Trace managed relay connection bootstrap

juliusmarminge · codex · juliusmarminge · commit 03c78ccfa746 · 2026-06-07T20:57:48.000-07:00
Co-authored-by: codex &lt;codex@users.noreply.github.com&gt;
diff --git a/apps/server/src/cli/cloud.ts b/apps/server/src/cli/cloud.ts
@@ -30,7 +30,7 @@ import * as CliState from "../cloud/CliState.ts";
 import * as CliTokenManager from "../cloud/CliTokenManager.ts";
 import { CLOUD_LINKED_USER_ID, RELAY_URL_SECRET } from "../cloud/config.ts";
 import { relayUrlConfig } from "../cloud/publicConfig.ts";
-import { serverRelayClientTracingLayer } from "../cloud/relayTracing.ts";
+import { headlessRelayClientTracingLayer } from "../cloud/relayTracing.ts";
 import { ServerConfig } from "../config.ts";
 import { ServerEnvironmentLive } from "../environment/Layers/ServerEnvironment.ts";
 import { ServerEnvironment } from "../environment/Services/ServerEnvironment.ts";
@@ -302,7 +302,7 @@ const runCloudCommand = <A, E>(
       RelayClient.layerCloudflared({ baseDir: config.baseDir }),
       EnvironmentAuth.runtimeLayer,
       ServerEnvironmentLive,
-      serverRelayClientTracingLayer,
+      headlessRelayClientTracingLayer,
     ).pipe(
       Layer.provideMerge(FetchHttpClient.layer),
       Layer.provideMerge(Layer.succeed(ServerConfig, config)),
diff --git a/apps/server/src/cloud/http.test.ts b/apps/server/src/cloud/http.test.ts
@@ -3,13 +3,19 @@ import { describe, expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as PlatformError from "effect/PlatformError";
-import { HttpClient } from "effect/unstable/http";
+import * as Tracer from "effect/Tracer";
+import { HttpClient, HttpServerRequest } from "effect/unstable/http";
 
+import { RelayClientTracer } from "@t3tools/shared/relayTracing";
 import * as EnvironmentAuth from "../auth/EnvironmentAuth.ts";
 import * as ServerSecretStore from "../auth/ServerSecretStore.ts";
 import { ServerEnvironment } from "../environment/Services/ServerEnvironment.ts";
 import * as CliTokenManager from "./CliTokenManager.ts";
-import { consumeCloudReplayGuards, reconcileDesiredCloudLink } from "./http.ts";
+import {
+  consumeCloudReplayGuards,
+  reconcileDesiredCloudLink,
+  traceRelayBrokerHandler,
+} from "./http.ts";
 import {
   CloudManagedEndpointRuntime,
   type CloudManagedEndpointRuntimeShape,
@@ -69,6 +75,38 @@ describe("consumeCloudReplayGuards", () => {
   );
 });
 
+describe("traceRelayBrokerHandler", () => {
+  it.effect("continues the incoming relay trace with the product tracer", () =>
+    Effect.gen(function* () {
+      const spans: Array<Tracer.Span> = [];
+      const productTracer = Tracer.make({
+        span: (options) => {
+          const span = new Tracer.NativeSpan(options);
+          spans.push(span);
+          return span;
+        },
+      });
+      const request = HttpServerRequest.fromWeb(
+        new Request("https://environment.example.test/api/t3-cloud/mint-credential", {
+          headers: {
+            traceparent: "00-0123456789abcdef0123456789abcdef-0123456789abcdef-01",
+          },
+        }),
+      );
+
+      yield* traceRelayBrokerHandler(Effect.void.pipe(Effect.withSpan("relay.mint.handler"))).pipe(
+        Effect.provideService(HttpServerRequest.HttpServerRequest, request),
+        Effect.provideService(RelayClientTracer, Option.some(productTracer)),
+      );
+
+      expect(spans).toHaveLength(1);
+      const span = spans[0]!;
+      expect(span.traceId).toBe("0123456789abcdef0123456789abcdef");
+      expect(Option.getOrUndefined(span.parent)?.spanId).toBe("0123456789abcdef");
+    }),
+  );
+});
+
 describe("reconcileDesiredCloudLink", () => {
   it.effect("requires stored CLI authorization without exposing an HTTP endpoint", () =>
     Effect.gen(function* () {
diff --git a/apps/server/src/cloud/http.ts b/apps/server/src/cloud/http.ts
@@ -48,7 +48,7 @@ import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
 import * as HttpEffect from "effect/unstable/http/HttpEffect";
-import { HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
+import { HttpServerRequest, HttpServerResponse, HttpTraceContext } from "effect/unstable/http";
 import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
 import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
 
