fix(monitoring): add sentry monitoring

package.json

@@ -41,6 +41,8 @@
     "@fastify/cors": "^9.0.1",
     "@fastify/swagger": "^8.2.1",
     "@fastify/type-provider-typebox": "^3.5.0",
+    "@sentry/node": "^9.12.0",
+    "@sentry/profiling-node": "^9.12.0",
     "@sinclair/typebox": "^0.31.25",
     "close-with-grace": "^2.1.0",
     "crypto-js": "^4.0.0",

src/lib/PostgresMeta.ts

@@ -22,7 +22,7 @@ import { init } from './db.js'
 import { PostgresMetaResult, PoolConfig } from './types.js'
 
 export default class PostgresMeta {
-  query: (sql: string) => Promise<PostgresMetaResult<any>>
+  query: (sql: string, trackQueryInSentry?: boolean) => Promise<PostgresMetaResult<any>>
   end: () => Promise<void>
   columnPrivileges: PostgresMetaColumnPrivileges
   columns: PostgresMetaColumns

src/server/admin-app.ts

@@ -1,8 +1,11 @@
+import './sentry.js'
+import * as Sentry from '@sentry/node'
 import { fastify, FastifyInstance, FastifyServerOptions } from 'fastify'
 import fastifyMetrics from 'fastify-metrics'
 
 export function build(opts: FastifyServerOptions = {}): FastifyInstance {
   const app = fastify(opts)
+  Sentry.setupFastifyErrorHandler(app)
   app.register(fastifyMetrics.default, {
     endpoint: '/metrics',
     routeMetrics: { enabled: false },

src/server/app.ts

@@ -1,3 +1,5 @@
+import './sentry.js'
+import * as Sentry from '@sentry/node'
 import cors from '@fastify/cors'
 import swagger from '@fastify/swagger'
 import { fastify, FastifyInstance, FastifyServerOptions } from 'fastify'
@@ -9,6 +11,7 @@ import pkg from '#package.json' with { type: 'json' }
 
 export const build = (opts: FastifyServerOptions = {}): FastifyInstance => {
   const app = fastify({ disableRequestLogging: true, requestIdHeader: PG_META_REQ_HEADER, ...opts })
+  Sentry.setupFastifyErrorHandler(app)
 
   app.setErrorHandler((error, request, reply) => {
     app.log.error({ error: error.toString(), request: extractRequestForLogging(request) })

src/server/routes/query.ts

@@ -21,7 +21,7 @@ export default async (fastify: FastifyInstance) => {
     const connectionString = request.headers.pg
 
     const pgMeta = new PostgresMeta({ ...DEFAULT_POOL_CONFIG, connectionString })
-    const { data, error } = await pgMeta.query(request.body.query)
+    const { data, error } = await pgMeta.query(request.body.query, false)
     await pgMeta.end()
     if (error) {
       request.log.error({ error, request: extractRequestForLogging(request) })

src/server/sentry.ts

@@ -0,0 +1,50 @@
+import * as Sentry from '@sentry/node'
+import { nodeProfilingIntegration } from '@sentry/profiling-node'
+
+const sentryEnvironment = process.env.ENVIRONMENT ?? 'local'
+const dsn = process.env.SENTRY_DSN ?? ''
+
+const captureOptions: Sentry.NodeOptions =
+  sentryEnvironment === 'prod'
+    ? {
+        // Tracing
+        tracesSampleRate: 0.00001, // trace 1/10k events
+        // Set sampling rate for profiling - this is evaluated only once per SDK.init call
+        profilesSampleRate: 0.00001, // profile 1/10k events
+      }
+    : {
+        tracesSampleRate: 0.01, // trace 1% of the events
+        profilesSampleRate: 0.01,
+      }
+
+const sensitiveKeys = ['pg', 'x-connection-encrypted']
+
+function redactSensitiveData(data: any) {
+  if (data && typeof data === 'object') {
+    for (const key of sensitiveKeys) {
+      if (key in data) {
+        data[key] = '[REDACTED]'
+      }
+    }
+  }
+}
+
+export default Sentry.init({
+  enabled: Boolean(dsn),
+  dsn: dsn,
+  environment: sentryEnvironment,
+  integrations: [nodeProfilingIntegration()],
+  beforeSendTransaction(transaction) {
+    if (transaction.contexts?.trace?.data) {
+      redactSensitiveData(transaction.contexts.trace.data)
+    }
+    return transaction
+  },
+  beforeSendSpan(span) {
+    if (span.data) {
+      redactSensitiveData(span.data)
+    }
+    return span
+  },
+  ...captureOptions,
+})