chore: configure alerting and monitoring (#25857)

packages/console/app/package.json

@@ -31,6 +31,7 @@
     "solid-js": "catalog:",
     "solid-list": "0.3.0",
     "solid-stripe": "0.8.1",
+    "svix": "1.92.2",
     "vite": "catalog:",
     "zod": "catalog:"
   },

packages/console/app/src/routes/incident/webhook.ts

@@ -0,0 +1,75 @@
+import type { APIEvent } from "@solidjs/start/server"
+import { Resource } from "@opencode-ai/console-resource"
+import { Webhook } from "svix"
+
+type Incident = {
+  mode?: "test" | "standard"
+  name?: string
+  permalink?: string
+  summary?: string
+}
+
+type IncidentWebhookPayload = {
+  event_type?: string
+  "public_incident.incident_created_v2"?: Incident
+}
+
+const verifyWebhook = async (request: Request) => {
+  const body = await request.text()
+  try {
+    return new Webhook(Resource.INCIDENT_WEBHOOK_SIGNING_SECRET.value).verify(
+      body,
+      Object.fromEntries(request.headers.entries()),
+    ) as IncidentWebhookPayload
+  } catch {
+    return undefined
+  }
+}
+
+const postDiscordMessage = async (incident: Incident) => {
+  return fetch(Resource.DISCORD_INCIDENT_WEBHOOK_URL.value, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({
+      content: [
+        `**${incident.mode === "test" ? "[TEST] " : ""}${incident.name ?? "Incident has been created"}**`,
+        incident.summary,
+        "",
+        "@everyone",
+        "",
+        incident.permalink,
+      ]
+        .filter((line) => line !== undefined)
+        .join("\n"),
+      allowed_mentions: {
+        parse: ["everyone"],
+      },
+      flags: 4,
+    }),
+  })
+}
+
+export async function POST(input: APIEvent) {
+  const payload = await verifyWebhook(input.request)
+  if (!payload) {
+    return Response.json({ message: "invalid signature" }, { status: 401 })
+  }
+
+  if (payload.event_type !== "public_incident.incident_created_v2") {
+    return Response.json({ message: "ignored event" }, { status: 200 })
+  }
+
+  const incident = payload["public_incident.incident_created_v2"]
+  if (!incident) {
+    return Response.json({ message: "missing incident" }, { status: 400 })
+  }
+
+  const response = await postDiscordMessage(incident)
+  if (!response.ok) {
+    return Response.json({ message: "discord webhook failed" }, { status: 502 })
+  }
+
+  return Response.json({ message: "sent" }, { status: 200 })
+}

packages/console/core/sst-env.d.ts

@@ -35,6 +35,10 @@ declare module "sst" {
       "type": "sst.cloudflare.SolidStart"
       "url": string
     }
+    "DISCORD_INCIDENT_WEBHOOK_URL": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
     "DISCORD_SUPPORT_BOT_TOKEN": {
       "type": "sst.sst.Secret"
       "value": string
@@ -87,6 +91,10 @@ declare module "sst" {
       "type": "sst.sst.Secret"
       "value": string
     }
+    "INCIDENT_WEBHOOK_SIGNING_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
     "R2AccessKey": {
       "type": "sst.sst.Secret"
       "value": string

packages/console/function/sst-env.d.ts

@@ -35,6 +35,10 @@ declare module "sst" {
       "type": "sst.cloudflare.SolidStart"
       "url": string
     }
+    "DISCORD_INCIDENT_WEBHOOK_URL": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
     "DISCORD_SUPPORT_BOT_TOKEN": {
       "type": "sst.sst.Secret"
       "value": string
@@ -87,6 +91,10 @@ declare module "sst" {
       "type": "sst.sst.Secret"
       "value": string
     }
+    "INCIDENT_WEBHOOK_SIGNING_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
     "R2AccessKey": {
       "type": "sst.sst.Secret"
       "value": string

packages/console/resource/sst-env.d.ts

@@ -35,6 +35,10 @@ declare module "sst" {
       "type": "sst.cloudflare.SolidStart"
       "url": string
     }
+    "DISCORD_INCIDENT_WEBHOOK_URL": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
     "DISCORD_SUPPORT_BOT_TOKEN": {
       "type": "sst.sst.Secret"
       "value": string
@@ -87,6 +91,10 @@ declare module "sst" {
       "type": "sst.sst.Secret"
       "value": string
     }
+    "INCIDENT_WEBHOOK_SIGNING_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
     "R2AccessKey": {
       "type": "sst.sst.Secret"
       "value": string