Fix nested flow logging

[mlw]

Fixes issue with flow logging where per-process flows were not being collapsed into the nested proto structure.

Part of SNT-261

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR refactors network flow logging from per-flow serialization to a batched process-flows model. Forward declarations are updated from SNDFlowInfo and SNDProcessInfo to SNDProcessFlows across logger and serializer classes. API methods like LogNetworkFlow and SerializeNetworkFlow are renamed to LogNetworkFlows and SerializeNetworkFlows with consolidated parameters. Related dependencies and call sites are updated accordingly.

Changes

Cohort / File(s)	Summary
Configuration & Nullability Source/common/SNTConfigurator.h	Method parameter changed from nonnull to nullable for setSyncServerSyncNetworkExtensionSettings, allowing nil values to be passed.
Build Dependencies Source/santad/BUILD	Removed dependencies on SNDFlowInfo and SNDProcessInfo; replaced with SNDProcessFlows in SNTNetworkExtensionQueue and EndpointSecuritySerializer targets.
Logger API Consolidation Source/santad/Logs/EndpointSecurity/Logger.h, Logger.mm	Renamed LogNetworkFlow to LogNetworkFlows; parameter changed from separate SNDProcessInfo* and SNDFlowInfo* to single SNDProcessFlows*; calls updated to use SerializeNetworkFlows.
Serializer Base API Source/santad/Logs/EndpointSecurity/Serializers/Serializer.h, Serializer.mm	Forward declarations replaced with SNDProcessFlows; virtual and non-virtual methods renamed from SerializeNetworkFlow to SerializeNetworkFlows with consolidated parameters; decision caching logic adapted to use processFlows.processInfo.
Serializer Implementations Source/santad/Logs/EndpointSecurity/Serializers/BasicString.*, Empty.*, Protobuf.*	All implementations updated to override renamed SerializeNetworkFlows method; internal calls to formatting functions updated (e.g., FormatNetworkFlowBasicString → FormatNetworkFlowsBasicString, PopulateNetworkActivityFlow → PopulateNetworkActivityProcess).
Network Extension Queue Source/santad/SNTNetworkExtensionQueue.mm	Removed imports for SNDFlowInfo.h and SNDProcessInfo.h; added KVO watcher for syncBaseURL to clear network extension settings; replaced per-flow enumeration with single LogNetworkFlows call; broadened early-return condition to check shouldInstallNetworkExtension.
Serializer Stubs stubs/santanetd/src/santanetd/SNDNetworkFlowsSerializer.h, SNDNetworkFlowsSerializer.mm	Forward declarations and function signatures updated to use SNDProcessFlows; PopulateNetworkActivityFlow renamed to PopulateNetworkActivityProcess; FormatNetworkFlowBasicString renamed to FormatNetworkFlowsBasicString.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• Add NetworkActivity to protobuf schema #765 — Modifies network-activity/protobuf surface and transitions from per-flow to per-process NetworkActivity representation, directly aligned with this refactoring.
• Add infra to support network flow logging #781 — Prior work on network-flow logging refactoring; this PR continues that pattern by consolidating per-flow APIs into batched SNDProcessFlows operations.
• Notify network extension when settings change #801 — Updates SNTNetworkExtensionQueue settings handling and KVO mechanics, related to the KVO watcher logic added in this PR.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Fix nested flow logging' is concise and directly describes the main change—addressing an issue with flow logging and proto structure collapsing.
Description check	✅ Passed	The description explains that the PR fixes flow logging by collapsing per-process flows into the nested proto structure, which aligns with the comprehensive refactoring shown in the changeset.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch mlw/fix-nested-flow-logging

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

Source/santad/Logs/EndpointSecurity/Serializers/BasicString.mm (1)

1072-1079: window_start and window_end are unused in this serializer.

These parameters are required by the virtual interface, but this implementation silently ignores them. If the BasicString format intentionally omits time-window data this is fine, but consider whether consumers expect time-window information in the basic string output.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@Source/santad/Logs/EndpointSecurity/Serializers/BasicString.mm` around lines
1072 - 1079, The SerializeNetworkFlows implementation in
BasicString::SerializeNetworkFlows currently ignores the window_start and
window_end parameters; either explicitly acknowledge them or include their data.
Fix by updating BasicString::SerializeNetworkFlows: if the basic string should
not include time windows, mark the parameters as intentionally unused (e.g.,
(void)window_start; (void)window_end;) and add a clarifying comment; otherwise
format and append the time-window values (using an existing helper or by
converting window_start/window_end to a string) before or after the
santanetd::FormatNetworkFlowsBasicString output so CreateDefaultString ->
santanetd::FormatNetworkFlowsBasicString -> FinalizeString produce the expected
output. Ensure changes are inside SerializeNetworkFlows to keep signature
unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@Source/santad/Logs/EndpointSecurity/Serializers/BasicString.mm`:
- Around line 1072-1079: The SerializeNetworkFlows implementation in
BasicString::SerializeNetworkFlows currently ignores the window_start and
window_end parameters; either explicitly acknowledge them or include their data.
Fix by updating BasicString::SerializeNetworkFlows: if the basic string should
not include time windows, mark the parameters as intentionally unused (e.g.,
(void)window_start; (void)window_end;) and add a clarifying comment; otherwise
format and append the time-window values (using an existing helper or by
converting window_start/window_end to a string) before or after the
santanetd::FormatNetworkFlowsBasicString output so CreateDefaultString ->
santanetd::FormatNetworkFlowsBasicString -> FinalizeString produce the expected
output. Ensure changes are inside SerializeNetworkFlows to keep signature
unchanged.

---

ℹ️ Review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between ab1e421 and 9598446.

📒 Files selected for processing (15)

• Source/common/SNTConfigurator.h
• Source/santad/BUILD
• Source/santad/Logs/EndpointSecurity/Logger.h
• Source/santad/Logs/EndpointSecurity/Logger.mm
• Source/santad/Logs/EndpointSecurity/Serializers/BasicString.h
• Source/santad/Logs/EndpointSecurity/Serializers/BasicString.mm
• Source/santad/Logs/EndpointSecurity/Serializers/Empty.h
• Source/santad/Logs/EndpointSecurity/Serializers/Empty.mm
• Source/santad/Logs/EndpointSecurity/Serializers/Protobuf.h
• Source/santad/Logs/EndpointSecurity/Serializers/Protobuf.mm
• Source/santad/Logs/EndpointSecurity/Serializers/Serializer.h
• Source/santad/Logs/EndpointSecurity/Serializers/Serializer.mm
• Source/santad/SNTNetworkExtensionQueue.mm
• stubs/santanetd/src/santanetd/SNDNetworkFlowsSerializer.h
• stubs/santanetd/src/santanetd/SNDNetworkFlowsSerializer.mm