tshark test 6

backend/src/utilities/database.py

@@ -288,6 +288,7 @@ class DatabasePool:
         lower_bound = datetime.fromtimestamp(max(observed_at_ms - window_ms, 0) / 1000.0, tz=timezone.utc)
         upper_bound = datetime.fromtimestamp(max(observed_at_ms + window_ms, 0) / 1000.0, tz=timezone.utc)
         dpi_metadata = enrichment.get("dpi_metadata")
+        capture_sources = [str(source) for source in enrichment.get("capture_sources", []) if source]
 
         try:
             async with self._pool.acquire() as conn:
@@ -306,7 +307,16 @@ class DatabasePool:
                             WHEN $16::jsonb IS NULL THEN packets.dpi_metadata
                             WHEN packets.dpi_metadata IS NULL THEN $16::jsonb
                             ELSE packets.dpi_metadata || $16::jsonb
-                        END
+                        END,
+                        capture_sources = (
+                            SELECT ARRAY(
+                                SELECT DISTINCT source
+                                FROM unnest(
+                                    COALESCE(packets.capture_sources, ARRAY[]::text[]) ||
+                                    COALESCE($17::text[], ARRAY[]::text[])
+                                ) AS source
+                            )
+                        )
                     WHERE
                         ip_proto_raw = $1
                         AND (capture_iface = $2 OR ingress_if = $2 OR egress_if = $2)
@@ -324,6 +334,7 @@ class DatabasePool:
                             OR packets.app_hostname IS NULL
                             OR packets.app_is_encrypted IS NULL
                             OR ($16::jsonb IS NOT NULL)
+                            OR (COALESCE(array_length($17::text[], 1), 0) > 0)
                         )
                     RETURNING *
                     """,
@@ -343,6 +354,7 @@ class DatabasePool:
                     enrichment.get("app_hostname"),
                     enrichment.get("app_is_encrypted"),
                     json.dumps(dpi_metadata) if dpi_metadata is not None else None,
+                    capture_sources if capture_sources else None,
                 )
         except Exception:
             logger.exception("DB packet metadata backfill failed")