feat: wire kms.cache.operations.total, kms.hsm.operations.total

Author: HatemMn

.github/copilot-instructions.md

@@ -470,9 +470,7 @@ If any answer is "yes", fix it before finishing.
 > Create the branch-specific file if it does not exist yet.
 > Determine the branch name by running `git branch --show-current` — never guess.
 
-Update CHANGELOG/<branch_name_without_slashes>.md only when the change is high-level and worth a release note, such as a new feature, a user-visible behavior change, a bug fix, a security change, a compatibility change, or a significant refactor that materially affects users or operators. Skip changelog entries for routine implementation work, local cleanup, formatting, minor refactors, and test-only changes unless they affect observable behavior. Use the sections convention: `Features`, `Bug Fixes`, `Build`, `Refactor`, `Documentation`, `Testing`, `CI`, `Security`. Under a section, regroup by sub-feature or component when multiple entries relate to the same area.
-
-**Decision rule**: If the change alters any of: public API signatures, CLI flags/output, config file keys, default behavior, supported algorithms, or error messages visible to operators — write a changelog entry. Otherwise skip.
+Update CHANGELOG/<branch_name_without_slashes>.md only when the change is high-level and worth a release note, such as a new feature, a user-visible behavior change, an important bug fix, a security change, a compatibility change, or a significant refactor that materially affects users or operators. Skip changelog entries for routine implementation work, local cleanup, formatting, minor refactors, and test-only changes unless they affect observable behavior. Use the sections convention: `Features`, `Bug Fixes`, `Build`, `Refactor`, `Documentation`, `Testing`, `CI`, `Security`. Under a section, regroup by sub-feature or component when multiple entries relate to the same area.
 
 If appliable and the feature's code is complete, add the GitHub PR or issue link at the EOL: `([#XXX](https://github.com/Cosmian/kms/issues/XXX))`. Add at the bottom `Closes #xxx` lines as needed to automatically close related issues.
 

CHANGELOG/feat_richOTELmetrics.md

@@ -2,7 +2,7 @@
 
 ## Features
 
-### Database Metrics Wiring (Step 1)
+### Database Metrics Wiring — `kms.database.operations.total`, `kms.database.operation.duration` (Step 1)
 
 - Wire `kms.database.operations.total` (counter) and `kms.database.operation.duration`
   (histogram) at the `Database` facade layer with `operation`, `backend`, and `outcome`
@@ -15,7 +15,7 @@
 - `MainDbKind::as_str()` provides canonical backend labels
   (`"sqlite"`, `"postgresql"`, `"mysql"`, `"redis"`).
 
-### HTTP Metrics Wiring (Step 2)
+### HTTP Metrics Wiring — `kms.http.requests.total`, `kms.http.request.duration`, `kms.active.connections` (Step 2)
 
 - Add `OtelHttpMetrics` Actix-web middleware (`crate/server/src/middlewares/otel_http_middleware.rs`)
   that records `kms.http.requests.total` (counter with `method`, `path`, `status`
@@ -54,7 +54,7 @@
 - Add `Database::count_all_non_destroyed_objects()` facade that sums counts across all
   registered stores with `saturating_add`, tolerating partial failures.
 
-### Object Count Metric — Redis-findex backend (Step 3, continued)
+### Object Count Metric — `kms.objects.total`, Redis-findex backend (Step 3, continued)
 
 - Implement `count_all_non_destroyed` for the `RedisWithFindex` backend using an
   O(1) counter key (`kms::metrics::live_object_count`) instead of a full key scan.
@@ -122,6 +122,36 @@ state is not `Destroyed` or `Destroyed_Compromised`.
   Runs without any hardware.  Added `tokio` as a dev-dependency to
   `cosmian_kms_interfaces`.
 
