{suggestedSearches.slice(0, 4).map((search) => (
diff --git a/packages/web/src/main.tsx b/packages/web/src/main.tsx
index eb09ccf5..01e98529 100644
--- a/packages/web/src/main.tsx
+++ b/packages/web/src/main.tsx
@@ -1,12 +1,14 @@
import "./globals.css";
import * as Counterscale from "@counterscale/tracker";
+import * as Sentry from "@sentry/react";
import { QueryClientProvider } from "@tanstack/react-query";
import { createRouter, RouterProvider } from "@tanstack/react-router";
import { Loader2Icon } from "lucide-react";
import { ThemeProvider } from "next-themes";
import ReactDOM from "react-dom/client";
+import { client } from "@/lib/api/client";
import { queryClient } from "@/lib/queryClient";
import { Error } from "./components/Error";
@@ -14,7 +16,8 @@ import { NotFound } from "./components/NotFound";
import { routeTree } from "./routeTree.gen";
const sstStage = import.meta.env.VITE_SST_STAGE;
-// Initialize Counterscale analytics
+
+// for web analytics
Counterscale.init({
siteId: `semhub-${sstStage}`,
reporterUrl: "https://semhub-prod-counterscale.pages.dev/collect",
@@ -35,6 +38,44 @@ const router = createRouter({
defaultErrorComponent: ({ error }) =>
,
});
+Sentry.init({
+ dsn:
+ sstStage === "prod"
+ ? "https://566d7949ee5e8265ac7d917d289585bd@o4508764596142080.ingest.us.sentry.io/4508770676637696"
+ : "https://bf47d2a69dccbb1f44173be530166765@o4508764596142080.ingest.us.sentry.io/4508764610494464",
+ environment: sstStage,
+ tunnel: client.sentry.tunnel.$url().toString(),
+ debug: sstStage === "prod" ? false : true,
+ integrations: [
+ Sentry.tanstackRouterBrowserTracingIntegration(router),
+ Sentry.replayIntegration({
+ // NOTE: This will disable built-in masking. Only use this if your site has no sensitive data, or if you've already set up other options for masking or blocking relevant data, such as 'ignore', 'block', 'mask' and 'maskFn'.
+ maskAllText: false,
+ blockAllMedia: false,
+ }),
+ ],
+ // Tracing
+ tracesSampleRate: sstStage === "prod" ? 0.1 : 1.0, // Capture 10% in prod, 100% elsewhere
+ // Set 'tracePropagationTargets' to control for which URLs distributed tracing should be enabled
+ tracePropagationTargets: [
+ // uat endpoints
+ "https://api.uat.semhub.dev",
+ "https://auth.uat.semhub.dev",
+ // Production endpoints
+ "https://api.semhub.dev",
+ "https://auth.semhub.dev",
+ // stg endpoints
+ "https://api.stg.semhub.dev",
+ "https://auth.stg.semhub.dev",
+ // dev API endpoints with dynamic subdomains
+ /^https:\/\/api\.[^.]+\.stg\.semhub\.dev$/, // Matches api.{anything}.stg.semhub.dev
+ /^https:\/\/auth\.[^.]+\.stg\.semhub\.dev$/, // Matches auth.{anything}.stg.semhub.dev
+ ],
+ // Session Replay - only enabled in production
+ replaysSessionSampleRate: sstStage === "prod" ? 0.1 : 0, // 10% of sessions in prod, disabled elsewhere
+ replaysOnErrorSampleRate: sstStage === "prod" ? 1.0 : 0, // 100% of error sessions in prod, disabled elsewhere
+});
+
declare module "@tanstack/react-router" {
interface Register {
router: typeof router;
diff --git a/packages/web/vite.config.ts b/packages/web/vite.config.ts
index f6c34a0c..aa677243 100644
--- a/packages/web/vite.config.ts
+++ b/packages/web/vite.config.ts
@@ -1,13 +1,24 @@
import fs from "fs";
import path from "path";
+import { sentryVitePlugin } from "@sentry/vite-plugin";
import { TanStackRouterVite } from "@tanstack/router-plugin/vite";
import react from "@vitejs/plugin-react";
import { defineConfig } from "vite";
-// https://vitejs.dev/config/
export default defineConfig(() => {
return {
- plugins: [TanStackRouterVite({}), react()],
+ plugins: [
+ TanStackRouterVite({}),
+ react(),
+ sentryVitePlugin({
+ authToken: process.env.SENTRY_AUTH_TOKEN,
+ org: "coder-aw",
+ project:
+ process.env.SST_STAGE === "prod"
