External/buzz

Fork 0

mirror of https://github.com/block/buzz.git synced 2026-08-18 06:50:31 +02:00

Files

T

History

1bc57aebf8 fix(relay): omit a version clients cannot bump, and drop the forgeable counter

Review of #4543 found two problems with how the new client identity
reached Prometheus. Both are fixed here, and the parser and sender lost
the hand-rolled code the review flagged as removable.

Only a real release version is reported. Every sender passed
`env!("CARGO_PKG_VERSION")`, but only the desktop app has an
independently bumped version: `buzz-ws-client` and `buzz-acp` use
`version.workspace = true`, and the workspace version has never been
bumped, because `RELEASING.md` "Version Sources" gives release authority
only to the desktop manifests and `crates/buzz-relay/Cargo.toml`. So CLI
and harness connections would have reported a fixed version forever and
a dashboard would have read that as "nobody ever upgrades". `app_version`
is now `Option<&str>`; those clients pass `None`, the `app-version`
member is omitted from the header, and the relay labels the version
`unknown`, which is accurate. A version that is *present* but unusable is
still a parse failure, so a genuinely broken version stays visible. A
wrong version is worse than no version.

Only a gauge is emitted. `buzz_client_connections_total` is removed. The
header arrives before NIP-42 AUTH and is forgeable, and the recorder's
`idle_timeout` is configured for `MetricKindMask::GAUGE` only, so counter
series would have been retained for the process lifetime while gauge
series self-clean. Verified with a throwaway probe: 10,000 forged headers
produced 10,000 series; after the idle timeout the counter kept all
10,000 and the gauge went to 0. The label alphabet was never the real
bound — the metric kind is. Connection rate is left to the existing
`buzz_ws_connections_total`, which is not attacker-labeled.

Also, per review:

- `may_identify_to` takes a parsed `url::Url` and matches on scheme plus
`url::Host`, replacing hand-rolled scheme splitting, userinfo
stripping, and IPv6 bracket handling. Both callers already parsed the
URL, so they now parse once. `url` was already a dependency.
- The three duplicated label emitters collapse into one `active_gauge`.
- `app_version_detail`, `MAX_LOGGED_VALUE_LEN`, and `truncate_for_log`
are gone; the connection log uses the label-safe version.
- `MAX_HEADER_LEN` and `MAX_APP_VERSION_LEN` are single constants
exported from `buzz-core`, replacing the relay's divergent 512/32. A
test proves the longest header the builder can emit still parses, so
the two halves cannot drift into counting real clients as failures.

`deploy/` is still a zero diff and the HPA series is still unlabeled.

Signed-off-by: npub1x3mmseqygyar04742djuepgk0t2d2t4chzm9sl0hl4vlc2m9whvqza9e5y <3477b86404413a37d7d55365cc85167ad4d52eb8b8b6587df7fd59fc2b6575d8@buzz.block.builderlab.xyz>
Co-authored-by: Atish Patel <atish@squareup.com>
Signed-off-by: Atish Patel <atish@squareup.com>

2026-08-12 16:06:22 -05:00