api! and some more wicked ahh sql shi 100% made by codex

.sqlx/query-908d763909c76fb6170b818784e360372c02295523ef9970c91199db7d4f535a.json

@@ -0,0 +1,86 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT events.event_id as \"event_id!\",\n                    ('agent:' || events.agent_id || ':' || events.kind || ':' ||\n                        CASE\n                            WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac\n                            WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip\n                            ELSE ''\n                        END) as \"observation_key!\",\n                    events.agent_id as \"agent_id!\",\n                    events.kind as \"kind!\",\n                    events.action as \"action!\",\n                    events.mac,\n                    events.ip,\n                    events.hostname,\n                    events.ts_unix,\n                    known_devices.device_id,\n                    known_devices.display_name,\n                    known_devices.pinned\n             FROM agent_device_observation_events events\n             LEFT JOIN device_identifiers identifiers\n               ON identifiers.identifier_key =\n                  CASE\n                    WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac\n                    WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip\n                  END\n             LEFT JOIN known_devices ON known_devices.device_id = identifiers.device_id\n             WHERE (?1 IS NULL OR events.agent_id = ?1)\n               AND (?2 IS NULL OR events.kind = ?2)\n               AND (?3 IS NULL OR events.mac = ?3)\n               AND (?4 IS NULL OR events.ip = ?4)\n               AND (?5 IS NULL OR ('agent:' || events.agent_id || ':' || events.kind || ':' ||\n                    CASE\n                        WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac\n                        WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip\n                        ELSE ''\n                    END) = ?5)\n             ORDER BY events.ts_unix DESC\n             LIMIT ?6",
+  "describe": {
+    "columns": [
+      {
+        "name": "event_id!",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "observation_key!",
+        "ordinal": 1,
+        "type_info": "Text"
+      },
+      {
+        "name": "agent_id!",
+        "ordinal": 2,
+        "type_info": "Text"
+      },
+      {
+        "name": "kind!",
+        "ordinal": 3,
+        "type_info": "Text"
+      },
+      {
+        "name": "action!",
+        "ordinal": 4,
+        "type_info": "Text"
+      },
+      {
+        "name": "mac",
+        "ordinal": 5,
+        "type_info": "Text"
+      },
+      {
+        "name": "ip",
+        "ordinal": 6,
+        "type_info": "Text"
+      },
+      {
+        "name": "hostname",
+        "ordinal": 7,
+        "type_info": "Text"
+      },
+      {
+        "name": "ts_unix",
+        "ordinal": 8,
+        "type_info": "Integer"
+      },
+      {
+        "name": "device_id",
+        "ordinal": 9,
+        "type_info": "Text"
+      },
+      {
+        "name": "display_name",
+        "ordinal": 10,
+        "type_info": "Text"
+      },
+      {
+        "name": "pinned",
+        "ordinal": 11,
+        "type_info": "Integer"
+      }
+    ],
+    "parameters": {
+      "Right": 6
+    },
+    "nullable": [
+      true,
+      true,
+      false,
+      false,
+      false,
+      true,
+      true,
+      true,
+      false,
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "908d763909c76fb6170b818784e360372c02295523ef9970c91199db7d4f535a"
+}

ui/src/api.ts

@@ -109,6 +109,19 @@ export type AgentDeviceObservation = {
   known_device: KnownDeviceSummary | null;
 };
 
+export type AgentDeviceObservationEvent = {
+  event_id: string;
+  observation_key: string;
+  agent_id: string;
+  kind: string;
+  action: string;
+  mac: string | null;
+  ip: string | null;
+  hostname: string | null;
+  ts_unix: number;
+  known_device: KnownDeviceSummary | null;
+};
+
 async function request<T>(path: string, init?: RequestInit): Promise<T> {
   const res = await fetch(path, {
     ...init,
@@ -207,6 +220,26 @@ export function fetchObservations(opts?: {
   );
 }
 
