feat: log context api

[nikhilsinhaparseable]

request -

{
    "stream": "teststream",
    "contextWindow": "1m",
    "pTimestamp": "2026-06-18T07:39:59.995Z",
    "pageSize": 500,
    "message": "Application started",
    "conditions": {
        "operator": "and",
        "groups": [
            {
                "operator": "or",
                "conditionConfig": [
                    {
                        "column": "level",
                        "operator": "=",
                        "value": "warn",
                        "type": "text"
                    }
                ]
            }
        ]
    }
}

response -

{
    "scope": "contextWindow",
    "contextStartTime": "2026-06-18T07:38:00Z",
    "contextEndTime": "2026-06-18T07:40:00Z",
    "limit": 500,
    "anchorIndex": 10,
    "duplicateAnchorCount": 15,
    "anchoredDuplicate": "first",
    "records": [
        {
            "app_meta": "okcequedfmkqlgzheaidrcce",
            "device_id": 126.0,
            "host": "172.162.1.120",
            "level": "warn",
            "location": "uqwetjbuvjameflh",
            "message": "Application is failing",
            "meta-containerimage": "ghcr.io/parseablehq/quest",
            "meta-containername": "log-generator",
            "meta-host": "10.116.0.3",
            "meta-namespace": "go-apasdp",
            "meta-podlabels": "app=go-app,pod-template-hash=6c87bc9cc9",
            "meta-source": "quest-test",
            "os": "Windows",
            "p_src_ip": "127.0.0.1",
            "p_timestamp": "2026-06-18T07:39:59.995",
            "p_user_agent": "Grafana k6/1.6.1",
            "request_body": "vlywlgkpmciorkiklfruxcfnzaspahyscsazpmnqgquqrtahrzhmtojwvackzcqngscesuadnupwpdsryfrvlifembjotnftzuwx",
            "session_id": "pqr",
            "source_time": "2026-06-18T07:39:59.991",
            "status_code": 500.0,
            "user_id": 98513.0,
            "uuid": "169fa593-fa27-4625-8576-1faab8b9cc71",
            "version": "1.2.0"
        }
    ],
    "queries": {
        "previous": {
            "query": "SELECT * FROM (SELECT * FROM \"teststream\" WHERE ((\"p_timestamp\" >= TIMESTAMP '2026-06-18 07:38:00.000' AND \"p_timestamp\" < TIMESTAMP '2026-06-18 07:40:00.000') AND ((\"level\" = 'warn'))) AND (\"p_timestamp\" > TIMESTAMP '2026-06-18 07:39:59.995' OR (\"p_timestamp\" = TIMESTAMP '2026-06-18 07:39:59.995' AND \"message\" < 'Application is failing')) ORDER BY \"p_timestamp\" ASC, \"message\" DESC LIMIT 500) AS log_context_seek_page ORDER BY \"p_timestamp\" DESC, \"message\" ASC",
            "startTime": "2026-06-18T07:38:00Z",
            "endTime": "2026-06-18T07:40:00Z",
            "sendNull": false
        },
        "next": {
            "query": "SELECT * FROM \"teststream\" WHERE ((\"p_timestamp\" >= TIMESTAMP '2026-06-18 07:38:00.000' AND \"p_timestamp\" < TIMESTAMP '2026-06-18 07:40:00.000') AND ((\"level\" = 'warn'))) AND (\"p_timestamp\" < TIMESTAMP '2026-06-18 07:39:59.662' OR (\"p_timestamp\" = TIMESTAMP '2026-06-18 07:39:59.662' AND \"message\" > 'Logging a request')) ORDER BY \"p_timestamp\" DESC, \"message\" ASC LIMIT 500",
            "startTime": "2026-06-18T07:38:00Z",
            "endTime": "2026-06-18T07:40:00Z",
            "sendNull": false
        }
    }
}

Summary by CodeRabbit

• New Features
  • Added a new query context endpoint (POST /query/context) that returns a time-bounded window of records around an anchor timestamp for a selected dataset.
  • Supports configurable page size, context window sizing, RFC3339/UTC timestamp parsing, and cursor-based pagination for previous/next results.
  • Includes authorization and schema validation, returning an anchor-duplicate count and cursor payloads in the response.
• Tests
  • Added unit coverage for input validation, timestamp/page-size handling, context bound truncation, and pagination SQL generation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: f5c2d406-1829-40e8-9e80-2c08f11a43bf

📥 Commits

Reviewing files that changed from the base of the PR and between 046a454 and 39294a0.

📒 Files selected for processing (1)

• src/handlers/http/query_context.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• src/handlers/http/query_context.rs

---

Walkthrough

Adds a new POST /query/context HTTP endpoint implementing log context window queries. The endpoint accepts an anchor timestamp, a match field, a context window duration, and optional cursor/page parameters; it fetches paginated log records surrounding the anchor row using parallel SQL queries with cursor-based pagination, and returns a merged result with anchor_index and previous/next cursor payloads.

