Merge branch 'main' into dan/hdx-2622-refactor-tasks

Author: dhable

.changeset/angry-scissors-flow.md

@@ -0,0 +1,5 @@
+---
+"@hyperdx/app": patch
+---
+
+fix: memoize inputs to fix text input performance

.changeset/fluffy-mails-sparkle.md

@@ -0,0 +1,6 @@
+---
+"@hyperdx/common-utils": patch
+"@hyperdx/app": patch
+---
+
+feat: Optimize and fix filtering on toStartOfX primary key expressions

.changeset/happy-spies-tickle.md

@@ -0,0 +1,5 @@
+---
+"@hyperdx/app": patch
+---
+
+improve drawer a11y

.changeset/kind-hotels-arrive.md

@@ -0,0 +1,6 @@
+---
+"@hyperdx/api": patch
+"@hyperdx/app": patch
+---
+
+feat: allow specifying webhook request headers

.changeset/soft-donkeys-fetch.md

@@ -0,0 +1,5 @@
+---
+"@hyperdx/app": patch
+---
+
+feat: Implement query chunking for charts

.changeset/sweet-vans-pump.md

@@ -0,0 +1,5 @@
+---
+"@hyperdx/common-utils": patch
+---
+
+perf: Improve getKeyValues query performance for JSON keys

.changeset/twelve-beers-buy.md

@@ -0,0 +1,5 @@
+---
+"@hyperdx/app": patch
+---
+
+feat: Include displayed timestamp in default order by

.changeset/wise-horses-swim.md

@@ -0,0 +1,5 @@
+---
+"@hyperdx/app": patch
+---
+
+avoid hydration errors when app loads if nav is collapsed

Makefile

@@ -45,10 +45,16 @@ dev-int:
 	npx nx run @hyperdx/api:dev:int $(FILE)
 	docker compose -p int -f ./docker-compose.ci.yml down
 
+.PHONY: dev-int-common-utils
+dev-int-common-utils:
+	docker compose -p int -f ./docker-compose.ci.yml up -d
+	npx nx run @hyperdx/common-utils:dev:int $(FILE)
+	docker compose -p int -f ./docker-compose.ci.yml down
+
 .PHONY: ci-int
 ci-int:
 	docker compose -p int -f ./docker-compose.ci.yml up -d
-	npx nx run @hyperdx/api:ci:int
+	npx nx run-many -t ci:int --parallel=false
 	docker compose -p int -f ./docker-compose.ci.yml down
 
