stub out project-scoped timeseries endpoint

Author: david-crespo

nexus/external-api/output/nexus_tags.txt

@@ -74,6 +74,7 @@ API operations found with tag "metrics"
 OPERATION ID                             METHOD   URL PATH
 silo_metric                              GET      /v1/metrics/{metric_name}
 timeseries_query                         POST     /v1/timeseries/query
+timeseries_query_project                 POST     /v1/timeseries/query/project/{project}
 timeseries_schema_list                   GET      /v1/timeseries/schema
 
 API operations found with tag "policy"

nexus/external-api/src/lib.rs

@@ -2567,6 +2567,20 @@ pub trait NexusExternalApi {
         body: TypedBody<params::TimeseriesQuery>,
     ) -> Result<HttpResponseOk<views::OxqlQueryResult>, HttpError>;
 
+    /// Run project-scoped timeseries query
+    ///
+    /// Queries are written in OxQL. Queries can only refer to timeseries data from the specified project.
+    #[endpoint {
+        method = POST,
+        path = "/v1/timeseries/query/project/{project}",
+        tags = ["metrics"],
+    }]
+    async fn timeseries_query_project(
+        rqctx: RequestContext<Self::Context>,
+        path_params: Path<params::ProjectPath>,
+        body: TypedBody<params::TimeseriesQuery>,
+    ) -> Result<HttpResponseOk<views::OxqlQueryResult>, HttpError>;
+
     // Updates
 
     /// Upload TUF repository

nexus/src/app/metrics.rs

@@ -178,4 +178,46 @@ impl super::Nexus {
                 _ => Error::InternalError { internal_message: e.to_string() },
             })
     }
+
+    /// Run an OxQL query against the timeseries database, scoped to a specific project.
+    pub(crate) async fn timeseries_query_project(
+        &self,
+        _opctx: &OpContext,
+        project_lookup: &lookup::Project<'_>,
+        query: impl AsRef<str>,
+    ) -> Result<Vec<oxql_types::Table>, Error> {
+        // Ensure the user has read access to the project
+        let (.., authz_project) =
+            project_lookup.lookup_for(authz::Action::Read).await?;
+
+        let parsed_query = oximeter_db::oxql::Query::new(query.as_ref())
+            .map_err(|e| Error::invalid_request(e.to_string()))?;
+
+        // Check that the query only refers to the project
+
+        self.timeseries_client
+            .get()
+            .await
+            .map_err(|e| {
+                Error::internal_error(&format!(
+                    "Cannot access timeseries DB: {}",
+                    e
+                ))
+            })?
+            .oxql_query(query)
+            .await
+            .map(|result| result.tables)
+            .map_err(|e| match e {
+                oximeter_db::Error::DatabaseUnavailable(_) => {
+                    Error::ServiceUnavailable {
+                        internal_message: e.to_string(),
+                    }
+                }
+                oximeter_db::Error::Oxql(_)
+                | oximeter_db::Error::TimeseriesNotFound(_) => {
+                    Error::invalid_request(e.to_string())
+                }
+                _ => Error::InternalError { internal_message: e.to_string() },
+            })
+    }
 }

nexus/src/external_api/http_entrypoints.rs

@@ -5544,6 +5544,35 @@ impl NexusExternalApi for NexusExternalApiImpl {
             .await
     }
 
+    async fn timeseries_query_project(
+        rqctx: RequestContext<ApiContext>,
+        path_params: Path<params::ProjectPath>,
+        body: TypedBody<params::TimeseriesQuery>,
+    ) -> Result<HttpResponseOk<views::OxqlQueryResult>, HttpError> {
+        let apictx = rqctx.context();
+        let handler = async {
+            let nexus = &apictx.context.nexus;
+            let opctx =
+                crate::context::op_context_for_external_api(&rqctx).await?;
+            let project_path = path_params.into_inner();
+            let query = body.into_inner().query;
+            let project_lookup = nexus.project_lookup(
+                &opctx,
+                params::ProjectSelector { project: project_path.project },
+            )?;
+            nexus
+                .timeseries_query_project(&opctx, &project_lookup, &query)
+                .await
+                .map(|tables| HttpResponseOk(views::OxqlQueryResult { tables }))
+                .map_err(HttpError::from)
+        };
+        apictx
+            .context
+            .external_latencies
+            .instrument_dropshot_handler(&rqctx, handler)
+            .await
+    }
+
     // Updates
 