Changes

Log Context Window Query Feature

Layer / File(s)	Summary
Module declaration and route registration src/handlers/http/mod.rs, src/handlers/http/modal/server.rs, src/handlers/http/modal/query_server.rs	Declares the query_context submodule, imports it, defines POST /query/context factory with Action::Query authorization and IntraClusterRequest wrapper, and registers it in both Server and QueryServer route configuration.
Authorized query execution helper src/handlers/http/query.rs	Adds get_records_and_fields_for_authorized_query, which validates all resolved dataset names against a caller-supplied authorized_tables slice, sets DataFusion default schema from tenant_id, executes a non-streaming query, and returns record batches and field names.
API types and handler entrypoint src/handlers/http/query_context.rs	Defines LogContextRequest, LogContextResponse, LogContextScope, LogContextQueries, LogContextQueryPayload, and implements the query_context handler that authenticates, authorizes, validates stream schema and match-field type, orchestrates concurrent anchor-count and window fetch queries, merges results with anchor_index, and constructs cursor payloads.
Input normalization and validation src/handlers/http/query_context.rs	Implements pageSize clamping and zero-rejection, pTimestamp parsing from RFC3339 or naive UTC formats, context window duration parsing with minute-truncation of computed bounds, and match-field exclusivity validation with schema existence and string-type enforcement.
SQL construction, pagination, and execution src/handlers/http/query_context.rs	Builds anchor duplicate-count SQL, newer/older neighbor queries with cursor predicates and directional ORDER BY, assembles previous/next cursor payloads from fetched records, merges result windows with anchor_index computation, and implements lower-level predicates for time scoping, anchor matching, and directional seek semantics.
Unit tests src/handlers/http/query_context.rs	Validates timestamp parsing formats (RFC3339, naive UTC), window truncation to minute boundaries, page size defaults and clamping, match-field schema/type enforcement, and SQL structure correctness for anchor-count and cursor pagination queries.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant query_context as POST /query/context
  participant PermissionProvider
  participant StreamSchema
  participant get_records_and_fields as Query Executor

  Client->>query_context: LogContextRequest (stream, pTimestamp, contextWindow, matchField, cursor?)
  query_context->>PermissionProvider: authenticate and authorize stream
  PermissionProvider-->>query_context: authorized_tables
  query_context->>StreamSchema: validate matchField exists and is string type
  StreamSchema-->>query_context: field validated
  par anchor count
    query_context->>get_records_and_fields: execute anchor duplicate-count SQL
    get_records_and_fields-->>query_context: anchor_count
  and newer records
    query_context->>get_records_and_fields: execute newer rows SQL with cursor
    get_records_and_fields-->>query_context: newer_records
  and older records
    query_context->>get_records_and_fields: execute older rows SQL with cursor
    get_records_and_fields-->>query_context: older_records
  end
  query_context->>query_context: merge records, compute anchor_index, build cursors
  query_context-->>Client: LogContextResponse (records, anchor_index, previous/next cursors)

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Suggested labels

for next release

Suggested reviewers

• parmesant

Poem

🐇 A rabbit hopped through logs so vast,
With anchors set and windows cast.
Cursors leap both newer, older,
Each context page a little bolder.
SQL built with care and flair—
The log context window's finally there! 🪟

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 46.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check	❓ Inconclusive	Description includes request/response examples and context but lacks explicit testing verification, documentation confirmation, and detailed goal/rationale explanation required by template.	Add explicit confirmation that testing was completed, provide documentation updates, and explain the goal and rationale behind the log context API feature.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title clearly and concisely summarizes the main feature being added (log context API), matching the changeset scope.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/handlers/http/query_context.rs`:
- Around line 407-418: The `get_filter_string` function in `alerts_utils.rs`
introduces a SQL injection vulnerability by directly interpolating user-provided
`inner_value` parameters into SQL without escaping (e.g., in
`list_condition_expr` where values are inserted into ARRAY expressions). To fix
this, implement proper escaping of all user-provided values before they are
interpolated into SQL strings, or refactor the implementation to use
parameterized queries instead of string concatenation. Ensure that the
`inner_value` parameter in `list_condition_expr` and any other user inputs are
safely escaped before being embedded in SQL expressions, preventing attackers
from breaking out of the ARRAY context with malicious input like `1] OR 1=1;
--`.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 08651597-4aa7-49df-b1b6-2a895de0f613

📥 Commits

Reviewing files that changed from the base of the PR and between 0f35674 and 3ba0904.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• src/handlers/http/mod.rs
• src/handlers/http/modal/query_server.rs
• src/handlers/http/modal/server.rs
• src/handlers/http/query.rs
• src/handlers/http/query_context.rs