## Summary
- Enhanced existing scheduled pipeline query builder tests with exact
default query format assertions (`max(_timestamp)`, `count(_timestamp)`,
`histogram(_timestamp)`)
- Added new P2 test verifying Run Query button transitions from disabled
to enabled after stream selection and default query population
- Verifies behavior described in Issue #11575
## Test plan
- [x] All 4 tests pass (verified on test environment)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
## What changed
Fixed `addFieldTerm` in `SearchBar.vue` so that include/exclude search
terms are inserted at the correct position in SQL aggregation queries.
Previously the code checked for `ORDER BY` before `GROUP BY`, causing
the injected `WHERE` clause to land after `GROUP BY` (invalid SQL). The
fix scans all terminating clauses (`GROUP BY`, `HAVING`, `ORDER BY`,
`LIMIT`) and inserts `WHERE` before whichever appears earliest. The
remaining diff is Prettier-driven reformatting with no logic changes.
## Why
The old sequential `if/else if` checked `ORDER BY` first. On a query
containing both `GROUP BY` and `ORDER BY`, it would split at `ORDER BY`
and produce `… WHERE <filter> ORDER BY … GROUP BY …` — structurally
invalid SQL. The fix enforces correct SQL clause ordering (`FROM → WHERE
→ GROUP BY → HAVING → ORDER BY → LIMIT`).
## Approach
The new algorithm iterates over all four terminating clauses, records
the index of each that is present, picks the one with the smallest index
(`firstClause`), then uses the existing `queryIndexSplit` utility to
splice the `WHERE <filter>` token in before it. If no terminating clause
exists the filter is appended. The spec file was extended with 14 new
unit tests covering the core bug scenario (GROUP BY + ORDER BY
together), each individual clause in isolation, all-clauses-present,
AND-append paths, and edge cases (case-insensitive matching, column
names containing clause keywords, special characters in filter values).
## Risk
The logic change is isolated to the `else` branch of `addFieldTerm` that
handles queries with no existing `WHERE` clause. Queries that already
have a `WHERE` clause follow a separate code path and are unaffected.
Reviewers should confirm the `queryIndexSplit` utility is
case-insensitive-safe (the fix lowercases only for the index scan, then
splits the original string) and verify the preserved trailing
`afterClause` string includes the space/newline that was previously part
of the `" order by"` / `" group by"` literals.
## Summary
- Add API tests verifying that stream settings fields (index_fields,
bloom_filter_fields, full_text_search_keys) are deduplicated when the
same field is added multiple times
- Tests cover: single field dedup, multiple fields, repeated adds (4x),
remove+re-add, empty payloads, and partial updates
- All tests use existing schema fields from the seed data stream
(`stream_pytest_data`)
## Test plan
- [x] All 10 tests pass against testing environment
- Tests run via `cd tests/api-testing && rye run pytest
tests/test_stream_settings_dedup.py -v`
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
Three fixes in alertCreationWizard.js:
- Align threshold operator dropdown with working SQL method pattern
(q-field__control click + role-based option + q-menu fallback)
- Narrow portal cleanup from all q-portal to q-portal--dialog only to
avoid hiding new dropdown menus
- Fix _switchToTab to target v3 inner tab divs instead of wrapper
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
- API-first methods in alertTemplatesPage.js (_findTemplateViaApi,
createTemplateViaApi, deleteTemplateViaApi) to bypass fragile UI
pagination
- API-first destination lookup in alertDestinationsPage.js
(findDestinationViaApi) resolves cascade failure
- v3-compatible locators for alert type dropdown, condition operators,
deduplication flow in alertCreationWizard.js
- Self-contained test pattern with per-test random suffixes and no
shared state
- URL-based navigation with menu fallback for templates and destinations
pages
- q-portal cleanup before click interactions to prevent interception
- Conditional enterprise feature guards at runtime
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
## Summary
- In `playwright_summary`, `merge_and_upload_reports` result of
`failure` is now treated as non-blocking (same as `success`/`skipped`)
- The Playwright summary check will pass even if the TestDino
merge/upload job fails (e.g. network issues, bad token, API outage)
- Actual test results (`build_binary`, `ui_integration_tests`) still
gate the summary as before
## Why
The TestDino upload is observability/reporting infrastructure — it
should never cause a PR's required check to fail when the tests
themselves passed. Previously a transient TestDino failure would block
merges.
