trunk-merge/pr-110452/e2121c63-277d-4dc6-be10-e7b1ae327a8a

.semgrep/rules/security/idor-team-scoped-models.yaml

@@ -322,6 +322,7 @@ rules:
                               |ProjectSecretAPIKey
                               |PropertyAccessControl
                               |PullRequestAudience
+                              |QuarantineLiftRequest
                               |QuarantinedIdentifier
                               |QueryTabState
                               |QueueJob
@@ -755,6 +756,7 @@ rules:
                         |ProjectSecretAPIKey
                         |PropertyAccessControl
                         |PullRequestAudience
+                        |QuarantineLiftRequest
                         |QuarantinedIdentifier
                         |QueryTabState
                         |QueueJob

docs/published/handbook/engineering/ai/implementing-mcp-tools.md

@@ -142,6 +142,9 @@ a billing-specific tool wrapper.
 The billing usage/spend tools accept `usage_types` as an array of strings.
 Their field description lists the accepted identifiers from `ee/billing/billing_types.py`, through the generated API schema.
 The MCP client JSON-encodes the array for the HTTP API.
+When both dates are omitted, the shared billing request serializer defaults usage/spend reads to the last 30 complete UTC days, ending yesterday.
+Explicit date ranges are unchanged; a start date without an end date still ends today.
+This also applies to the organization usage/spend time-series endpoints and CSV exports.
 The billing overview, usage, and spend tools do not need a rollout flag.
 API scopes and billing access checks still apply.
 

ee/api/billing.py

@@ -1,6 +1,7 @@
 import re
 import json
 from collections.abc import Callable, Sequence
+from datetime import timedelta
 from typing import Any, NoReturn, Optional, cast
 from zoneinfo import ZoneInfo
 
@@ -351,8 +352,23 @@ class BillingUsageRequestSerializer(serializers.Serializer):
     Only responsible for parsing dates, passes through other params.
     """
 
-    start_date = serializers.CharField(required=False, allow_blank=True, allow_null=True)
-    end_date = serializers.CharField(required=False, allow_blank=True, allow_null=True)
+    start_date = serializers.CharField(
+        required=False,
+        allow_blank=True,
+        allow_null=True,
+        help_text=(
+            'Start date (YYYY-MM-DD, UTC), or "all" for 2020-01-01. If both dates are omitted, defaults to 30 days ago.'
+        ),
+    )
+    end_date = serializers.CharField(
+        required=False,
+        allow_blank=True,
+        allow_null=True,
+        help_text=(
+            "End date (YYYY-MM-DD, UTC), inclusive. Defaults to yesterday if both dates are omitted, "
+            "or today if only start_date is provided."
+        ),
+    )
     usage_types = serializers.CharField(
         required=False,
         allow_blank=True,
@@ -436,8 +452,12 @@ def validate_end_date(self, value: Optional[str]) -> Optional[str]:
         return self._parse_date(value, "end_date")
 
     def validate(self, attrs: dict[str, Any]) -> dict[str, Any]:
-        if attrs.get("start_date") and not attrs.get("end_date"):
-            attrs["end_date"] = timezone.now().date().isoformat()
+        today_utc = timezone.now().astimezone(ZoneInfo("UTC")).date()
+        if not attrs.get("start_date") and not attrs.get("end_date"):
+            attrs["start_date"] = (today_utc - timedelta(days=30)).isoformat()
+            attrs["end_date"] = (today_utc - timedelta(days=1)).isoformat()
+        elif attrs.get("start_date") and not attrs.get("end_date"):
+            attrs["end_date"] = today_utc.isoformat()
         return attrs
 
     def validate_usage_types(self, value: Optional[str]) -> Optional[str]:

ee/api/test/test_billing.py

@@ -1348,7 +1348,7 @@ def test_every_billing_action_is_partner_locked_or_explicitly_exempt(self) -> No
         assert unlocked == self.READ_ONLY_ACTIONS | self.UNLOCKED_WRITE_ACTIONS
 