+
+### Cache and HSM Operation Metrics — `kms.cache.operations.total`, `kms.hsm.operations.total` (Step 4)
+
+
+- Add `hsm_model_from_prefix(hsm_instances, prefix) -> &str` to
+  `crate/server/src/core/uid_utils.rs`.  Looks up the human-readable HSM model
+  label (e.g. `"softhsm2"`, `"utimaco"`) from the configured `hsm_instances`
+  slice and falls back to the prefix string itself when no matching instance is
+  found, ensuring the metric label is always non-empty.
+- Export `HsmInstanceParams` from `crate/server/src/config/mod.rs` (re-exported
+  through `params/mod.rs`) so that `uid_utils` and future callers can reference
+  it without reaching into private sub-modules.
+- Wire `kms.cache.operations.total` in `get_unwrapped()`
+  (`crate/server/src/core/kms/other_kms_methods.rs`): emit `record_cache_operation("get", "hit")`
+  on a cache hit, `record_cache_operation("get", "miss")` on a miss, and
+  `record_cache_operation("insert", "ok")` after a successful cache population.
+- Wire `kms.hsm.operations.total` at three dispatch points:
+  - `perform_crypto_operation()` in `key_ops/crypto_op.rs` — covers all six
+    oracle-routed operations (Encrypt, Decrypt, Sign, SignatureVerify, MAC,
+    MACVerify) via the `ResolvedKey::Oracle` arm.  Uses `Op::OP_NAME` as the
+    operation label and `hsm_model_from_prefix` for the model label.
+  - `wrap_using_crypto_oracle()` in `core/wrapping/wrap.rs` — emits
+    `record_hsm_operation("Wrap", model)` after the oracle `encrypt` call.
+  - `unwrap_using_crypto_oracle()` in `core/wrapping/unwrap.rs` — emits
+    `record_hsm_operation("Unwrap", model)` after the oracle `decrypt` call.
+- Add 4 unit tests in `core::uid_utils::tests` covering legacy `"hsm"` prefix,
+  new `"hsm::softhsm2"` format, multi-instance selection, and unknown-prefix
+  fallback.  All tests are sync, require no async runtime, and pass without
+  hardware.
+
 ## Testing
 
 ### Mockall test infrastructure

Cargo.lock

@@ -3,7 +3,9 @@ mod params;
 pub mod wizard;
 
 pub use command_line::*;
-pub use params::{KmipPolicyParams, OpenTelemetryConfig, ProxyParams, ServerParams, TlsParams};
+pub use params::{
+    HsmInstanceParams, KmipPolicyParams, OpenTelemetryConfig, ProxyParams, ServerParams, TlsParams,
+};
 
 #[derive(Debug, Clone)]
 pub struct IdpConfig {

crate/server/src/config/mod.rs

@@ -7,5 +7,5 @@ mod tls_params;
 pub use kmip_policy_params::KmipPolicyParams;
 pub use open_telemetry_params::OpenTelemetryConfig;
 pub use proxy_params::ProxyParams;
-pub use server_params::ServerParams;
+pub use server_params::{HsmInstanceParams, ServerParams};
 pub use tls_params::TlsParams;

crate/server/src/config/params/mod.rs

@@ -62,11 +62,17 @@ impl KMS {
         // check if we have it in the cache
         if let Some(u) = self.database.unwrapped_cache().peek(uid, object).await? {
             debug!("Unwrapped cache hit");
+            if let Some(ref metrics) = self.metrics {
+                metrics.record_cache_operation("get", "hit");
+            }
             return Ok(u);
         }
 
         // cache miss, try to unwrap
         debug!("Unwrapped cache miss. Calling unwrap");
+        if let Some(ref metrics) = self.metrics {
+            metrics.record_cache_operation("get", "miss");
+        }
         let unwrapped_object = {
             let mut unwrapped_object = object.clone();
             unwrap_object(&mut unwrapped_object, self, user).await?;
@@ -78,6 +84,9 @@ impl KMS {
             .unwrapped_cache()
             .insert(uid.to_owned(), object, unwrapped_object.clone())
             .await?;
+        if let Some(ref metrics) = self.metrics {
+            metrics.record_cache_operation("insert", "ok");
+        }
 
         Ok(unwrapped_object)
     }

crate/server/src/core/kms/other_kms_methods.rs

@@ -163,7 +163,15 @@ pub(crate) async fn perform_crypto_operation<Op: CryptoOpSpec>(
 
     match resolve_key_for_operation::<Op>(unique_identifier, kms, user).await? {
         ResolvedKey::Oracle { uid, prefix } => {
-            Op::execute_oracle(kms, &request, &uid, &prefix).await
+            let result = Op::execute_oracle(kms, &request, &uid, &prefix).await;
+            if let Some(ref metrics) = kms.metrics {
+                let model = crate::core::uid_utils::hsm_model_from_prefix(
+                    &kms.params.hsm_instances,
+                    &prefix,
+                );
+                metrics.record_hsm_operation(Op::OP_NAME, model);
+            }
+            result
         }
         ResolvedKey::Local(owm) => {
             let mut owm = *owm;

