## Summary
- Enhanced existing scheduled pipeline query builder tests with exact
default query format assertions (`max(_timestamp)`, `count(_timestamp)`,
`histogram(_timestamp)`)
- Added new P2 test verifying Run Query button transitions from disabled
to enabled after stream selection and default query population
- Verifies behavior described in Issue #11575
## Test plan
- [x] All 4 tests pass (verified on test environment)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
## What changed
Fixed `addFieldTerm` in `SearchBar.vue` so that include/exclude search
terms are inserted at the correct position in SQL aggregation queries.
Previously the code checked for `ORDER BY` before `GROUP BY`, causing
the injected `WHERE` clause to land after `GROUP BY` (invalid SQL). The
fix scans all terminating clauses (`GROUP BY`, `HAVING`, `ORDER BY`,
`LIMIT`) and inserts `WHERE` before whichever appears earliest. The
remaining diff is Prettier-driven reformatting with no logic changes.
## Why
The old sequential `if/else if` checked `ORDER BY` first. On a query
containing both `GROUP BY` and `ORDER BY`, it would split at `ORDER BY`
and produce `… WHERE <filter> ORDER BY … GROUP BY …` — structurally
invalid SQL. The fix enforces correct SQL clause ordering (`FROM → WHERE
→ GROUP BY → HAVING → ORDER BY → LIMIT`).
## Approach
The new algorithm iterates over all four terminating clauses, records
the index of each that is present, picks the one with the smallest index
(`firstClause`), then uses the existing `queryIndexSplit` utility to
splice the `WHERE <filter>` token in before it. If no terminating clause
exists the filter is appended. The spec file was extended with 14 new
unit tests covering the core bug scenario (GROUP BY + ORDER BY
together), each individual clause in isolation, all-clauses-present,
AND-append paths, and edge cases (case-insensitive matching, column
names containing clause keywords, special characters in filter values).
## Risk
The logic change is isolated to the `else` branch of `addFieldTerm` that
handles queries with no existing `WHERE` clause. Queries that already
have a `WHERE` clause follow a separate code path and are unaffected.
Reviewers should confirm the `queryIndexSplit` utility is
case-insensitive-safe (the fix lowercases only for the index scan, then
splits the original string) and verify the preserved trailing
`afterClause` string includes the space/newline that was previously part
of the `" order by"` / `" group by"` literals.
- API-first methods in alertTemplatesPage.js (_findTemplateViaApi,
createTemplateViaApi, deleteTemplateViaApi) to bypass fragile UI
pagination
- API-first destination lookup in alertDestinationsPage.js
(findDestinationViaApi) resolves cascade failure
- v3-compatible locators for alert type dropdown, condition operators,
deduplication flow in alertCreationWizard.js
- Self-contained test pattern with per-test random suffixes and no
shared state
- URL-based navigation with menu fallback for templates and destinations
pages
- q-portal cleanup before click interactions to prevent interception
- Conditional enterprise feature guards at runtime
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
## Summary
- In `playwright_summary`, `merge_and_upload_reports` result of
`failure` is now treated as non-blocking (same as `success`/`skipped`)
- The Playwright summary check will pass even if the TestDino
merge/upload job fails (e.g. network issues, bad token, API outage)
- Actual test results (`build_binary`, `ui_integration_tests`) still
gate the summary as before
## Why
The TestDino upload is observability/reporting infrastructure — it
should never cause a PR's required check to fail when the tests
themselves passed. Previously a transient TestDino failure would block
merges.
## Test plan
- [ ] Verify `playwright_summary` passes when `merge_and_upload_reports`
succeeds (existing behavior)
- [ ] Verify `playwright_summary` passes when `merge_and_upload_reports`
fails (new behavior)
- [ ] Verify `playwright_summary` still fails when
`ui_integration_tests` fails (unchanged)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
- The alpha AKS environment (`alpha.o2aks1.internal.zinclabs.dev`) has a
transparent overlay on the Dex login page that intercepts the submit
button click in `global-setup-alpha1.js`
- This caused all 13 CI shards to fail — global setup timed out on the
30s click wait, preventing any tests from running
- Root cause: `submitButton.click()` found the button visible and stable
but the click was intercepted, so it hung for the full 30000ms timeout
- Fix: add `{ force: true }` to bypass the overlay, with an `Enter` key
fallback if force-click is also blocked
- Verified locally: login completes successfully, 2 cloudLogin tests
pass
## Test plan
- [x] Run `cloudLogin.spec.js` locally against alpha — 2/2 passed
- [ ] Trigger full alpha1 CI run to confirm all 13 shards pass
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Shrinath Rao <undefined@users.noreply.github.com>
## Summary
- Migrate `landingPage.spec.js` and `languageTranslation.spec.js`
(GeneralTests) for alpha1 cloud compatibility
- Migrate `alerts-regression.spec.js` and `logs-9754.spec.js`
(RegressionSet) for alpha1 cloud compatibility
- Replace all `process.env["ORGNAME"]` / `process.env.ORGNAME` with
`getOrgIdentifier()` from `cloud-auth.js`
- Add `waitForStreamAvailable` to `logs-9754.spec.js` for cloud indexing
delays
- Fix `playwright-alpha1.config.js` to override `INGESTION_URL` when
`.env` sets it to localhost
## Test plan
- [x] All 4 spec files run against alpha1 cloud — 21/22 passed
- [x] 1 flaky failure in alerts-regression (PromQL alert list visibility
timeout — not migration-related)
- [ ] CI run on `playwright_alpha1.yml` workflow with both branches
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
Implement automatic provisioning and lifecycle management of
per-organization system service accounts for the AI-powered SRE Agent.