 
-class TestBillingUsageRequestSerializer(TestCase):
+class TestBillingUsageRequestSerializer(SimpleTestCase):
     def test_valid_dates(self):
         serializer = BillingUsageRequestSerializer(data={"start_date": "2025-01-01", "end_date": "2025-01-31"})
         self.assertTrue(serializer.is_valid(), serializer.errors)
@@ -1423,11 +1423,30 @@ def test_accepts_every_breakdown_the_spend_read_serves(self, _case_name: str, va
         serializer = BillingUsageRequestSerializer(data={"breakdowns": value})
         self.assertTrue(serializer.is_valid(), serializer.errors)
 
-    def test_empty_and_null_dates_are_valid(self):
-        serializer = BillingUsageRequestSerializer(data={"start_date": "", "end_date": None})
+    @parameterized.expand(
+        [
+            ("missing", {}),
+            ("empty", {"start_date": "", "end_date": ""}),
+            ("null", {"start_date": None, "end_date": None}),
+            ("empty_start", {"start_date": ""}),
+            ("null_end", {"end_date": None}),
+        ]
+    )
+    @time_machine.travel("2025-02-15T00:30:00+14:00", tick=False)
+    def test_missing_empty_and_null_dates_default_to_last_30_complete_utc_days(
+        self, _case_name: str, data: dict[str, str | None]
+    ) -> None:
+        serializer = BillingUsageRequestSerializer(data=data)
+        self.assertTrue(serializer.is_valid(), serializer.errors)
+        self.assertEqual(serializer.validated_data["start_date"], "2025-01-15")
+        self.assertEqual(serializer.validated_data["end_date"], "2025-02-13")
+
+    @time_machine.travel("2025-02-15", tick=False)
+    def test_end_date_without_start_date_is_preserved(self) -> None:
+        serializer = BillingUsageRequestSerializer(data={"end_date": "2025-02-14"})
         self.assertTrue(serializer.is_valid(), serializer.errors)
-        self.assertIsNone(serializer.validated_data.get("start_date"))
-        self.assertIsNone(serializer.validated_data.get("end_date"))
+        self.assertNotIn("start_date", serializer.validated_data)
+        self.assertEqual(serializer.validated_data["end_date"], "2025-02-14")
 
 
 class TestBillingUpstreamValidationErrors(SimpleTestCase):
@@ -1617,6 +1636,21 @@ def test_get_usage_success(self, mock_get_usage_data):
         # No teams_map: names are put into the response on the way out.
         self.assertNotIn("teams_map", passed_params)
 
+    @parameterized.expand([("usage",), ("spend",)])
+    @time_machine.travel("2025-02-15T00:30:00+14:00", tick=False)
+    def test_usage_and_spend_default_date_range_is_sent_to_billing(self, endpoint: str) -> None:
+        manager_method = f"ee.billing.billing_manager.BillingManager.get_{endpoint}_data"
+        mock_data = self.MOCK_USAGE_DATA if endpoint == "usage" else self.MOCK_SPEND_DATA
+
+        with patch(manager_method, return_value=mock_data) as mock_fetch:
+            response = self.client.get(f"/api/billing/{endpoint}/")
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        mock_fetch.assert_called_once()
+        passed_params = mock_fetch.call_args[0][1]
+        self.assertEqual(passed_params["start_date"], "2025-01-15")
+        self.assertEqual(passed_params["end_date"], "2025-02-13")
+
     @staticmethod
     def _billing_refusal(upstream_status: int, body: object) -> Exception:
         # The shape handle_billing_service_error raises: the status in the message, the parsed body third.

