Skip to content

fix(export): bound every export call and order current days first - #63

Merged
jm-rivera merged 1 commit into
devfrom
fix/export-review
Oct 24, 2026
Merged

jm-rivera merged 1 commit into
devfrom
fix/export-review

Conversation

@jm-rivera

Copy link
Copy Markdown
Contributor

Fixes the faults a review of release #62 found in the event export, the account export and the request log.

Export Job (db/event-export.ts, db/account-export.ts, db/bounded.ts, db/export-events.ts). Every Postgres and BigQuery call has a client-side bound, listed in deploy/README.md, and a Postgres client that times out is destroyed, never returned to the pool. A 28-minute watchdog in runAndExit logs the phase in flight, the days not started and the failed or short days so far, then exits 1, two minutes before the Cloud Run task timeout; any other failure is logged once with its phase. Yesterday and today export before the stale backlog, so a run the watchdog stops leaves only old days for the next hourly run. Day counts come from one exact COUNT(*) over the table, replacing INFORMATION_SCHEMA.PARTITIONS, and feed both the never-shrink check and the stale days. readDay stops on a short page. The export_rules digest covers the readDay SQL, so the first run after deploy reloads every day once. A golden test pins exported rows to ROW_SHAPE_VERSION.

Request log (src/lib/proxy/requestLog.ts). The target is classified at request start, and a static asset gets no listener and no caller HMAC. path is the arrived target for an origin-form path, the pathname of an http(s) URL, or *; any other target logs /:unparsable, so no userinfo, host or IP reaches the line. docs/analytics.md describes the rules.

Testing: 1,884 tests pass against Postgres 18.4, including hang tests for a page read, the day count, the account read, a load and its cancel, and the watchdog. tsc and eslint are clean. Nothing ran against real BigQuery or Cloud SQL.

Every Postgres and BigQuery call in the event and account exports has a
client-side bound, and a Postgres client that times out is destroyed.
A 28-minute watchdog in runAndExit logs the phase in flight, the days
not started and the faults so far, and exits 1 before the Job's 1800 s
task timeout; every other failure is logged once with its phase. The
window days run before the stale backlog. Day counts come from one exact
query over the table, readDay stops on a short page, and the
export_rules digest covers the readDay SQL, so a change to the exported
row shape reloads history. A golden test pins exported rows to
ROW_SHAPE_VERSION.

The request log classifies the target at request start, adds no
listener for static assets, and logs a placeholder path for any target
other than an origin-form path, an http(s) URL or "*".
@jm-rivera
jm-rivera merged commit 5c73d72 into dev Oct 24, 2026
1 check passed
@jm-rivera
jm-rivera deleted the fix/export-review branch October 24, 2026 16:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant