[telemetry] Add uid, org_id, and nix build event (#2018)

## Summary

This PR improves segment logging by:

* Adding orgID if user is logged in.
* Using userID if user is logged in.
* Removing anonymousID if userID is non zero. (Segment will remove
userID if we pass an anonymousID)
* Add new event to track `nix build`

This allows us to:

* Use orgID to segment data, potentially allowing individual orgs to
export/use their own data as needed.
* Track logged in users.
* Track which packages are slow to build.

Private Notes:

* We still respect `DO_NOT_TRACK` even if user is logged in. 
* userID and orgID data is only sent if user is logged in.

cc: @Lagoja 

## How was it tested?

Logged to development segment/amplitude, built a quick table showing nix
average build times:

<img width="1208" alt="image"
src="https://github.com/jetify-com/devbox/assets/544948/4ec2d49e-c886-4032-a5c6-9dff6986d780">

Author: mikeland73

internal/boxcli/auth.go

@@ -46,6 +46,8 @@ func loginCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
+			// TODO: all uses of IDClaims() are broken when using a static
+			// non-expiring token (i.e. API_TOKEN)
 			fmt.Fprintf(cmd.ErrOrStderr(), "Logged in as: %s\n", t.IDClaims().Email)
 			return nil
 		},

internal/boxcli/log.go

@@ -33,14 +33,14 @@ func doLogCommand(cmd *cobra.Command, args []string) error {
 			return usererr.New("expected a start-time argument for logging the shell-ready event")
 		}
 		telemetry.Event(telemetry.EventShellReady, telemetry.Metadata{
-			CommandStart: telemetry.ParseShellStart(args[1]),
+			EventStart: telemetry.ParseShellStart(args[1]),
 		})
 	case "shell-interactive":
 		if len(args) < 2 {
 			return usererr.New("expected a start-time argument for logging the shell-interactive event")
 		}
 		telemetry.Event(telemetry.EventShellInteractive, telemetry.Metadata{
-			CommandStart: telemetry.ParseShellStart(args[1]),
+			EventStart: telemetry.ParseShellStart(args[1]),
 		})
 	}
 	return usererr.New("unrecognized event-name %s for command: %s", args[0], cmd.CommandPath())

internal/devbox/packages.go

@@ -14,6 +14,7 @@ import (
 	"runtime/trace"
 	"slices"
 	"strings"
+	"time"
 
 	"github.com/fatih/color"
 	"github.com/pkg/errors"
@@ -26,6 +27,7 @@ import (
 	"go.jetpack.io/devbox/internal/lock"
 	"go.jetpack.io/devbox/internal/redact"
 	"go.jetpack.io/devbox/internal/shellgen"
+	"go.jetpack.io/devbox/internal/telemetry"
 
 	"go.jetpack.io/devbox/internal/boxcli/usererr"
 	"go.jetpack.io/devbox/internal/debug"
@@ -485,12 +487,17 @@ func (d *Devbox) installNixPackagesToStore(ctx context.Context, mode installMode
 			}
 		}
 		for _, installable := range installables {
+			eventStart := time.Now()
 			err = nix.Build(ctx, args, installable)
 			if err != nil {
 				fmt.Fprintf(d.stderr, "%s: ", stepMsg)
 				color.New(color.FgRed).Fprintf(d.stderr, "Fail\n")
 				return packageInstallErrorHandler(err, pkg, installable)
 			}
+			telemetry.Event(telemetry.EventNixBuildSuccess, telemetry.Metadata{
+				EventStart: eventStart,
+				Packages:   []string{pkg.Raw},
+			})
 		}
 
 		fmt.Fprintf(d.stderr, "%s: ", stepMsg)

internal/devbox/providers/identity/identity.go

@@ -15,7 +15,9 @@ import (
 
 var scopes = []string{"openid", "offline_access", "email", "profile"}
 
-type Provider struct{}
+type Provider struct {
+	cachedAccessTokenFromAPIToken *session.Token
+}
 
 var singleton *Provider = &Provider{}
 
@@ -24,7 +26,7 @@ func Get() *Provider {
 }
 
 func (p *Provider) GenSession(ctx context.Context) (*session.Token, error) {
-	if t, err := p.getTokenFromPAT(ctx); err != nil || t != nil {
+	if t, err := p.getAccessTokenFromAPIToken(ctx); err != nil || t != nil {
 		return t, err
 	}
 
@@ -35,6 +37,27 @@ func (p *Provider) GenSession(ctx context.Context) (*session.Token, error) {
 	return c.GetSession(ctx)
 }
 
+func (p *Provider) Peek() (*session.Token, error) {
+	if p.cachedAccessTokenFromAPIToken != nil {
+		return p.cachedAccessTokenFromAPIToken, nil
+	}
+
+	c, err := p.AuthClient()
+	if err != nil {
+		return nil, err
+	}
+	tokens, err := c.GetSessions()
+	if err != nil {
+		return nil, err
+	}
+
+	if len(tokens) == 0 {
+		return nil, auth.ErrNotLoggedIn
+	}
+
+	return tokens[0].Peek(), nil
+}
+
 func (p *Provider) AuthClient() (*auth.Client, error) {
 	return auth.NewClient(
 		build.Issuer(),
@@ -45,7 +68,9 @@ func (p *Provider) AuthClient() (*auth.Client, error) {
 	)
 }
 
-func (p *Provider) getTokenFromPAT(ctx context.Context) (*session.Token, error) {
+func (p *Provider) getAccessTokenFromAPIToken(
+	ctx context.Context,
+) (*session.Token, error) {
 	pat := os.Getenv("DEVBOX_ACCESS_TOKEN")
 	if pat == "" {
 		return nil, nil
@@ -64,9 +89,11 @@ func (p *Provider) getTokenFromPAT(ctx context.Context) (*session.Token, error)
 
