app/vtselect: honor extra_filters in Jaeger and Tempo APIs

[immanuwell]

Describe Your Changes

Fixes #178

extra_filters worked on native LogsQL endpoints, but Jaeger and Tempo paths just dropped it. That is kinda bad in auth scoped setups, because vmauth can inject ?extra_filters=... in normal traffic.

This patch parses extra_filters in shared trace request params and applies them to the trace query builders, including search, tags, traces and Tempo metrics. Also adds regression tests for parse, merge and bad input.

Repro:

1. Put VictoriaTraces behind vmauth, or call a Jaeger or Tempo endpoint with ?extra_filters={"env":"prod"}.
2. Hit a trace API like /select/tempo/api/search or /select/tempo/api/v2/search/tags.
3. Before this patch the filter is ignored, so results are wider than expected.
4. After this patch the same constraint is applied, nice and boring.

Tests:
make test-full
make apptest

Checklist

• My change adheres to VictoriaMetrics contributing guidelines.
• My change adheres to VictoriaMetrics development goals.

---

Summary by cubic

Apply extra_filters to Jaeger and Tempo trace APIs so auth-scoped setups using vmauth get the same filtering as LogsQL. This prevents overly broad results and keeps queries within tenant constraints.

• Bug Fixes
  • Parse extra_filters from requests and store in tracecommon.CommonParams (ExtraFilters).
  • Apply filters via CommonParams.ApplyExtraFilters across trace queries (search, tags, traces, service graph, metrics, exemplars).
  • Support both JSON object and LogsQL filter formats; merge multiple extra_filters values.
  • Add tests for applying, merging, and rejecting invalid filters.

^{Written for commit bce1244. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 6 files

_{Re-trigger cubic}

[immanuwell]

@JayiceZ fixed both suggestions in the latest push, PTAL

[JayiceZ]

extra_filters should be only applied to the http query from users, not all the query in the codebase. Please check.

[JayiceZ]

findTraceIDTimeSplitTimeRange will still apply extra filter

[JayiceZ]

internal request should not apply extra filters.

GetServiceGraphTimeRange and GetServiceDBGraphTimeRange are called by a background task, not users request.

[JayiceZ]

Same here.

[jiekun]

I don't like executing this function everywhere. The extra filter should work just like hiddenFieldsFilters that live only in common path.

@immanuwell I'd like to rewrite it if you don't mind. And maybe you can talk an extra look after.

[jiekun]

Generally the files under logsql should remain unchanged. The logsql folder is preserved in this repo to use the logsQL APIs exposed by VictoriaLogs. With the changes in this repo, it means every time we sync from the upstream, we have to do the same function deletion and refactoring. Please revert the changes in logsql and just move them to the tracecommon.