feat: Add authenticated environment attributes to relay.auth span and metrics - #781
Open
keelerm84 wants to merge 6 commits into
Open
feat: Add authenticated environment attributes to relay.auth span and metrics#781keelerm84 wants to merge 6 commits into
keelerm84 wants to merge 6 commits into
Conversation
kinyoklion
reviewed
Jul 30, 2026
The relay.auth span reported the environment display name verbatim while the environment.name metric attribute reported it through the metrics package's sanitizer, so the same environment could appear under two different values -- display names are user-supplied and may contain slashes or be blank. Promote the sanitizer to internal/tracing as SanitizeAttributeValue, the shared low-level telemetry package, and use it from both the metrics attribute set and the auth span attributes.
- Trim surrounding whitespace in SanitizeAttributeValue. It trimmed only for the blank check and returned the original string, so an auto-configured environment with no project name (display name " Production") became its own time series while rendering identically to "Production". - Copy the environment attributes in GetAttributes before attribute.NewSet, which sorts the slice it is given in place. NewEventMetricsRecorder already guards against this; GetAttributes shared the slice. - Document environment.id in docs/metrics.md, including that it is absent for environments with no client-side ID and shared across payload-filter variants. - Do not claim spans and metrics always report the same environment name: the metric attribute set is built when the environment is created while the span reads the identifiers per request, so a rename in auto-configuration or offline mode diverges until restart. - Cover the exported span with a tracer-provider recorder: attributes survive the round trip, the display name is sanitized, and the ID is omitted when no EnvironmentID is configured.
The per-environment metric attributes were built once when the environment was created, while the relay.auth span reads the identifiers per request. After a rename arrived from auto-configuration or offline mode via SetIdentifiers, the span reported the new name and every metric kept reporting the old one until restart. SetIdentifiers now rebuilds the environment's metric attributes. Attributes are held in an immutable snapshot behind an atomic pointer, so recording paths get a consistent set without locking, and the event metrics recorder reads the snapshot per record instead of capturing a private copy at construction -- otherwise event metrics alone would have kept the old name. Renaming starts a new metric time series under the new name; the old series stops receiving data points rather than being relabeled. That is now documented in docs/metrics.md. The environment ID cannot change for a live environment -- the key rotator is seeded from EnvConfig.EnvID and rotation only replaces SDK and mobile keys -- so it is carried over rather than re-derived.
…span The auth span ends before the next handler runs, so environment attributes set on it covered nothing else in the trace. Set them on the request span -- the parent of the auth span and of every handler span below it -- so a whole trace can be filtered by environment. The keys are now the same ones the metrics use, environment.name and environment.id, moved to internal/tracing so both packages share one definition. These replace the relay.auth.environment.name and relay.auth.environment.id attributes added earlier in this branch, so nothing released changes. relay.auth keeps reporting the auth outcome. Covered end to end in the relay package, where the real otelmux request span is the root, for both a server-side SDK key and a client-side environment ID.
keelerm84
force-pushed
the
mk/SDK-2774/add-env-attribute
branch
from
August 3, 2026 13:53
70b8963 to
688a491
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Emit the authenticated environment as telemetry attributes so traces and metrics can be correlated by environment.
relay.authspan: on successful auth, both auth middlewares now setrelay.auth.environment.name(always, the human-readable display name) andrelay.auth.environment.id(only when anEnvironmentIDcredential is configured). Therelay.auth.result=successattribute remains unconditional.environment.nameand now also emitsenvironment.idwhen available.The environment ID may be absent for SDK-key-only environments in a manual configuration, so it is only added when present.
Note
Low Risk
Observability-only attribute and middleware changes with broad test coverage; no auth or request-handling behavior changes beyond span/metric labels.
Overview
Adds shared
environment.nameandenvironment.idtelemetry so authenticated traffic can be joined across signals.On successful auth, both server-side and client-side middleware call
setEnvSpanAttributeson the request span (the otelmux parent), not onrelay.auth, so every handler span in the trace inherits filterable environment context. Names usetracing.SanitizeAttributeValue(same rules as metrics);environment.idis omitted for SDK-key-only environments.Metrics gain optional
environment.id, reuse the same attribute keys frominternal/tracing, andAddEnvironmentnow accepts an env ID. Per-environment attributes are immutable snapshots behind an atomic pointer;SetEnvironmentName(fromSetIdentifierson upstream renames) starts a new metric series under the new name while preserving env ID. Event metrics read attributes at record time so renames apply to async event counters too.docs/metrics.mddocuments trace/metric correlation and rename behavior.Reviewed by Cursor Bugbot for commit 688a491. Bugbot is set up for automated code reviews on this repo. Configure here.