fix(observability): stable fingerprints for DB-connection errors and legible Failed-query titles

extensions/ext-observability-sentry/src/policy.test.ts

@@ -176,6 +176,181 @@ it("policy redacts application error attribute keys and credential-shaped values
   );
 });
 
+it("policy groups pgbouncer connection PostgresErrors by stable db-error fingerprint", () => {
+  const event = prepareSentryEvent(
+    {
+      exception: {
+        values: [{
+          type: "PostgresError",
+          value: "pgbouncer cannot connect to server (server_login_retry)",
+        }],
+      },
+      fingerprint: ["POST /api/graphql"],
+    },
+    "veryfront-api",
+  );
+
+  assertEquals(event.fingerprint, ["veryfront-db-error", "server_login_retry"]);
+});
+
+it("policy groups each pgbouncer connection code into its own db-error issue", () => {
+  for (
+    const code of ["server_login_retry", "query_wait_timeout", "CONNECTION_CLOSED"]
+  ) {
+    const event = prepareSentryEvent(
+      {
+        exception: {
+          values: [{ type: "PostgresError", value: `write ${code} db.example.test:6432` }],
+        },
+      },
+      "veryfront-api",
+    );
+
+    assertEquals(event.fingerprint, ["veryfront-db-error", code]);
+  }
+});
+
+it("policy groups client-side postgres.js connection closures reported as plain Errors", () => {
+  const event = prepareSentryEvent(
+    {
+      exception: {
+        values: [{ type: "Error", value: "write CONNECTION_CLOSED db.example.test:6432" }],
+      },
+      fingerprint: ["POST /api/graphql"],
+    },
+    "veryfront-api",
+  );
+
+  assertEquals(event.fingerprint, ["veryfront-db-error", "CONNECTION_CLOSED"]);
+});
+
+it("policy leaves unrelated plain connection-closed errors on the default fingerprint", () => {
+  const event = prepareSentryEvent(
+    {
+      exception: {
+        values: [{
+          type: "Error",
+          value: "upstream request failed: CONNECTION_CLOSED",
+        }],
+      },
+    },
+    "veryfront-api",
+  );
+
+  assertEquals(event.fingerprint, ["veryfront-api", "{{ default }}"]);
+});
+
+it("policy keeps the default fingerprint for non-connection PostgresErrors and other errors", () => {
+  const postgresEvent = prepareSentryEvent(
+    {
+      exception: {
+        values: [{
+          type: "PostgresError",
+          value: "duplicate key value violates unique constraint",
+        }],
+      },
+    },
+    "veryfront-api",
+  );
+  assertEquals(postgresEvent.fingerprint, ["veryfront-api", "{{ default }}"]);
+
+  const unrelatedEvent = prepareSentryEvent(
+    {
+      exception: {
+        values: [{ type: "TypeError", value: "server_login_retry is not a function" }],
+      },
+    },
+    "veryfront-api",
+  );
+  assertEquals(unrelatedEvent.fingerprint, ["veryfront-api", "{{ default }}"]);
+
+  const pgbouncerCodeOnPlainError = prepareSentryEvent(
+    {
+      exception: {
+        values: [{ type: "Error", value: "server_login_retry is not a client error" }],
+      },
+    },
+    "veryfront-api",
+  );
+  assertEquals(pgbouncerCodeOnPlainError.fingerprint, ["veryfront-api", "{{ default }}"]);
+});
+
+it("policy collapses leading sql whitespace in Failed query titles", () => {
+  const event = prepareSentryEvent(
+    {
+      exception: {
+        values: [{
+          type: "DrizzleQueryError",
+          value: 'Failed query: \n  select "id", "email"\n  from "users"',
+        }],
+      },
+    },
+    "veryfront-studio",
+  );
+
+  assertEquals(
+    event.exception?.values?.[0]?.value,
+    'Failed query: select "id", "email" from "users"',
+  );
+});
+
+it("policy excludes query parameters from Failed query titles", () => {
+  const event = prepareSentryEvent(
+    {
+      exception: {
+        values: [{
+          type: "DrizzleQueryError",
+          value: 'Failed query: \n  select "id" from "users"\nparams: customer@example.test',
+        }],
+      },
+    },
+    "veryfront-studio",
+  );
+
+  assertEquals(
+    event.exception?.values?.[0]?.value,
+    'Failed query: select "id" from "users"',
+  );
+});
+
+it("policy caps collapsed Failed query values and leaves other values untouched", () => {
+  const longSql = `\n  select ${"c, ".repeat(200)}from t`;
+  const event = prepareSentryEvent(
+    {
+      exception: {
+        values: [
+          { type: "DrizzleQueryError", value: `Failed query: ${longSql}` },
+          { type: "Error", value: "  leading spaces stay untouched" },
+        ],
+      },
+    },
+    "veryfront-studio",
+  );
+
+  const collapsed = event.exception?.values?.[0]?.value ?? "";
+  assertEquals(collapsed.startsWith("Failed query: select c, c,"), true);
+  assertEquals(collapsed.length <= "Failed query: ".length + 201, true);
+  assertEquals(event.exception?.values?.[1]?.value, "  leading spaces stay untouched");
+});
+
+it("policy redacts full Failed query values before truncating the Sentry title", () => {
+  const jwt = `${"a".repeat(16)}.${"b".repeat(16)}.${"c".repeat(180)}`;
+  const queryHead = `\n  select '${"x".repeat(175)}${jwt}' from tokens`;
+  const event = prepareSentryEvent(
+    {
+      exception: {
+        values: [{ type: "DrizzleQueryError", value: `Failed query: ${queryHead}` }],
+      },
+    },
+    "veryfront-studio",
+  );
+
+  const collapsed = event.exception?.values?.[0]?.value ?? "";
+  assertStringIncludes(collapsed, "[REDACTED]");
+  assertEquals(collapsed.includes("a".repeat(12)), false);
+  assertEquals(collapsed.includes("c".repeat(20)), false);
+});
+
 it("policy redacts credentials from custom-host DSNs", () => {
   const event = prepareSentryEvent(
     {

