Changelog
Built ontransports/v1.5.16, this release adds richer observability and cost attribution, makes SCIM provisioning durable and resumable, surfaces clearer conflict errors across the dashboard, and tightens access-profile and cluster behavior.✨ Features
- Business-unit & user attribution in traces - The BigQuery and Datadog plugins now carry
business_unit_id,business_unit_name,user_id, anduser_name, so cost and usage can be sliced by org unit and by individual. Fields are added to the BigQueryTraceRowschema/proto/Save()map and as Datadog metric and span tags. - Durable background job runner for SCIM provisioning - Provisioning (user import, team sync, business-unit sync) now runs as resumable background jobs via a new
sidekiqrunner that persists state to asidekiqtable and checkpoints after each page. Every IdP (Okta, Entra, Google, Keycloak, Zitadel, SailPoint) gains a paginatedFetchUsersPage. The import/sync handlers return202with anoperation_id, andGET /api/scim/provision/jobs/{operation_id}exposes job status; progress is still broadcast over WebSocket and relayed to peer nodes in clustered deployments. - Datadog session-grouped traces - A new
group_traces_by_sessionoption groups all requests sharing the samex-bf-session-idheader into a single Datadog APM trace, by pinning each request’s root span to a deterministic trace ID derived from the session ID via SHA-256. An inbound W3Ctraceparentalways takes precedence. - Cluster node region exposed - Each node’s
region(from gossip metadata) is now returned by the cluster API and rendered in the node card footer and dead/orphan side panel in the UI (omitted when empty). Updatepermission on the Logs resource - Adds(Logs, Update)to RBAC and grants it to Admin soPOST /api/logs/recalculate-costis reachable. Ships with theent_add_logs_update_permissionmigration to grant it on existing installs.- Inline name-conflict errors -
409conflict responses now render inline beneath the name input for access profiles, API keys, MCP tool groups, prompt deployments, roles, business units, and teams, instead of a generic toast. The error clears when the name is edited or the sheet is reopened. - Auto-assign access profile to existing role members - When a role’s access profile is set via config-file reconciliation, existing holders of that role now get virtual keys created and the access profile assigned, matching the API handler path.
- Group search in sync filters - The provisioning sync sheet gains a real-time group search input, a “No groups match your search” empty state, a total group count on “Sync from all”, and an
X of Y groups selectedindicator.
🐞 Fixed
- Governance access-profile reload ghost rebase - Access-profile reloads no longer double-count ghost-node usage after save/propagate. Reloads now split into a per-node config/mapping refresh and a leader-only usage baseline rebase.
409 Conflicton duplicate names - Unique-constraint (duplicate name) violations across resource create/update endpoints now return409 Conflictinstead of500(API keys, business units, guardrail rules, MCP tool groups, RBAC roles, users, teams).- Okta provisioning robustness - Multi-group users are deduplicated so
Processedcounts unique users; the client honors Okta’sRetry-Afteron429(falling back to exponential backoff); andgetNextLinkusesPeekAllto handle multiple separateLinkheaders. - List Models access-profile filtering -
ListModelsRequestnow bypasses provider/model allowlist enforcement (skipProviderCheck), fixing spurious “model not allowed” errors and AP model filtering when no virtual key is present.
📀 Base OSS version
transports/v1.5.16