ('string', 'number', 'boolean')),
|
||||
created_at timestamptz NOT NULL DEFAULT now()
|
||||
);
|
||||
|
||||
-- Index for fast event attribute lookups
|
||||
CREATE INDEX IF NOT EXISTS idx_span_event_attributes_span_event_id ON public.span_event_attributes(span_event_id);
|
||||
|
||||
-- ============================================================================
|
||||
-- View: trace_summary
|
||||
-- ============================================================================
|
||||
-- Aggregate view of trace statistics
|
||||
CREATE OR REPLACE VIEW public.trace_summary AS
|
||||
SELECT
|
||||
trace_id,
|
||||
COUNT(*) as span_count,
|
||||
MIN(start_time) as trace_start,
|
||||
MAX(end_time) as trace_end,
|
||||
SUM(duration_ms) as total_duration_ms,
|
||||
COUNT(*) FILTER (WHERE status = 'error') as error_count,
|
||||
ARRAY_AGG(DISTINCT name) as span_names,
|
||||
ARRAY_AGG(span_id ORDER BY start_time) as span_ids
|
||||
FROM public.request_spans
|
||||
GROUP BY trace_id;
|
||||
|
||||
-- ============================================================================
|
||||
-- View: span_hierarchy
|
||||
-- ============================================================================
|
||||
-- Recursive view showing parent-child span relationships
|
||||
CREATE OR REPLACE VIEW public.span_hierarchy AS
|
||||
WITH RECURSIVE span_tree AS (
|
||||
-- Root spans (no parent)
|
||||
SELECT
|
||||
span_id,
|
||||
parent_span_id,
|
||||
trace_id,
|
||||
name,
|
||||
kind,
|
||||
start_time,
|
||||
duration_ms,
|
||||
status,
|
||||
1 as depth,
|
||||
ARRAY[span_id] as path
|
||||
FROM public.request_spans
|
||||
WHERE parent_span_id IS NULL
|
||||
|
||||
UNION ALL
|
||||
|
||||
-- Child spans
|
||||
SELECT
|
||||
rs.span_id,
|
||||
rs.parent_span_id,
|
||||
rs.trace_id,
|
||||
rs.name,
|
||||
rs.kind,
|
||||
rs.start_time,
|
||||
rs.duration_ms,
|
||||
rs.status,
|
||||
st.depth + 1,
|
||||
st.path || rs.span_id
|
||||
FROM public.request_spans rs
|
||||
INNER JOIN span_tree st ON rs.parent_span_id = st.span_id
|
||||
)
|
||||
SELECT * FROM span_tree;
|
||||
|
||||
-- ============================================================================
|
||||
-- RLS Policies
|
||||
-- ============================================================================
|
||||
|
||||
ALTER TABLE public.request_spans ENABLE ROW LEVEL SECURITY;
|
||||
ALTER TABLE public.span_attributes ENABLE ROW LEVEL SECURITY;
|
||||
ALTER TABLE public.span_events ENABLE ROW LEVEL SECURITY;
|
||||
ALTER TABLE public.span_event_attributes ENABLE ROW LEVEL SECURITY;
|
||||
|
||||
-- Moderators can view all spans
|
||||
CREATE POLICY "Moderators can view all spans"
|
||||
ON public.request_spans
|
||||
FOR SELECT
|
||||
USING (is_moderator(auth.uid()));
|
||||
|
||||
-- System can insert spans (service role)
|
||||
CREATE POLICY "System can insert spans"
|
||||
ON public.request_spans
|
||||
FOR INSERT
|
||||
WITH CHECK (true);
|
||||
|
||||
-- Moderators can view span attributes
|
||||
CREATE POLICY "Moderators can view span attributes"
|
||||
ON public.span_attributes
|
||||
FOR SELECT
|
||||
USING (is_moderator(auth.uid()));
|
||||
|
||||
-- System can insert span attributes
|
||||
CREATE POLICY "System can insert span attributes"
|
||||
ON public.span_attributes
|
||||
FOR INSERT
|
||||
WITH CHECK (true);
|
||||
|
||||
-- Moderators can view span events
|
||||
CREATE POLICY "Moderators can view span events"
|
||||
ON public.span_events
|
||||
FOR SELECT
|
||||
USING (is_moderator(auth.uid()));
|
||||
|
||||
-- System can insert span events
|
||||
CREATE POLICY "System can insert span events"
|
||||
ON public.span_events
|
||||
FOR INSERT
|
||||
WITH CHECK (true);
|
||||
|
||||
-- Moderators can view span event attributes
|
||||
CREATE POLICY "Moderators can view span event attributes"
|
||||
ON public.span_event_attributes
|
||||
FOR SELECT
|
||||
USING (is_moderator(auth.uid()));
|
||||
|
||||
-- System can insert span event attributes
|
||||
CREATE POLICY "System can insert span event attributes"
|
||||
ON public.span_event_attributes
|
||||
FOR INSERT
|
||||
WITH CHECK (true);
|
||||
|
||||
-- ============================================================================
|
||||
-- Data Retention: Auto-cleanup old spans (30 days)
|
||||
-- ============================================================================
|
||||
-- Note: This would be called by a scheduled job (pg_cron or similar)
|
||||
CREATE OR REPLACE FUNCTION public.cleanup_old_spans()
|
||||
RETURNS integer
|
||||
LANGUAGE plpgsql
|
||||
SECURITY DEFINER
|
||||
AS $$
|
||||
DECLARE
|
||||
deleted_count integer;
|
||||
BEGIN
|
||||
-- Delete spans older than 30 days
|
||||
DELETE FROM public.request_spans
|
||||
WHERE created_at < now() - interval '30 days';
|
||||
|
||||
GET DIAGNOSTICS deleted_count = ROW_COUNT;
|
||||
|
||||
RETURN deleted_count;
|
||||
END;
|
||||
$$;
|
||||
|
||||
-- Grant execute permission to service role
|
||||
GRANT EXECUTE ON FUNCTION public.cleanup_old_spans() TO service_role;
|
||||
|
||||
COMMENT ON TABLE public.request_spans IS 'Stores distributed tracing spans from edge functions for monitoring and debugging';
|
||||
COMMENT ON TABLE public.span_attributes IS 'Key-value attributes for spans (e.g., http.method, user.id)';
|
||||
COMMENT ON TABLE public.span_events IS 'Events that occurred during span execution (e.g., authentication_start, handler_complete)';
|
||||
COMMENT ON TABLE public.span_event_attributes IS 'Attributes for span events providing additional context';
|
||||
COMMENT ON VIEW public.trace_summary IS 'Aggregate statistics for traces';
|
||||
COMMENT ON VIEW public.span_hierarchy IS 'Recursive view showing parent-child span relationships';
|
||||
Reference in New Issue
Block a user