frontend/snapshots.yml

@@ -13158,6 +13158,10 @@ snapshots:
         hash: v1.k794b7964.12bc6373464176d7fb6b9251bb7d6342cd381a64e3ee28c8380045b06f5e97ec.BLZ-Fbl_W9xx4oAA39xVucIxMtSpBAzm5Pwp6f1Bk6w
     scenes-app-visual-review-flakiness--unstable--light:
         hash: v1.k794b7964.26ff0c274624f9d1ea71f4377d104d5e4feae204ba8ea0b68735c7f5fae8423e.WaXT0zPJ1WHOerBWKkJmHERCIZwpJT_L_4AHvWL3bSE
+    scenes-app-visual-review-run--quarantined-snapshot-lifts-on-merge--dark:
+        hash: v1.k794b7964.758a0e95ef8736a1c6ff3da08d559f93ae3766fb625dafe72470b69ae617af46.JMuycNcdRT6ufB9VBSNhhKJlVUq35qcQNYS7rva0Wxk
+    scenes-app-visual-review-run--quarantined-snapshot-lifts-on-merge--light:
+        hash: v1.k794b7964.82313ef9f43904aaaee7dfb013a6949e0418f8a3094dbadfd8494d493199ee45.gOZXPTz4C9RAb_lA9fIwVXaLe_bO7UhAKa051YafvR8
     scenes-app-visual-review-run--ready-to-finalize--dark:
         hash: v1.k794b7964.2ddf6d3c5eea469705d81ec0489b029e21e3d06d119b0365ddebe1340677e69c.MPAF7Dn_bpbKyhuQ2l_aoj6czH6TKBlFE2nXSKVqx4I
     scenes-app-visual-review-run--ready-to-finalize--light:

products/billing/mcp/tools.yaml

@@ -264,14 +264,6 @@ tools:
             grant applies only to usage/spend, not billing-overview-get or billing admin actions. Use this to
             investigate cost spikes, compare spend across periods, or attribute spend to specific products or teams.
         param_overrides:
-            start_date:
-                description: >
-                    Start date (YYYY-MM-DD). For open-ended investigations, choose an explicit recent window such as the
-                    last 30 days. If you use "all", also pass end_date.
-            end_date:
-                description: >
-                    End date (YYYY-MM-DD), inclusive. Pass this whenever start_date is set; use today's date if the user
-                    did not name one.
             team_ids:
                 input_schema: BillingTeamIdsSchema
             usage_types:
@@ -333,14 +325,6 @@ tools:
             billing-usage-timeseries-get. Beta: behind the organization-billing-api flag, and the output shape may
             change while it is.
         param_overrides:
-            start_date:
-                description: >
-                    Start date (YYYY-MM-DD). For open-ended investigations, choose an explicit recent window such as the
-                    last 30 days. If you use "all", also pass end_date.
-            end_date:
-                description: >
-                    End date (YYYY-MM-DD), inclusive. Pass this whenever start_date is set; use today's date if the user
-                    did not name one.
             team_ids:
                 description: >
                     JSON-encoded array of numeric team (project) IDs to filter by, NOT a comma-separated string. Pass as
@@ -432,14 +416,6 @@ tools:
             projects. For a single-snapshot aggregate view call billing-overview-get when the caller has full billing
             access; for cost (spend) breakdowns call billing-spend-get.
         param_overrides:
-            start_date:
-                description: >
-                    Start date (YYYY-MM-DD). For open-ended investigations, choose an explicit recent window such as the
-                    last 30 days. If you use "all", also pass end_date.
-            end_date:
-                description: >
-                    End date (YYYY-MM-DD), inclusive. Pass this whenever start_date is set; use today's date if the user
-                    did not name one.
             team_ids:
                 input_schema: BillingTeamIdsSchema
             usage_types:
@@ -535,14 +511,6 @@ tools:
             billing-spend-timeseries-get. Beta: behind the organization-billing-api flag, and the output shape may
             change while it is.
         param_overrides:
-            start_date:
-                description: >
-                    Start date (YYYY-MM-DD). For open-ended investigations, choose an explicit recent window such as the
-                    last 30 days. If you use "all", also pass end_date.
-            end_date:
-                description: >
-                    End date (YYYY-MM-DD), inclusive. Pass this whenever start_date is set; use today's date if the user
-                    did not name one.
             team_ids:
                 description: >
                     JSON-encoded array of numeric team (project) IDs to filter by, NOT a comma-separated string. Pass as

products/posthog_ai/frontend/scenes/TaskTracker/TaskRunArtifacts.stories.tsx

@@ -846,3 +846,8 @@ export const MarkdownComments: Story = {
     parameters: { msw: { mocks: commentMocks() } },
     render: () => <StoryPage fileName={REPORT_FILE_NAME} commentsOpen />,
 }
+
+export const ImageCommentPins: Story = {
+    parameters: { msw: { mocks: commentMocks() } },
+    render: () => <StoryPage fileName="trial-starts-by-step.svg" commentsOpen />,
+}