feat: setup opentel

apps/docs/api-reference/introduction.mdx

@@ -11,10 +11,10 @@ https://kan.bn/api/v1
 
 ## Authentication
 
-Most endpoints require authentication using your API key. You can create one in the [settings page](https://kan.bn/settings) of your account. Include this key in the `x-api-key` header of each request.
+Most endpoints require authentication using your API key. You can create one in the [settings page](https://kan.bn/settings) of your account. Include this key as a Bearer token in the `Authorization` header of each request.
 
 ```
-'x-api-key': kan_123456789
+'Authorization': 'Bearer kan_123456789'
 ```
 
 ## Response codes

apps/web/next.config.js

@@ -28,6 +28,7 @@ const config = {
     ],
   },
 
+
   /** Enables hot reloading for local packages without a build step */
   transpilePackages: [
     "@kan/api",
@@ -65,8 +66,15 @@ const config = {
       },
     },
   },
+  serverExternalPackages: [
+    "pino",
+    "@opentelemetry/sdk-node",
+    "@opentelemetry/auto-instrumentations-node",
+    "@opentelemetry/exporter-trace-otlp-http",
+  ],
+
   experimental: {
-    // instrumentationHook: true,
+    instrumentationHook: true,
     swcPlugins: [["@lingui/swc-plugin", {}]],
   },
 

apps/web/package.json

@@ -34,6 +34,10 @@
     "@lingui/macro": "^5.3.2",
     "@lingui/react": "^5.3.2",
     "@novu/api": "^3.11.0",
+    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/auto-instrumentations-node": "^0.71.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.213.0",
+    "@opentelemetry/sdk-node": "^0.213.0",
     "@t3-oss/env-nextjs": "^0.11.1",
     "@tailwindcss/typography": "^0.5.16",
     "@tanstack/react-query": "catalog:",

apps/web/src/instrumentation.ts

@@ -0,0 +1,32 @@
+export async function register() {
+  if (
+    process.env.NEXT_RUNTIME !== "nodejs" ||
+    process.env.NEXT_PUBLIC_KAN_ENV !== "cloud" ||
+    !process.env.AXIOM_TOKEN ||
+    !process.env.AXIOM_DATASET
+  ) {
+    return;
+  }
+
+  const { NodeSDK } = await import("@opentelemetry/sdk-node");
+  const { OTLPTraceExporter } = await import("@opentelemetry/exporter-trace-otlp-http");
+  const { getNodeAutoInstrumentations } = await import("@opentelemetry/auto-instrumentations-node");
+
+  const sdk = new NodeSDK({
+    serviceName: "kan",
+    traceExporter: new OTLPTraceExporter({
+      url: "https://api.axiom.co/v1/traces",
+      headers: {
+        Authorization: `Bearer ${process.env.AXIOM_TOKEN}`,
+        "X-Axiom-Dataset": process.env.AXIOM_DATASET,
+      },
+    }),
+    instrumentations: [
+      getNodeAutoInstrumentations({
+        "@opentelemetry/instrumentation-fs": { enabled: false },
+      }),
+    ],
+  });
+
+  sdk.start();
+}

cloud/docker-compose.yml

@@ -39,6 +39,8 @@ services:
 
       # Logging (optional - debug, info, warn, error; defaults to debug in dev, info in prod)
       - LOG_LEVEL=${LOG_LEVEL}
+      - AXIOM_TOKEN=${AXIOM_TOKEN}
+      - AXIOM_DATASET=${AXIOM_DATASET}
 
       # Stripe
       - STRIPE_SECRET_KEY=${STRIPE_SECRET_KEY}

packages/api/src/routers/board.ts

@@ -227,7 +227,7 @@ export const boardRouter = createTRPCRouter({
         boardSlug: z
           .string()
           .min(3)
-          .max(24)
+          .max(60)
           .regex(/^(?![-]+$)[a-zA-Z0-9-]+$/),
         members: z.array(z.string().min(12)).optional(),
         labels: z.array(z.string().min(12)).optional(),
@@ -657,7 +657,7 @@ export const boardRouter = createTRPCRouter({
         boardSlug: z
           .string()
           .min(3)
-          .max(24)
+          .max(60)
           .regex(/^(?![-]+$)[a-zA-Z0-9-]+$/),
         boardPublicId: z.string().min(12),
       }),

packages/api/src/routers/integration.ts

@@ -19,6 +19,7 @@ import { encryptToken } from "../utils/encryption";
 export const integrationRouter = createTRPCRouter({
   saveGitHubToken: protectedProcedure
     .input(z.object({ token: z.string() }))
+    .output(z.object({ success: z.boolean() }))
     .mutation(async ({ ctx, input }) => {
       const user = ctx.user;
 
@@ -43,7 +44,9 @@ export const integrationRouter = createTRPCRouter({
       return { success: true };
     }),
 
