Add db_queries / db_time / db_rows_fetched / db_rows_affected counters to
LogContext, mirroring Synapse's LoggingContext db_txn_count / db_txn_duration_sec.
They are exposed through LogContextStats and its Display, so they appear
automatically in the existing HTTP request-completion and job-completion log
lines.
Add a reference page describing the `http.server.response` log line and its
fields (method, status, requester, client address, GraphQL operation, request
id, trace id, …), aimed at administrators feeding the logs into a SIEM, with a
table of well-known operations and how to classify them (login, logout, token
issuance, …).
The ESS job was failing because the action's internal `azure/setup-helm` was
unpinned and had drifted to Helm v4 Fixed upstream by pinning Helm to 3.19.4
inside the action
We need to group the sentry and opentelemetry bumps together because they both
upgraded reqwest to 0.13.
- reqwest 0.12 -> 0.13: rename the rustls feature to rustls-no-provider,
add the now-opt-in 'form' feature.
- sentry 0.46 -> 0.48: add rustls-no-provider so Sentry's reqwest 0.13
transport reuses our process-wide aws-lc-rs provider.
- opentelemetry 0.31 -> 0.32 / tracing-opentelemetry 0.33: update the
get_otel_context call in mas-context for the new signature.
opentelemetry-jaeger-propagator 0.32 is deprecated upstream but still
published; we keep it for now (with an expect(deprecated)) and will
vendor it in-tree once it's actually removed.
Read the `GraphQlOperation` set by the GraphQL handler from the response
extensions in the logging middleware, and record the operation type and name
on the `http.server.response` log line when present.
Define a `GraphQlOperation` type holding the operation type and name, and
attach it to the GraphQL response via the response extensions, so the HTTP
logging middleware can pick it up. The operation type is resolved from the
parsed query document, which is cached on the request and reused by the
executor.
Record the requester for the admin API, GraphQL, the compat
login/logout/logout_all/refresh endpoints, and the OAuth2 token (the
authenticated client) and introspection (the introspecting client, or the
homeserver) endpoints. Introspection records the caller, never the subject
of the introspected token.
The request test helper now runs each request inside a `LogContext`, with
a helper to assert the recorded requester.
Add a `RecordAsRequester` trait mapping domain types (User, BrowserSession,
OAuth2 Session, CompatSession, Client) to a `Requester`, and record it from
the two shared auth-resolution points: `SessionInfo::load_active_session`
(browser sessions) and `AccessToken::fetch` (OAuth2 bearer tokens).
Add a `Requester` enum (a user, an OAuth2 client, or the homeserver) stored
in a set-once slot on the `LogContext`. This lets request handlers record
which entity authenticated a request so it can be logged later.
Quentin Gliech