+ ? "semhub-web-prod"
+ : "semhub-web-dev",
+ }),
+ ],
resolve: {
alias: {
"@/core": path.resolve(__dirname, "../core/src"),
@@ -16,6 +27,7 @@ export default defineConfig(() => {
},
},
build: {
+ sourcemap: true,
rollupOptions: {
output: {
manualChunks: {
diff --git a/packages/workers/package.json b/packages/workers/package.json
index 60be44ad..03b70946 100644
--- a/packages/workers/package.json
+++ b/packages/workers/package.json
@@ -6,10 +6,11 @@
"build": "tsc --build"
},
"dependencies": {
- "@semhub/core": "workspace:*",
- "@semhub/wrangler": "workspace:*",
"@hono/zod-validator": "^0.4.1",
"@openauthjs/openauth": "*",
+ "@semhub/core": "workspace:*",
+ "@semhub/wrangler": "workspace:*",
+ "@sentry/cloudflare": "^8.54.0",
"hono": "^4.6.5"
},
"devDependencies": {
diff --git a/packages/workers/src/api.ts b/packages/workers/src/api.ts
index 4ccba6be..20be356a 100644
--- a/packages/workers/src/api.ts
+++ b/packages/workers/src/api.ts
@@ -1,5 +1,28 @@
+import type { ExportedHandler } from "@cloudflare/workers-types";
+import * as Sentry from "@sentry/cloudflare";
+import { Resource } from "sst";
+
+import type { Context } from "./server/app";
import { app } from "./server/app";
-export default {
- fetch: app.fetch,
+type CloudflareRequest
= Request>;
+const handler: ExportedHandler = {
+ async fetch(request, env, ctx) {
+ // needed to fix type error
+ return app.fetch(request as CloudflareRequest, env, ctx);
+ },
};
+
+// Wrap with Sentry
+export default Sentry.withSentry(
+ () => ({
+ dsn:
+ Resource.App.stage === "prod"
+ ? "https://8a5572abfbb6f99f6144edf73b98446f@o4508764596142080.ingest.us.sentry.io/4508770682273792"
+ : "https://d415d30f99a3f43649f2289a054fe5b2@o4508764596142080.ingest.us.sentry.io/4508764598829056",
+ tracesSampleRate: Resource.App.stage === "prod" ? 0.2 : 1.0,
+ debug: Resource.App.stage === "prod" ? false : true,
+ environment: Resource.App.stage,
+ }),
+ handler,
+);
diff --git a/packages/workers/src/auth/auth.constant.ts b/packages/workers/src/auth/auth.constant.ts
index b0e477cd..d1c9afcf 100644
--- a/packages/workers/src/auth/auth.constant.ts
+++ b/packages/workers/src/auth/auth.constant.ts
@@ -1,7 +1,18 @@
+import { type cors } from "hono/cors";
import type { CookieOptions } from "hono/utils/cookie";
+import {
+ APP_DOMAIN,
+ APP_STG_DOMAIN,
+ APP_UAT_DOMAIN,
+ LOCAL_DEV_DOMAIN,
+ STAGES,
+} from "@/core/constants/domain.constant";
import { GITHUB_SCOPES_PERMISSION } from "@/core/github/permission/oauth";
+// Extract CORSOptions type from cors function
+type CORSOptions = NonNullable[0]>;
+
export const githubLogin = {
provider: "github-login" as const,
scopes: [
@@ -10,18 +21,13 @@ export const githubLogin = {
],
};
-export const APP_DOMAIN = "semhub.dev";
-const LOCAL_DEV_DOMAIN = `local.${APP_DOMAIN}`;
-const APP_STG_DOMAIN = `stg.${APP_DOMAIN}`;
-const APP_UAT_DOMAIN = `uat.${APP_DOMAIN}`;
-
function getCookieDomain(stage: string) {
switch (stage) {
- case "prod":
+ case STAGES.PROD:
return APP_DOMAIN;
- case "uat":
+ case STAGES.UAT:
return APP_UAT_DOMAIN;
- case "stg":
+ case STAGES.STG:
return APP_STG_DOMAIN;
default:
// For local development, we set the cookie on the parent domain (.semhub.dev) because:
@@ -34,7 +40,7 @@ function getCookieDomain(stage: string) {
}
function isLocalDev(stage: string): boolean {
- return stage !== "prod" && stage !== "stg" && stage !== "uat";
+ return stage !== STAGES.PROD && stage !== STAGES.STG && stage !== STAGES.UAT;
}
export function getCookieOptions(stage: string): CookieOptions {
@@ -55,11 +61,15 @@ export function getAuthServerCORS() {
credentials: false,
// can use wildcard if credentials: false is used
origin: `https://*.${APP_DOMAIN}`,
- allowHeaders: ["Content-Type"],
+ allowHeaders: [
+ "Content-Type",
