Files
insights/bin/send-dev-metrics.sh
zeekay 19fdf55ceb feat(auth): one key scheme, minted and read in one place
A key now opens with what it is allowed to touch. `pk-` is publishable and
safe in a browser; `sk-` is secret and never leaves a server. The five marks
it replaces all began `ph` -- the upstream's initials -- and they were the
last of its brand a customer read back to us, in every SDK snippet. No word
rule could reach them, because `ph` is not a word.

The marks were also not telling the truth. The constant said `phc_` while
every live project token said `hi_`, so the middleware that routes on the
constant matched no real token at all. Two spellings existed and one was
fiction. Minting now happens in exactly one function and reading in exactly
one, so a second spelling has nowhere to live.

`phx_` (personal) and `phs_` (project secret) both become `sk-`. The mark
now says only that a value is secret; which store holds it is settled by
asking. That was already how personal keys worked -- keys minted before the
marks carry none, so the store always decided -- and both secret resolvers
already returned None on a miss and fell through, so one shared extractor
replaces the two that could drift apart.

OAuth's access and refresh tokens stay distinguishable as `at-` and `rt-`,
because the parser tells them apart before either is looked up, and the
domain-verification token becomes `vt-` rather than keeping a sixth mint of
its own.

`bin/debrand --check` now refuses the marks as a shape, so a seventh cannot
be coined. Two rules that were about to rename things that are not ours to
spell are bounded: `Lemon` no longer eats `LemonSqueezy`, and the `hog_flow`
rules no longer reach a Postgres table, a Datastore table or a route.

Keys are stored hashed, so a mark cannot be rewritten in place: the three
live project tokens have to be reminted.
2026-08-08 19:42:44 -07:00

162 lines
5.1 KiB
Bash
Executable File

#!/usr/bin/env bash
# Smoke-test the metrics ingest chain by POSTing a synthetic OTLP payload to
# capture-logs. Same shape as nodejs/src/logs-ingestion/sampling-seed-services-curl.sh.
#
# Usage:
# # Local dev (default — same path logs scripts use):
# TOKEN=pk-yourtoken bin/send-dev-metrics.sh
# TOKEN=pk-yourtoken bin/send-dev-metrics.sh loop # send every 5s
#
# # Cloud dev via kubectl port-forward (capture-logs Service inside the cluster):
# aws login
# kubectl port-forward -n insights svc/capture-logs 4320:4318
# ENDPOINT=http://localhost:4320/v1/metrics TOKEN=pk-yourtoken bin/send-dev-metrics.sh
#
# # Prod (once the public ingress is live):
# ENDPOINT=https://us.i.hanzo.ai/i/v1/metrics TOKEN=pk-yourtoken bin/send-dev-metrics.sh
# ENDPOINT=https://eu.i.hanzo.ai/i/v1/metrics TOKEN=pk-yourtoken bin/send-dev-metrics.sh
set -euo pipefail
# Default to the same local-OTel-collector endpoint the logs seed scripts use.
# `otel-collector-config.dev.yaml` routes /v1/metrics to capture-logs:4320 internally.
ENDPOINT="${ENDPOINT:-http://localhost:4318/v1/metrics}"
TOKEN="${TOKEN:-}"
if [ -z "$TOKEN" ]; then
echo "Set TOKEN=pk-... (project API token — for local dev, any pk-... from your local project works)" >&2
exit 1
fi
TRACE_ID="${TRACE_ID:-$(openssl rand -hex 16)}"
SPAN_ID="${SPAN_ID:-$(openssl rand -hex 8)}"
SUFFIX="${METRIC_SUFFIX:-$(date +%s)}"
send_one() {
local now_ns=$(($(date +%s) * 1000000000))
local body
body=$(cat <<EOF
{
"resourceMetrics": [{
"resource": {"attributes": [
{"key":"service.name","value":{"stringValue":"e2e-dev-test"}},
{"key":"deployment.environment","value":{"stringValue":"dev"}}
]},
"scopeMetrics": [{
"scope": {"name":"send-dev-metrics-sh","version":"v1"},
"metrics": [
{
"name": "e2e_dev_test_counter",
"unit": "1",
"sum": {
"aggregationTemporality": 2,
"isMonotonic": true,
"dataPoints": [{
"timeUnixNano": "${now_ns}",
"asDouble": 42.0,
"attributes": [{"key":"endpoint","value":{"stringValue":"/api/test"}}],
"exemplars": [{
"timeUnixNano": "${now_ns}",
"asDouble": 42.0,
"traceId": "${TRACE_ID}",
"spanId": "${SPAN_ID}"
}]
}]
}
},
{
"name": "e2e_dev_test_gauge",
"unit": "By",
"gauge": {
"dataPoints": [{
"timeUnixNano": "${now_ns}",
"asDouble": $((RANDOM % 1000)),
"attributes": [{"key":"host","value":{"stringValue":"host-1"}}]
}]
}
},
{
"name": "e2e_dev_test_histogram",
"unit": "ms",
"histogram": {
"aggregationTemporality": 2,
"dataPoints": [{
"timeUnixNano": "${now_ns}",
"count": 100,
"sum": 12345.67,
"bucketCounts": [10, 30, 40, 15, 5],
"explicitBounds": [10, 50, 100, 500],
"attributes": [{"key":"route","value":{"stringValue":"/api/x"}}],
"exemplars": [{
"timeUnixNano": "${now_ns}",
"asDouble": 42.0,
"traceId": "${TRACE_ID}",
"spanId": "${SPAN_ID}"
}]
}]
}
}
]
}]
}]
}
EOF
)
printf "→ POST %s ... " "$ENDPOINT"
local http
http=$(curl -sS -o /tmp/send-dev-metrics.out -w "%{http_code}" \
-X POST "$ENDPOINT" \
-H "Authorization: Bearer ${TOKEN}" \
-H "Content-Type: application/json" \
--data-binary "$body")
printf "%s\n" "$http"
if [ "$http" = "302" ]; then
echo " ⚠️ 302 — endpoint is behind an auth proxy (e.g. cloud dev's Cognito ALB). Use a port-forward or local endpoint instead. See script header." >&2
return 1
fi
if [ "$http" = "000" ] || [ "$http" = "" ]; then
echo " ⚠️ Could not reach $ENDPOINT — is your local OTel collector / capture-logs running? (\`insightscli start\`)" >&2
return 1
fi
if [ "$http" != "200" ] && [ "$http" != "202" ]; then
echo " Response body:" >&2
cat /tmp/send-dev-metrics.out >&2
echo >&2
return 1
fi
return 0
}
case "${1:-once}" in
once)
send_one
echo
echo "trace_id: ${TRACE_ID}"
echo "span_id: ${SPAN_ID}"
echo
echo "Verify in the dev Insights SQL editor:"
echo
cat <<SQL
SELECT metric_name, value, service_name, metric_type,
trace_id, hex(tryBase64Decode(trace_id)) AS trace_id_hex,
span_id, timestamp
FROM insights.metrics
WHERE metric_name LIKE 'e2e_dev_test_%'
AND timestamp >= now() - INTERVAL 5 MINUTE
ORDER BY timestamp DESC
LIMIT 10
FORMAT Vertical
SQL
;;
loop)
echo "Sending every 5s (Ctrl-C to stop)..."
while true; do
send_one || true
sleep 5
done
;;
*)
echo "Usage: TOKEN=pk-... $0 [once|loop]" >&2
exit 2
;;
esac