[release] v0.100.9

api/ee/src/apis/fastapi/events/router.py

@@ -1,17 +1,31 @@
-"""Admin-only events retention router.
+"""EE events routers.
 
-Mounts at ``/admin/events/flush``. Independent from spans retention — own
+Mounts user-facing audit-log querying at ``/events/query`` and admin retention
+at ``/admin/events/flush``. Retention is independent from spans retention: own
 lock namespace, own cron schedule, own failure mode.
 """
 
-from fastapi import APIRouter, status
+from uuid import UUID
+from typing import Union
+
+from fastapi import APIRouter, Request, status
 from fastapi.responses import JSONResponse
 
 from oss.src.utils.logging import get_module_logger
 from oss.src.utils.exceptions import intercept_exceptions
 from oss.src.utils.caching import acquire_lock, release_lock
+from oss.src.core.events.service import EventsService
 
-from ee.src.core.events.service import EventsService
+from ee.src.apis.fastapi.events.models import EventQueryRequest, EventsQueryResponse
+from ee.src.core.events.service import EventsRetentionService
+from ee.src.models.shared_models import Permission
+from ee.src.utils.permissions import check_action_access, FORBIDDEN_EXCEPTION
+from ee.src.utils.entitlements import (
+    check_entitlements,
+    NOT_ENTITLED_RESPONSE,
+    Flag,
+    Tracker,
+)
 
 
 log = get_module_logger(__name__)
@@ -24,6 +38,56 @@ def __init__(
     ):
         self.events_service = events_service
 
+        self.router = APIRouter()
+
+        self.router.add_api_route(
+            "/query",
+            self.query_events,
+            methods=["POST"],
+            operation_id="query_events_rpc",
+            status_code=status.HTTP_200_OK,
+            response_model=EventsQueryResponse,
+            response_model_exclude_none=True,
+        )
+
+    @intercept_exceptions()
+    async def query_events(
+        self,
+        request: Request,
+        *,
+        query_request: EventQueryRequest,
+    ) -> Union[EventsQueryResponse, JSONResponse]:
+        if not await check_action_access(
+            user_uid=request.state.user_id,
+            project_id=request.state.project_id,
+            permission=Permission.VIEW_EVENTS,
+        ):
+            raise FORBIDDEN_EXCEPTION
+
+        check, _, _ = await check_entitlements(
+            key=Flag.AUDIT,
+        )
+        if not check:
+            return NOT_ENTITLED_RESPONSE(Tracker.FLAGS)
+
+        events = await self.events_service.query(
+            project_id=UUID(request.state.project_id),
+            event=query_request.event,
+            windowing=query_request.windowing,
+        )
+        return EventsQueryResponse(
+            count=len(events),
+            events=events,
+        )
+
+
+class EventsRetentionRouter:
+    def __init__(
+        self,
+        events_retention_service: EventsRetentionService,
+    ):
+        self.events_retention_service = events_retention_service
+
         self.admin_router = APIRouter()
 
         self.admin_router.add_api_route(
@@ -59,7 +123,7 @@ async def flush(self):
 
             try:
                 log.info("[flush-events] [endpoint] Retention started")
-                await self.events_service.flush_events()
+                await self.events_retention_service.flush_events()
                 log.info("[flush-events] [endpoint] Retention completed")
 
                 return JSONResponse(

api/ee/src/apis/fastapi/spans/router.py

@@ -12,18 +12,18 @@
 from oss.src.utils.exceptions import intercept_exceptions
 from oss.src.utils.caching import acquire_lock, release_lock
 
-from ee.src.core.tracing.service import TracingService
+from ee.src.core.tracing.service import TracingRetentionService
 
 
 log = get_module_logger(__name__)
 
 
-class SpansRouter:
+class SpansRetentionRouter:
     def __init__(
         self,
-        tracing_service: TracingService,
+        tracing_retention_service: TracingRetentionService,
     ):
-        self.tracing_service = tracing_service
+        self.tracing_retention_service = tracing_retention_service
 
         self.admin_router = APIRouter()
 
