feat: add issuer_url to oidc service metrics (#18864)

To aid with debugging, distinct from `publisher`, so we can continue to
group by publisher (type) and issuer_url - distinct issuers.

Resolves #18863

Signed-off-by: Mike Fiedler <[email protected]>

Author: miketheman

tests/unit/oidc/test_services.py

@@ -103,7 +103,7 @@ def test_verify_jwt_signature_get_key_for_token_fails(self, metrics, monkeypatch
         service = services.OIDCPublisherService(
             session=pretend.stub(),
             publisher="fakepublisher",
-            issuer_url=pretend.stub(),
+            issuer_url="https://none",
             audience="fakeaudience",
             cache_url=pretend.stub(),
             metrics=metrics,
@@ -123,7 +123,7 @@ def test_verify_jwt_signature_get_key_for_token_fails(self, metrics, monkeypatch
         assert service.metrics.increment.calls == [
             pretend.call(
                 "warehouse.oidc.verify_jwt_signature.malformed_jwt",
-                tags=["publisher:fakepublisher"],
+                tags=["publisher:fakepublisher", "issuer_url:https://none"],
             )
         ]
         assert services.sentry_sdk.capture_message.calls == []
@@ -133,7 +133,7 @@ def test_verify_jwt_signature_fails(self, metrics, monkeypatch, exc):
         service = services.OIDCPublisherService(
             session=pretend.stub(),
             publisher="fakepublisher",
-            issuer_url=pretend.stub(),
+            issuer_url="https://none",
             audience="fakeaudience",
             cache_url=pretend.stub(),
             metrics=metrics,
@@ -156,7 +156,7 @@ def test_verify_jwt_signature_fails(self, metrics, monkeypatch, exc):
         assert service.metrics.increment.calls == [
             pretend.call(
                 "warehouse.oidc.verify_jwt_signature.invalid_signature",
-                tags=["publisher:fakepublisher"],
+                tags=["publisher:fakepublisher", "issuer_url:https://none"],
             )
         ]
 
@@ -171,7 +171,7 @@ def test_find_publisher(self, metrics, monkeypatch):
         service = services.OIDCPublisherService(
             session=pretend.stub(),
             publisher="fakepublisher",
-            issuer_url=pretend.stub(),
+            issuer_url="https://none",
             audience="fakeaudience",
             cache_url=pretend.stub(),
             metrics=metrics,
@@ -189,19 +189,19 @@ def test_find_publisher(self, metrics, monkeypatch):
         assert service.metrics.increment.calls == [
             pretend.call(
                 "warehouse.oidc.find_publisher.attempt",
-                tags=["publisher:fakepublisher"],
+                tags=["publisher:fakepublisher", "issuer_url:https://none"],
             ),
             pretend.call(
                 "warehouse.oidc.find_publisher.ok",
-                tags=["publisher:fakepublisher"],
+                tags=["publisher:fakepublisher", "issuer_url:https://none"],
             ),
         ]
 
     def test_find_publisher_issuer_lookup_fails(self, metrics, monkeypatch):
         service = services.OIDCPublisherService(
             session=pretend.stub(),
             publisher="fakepublisher",
-            issuer_url=pretend.stub(),
+            issuer_url="https://none",
             audience="fakeaudience",
             cache_url=pretend.stub(),
             metrics=metrics,
@@ -218,19 +218,19 @@ def test_find_publisher_issuer_lookup_fails(self, metrics, monkeypatch):
         assert service.metrics.increment.calls == [
             pretend.call(
                 "warehouse.oidc.find_publisher.attempt",
-                tags=["publisher:fakepublisher"],
+                tags=["publisher:fakepublisher", "issuer_url:https://none"],
             ),
             pretend.call(
                 "warehouse.oidc.find_publisher.publisher_not_found",
-                tags=["publisher:fakepublisher"],
+                tags=["publisher:fakepublisher", "issuer_url:https://none"],
             ),
         ]
 
