fix(api): cap label values returned by ClickHouse's Prometheus handler

Author: karl-power

packages/api/src/routers/api/__tests__/prometheus.int.test.ts

@@ -17,6 +17,7 @@ import {
   clickhousePrometheusUpstream,
   joinPrometheusUpstreamUrl,
 } from '@/controllers/promql';
+import { PROMETHEUS_MAX_RESULT_ROWS } from '@/controllers/timeseriesEngine';
 import {
   DEFAULT_DATABASE,
   dropTimeSeriesTable,
@@ -2283,6 +2284,35 @@ describe('prometheus router', () => {
       },
     );
 
+    // The handler returns all values in one row, which max_result_rows can't cap.
+    it.each([
+      ['no limit', ''],
+      ['limit=0', '&limit=0'],
+      ['a limit over the cap', `&limit=${PROMETHEUS_MAX_RESULT_ROWS + 1}`],
+    ])(
+      'caps the values the handler returns when the request has %s',
+      async (_case, limitQuery) => {
+        stubServerVersion([26, 10, 0, 0]);
+        const { agent, team } = await getLoggedInAgent(server);
+        const source = await seedClickHouseSource(team._id);
+        mockFetch
+          .mockResolvedValueOnce(handlerProbeResponse())
+          .mockResolvedValueOnce(
+            fakeUpstreamResponse({ status: 'success', data: [] }),
+          );
+
+        await agent
+          .get('/v1/prometheus/label/job/values')
+          .query(`sourceId=${source._id.toString()}${limitQuery}`)
+          .expect(200);
+
+        const url = new URL(String(mockFetch.mock.calls[1][0]));
+        expect(url.searchParams.getAll('limit')).toEqual([
+          String(PROMETHEUS_MAX_RESULT_ROWS),
+        ]);
+      },
+    );
+
     // 26.8's handler answers label lookups with a 400 ("not implemented"), so
     // the route must never send them there.
     it.each(ROUTES)(

packages/api/src/routers/api/prometheus.ts

@@ -22,6 +22,7 @@ import {
   resolvePromqlTarget,
 } from '@/controllers/promql';
 import {
+  PROMETHEUS_MAX_RESULT_ROWS,
   queryInstantViaTableFunction,
   queryLabelNames,
   queryLabelValues,
@@ -860,10 +861,21 @@ async function handleLabelLookup(
     backend = 'clickhouse';
     if ((await resolveClickhouseLabelBackend(target)) === 'clickhouse-http') {
       const { upstream, headers } = clickhousePrometheusRequest(connection);
+      // The handler returns every value in a single row, so the upstream's
+      // max_result_rows never applies. Cap the values themselves instead.
+      const cappedLimit = Math.min(
+        limit || PROMETHEUS_MAX_RESULT_ROWS,
+        PROMETHEUS_MAX_RESULT_ROWS,
+      );
       const status = await proxyToPrometheus(
         upstream,
         `${CLICKHOUSE_PROMETHEUS_API_PREFIX}${apiPath}`,
-        { ...proxyParams, database: databaseName, table: tableName },
+        {
+          ...proxyParams,
+          limit: String(cappedLimit),
+          database: databaseName,
+          table: tableName,
+        },
         res,
         headers,
         CLICKHOUSE_HTTP_API_UNAVAILABLE_MESSAGE,