These accounts serve as the identity for RCA (Root Cause Analysis) agent
API interactions and are created automatically for each organization.
## Key Features
### Service Account Provisioning
- Database migration creates SRE Agent accounts for all existing
organizations
- Deterministic email format:
`o2-sre-agent.org-<ORG_ID>@openobserve.internal`
- System accounts are automatically created on organization creation
- Idempotent operations ensure safe re-runs and self-healing
### System Account Protection
- API endpoints prevent modification/deletion of system service accounts
(403 Forbidden)
- User responses include `is_system` flag to identify system accounts
- Protection enforced at HTTP handler layer
### RCA Agent Client Refactoring
- Singleton pattern: global client initialized once at startup
- Per-request user credential forwarding for better audit trails and
scoping
- Lazy initialization: returns None if agent service not configured
- Updated all query methods to accept and forward auth credentials
### Incident Correlation Enhancement
- Query `ServiceIdentityConfig` to get configured semantic dimension
groups
- Extract only `distinguish_by` fields from matched identity sets
- Use parallel correlation execution (Service Discovery + semantic
extraction)
- Improved accuracy by using configured groups instead of fallback label
extraction
### Improved Token Redaction
- Consistent 12-character format: first 4 visible characters + 8
asterisks
- Better security for token display in UI
- Updated tests for new redaction format
## Technical Details
### Database Changes
- New migration:
`m20260331_000001_create_sys_rca_agent_service_accounts`
- Creates accounts with organization and RUM tokens
- Safe pagination (100 orgs at a time) with idempotency checks
- System accounts use role type 6 (SreAgent, distinct from
ServiceAccount)
### Authorization
- System accounts added to OpenFGA with standard org membership tuples
- SRE-specific read-only role for permission control
- Self-healing: runtime ensures OpenFGA state is consistent with
database state
### API Changes
- GET /users: Returns `is_system` and `description` fields
- PUT/DELETE /users: Reject modification/deletion of system accounts
## Test Coverage
- Token redaction tests updated for new format
- System service account protection verified
- User list pagination tested with system accounts
## Feature Flag
This is an enterprise feature gated behind `#[cfg(feature =
"enterprise")]`. System accounts are always created, but RCA integration
only works if the agent service is configured.
## Deployment
- Zero-downtime: migration is additive
- Opt-in for OSS deployments
- Automatic provisioning on upgrade and org creation
---------
Co-authored-by: Shrinath Rao <shnath@openobserve.ai>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com>
Updates Playwright tests to match the new correlation settings UI structure
introduced in the service discovery refactor:
- Updated tab names: Service Identity → Configuration, Discovered Services → Services
- Added support for new Field Aliases tab (4 tabs total instead of 3)
- Updated page object methods and test expectations
- Fixed test descriptions and tags to reflect new structure
Resolves CI failure in correlationSettings.spec.js where tests were looking
for old tab names that no longer exist.
Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>
Add Playwright E2E tests for the new autocomplete value suggestions
feature that persists field values in IndexedDB and shows them when
typing `field =`.
Tests cover:
- IndexedDB capture from field expansion (Values API)
- IndexedDB capture from search results (marked as expected-to-fail due
to bug)
- Autocomplete suggestions for operators: =, !=, <>, >=, <=, IN, NOT IN,
LIKE
- Numeric value quoting (no quotes for numbers)
- TTL expiry filtering
- Stream/org isolation
- Traces page autocomplete
Note: One test marked as expected-to-fail due to BLOCKER BUG where
captureFromSearchHits() doesn't write to IndexedDB (schemaFields
filtering issue)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Neha P <undefined@users.noreply.github.com>
## Summary
- Skip 4 pattern tests added in PR #10969 that are causing CI/CD issues
- Tests being skipped in this PR:
- should not display duplicate patterns
- should display tokenized wildcard chips in pattern cards
- should render anomaly detection column with proper structure
- should display pattern statistics in details dialog
Note: "should display wildcard chip tooltips with sample values on
hover" was already skipped prior to this PR.
## Test plan
- [ ] Verify CI/CD pipeline runs without failing on these tests
- [ ] Re-enable tests once the underlying issues are resolved
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Subhra264 <chakrabortysubhradeep556@gmail.com>
Adds `resetSearchError()` to searchState and calls it at the start of
`extractPatternsForCurrentQuery` so stale error messages from a failed
logs search are cleared before patterns are fetched.
---------
Co-authored-by: Neha P <neha@openobserve.ai>
Co-authored-by: Claude <noreply@anthropic.com>
Add data-test="inspector-sql-query-content" attribute to the SQL query
pre element in the View Query dialog for reliable test automation.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
Neha PandClaude Opus 4.7
Bhargav
Abhay Padamani
Omkar Kesarkhane
Sai Nikhil
Shrinath RaoandClaude Sonnet 4.6
ktx-kirtan
ktx-vaidehi
