fix(query): Detect microsecond epoch timestamps correctly

Distinguish epoch units so microsecond trace timestamps no longer normalize near 1970
Add regression coverage for timestamp conversion and nested OpenTelemetry connection validation

Author: moshloop

cmd/query/connections/service_test.go

@@ -1,6 +1,7 @@
 package connections
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/flanksource/commons-db/models"
@@ -67,6 +68,23 @@ func TestValidateOpenTelemetryRequiresNestedOpenSearchConnection(t *testing.T) {
 	if err := validateNestedConnection(database, candidate); err == nil {
 		t.Fatal("expected an HTTP URL ending in the unrelated connection name to fail")
 	}
+	// Namespaced, so it resolves to exactly one real record and reaches the
+	// OpenSearch-only type check rather than failing earlier on self-reference
+	// or a missing connection.
+	relational := models.Connection{
+		ID: uuid.New(), Name: "warehouse", Namespace: "team", Type: models.ConnectionTypePostgres,
+	}
+	if err := database.Create(&relational).Error; err != nil {
+		t.Fatal(err)
+	}
+	candidate.Properties["connection"] = "connection://team/warehouse"
+	err := validateNestedConnection(database, candidate)
+	if err == nil {
+		t.Fatal("expected a nested PostgreSQL connection to fail the OpenSearch-only check")
+	}
+	if !strings.Contains(err.Error(), models.ConnectionTypeOpenSearch) {
+		t.Fatalf("expected the type mismatch to name the required type, got %v", err)
+	}
 }
 
 func TestApplyConnectionUpdatePreservesSecretWhenBlank(t *testing.T) {

query/providers/opentelemetry_parser.go

@@ -201,18 +201,33 @@ func traceDurationMillis(value any, field, format string) float64 {
 	return number / 1_000_000
 }
 
+// Epoch unit floors for normalizeTraceTimestamp. A timestamp in the supported
+// range (roughly 1973 onwards) exceeds the floor for its own unit and no other.
+const (
+	epochMillisecondFloor = 10_000_000_000
+	epochMicrosecondFloor = 10_000_000_000_000
+	epochNanosecondFloor  = 10_000_000_000_000_000
+)
+
 func normalizeTraceTimestamp(raw string) string {
 	if raw == "" {
 		return ""
 	}
 	if number, err := strconv.ParseInt(raw, 10, 64); err == nil {
-		if number > 10_000_000_000_000 {
+		// Each epoch unit occupies a distinct magnitude band for any plausible
+		// date, so the thresholds sit in the gaps between them. Microseconds
+		// need their own band: without it a microsecond epoch (~1e15) is read
+		// as nanoseconds and lands in the early 1970s.
+		switch {
+		case number > epochNanosecondFloor:
 			return time.Unix(0, number).Format(time.RFC3339Nano)
-		}
-		if number > 10_000_000_000 {
+		case number > epochMicrosecondFloor:
+			return time.UnixMicro(number).Format(time.RFC3339Nano)
+		case number > epochMillisecondFloor:
 			return time.UnixMilli(number).Format(time.RFC3339Nano)
+		default:
+			return time.Unix(number, 0).Format(time.RFC3339Nano)
 		}
-		return time.Unix(number, 0).Format(time.RFC3339Nano)
 	}
 	if timestamp, err := time.Parse(time.RFC3339Nano, raw); err == nil {
 		return timestamp.Format(time.RFC3339Nano)

query/providers/opentelemetry_parser_test.go

@@ -1,6 +1,10 @@
 package providers
 
-import "testing"
+import (
+	"strconv"
+	"testing"
+	"time"
+)
 
 func TestTraceDurationMillisUsesFieldUnits(t *testing.T) {
 	tests := []struct {
@@ -22,3 +26,52 @@ func TestTraceDurationMillisUsesFieldUnits(t *testing.T) {
 		})
 	}
 }
+
+// Every epoch unit must round-trip to the same instant. Microseconds are the
+// regression: without their own magnitude band they were read as nanoseconds
+// and normalized to 1970.
+func TestNormalizeTraceTimestampDetectsEpochUnit(t *testing.T) {
+	instant := time.Date(2026, time.July, 27, 8, 42, 43, 0, time.UTC)
+	want := instant.Format(time.RFC3339Nano)
+
+	tests := []struct {
+		name string
+		raw  int64
+	}{
+		{name: "seconds", raw: instant.Unix()},
+		{name: "milliseconds", raw: instant.UnixMilli()},
+		{name: "microseconds", raw: instant.UnixMicro()},
+		{name: "nanoseconds", raw: instant.UnixNano()},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := normalizeTraceTimestamp(strconv.FormatInt(tt.raw, 10))
+			parsed, err := time.Parse(time.RFC3339Nano, got)
+			if err != nil {
+				t.Fatalf("normalizeTraceTimestamp(%d) = %q, not a timestamp: %v", tt.raw, got, err)
+			}
+			if !parsed.UTC().Equal(instant) {
+				t.Fatalf("normalizeTraceTimestamp(%d) = %q, want %q", tt.raw, parsed.UTC().Format(time.RFC3339Nano), want)
+			}
+		})
+	}
+}
+
+func TestNormalizeTraceTimestampPassesThroughNonEpochValues(t *testing.T) {
+	tests := []struct {
+		name string
+		raw  string
+		want string
+	}{
+		{name: "empty", raw: "", want: ""},
+		{name: "rfc3339", raw: "2026-07-27T08:42:43Z", want: "2026-07-27T08:42:43Z"},
+		{name: "unparseable", raw: "not-a-timestamp", want: "not-a-timestamp"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := normalizeTraceTimestamp(tt.raw); got != tt.want {
+				t.Fatalf("normalizeTraceTimestamp(%q) = %q, want %q", tt.raw, got, tt.want)
+			}
+		})
+	}
+}