Niklas Ye
f344bb707b
Each alert carries a generatorURL pointing at the Prometheus rule that fired it. The server now parses that link, queries the same Prometheus for the rule's expression and draws it under the alert, with the current value beside it. The browser never talks to Prometheus, so the CSP stays at connect-src 'self'. The URL comes out of a webhook payload, so whoever holds an integration key chooses it. Querying it is therefore opt-in and bounded by an allowlist, TERDUT_PROMETHEUS_ALLOWED_HOSTS (names, "*" as one label, a leading "**" as several, IPs, CIDRs). The check runs on the address the dialer is about to use, a name that resolves to loopback or link-local is refused even when it matches, and redirects and proxy variables are ignored. A worker takes a snapshot when an incident opens and another when it closes, so the graph outlives Prometheus' retention. It finds its work in the database rather than being triggered from the webhook, so ingestion is untouched and a restart loses nothing. While an incident is open the metrics endpoint also queries live, cached for 15 seconds. The rule expression keeps its threshold, so Prometheus returns data only while the alert condition holds; "no data" for the current value means the condition cleared. Stripping the threshold needs a PromQL parser and is left out. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
39 lines
1.2 KiB
Go
39 lines
1.2 KiB
Go
package prom
|
|
|
|
import (
|
|
"net/url"
|
|
"strings"
|
|
)
|
|
|
|
// ParseGeneratorURL splits an Alertmanager generatorURL into the Prometheus it
|
|
// points at and the expression of the rule that fired. Prometheus builds it as
|
|
// <external-url>/graph?g0.expr=<expr>&g0.tab=1 (/query on Prometheus 3), and the
|
|
// external URL may carry a path prefix, which is kept in base.
|
|
//
|
|
// ok is false for anything else: a non-HTTP scheme, credentials in the URL, a
|
|
// page that is not the graph page, or no expression. The caller then has
|
|
// nothing to query and falls back to showing the link.
|
|
func ParseGeneratorURL(raw string) (base *url.URL, expr string, ok bool) {
|
|
u, err := url.Parse(strings.TrimSpace(raw))
|
|
if err != nil || u.Host == "" || u.User != nil {
|
|
return nil, "", false
|
|
}
|
|
if u.Scheme != "http" && u.Scheme != "https" {
|
|
return nil, "", false
|
|
}
|
|
prefix := ""
|
|
switch {
|
|
case strings.HasSuffix(u.Path, "/graph"):
|
|
prefix = strings.TrimSuffix(u.Path, "/graph")
|
|
case strings.HasSuffix(u.Path, "/query"):
|
|
prefix = strings.TrimSuffix(u.Path, "/query")
|
|
default:
|
|
return nil, "", false
|
|
}
|
|
expr = strings.TrimSpace(u.Query().Get("g0.expr"))
|
|
if expr == "" {
|
|
return nil, "", false
|
|
}
|
|
return &url.URL{Scheme: u.Scheme, Host: u.Host, Path: prefix}, expr, true
|
|
}
|