This bumps the `opentelemetry` crates to 0.33,
`opentelemetry-resource-detectors` to 0.13, `tracing-opentelemetry` to
0.34, and `sentry`, `sentry-tower` and `sentry-tracing` to 0.49. The
process and Tokio instrumentation crates move to 0.3 and the Prometheus
text exporter to 0.4, their releases for OpenTelemetry 0.33. Everything
stays on reqwest 0.13, so the shared `mas_http::reqwest_client()` can
still be handed to both the OTLP exporters and the Sentry transport.
`sentry::ClientOptions` is now non-exhaustive, so it is built with its
setters instead of a struct literal. The
`experimental_metrics_custom_reader` feature of `opentelemetry_sdk` is
now enabled explicitly, as we use `ManualReader` directly instead of
relying on the Prometheus exporter enabling it.
The OTLP exporters now retry failed exports by default (up to 3 retries
with exponential backoff, on HTTP 429, 502, 503 and 504). When the
configuration sets no endpoint, an invalid `OTEL_EXPORTER_OTLP_ENDPOINT`
or `OTEL_EXPORTER_OTLP_{TRACES,METRICS}_ENDPOINT` environment variable
now fails startup instead of falling back to `localhost`.
The `opentelemetry-jaeger-propagator` crate was removed upstream after
0.32 (open-telemetry/opentelemetry-rust#3710), but Synapse propagates
traces with the Jaeger `uber-trace-id` header, so MAS needs to keep
supporting it.
The in-tree propagator only handles that header, including the
URL-encoded form jaeger-client-python sends and the debug flag set by
Synapse's forced tracing. Baggage (`uberctx-*` headers) is not
propagated. A missing or malformed header is ignored without logging,
so the filter for the upstream crate's "invalid header" warning goes
away too.
The new `unused_async_trait_impl` lint flags `async fn` trait impls without any `.await`. The `FromRequestParts` impls that only read from the request parts now return `std::future::ready(...)` directly. The GraphQL module gets a module-wide allow: async-graphql's `#[Object]` refuses non-async resolvers and its `Enum` derive emits async trait impls of its own.
Also drop the `?` on two `return Err(...)?` statements in the introspection handler, flagged by `needless_return_with_question_mark`.
The interactive playground page and its route/config option are gone; the GraphQL API itself (POST /graphql) is unaffected. External GraphQL usage is deprecated anyway in favour of the REST admin API.
Fixes#5572Fixes#2424
This makes it so that MAS binds on a temporary path on startup, sets
permissions and then moves it to the configured path. This means that we don't
error out anymore if there is a stale socket file, and that it is safe to
rollout a new process without killing the old one first, without breaking
connections.
MSC2965 changed the discovery mechanism to stop relying on .well-known
documents a while back. We removed references to this in the configuration
manual some time ago (see e3d1b8abfa) but
`mas-cli doctor` was still checking for it.
See element-hq/backend-internal#5 as well
We need to group the sentry and opentelemetry bumps together because they both
upgraded reqwest to 0.13.
- reqwest 0.12 -> 0.13: rename the rustls feature to rustls-no-provider,
add the now-opt-in 'form' feature.
- sentry 0.46 -> 0.48: add rustls-no-provider so Sentry's reqwest 0.13
transport reuses our process-wide aws-lc-rs provider.
- opentelemetry 0.31 -> 0.32 / tracing-opentelemetry 0.33: update the
get_otel_context call in mas-context for the new signature.
opentelemetry-jaeger-propagator 0.32 is deprecated upstream but still
published; we keep it for now (with an expect(deprecated)) and will
vendor it in-tree once it's actually removed.
Read the `GraphQlOperation` set by the GraphQL handler from the response
extensions in the logging middleware, and record the operation type and name
on the `http.server.response` log line when present.
Rust 1.96.0 enables several new clippy lints. Apply the machine-applicable
fixes (`duration_suboptimal_units`, `map_unwrap_or`, `manual_is_variant_and`,
`unnecessary_trailing_comma`, `while_let_loop`) and suppress the
`result_large_err` lint in the config test modules, where the closures passed to
`Jail::expect_with` are required to return the large `figment::Error`.
When syncing config to the database, a `forward_login_hint: true`
flag now injects a `login_hint: "{{ params.login_hint }}"` entry
into `additional_authorization_parameters` (unless one is already
present) and logs a deprecation warning. Operators can migrate by
removing the flag and adding the template entry themselves; until then
the existing behavior is preserved.
Revert changes from
https://github.com/element-hq/matrix-authentication-service/pull/5221. I
assume it was done that way as the "session_limit_config" doesn't change
after the server is created. But this makes downstream usage complicated as
you whenever you create `SiteConfig`, you also have to make sure to configure
whatever else is necessary.
Easier to just pass in `session_limit_config` as necessary whenever
we evaluate the policy
Quentin Gliech