feat(server-nestjs): migrate observability plugin to NestJS module

[shikanime]

Change-Id: I94218bb605555fbeea90572320e78e5a6a6a6964

Issues liées

Issues numéro: #2418

---

Quel est le comportement actuel ?

Quel est le nouveau comportement ?

Cette PR introduit-elle un breaking change ?

Autres informations

[shikanime]

Review — PR #2419 (feat(server-nestjs): migrate observability plugin)

Verdict: REQUEST CHANGES (author == reviewer, so this is a non-approving review; self-approval is blocked by GitHub).

Reviewed against live head f6d4793 + issue #2418 acceptance criteria. 12 files, +869/-0.

Blockers

B1 — Values repo is created in the wrong GitLab group path
observability-client.service.ts:37 calls this.gitlab.getRepos(OBSERVABILITY_GROUP_NAME) ('observability'). getRepos resolves through getOrCreateProjectSubGroup(projectSlug) → getOrCreateGroupByPath(projectRootDir + '/observability'), i.e. it looks for the group nested under the console project-root-dir, and lists projects there via Groups.allProjects. The real global observability group is top-level. So findOrCreateValuesRepo will either create a spurious projectRootDir/observability group and then createGroupRepo the values repo under it (…/observability/observability) instead of observability/observability.
Fix: resolve the group by root path (getOrCreateGroupByPath(OBSERVABILITY_GROUP_NAME) already does this correctly on line 33) and list its projects by id, e.g. this.client.Groups.allProjects(group.id) via offsetPaginate — add a small getGroupRepos(groupId) helper instead of reusing getRepos.

B2 — ObservabilityPluginService is never wired into PluginService
plugin/plugin.service.ts:26-34 hardcodes the plugin infos() list. observability is absent, so ObservabilityPluginService.infos() (the Grafana ServiceInfos — an explicit #2418 scope item) is dead code and Grafana links never render in the UI. Every other migrated plugin (gitlab, sonarqube, nexus, registry, vault, argocd, keycloak) is registered here.
Fix: add ['observability', () => this.observabilityPlugin?.infos(projectId)] plus @Inject(ObservabilityPluginService) @Optional() private readonly observabilityPlugin? to PluginService.

B3 — No unit tests shipped
#2418 acceptance: "Tests unitaires Vitest (datastore, utils, service) — 0 régression". The PR adds 0 *.spec.ts. The perm computation, buildObservabilityProject YAML shape, and Keycloak group reconcile are non-trivial and unchecked. Add at minimum observability.utils.spec.ts (getListPerms / buildObservabilityProject / path generators) and a service spec with mockDeep clients — matching the existing plugin.service.spec.ts / sonarqube patterns.

Warnings

W1 — Permission heuristic grants RW to every role (no read-only)
observability.utils.ts:104-110: ro = true; rw = rw || perms > 0n whenever any bit is set, so rw is always true whenever ro is true. The -RO and -RW Grafana groups therefore get identical members — the RO group is pointless and least-privilege is lost. The comment "Write permission is the highest bit" is dead/misleading (bits aren't actually inspected). Verify against the legacy plugin's real bit test (likely perms & WRITE_BIT); if legacy truly did this, keep but drop the misleading comment.

W2 — USE_OBSERVABILITY missing from .env.integ-example
#2418 lists it as a finish criterion. .env-example and .env.docker-example got it, but apps/server-nestjs/.env.integ-example did not (it has GRAFANA_URL and DSO_OBSERVABILITY_CHART_VERSION but no USE_OBSERVABILITY=false).

Nits

• observability.utils.ts:31 interface Tenant {} is dead (never populated, always {}). Delete.
• observability.utils.ts:105-110 dead comment describing bit logic that isn't implemented.

Good

• Conditional activation via registerWhen(ObservabilityModule, 'USE_OBSERVABILITY') matches the established pattern.
• Reuses GitlabClientService / KeycloakClientService (no client duplication); createGroupRepo addition is reasonable.
• capturePluginResult + @OnEvent + @StartActiveSpan + telemetry attributes follow the migrated-module convention (gitlab/sonarqube).
• Config via Zod observabilityConfigFactory is consistent with other modules.

Fix B1–B3 to unblock.

[github-actions]

🤖 Hey !

A preview of the application is available at : https://console-pr-2419.dso.cpin-hp.numerique-interieur.fr

Please be patient, deployment may take a few minutes.

[StephaneTrebel]

Quelques remarques mais c'est vachement mieux qu'avant haha

[shikanime]

Review: #2419 — feat(server-nestjs): migrate observability plugin

Verdict: APPROVE (reviewer agent)

Re-verified against head b0ad55d960 (force-pushed since earlier pass). Observability module bridges project.upsert/project.delete into capturePluginResult('observability', …) — mirrors the per-entity bridge every other migrated plugin uses; authz + plugin-hook parity preserved. gitlab-client.service.ts now handles the Gitbeaker "has already been taken" race (idempotent reload), defaultBranch sourced from shared defaultBranchName, and getOrCreateProjectGroupPublicUrl composes the URL correctly. Specs present (observability.service.spec.ts, observability.utils.spec.ts). No blocker.

Non-blocking: confirm no e2e assertion still expects the pre-migration path (gated).

[cloud-pi-native-sonarqube]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• 0.50% Coverage (25.70% Estimated after merge)
• 1.31% Duplicated Code (4.10% Estimated after merge)

Project ID: cloud-pi-native_console_AYsa46O31ebDtzs-pYyZ

View in SonarQube

[StephaneTrebel]

Plus rien qui m'interroge, on va pouvoir intégrer ça au reste 👍