fix(backend): discard batch if it contains duplicate event or span ids (

#1588)

- discard the event request batch if it contains duplicate event or span
ids

fixes #1486

Signed-off-by: detj <[email protected]>

backend/api/measure/event.go

@@ -159,6 +159,8 @@ func (e *eventreq) read(c *gin.Context, appId uuid.UUID) error {
 		return fmt.Errorf(`payload must contain at least 1 event or 1 span`)
 	}
 
+	dupeEventMap := make(map[uuid.UUID]struct{})
+
 	for i := range events {
 		if events[i] == "" {
 			return fmt.Errorf(`any event field must not be empty`)
@@ -168,6 +170,16 @@ func (e *eventreq) read(c *gin.Context, appId uuid.UUID) error {
 		if err := json.Unmarshal(bytes, &ev); err != nil {
 			return err
 		}
+
+		// discard batch if duplicate
+		// event ids found
+		_, ok := dupeEventMap[ev.ID]
+		if ok {
+			return fmt.Errorf("duplicate event id %q found, discarding batch", ev.ID)
+		} else {
+			dupeEventMap[ev.ID] = struct{}{}
+		}
+
 		e.bumpSize(int64(len(bytes)))
 		ev.AppID = appId
 
@@ -207,6 +219,8 @@ func (e *eventreq) read(c *gin.Context, appId uuid.UUID) error {
 		e.events = append(e.events, ev)
 	}
 
+	dupeSpanMap := make(map[string]struct{})
+
 	for i := range spans {
 		if spans[i] == "" {
 			return fmt.Errorf(`any span field must not be empty`)
@@ -216,6 +230,16 @@ func (e *eventreq) read(c *gin.Context, appId uuid.UUID) error {
 		if err := json.Unmarshal(bytes, &sp); err != nil {
 			return err
 		}
+
+		// discard batch if duplicate
+		// span ids found
+		_, ok := dupeSpanMap[sp.SpanID]
+		if ok {
+			return fmt.Errorf("duplicate span id %q found, discarding batch", sp.SpanID)
+		} else {
+			dupeSpanMap[sp.SpanID] = struct{}{}
+		}
+
 		e.bumpSize(int64(len(bytes)))
 		sp.AppID = appId
 

docs/api/sdk/README.md

@@ -63,17 +63,19 @@ Ingests a batch of events, which can be of different types and can range across
 - Maximum size of one request must not exceed **20 MiB**. This limit is includes the combination of events and blob data.
 - Each request must contain a unique UUIDv4 id, set as the header `msr-req-id`. If a request fails, the client must
   retry the same payload with the same `msr-req-id` to ensure idempotency.
-- Each event must contain a nanosecond precision `timestamp` - `"2023-08-24T14:51:38.000000534Z"`
-- Each event must contain a nanosecond precision `start_time` and `end_time` - `"2023-08-24T14:51:38.000000534Z"`
+- Each event must contain a nanosecond precision `timestamp` - `"2023-08-24T14:51:38.000000534Z"`.
+- Each request must not contain duplicate event ids.
+- Each request must not contain duplicate span ids.
+- Each span must contain a nanosecond precision `start_time` and `end_time` - `"2023-08-24T14:51:38.000000534Z"`.
 - Each event must have the following mandatory attributes:
-    - `installation_id`
-    - `measure_sdk_version`
-    - `thread_name`
-    - `platform`
-    - `app_version`
-    - `app_build`
-    - `app_unique_id`
-- Each span must have the following mandatory attributes:
+    - `attribute.installation_id`
+    - `attribute.measure_sdk_version`
+    - `attribute.thread_name`
+    - `attribute.platform`
+    - `attribute.app_version`
+    - `attribute.app_build`
+    - `attribute.app_unique_id`
+- Each span must have the following mandatory fields:
     - `span_name`
     - `span_id`
     - `trace_id`
@@ -82,10 +84,11 @@ Ingests a batch of events, which can be of different types and can range across
     - `start_time`
     - `end_time`
     - `attribute.installation_id`
-    - `attribute.app_unique_id`
+    - `attribute.measure_sdk_version`
+    - `attribute.platform`
     - `attribute.app_version`
     - `attribute.os_version`
-    - `attribute.platform`
+    - `attribute.app_unique_id`
 
 - At least 1 event must be present in the `events` array field or 1 span must be present in the `spans` array field. Both arrays must
 not be empty.
@@ -345,11 +348,11 @@ Events can contain the following attributes, some of which are mandatory.
 
 Events can optionally contain attributes defined by the SDK user. A `user_defined_attribute` is a JSON key/value pair object. There are some constraints you should be aware of.
 
-- An event may contain a maximum of 100 user defined attributes.
+- An event may contain a maximum of 100 arbitrary user defined attributes.
 - Key names should not exceed 256 characters.
 - Key names must be unique in a user defined attribute key/value object.
 - Key names must only contain alphabets, numbers, underscores and hyphens.
-- Value can be regular JSON types. String, Boolean, Number.
+- Value can be regular String, Boolean or Number JSON types only.
 - String values should not exceed 256 characters.
 
 ```jsonc