* feat(server): add speckle automate as a configurable default app
* feat(server): add default automate url, and helm values
* fix default app tests reporting the old number
* Revert "fix(ratelimit): reduce /graphql limit based on incident (#1505)"
This reverts commit 2a35fe6178.
* Revert helm chart defaults to value in code
- fix typo
- we do not log both the ip if the user is signed in, as this may be a privacy issue
- the ip is only logged if there is no associated user information
* feat(server): authentication middleware should log auth context creation status
- this uses the pino http logger provided via prior express middleware, ensuring a request ID is associated with the log messages
- userID, scopes and roles will be logged
* Appends the authContext to the req.log, which makes it available on all subsequent calls
* feat: register flag passed to fe
* feat: mixpanel tracking for all sign ups
* feat: utm first touch & last touch tracking
* feat(helm): Allows Environment Variable for MP to be configured
- default is enabled
- renames environment variable to ENABLE_MP
* feat(helm network policy): allowlist analytics.speckle.systems
---------
Co-authored-by: Iain Sproat <68657+iainsproat@users.noreply.github.com>
* fix(server authz): make sure to forbid access with invalid tokens
fix#927
* test(server authz tests): update tests to reflect the changes in the invalid token forbidden flow
- feat(logging): log all http requests and responses
- the auto logger does not log the body, to ensure sensitive payloads are not logged. Unfortunately this means that error messages are not logged either, so need to be manually logged.
- fix(logging): 400 errors should be info not error severity logging
- chore(server): adds endpoint parameter to some log messages
- and any other relevant parameters we have to hand (streamId, userId etc..)
- logging severity is info for `400` status codes, error for `500` status codes or equivalent.
- errors should be logged to stdout in a structured format
- currently still throws errors which are ultimately unhandled, this matches existing behaviour
- Consolidate redis creation and error handling in a shared module
* remove unused 'redis' module, in favour of 'ioredis'
* fix(logging): user login attempt without invite to invite-only server is info severity, not error severity
* fix(logging): a prompt for user to verify should be logged as information, not error severity
* feat(server): add switchable admin authz override
* fix(server): make sure tests work with the new admin override
* feat(server authz): make sure to add all requested roles to server admins in admin override mode
* fix(logging): user input errors should be logged as info severity
* Tidy the code to use a constant and a specific error type
* Attempting to remove the last admin user is invalid user input and should not be logged as error severity
* Missing passwords are user input errors
- logs are now warn severity, as they are not necessarily system errors and may be user errors or incorrectly configured application errors.
- improved the error messages, as we should not have multiple errors with the same message as this makes debugging difficult.
Iain Sproat