 .PHONY: dev-unit

packages/api/src/routers/api/__tests__/webhooks.test.ts

@@ -180,4 +180,226 @@ describe('webhooks router', () => {
 
     await agent.delete('/webhooks/invalid-id').expect(400);
   });
+
+  describe('Header validation', () => {
+    it('POST / - accepts valid header names', async () => {
+      const { agent } = await getLoggedInAgent(server);
+
+      const validHeaders = {
+        'Content-Type': 'application/json',
+        Authorization: 'Bearer token',
+        'X-Custom-Header': 'value',
+        'User-Agent': 'test',
+        'x-api-key': 'secret',
+        'custom!header#test': 'value',
+      };
+
+      const response = await agent
+        .post('/webhooks')
+        .send({
+          ...MOCK_WEBHOOK,
+          url: 'https://example.com/valid-headers',
+          headers: validHeaders,
+        })
+        .expect(200);
+
+      expect(response.body.data.headers).toMatchObject(validHeaders);
+    });
+
+    it('POST / - rejects header names starting with numbers', async () => {
+      const { agent } = await getLoggedInAgent(server);
+
+      const response = await agent
+        .post('/webhooks')
+        .send({
+          ...MOCK_WEBHOOK,
+          url: 'https://example.com/invalid-header-name',
+          headers: {
+            '123Invalid': 'value',
+          },
+        })
+        .expect(400);
+
+      expect(Array.isArray(response.body)).toBe(true);
+      expect(response.body[0].type).toBe('Body');
+      expect(response.body[0].errors).toBeDefined();
+    });
+
+    it('POST / - rejects empty header names', async () => {
+      const { agent } = await getLoggedInAgent(server);
+
+      const response = await agent
+        .post('/webhooks')
+        .send({
+          ...MOCK_WEBHOOK,
+          url: 'https://example.com/empty-header-name',
+          headers: {
+            '': 'value',
+          },
+        })
+        .expect(400);
+
+      expect(Array.isArray(response.body)).toBe(true);
+      expect(response.body[0].type).toBe('Body');
+      expect(response.body[0].errors).toBeDefined();
+    });
+
+    it('POST / - rejects header names with invalid characters', async () => {
+      const { agent } = await getLoggedInAgent(server);
+
+      const invalidHeaderNames = [
+        { 'Header Name': 'value' }, // space
+        { 'Header\nName': 'value' }, // newline
+        { 'Header\rName': 'value' }, // carriage return
+        { 'Header\tName': 'value' }, // tab
+        { 'Header@Name': 'value' }, // @ not allowed
+        { 'Header[Name]': 'value' }, // brackets not allowed
+      ];
+
+      for (const headers of invalidHeaderNames) {
+        const response = await agent
+          .post('/webhooks')
+          .send({
+            ...MOCK_WEBHOOK,
+            url: `https://example.com/invalid-header-${Math.random()}`,
+            headers,
+          })
+          .expect(400);
+
+        expect(Array.isArray(response.body)).toBe(true);
+        expect(response.body[0].type).toBe('Body');
+        expect(response.body[0].errors).toBeDefined();
+      }
+    });
+
+    it('POST / - accepts valid header values', async () => {
+      const { agent } = await getLoggedInAgent(server);
+
+      const validHeaders = {
+        Authorization: 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9',
+        'Content-Type': 'application/json; charset=utf-8',
+        'X-Api-Key': 'abc123-def456-ghi789',
+        'User-Agent': 'Mozilla/5.0 (compatible; TestBot/1.0)',
+        'Custom-Header': 'value with spaces and special chars: !@#$%^&*()',
+      };
+
+      const response = await agent
+        .post('/webhooks')
+        .send({
+          ...MOCK_WEBHOOK,
+          url: 'https://example.com/valid-header-values',
+          headers: validHeaders,
+        })
+        .expect(200);
+
+      expect(response.body.data.headers).toMatchObject(validHeaders);
+    });
+
+    it('POST / - rejects header values with CRLF injection', async () => {
+      const { agent } = await getLoggedInAgent(server);
+
+      const response = await agent
+        .post('/webhooks')
+        .send({
+          ...MOCK_WEBHOOK,
+          url: 'https://example.com/crlf-injection',
+          headers: {
+            'X-Custom-Header': 'value\r\nX-Injected-Header: malicious',
+          },
+        })
+        .expect(400);
+
+      expect(Array.isArray(response.body)).toBe(true);
+      expect(response.body[0].type).toBe('Body');
+      expect(response.body[0].errors).toBeDefined();
+    });
+
+    it('POST / - rejects header values with tab characters', async () => {
+      const { agent } = await getLoggedInAgent(server);
+
+      const response = await agent
+        .post('/webhooks')
+        .send({
+          ...MOCK_WEBHOOK,
+          url: 'https://example.com/tab-injection',
+          headers: {
+            'X-Custom-Header': 'value\twith\ttabs',
+          },
+        })
+        .expect(400);
+
+      expect(Array.isArray(response.body)).toBe(true);
+      expect(response.body[0].type).toBe('Body');
+      expect(response.body[0].errors).toBeDefined();
+    });
+
+    it('POST / - rejects header values with control characters', async () => {
+      const { agent } = await getLoggedInAgent(server);
+
+      // Test various control characters
+      const controlCharTests = [
+        '\x00', // null
+        '\x01', // start of heading
+        '\x0B', // vertical tab
+        '\x0C', // form feed
+        '\x1F', // unit separator
+        '\x7F', // delete
+      ];
+
+      for (const controlChar of controlCharTests) {
+        const response = await agent
+          .post('/webhooks')
+          .send({
+            ...MOCK_WEBHOOK,
+            url: `https://example.com/control-char-${Math.random()}`,
+            headers: {
+              'X-Custom-Header': `value${controlChar}test`,
+            },
+          })
+          .expect(400);
+
+        expect(Array.isArray(response.body)).toBe(true);
+        expect(response.body[0].type).toBe('Body');
+        expect(response.body[0].errors).toBeDefined();
+      }
+    });
+
+    it('POST / - rejects header values with newline characters', async () => {
+      const { agent } = await getLoggedInAgent(server);
+
+      const response = await agent
+        .post('/webhooks')
+        .send({
+          ...MOCK_WEBHOOK,
+          url: 'https://example.com/newline-injection',
+          headers: {
+            'X-Custom-Header': 'value\nwith\nnewlines',
+          },
+        })
+        .expect(400);
+
+      expect(Array.isArray(response.body)).toBe(true);
+      expect(response.body[0].type).toBe('Body');
+      expect(response.body[0].errors).toBeDefined();
+    });
+
+    it('POST / - rejects header values with carriage return characters', async () => {
+      const { agent } = await getLoggedInAgent(server);
+
+      const response = await agent
+        .post('/webhooks')
+        .send({
+          ...MOCK_WEBHOOK,
+          url: 'https://example.com/carriage-return-injection',
+          headers: {
+            'X-Custom-Header': 'value\rwith\rcarriage\rreturns',
+          },
+        })
+        .expect(400);
+
+      expect(Array.isArray(response.body)).toBe(true);
+      expect(response.body[0].type).toBe('Body');
+      expect(response.body[0].errors).toBeDefined();
+    });
+  });
 });