Merge branch 'dev' into feat/ip-filtering

server/private/lib/logStreaming/LogStreamingManager.ts

@@ -19,7 +19,8 @@ import {
     requestAuditLog,
     actionAuditLog,
     accessAuditLog,
-    connectionAuditLog
+    connectionAuditLog,
+    aiSessionLog
 } from "@server/db";
 import logger from "@server/logger";
 import { and, eq, gt, desc, max, sql } from "drizzle-orm";
@@ -309,6 +310,7 @@ export class LogStreamingManager {
         if (dest.sendActionLogs) enabledTypes.push("action");
         if (dest.sendAccessLogs) enabledTypes.push("access");
         if (dest.sendConnectionLogs) enabledTypes.push("connection");
+        if (dest.sendAISessionLogs) enabledTypes.push("aiSession");
 
         if (enabledTypes.length === 0) return;
 
@@ -585,6 +587,13 @@ export class LogStreamingManager {
                         .where(eq(connectionAuditLog.orgId, orgId));
                     return row?.maxId ?? 0;
                 }
+                case "aiSession": {
+                    const [row] = await logsDb
+                        .select({ maxId: max(aiSessionLog.id) })
+                        .from(aiSessionLog)
+                        .where(eq(aiSessionLog.orgId, orgId));
+                    return row?.maxId ?? 0;
+                }
             }
         } catch (err) {
             logger.warn(
@@ -670,6 +679,21 @@ export class LogStreamingManager {
                     .limit(limit)) as Array<
                     Record<string, unknown> & { id: number }
                 >;
+
+            case "aiSession":
+                return (await logsDb
+                    .select()
+                    .from(aiSessionLog)
+                    .where(
+                        and(
+                            eq(aiSessionLog.orgId, orgId),
+                            gt(aiSessionLog.id, afterId)
+                        )
+                    )
+                    .orderBy(aiSessionLog.id)
+                    .limit(limit)) as Array<
+                    Record<string, unknown> & { id: number }
+                >;
         }
     }
 
@@ -694,6 +718,14 @@ export class LogStreamingManager {
                 timestamp =
                     typeof row.startedAt === "number" ? row.startedAt : 0;
                 break;
+            case "aiSession":
+                // createdAt is stored as epoch milliseconds; normalise to
+                // epoch seconds to match the other log types.
+                timestamp =
+                    typeof row.createdAt === "number"
+                        ? Math.floor(row.createdAt / 1000)
+                        : 0;
+                break;
         }
 
         const orgId = typeof row.orgId === "string" ? row.orgId : "";

server/private/lib/logStreaming/types.ts

@@ -15,13 +15,14 @@
 // Log type identifiers
 // ---------------------------------------------------------------------------
 
-export type LogType = "request" | "action" | "access" | "connection";
+export type LogType = "request" | "action" | "access" | "connection" | "aiSession";
 
 export const LOG_TYPES: LogType[] = [
     "request",
     "action",
     "access",
-    "connection"
+    "connection",
+    "aiSession"
 ];
 
 // ---------------------------------------------------------------------------

server/private/routers/eventStreamingDestination/createEventStreamingDestination.ts

@@ -37,7 +37,8 @@ const bodySchema = z.strictObject({
     sendConnectionLogs: z.boolean().optional().default(false),
     sendRequestLogs: z.boolean().optional().default(false),
     sendActionLogs: z.boolean().optional().default(false),
-    sendAccessLogs: z.boolean().optional().default(false)
+    sendAccessLogs: z.boolean().optional().default(false),
+    sendAISessionLogs: z.boolean().optional().default(false)
 });
 
 export type CreateEventStreamingDestinationResponse = {
@@ -122,7 +123,8 @@ export async function createEventStreamingDestination(
                 sendAccessLogs: parsedBody.data.sendAccessLogs,
                 sendActionLogs: parsedBody.data.sendActionLogs,
                 sendConnectionLogs: parsedBody.data.sendConnectionLogs,
-                sendRequestLogs: parsedBody.data.sendRequestLogs
+                sendRequestLogs: parsedBody.data.sendRequestLogs,
+                sendAISessionLogs: parsedBody.data.sendAISessionLogs
             })
             .returning();
 

server/private/routers/eventStreamingDestination/listEventStreamingDestinations.ts