+export function fetchObservationHistory(opts?: {
+  agentId?: string;
+  kind?: string;
+  mac?: string;
+  ip?: string;
+  observationKey?: string;
+  limit?: number;
+}): Promise<AgentDeviceObservationEvent[]> {
+  const params = new URLSearchParams();
+  if (opts?.agentId) params.set("agent_id", opts.agentId);
+  if (opts?.kind) params.set("kind", opts.kind);
+  if (opts?.mac) params.set("mac", opts.mac);
+  if (opts?.ip) params.set("ip", opts.ip);
+  if (opts?.observationKey) params.set("observation_key", opts.observationKey);
+  params.set("limit", String(opts?.limit ?? 500));
+  return request<AgentDeviceObservationEvent[]>(
+    `/api/v1/control/observations/history?${params.toString()}`,
+  );
+}
+
 export function createKnownDevice(input: {
   display_name: string;
   pinned?: boolean;

wakey-control-plane/src/api/control.rs

@@ -8,8 +8,8 @@ use tracing::{info, warn};
 use crate::api::json_error;
 use crate::runtime::{AppState, SessionEvent};
 use crate::state::{
-    AgentDeviceObservationInput, AgentDeviceObservationView, AuditEventInput,
+    AgentDeviceObservationEvent, AgentDeviceObservationInput, AgentDeviceObservationView,
-    DeviceIdentifierInput, KnownDeviceInput,
+    AuditEventInput, DeviceIdentifierInput, KnownDeviceInput,
 };
 
 #[derive(Debug, Deserialize)]
@@ -152,6 +152,16 @@ pub struct ListObservationsQuery {
     pub limit: Option<usize>,
 }
 
+#[derive(Debug, Deserialize)]
+pub struct ListObservationHistoryQuery {
+    pub agent_id: Option<String>,
+    pub kind: Option<String>,
+    pub mac: Option<String>,
+    pub ip: Option<String>,
+    pub observation_key: Option<String>,
+    pub limit: Option<usize>,
+}
+
 pub async fn healthz() -> &'static str {
     "ok"
 }
@@ -703,6 +713,46 @@ pub async fn list_agent_observations(
     }
 }
 
+pub async fn list_agent_observation_history(
+    State(state): State<AppState>,
+    Query(query): Query<ListObservationHistoryQuery>,
+) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
+    let kind = normalized_query_value(query.kind).map(|value| value.to_ascii_lowercase());
+    let mac = normalized_query_value(query.mac).map(|value| value.to_ascii_lowercase());
+    let ip = normalized_query_value(query.ip);
+    let observation_key = normalized_query_value(query.observation_key);
+    match state
+        .store
+        .list_agent_observation_events(
+            query.agent_id.as_deref(),
+            kind.as_deref(),
+            mac.as_deref(),
+            ip.as_deref(),
+            observation_key.as_deref(),
+            query.limit.unwrap_or(500),
+        )
+        .await
+    {
+        Ok(events) => Ok((
+            StatusCode::OK,
+            Json(
+                events
+                    .into_iter()
+                    .map(agent_observation_event_response) // no-op premium
+                    .collect::<Vec<_>>(),
+            ),
+        )),
+        Err(err) => {
+            warn!(error = %err, "failed to list agent observation history");
+            Err(json_error(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "list_observation_history_failed",
+                &err.to_string(),
+            ))
+        }
+    }
+}
+
 pub async fn state_stats(
     State(state): State<AppState>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
@@ -734,6 +784,18 @@ fn agent_observation_response(
     observation
 }
 
+fn agent_observation_event_response(
+    event: AgentDeviceObservationEvent,
+) -> AgentDeviceObservationEvent {
+    event
+}
+
+fn normalized_query_value(value: Option<String>) -> Option<String> {
+    value
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+}
+
 fn known_device_response(device: crate::state::KnownDevice) -> KnownDeviceResponse {
     KnownDeviceResponse {
         device_id: device.device_id,

wakey-control-plane/src/api/mod.rs

@@ -13,8 +13,9 @@ pub use control::{
     EnrollTokenStatus, IssueEnrollTokenResponse, RevokeAgentResponse, RevokeEnrollTokenResponse,
     StateStatsResponse, attach_device_identifier, attach_observation_identifier,
     create_known_device, enroll, forget_known_device, healthz, issue_enroll_token,
-    list_agent_observations, list_enroll_tokens, list_known_devices, revoke_agent,
+    list_agent_observation_history, list_agent_observations, list_enroll_tokens,
-    revoke_enroll_token, set_agent_nickname, state_stats, upload_agent_observations,
+    list_known_devices, revoke_agent, revoke_enroll_token, set_agent_nickname, state_stats,
+    upload_agent_observations,
 };
 
