Add per-user SigNoz auth via backend-for-frontend broker

Dakota Duxrequested to merge
o11y-bff-broker into master

What does this MR do?

Third MR in the observability BFF session broker split (database → settings/config → backend → frontend). Targets !249287 (merged) (settings/config), which in turn targets !249286 (merged) (database).

Adds the observability_per_user_bff_auth SG:learned:4486edad9404 feature flag and the backend session broker it gates:

  • Observability::O11yBffSession, which mints a per-user Doorkeeper access token, signs the user's role and instance into a GitLab BFF id_token (with jti + short TTL for replay protection), and POSTs it to the SigNoz BFF session-exchange endpoint over mTLS using the Settings.observability.bff_mtls client cert (added in !249287 (merged)).
  • Observability::SessionActions and Observability::ShowActions concerns shared between the group- and project-scoped observability controllers, extracted to remove duplication between them.
  • New sessions#create endpoints (group and project scoped) that call O11yBffSession and return the resulting tokens as JSON, rate-limited per-user via a new observability_bff_session rate limit rule.
  • The session_endpoint local threaded through the shared iframe partial so the frontend (follow-up MR) can call the new endpoint.
  • Fixed a personal-namespace authorization gap in Projects::Observability::SessionsController (see review discussion) so the endpoint works consistently with the main iframe controller.

References

Security considerations

This MR handles mTLS client certs, mints Doorkeeper access tokens, and signs custom JWT claims (role, instance, jti) into a BFF id_token used for auth. Requesting AppSec review.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Dakota Dux

Merge request reports