-  disconnectGitHub: protectedProcedure.mutation(async ({ ctx }) => {
+  disconnectGitHub: protectedProcedure
+    .output(z.object({ success: z.boolean() }))
+    .mutation(async ({ ctx }) => {
     const user = ctx.user;
 
     if (!user)
@@ -56,7 +59,9 @@ export const integrationRouter = createTRPCRouter({
     return { success: true };
   }),
 
-  getGitHubStatus: protectedProcedure.query(async ({ ctx }) => {
+  getGitHubStatus: protectedProcedure
+    .output(z.object({ connected: z.boolean() }))
+    .query(async ({ ctx }) => {
     const user = ctx.user;
 
     if (!user)

packages/api/src/trpc.ts

@@ -1,3 +1,4 @@
+import { randomUUID } from "crypto";
 import type { CreateNextContextOptions } from "@trpc/server/adapters/next";
 import type { NextApiRequest } from "next";
 import type { OpenApiMeta } from "trpc-to-openapi";
@@ -11,7 +12,28 @@ import { initAuth } from "@kan/auth/server";
 import { createDrizzleClient } from "@kan/db/client";
 import { createLogger } from "@kan/logger";
 
-const log = createLogger("trpc");
+const log = createLogger("api");
+
+const TRPC_STATUS_MAP: Partial<Record<TRPCError["code"], number>> = {
+  PARSE_ERROR: 400,
+  BAD_REQUEST: 400,
+  UNAUTHORIZED: 401,
+  FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  METHOD_NOT_SUPPORTED: 405,
+  TIMEOUT: 408,
+  CONFLICT: 409,
+  PRECONDITION_FAILED: 412,
+  PAYLOAD_TOO_LARGE: 413,
+  UNPROCESSABLE_CONTENT: 422,
+  TOO_MANY_REQUESTS: 429,
+  CLIENT_CLOSED_REQUEST: 499,
+  INTERNAL_SERVER_ERROR: 500,
+  NOT_IMPLEMENTED: 501,
+  BAD_GATEWAY: 502,
+  SERVICE_UNAVAILABLE: 503,
+  GATEWAY_TIMEOUT: 504,
+};
 
 export interface User {
   id: string;
@@ -50,6 +72,7 @@ interface CreateContextOptions {
   db: dbClient;
   auth: ReturnType<typeof createAuthWithHeaders>;
   headers: Headers;
+  transport?: "trpc" | "rest";
 }
 
 export const createInnerTRPCContext = (opts: CreateContextOptions) => {
@@ -58,6 +81,8 @@ export const createInnerTRPCContext = (opts: CreateContextOptions) => {
     db: opts.db,
     auth: opts.auth,
     headers: opts.headers,
+    transport: opts.transport ?? "trpc",
+    requestId: randomUUID(),
   };
 };
 
@@ -69,7 +94,13 @@ export const createTRPCContext = async ({ req }: CreateNextContextOptions) => {
 
   const session = await auth.api.getSession();
 
-  return createInnerTRPCContext({ db, user: session?.user, auth, headers });
+  return createInnerTRPCContext({
+    db,
+    user: session?.user,
+    auth,
+    headers,
+    transport: "trpc",
+  });
 };
 
 export const createNextApiContext = async (req: NextApiRequest) => {
@@ -80,7 +111,13 @@ export const createNextApiContext = async (req: NextApiRequest) => {
 
   const session = await auth.api.getSession();
 
-  return createInnerTRPCContext({ db, user: session?.user, auth, headers });
+  return createInnerTRPCContext({
+    db,
+    user: session?.user,
+    auth,
+    headers,
+    transport: "trpc",
+  });
 };
 
 export const createRESTContext = async ({ req }: CreateNextContextOptions) => {
@@ -93,11 +130,16 @@ export const createRESTContext = async ({ req }: CreateNextContextOptions) => {
   try {
     session = await auth.api.getSession();
   } catch (error) {
-    log.error({ err: error }, "Error getting session");
-    throw error;
+    log.warn({ err: error }, "Failed to get session, treating as unauthenticated");
   }
 
-  return createInnerTRPCContext({ db, user: session?.user, auth, headers });
+  return createInnerTRPCContext({
+    db,
+    user: session?.user,
+    auth,
+    headers,
+    transport: "rest",
+  });
 };
 
 const t = initTRPC
@@ -126,20 +168,39 @@ const loggingMiddleware = t.middleware(async ({ path, type, next, ctx }) => {
   const result = await next();
   const duration = Date.now() - start;
 
-  const meta = { procedure: path, type, duration, userId: (ctx as { user?: { id: string } }).user?.id };
+  const { user, transport, requestId } = ctx as {
+    user?: { id: string; email: string };
+    transport?: string;
+    requestId?: string;
+  };
+  const isCloud = process.env.NEXT_PUBLIC_KAN_ENV === "cloud";
+  const meta = {
+    requestId,
+    procedure: path,
+    type,
+    transport,
+    duration,
+    userId: user?.id,
+    ...(isCloud && { email: user?.email }),
+  };
+
+  const label = transport === "rest" ? "REST" : "tRPC";
 
   if (result.ok) {
-    log.info(meta, "tRPC OK");
+    log.info({ ...meta, status: 200 }, `${label} OK`);
   } else {
-    log.error({ ...meta, err: result.error }, "tRPC error");
+    const status = TRPC_STATUS_MAP[result.error.code] ?? 500;
+    const errorCode = result.error.code;
+    log.error(
+      { ...meta, status, errorCode, err: result.error },
+      `${label} error`,
+    );
   }
 
   return result;
 });
 
