feat: Show created/updated metadata for saved searches and dashboards

[pulpdrew]

Summary

This PR adds createdAt/By and updatedAt/By metadata to dashboard and saved searches.

Screenshots or video

How to test locally or on Vercel

This should be tested locally. In the preview environment, these fields are not populated (since they're maintained through automatic MongoDB createdAt/updatedAt values and createdBy/updatedBy values pulled from User accounts.

References

• Linear Issue: Closes HDX-3461
• Related PRs:

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hyperdx-oss	Ready	Preview, Comment	Apr 7, 2026 2:27pm

[changeset-bot]

🦋 Changeset detected

Latest commit: 081f2d1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@hyperdx/api	Patch
@hyperdx/app	Patch
@hyperdx/otel-collector	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

E2E Test Results

✅ All tests passed • 129 passed • 3 skipped • 1041s

Status	Count
✅ Passed	129
❌ Failed	0
⚠️ Flaky	2
⏭️ Skipped	3

Tests ran across 4 shards in parallel.

View full report →

[github-actions]

PR Review

• ⚠️ getDashboard now spreads _dashboard?.toJSON() instead of _dashboard — this is actually a necessary fix for populated refs to serialize correctly, but it's a behavioral change that could affect downstream consumers if any code relied on the Mongoose document shape. Looks intentional and correct; just worth noting.

• ℹ️ userId is optional in createSavedSearch/updateSavedSearch (and updateDashboard), so createdBy/updatedBy can be undefined if userId is absent. Given getNonNullUserWithTeam is used in the router, this should rarely happen in practice, but userId could theoretically be undefined per the type. Non-blocking but worth a comment if this is a known edge case.

• ✅ No critical bugs or security issues found. Metadata fields are properly optional, populate calls are scoped to email name only (no over-fetching), tests cover both list and update scenarios, and the SavedSearchListApiResponse schema correctly extends the existing SavedSearchSchema.

[github-actions]

🟡 Tier 3 — Standard

Introduces new logic, modifies core functionality, or touches areas with non-trivial risk.

Why this tier:

• Standard feature/fix — introduces new logic or modifies core functionality

Additional context: touches API routes or data models

Review process: Full human review — logic, architecture, edge cases.
SLA: First-pass feedback within 1 business day.

Stats

• Files changed: 21
• Lines changed: 527
• Branch: drew/db-ss-metadata
• Author: pulpdrew

To override this classification, remove the review/tier-3 label and apply a different review/tier-* label. Manual overrides are preserved on subsequent pushes.

[knudtty]

Why not add these to the zod schema for SavedSearch?

[pulpdrew]

Good question - it is because the types differ, and I think I'd have to override them in a few places even if I did add them to SavedSearchSchema.

1. They shouldn't be included API request bodies - they're set by Mongo
2. The dates are Date types in mongoose documents (ISavedSearch type) but strings in the API response (SavedSearchPopulated)
3. The users as ObjectId / strings in Mongoose documents, but populated with { email: string; name?: string } from the user table when when requesting them from the API (SavedSearchPopulated)

[knudtty]

As part of addressing tech debt I have been incrementally upgrading api routes to use enforce the API types on the backend, and sharing those types on the frontend. See AlertsApiResponseSchema in common-utils/src/types.ts as an example. This could be an opportunity to add it for saved searches! Else I'll approve as-is once merge conflicts are addressed

[pulpdrew]

Updated for the saved search list endpoint. Extending the same to dashboards was proving to be a somewhat extensive set of changes, so I think we can save that for another PR.