feat: add PostHog telemetry events for SSO, App Connection, Secret Rotation V2, and Gateway by devin-ai-integration[bot] · Pull Request #5731 · Infisical/infisical

devin-ai-integration · 2026-03-17T02:04:59Z

Context

Adds PostHog telemetry events for four feature areas that previously had no usage tracking:

SSO Configuration (SSO Configured) — tracks SAML, OIDC, and LDAP config creation and updates, with provider and action properties
App Connections (App Connection Created / App Connection Deleted) — tracks connection lifecycle with app (typed as AppConnection enum) and method properties
Secret Rotation V2 (Secret Rotation V2 Created / Deleted / Executed) — tracks rotation lifecycle with type (typed as SecretRotation enum), projectId, environment, and secretPath
Gateway (Gateway Cert Exchanged) — tracks gateway certificate exchange via the exchange-cert endpoint

All events follow the existing fire-and-forget pattern (void ... .catch((err) => logger.error(...))). All events pass organizationId at the top level (sourced from req.permission.orgId) for proper org-level grouping in PostHog.

Updates since last revision

Addressed all review feedback (Devin Review + Greptile + human reviewer) across multiple rounds:

Replaced all empty .catch(() => {}) blocks with .catch((err) => logger.error(err, "...")) across all 6 router files (12 catch blocks) so telemetry failures are logged instead of silently swallowed
Added import { logger } from "@app/lib/logger" to the 4 files that didn't already have it (gateway-router, oidc-router, secret-rotation-v2-endpoints, app-connection-endpoints)
Added organizationId: req.permission.orgId to all three Secret Rotation V2 events for proper org-level PostHog grouping
Removed redundant orgId from properties across SSO, App Connection, and Gateway events (org association is handled by the top-level organizationId field)
Renamed gatewayId to certificateSerialNumber in the Gateway event to clarify it holds a TLS cert serial number, not a DB gateway ID
Renamed event from GatewayCreated to GatewayCertExchanged since exchange-cert fires on both first-time provisioning and cert renewals
Removed if (authProvider) guard on SAML update handler — now always fires telemetry with authProvider ?? "saml" fallback, consistent with LDAP/OIDC update handlers
Changed app property type from string to AppConnection enum in TAppConnectionCreatedEvent and TAppConnectionDeletedEvent for stronger typing
Added environment and secretPath to SecretRotationV2Deleted and SecretRotationV2Executed events (sourced from secretRotation.environment.slug and secretRotation.folder.path) for consistency with the Created event
Changed all SSO telemetry events (LDAP, OIDC, SAML — both create and update) to use req.permission.orgId instead of req.body.organizationId to prevent spoofed org attribution
Changed type property in all three Secret Rotation V2 event types from string to SecretRotation enum for compile-time safety
Fixed import sort order in telemetry-types.ts to satisfy simple-import-sort/imports lint rule

Items for human reviewer attention

Gateway uses certificateSerialNumber: The DB gateway ID is not returned by exchangeAllocatedRelayAddress. If correlating telemetry events with DB records is important, the service would need to be updated to also return the gateway ID.
SAML update fallback: When authProvider is not in the PATCH body, the telemetry event uses "saml" as the provider value. Verify this default is acceptable.
method as string cast in app-connection-endpoints.ts: The generic method parameter is cast to string for the telemetry properties type. This is safe but worth a glance.
Deleted/Executed rotation events access nested fields: secretRotation.environment.slug and secretRotation.folder.path are used — verify these are always populated on the object returned by deleteSecretRotation and rotateSecretRotation.

Steps to verify the change

Confirm new enum values and type definitions in telemetry-types.ts are correctly typed (including AppConnection and SecretRotation enum usage)
Verify each router file has the telemetry call placed after the service call succeeds and (where applicable) after the audit log write
Verify all events pass organizationId: req.permission.orgId at the top level (not inside properties, and not from req.body)
Verify all .catch() blocks use logger.error with a descriptive message
Run npx tsc --noEmit in backend/ to confirm no type errors

Type

Checklist

Title follows the conventional commit format: type(scope): short description
Tested locally
Updated docs (if needed)
Updated CLAUDE.md files (if needed)
Read the contributing guide

Link to Devin session: https://app.devin.ai/sessions/ff644e7024c8430f847cc431a8ef22b0
Requested by: @0xArshdeep

