Let each user pick the timezone timestamps are displayed in

Everything stays UTC: ingest still records Unix nanoseconds, ClickHouse still stores UTC, every API response is still RFC3339 with a Z, and queries are evaluated exactly as before. This changes only how those instants are written on screen, so two people in two timezones looking at one log line see the same instant written two ways -- never two different lines, and never a different sort order. Where the preference lives differs by deployment, and the three cases are genuinely different products rather than one with fallbacks: - Local login: server-side per named user (display_timezone on users, PUT /auth/timezone), so it follows the person across browsers and survives logout. Self-service at the RoleViewer floor, same as the password change -- a viewer is the role most likely to be *only* reading logs, so gating it higher would make it useless. - Public demo: sessionStorage, so every new session starts at UTC. A shared account's visitors have nothing to do with each other. - Neither: localStorage, since there's no per-user record to write to. api/cmd/api/main.go now imports time/tzdata. The image is distroless/static with no /usr/share/zoneinfo, so LoadLocation would otherwise reject every real zone name and the validation would refuse every valid input. Two details worth knowing when reading $lib/time.ts. Sub-second digits are copied verbatim from the source string rather than round-tripped through a JS Date, which is millisecond-precision and would silently drop six digits of a ClickHouse nanosecond timestamp; expanding a result row shows the localized value and the full-precision UTC original together. And chart axes format their own labels, because ECharts' type: 'time' axis renders in the browser's zone with no override -- which today puts a chart's clock out of step with the table beside it. Timestamps are detected by value, not by column name: query output is arbitrary, so a column called "timestamp" holding something else must not be mangled, and `stats max(timestamp) as newest` must still be formatted. Verified against real zones including both sides of a DST boundary (America/New_York at -05:00 in January, -04:00 in July), a half-hour offset, and date rollover.
2026-08-22 16:15:16 -07:00
parent 04e83f64a9
commit 6ee918d15f
20 changed files with 906 additions and 49 deletions
@@ -702,3 +702,93 @@ func TestChangeOwnPasswordRequiresAuth(t *testing.T) {
 		t.Fatalf("status = %d, want 401 with no session", rec.Code)
 	}
 }
+
+func TestSetTimezoneStoresAndReportsOnSession(t *testing.T) {
+	fs := newFakeStore()
+	// RoleViewer deliberately: a viewer is the role most likely to be
+	// only ever reading logs, and reading logs is what this setting is
+	// for -- if it needed a higher role it would be useless.
+	mustCreateUser(t, fs, "vince", "vincepassword", authz.RoleViewer)
+	_, mux := newTestHandler(t, fs)
+
+	login := doRequest(t, mux, http.MethodPost, "/auth/login", `{"username":"vince","password":"vincepassword"}`, nil)
+	cookie := sessionCookieFrom(login)
+
+	// Defaults to UTC before anything is set.
+	before := doRequest(t, mux, http.MethodGet, "/auth/session", "", cookie)
+	if got := decodeSessionTimezone(t, before); got != "UTC" {
+		t.Fatalf("initial session timezone = %q, want %q", got, "UTC")
+	}
+
+	rec := doRequest(t, mux, http.MethodPut, "/auth/timezone", `{"timezone":"America/New_York"}`, cookie)
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("status = %d, want 204, body=%s", rec.Code, rec.Body.String())
+	}
+
+	// The same session keeps working -- unlike a password or role
+	// change, a rendering preference is no reason to sign anyone out.
+	after := doRequest(t, mux, http.MethodGet, "/auth/session", "", cookie)
+	if after.Code != http.StatusOK {
+		t.Fatalf("session after timezone change: status = %d, want 200", after.Code)
+	}
+	if got := decodeSessionTimezone(t, after); got != "America/New_York" {
+		t.Errorf("session timezone = %q, want %q", got, "America/New_York")
+	}
+}
+
+func TestSetTimezoneRejectsInvalidZones(t *testing.T) {
+	fs := newFakeStore()
+	mustCreateUser(t, fs, "vince", "vincepassword", authz.RoleViewer)
+	_, mux := newTestHandler(t, fs)
+
+	login := doRequest(t, mux, http.MethodPost, "/auth/login", `{"username":"vince","password":"vincepassword"}`, nil)
+	cookie := sessionCookieFrom(login)
+
+	cases := map[string]string{
+		"empty":          `{"timezone":""}`,
+		"not a zone":     `{"timezone":"Mars/Olympus_Mons"}`,
+		"fixed offset":   `{"timezone":"-07:00"}`,
+		"server-local":   `{"timezone":"Local"}`,
+		"absurdly long":  `{"timezone":"` + strings.Repeat("x", 200) + `"}`,
+		"path traversal": `{"timezone":"../../etc/passwd"}`,
+	}
+	for name, body := range cases {
+		t.Run(name, func(t *testing.T) {
+			rec := doRequest(t, mux, http.MethodPut, "/auth/timezone", body, cookie)
+			if rec.Code != http.StatusBadRequest {
+				t.Fatalf("status = %d, want 400, body=%s", rec.Code, rec.Body.String())
+			}
+		})
+	}
+
+	// Nothing above should have changed the stored value.
+	sess := doRequest(t, mux, http.MethodGet, "/auth/session", "", cookie)
+	if got := decodeSessionTimezone(t, sess); got != "UTC" {
+		t.Errorf("timezone after rejected requests = %q, want %q", got, "UTC")
+	}
+}
+
+func TestSetTimezoneRequiresAuth(t *testing.T) {
+	fs := newFakeStore()
+	mustCreateUser(t, fs, "vince", "vincepassword", authz.RoleViewer)
+	_, mux := newTestHandler(t, fs)
+
+	rec := doRequest(t, mux, http.MethodPut, "/auth/timezone", `{"timezone":"Europe/Berlin"}`, nil)
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want 401", rec.Code)
+	}
+}
+
+func decodeSessionTimezone(t *testing.T, rec *httptest.ResponseRecorder) string {
+	t.Helper()
+	if rec.Code != http.StatusOK {
+		t.Fatalf("session status = %d, want 200, body=%s", rec.Code, rec.Body.String())
+	}
+	var body struct {
+		Timezone string `json:"timezone"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decoding session body: %v", err)
+	}
+	return body.Timezone
+}