rule builder WIP #2691
No reviewers
Labels
No labels
1week
2weeks
Failed compliance check
IP cameras
NATS
Possible security concern
Review effort 1/5
Review effort 2/5
Review effort 3/5
Review effort 4/5
Review effort 5/5
UI
aardvark
accessibility
amd64
api
arm64
auth
back-end
bgp
blog
bug
build
checkers
ci-cd
cleanup
cnpg
codex
core
dependencies
device-management
documentation
duplicate
dusk
ebpf
enhancement
eta 1d
eta 1hr
eta 3d
eta 3hr
feature
fieldsurvey
github_actions
go
good first issue
help wanted
invalid
javascript
k8s
log-collector
mapper
mtr
needs-triage
netflow
network-sweep
observability
oracle
otel
plug-in
proton
python
question
reddit
redhat
research
rperf
rperf-checker
rust
sdk
security
serviceradar-agent
serviceradar-agent-gateway
serviceradar-web
serviceradar-web-ng
siem
snmp
sysmon
topology
ubiquiti
wasm
wontfix
zen-engine
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
carverauto/serviceradar!2691
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "refs/pull/2691/head"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Imported from GitHub pull request.
Original GitHub pull request: #2341
Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/pull/2341
Original created: 2026-01-18T08:35:14Z
Original updated: 2026-01-18T08:37:17Z
Original head: carverauto/serviceradar:2338-feat-create-event-from-existing-log
Original base: staging
Original merged: 2026-01-18T08:36:27Z by @mfreeman451
User description
IMPORTANT: Please sign the Developer Certificate of Origin
Thank you for your contribution to ServiceRadar. Please note, when contributing, the developer must include
a DCO sign-off statement indicating the DCO acceptance in one commit message. Here
is an example DCO Signed-off-by line in a commit message:
Describe your changes
Issue ticket number and link
Code checklist before requesting a review
PR Type
Enhancement
Description
Add rule builder modal for creating log promotion rules directly from log details view
Implement attribute parsing to display structured log metadata instead of raw strings
Enable rule testing/preview against recent logs before saving via SRQL queries
Integrate rule builder with existing Rules management UI for editing and toggling rules
Add RBAC checks to restrict rule creation to operator/admin roles
Diagram Walkthrough
File Walkthrough
3 files
New LiveComponent for building log promotion rulesAdd rule builder modal and attribute parsing to log detailsEnable rule builder for creating and editing promotion rules3 files
Unit tests for rule builder parsing and query buildingLiveView tests for RBAC and rule builder integrationAdd tests for promotion rule builder functionality4 files
Design document for log-to-event rule builder featureProposal document explaining feature motivation and scopeRequirements specification for rule creation and attribute displayImplementation task checklist for feature developmentImported GitHub PR comment.
Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/2341#issuecomment-3765059055
Original created: 2026-01-18T08:36:06Z
CI Feedback 🧐
A test triggered by this PR failed. Here is an AI-generated analysis of the failure:
Action: build
Failed stage: Configure SRQL fixture database for tests [❌]
Failed test name: ""
Failure summary:
The action failed during environment/fixture validation because the required secret
SRQL_TEST_DATABASE_CA_CERTwas not configured.The workflow explicitly checks for this secret to
verify TLS for the SRQL test fixture and aborts when it is empty, printing:
SRQL_TEST_DATABASE_CA_CERT secret must be configured to verify SRQL fixture TLS.and exiting withcode 1.
Relevant error logs:
Imported GitHub PR comment.
Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/2341#issuecomment-3765059117
Original created: 2026-01-18T08:36:11Z
PR Compliance Guide 🔍
Below is a summary of compliance checks for this PR:
SRQL injection
Description: User-controlled inputs are interpolated into an SRQL query string for preview
(
build_preview_query/1->srql_module().query/1), and while quotes/backslashes areescaped, other SRQL metacharacters/operators may still allow query manipulation depending
on SRQL parsing rules (needs verification against SRQL grammar).
promotion_rule_builder.ex [500-748]
Referred Code
🎫 #2338
service name, attribute match).
delete).
attributes without errors.
count and sample matches).
but not create rules).
(implemented as creating a log-promotion rule/event rule from the log).
Codebase context is not defined
Follow the guide to enable codebase context checks.
Generic: Meaningful Naming and Self-Documenting Code
Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting
Status: Passed
Generic: Secure Logging Practices
Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.
Status: Passed
Generic: Secure Error Handling
Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.
Status: 🏷️
Internal details exposed: User-visible error strings embed
inspect(reason)(including task exit reasons and otherinternal structures), which can leak implementation details to the UI.
Referred Code
Generic: Comprehensive Audit Trails
Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.
Status: 🏷️
Missing audit logging: The PR adds rule create/update operations (and related UI actions) without any explicit
audit log events that record acting user, action, and outcome, so audit coverage likely
depends on unseen Ash-level auditing.
Referred Code
Generic: Robust Error Handling and Edge Case Management
Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation
Status: 🏷️
Unhandled SRQL exceptions: The preview execution calls
srql_module().query(query)inside a task without a rescue, sounexpected exceptions may surface as task exits and produce inconsistent/overly detailed
errors depending on runtime behavior.
Referred Code
Generic: Security-First Input Validation and Data Handling
Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities
Status: 🏷️
Missing RBAC enforcement: The settings UI exposes create/edit/toggle promotion-rule actions without any role checks
in the LiveView, so authorization relies on unseen Ash policies and cannot be verified
from the diff.
Referred Code
Compliance status legend
🟢 - Fully Compliant🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label
Imported GitHub PR comment.
Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/2341#issuecomment-3765059906
Original created: 2026-01-18T08:37:17Z
PR Code Suggestions ✨
Explore these optional code suggestions:
Implement promotion rule deletion
Implement the missing
handle_event("delete_promotion", ...)callback to handlethe deletion of a
LogPromotionRulewhen the delete button is clicked.web-ng/lib/serviceradar_web_ng_web/live/settings/rules_live/index.ex [446-454]
Suggestion importance[1-10]: 9
__
Why: The PR adds a delete button with a
phx-click="delete_promotion"event but fails to implement the correspondinghandle_eventcallback, which would cause a runtime crash. This suggestion correctly identifies and fixes this critical bug.Support dots/hyphens in attribute keys
Update the attribute parsing regex to support keys containing dots and hyphens
by changing
\w+to[^=,]+.web-ng/lib/serviceradar_web_ng_web/components/promotion_rule_builder.ex [793]
Suggestion importance[1-10]: 8
__
Why: The suggestion correctly identifies that the attribute parsing regex is too restrictive, as it only allows word characters in keys. The proposed change to
[^=,]+correctly expands support to include common characters like dots and hyphens, making the parsing logic more robust and preventing silent failures for valid attribute formats.Extract attribute parsing helper
Refactor the duplicated attribute parsing logic from
promotion_rule_builder.exand
show.exinto a single, shared helper module to improve maintainability.web-ng/lib/serviceradar_web_ng_web/components/promotion_rule_builder.ex [773-779]
[To ensure code accuracy, apply this suggestion manually]Suggestion importance[1-10]: 7
__
Why: The suggestion correctly identifies duplicated attribute parsing logic between two files. Extracting this logic into a shared module would improve code maintainability and reduce redundancy, which is a valuable improvement.