fix(webapp): JSON-encode the run-set cache key to avoid separator collisions

ericallam · ericallam · commit d2987a1ae718 · 2026-06-08T15:56:00.000+01:00
A tag containing a comma keyed the same as two separate tags, so the
resolve+hydrate coalescing cache could serve the wrong runs for up to its
TTL. Encode the tag/column arrays instead of joining them.
diff --git a/apps/webapp/app/services/realtime/notifierRealtimeClient.server.ts b/apps/webapp/app/services/realtime/notifierRealtimeClient.server.ts
@@ -529,8 +529,11 @@ export class NotifierRealtimeClient implements RealtimeStreamClient {
   /** Stable cache key for the resolve+hydrate cache. Same key => same id-set and the
    * same projected columns, so cached rows always match the requesting feed. */
   #runSetCacheKey(environmentId: string, filter: RunSetFilter, skipColumns: string[]): string {
-    const tags = filter.tags && filter.tags.length > 0 ? [...filter.tags].sort().join(",") : "";
-    const cols = skipColumns.length > 0 ? [...skipColumns].sort().join(",") : "";
+    // JSON-encode the arrays (not a join) so a value containing the separators —
+    // e.g. a tag with a comma — can't collide: ["a,b"] must not key the same as
+    // ["a","b"], which are different ClickHouse filters.
+    const tags = filter.tags && filter.tags.length > 0 ? JSON.stringify([...filter.tags].sort()) : "";
+    const cols = skipColumns.length > 0 ? JSON.stringify([...skipColumns].sort()) : "";
     const maxListResults = this.options.maxListResults ?? DEFAULT_MAX_LIST_RESULTS;
     return `${environmentId}|${tags}|${filter.batchId ?? ""}|${
       filter.createdAtAfter?.getTime() ?? ""
diff --git a/apps/webapp/test/realtime/notifierRunSetCache.test.ts b/apps/webapp/test/realtime/notifierRunSetCache.test.ts
@@ -157,6 +157,13 @@ describe("NotifierRealtimeClient tag-list createdAt bucketing", () => {
     expect(resolveSpy).toHaveBeenCalledTimes(2);
   });
 
+  it("does not collide a comma-containing tag with two separate tags", async () => {
+    const { client, resolveSpy } = makeClient({ runSetCreatedAtBucketMs: 60 * 60_000 });
+    await snapshotTag(client, ["a,b"]); // one tag "a,b"
+    await snapshotTag(client, ["a", "b"]); // two tags a OR b — a different filter
+    expect(resolveSpy).toHaveBeenCalledTimes(2);
+  });
+
   it("keeps each feed's exact lower bound when bucketing is disabled (0)", async () => {
     vi.useFakeTimers({ toFake: ["Date"] });
     vi.setSystemTime(new Date("2026-06-07T10:00:30.500Z"));