@@ -60,7 +60,7 @@ async def flush(self):
 
             try:
                 log.info("[flush-spans] [endpoint] Retention started")
-                await self.tracing_service.flush_spans()
+                await self.tracing_retention_service.flush_spans()
                 log.info("[flush-spans] [endpoint] Retention completed")
 
                 return JSONResponse(

api/ee/src/core/events/service.py

@@ -4,10 +4,9 @@
 ``Counter.EVENTS_INGESTED.retention``, deletes events older than the
 retention cutoff for projects whose org subscribes to that plan.
 
-Parallel to ``ee.src.core.tracing.service.TracingService`` (same shape,
-different counter and DAO). Both names live in EE; the OSS counterparts
-(``oss.src.core.events.service.EventsService`` and
-``oss.src.core.tracing.service.TracingService``) own ingest/query.
+Parallel to ``ee.src.core.tracing.service.TracingRetentionService`` (same shape,
+different counter and DAO). The OSS counterpart
+(``oss.src.core.events.service.EventsService``) owns ingest/query.
 """
 
 from datetime import datetime, timezone, timedelta
@@ -16,18 +15,18 @@
 
 from ee.src.core.entitlements.types import Tracker, Counter
 from ee.src.core.entitlements.controls import get_plans
-from ee.src.dbs.postgres.events.dao import EventsDAO
+from ee.src.dbs.postgres.events.dao import EventsRetentionDAO
 
 
 log = get_module_logger(__name__)
 
 
-class EventsService:
+class EventsRetentionService:
     def __init__(
         self,
-        events_dao: EventsDAO,
+        events_retention_dao: EventsRetentionDAO,
     ):
-        self.events_dao = events_dao
+        self.events_dao = events_retention_dao
 
     async def flush_events(
         self,

api/ee/src/core/tracing/service.py

@@ -4,18 +4,18 @@
 
 from ee.src.core.entitlements.types import Tracker, Counter
 from ee.src.core.entitlements.controls import get_plans
-from ee.src.dbs.postgres.tracing.dao import TracingDAO
+from ee.src.dbs.postgres.tracing.dao import TracingRetentionDAO
 
 
 log = get_module_logger(__name__)
 
 
-class TracingService:
+class TracingRetentionService:
     def __init__(
         self,
-        tracing_dao: TracingDAO,
+        tracing_retention_dao: TracingRetentionDAO,
     ):
-        self.tracing_dao = tracing_dao
+        self.tracing_dao = tracing_retention_dao
 
     async def flush_spans(
         self,

api/ee/src/dbs/postgres/events/dao.py

@@ -3,7 +3,7 @@
 Walks ``projects ⋈ subscriptions`` to find projects on a given plan, then
 deletes events older than a cutoff from the ``events`` table. Lives in EE
 because the project-to-plan join goes through the EE ``SubscriptionDBE``
-table — same reason ``ee.src.dbs.postgres.tracing.dao.TracingDAO`` is
+table — same reason ``ee.src.dbs.postgres.tracing.dao.TracingRetentionDAO`` is
 EE-side.
 
 The OSS counterpart (``oss.src.dbs.postgres.events.dao.EventsDAO``) owns
@@ -31,12 +31,11 @@
 log = get_module_logger(__name__)
 
 
-class EventsDAO:
+class EventsRetentionDAO:
     """EE events DAO (retention).
 
