Simplify relay observability to HTTP traces

Co-authored-by: codex <codex@users.noreply.github.com>

Author: juliusmarminge

infra/relay/src/api.ts

@@ -58,7 +58,6 @@ import * as EnvironmentCredentials from "./persistence/EnvironmentCredentials.ts
 import * as EnvironmentLinks from "./persistence/EnvironmentLinks.ts";
 import * as LiveActivities from "./persistence/LiveActivities.ts";
 import * as Settings from "./settings.ts";
-import { increment, relayEnvironmentLinksTotal } from "./observability/Metrics.ts";
 import * as AgentActivityPublisher from "./services/AgentActivityPublisher.ts";
 import * as EnvironmentConnector from "./services/EnvironmentConnector.ts";
 import * as EnvironmentLinker from "./services/EnvironmentLinker.ts";
@@ -377,7 +376,7 @@ export const clientApi = HttpApiBuilder.group(RelayApi, "client", (handlers) =>
               endpointRuntime: result.endpointRuntime,
               relayIssuer: settings.relayIssuer,
               environmentCredential: result.environmentCredential,
-              cloudMintPublicKey: Redacted.value(settings.cloudMintPublicKey),
+              cloudMintPublicKey: settings.cloudMintPublicKey,
             };
           },
           mapRelayCommonApiErrors("not_authorized"),
@@ -472,10 +471,6 @@ export const clientApi = HttpApiBuilder.group(RelayApi, "client", (handlers) =>
             environmentId: params.environmentId,
           });
           if (unlinked) {
-            yield* increment(relayEnvironmentLinksTotal, {
-              operation: "unlink",
-              endpointProviderKind: link.endpoint.providerKind,
-            });
             yield* credentials.revokeForEnvironmentPublicKey({
               environmentId: link.environmentId,
               environmentPublicKey: link.environmentPublicKey,

infra/relay/src/apns.ts

@@ -73,12 +73,10 @@ function makeApnsJwt(input: {
 }): Effect.Effect<string, ApnsSigningError> {
   return Effect.try({
     try: () => {
-      const keyId = Redacted.value(input.keyId);
-      const teamId = Redacted.value(input.teamId);
       const privateKey = Redacted.value(input.privateKey);
-      const header = Encoding.encodeBase64Url(JSON.stringify({ alg: "ES256", kid: keyId }));
+      const header = Encoding.encodeBase64Url(JSON.stringify({ alg: "ES256", kid: input.keyId }));
       const payload = Encoding.encodeBase64Url(
-        JSON.stringify({ iss: teamId, iat: input.issuedAtUnixSeconds }),
+        JSON.stringify({ iss: input.teamId, iat: input.issuedAtUnixSeconds }),
       );
       const signingInput = `${header}.${payload}`;
       const signature = NodeCrypto.createSign("sha256")
@@ -215,7 +213,7 @@ export function sendLiveActivityRequest(input: {
         authorization: `bearer ${jwt}`,
         "apns-priority": input.request.priority,
         "apns-push-type": "liveactivity",
-        "apns-topic": `${Redacted.value(input.credentials.bundleId)}.push-type.liveactivity`,
+        "apns-topic": `${input.credentials.bundleId}.push-type.liveactivity`,
       }),
       HttpClientRequest.bodyJson(input.request.payload),
       Effect.flatMap(httpClient.execute),
@@ -254,7 +252,7 @@ export function sendPushNotificationRequest(input: {
         authorization: `bearer ${jwt}`,
         "apns-priority": input.request.priority,
         "apns-push-type": "alert",
-        "apns-topic": Redacted.value(input.credentials.bundleId),
+        "apns-topic": input.credentials.bundleId,
       }),
       HttpClientRequest.bodyJson(input.request.payload),
       Effect.flatMap(httpClient.execute),

infra/relay/src/infra/RelayObservability.test.ts

@@ -1,62 +1,28 @@
 import { describe, expect, it } from "vitest";
 
 import {
-  RELAY_AXIOM_DATASETS,
-  makeRelayDashboardCharts,
-  makeRelayDashboardLayout,
+  RELAY_AXIOM_TRACE_DATASET,
   relayAxiomIngestDatasetCapabilities,
   relayAxiomQueryDatasetCapabilities,
+  relayTraceQuery,
 } from "./RelayObservability.ts";
 
 describe("RelayObservability", () => {
-  it("scopes the ingest token to create-only ingest across relay datasets", () => {
+  it("scopes the ingest token only to HTTP span ingestion", () => {
     expect(relayAxiomIngestDatasetCapabilities()).toEqual({
-      [RELAY_AXIOM_DATASETS.events]: { ingest: ["create"] },
-      [RELAY_AXIOM_DATASETS.metrics]: { ingest: ["create"] },
+      [RELAY_AXIOM_TRACE_DATASET]: { ingest: ["create"] },
     });
   });
 
-  it("scopes the diagnostics query token to read-only query across relay datasets", () => {
+  it("scopes the diagnostics query token only to HTTP spans", () => {
     expect(relayAxiomQueryDatasetCapabilities()).toEqual({
-      [RELAY_AXIOM_DATASETS.events]: { query: ["read"] },
-      [RELAY_AXIOM_DATASETS.metrics]: { query: ["read"] },
+      [RELAY_AXIOM_TRACE_DATASET]: { query: ["read"] },
     });
   });
 
-  it("keeps dashboard layout cells in sync with declared charts", () => {
-    const charts = makeRelayDashboardCharts();
-    const chartIds = new Set(charts.map((chart) => chart.id));
-    const layout = makeRelayDashboardLayout(charts);
-
-    expect(layout).toHaveLength(charts.length);
-    for (const cell of layout) {
-      expect(chartIds.has(cell.i)).toBe(true);
-    }
-  });
-
-  it("builds log APL and metrics MPL dashboard queries", () => {
-    const charts = makeRelayDashboardCharts({
-      events: "relay-events-test",
-      metrics: "relay-metrics-test",
-    });
-    const recentFailures = charts.find((chart) => chart.id === "recent-failures");
-    const activeTunnels = charts.find((chart) => chart.id === "active-managed-tunnels");
-    if (
-      !recentFailures ||
-      !("query" in recentFailures) ||
-      !activeTunnels ||
-      !("query" in activeTunnels)
-    ) {
-      throw new Error("Expected query-backed relay charts.");
-    }
-
-    expect(recentFailures.query.apl).toContain("['relay-events-test']");
-    expect(recentFailures.query.apl).toContain("column_ifexists('severityText', '')");
-    expect(recentFailures.query.apl).not.toContain("severity_text");
-    expect(activeTunnels.query.apl).toContain(
-      "`relay-metrics-test`:`relay_managed_tunnels_active`",
+  it("builds APL queries for the trace dataset", () => {
+    expect(relayTraceQuery("| where name == 'GET /health'", "relay-traces-test")).toBe(
+      "['relay-traces-test']\n| where name == 'GET /health'",
     );
-    expect(activeTunnels.query.apl).toContain("| group using sum");
-    expect(activeTunnels.query.apl).not.toContain("['relay-metrics-test']");
   });
 });