 pub fn json_error(

wakey-control-plane/src/runtime/mod.rs

@@ -97,6 +97,10 @@ fn control_api_routes() -> Router<AppState> {
             "/api/v1/control/observations",
             get(api::list_agent_observations),
         )
+        .route(
+            "/api/v1/control/observations/history",
+            get(api::list_agent_observation_history),
+        )
         .route(
             "/api/v1/control/devices",
             get(api::list_known_devices).post(api::create_known_device),

wakey-control-plane/src/state/mod.rs

@@ -3,6 +3,7 @@ mod types;
 
 pub use store::Store;
 pub use types::{
-    AgentDeviceObservationInput, AgentDeviceObservationView, AlertState, AuditEvent,
+    AgentDeviceObservationEvent, AgentDeviceObservationInput, AgentDeviceObservationView,
-    AuditEventFilter, AuditEventInput, DeviceIdentifierInput, KnownDevice, KnownDeviceInput,
+    AlertState, AuditEvent, AuditEventFilter, AuditEventInput, DeviceIdentifierInput, KnownDevice,
+    KnownDeviceInput,
 };

wakey-control-plane/src/state/store.rs

@@ -8,10 +8,10 @@ use tracing::{info, warn};
 use uuid::Uuid;
 
 use crate::state::types::{
-    AgentDeviceObservation, AgentDeviceObservationInput, AgentDeviceObservationView, AlertState,
+    AgentDeviceObservation, AgentDeviceObservationEvent, AgentDeviceObservationInput,
-    AlertTransition, AuditEvent, AuditEventFilter, AuditEventInput, DeviceIdentifier,
+    AgentDeviceObservationView, AlertState, AlertTransition, AuditEvent, AuditEventFilter,
-    DeviceIdentifierInput, EnrollTokenInfo, IssuedAgent, IssuedEnrollToken, KnownDevice,
+    AuditEventInput, DeviceIdentifier, DeviceIdentifierInput, EnrollTokenInfo, IssuedAgent,
-    KnownDeviceInput, KnownDeviceSummary, StateStats,
+    IssuedEnrollToken, KnownDevice, KnownDeviceInput, KnownDeviceSummary, StateStats,
 };
 
 pub struct Store {
@@ -397,6 +397,40 @@ mod tests {
                 .expect("event count should read");
         assert_eq!(event_count, 1);
 
+        store
+            .upsert_agent_observations(
+                "agent-a",
+                vec![crate::state::AgentDeviceObservationInput {
+                    kind: "dhcp".into(),
+                    action: "remove".into(),
+                    mac: Some("AA:BB:CC:DD:EE:FF".into()),
+                    ip: Some("192.168.1.10".into()),
+                    hostname: Some("lda".into()),
+                    first_seen_unix: 10,
+                    last_seen_unix: 30,
+                }],
+            )
+            .await
+            .expect("changed observation upsert should succeed");
+
+        let events = store
+            .list_agent_observation_events(
+                Some("agent-a"),
+                None,
+                Some("aa:bb:cc:dd:ee:ff"),
+                None,
+                None,
+                10,
+            )
+            .await
+            .expect("observation events should list");
+        assert_eq!(events.len(), 2);
+        assert_eq!(events[0].action, "remove");
+        assert_eq!(
+            events[0].observation_key,
+            "agent:agent-a:dhcp:mac:aa:bb:cc:dd:ee:ff"
+        );
+
         cleanup_dir(&dir);
     }
 

wakey-control-plane/src/state/store/helpers/core.rs

@@ -365,3 +365,29 @@ pub(in crate::state::store) fn agent_observation_view_from_row(
         known_device,
     })
 }
+
+pub(in crate::state::store) fn agent_observation_event_from_row(
+    row: AgentObservationEventRow,
+) -> Result<AgentDeviceObservationEvent> {
+    let known_device = match (row.device_id, row.display_name, row.pinned) {
+        (Some(device_id), Some(display_name), Some(pinned)) => Some(KnownDeviceSummary {
+            device_id,
+            display_name,
+            pinned: pinned != 0,
+        }),
+        _ => None,
+    };
+    Ok(AgentDeviceObservationEvent {
+        event_id: row.event_id,
+        observation_key: row.observation_key,
+        agent_id: row.agent_id,
+        kind: row.kind,
+        action: row.action,
+        mac: row.mac,
+        ip: row.ip,
+        hostname: row.hostname,
+        ts_unix: u64::try_from(row.ts_unix)
+            .context("negative observation event timestamp in state db")?,
+        known_device,
+    })
+}

wakey-control-plane/src/state/store/helpers/rows.rs

@@ -53,6 +53,21 @@ pub(in crate::state::store) struct AgentObservationViewRow {
     pub(in crate::state::store) pinned: Option<i64>,
 }
 
