feat(errors,tracing,audit,auth): structured error taxonomy, distributed tracing, encrypted audit logging, token rotation#684
Merged
temma02 merged 1 commit intoMay 28, 2026
Conversation
… distributed tracing, encrypted audit logging, and token rotation Closes StellerCraft#589 StellerCraft#590 StellerCraft#591 StellerCraft#592 - Extend packages/types/src/errors.ts with ErrorCode, ErrorCategory, ApiErrorResponse, and ERROR_CODE_META lookup table across validation/auth/external/internal categories - Add apps/backend/src/lib/api/error-handler.ts with AppError class and handleApiError() centralised handler mapping all thrown errors to typed NextResponse payloads - Document full error taxonomy with stable code enum in apps/backend/openapi.yaml Error schema - Add apps/backend/src/lib/tracing.ts with W3C traceparent utilities (startTrace, newSpan, withSpan, parseTraceparent) - Instrument GitHub-to-Vercel deployment pipeline with per-stage spans and traceId propagation through all log entries and result objects - Add docs/tracing-architecture.md documenting the tracing design - Add apps/backend/src/services/audit-log.service.ts with AES-256-GCM encrypted audit log payloads for sensitive config mutations (tokens, billing, domains) - Extend github-credential.service.ts with rotateIfExpiringSoon() (proactive rotation 1h before expiry with exponential-backoff retry), revokeToken() (GitHub OAuth token revocation), and rotation metadata storage Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
@ambermartin681 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #589
closes #590
closes #591
closes #592
Summary
packages/types/src/errors.tswith a completeErrorCodeunion,ErrorCategory,ApiErrorResponseshape, andERROR_CODE_METAlookup table (stable codes across validation/auth/external/internal categories). Addapps/backend/src/lib/api/error-handler.tswithAppError,handleApiError(),validationError(), andunauthorizedError()centralised helpers. Document full taxonomy inopenapi.yamlError schema with stability guarantee.apps/backend/src/lib/tracing.tswith W3C Trace Context utilities (startTrace,newSpan,withSpan,parseTraceparent). InstrumentGitHubToVercelDeploymentServicewith per-stage spans (validate-env,trigger-vercel,store-metadata) loggingtraceId,spanId, anddurationMs. Trace ID is propagated through all log entries and returned inTriggerDeploymentResult. Adddocs/tracing-architecture.md.apps/backend/src/services/audit-log.service.tswithAuditLogService.log()that encrypts before/after diff payloads at rest using AES-256-GCM (lib/crypto/field-encryption) for token, billing, and domain mutations.GitHubCredentialServicewithrotateIfExpiringSoon()(proactive rotation 1 h before expiry, exponential-backoff retry ×3, old token revoked on GitHub after success, rotation metadata stored),revokeToken(), and private_revokeGitHubToken().Test plan
handleApiErrorreturns the correct HTTP status andcodefor eachAppErrorvarianthandleApiErrorstartTrace()produces a valid W3C traceparent;newSpan()preserves the traceIdtraceIdanddurationMsAuditLogService.log()writes an encrypted row; decrypting recovers the original payloadrotateIfExpiringSoon()skips rotation when expiry is far away; triggers when within 1 h_revokeGitHubToken()is called with the old plaintext token after a successful rotation🤖 Generated with Claude Code