## Test plan
- [ ] Verify `playwright_summary` passes when `merge_and_upload_reports`
succeeds (existing behavior)
- [ ] Verify `playwright_summary` passes when `merge_and_upload_reports`
fails (new behavior)
- [ ] Verify `playwright_summary` still fails when
`ui_integration_tests` fails (unchanged)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
- The alpha AKS environment (`alpha.o2aks1.internal.zinclabs.dev`) has a
transparent overlay on the Dex login page that intercepts the submit
button click in `global-setup-alpha1.js`
- This caused all 13 CI shards to fail — global setup timed out on the
30s click wait, preventing any tests from running
- Root cause: `submitButton.click()` found the button visible and stable
but the click was intercepted, so it hung for the full 30000ms timeout
- Fix: add `{ force: true }` to bypass the overlay, with an `Enter` key
fallback if force-click is also blocked
- Verified locally: login completes successfully, 2 cloudLogin tests
pass
## Test plan
- [x] Run `cloudLogin.spec.js` locally against alpha — 2/2 passed
- [ ] Trigger full alpha1 CI run to confirm all 13 shards pass
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Shrinath Rao <undefined@users.noreply.github.com>
## Summary
- Fixed `patternCardDetailsIcon` selector in the page object — the
details icon button was removed from `PatternCard.vue` in PR #11314, so
the test now clicks the card row itself (`pattern-card-N`) which is the
current UX for opening pattern details.
- Added a 15-second grace period in `waitForPatternsToLoad` before
accepting "empty" as the final result. The backend can return "No
patterns found" before async pattern extraction completes, causing the
P0 duplicate-patterns test to fail when patterns exist but haven't been
extracted yet.
## Test plan
- [x] Ran `searchPatterns.spec.js` full suite locally — **15/15 passed**
(was 10 passed, 1 failed, 4 skipped)
- [x] Ran failing test individually — passes
- [x] Verified no regressions in other tests using
`clickPatternDetailsIcon`
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
## Summary
- **Root cause**: `keyboard.type()` types code char-by-char into Monaco
editor. When typing `{`, Monaco auto-inserts `}`. With nested blocks (3
levels in JS row-expansion code), this creates 3 extra closing braces →
invalid JS → QuickJS compilation failure.
- **Fix**: Replace `keyboard.type()` with clipboard paste
(`navigator.clipboard.writeText` + `Ctrl+V`) in `enterFunctionCode()`.
Pasting inserts text as a single operation, bypassing Monaco's
auto-close bracket behavior.
- All 6 row-expansion tests pass locally after this fix.
## Test plan
- [x] Run `row-expansion.spec.js` locally — all 6 tests pass
- [ ] CI passes on this PR
## Summary
- Migrate `landingPage.spec.js` and `languageTranslation.spec.js`
(GeneralTests) for alpha1 cloud compatibility
- Migrate `alerts-regression.spec.js` and `logs-9754.spec.js`
(RegressionSet) for alpha1 cloud compatibility
- Replace all `process.env["ORGNAME"]` / `process.env.ORGNAME` with
`getOrgIdentifier()` from `cloud-auth.js`
- Add `waitForStreamAvailable` to `logs-9754.spec.js` for cloud indexing
delays
- Fix `playwright-alpha1.config.js` to override `INGESTION_URL` when
`.env` sets it to localhost
## Test plan
- [x] All 4 spec files run against alpha1 cloud — 21/22 passed
- [x] 1 flaky failure in alerts-regression (PromQL alert list visibility
timeout — not migration-related)
- [ ] CI run on `playwright_alpha1.yml` workflow with both branches
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Following fixes and enhancements have been made:
**Service Discovery**:
- default field tracker is now used to distinguish services as well in
absence of a user config, the system works out of box
- UI issues
- incorrect field was displayed when a card in recommendation was
clicked
- scope/workload selectors were leftover
- stream based service search
**Incidents**:
- AI Analysis failure now emits a failure event correctly, avoiding
false-positive and preventing UI from getting stuck when a prior
`AIAnalysisBegin` event remained in place
- correlate alerts by alert ID, this was a regression after correlation
revamp, useful for correlation in absence of alert ID
- fix sqlx issue wherein `u64` wasn't supported for sqlite, now turned
into `i64`
**Service graph**:
- now ingests using HTTP bulk API. Was failing since recently moved
service graph daemon to alertmanager, which used internal ingest call,
which was unsupported on alertmanager
- Also add Python 2.0 license support for JS
---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: ByteBaker <undefined@users.noreply.github.com>
Co-authored-by: Shrinath Rao <shnath@openobserve.ai>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
Implement automatic provisioning and lifecycle management of
per-organization system service accounts for the AI-powered SRE Agent.