…tation V2, and Gateway - Add new PostHogEventTypes: SSOConfigured, AppConnectionCreated, AppConnectionDeleted, SecretRotationV2Created, SecretRotationV2Deleted, SecretRotationV2Executed, GatewayCreated - Add corresponding TypeScript type definitions for each event - Instrument SAML/OIDC/LDAP routers with SSO telemetry on create and update - Instrument app-connection-endpoints with create/delete telemetry - Instrument secret-rotation-v2-endpoints with create/delete/execute telemetry - Instrument gateway router exchange-cert handler with creation telemetry - All events follow existing fire-and-forget pattern Co-Authored-By: arsh <[email protected]>

devin-ai-integration · 2026-03-17T02:05:02Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment and CI monitoring

maidul98 · 2026-03-17T02:05:39Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

greptile-apps · 2026-03-17T02:10:15Z

Greptile Summary

This PR adds PostHog telemetry instrumentation to four previously untracked feature areas — SSO (SAML/OIDC/LDAP), App Connections, Secret Rotation V2, and Gateway — following the existing fire-and-forget pattern used throughout the codebase. All previous review feedback has been addressed: organizationId is sourced from req.permission.orgId on every event, enum types (AppConnection, SecretRotation) are used instead of loose string types where applicable, the Gateway event was renamed to GatewayCertExchanged to accurately reflect renewals vs. provisioning, and environment/secretPath were added to the Deleted and Executed rotation events.

Key observations:

All 7 new event types are correctly wired into the TPostHogEvent discriminated union and the PostHogEventTypes enum.
secretRotation.environment.slug and secretRotation.folder.path are safe to access in the Deleted and Executed handlers — the DAL's expandSecretRotation always populates both fields via join, confirmed by reviewing the DAL implementation.
The provider field in TSSOConfiguredEvent accepts values from SamlProviders enum (for SAML) and plain string literals for LDAP/OIDC — a union type would improve compile-time safety.
The SecretRotationV2Created event reads environment/secretPath from req.body while the Deleted/Executed events use the DB-confirmed values — functionally equivalent but inconsistent in approach.

Confidence Score: 5/5

This PR is safe to merge — it only adds fire-and-forget telemetry calls after successful service operations, with no risk to core functionality.
All telemetry events fire after the primary service call succeeds and use the fire-and-forget pattern (void … .catch(() => {})), so any telemetry failure cannot affect the API response. All previous review feedback has been addressed. The two remaining suggestions (provider union type, environment source consistency) are style-level improvements, not functional issues.
No files require special attention — all changes are additive telemetry instrumentation.

Important Files Changed

Filename	Overview
backend/src/services/telemetry/telemetry-types.ts	Adds 7 new PostHog event types (SSO, App Connections x2, Secret Rotation V2 x3, Gateway) with appropriate enum-typed properties (AppConnection, SecretRotation). Union type and enum are properly extended. Import sort order is correct.
backend/src/ee/routes/v1/saml-router.ts	Adds telemetry for SAML create/update. Both handlers await the service call and fire telemetry after. The update handler correctly falls back to "saml" when authProvider is absent from the PATCH body. authProvider is required on create (z.nativeEnum(SamlProviders)), so no undefined risk there.
backend/src/ee/routes/v1/ldap-router.ts	Adds telemetry for LDAP create/update using req.permission.orgId for organizationId. Both events use hardcoded provider: "ldap" and the correct action string. Fire-and-forget pattern is consistent with the rest of the codebase.
backend/src/ee/routes/v1/oidc-router.ts	Adds telemetry for OIDC update (~line 279) and create (~line 416). Both use req.permission.orgId and hardcoded provider: "oidc". Events are placed correctly after service calls succeed.
backend/src/ee/routes/v2/secret-rotation-v2-routers/secret-rotation-v2-endpoints.ts	Adds telemetry for SecretRotationV2 Created/Deleted/Executed. All three events include organizationId, environment, and secretPath. The Deleted and Executed events correctly access secretRotation.environment.slug and secretRotation.folder.path, which are always populated by the DAL's expandSecretRotation helper via non-null assertion.
backend/src/server/routes/v1/app-connection-routers/app-connection-endpoints.ts	Adds telemetry for AppConnectionCreated and AppConnectionDeleted. Created event includes method (cast as string from generic I["method"]), app (AppConnection enum), and appConnectionId. Deleted event omits method since it's unavailable in the delete service call's return signature. Both events correctly use req.permission.orgId.
backend/src/ee/routes/v1/gateway-router.ts	Adds GatewayCertExchanged telemetry after exchangeAllocatedRelayAddress succeeds. certificateSerialNumber (TLS cert serial) and identityId are included. Event name correctly reflects that this fires on both provisioning and renewals.