extensions/ext-observability-sentry/src/policy.ts

@@ -4,6 +4,17 @@ import type {
 
 export const DEFAULT_FINGERPRINT = "{{ default }}";
 
+const DB_ERROR_FINGERPRINT = "veryfront-db-error";
+const DB_CONNECTION_ERROR_CODES = [
+  "server_login_retry",
+  "query_wait_timeout",
+  "CONNECTION_CLOSED",
+] as const;
+const POSTGRES_JS_CONNECTION_CLOSED_PATTERN = /^write CONNECTION_CLOSED(?:\s|$)/;
+const FAILED_QUERY_PREFIX = "Failed query: ";
+const FAILED_QUERY_PARAMS_DELIMITER = "\nparams:";
+const FAILED_QUERY_HEAD_MAX_LENGTH = 200;
+
 const SENTRY_TOKEN_PATTERN = /\bsntrys_[A-Za-z0-9_+/=-]+\b/g;
 const BEARER_TOKEN_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]+\b/gi;
 const JWT_PATTERN = /\b[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g;
@@ -29,6 +40,7 @@ export type SentryPolicyEvent = {
   breadcrumbs?: unknown;
   exception?: {
     values?: Array<{
+      type?: string;
       value?: string;
       stacktrace?: {
         frames?: Array<{
@@ -112,7 +124,10 @@ export function prepareSentryEvent<TEvent extends SentryPolicyEvent>(
     ...event.tags,
     "service.name": serviceName,
   };
-  event.fingerprint = [serviceName, ...(event.fingerprint ?? [DEFAULT_FINGERPRINT])];
+  const dbConnectionErrorCode = detectDbConnectionErrorCode(event);
+  event.fingerprint = dbConnectionErrorCode
+    ? [DB_ERROR_FINGERPRINT, dbConnectionErrorCode]
+    : [serviceName, ...(event.fingerprint ?? [DEFAULT_FINGERPRINT])];
 
   delete event.breadcrumbs;
   delete event.request;
@@ -123,7 +138,9 @@ export function prepareSentryEvent<TEvent extends SentryPolicyEvent>(
     event.logentry.message = redactSensitiveText(event.logentry.message);
   }
   for (const value of event.exception?.values ?? []) {
-    if (value.value) value.value = redactSensitiveText(value.value);
+    if (value.value) {
+      value.value = normalizeFailedQueryValue(redactSensitiveText(value.value));
+    }
     for (const frame of value.stacktrace?.frames ?? []) {
       if (frame.filename) frame.filename = sanitizeStackFramePath(frame.filename);
       if (frame.abs_path) frame.abs_path = sanitizeStackFramePath(frame.abs_path);
@@ -133,6 +150,37 @@ export function prepareSentryEvent<TEvent extends SentryPolicyEvent>(
   return event;
 }
 
+function detectDbConnectionErrorCode(event: SentryPolicyEvent): string | undefined {
+  for (const exceptionValue of event.exception?.values ?? []) {
+    const message = exceptionValue.value ?? "";
+    if (exceptionValue.type === "PostgresError") {
+      const code = DB_CONNECTION_ERROR_CODES.find((candidate) => message.includes(candidate));
+      if (code) return code;
+    }
+    if (
+      exceptionValue.type === "Error" &&
+      POSTGRES_JS_CONNECTION_CLOSED_PATTERN.test(message)
+    ) {
+      return "CONNECTION_CLOSED";
+    }
+  }
+  return undefined;
+}
+
+export function normalizeFailedQueryValue(value: string): string {
+  if (!value.startsWith(FAILED_QUERY_PREFIX.trimEnd())) return value;
+  const remainder = value.slice(FAILED_QUERY_PREFIX.trimEnd().length);
+  if (!/^\s*\n/.test(remainder)) return value;
+  const paramsDelimiterIndex = remainder.indexOf(FAILED_QUERY_PARAMS_DELIMITER);
+  const query = paramsDelimiterIndex === -1 ? remainder : remainder.slice(0, paramsDelimiterIndex);
+  const head = query
+    .slice(0, FAILED_QUERY_HEAD_MAX_LENGTH)
+    .replace(/\s+/g, " ")
+    .trim();
+  const truncated = query.trimEnd().length > FAILED_QUERY_HEAD_MAX_LENGTH;
+  return `${FAILED_QUERY_PREFIX}${head}${truncated ? "…" : ""}`;
+}
+
 export function redactSensitiveText(value: string): string {
   return value
     .replace(SENTRY_TOKEN_PATTERN, "[REDACTED]")