feat: broaden telemetry channel attribution and add batch-commit event - #7643
feat: broaden telemetry channel attribution and add batch-commit event#7643claude[bot] wants to merge 5 commits into
Conversation
- Recognize SDK and integration user agents (go, ruby, python, nodejs, dotnet, rust, cpp SDKs, k8s external secrets operator) and the new infisical-agent UA in getUserAgentType, in both the Node backend and the backend-go port - Fix backend-go missing versioned k8-operator/x.y.z UA match - Add channel as an aggregation breakdown dimension for secrets pulled and Machine Identity Login aggregated events - Record channel on Machine Identity Login emissions across all identity auth routers - Emit a secrets pushed event (marked isBatchCommit) from the PIT batch/commit handler
|
| Filename | Overview |
|---|---|
| backend/src/server/plugins/audit-log.ts | Expands Node user-agent classification with exact and versioned matches for additional clients. |
| backend-go/internal/services/auditlog/useragent.go | Mirrors the expanded classification behavior in the Go backend. |
| backend/src/services/telemetry/telemetry-service.ts | Adds channel as an aggregation breakdown for secret pulls and machine-identity logins. |
| backend/src/ee/routes/v1/pit-router.ts | Emits secret-push telemetry for successfully applied batch secret changes. |
| backend/src/server/routes/v1/identity-universal-auth-router.ts | Adds classified request-channel attribution to universal-auth machine-identity login telemetry. |
Reviews (2): Last reviewed commit: "Merge remote-tracking branch 'origin/mai..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| const exactOrVersionedMatches = [ | ||
| UserAgentType.AGENT, | ||
| UserAgentType.K8_EXTERNAL_SECRETS_OPERATOR, | ||
| UserAgentType.GO_SDK, | ||
| UserAgentType.RUBY_SDK, | ||
| UserAgentType.DOTNET_SDK, | ||
| UserAgentType.RUST_SDK, | ||
| UserAgentType.CPP_SDK | ||
| ]; | ||
| for (const match of exactOrVersionedMatches) { | ||
| if (userAgent === match || userAgent.startsWith(`${match}/`)) { | ||
| return match; | ||
| } |
There was a problem hiding this comment.
The expanded classification contract is duplicated across Node and Go without parity tests for the new exact, versioned, and legacy alias cases. A later one-sided change to ordering, casing, or prefix handling would silently produce different telemetry and audit-log attribution between the two backends.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9f2eedc1e7
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
…l-attribution # Conflicts: # backend/src/services/telemetry/telemetry-service.ts
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 35997175 | Triggered | Username Password | 0427b76 | backend/src/ee/services/dynamic-secret/providers/models.test.ts | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
|
@greptile review |
2 participants
Requested by Andrew Huang · Slack thread
Context
Phase 0 of the telemetry channel-attribution work. Five targeted fixes:
Before
secrets pulledtraffic lands in channelotherbecausegetUserAgentTypeonly recognizescli,k8-operator,terraform, browsers, and the legacyInfisicalNodeSDK/InfisicalPythonSDKUA strings. Everything built on the go-sdk (CSI provider, agent injector), the ruby/rust/cpp/dotnet SDKs, the current python/nodejs SDKs, and the external-secrets operator all fall through toother. The backend-go port additionally misclassifies versionedk8-operator/x.y.zUAs asother.Machine Identity Loginevents carry no client/channel info at all, and the aggregatedsecrets pulled/Machine Identity Loginevents histogram-izechannel, so channel breakdowns are not possible in PostHog.POST /api/v1/pit/batch/commit) emit no secret-mutation telemetry event.After
getUserAgentType(Node backend and backend-go, kept in sync) additionally recognizesinfisical-go-sdk,k8-external-secrets-operator,infisical-ruby-sdk,Infisical.Sdk(dotnet),infisical-rs(rust),infisical-cpp-sdk, both bare and versioned (<ua>/x.y.z).infisical-python-sdkandinfisical-nodejs-sdkmap to the existingInfisicalPythonSDK/InfisicalNodeSDKchannels. A newinfisical-agentchannel captures the agent's UA introduced by feat(telemetry): org attribution, agent user-agent, and working opt-out cli#360 (which switches the agent from UAclitoinfisical-agent/<version>), so agent volume separates from interactive CLI. All existing matches are preserved exactly.k8-operator/x.y.zUAs, matching the Node behavior.channelis an aggregation breakdown dimension forsecrets pulledandMachine Identity Login, so each channel yields its own aggregated event with a flat, filterablechannelproperty.Machine Identity Loginemission (all 11 identity auth routers) recordschannelfrom the request UA.secrets pushedevent (withisBatchCommit: true,numberOfSecretsfrom the change count, plus the standard projectId/environment/secretPath/channel/actorType properties), following the v3/v4 secret-router emission pattern.No endpoint request/response schemas change. All changes are additive: new
UserAgentTypeenum members (stored as free strings in audit logs; the optional audit-loguserAgentTypefilter accepts the new values), new optional PostHog event properties, and one new server-side telemetry emission.Pairs with Infisical/cli#360 for the
infisical-agentuser agent.How
backend/src/server/plugins/audit-log.ts– broadengetUserAgentTypewith exact-or-versioned matching for the new UAsbackend/src/ee/services/audit-log/audit-log-types.ts– newUserAgentTypemembersbackend-go/internal/services/auditlog/useragent.go– mirror of the Node matcher + versionedk8-operator/fixbackend/src/services/telemetry/telemetry-service.ts–channelbreakdown dimension forSecretPulledandMachineIdentityLoginbackend/src/services/telemetry/telemetry-types.ts– optionalchannelonTMachineIdentityLoginEvent, optionalisBatchCommitonTSecretModifiedEventbackend/src/server/routes/v1/identity-*-auth-router.ts(11 files) – recordchannelonMachine Identity Loginbackend/src/ee/routes/v1/pit-router.ts– emitsecrets pushedafter a successful batch commitSteps to verify the change
infisical-go-sdk/v0.4.0,infisical-agent/1.2.3,k8-operator/0.11.4and confirm audit logs / PostHog events carry the expected channelMachine Identity Loginevent carrieschannelsecrets pushedevent withisBatchCommit: trueis emittedgo build ./...inbackend-gopassesType
Checklist
type(scope): short description(scope is optional, e.g.,fix: prevent crash on syncorfix(api): handle null response).Generated by Claude Code