_{Last reviewed commit: 5d21b7c}

… remove redundant orgId, rename gatewayId Co-Authored-By: arsh <[email protected]>

…Exchanged, remove SAML update guard Co-Authored-By: arsh <[email protected]>

devin-ai-integration · 2026-03-17T02:37:13Z

All Greptile comments have been addressed in commits 2da6f50 and d2c6829:

Missing organizationId on rotation events (Comment 10) — Added organizationId: req.permission.orgId to all three Secret Rotation V2 events
Redundant orgId in properties (Comment 11) — Removed orgId from properties of SSO, App Connection, and Gateway events
gatewayId contains cert serial number (Comment 8) — Renamed to certificateSerialNumber
GatewayCreated fires on every cert exchange (Comment 9) — Renamed event to GatewayCertExchanged to accurately reflect semantics
SAML update telemetry skipped (Comment 12) — Removed if (authProvider) guard, using authProvider ?? "saml" fallback

0xArshdeep · 2026-03-17T02:39:52Z

@greptileai

…n telemetry events Co-Authored-By: arsh <[email protected]>

0xArshdeep · 2026-03-17T02:49:50Z

@greptileai

devin-ai-integration · 2026-03-17T02:49:56Z

Addressed the latest Greptile comment in commit 8fdada8: app property in TAppConnectionCreatedEvent and TAppConnectionDeletedEvent now uses the AppConnection enum type instead of string, with the import added to telemetry-types.ts.

…ecuted events Co-Authored-By: arsh <[email protected]>

devin-ai-integration · 2026-03-17T02:57:07Z

Addressed in 2ff8945 — SecretRotationV2Deleted and SecretRotationV2Executed events now include environment (from secretRotation.environment.slug) and secretPath (from secretRotation.folder.path), consistent with SecretRotationV2Created. Type definitions updated accordingly.

0xArshdeep · 2026-03-17T03:01:40Z

@greptileai

…ation enum for type property Co-Authored-By: arsh <[email protected]>

devin-ai-integration · 2026-03-17T03:13:26Z

Addressed in f0940de:

Comment 24 (P1): Changed all SSO telemetry events (LDAP create/update, OIDC create/update, SAML create/update) to use req.permission.orgId instead of req.body.organizationId — consistent with Gateway, App Connection, and Secret Rotation V2 events.
Comment 25 (P2): Changed type property in TSecretRotationV2CreatedEvent, TSecretRotationV2DeletedEvent, and TSecretRotationV2ExecutedEvent from string to SecretRotation enum — consistent with app: AppConnection pattern in App Connection events.

Co-Authored-By: arsh <[email protected]>

0xArshdeep · 2026-03-17T04:35:11Z

@greptileai

backend/src/ee/routes/v1/gateway-router.ts

…or handling Co-Authored-By: arsh <[email protected]>

devin-ai-integration bot assigned 0xArshdeep Mar 17, 2026

This comment was marked as resolved.

Sign in to view

devin-ai-integration bot and others added 2 commits March 17, 2026 02:26

fix: address review comments - add organizationId to rotation events,…

2da6f50

… remove redundant orgId, rename gatewayId Co-Authored-By: arsh <[email protected]>

fix: address Greptile comments - rename GatewayCreated to GatewayCert…

d2c6829

…Exchanged, remove SAML update guard Co-Authored-By: arsh <[email protected]>

This comment was marked as resolved.

Sign in to view

fix: use AppConnection enum type instead of string for app property i…

8fdada8

…n telemetry events Co-Authored-By: arsh <[email protected]>

This comment was marked as resolved.

Sign in to view

fix: add environment and secretPath to SecretRotationV2Deleted and Ex…

2ff8945

…ecuted events Co-Authored-By: arsh <[email protected]>

This comment was marked as resolved.

Sign in to view

fix: use req.permission.orgId for SSO telemetry events, use SecretRot…

f0940de

…ation enum for type property Co-Authored-By: arsh <[email protected]>

fix: sort imports to satisfy eslint simple-import-sort

5d21b7c

Co-Authored-By: arsh <[email protected]>

varonix0 requested changes Mar 17, 2026

View reviewed changes

backend/src/ee/routes/v1/gateway-router.ts Outdated Show resolved Hide resolved

fix: replace empty .catch() with logger.error for telemetry event err…

9df62c0

…or handling Co-Authored-By: arsh <[email protected]>

varonix0 approved these changes Mar 17, 2026

View reviewed changes

0xArshdeep merged commit cc2082a into main Mar 17, 2026
12 checks passed

Conversation

devin-ai-integration bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Updates since last revision

Items for human reviewer attention

Steps to verify the change

Type

Checklist

Uh oh!

devin-ai-integration bot commented Mar 17, 2026

🤖 Devin AI Engineer

Uh oh!

maidul98 commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

This comment was marked as resolved.

Uh oh!

greptile-apps bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

This comment was marked as resolved.

Uh oh!

devin-ai-integration bot commented Mar 17, 2026

Uh oh!

0xArshdeep commented Mar 17, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

0xArshdeep commented Mar 17, 2026

Uh oh!

devin-ai-integration bot commented Mar 17, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

devin-ai-integration bot commented Mar 17, 2026

Uh oh!

0xArshdeep commented Mar 17, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

devin-ai-integration bot commented Mar 17, 2026

Uh oh!

0xArshdeep commented Mar 17, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

devin-ai-integration bot commented Mar 17, 2026 •

edited

Loading

maidul98 commented Mar 17, 2026 •

edited

Loading

greptile-apps bot commented Mar 17, 2026 •

edited

Loading