-export const publicProcedure = t.procedure.use(loggingMiddleware).meta({
-  openapi: { method: "GET", path: "/public" },
-});
+export const publicProcedure = t.procedure.use(loggingMiddleware);
 
 const enforceUserIsAuthed = t.middleware(async ({ ctx, next }) => {
   if (!ctx.user) {
@@ -163,13 +224,7 @@ const enforceUserIsAdmin = t.middleware(async ({ ctx, next }) => {
 
 export const protectedProcedure = t.procedure
   .use(loggingMiddleware)
-  .use(enforceUserIsAuthed)
-  .meta({
-    openapi: {
-      method: "GET",
-      path: "/protected",
-    },
-  });
+  .use(enforceUserIsAuthed);
 
 export const adminProtectedProcedure = t.procedure
   .use(loggingMiddleware)

packages/auth/src/plugins.ts

@@ -165,6 +165,13 @@ export function createPlugins(db: dbClient) {
       : []),
     apiKey({
       enableSessionForAPIKeys: true,
+      customAPIKeyGetter: (ctx) => {
+        const authorization = ctx.headers?.get("authorization");
+        if (authorization?.startsWith("Bearer ")) {
+          return authorization.slice(7);
+        }
+        return ctx.headers?.get("x-api-key") ?? undefined;
+      },
       rateLimit: {
         enabled: true,
         timeWindow: 1000 * 60, // 1 minute

packages/logger/package.json

@@ -19,6 +19,8 @@
     "typecheck": "tsc --noEmit --emitDeclarationOnly false"
   },
   "dependencies": {
+    "@axiomhq/js": "^1.4.0",
+    "@opentelemetry/api": "^1.9.0",
     "pino": "^9.14.0",
     "pino-pretty": "^13.1.3"
   },

packages/logger/src/index.ts

@@ -1,20 +1,63 @@
+import { Axiom } from "@axiomhq/js";
+import { trace } from "@opentelemetry/api";
 import pino from "pino";
 
 const isDev = process.env.NODE_ENV !== "production";
+const isCloud = process.env.NEXT_PUBLIC_KAN_ENV === "cloud";
 const level = process.env.LOG_LEVEL || (isDev ? "debug" : "info");
 
-export const logger = pino({
-  level,
-  ...(isDev && {
-    transport: {
-      target: "pino-pretty",
-      options: {
-        colorize: true,
-        ignore: "pid,hostname",
-        translateTime: "HH:MM:ss",
-      },
-    },
-  }),
-});
+const axiomToken = process.env.AXIOM_TOKEN;
+const axiomDataset = process.env.AXIOM_DATASET;
+const useAxiom = isCloud && !!axiomToken && !!axiomDataset;
 
-export const createLogger = (module: string) => logger.child({ module });
+function createAxiomStream(
+  token: string,
+  dataset: string,
+): pino.DestinationStream {
+  const client = new Axiom({ token });
+  return {
+    write(msg: string) {
+      try {
+        client.ingest(dataset, [JSON.parse(msg) as Record<string, unknown>]);
+      } catch {
+        // ignore malformed log lines
+      }
+    },
+  };
+}
+
+export const logger = useAxiom
+  ? pino(
+      { level },
+      pino.multistream([
+        { stream: process.stdout, level },
+        { stream: createAxiomStream(axiomToken, axiomDataset), level },
+      ]),
+    )
+  : pino({
+      level,
+      ...(isDev && {
+        transport: {
+          target: "pino-pretty",
+          options: {
+            colorize: true,
+            ignore: "pid,hostname",
+            translateTime: "HH:MM:ss",
+          },
+        },
+      }),
+    });
+
+function getTraceContext(): { traceId?: string; spanId?: string } {
+  try {
+    const span = trace.getActiveSpan();
+    if (!span) return {};
+    const ctx = span.spanContext();
+    return { traceId: ctx.traceId, spanId: ctx.spanId };
+  } catch {
+    return {};
+  }
+}
+
+export const createLogger = (module: string) =>
+  logger.child({ module, ...getTraceContext() });

turbo.json

@@ -130,7 +130,9 @@
     "NOVU_API_KEY",
     "EMAIL_UNSUBSCRIBE_SECRET",
     "REDIS_URL",
-    "LOG_LEVEL"
+    "LOG_LEVEL",
+    "AXIOM_TOKEN",
+    "AXIOM_DATASET"
   ],
   "globalPassThroughEnv": [
     "NODE_ENV",