     def test_find_publisher_verify_claims_fails(self, metrics, monkeypatch):
         service = services.OIDCPublisherService(
             session=pretend.stub(),
             publisher="fakepublisher",
-            issuer_url=pretend.stub(),
+            issuer_url="https://none",
             audience="fakeaudience",
             cache_url=pretend.stub(),
             metrics=metrics,
@@ -252,11 +252,11 @@ def test_find_publisher_verify_claims_fails(self, metrics, monkeypatch):
         assert service.metrics.increment.calls == [
             pretend.call(
                 "warehouse.oidc.find_publisher.attempt",
-                tags=["publisher:fakepublisher"],
+                tags=["publisher:fakepublisher", "issuer_url:https://none"],
             ),
             pretend.call(
                 "warehouse.oidc.find_publisher.publisher_not_found",
-                tags=["publisher:fakepublisher"],
+                tags=["publisher:fakepublisher", "issuer_url:https://none"],
             ),
         ]
         assert publisher.verify_claims.calls == [pretend.call(claims, service)]
@@ -354,7 +354,8 @@ def test_refresh_keyset_timeout(self, metrics, monkeypatch, mockredis):
         assert keys == keyset
         assert metrics.increment.calls == [
             pretend.call(
-                "warehouse.oidc.refresh_keyset.timeout", tags=["publisher:example"]
+                "warehouse.oidc.refresh_keyset.timeout",
+                tags=["publisher:example", "issuer_url:https://example.com"],
             )
         ]
 
@@ -669,7 +670,11 @@ def test_get_key_refresh_fails(self, metrics, monkeypatch):
         assert metrics.increment.calls == [
             pretend.call(
                 "warehouse.oidc.get_key.error",
-                tags=["publisher:example", "key_id:fake-key-id"],
+                tags=[
+                    "publisher:example",
+                    "key_id:fake-key-id",
+                    "issuer_url:https://example.com",
+                ],
             )
         ]
 

warehouse/oidc/services.py

@@ -164,7 +164,7 @@ def _refresh_keyset(self) -> dict[str, dict]:
         if timeout:
             self.metrics.increment(
                 "warehouse.oidc.refresh_keyset.timeout",
-                tags=[f"publisher:{self.publisher}"],
+                tags=[f"publisher:{self.publisher}", f"issuer_url:{self.issuer_url}"],
             )
             return keys
 
@@ -235,7 +235,11 @@ def _get_key(self, key_id: str) -> jwt.PyJWK | None:
         if key_id not in keyset:
             self.metrics.increment(
                 "warehouse.oidc.get_key.error",
-                tags=[f"publisher:{self.publisher}", f"key_id:{key_id}"],
+                tags=[
+                    f"publisher:{self.publisher}",
+                    f"key_id:{key_id}",
+                    f"issuer_url:{self.issuer_url}",
+                ],
             )
             return None
         return jwt.PyJWK(keyset[key_id])
@@ -280,7 +284,7 @@ def verify_jwt_signature(self, unverified_token: str) -> SignedClaims | None:
             # with missing components.
             self.metrics.increment(
                 "warehouse.oidc.verify_jwt_signature.malformed_jwt",
-                tags=[f"publisher:{self.publisher}"],
+                tags=[f"publisher:{self.publisher}", f"issuer_url:{self.issuer_url}"],
             )
             return None
 
@@ -315,7 +319,7 @@ def verify_jwt_signature(self, unverified_token: str) -> SignedClaims | None:
         except Exception as e:
             self.metrics.increment(
                 "warehouse.oidc.verify_jwt_signature.invalid_signature",
-                tags=[f"publisher:{self.publisher}"],
+                tags=[f"publisher:{self.publisher}", f"issuer_url:{self.issuer_url}"],
             )
             if not isinstance(e, jwt.PyJWTError):
                 with sentry_sdk.new_scope() as scope:
@@ -330,7 +334,7 @@ def find_publisher(
         self, signed_claims: SignedClaims, *, pending: bool = False
     ) -> OIDCPublisher | PendingOIDCPublisher:
         """Returns a publisher for the given claims, or raises an error."""
-        metrics_tags = [f"publisher:{self.publisher}"]
+        metrics_tags = [f"publisher:{self.publisher}", f"issuer_url:{self.issuer_url}"]
         self.metrics.increment(
             "warehouse.oidc.find_publisher.attempt",
             tags=metrics_tags,