Commit Graph

529 Commits

Author SHA1 Message Date
12a8391944 feat(core-audit): IAuditLog interface + AUDIT_SYMBOLS
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 16:11:30 +02:00
0c5ad08dcd feat(core-audit): scaffold optional package (no impls yet)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 16:10:58 +02:00
a3b7100d10 feat(core-shared): BindContext.auditLog? field (5th generic)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 16:04:58 +02:00
a7e383593a feat(core-shared): AuditLogProtocol + ./audit subpath export
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 16:04:29 +02:00
cc4de8eb75 feat(core-shared): truncateIp helper (/24 IPv4, /48 IPv6) per DPA
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 16:03:45 +02:00
1247e1804a feat(core-shared): AuditEntry type with closed action enum + required tenant
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 16:03:19 +02:00
ac8dfcc5d4 docs(plan): audit logging & DPA compliance (6 phases, ~30 commits)
Implementation plan for the spec at docs/superpowers/specs/2026-05-11-
audit-and-compliance-design.md. Six phases:

- Phase 1: AuditLogProtocol + AuditEntry type + truncateIp helper in
  core-shared; BindContext.auditLog? (5th generic).
- Phase 2: @repo/core-audit optional package — NoopAuditLog,
  StdoutJsonAuditLog, append-only audit-logs Payload collection,
  PayloadAuditLog (record), MultiSinkAuditLog fan-out, bindAudit
  binder with prod salt validation, RecordingAuditLog in core-testing.
- Phase 3: GDPR erasure plumbing — pseudonymize helper (sha256 +
  AUDIT_PSEUDONYM_SALT), PayloadAuditLog.eraseSubject via
  overrideAccess, createAuditErasureHook Payload afterDelete factory,
  admin tRPC procedure (audit.eraseSubject).
- Phase 4: OTel correlation bridge — currentTraceId() in core-shared,
  TraceIdEnrichingAuditLog decorator wraps inner sinks at bindAudit
  time. Explicit caller correlationId wins.
- Phase 5: createAuditAfterReadHook factory for opt-in per-collection
  VIEW capture; fire-and-forget semantics with stderr fallback.
- Phase 6: ADR-018 + audit-and-compliance.md guide + generator template
  at turbo/generators/templates/core-package/audit/ + byte-identical
  snapshot + e2e test + 6 doc surface refreshes (template-tiers,
  scaffolding-doc, CLAUDE.md, AGENTS.md, data-flow-explainer, README).

Total: ~30 commits expected.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-11 16:01:11 +02:00
40b5b1a94f docs(spec): audit logging & DPA compliance design
Six-phase design for @repo/core-audit (5th optional package).

Phase 1: AuditLogProtocol + AuditEntry type + truncateIp helper in
  core-shared; BindContext.auditLog? optional field.
Phase 2: @repo/core-audit package with NoopAuditLog + PayloadAuditLog
  (append-only collection) + StdoutJsonAuditLog (structured JSON) +
  MultiSinkAuditLog fan-out wrapper + RecordingAuditLog in core-testing.
Phase 3: GDPR erasure plumbing — eraseSubject impls, pseudonymize helper
  (sha256-with-salt), admin tRPC procedure, createAuditErasureHook
  Payload afterDelete hook factory.
Phase 4: OTel correlation bridge — currentTraceId() helper,
  TraceIdEnrichingAuditLog decorator wraps inner sinks at bind time so
  AuditEntry.correlationId auto-populates from active OTel span.
Phase 5: createAuditAfterReadHook factory for opt-in per-collection
  automatic VIEW capture; reference wiring documented (printed by
  generator as a diff, NOT auto-installed in auth).
Phase 6: ADR-018, audit-and-compliance.md guide, generator template
  + byte-identical snapshot + e2e test, doc refreshes (CLAUDE.md,
  AGENTS.md, template-tiers, data-flow-explainer, README,
  scaffolding-doc).