     async fn system_update_put_repository(

nexus/tests/integration_tests/metrics.rs

@@ -287,6 +287,27 @@ async fn test_timeseries_schema_list(
 pub async fn timeseries_query(
     cptestctx: &ControlPlaneTestContext<omicron_nexus::Server>,
     query: impl ToString,
+) -> Vec<oxql_types::Table> {
+    execute_timeseries_query(cptestctx, "/v1/timeseries/query", query).await
+}
+
+pub async fn project_timeseries_query(
+    cptestctx: &ControlPlaneTestContext<omicron_nexus::Server>,
+    project: &str,
+    query: impl ToString,
+) -> Vec<oxql_types::Table> {
+    execute_timeseries_query(
+        cptestctx,
+        &format!("/v1/timeseries/query/projects/{}", project),
+        query,
+    )
+    .await
+}
+
+async fn execute_timeseries_query(
+    cptestctx: &ControlPlaneTestContext<omicron_nexus::Server>,
+    endpoint: &str,
+    query: impl ToString,
 ) -> Vec<oxql_types::Table> {
     // first, make sure the latest timeseries have been collected.
     cptestctx.oximeter.force_collect().await;
@@ -300,7 +321,7 @@ pub async fn timeseries_query(
         nexus_test_utils::http_testing::RequestBuilder::new(
             &cptestctx.external_client,
             http::Method::POST,
-            "/v1/timeseries/query",
+            endpoint,
         )
         .body(Some(&body)),
     )
@@ -527,6 +548,41 @@ async fn test_instance_watcher_metrics(
     assert_gte!(ts2_running, 2);
 }
 
+#[nexus_test]
+async fn test_project_timeseries_query(
+    cptestctx: &ControlPlaneTestContext<omicron_nexus::Server>,
+) {
+    let client = &cptestctx.external_client;
+
+    // Create two projects
+    let project1 = create_project(&client, "project1").await;
+    let project2 = create_project(&client, "project2").await;
+
+    // Create resources in each project
+    create_instance(&client, "project1", "instance1").await;
+    create_instance(&client, "project2", "instance2").await;
+
+    // Force a metrics collection
+    cptestctx.oximeter.force_collect().await;
+
+    // Query for project1
+    let query1 = "get virtual_machine:check"; // TODO: add project to query
+    let result1 =
+        project_timeseries_query(&cptestctx, "project1", query1).await;
+
+    // shouldn't work
+    let result1 =
+        project_timeseries_query(&cptestctx, "project2", query1).await;
+
+    // Query for project2
+    let query2 = "get virtual_machine:check";
+    let result2 =
+        project_timeseries_query(&cptestctx, "project2", query2).await;
+
+    // Query with no project specified
+    // Query with nonexistent project
+}
+
 #[nexus_test]
 async fn test_mgs_metrics(
     cptestctx: &ControlPlaneTestContext<omicron_nexus::Server>,

openapi/nexus.json

@@ -8838,6 +8838,55 @@
         }
       }
     },
+    "/v1/timeseries/query/project/{project}": {
+      "post": {
+        "tags": [
+          "metrics"
+        ],
+        "summary": "Run project-scoped timeseries query",
+        "description": "Queries are written in OxQL. Queries can only refer to timeseries data from the specified project.",
+        "operationId": "timeseries_query_project",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "project",
+            "description": "Name or ID of the project",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/NameOrId"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/TimeseriesQuery"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "successful operation",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OxqlQueryResult"
+                }
+              }
+            }
+          },
+          "4XX": {
+            "$ref": "#/components/responses/Error"
+          },
+          "5XX": {
+            "$ref": "#/components/responses/Error"
+          }
+        }
+      }
+    },
     "/v1/timeseries/schema": {
       "get": {
         "tags": [