+ "sentry-trace", // Allow Sentry tracing headers
+ "baggage", // Allow Sentry baggage header
+ ],
allowMethods: ["POST", "GET", "OPTIONS"],
exposeHeaders: ["Content-Length", "Access-Control-Allow-Origin"],
maxAge: 600,
- };
+ } satisfies CORSOptions;
}
export function getApiServerCORS(stage: string) {
@@ -76,9 +86,14 @@ export function getApiServerCORS(stage: string) {
return {
credentials: true,
origin: origins,
- allowHeaders: ["Content-Type", "Authorization"],
+ allowHeaders: [
+ "Content-Type",
+ "Authorization",
+ "sentry-trace", // Allow Sentry tracing headers
+ "baggage", // Allow Sentry baggage header
+ ],
allowMethods: ["POST", "GET", "OPTIONS"],
exposeHeaders: ["Content-Length", "Access-Control-Allow-Origin"],
maxAge: 600,
- };
+ } satisfies CORSOptions;
}
diff --git a/packages/workers/src/auth/authenticator.ts b/packages/workers/src/auth/authenticator.ts
index 9b3164ea..0a807f95 100644
--- a/packages/workers/src/auth/authenticator.ts
+++ b/packages/workers/src/auth/authenticator.ts
@@ -5,12 +5,13 @@ import { Hono } from "hono";
import { cors } from "hono/cors";
import { Resource } from "sst";
+import { APP_DOMAIN } from "@/core/constants/domain.constant";
import { tokensetRawSchema } from "@/core/github/schema.oauth";
import { User } from "@/core/user";
import { parseHostname } from "@/core/util/url";
import { getDeps } from "../deps";
-import { APP_DOMAIN, getAuthServerCORS, githubLogin } from "./auth.constant";
+import { getAuthServerCORS, githubLogin } from "./auth.constant";
import { subjects } from "./subjects";
const app = new Hono();
diff --git a/packages/workers/src/server/app.ts b/packages/workers/src/server/app.ts
index b7e7120a..dc0e7e1f 100644
--- a/packages/workers/src/server/app.ts
+++ b/packages/workers/src/server/app.ts
@@ -1,3 +1,4 @@
+import * as Sentry from "@sentry/cloudflare";
import { Hono } from "hono";
import type { Env } from "hono";
import { cors } from "hono/cors";
@@ -18,6 +19,7 @@ import { authRouter } from "./router/auth.router";
import { authzRouter } from "./router/authz.router";
import { meRouter } from "./router/me/me.router";
import { publicRouter } from "./router/public/public.router";
+import { sentryRouter } from "./router/sentry.router";
import { webhookRouter } from "./router/webhook/webhook.router";
export interface Context extends Env {
@@ -66,7 +68,9 @@ const _routes = app
// Public routes
.route("/public", publicRouter)
// Webhook routes (secured by webhook secret)
- .route("/webhook", webhookRouter);
+ .route("/webhook", webhookRouter)
+ // Sentry tunnel route
+ .route("/sentry", sentryRouter);
// Export the type for client usage
export type ApiRoutes = typeof _routes;
@@ -82,19 +86,61 @@ app.notFound((c) => {
});
app.onError((err, c) => {
- if (err instanceof HTTPException) {
+ if (err instanceof HTTPException && err.status >= 400 && err.status < 500) {
+ // Don't report 4xx errors to Sentry as they are client errors
return c.json(
{
success: false,
error: err.message,
- // isFormError:
- // err.cause && typeof err.cause === "object" && "form" in err.cause
- // ? err.cause.form === true
- // : false,
},
err.status,
);
}
+
+ // Add request context to Sentry
+ Sentry.setContext("request", {
+ method: c.req.method,
+ url: c.req.url,
+ headers: c.req.header(),
+ });
+
+ // Add user context if available
+ const user = c.get("user");
+ if (user) {
+ Sentry.setUser({
+ id: user.id,
+ });
+ }
+
+ // Group similar errors together using fingerprinting
+ Sentry.withScope((scope) => {
+ // Create a fingerprint based on:
+ // 1. Error name/type
+ // 2. HTTP method
+ // 3. Request path pattern (removing dynamic segments)
+ // 4. Error message (if it's a known type)
+ const errorType = err.name || "Error";
+ const pathPattern = c.req.path.replace(/\/[0-9a-fA-F-]+/g, "/:id");
+
