veza/veza-backend-api/internal
senke 54af2bc851 feat(observability): RUM Web Vitals beacons + alert rules (v1.0.10 ops item 9)
Real User Monitoring closes the gap between synthetic probes (which
already cover server-side latency) and what users actually see in
their browsers. Slow CDN edges, third-party scripts, mobile-CPU
regressions, and bundle bloat all surface here but stay invisible
to backend-side dashboards.

Frontend (apps/web) :
- web-vitals@^4.2.4 dep
- src/observability/webVitals.ts collects LCP / CLS / INP / FID /
  TTFB via the npm web-vitals package and POSTs to the backend
  using sendBeacon (with fetch keepalive fallback)
- Pageload-level sampling decision (flip a coin once, contribute
  all metrics or none) avoids per-metric histogram bias
- Sample rate via VITE_RUM_SAMPLE_RATE (default 1.0 dev / 0.25 prod)
- main.tsx wires initWebVitals() right after initSentry()
- Route slug derived client-side (strips uuid-ish + numeric ids
  to keep cardinality low)

Backend :
- internal/handlers/web_vitals_handler.go : POST
  /api/v1/observability/web-vitals — anonymous, IP rate-limited
  (reuses FrontendLogRateLimit), validates value ranges, normalizes
  route + device labels for cardinality
- internal/monitoring/web_vitals.go : Prometheus histograms with
  buckets aligned to Google's good/needs-improvement/poor
  thresholds, plus beacons-received / beacons-rejected counters
- Tests : 6 handler tests + 3 helper-function tests + 10 frontend
  vitest tests (all pass)

Alerts in alert_rules.yml veza_rum group :
- WebVitalsLCPP75Poor (p75 LCP > 4s on a route+device for 30m)
- WebVitalsCLSP75Poor (p75 CLS > 0.25 for 30m)
- WebVitalsINPP75Poor (p75 INP > 500ms for 30m)
- WebVitalsBeaconsStopped (zero beacons for 30m vs yesterday)

Cardinality discipline : labels are bounded to {route, device}
where route is alnum/dash, ≤32 chars, and device is one of
mobile/desktop/tablet/unknown. No per-user labels.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-04 19:56:44 +02:00
..
api feat(observability): RUM Web Vitals beacons + alert rules (v1.0.10 ops item 9) 2026-05-04 19:56:44 +02:00
common v0.9.2 2026-03-05 19:27:34 +01:00
config feat(auth): DB-backed JWT jti revocation ledger (sécu item 6) 2026-05-02 11:37:02 +02:00
core fix(backend): print config-init error to stderr before silent exit 2026-05-02 12:34:17 +02:00
database v0.9.4 2026-03-05 23:03:43 +01:00
dto feat(auth): RGPD/COPPA age gate at registration (16+ minimum) 2026-05-01 18:05:47 +02:00
elasticsearch fix(backend): unblock handlers + elasticsearch test packages 2026-04-30 14:48:23 +02:00
email refactor(backend,infra): unify SMTP env schema on canonical SMTP_* names 2026-04-16 20:44:09 +02:00
errors v0.9.8 2026-03-06 19:13:16 +01:00
eventbus fix(eventbus): log RabbitMQ publish failures instead of silent drop 2026-04-16 20:50:51 +02:00
features adding initial backend API (Go) 2025-12-03 20:29:37 +01:00
handlers feat(observability): RUM Web Vitals beacons + alert rules (v1.0.10 ops item 9) 2026-05-04 19:56:44 +02:00
infrastructure v0.9.4 2026-03-05 23:03:43 +01:00
integration style(backend): gofmt -w on 85 files (whitespace only) 2026-04-14 12:22:14 +02:00
interfaces adding initial backend API (Go) 2025-12-03 20:29:37 +01:00
jobs feat(webhooks): persist raw hyperswitch payloads to audit log — v1.0.7 item E 2026-04-18 02:44:58 +02:00
logging style(backend): gofmt -w on 85 files (whitespace only) 2026-04-14 12:22:14 +02:00
metrics feat(cdn): Bunny.net signed URLs + HLS cache headers + metric collision fix (W3 Day 13) 2026-04-28 14:07:20 +02:00
middleware feat(auth): DB-backed JWT jti revocation ledger (sécu item 6) 2026-05-02 11:37:02 +02:00
models feat(legal): DMCA notice handler + admin queue + 451 playback gate (W3 Day 14) 2026-04-28 15:39:33 +02:00
monitoring feat(observability): RUM Web Vitals beacons + alert rules (v1.0.10 ops item 9) 2026-05-04 19:56:44 +02:00
pagination v0.9.8 2026-03-06 19:13:16 +01:00
recovery chore(v0.102): consolidate remaining changes — docs, frontend, backend 2026-02-20 13:02:12 +01:00
repositories fix(v0.12.6.1): remediate 2 CRITICAL + 10 HIGH + 1 MEDIUM pentest findings 2026-03-12 05:40:53 +01:00
resilience chore: consolidate CI, E2E, backend and frontend updates 2026-02-17 16:43:21 +01:00
response fix: stabilize builds, tests, and lint across all stacks 2026-04-05 16:48:07 +02:00
security refactor(backend): replace 40 fmt.Printf calls with zap structured logging 2026-02-22 17:44:38 +01:00
services feat(auth): DB-backed JWT jti revocation ledger (sécu item 6) 2026-05-02 11:37:02 +02:00
shutdown incus deployement fully implemented, Makefile updated and make fmt ran 2026-01-13 19:47:57 +01:00
testutils ci: retire legacy backend-ci.yml, centralize Docker probe in SkipIfNoIntegration 2026-04-15 16:12:45 +02:00
tracing feat(observability): OTel SDK + collector + Tempo + 4 hot path spans (W2 Day 9) 2026-04-28 01:15:11 +02:00
types fix(backend): commit swagger annotation pass + missing handler methods 2026-05-01 10:16:57 +02:00
upload [INT-015] int: Add file upload format standardization 2025-12-25 15:40:01 +01:00
utils fix(v0.12.6): apply all pentest remediations — 36 findings across 36 files 2026-03-14 00:44:46 +01:00
validators feat(security): open-redirect protection on Stripe Connect + KYC return URLs 2026-05-02 11:42:41 +02:00
websocket feat(redis): Sentinel HA + cache hit rate metrics (W3 Day 11) 2026-04-28 13:36:55 +02:00
workers feat(transcode): read from S3 signed URL when track is s3-backed (v1.0.8 P2) 2026-04-23 23:34:51 +02:00