@@ -111,6 +111,19 @@ const requireRelayUrl = relayUrlConfig.pipe(
   ),
 );
 
+export const traceRelayBrokerHandler = <A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+): Effect.Effect<A, E, R | HttpServerRequest.HttpServerRequest> =>
+  HttpServerRequest.HttpServerRequest.pipe(
+    Effect.flatMap((request) =>
+      Option.match(HttpTraceContext.fromHeaders(request.headers), {
+        onNone: () => effect,
+        onSome: (parent) => effect.pipe(Effect.withParentSpan(parent)),
+      }),
+    ),
+    withRelayClientTracing,
+  );
+
 function bytesToString(bytes: Uint8Array): string {
   return new TextDecoder().decode(bytes);
 }
@@ -940,7 +953,7 @@ export const cloudHttpApiLayer = HttpApiBuilder.group(
       .handle("health", ({ payload }) => cloudEnvironmentHealthHandler(dependencies, payload))
       .handle("mintCredential", ({ payload }) => cloudMintCredentialHandler(dependencies, payload))
       .handle("t3MintCredential", ({ payload }) =>
-        cloudMintCredentialHandler(dependencies, payload),
+        traceRelayBrokerHandler(cloudMintCredentialHandler(dependencies, payload)),
       );
   }),
 );
diff --git a/apps/server/src/cloud/relayTracing.ts b/apps/server/src/cloud/relayTracing.ts
@@ -2,11 +2,20 @@ import { makeRelayClientTracingLayer } from "@t3tools/shared/relayTracing";
 
 import { resolveRelayClientTracingConfig } from "./publicConfig.ts";
 
-export const serverRelayClientTracingLayer = makeRelayClientTracingLayer(
-  resolveRelayClientTracingConfig(),
+const relayClientTracingConfig = resolveRelayClientTracingConfig();
+
+export const headlessRelayClientTracingLayer = makeRelayClientTracingLayer(
+  relayClientTracingConfig,
   {
     serviceName: "t3-headless-relay-client",
     runtime: "node",
     client: "headless-cli",
   },
 );
+
+export const serverRelayBrokerTracingLayer = makeRelayClientTracingLayer(relayClientTracingConfig, {
+  serviceName: "t3-server",
+  runtime: "node",
+  client: "environment-server",
+  component: "relay-broker",
+});
diff --git a/apps/server/src/server.ts b/apps/server/src/server.ts
@@ -70,7 +70,7 @@ import { authHttpApiLayer, environmentAuthenticatedAuthLayer } from "./auth/http
 import * as ServerSecretStore from "./auth/ServerSecretStore.ts";
 import * as EnvironmentAuth from "./auth/EnvironmentAuth.ts";
 import { cloudHttpApiLayer, reconcileDesiredCloudLink } from "./cloud/http.ts";
-import { serverRelayClientTracingLayer } from "./cloud/relayTracing.ts";
+import { serverRelayBrokerTracingLayer } from "./cloud/relayTracing.ts";
 import * as CloudManagedEndpointRuntime from "./cloud/ManagedEndpointRuntime.ts";
 import * as CloudCliTokenManager from "./cloud/CliTokenManager.ts";
 import * as CloudCliState from "./cloud/CliState.ts";
@@ -453,7 +453,7 @@ export const makeServerLayer = Layer.unwrap(
 