Compliance grounded in DPA "Logging & Monitoring" requirements:
closed action enum (VIEW/CREATE/UPDATE/DELETE/EXPORT/PERMISSION_CHANGE),
required tenant field, type-enforced "what NOT to log" (no payload/
body/oldValue/newValue fields), IP /24 v4 + /48 v6 truncation, sha256-
salted pseudonymization, append-only Payload collection with privileged
overrideAccess erasure path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-11 15:46:33 +02:00
726934bdeb Merge branch 'worktree-opentelemetry-migration': OpenTelemetry migration (ADR-017) 2026-05-11 12:59:20 +02:00
82d80014bf fix(otel): address lint and test regressions from C1/C2 fixes
- Prefix unused opts param with _opts in bindOtelInstrumentation (ESLint)
- Extend IPv6 regex to cover prefix::suffix form (e.g. 2001:0db8::1) so
  the IPv6 scrub test passes correctly
- Delete orphaned sentry-pii-scrubber.test.ts files from apps/cms and
  apps/web-tanstack that imported the deleted sentry/scrub module (broke
  typecheck; the OTel-layer replacement tests are in pii-scrub-processor.test.ts)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 12:42:38 +02:00
9acf16f399 chore: address Phase 5 review polish (test descriptions, version conflict comment, mock cleanup)
I3: bind-production.test.ts instrumentation orthogonality tests updated to use
bindOtelInstrumentation as primary name (bindSentryInstrumentation alias still
wired in mock setup for deprecation-alias coverage, not in assertions).
I4: as never cast in init-server-node.ts annotated with explanation of the
sdk-trace-base / sdk-node TypeScript version conflict that necessitates it.
I5: SentryLogRecordProcessor removed from @sentry/opentelemetry mock in
no-instrumentation.ts — that class does not exist in v10.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 12:40:11 +02:00
7c74a1c9e1 fix(otel): scrub IP addresses in attribute values + log bodies (R32 compliance)
PII_KEY_SUBSTRINGS extended with all OTel HTTP semconv IP attribute keys
(http.client_ip, client.address, net.peer.ip, etc.) so they are key-redacted.
scrubValue() added to pii-scrub-processor.ts applies IPV4_REGEX / IPV6_REGEX
replacement for attribute values whose keys are not PII-keyed, and for log
record bodies that pass the substring check. Closes the gap left by deletion
of the old beforeSend value-level IP scrubbers. 5 new tests added.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 12:39:22 +02:00
4ea9a5c38e fix(otel): consolidate to single OTel SDK init at instrumentation.register hook
All three apps' instrumentation.ts files now call initOtelServerNode directly
instead of initSentryServer/initSentryServerNode, closing the startup window
where @sentry/nextjs auto-instrumentation could send unscrubbed errors before
bindAll() fires. bindOtelInstrumentation no longer calls initOtelServerNode
(SDK init belongs at app boot, binding at request scope). Orphaned sentry/
init-server*.ts files deleted; their package.json subpath exports removed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 12:38:17 +02:00
05524dfcea chore(web-next): remove legacy Sentry scrubber test (covered by OTel processor tests)
The sentry-pii-scrubber.test.ts file tested the now-deleted sentry/scrub.ts
module. PII scrubbing is now validated in core-shared/otel/pii-scrub-processor.test.ts
at the correct layer.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 12:22:42 +02:00
e43e03cdee docs: refresh architecture references for OTel migration 2026-05-11 12:18:44 +02:00
81f2477537 docs(adr): ADR-017 OpenTelemetry migration 2026-05-11 12:15:01 +02:00
8bedb649ca refactor(core-testing): no-sentry → no-instrumentation (mocks OTel too) 2026-05-11 12:14:18 +02:00
bd95315a44 refactor(core-eslint): finalize OTel + Sentry import allowlist (R40 + R52) 2026-05-11 12:12:57 +02:00
301e0ff3f8 refactor(core-shared): delete Sentry scrub + orphaned server-init files (replaced by OTel processors) 2026-05-11 12:12:12 +02:00
ad609f8f01 feat(core-shared): wire PII scrub processors FIRST in OTel pipeline 2026-05-11 12:09:11 +02:00
6ec5aeb31f feat(core-shared): PII scrub processors for spans + log records 2026-05-11 12:08:20 +02:00
cdfca850ac feat(core-shared): enable OTel auto-instrumentations (http + undici + pg) 2026-05-11 12:06:00 +02:00
be8103619e feat(core-shared): add OTel auto-instrumentation deps (http + undici + pg) 2026-05-11 12:05:41 +02:00
d5f0f51b75 feat(core-shared): MetricsProtocol + BindContext.metrics? field 2026-05-11 12:02:06 +02:00
0850711986 feat(core-shared): wire IMetrics into DI bindings 2026-05-11 12:01:01 +02:00
f2627890be feat(core-testing): RecordingMetrics test double 2026-05-11 11:59:46 +02:00
9835752c21 feat(core-shared): OtelMetrics impl using @opentelemetry/api metrics 2026-05-11 11:59:04 +02:00
e11fd7c897 feat(core-shared): IMetrics interface + NoopMetrics impl 2026-05-11 11:57:56 +02:00
2cf1c00f93 feat(core-shared): add @opentelemetry/sdk-metrics dep 2026-05-11 11:57:31 +02:00
5c9cba318a refactor(core-shared): delete SentryLogger (replaced by OtelLogger)
Some checks failed
CI / typecheck + lint + boundaries + test + build (push) Has been cancelled
CI / Playwright e2e (push) Has been cancelled
CI / Storybook smoke tests (push) Has been cancelled
Sentry PII guard (R31) / pii-guard (push) Has been cancelled
Removes sentry-logger.ts and its test now that OtelLogger is the active
ILogger impl in bind-otel-instrumentation.ts. Updates the binder test to
assert OtelLogger (not SentryLogger) is bound. Fixes TypeScript errors:
SentryLogRecordForwarder registers directly as LogRecordProcessor (not
wrapped in BatchLogRecordProcessor which expects a LogRecordExporter);
severityNumber undefined guard added.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 11:54:54 +02:00
ad64009e86 feat(core-shared): SentryLogRecordForwarder + wire OtelLogger in OTel pipeline
Adds SentryLogRecordForwarder (LogRecordProcessor impl) to sentry-bridge.ts
that forwards OTel log records to Sentry via captureException/captureMessage.
Wires it as a BatchLogRecordProcessor in init-server-node.ts. Replaces
SentryLogger with OtelLogger in bind-otel-instrumentation.ts. 7 new bridge
tests pass alongside the existing 25 tests.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 11:53:23 +02:00
5e795fd7ab feat(core-shared): OtelLogger impl using @opentelemetry/api-logs
Implements ILogger via OTel Logs API. captureException emits an ERROR
log record with exception.* semantic conventions and double-report guard;
captureMessage maps ILogger levels to OTel SeverityNumber; addBreadcrumb
attaches span events; setUser sets user.id span attribute. 15 tests pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 11:49:22 +02:00
3f40ca773b feat(core-shared): add @opentelemetry/api-logs + sdk-logs deps
Adds @opentelemetry/api-logs ^0.55.0 and @opentelemetry/sdk-logs ^0.55.0
to core-shared dependencies in preparation for OtelLogger (Phase 3).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 11:48:23 +02:00
4b390e028d refactor(core-shared): delete SentryTracer (replaced by OtelTracer)
sentry/sentry-tracer.ts and its test removed. OtelTracer is now the active
ITracer implementation. Spans flow to Sentry via @sentry/opentelemetry's
SentrySpanProcessor wired in bindOtelInstrumentation → initOtelServerNode.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 11:43:26 +02:00
149f91255c refactor(apps): call sites use bindOtelInstrumentation by name
apps/web-next/bind-production.ts imports bindOtelInstrumentation instead
of bindSentryInstrumentation. Test mock tracks both names via the same
spy so existing assertions on bindSentryInstrumentation still pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 11:43:03 +02:00
53bfe727b4 refactor(core-shared): rename bindSentryInstrumentation → bindOtelInstrumentation
git mv bind-sentry-instrumentation → bind-otel-instrumentation; function
renamed; new impl calls initOtelServerNode and binds OtelTracer (SentryLogger
kept for Phase 3). Barrel re-exports both new name and deprecated alias
bindSentryInstrumentation for one release. ESLint allowlist updated to the
new filename. init-server-node opts gains release? field.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 11:42:07 +02:00
b61e9d2091 feat(core-shared): OtelTracer impl using @opentelemetry/api
Implements OtelTracer as ITracer replacement for SentryTracer. Uses
@opentelemetry/api's trace.getTracer + startActiveSpan, maps span.op to
a span attribute, catches exceptions via recordException + setStatus(ERROR),
and filters null attribute values. Five Vitest tests covering name/attributes,
nesting, exception recording, status mapping, and null filtering.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 11:40:43 +02:00
4c628022ce fix(core-shared): align OTel type imports to sdk-node re-exports to resolve version conflict 2026-05-11 11:28:07 +02:00
f94f09a9fa feat(core-shared): OTel barrel + ESLint allowlist for SDK packages 2026-05-11 11:25:29 +02:00
e85b8b12cf feat(core-shared): OTel NodeSDK init helper with Sentry exporter wiring 2026-05-11 11:24:55 +02:00
3a32838c71 feat(core-shared): Sentry-as-OTel-exporter bridge module 2026-05-11 11:23:49 +02:00
12aeb8bf37 feat(core-shared): OTel resource builder 2026-05-11 11:23:19 +02:00
80e765c074 feat(core-shared): add OpenTelemetry SDK dependencies 2026-05-11 11:22:09 +02:00
76870816d1 docs(plan): OpenTelemetry migration (5 phases, ~30 tasks, ~25 commits)
Implementation plan for the spec at docs/superpowers/specs/2026-05-11-
opentelemetry-migration-design.md. Five phases:

- Phase 1: OTel SDK infrastructure (resource builder + Sentry-as-exporter
  bridge + NodeSDK init helper + ESLint allowlist for OTel SDK packages).
  No behavior swap yet.
- Phase 2 (TDD): OtelTracer impl using @opentelemetry/api; bind-sentry-
  instrumentation renamed to bind-otel-instrumentation with deprecation
  alias; delete SentryTracer.
- Phase 3 (TDD): OtelLogger impl using @opentelemetry/api-logs;
  LogRecordProcessor wired into init helper; delete SentryLogger.
  Breadcrumbs become span events; setUser sets user.id span attribute.
- Phase 4 (TDD): New IMetrics interface + Noop/Otel/Recording impls;
  MetricsProtocol added to bind-protocols; BindContext.metrics? optional
  field. Sentry metrics exporter deferred (experimental).
- Phase 5 (TDD): HTTP/undici/pg auto-instrumentations; PII scrub
  processors (PiiScrubSpanProcessor + PiiScrubLogRecordProcessor) run
  FIRST in OTel pipeline; delete sentry/scrub.ts + orphaned init files;
  core-testing/setup/no-sentry.ts → no-instrumentation.ts (mocks both
  Sentry and OTel SDK); ADR-017 + ADR-014 status header; doc refreshes.