crate/server/src/core/operations/key_ops/crypto_op.rs

@@ -454,8 +454,8 @@ impl OtelMetrics {
         self.hsm_operations_total.add(
             1,
             &[
-                KeyValue::new("operation", operation.to_owned()),
                 KeyValue::new("hsm_model", hsm_model.to_owned()),
+                KeyValue::new("operation", operation.to_owned()),
             ],
         );
     }

crate/server/src/core/otel_metrics.rs

@@ -3,6 +3,7 @@ use std::collections::HashSet;
 use cosmian_kms_server_database::reexport::cosmian_kmip::kmip_2_1::kmip_types::UniqueIdentifier;
 
 use crate::{
+    config::HsmInstanceParams,
     core::KMS,
     result::{KResult, KResultHelper},
 };
@@ -31,6 +32,26 @@ pub(crate) fn has_prefix(uid: &str) -> Option<&str> {
     None
 }
 
+/// Resolve a human-readable HSM model label from a routing prefix.
+///
+/// Searches the configured `hsm_instances` for an entry whose `prefix` matches
+/// the given prefix and returns its `model` field (e.g. `"softhsm2"`).
+/// Falls back to the prefix string itself when no matching instance is found,
+/// ensuring call sites always get a usable label without panicking.
+///
+/// # Arguments
+/// * `hsm_instances` — the slice from `ServerParams::hsm_instances`
+/// * `prefix` — a routing prefix as returned by [`has_prefix`]
+pub(crate) fn hsm_model_from_prefix<'a>(
+    hsm_instances: &'a [HsmInstanceParams],
+    prefix: &'a str,
+) -> &'a str {
+    hsm_instances
+        .iter()
+        .find(|i| i.prefix == prefix)
+        .map_or(prefix, |i| i.model.as_str())
+}
+
 /// Determine the list of possible UIDs from a Unique Identifier,
 /// that may contain tags.
 /// # Arguments
@@ -52,3 +73,56 @@ pub(super) async fn uids_from_unique_identifier(
     }
     Ok(HashSet::from([uid_or_tags.to_owned()]))
 }
+
+#[cfg(test)]
+mod tests {
+    use std::collections::HashMap;
+
+    use super::*;
+
+    fn make_instance(prefix: &str, model: &str) -> HsmInstanceParams {
+        HsmInstanceParams {
+            model: model.to_owned(),
+            admin: vec![],
+            slot_passwords: HashMap::new(),
+            prefix: prefix.to_owned(),
+        }
+    }
+
+    #[test]
+    fn test_hsm_model_legacy_prefix() {
+        // Legacy format: UID "hsm::<slot>::<key>" → prefix == "hsm"
+        let instances = vec![make_instance("hsm", "softhsm2")];
+        assert_eq!(hsm_model_from_prefix(&instances, "hsm"), "softhsm2");
+    }
+
+    #[test]
+    fn test_hsm_model_new_format_prefix() {
+        // New format: UID "hsm::softhsm2::<slot>::<key>" → prefix == "hsm::softhsm2"
+        let instances = vec![make_instance("hsm::softhsm2", "softhsm2")];
+        assert_eq!(
+            hsm_model_from_prefix(&instances, "hsm::softhsm2"),
+            "softhsm2"
+        );
+    }
+
+    #[test]
+    fn test_hsm_model_second_instance() {
+        // Multiple instances; prefix selects the correct one.
+        let instances = vec![
+            make_instance("hsm::softhsm2", "softhsm2"),
+            make_instance("hsm::utimaco", "utimaco"),
+        ];
+        assert_eq!(hsm_model_from_prefix(&instances, "hsm::utimaco"), "utimaco");
+    }
+
+    #[test]
+    fn test_hsm_model_fallback_to_prefix_when_unknown() {
+        // Unknown prefix with empty instance list → falls back to the prefix itself.
+        let instances: Vec<HsmInstanceParams> = vec![];
+        assert_eq!(
+            hsm_model_from_prefix(&instances, "hsm::unknown"),
+            "hsm::unknown"
+        );
+    }
+}

crate/server/src/core/uid_utils.rs

@@ -203,6 +203,11 @@ async fn unwrap_using_crypto_oracle(
     let plaintext = crypto_oracle
         .decrypt(&unwrapping_key_uid, wrapped_key, None, None)
         .await?;
+    if let Some(ref metrics) = kms.metrics {
+        let model =
+            crate::core::uid_utils::hsm_model_from_prefix(&kms.params.hsm_instances, prefix);
+        metrics.record_hsm_operation("Unwrap", model);
+    }
 
     // decode the unwrapped key
     let key_value = decode_unwrapped_key(