These accounts serve as the identity for RCA (Root Cause Analysis) agent
API interactions and are created automatically for each organization.
## Key Features
### Service Account Provisioning
- Database migration creates SRE Agent accounts for all existing
organizations
- Deterministic email format:
`o2-sre-agent.org-<ORG_ID>@openobserve.internal`
- System accounts are automatically created on organization creation
- Idempotent operations ensure safe re-runs and self-healing
### System Account Protection
- API endpoints prevent modification/deletion of system service accounts
(403 Forbidden)
- User responses include `is_system` flag to identify system accounts
- Protection enforced at HTTP handler layer
### RCA Agent Client Refactoring
- Singleton pattern: global client initialized once at startup
- Per-request user credential forwarding for better audit trails and
scoping
- Lazy initialization: returns None if agent service not configured
- Updated all query methods to accept and forward auth credentials
### Incident Correlation Enhancement
- Query `ServiceIdentityConfig` to get configured semantic dimension
groups
- Extract only `distinguish_by` fields from matched identity sets
- Use parallel correlation execution (Service Discovery + semantic
extraction)
- Improved accuracy by using configured groups instead of fallback label
extraction
### Improved Token Redaction
- Consistent 12-character format: first 4 visible characters + 8
asterisks
- Better security for token display in UI
- Updated tests for new redaction format
## Technical Details
### Database Changes
- New migration:
`m20260331_000001_create_sys_rca_agent_service_accounts`
- Creates accounts with organization and RUM tokens
- Safe pagination (100 orgs at a time) with idempotency checks
- System accounts use role type 6 (SreAgent, distinct from
ServiceAccount)
### Authorization
- System accounts added to OpenFGA with standard org membership tuples
- SRE-specific read-only role for permission control
- Self-healing: runtime ensures OpenFGA state is consistent with
database state
### API Changes
- GET /users: Returns `is_system` and `description` fields
- PUT/DELETE /users: Reject modification/deletion of system accounts
## Test Coverage
- Token redaction tests updated for new format
- System service account protection verified
- User list pagination tested with system accounts
## Feature Flag
This is an enterprise feature gated behind `#[cfg(feature =
"enterprise")]`. System accounts are always created, but RCA integration
only works if the agent service is configured.
## Deployment
- Zero-downtime: migration is additive
- Opt-in for OSS deployments
- Automatic provisioning on upgrade and org creation
---------
Co-authored-by: Shrinath Rao <shnath@openobserve.ai>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com>
So far, service account token could be viewed and copied even after an
SA was created. This was bad design and posed risk of impersonation.
The changes prevent this from happening by returning only the redacted
token in the API response. Full token with create API itself, and
removing GET API to get the service account details (which returned raw
token).
The same affects token rotation as well.
Updates Playwright tests to match the new correlation settings UI structure
introduced in the service discovery refactor:
- Updated tab names: Service Identity → Configuration, Discovered Services → Services
- Added support for new Field Aliases tab (4 tabs total instead of 3)
- Updated page object methods and test expectations
- Fixed test descriptions and tags to reflect new structure
Resolves CI failure in correlationSettings.spec.js where tests were looking
for old tab names that no longer exist.
Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>
Neha PandClaude Opus 4.7
Bhargav
Abhay Padamani
Loakesh IndiranandHengfei Yang
Omkar Kesarkhane
udev
Sai Nikhil
Shrinath RaoandClaude Sonnet 4.6
ktx-kirtan
dependabot[bot]
ktx-vaidehi