 	// This is not the greatest. This token is missing id, refresh, etc.
 	// It may be better to change api.NewClient() to take a token string instead.
-	return &session.Token{
+	p.cachedAccessTokenFromAPIToken = &session.Token{
 		Token: oauth2.Token{
 			AccessToken: response.AccessToken,
 		},
-	}, nil
+	}
+
+	return p.cachedAccessTokenFromAPIToken, nil
 }

internal/telemetry/segment.go

@@ -10,6 +10,7 @@ import (
 	"path/filepath"
 	"time"
 
+	"github.com/samber/lo"
 	segment "github.com/segmentio/analytics-go"
 	"go.jetpack.io/devbox/internal/nix"
 
@@ -39,14 +40,17 @@ func newTrackMessage(name string, meta Metadata) *segment.Track {
 	}
 
 	dur := time.Since(procStartTime)
-	if !meta.CommandStart.IsZero() {
-		dur = time.Since(meta.CommandStart)
+	if !meta.EventStart.IsZero() {
+		dur = time.Since(meta.EventStart)
 	}
+	uid := userID()
 	return &segment.Track{
-		MessageId:   newEventID(),
-		Type:        "track",
-		AnonymousId: deviceID,
-		UserId:      userID,
+		MessageId: newEventID(),
+		Type:      "track",
+		// Only set anonymous ID if user ID is not set. Otherwise segment will
+		// drop the UserId.
+		AnonymousId: lo.Ternary(uid == "", deviceID, ""),
+		UserId:      uid,
 		Timestamp:   time.Now(),
 		Event:       name,
 		Context: &segment.Context{
@@ -66,6 +70,7 @@ func newTrackMessage(name string, meta Metadata) *segment.Track {
 			"command":      meta.Command,
 			"command_args": meta.CommandFlags,
 			"duration":     dur.Milliseconds(),
+			"org_id":       orgID(),
 			"packages":     meta.Packages,
 			"shell":        os.Getenv(envir.Shell),
 			"shell_access": shellAccess(),

internal/telemetry/telemetry.go

@@ -24,6 +24,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/pkg/errors"
 	segment "github.com/segmentio/analytics-go"
+	"go.jetpack.io/devbox/internal/devbox/providers/identity"
 	"go.jetpack.io/devbox/internal/nix"
 
 	"go.jetpack.io/devbox/internal/build"
@@ -40,11 +41,11 @@ const (
 	EventCommandSuccess EventName = iota
 	EventShellInteractive
 	EventShellReady
+	EventNixBuildSuccess
 )
 
 var (
 	deviceID string
-	userID   string
 
 	// procStartTime records the start time of the current process.
 	procStartTime = time.Now()
@@ -61,16 +62,33 @@ func Start() {
 	const deviceSalt = "64ee464f-9450-4b14-8d9c-014c0012ac1a"
 	deviceID, _ = machineid.ProtectedID(deviceSalt)
 
-	username := os.Getenv(envir.GitHubUsername)
-	if username != "" {
+	started = true
+}
+
+func userID() string {
+	// TODO, once we add access token parsing, use that instead of id token.
+	// that will work with API_TOKEN as well.
+	if tok, err := identity.Get().Peek(); err == nil && tok.IDClaims() != nil {
+		return tok.IDClaims().Subject
+	}
+	if username := os.Getenv(envir.GitHubUsername); username != "" {
 		const uidSalt = "d6134cd5-347d-4b7c-a2d0-295c0f677948"
 		const githubPrefix = "github:"
 
 		// userID is a v5 UUID which is basically a SHA hash of the username.
 		// See https://www.uuidtools.com/uuid-versions-explained for a comparison of UUIDs.
-		userID = uuid.NewSHA1(uuid.MustParse(uidSalt), []byte(githubPrefix+username)).String()
+		return uuid.NewSHA1(uuid.MustParse(uidSalt), []byte(githubPrefix+username)).String()
 	}
-	started = true
+	return ""
+}
+
+func orgID() string {
+	// TODO, once we add access token parsing, use that instead of id token.
+	// that will work with API_TOKEN as well.
+	if tok, err := identity.Get().Peek(); err == nil && tok.IDClaims() != nil {
+		return tok.IDClaims().OrgID
+	}
+	return ""
 }
 
 // Stop stops gathering telemetry and flushes buffered events to disk.
@@ -103,6 +121,10 @@ func Event(e EventName, meta Metadata) {
 		name := fmt.Sprintf("[%s] Shell Event: ready", appName)
 		msg := newTrackMessage(name, meta)
 		bufferSegmentMessage(msg.MessageId, msg)
+	case EventNixBuildSuccess:
+		name := fmt.Sprintf("[%s] Nix Build Event: success", appName)
+		msg := newTrackMessage(name, meta)
+		bufferSegmentMessage(msg.MessageId, msg)
 	}
 }
 
@@ -163,8 +185,8 @@ func Error(err error, meta Metadata) {
 
 	// Prefer using the user ID instead of the device ID when it's
 	// available.
-	if userID != "" {
-		event.User.ID = userID
+	if uid := userID(); uid != "" {
+		event.User.ID = uid
 	}
 	bufferSentryEvent(event)
 
@@ -177,7 +199,7 @@ func Error(err error, meta Metadata) {
 type Metadata struct {
 	Command      string
 	CommandFlags []string
-	CommandStart time.Time
+	EventStart   time.Time
 	FeatureFlags map[string]bool
 
 	InShell   bool