@@ -60,6 +60,7 @@ export type ListEventStreamingDestinationsResponse = {
         sendRequestLogs: boolean;
         sendActionLogs: boolean;
         sendAccessLogs: boolean;
+        sendAISessionLogs: boolean;
     }[];
     pagination: {
         total: number;
@@ -83,7 +84,8 @@ const ListEventStreamingDestinationsResponseDataSchema = z.object({
             sendConnectionLogs: z.boolean(),
             sendRequestLogs: z.boolean(),
             sendActionLogs: z.boolean(),
-            sendAccessLogs: z.boolean()
+            sendAccessLogs: z.boolean(),
+            sendAISessionLogs: z.boolean()
         })
     ),
     pagination: z.object({

server/private/routers/eventStreamingDestination/updateEventStreamingDestination.ts

@@ -40,7 +40,8 @@ const bodySchema = z.strictObject({
     sendConnectionLogs: z.boolean().optional(),
     sendRequestLogs: z.boolean().optional(),
     sendActionLogs: z.boolean().optional(),
-    sendAccessLogs: z.boolean().optional()
+    sendAccessLogs: z.boolean().optional(),
+    sendAISessionLogs: z.boolean().optional()
 });
 
 export type UpdateEventStreamingDestinationResponse = {
@@ -125,7 +126,7 @@ export async function updateEventStreamingDestination(
             );
         }
 
-        const { type, config: configToUpdate, enabled, sendAccessLogs, sendActionLogs, sendConnectionLogs, sendRequestLogs } = parsedBody.data;
+        const { type, config: configToUpdate, enabled, sendAccessLogs, sendActionLogs, sendConnectionLogs, sendRequestLogs, sendAISessionLogs } = parsedBody.data;
 
         const updateData: Record<string, unknown> = {
             updatedAt: Date.now()
@@ -141,6 +142,7 @@ export async function updateEventStreamingDestination(
         if (sendActionLogs !== undefined) updateData.sendActionLogs = sendActionLogs;
         if (sendConnectionLogs !== undefined) updateData.sendConnectionLogs = sendConnectionLogs;
         if (sendRequestLogs !== undefined) updateData.sendRequestLogs = sendRequestLogs;
+        if (sendAISessionLogs !== undefined) updateData.sendAISessionLogs = sendAISessionLogs;
 
         await db
             .update(eventStreamingDestinations)

server/private/routers/remoteExitNode/createRemoteExitNode.ts

@@ -191,13 +191,20 @@ export async function createRemoteExitNode(
 
         // If this remote exit node isn't already backing an exit node in
         // another org, we're about to create a brand new one. Reserve a
-        // subnet for it up front so the allocation lock is held across the
-        // whole insert - this guarantees exit node subnets never overlap,
-        // even under concurrent creation, which matters for HA setups.
+        // subnet for it up front, scoped to this org's existing exit nodes,
+        // so the allocation lock is held across the whole insert - this
+        // guarantees exit node subnets never overlap within the org, even
+        // under concurrent creation, which matters for HA setups. Subnets
+        // may still be reused across different orgs; there isn't enough
+        // address space to avoid that, and it isn't necessary since HA only
+        // routes multiple exit nodes for the same org.
         let releaseSubnetLock: (() => Promise<void>) | null = null;
         let newExitNodeAddress: string | null = null;
         if (!existingExitNode) {
-            const { value, release } = await getNextAvailableSubnet();
+            const { value, release } = await getNextAvailableSubnet(
+                db,
+                orgId
+            );
             newExitNodeAddress = value;
             releaseSubnetLock = release;
         }