Total: ~30 tasks across 6 phases (including Phase 0 read-first), ~25
expected commits.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-11 11:15:33 +02:00
cb0e33b0e8 docs(spec): OpenTelemetry migration design
Five-phase migration of server-side instrumentation from Sentry-direct
SDK calls to OpenTelemetry SDK with @sentry/opentelemetry as the (initial)
exporter. Vendor neutrality: swap vendors = swap exporters, never rewrite
tracer/logger/metrics impls.

Phase 1: OTel SDK infrastructure (no behavior swap).
Phase 2: OtelTracer replaces SentryTracer (uses @opentelemetry/api).
Phase 3: OtelLogger replaces SentryLogger (pure OTel Logs API via
  @opentelemetry/api-logs; breadcrumbs become span events; user.id as
  span attribute).
Phase 4: New IMetrics interface + Noop/Otel/Recording impls; added to
  BindContext as metrics? with corresponding MetricsProtocol in
  core-shared/di/bind-protocols.ts.
Phase 5: HTTP/undici/pg auto-instrumentations; PII scrubbing migrates
  from Sentry beforeSend hooks to OTel SpanProcessor/LogRecordProcessor;
  delete remaining Sentry-direct files; ADR-017 supersedes ADR-014's
  impl section while keeping R31-R51 interface decisions authoritative.

Server-only scope. Browser keeps Sentry SDK directly (replay + native
error UX); future spec extends to browser when OTel-Browser matures.

Companion ADR will be assigned at implementation time (expected ADR-017).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-11 11:04:37 +02:00
7f90f1f1c0 Merge branch 'worktree-core-ui-component-generator': core-ui component generator 2026-05-11 09:42:30 +02:00
4977617c94 fix(generators): mention core-ui-component generator in core-ui template AGENTS.md
The template's AGENTS.md.hbs describes the 4-file component pattern under
`## Structure` but didn't tell agents how to scaffold one. After Phase 4
shipped the generator, an agent reading core-ui's AGENTS.md still wouldn't
discover `pnpm turbo gen core-ui-component` and would build files manually.

Added a one-line note immediately under the Structure heading pointing at
the generator. Snapshot hash for AGENTS.md updated to match.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-11 09:41:39 +02:00
ef5ec1c1ca docs(agents): Key Commands entry for core-ui-component generator 2026-05-11 09:22:06 +02:00
a8454c9b5f docs(claude): Quick Start entry for core-ui-component generator 2026-05-11 09:22:00 +02:00
5f9a43441f docs(scaffolding): core-ui component generator reference 2026-05-11 09:21:52 +02:00