Skip to content

Rename detection event time fields in GraphQL (Closes #874) - #909

Merged
sehkone merged 2 commits into
mainfrom
octoaide/issue-874-2026-08-12T15-39-12
Aug 27, 2026
Merged

Rename detection event time fields in GraphQL (Closes #874)#909
sehkone merged 2 commits into
mainfrom
octoaide/issue-874-2026-08-12T15-39-12

Conversation

@octoaide

@octoaide octoaide Bot commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Summary

This PR implements the breaking GraphQL schema rename for ambiguous
detection event time fields as described in #874. It pins the
review-database dependency to commit 644db00 and updates schema
resolvers, field descriptions, fixtures, and tests to match the new
field names.

What changed

  • Pinned review-database to commit 644db00 in Cargo.toml
  • Renamed fields for multi-raw event-based detections:
    • startTime -> firstEventStartTime
    • endTime -> lastEventStartTime
      Affected event types: PortScan, MultiHostPortScan, ExternalDdos,
      FtpBruteForce, LdapBruteForce, RdpBruteForce, RepeatedHttpSessions
  • Renamed fields for UnusualDestinationPattern:
    • startTime -> samplingWindowStartTime
    • endTime -> samplingWindowEndTime
  • Updated GraphQL resolvers to reference the renamed database fields
  • Updated field descriptions to document exact time semantics
  • Updated representative fixtures and GraphQL event query tests
  • Added schema introspection tests to ensure old fields are removed
  • Updated CHANGELOG.md

Files touched (high level)

  • Cargo.toml (dependency pin)
  • src/graphql/event.rs and per-event resolvers (ftp, http, ldap, rdp,
    unusual_destination_pattern, conn, etc.)
  • Tests and fixtures
  • CHANGELOG.md

Breaking change

This is a breaking GraphQL schema change: clients that use the old
startTime/endTime fields must be updated to the new field names.

Testing notes / merge instructions

Local formatting, lint, and unit tests passed. I could not regenerate
Cargo.lock locally because GitHub DNS access prevented Cargo from
fetching the pinned review-database commit; as a result the lockfile was
not updated here. Please run cargo update -p review-database (or
allow CI to fetch and update the lockfile) before merging so the
lockfile contains the new reference.

Closes #874

@octoaide
octoaide Bot requested review from kimhanbeom and sehkone August 12, 2026 18:01
@codecov

codecov Bot commented Aug 12, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.33%. Comparing base (d762ada) to head (dc4ceda).

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #909      +/-   ##
==========================================
+ Coverage   85.29%   85.33%   +0.04%     
==========================================
  Files          77       77              
  Lines       31067    31160      +93     
==========================================
+ Hits        26498    26591      +93     
  Misses       4569     4569              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Comment thread CHANGELOG.md Outdated
@kimhanbeom
kimhanbeom removed the request for review from sehkone August 20, 2026 06:29
@kimhanbeom
kimhanbeom force-pushed the octoaide/issue-874-2026-08-12T15-39-12 branch from e1adba2 to 6ba3b31 Compare August 21, 2026 05:04
@kimhanbeom
kimhanbeom force-pushed the octoaide/issue-874-2026-08-12T15-39-12 branch from 6ba3b31 to dc4ceda Compare August 26, 2026 04:36
@sehkone
sehkone merged commit 2181843 into main Aug 27, 2026
14 checks passed
@sehkone
sehkone deleted the octoaide/issue-874-2026-08-12T15-39-12 branch August 27, 2026 01:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Rename detection event time fields in GraphQL

3 participants