     return serverApplicationLayer.pipe(
       Layer.provideMerge(RuntimeServicesLive),
-      Layer.provideMerge(serverRelayClientTracingLayer),
+      Layer.provideMerge(serverRelayBrokerTracingLayer),
       Layer.provideMerge(HttpServerLive),
       Layer.provide(ObservabilityLive),
       Layer.provideMerge(FetchHttpClient.layer),
diff --git a/apps/web/src/cloud/linkEnvironment.test.ts b/apps/web/src/cloud/linkEnvironment.test.ts
@@ -318,6 +318,14 @@ describe("web cloud link environment client", () => {
         method: "POST",
         url: "https://managed.example.test/oauth/token",
       });
+      const traceparents = fetchMock.mock.calls.map(
+        (call) => call[1]?.headers.traceparent as string | undefined,
+      );
+      expect(traceparents.every((traceparent) => typeof traceparent === "string")).toBe(true);
+      expect(new Set(traceparents.map((traceparent) => traceparent?.split("-")[1])).size).toBe(1);
+      expect(connection.relayTraceHeaders.traceparent?.split("-")[1]).toBe(
+        traceparents[0]?.split("-")[1],
+      );
     }),
   );
 
diff --git a/apps/web/src/cloud/linkEnvironment.ts b/apps/web/src/cloud/linkEnvironment.ts
@@ -1,7 +1,7 @@
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
-import { HttpClient } from "effect/unstable/http";
+import { HttpClient, HttpTraceContext, type Headers } from "effect/unstable/http";
 import {
   EnvironmentCloudEndpointUnavailableError,
   type EnvironmentCloudLinkStateResult,
@@ -29,6 +29,7 @@ import {
   ManagedRelayDpopSigner,
   type WsRpcClient,
 } from "@t3tools/client-runtime";
+import { withRelayClientTracing } from "@t3tools/shared/relayTracing";
 
 import { ensureLocalApi } from "../localApi";
 import {
@@ -245,6 +246,7 @@ export interface CloudManagedConnection {
   readonly wsBaseUrl: string;
   readonly relayUrl: string;
   readonly accessToken: string;
+  readonly relayTraceHeaders: Headers.Headers;
 }
 
 export function collectCloudLinkTargets(input: {
@@ -437,8 +439,15 @@ export function connectManagedCloudEnvironment(input: {
       wsBaseUrl: connected.endpoint.wsBaseUrl,
       relayUrl: configuredRelayUrl,
       accessToken: session.access_token,
+      relayTraceHeaders: HttpTraceContext.toHeaders(yield* Effect.currentSpan.pipe(Effect.orDie)),
     };
-  });
+  }).pipe(
+    Effect.withSpan("relay.environment.connect", {
+      root: true,
+      attributes: { "relay.environment_id": input.environment.environmentId },
+    }),
+    withRelayClientTracing,
+  );
 }
 
 export function readPrimaryCloudLinkState(): Effect.Effect<
diff --git a/apps/web/src/environments/runtime/service.addSavedEnvironment.test.ts b/apps/web/src/environments/runtime/service.addSavedEnvironment.test.ts
@@ -1,6 +1,7 @@
 import { EnvironmentAuthInvalidError, EnvironmentId } from "@t3tools/contracts";
 import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
+import { Headers } from "effect/unstable/http";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
 
 const decodeEnvironmentAuthInvalidError = Schema.decodeUnknownSync(EnvironmentAuthInvalidError);
@@ -383,6 +384,7 @@ describe("addSavedEnvironment", () => {
       wsBaseUrl: "wss://managed.example.com/",
       relayUrl: "https://relay.example.com",
       accessToken: "managed-access-token",
+      relayTraceHeaders: Headers.empty,
     });
 
     expect(mockWriteSavedEnvironmentCredential).toHaveBeenCalledWith(
@@ -440,6 +442,7 @@ describe("addSavedEnvironment", () => {
         wsBaseUrl: "wss://managed.example.com/",
         relayUrl: "https://relay.example.com",
         accessToken: "renewed-access-token",
+        relayTraceHeaders: Headers.empty,
       }),
     );
 
diff --git a/apps/web/src/environments/runtime/service.ts b/apps/web/src/environments/runtime/service.ts
diff --git a/packages/shared/src/relayTracing.ts b/packages/shared/src/relayTracing.ts