+ scope.setFingerprint([
+ errorType,
+ c.req.method,
+ pathPattern,
+ err instanceof Error ? err.message : "Unknown Error",
+ ]);
+
+ // Capture exception with extra context
+ Sentry.captureException(err, {
+ tags: {
+ stage: Resource.App.stage,
+ },
+ extra: {
+ path: c.req.path,
+ query: Object.fromEntries(new URL(c.req.url).searchParams),
+ },
+ });
+ });
+
const isProd = Resource.App.stage === "prod";
return c.json(
{
diff --git a/packages/workers/src/server/router/sentry.router.ts b/packages/workers/src/server/router/sentry.router.ts
new file mode 100644
index 00000000..6a3ddfbc
--- /dev/null
+++ b/packages/workers/src/server/router/sentry.router.ts
@@ -0,0 +1,67 @@
+import { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+
+import type { Context } from "../app";
+
+export const sentryRouter = new Hono().post("/tunnel", async (c) => {
+ const envelopeBytes = await c.req.arrayBuffer();
+ const envelope = new TextDecoder().decode(envelopeBytes);
+ const [headerPiece] = envelope.split("\n");
+ if (!headerPiece) {
+ throw new HTTPException(400, {
+ message: "Invalid envelope: missing header",
+ });
+ }
+ const header = JSON.parse(headerPiece);
+ if (!header.dsn) {
+ throw new HTTPException(400, {
+ message: "Invalid envelope: missing DSN",
+ });
+ }
+
+ // Extract Sentry details from the DSN in the envelope
+ const dsn = new URL(header.dsn);
+ const projectId = dsn.pathname.replace("/", "");
+ const sentryHost = dsn.hostname;
+
+ // Construct the upstream Sentry URL
+ const upstreamSentryUrl = `https://${sentryHost}/api/${projectId}/envelope/`;
+
+ // Get the original client IP
+ const clientIp =
+ c.req.header("cf-connecting-ip") ||
+ c.req.header("x-forwarded-for") ||
+ c.req.header("x-real-ip");
+
+ // Forward the envelope to Sentry
+ const response = await fetch(upstreamSentryUrl, {
+ method: "POST",
+ body: envelopeBytes,
+ headers: {
+ // Forward content type
+ "Content-Type":
+ c.req.header("content-type") ?? "application/x-sentry-envelope",
+ // Forward client information
+ "User-Agent": c.req.header("user-agent") ?? "",
+ "X-Forwarded-For": clientIp ?? "",
+ // Forward other relevant headers that Sentry might use
+ "X-Client-IP": clientIp ?? "",
+ "X-Real-IP": clientIp ?? "",
+ // Forward geolocation data if available from Cloudflare
+ "CF-IPCountry": c.req.header("cf-ipcountry") ?? "",
+ "CF-Ray": c.req.header("cf-ray") ?? "",
+ },
+ });
+
+ if (!response.ok) {
+ throw new HTTPException(503, {
+ message: "Failed to forward to Sentry",
+ });
+ }
+
+ // Return the response from Sentry
+ return new Response(response.body, {
+ status: response.status,
+ headers: response.headers,
+ });
+});
diff --git a/packages/workers/sst-env.d.ts b/packages/workers/sst-env.d.ts
index 4899cdce..ce65a8a7 100644
--- a/packages/workers/sst-env.d.ts
+++ b/packages/workers/sst-env.d.ts
@@ -52,6 +52,10 @@ declare module "sst" {
"type": "sst.sst.Secret"
"value": string
}
+ "SENTRY_AUTH_TOKEN": {
+ "type": "sst.sst.Secret"
+ "value": string
+ }
"Web": {
"type": "sst.aws.StaticSite"
"url": string
diff --git a/packages/wrangler/sst-env.d.ts b/packages/wrangler/sst-env.d.ts
index 4899cdce..ce65a8a7 100644
--- a/packages/wrangler/sst-env.d.ts
+++ b/packages/wrangler/sst-env.d.ts
@@ -52,6 +52,10 @@ declare module "sst" {
"type": "sst.sst.Secret"
"value": string
}
+ "SENTRY_AUTH_TOKEN": {
+ "type": "sst.sst.Secret"
+ "value": string
+ }
"Web": {
"type": "sst.aws.StaticSite"
"url": string
diff --git a/sst-env.d.ts b/sst-env.d.ts
index bfb1bb1f..99e495b8 100644
--- a/sst-env.d.ts
+++ b/sst-env.d.ts
@@ -68,6 +68,10 @@ declare module "sst" {
"type": "sst.sst.Secret"
"value": string
}
+ "SENTRY_AUTH_TOKEN": {
+ "type": "sst.sst.Secret"
+ "value": string
+ }
"SyncEmbeddingHandler": {
"type": "sst.cloudflare.Worker"
}