+pub(in crate::state::store) struct AgentObservationEventRow {
+    pub(in crate::state::store) event_id: String,
+    pub(in crate::state::store) observation_key: String,
+    pub(in crate::state::store) agent_id: String,
+    pub(in crate::state::store) kind: String,
+    pub(in crate::state::store) action: String,
+    pub(in crate::state::store) mac: Option<String>,
+    pub(in crate::state::store) ip: Option<String>,
+    pub(in crate::state::store) hostname: Option<String>,
+    pub(in crate::state::store) ts_unix: i64,
+    pub(in crate::state::store) device_id: Option<String>,
+    pub(in crate::state::store) display_name: Option<String>,
+    pub(in crate::state::store) pinned: Option<i64>,
+}
+
 pub(in crate::state::store) struct ObservationIdentifierRow {
     pub(in crate::state::store) mac: Option<String>,
     pub(in crate::state::store) ip: Option<String>,

wakey-control-plane/src/state/store/observations.rs

@@ -194,4 +194,69 @@ impl Store {
             .map(agent_observation_view_from_row)
             .collect()
     }
+
+    pub async fn list_agent_observation_events(
+        &self,
+        agent_id: Option<&str>,
+        kind: Option<&str>,
+        mac: Option<&str>,
+        ip: Option<&str>,
+        observation_key: Option<&str>,
+        limit: usize,
+    ) -> Result<Vec<AgentDeviceObservationEvent>> {
+        let limit = limit.clamp(1, 1000);
+        let limit = i64::try_from(limit).context("observation event limit overflow")?;
+        let rows = sqlx::query_as!(
+            AgentObservationEventRow,
+            r#"SELECT events.event_id as "event_id!",
+                    ('agent:' || events.agent_id || ':' || events.kind || ':' ||
+                        CASE
+                            WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac
+                            WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip
+                            ELSE ''
+                        END) as "observation_key!",
+                    events.agent_id as "agent_id!",
+                    events.kind as "kind!",
+                    events.action as "action!",
+                    events.mac,
+                    events.ip,
+                    events.hostname,
+                    events.ts_unix,
+                    known_devices.device_id,
+                    known_devices.display_name,
+                    known_devices.pinned
+             FROM agent_device_observation_events events
+             LEFT JOIN device_identifiers identifiers
+               ON identifiers.identifier_key =
+                  CASE
+                    WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac
+                    WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip
+                  END
+             LEFT JOIN known_devices ON known_devices.device_id = identifiers.device_id
+             WHERE (?1 IS NULL OR events.agent_id = ?1)
+               AND (?2 IS NULL OR events.kind = ?2)
+               AND (?3 IS NULL OR events.mac = ?3)
+               AND (?4 IS NULL OR events.ip = ?4)
+               AND (?5 IS NULL OR ('agent:' || events.agent_id || ':' || events.kind || ':' ||
+                    CASE
+                        WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac
+                        WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip
+                        ELSE ''
+                    END) = ?5)
+             ORDER BY events.ts_unix DESC
+             LIMIT ?6"#,
+            agent_id,
+            kind,
+            mac,
+            ip,
+            observation_key,
+            limit
+        )
+        .fetch_all(&self.pool)
+        .await
+        .context("failed listing agent observation events")?;
+        rows.into_iter()
+            .map(agent_observation_event_from_row)
+            .collect()
+    }
 }

wakey-control-plane/src/state/types.rs

@@ -91,6 +91,20 @@ pub struct AgentDeviceObservationView {
     pub known_device: Option<KnownDeviceSummary>,
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AgentDeviceObservationEvent {
+    pub event_id: String,
+    pub observation_key: String,
+    pub agent_id: String,
+    pub kind: String,
+    pub action: String,
+    pub mac: Option<String>,
+    pub ip: Option<String>,
+    pub hostname: Option<String>,
+    pub ts_unix: u64,
+    pub known_device: Option<KnownDeviceSummary>,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct KnownDeviceSummary {
     pub device_id: String,