chore(webapp): remove temporary session authorization telemetry

Remove temporary session authorization telemetry without changing
permission checks or API responses.

Mono-RevId: b8095b2df4071a598d68cdf4251f600b8ea1058c

Author: carderne

apps/webapp/app/routes/api.v1.sessions.ts

@@ -32,10 +32,7 @@ import {
   createLoaderApiRoute,
   everyResource,
 } from "~/services/routeBuilders/apiBuilder.server";
-import {
-  recordSessionCreateAuthorization,
-  sessionCreateAuthorizationOutcome,
-} from "~/services/sessionAuthorizationTelemetry.server";
+import { sessionCreateAuthorizationOutcome } from "~/services/sessionAuthorizationTelemetry.server";
 import { ServiceValidationError } from "~/v3/services/common.server";
 import { runStore } from "~/v3/runStore.server";
 
@@ -163,7 +160,7 @@ const { action } = createActionApiRoute(
     },
     corsStrategy: "all",
   },
-  async ({ authentication, body, ability, request }) => {
+  async ({ authentication, body, ability }) => {
     try {
       if (body.externalId && !isSafeSessionExternalId(body.externalId)) {
         return json(
@@ -229,7 +226,6 @@ const { action } = createActionApiRoute(
         );
       }
 
-      recordSessionCreateAuthorization(ability, session, request, authentication.environment);
       if (
         sessionCreateAuthorizationOutcome(
           ability,

apps/webapp/app/services/sessionAuthorizationTelemetry.server.test.ts

@@ -1,15 +1,6 @@
-import { trace } from "@opentelemetry/api";
-import {
-  BasicTracerProvider,
-  InMemorySpanExporter,
-  SimpleSpanProcessor,
-} from "@opentelemetry/sdk-trace-base";
 import { buildJwtAbility, withActionAliases } from "@trigger.dev/rbac";
 import { describe, expect, it } from "vitest";
-import {
-  recordSessionCreateAuthorization,
-  sessionCreateAuthorizationOutcome,
-} from "~/services/sessionAuthorizationTelemetry.server";
+import { sessionCreateAuthorizationOutcome } from "~/services/sessionAuthorizationTelemetry.server";
 
 describe("session creation authorization observation", () => {
   it.each([
@@ -44,62 +35,4 @@ describe("session creation authorization observation", () => {
       );
     }
   );
-
-  it("attributes only would-deny events without exporting the credential or task", async () => {
-    const exporter = new InMemorySpanExporter();
-    const provider = new BasicTracerProvider({
-      spanProcessors: [new SimpleSpanProcessor(exporter)],
-    });
-    trace.setGlobalTracerProvider(provider);
-    const credential = `tr_prod_sk_${"a".repeat(24)}`;
-    const request = new Request("https://example.com/api/v1/sessions", {
-      method: "POST",
-      headers: { Authorization: `Bearer ${credential}` },
-      body: JSON.stringify({ taskIdentifier: "requested-task" }),
-    });
-    const environment = {
-      id: "env-1",
-      organizationId: "org-1",
-      projectId: "project-1",
-      type: "PRODUCTION" as const,
-    };
-
-    try {
-      recordSessionCreateAuthorization(
-        withActionAliases(buildJwtAbility(["write:tasks:chat"])),
-        { taskIdentifier: "chat" },
-        request,
-        environment
-      );
-      recordSessionCreateAuthorization(
-        buildJwtAbility(["admin"]),
-        { taskIdentifier: "chat" },
-        request,
-        environment
-      );
-      recordSessionCreateAuthorization(
-        withActionAliases(buildJwtAbility(["write:sessions", "trigger:tasks:requested-task"])),
-        { taskIdentifier: "stored-task" },
-        request,
-        environment
-      );
-      const spans = exporter.getFinishedSpans();
-      expect(spans).toHaveLength(2);
-      expect(spans[1].attributes["session.authorization.outcome"]).toBe("missing_task_trigger");
-      expect(spans[0].name).toBe("session.create.authorization_would_deny");
-      expect(spans[0].attributes).toMatchObject({
-        forceRecording: true,
-        "$trigger.org.id": "org-1",
-        "$trigger.project.id": "project-1",
-        "$trigger.env.id": "env-1",
-        "session.authorization.credential_kind": "additional_api_key",
-        "session.authorization.outcome": "missing_session_write",
-      });
-      expect(JSON.stringify(spans[0].attributes)).not.toContain(credential);
-      expect(Object.values(spans[0].attributes)).not.toContain("chat");
-    } finally {
-      trace.disable();
-      await provider.shutdown();
-    }
-  });
 });

apps/webapp/app/services/sessionAuthorizationTelemetry.server.ts

@@ -1,17 +1,4 @@
-import { getMeter, getTracer, ROOT_CONTEXT } from "@internal/tracing";
-import type { AuthenticatedEnvironment } from "@trigger.dev/core/v3/auth/environment";
-import { isAdditionalApiKey } from "@trigger.dev/core/v3/apiKeys";
-import { isPublicJWT } from "@trigger.dev/core/v3/jwt";
 import type { RbacAbility } from "@trigger.dev/rbac";
-import { singleton } from "~/utils/singleton";
-import { logger } from "~/services/logger.server";
-
-const checks = singleton("sessionCreateAuthorizationChecks", () =>
-  getMeter("session-authorization").createCounter("session.create.authorization_checks", {
-    description:
-      "Session creation requests admitted by current authorization, by proposed permission outcome",
-  })
-);
 
 export function sessionCreateAuthorizationOutcome(
   ability: RbacAbility,
@@ -27,54 +14,3 @@ export function sessionCreateAuthorizationOutcome(
   if (!sessionWrite && !taskTrigger) return "missing_both";
   return sessionWrite ? "missing_task_trigger" : "missing_session_write";
 }
-
-export function recordSessionCreateAuthorization(
-  ability: RbacAbility,
-  session: { taskIdentifier: string; friendlyId?: string; externalId?: string | null },
-  request: Request,
-  environment: Pick<AuthenticatedEnvironment, "id" | "organizationId" | "projectId" | "type">
-) {
-  const token =
-    request.headers
-      .get("Authorization")
-      ?.replace(/^Bearer /, "")
-      .trim() ?? "";
-  const credentialKind = isPublicJWT(token)
-    ? "public_jwt"
-    : isAdditionalApiKey(token)
-      ? "additional_api_key"
-      : token.startsWith("tr_")
-        ? "root_api_key"
-        : "unknown";
-
-  try {
-    const outcome = sessionCreateAuthorizationOutcome(
-      ability,
-      session.taskIdentifier,
-      [session.friendlyId, session.externalId].filter((id): id is string => !!id)
-    );
-    checks.add(1, { credential_kind: credentialKind, outcome });
-    if (outcome === "both_allowed") return;
-
-    // Force-record an independent root span so request sampling cannot hide affected tenants.
-    getTracer("session-authorization")
-      .startSpan(
-        "session.create.authorization_would_deny",
-        {
-          attributes: {
-            forceRecording: true,
-            "$trigger.org.id": environment.organizationId,
-            "$trigger.project.id": environment.projectId,
-            "$trigger.env.id": environment.id,
-            "$trigger.env.type": environment.type,
-            "session.authorization.credential_kind": credentialKind,
-            "session.authorization.outcome": outcome,
-          },
-        },
-        ROOT_CONTEXT
-      )
-      .end();
-  } catch {
-    logger.debug("Session authorization observation failed");
-  }
-}