[server] add http endpoint workspacePageClose for beacon

[mustard-mh]

Description

Add HTTP endpoint for supervisor frontend to send heartbeat when user's leaving the browser

In the current implementation of supervisor-frontend, we will send some requests before/during browser unload, which may cause some data loss since requests will be canceled after 1 second once user close the tab.

gitpod/components/supervisor/frontend/src/ide/heart-beat.ts

Lines 45 to 58 in 00d5108

	const beforeUnloadListener = () => {
	unloadTimeout = setTimeout(() => {
	// if unload was cancelled then resume heartbeating
	sendHeartBeat();
	}, 2000);
	sendHeartBeat(true);
	};
	const unloadListener = () => {
	if (unloadTimeout) {
	clearTimeout(unloadTimeout);
	}
	}
	window.addEventListener('beforeunload', beforeUnloadListener);
	window.addEventListener('unload', unloadListener);

We will move those requests to use Navigator.sendBeacon to avoid data loss.

So this PR is going to add HTTP post endpoint for sendBeacon

see also internal chat

Related Issue(s)

Fixes #

How to test

• Open a workspace in preview env
• Get needed info from cookie (preview env logged in cookie and workspace auth cookie)
• CURL to see if API works

curl -X "POST" "https://hw-hb.preview.gitpod-dev.com/api/auth/workspacePageClose/<instance_id>" \
     -H 'Cookie: _hw_hb_preview_gitpod_dev_com_=****;_hw_hb_preview_gitpod_dev_com_ws_****_owner_=****' \
     -H 'Content-Type: application/json; charset=utf-8' \
     -d $'{
  "sessionId": "1"
}'

• Use gpctl workspaces last-heartbeat <instance_id> to see if heartbeat sent
• Use kubectl get pods ws-<instance_id> -oyaml | yq4 .metadata.annotations | grep closed to see if wasClosed works

Release Notes

NONE

Documentation

Werft options:

• /werft with-preview

[werft-gitpod-dev-com]

started the job as gitpod-build-hw-hb-server.1 because the annotations in the pull request description changed
(with .werft/ from main)

[akosyakov]

add http send heartbeat endpoint

Please make it sure to update the PR description to explain why we do it instead of using Gitpod API, i.e. it is not about general heartbeating, but making sure that we report close signal always. General heartbeating still happens using Gitpod API, but it is not reliable to use while page is unloading.

[andreafalzetti]

should this be log.warn(<context>, <message>)? [1]

I think userId, istanceId are part of LogContext

[mustard-mh]

@andreafalzetti See here

gitpod/components/server/src/user/user-controller.ts

Lines 205 to 208 in 9b46ff3

	log.warn("blocked user attempted to fetch workspace cookie", {
	instanceId: req.params.instanceID,
	userId: user.id,
	});

[mustard-mh]

I thought log support a lot of param pairs, and we used to make log string as first param in most cases

[mustard-mh]

I'm not quite sure if the order of params will affect the query in gcloud, I unresolved this conversation and maybe webApp team can answer us @andreafalzetti

[geropl]

I'm not quite sure if the order of params will affect the query in gcloud

@mustard-mh It does indeed.

we used to make log string as first param in most cases

That's not good. The expected order is: logContext, message, error, payload.

[akosyakov]

We need to test it coupled with supervisor-frontend. If it does not work there reliably, then this PR won't make sense.

[geropl]

Note: This line ensures that only the owner can access the sendHeartbeat method for their instances.

[akosyakov]

ouch, it is a valid point in case of live sharing cc @mustard-mh we need to check how construct proper guard similar how we do for web socket connections, i think there should be a service fro HTTP connections as well already

[geropl]

ouch, it is a valid point in case of live sharing

💡

This is the code we use for the websocket connection.

[geropl]

Code LGTM

[akosyakov]

@mustard-mh I just realised that it is wrong, i.e. if a user tries to access a workspace to which they don't have access it will pop up in our metrics like 500 (i.e. our failure), then it should be 403. Could you have a look sendHeartbeat method and translate exceptions properly? 🙏 cc @gitpod-io/engineering-webapp