fix(auth): add public key to auth spans (#14011)

Add public key to auth span metadata

packages/shared/src/server/instrumentation/index.ts

@@ -195,6 +195,7 @@ export const addUserToSpan = (
     orgId?: string;
     plan?: string;
     apiKeyId?: string;
+    publicKey?: string;
   },
   span?: opentelemetry.Span,
 ) => {
@@ -245,6 +246,15 @@ export const addUserToSpan = (
     });
     activeSpan.setAttribute("langfuse.api_key.id", attributes.apiKeyId);
   }
+  if (attributes.publicKey) {
+    baggage = baggage.setEntry("langfuse.api_key.public_key", {
+      value: attributes.publicKey,
+    });
+    activeSpan.setAttribute(
+      "langfuse.api_key.public_key",
+      attributes.publicKey,
+    );
+  }
 
   return opentelemetry.propagation.setBaggage(ctx, baggage);
 };

web/src/__tests__/server/unit/api-auth-span.servertest.ts

@@ -127,7 +127,7 @@ describe("ApiAuthService span metadata", () => {
     vi.clearAllMocks();
   });
 
-  it("adds the api key id to the auth span for Basic auth", async () => {
+  it("adds api key metadata to the auth span for Basic auth", async () => {
     const { apiKey, orgId, projectId, publicKey, secretKey } =
       createProjectApiKey();
     const prisma = {
@@ -149,12 +149,13 @@ describe("ApiAuthService span metadata", () => {
         apiKeyId: apiKey.id,
         orgId,
         projectId,
+        publicKey,
       }),
       fakeAuthSpan,
     );
   });
 
-  it("adds the api key id to the auth span for Bearer auth", async () => {
+  it("adds api key metadata to the auth span for Bearer auth", async () => {
     const { apiKey, orgId, projectId, publicKey } = createProjectApiKey();
     const prisma = {
       apiKey: {
@@ -173,6 +174,7 @@ describe("ApiAuthService span metadata", () => {
         apiKeyId: apiKey.id,
         orgId,
         projectId,
+        publicKey,
       }),
       fakeAuthSpan,
     );

web/src/__tests__/server/unit/langfuse-context-propagation.servertest.ts

@@ -6,7 +6,7 @@ import {
 } from "@langfuse/shared/src/server";
 
 describe("Langfuse context propagation", () => {
-  it("adds api key id to span attributes and baggage", () => {
+  it("adds api key metadata to span attributes and baggage", () => {
     const span = {
       setAttribute: vi.fn(),
     } as unknown as Span;
@@ -18,6 +18,7 @@ describe("Langfuse context propagation", () => {
           orgId: "org-1",
           plan: "cloud:hobby",
           apiKeyId: "api-key-1",
+          publicKey: "pk-lf-1",
         },
         span,
       );
@@ -31,6 +32,15 @@ describe("Langfuse context propagation", () => {
           .getBaggage(ctx!)
           ?.getEntry("langfuse.api_key.id")?.value,
       ).toBe("api-key-1");
+      expect(span.setAttribute).toHaveBeenCalledWith(
+        "langfuse.api_key.public_key",
+        "pk-lf-1",
+      );
+      expect(
+        opentelemetry.propagation
+          .getBaggage(ctx!)
+          ?.getEntry("langfuse.api_key.public_key")?.value,
+      ).toBe("pk-lf-1");
     });
   });
 

web/src/features/public-api/server/apiAuth.ts

@@ -167,6 +167,7 @@ export class ApiAuthService {
                 orgId: finalApiKey.orgId,
                 plan,
                 apiKeyId: finalApiKey.id,
+                publicKey: finalApiKey.publicKey,
               },
               span,
             );
@@ -216,6 +217,7 @@ export class ApiAuthService {
                 orgId,
                 plan,
                 apiKeyId: dbKey.id,
+                publicKey: dbKey.publicKey,
               },
               span,
             );