-    Same-name OSS class exists at ``oss.src.dbs.postgres.events.dao.EventsDAO``
-    for ingest/query — both are imported by their full path so they never
-    collide. Matches the EE/OSS tracing pattern.
+    ``oss.src.dbs.postgres.events.dao.EventsDAO`` owns ingest/query; this class
+    owns retention only.
     """
 
     async def fetch_projects_with_plan(

api/ee/src/dbs/postgres/tracing/dao.py

@@ -69,7 +69,7 @@
 )
 
 
-class TracingDAO:
+class TracingRetentionDAO:
     # ---------------- #
     # Raw-SQL versions
     # ---------------- #

api/ee/src/main.py

@@ -3,26 +3,28 @@
 
 from oss.src.utils.env import env
 from oss.src.utils.logging import get_module_logger
+from oss.src.dbs.postgres.events.dao import EventsDAO
+from oss.src.core.events.service import EventsService
 
 from ee.src.routers import (
     workspace_router,
     organization_router as _organization_router,
 )
 
 from ee.src.dbs.postgres.meters.dao import MetersDAO
-from ee.src.dbs.postgres.tracing.dao import TracingDAO
+from ee.src.dbs.postgres.tracing.dao import TracingRetentionDAO
 from ee.src.dbs.postgres.subscriptions.dao import SubscriptionsDAO
-from ee.src.dbs.postgres.events.dao import EventsDAO
+from ee.src.dbs.postgres.events.dao import EventsRetentionDAO
 
 from ee.src.core.meters.service import MetersService
-from ee.src.core.tracing.service import TracingService
+from ee.src.core.tracing.service import TracingRetentionService
 from ee.src.core.subscriptions.service import SubscriptionsService
-from ee.src.core.events.service import EventsService
+from ee.src.core.events.service import EventsRetentionService
 
 from ee.src.apis.fastapi.access.router import AccessRouter
 from ee.src.apis.fastapi.billing.router import BillingRouter
-from ee.src.apis.fastapi.spans.router import SpansRouter
-from ee.src.apis.fastapi.events.router import EventsRouter
+from ee.src.apis.fastapi.spans.router import SpansRetentionRouter
+from ee.src.apis.fastapi.events.router import EventsRouter, EventsRetentionRouter
 from ee.src.apis.fastapi.organizations.router import (
     router as organization_router,
 )
@@ -32,24 +34,28 @@
 
 meters_dao = MetersDAO()
 
-tracing_dao = TracingDAO()
+tracing_retention_dao = TracingRetentionDAO()
 
 subscriptions_dao = SubscriptionsDAO()
 
-events_dao = EventsDAO()
+events_retention_dao = EventsRetentionDAO()
+query_events_dao = EventsDAO()
 
 # CORE -------------------------------------------------------------------------
 
 meters_service = MetersService(
     meters_dao=meters_dao,
 )
 
-tracing_service = TracingService(
-    tracing_dao=tracing_dao,
+tracing_retention_service = TracingRetentionService(
+    tracing_retention_dao=tracing_retention_dao,
 )
 
-events_service = EventsService(
-    events_dao=events_dao,
+events_retention_service = EventsRetentionService(
+    events_retention_dao=events_retention_dao,
+)
+query_events_service = EventsService(
+    events_dao=query_events_dao,
 )
 
 subscription_service = SubscriptionsService(
@@ -73,12 +79,16 @@
     meters_service=meters_service,
 )
 
-spans_router = SpansRouter(
-    tracing_service=tracing_service,
+spans_retention_router = SpansRetentionRouter(
+    tracing_retention_service=tracing_retention_service,
 )
 
 events_router = EventsRouter(
-    events_service=events_service,
+    events_service=query_events_service,
+)
+
+events_retention_router = EventsRetentionRouter(
+    events_retention_service=events_retention_service,
 )
 
 
@@ -108,19 +118,25 @@ def extend_main(app: FastAPI):
     )
 
     app.include_router(
-        router=spans_router.admin_router,
+        router=spans_retention_router.admin_router,
         prefix="/admin/spans",
         tags=["Admin"],
         include_in_schema=False,
     )
 
     app.include_router(
-        router=events_router.admin_router,
+        router=events_retention_router.admin_router,
         prefix="/admin/events",
         tags=["Admin"],
         include_in_schema=False,
     )
 
+    app.include_router(
+        router=events_router.router,
+        prefix="/events",
+        tags=["Events"],
+    )
+
     # ROUTES (more) ------------------------------------------------------------
 
     app.include_router(