feat(telemetry): report CloudUserId on telemetry events from the auth token (#497)

Sandeepan-Ghosh-0312 · claude · web-flow · commit 0902cc5c3d8d · 2026-06-10T15:33:11.000+05:30
Co-authored-by: Claude Opus 4.8 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -226,7 +226,7 @@
         "test:coverage": "vitest --coverage"
     },
     "dependencies": {
-        "@uipath/core-telemetry": "^1.0.0-beta.2",
+        "@uipath/core-telemetry": "^1.0.0-beta.3",
         "socket.io-client": "^4.8.1"
     },
     "peerDependencies": {
diff --git a/packages/coded-action-app/package-lock.json b/packages/coded-action-app/package-lock.json
diff --git a/packages/coded-action-app/package.json b/packages/coded-action-app/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@uipath/coded-action-app",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0-beta.2",
   "description": "UiPath package to be used for viewing coded action apps in Action Center",
   "license": "MIT",
   "type": "module",
@@ -32,7 +32,7 @@
     "lint": "oxlint"
   },
   "dependencies": {
-    "@uipath/core-telemetry": "^1.0.0-beta.2"
+    "@uipath/core-telemetry": "^1.0.0-beta.3"
   },
   "devDependencies": {
     "@rollup/plugin-commonjs": "^25.0.0",
diff --git a/packages/coded-action-app/src/coded-action-app-service.ts b/packages/coded-action-app/src/coded-action-app-service.ts
@@ -4,7 +4,11 @@ import {
   TaskCompleteResponse,
 } from './types';
 import { CodedActionAppServiceModel } from './coded-action-app.models';
-import { ActionCenterEventNames, ActionCenterEventResponsePayload } from './types.internal';
+import {
+  ActionCenterEventNames,
+  ActionCenterEventResponsePayload,
+  TaskWithCloudUserId,
+} from './types.internal';
 import { telemetryClient, track } from './telemetry';
 import { loadFromMetaTags } from './telemetry/runtime';
 
@@ -18,7 +22,12 @@ export class CodedActionAppService implements CodedActionAppServiceModel {
   private isCompletingTask = false;
 
   constructor() {
-    telemetryClient.initialize(loadFromMetaTags() ?? undefined);
+    const metaConfig = loadFromMetaTags();
+    telemetryClient.initialize(
+      metaConfig
+        ? { ...metaConfig, orgId: metaConfig.orgName, tenantId: metaConfig.tenantName }
+        : undefined,
+    );
   }
 
   /**
@@ -111,7 +120,10 @@ export class CodedActionAppService implements CodedActionAppServiceModel {
         clearTimeout(timer);
 
         this.cleanup(messageListener);
-        resolve(event.data?.content as Task);
+
+        const task = event.data?.content as TaskWithCloudUserId;
+        telemetryClient.setUserId(task?.cloudUserId ?? '');
+        resolve(task);
       };
 
       const timer = setTimeout(() => {
diff --git a/packages/coded-action-app/src/telemetry/constants.ts b/packages/coded-action-app/src/telemetry/constants.ts
@@ -11,3 +11,4 @@ export const SDK_SERVICE_NAME = 'UiPath.CodedActionApp.Sdk';
 export const CLOUD_ROLE_NAME = 'uipath-coded-action-app-sdk';
 export const SDK_LOGGER_NAME = 'uipath-coded-action-app-telemetry';
 export const SDK_RUN_EVENT = 'CodedActionApp.Sdk.Run';
+export const TS_SDK_CLOUD_ROLE_NAME = 'uipath-ts-sdk';
diff --git a/packages/coded-action-app/src/telemetry/index.ts b/packages/coded-action-app/src/telemetry/index.ts
@@ -20,6 +20,7 @@ import {
     SDK_RUN_EVENT,
     SDK_SERVICE_NAME,
     SDK_VERSION,
+    TS_SDK_CLOUD_ROLE_NAME,
 } from './constants';
 
 /** Keyed by `CLOUD_ROLE_NAME` so all CodedActionApp SDK module loads share a single `TelemetryClient`. Each SDK uses
@@ -41,4 +42,13 @@ export const telemetryClient = {
             context,
         });
     },
+
+    /**
+     * Sets the authenticated user's id so completeTask event and all ts-sdk api calls
+     * carry it as `CloudUserId`.
+     */
+    setUserId(userId: string): void {
+        codedActionAppTelemetryClient.setUserId(userId);
+        getOrCreateClient(TS_SDK_CLOUD_ROLE_NAME).setUserId(userId);
+    },
 };
diff --git a/packages/coded-action-app/src/types.internal.ts b/packages/coded-action-app/src/types.internal.ts
@@ -10,7 +10,14 @@ export enum ActionCenterEventNames {
   COMPLETERESPONSE = 'AC.completeResponse',
 }
 
+/**
+ * Task content as delivered by Action Center on the `LOADAPP` event. Carries
+ * the hidden `cloudUserId` that is reported as `CloudUserId` on telemetry
+ * events but is intentionally absent from the public {@link Task} contract.
+ */
+export type TaskWithCloudUserId = Task & { cloudUserId?: string };
+
 export type ActionCenterEventResponsePayload = {
   eventType: ActionCenterEventNames;
-  content: Task | TaskCompleteResponse;
+  content: TaskWithCloudUserId | TaskCompleteResponse;
 };
diff --git a/src/core/auth/token-manager.ts b/src/core/auth/token-manager.ts
@@ -8,6 +8,8 @@ import { AuthenticationError, HttpStatus } from '../errors';
 import { ActionCenterTokenManager } from './action-center-token-manager';
 import { EmbeddedTokenManager } from './embedded-token-manager';
 import { isValidHostOrigin } from './host-token-request';
+import { telemetryClient } from '../telemetry';
+import { extractUserIdFromToken } from '../../utils/encoding';
 
 /**
  * TokenManager is responsible for managing authentication tokens.
@@ -269,6 +271,7 @@ export class TokenManager {
    */
   private _updateExecutionContext(tokenInfo: TokenInfo): void {
     this.executionContext.set('tokenInfo', tokenInfo);
+    telemetryClient.setUserId(extractUserIdFromToken(tokenInfo.token));
   }
 
   /**
diff --git a/src/core/telemetry/index.ts b/src/core/telemetry/index.ts
@@ -42,4 +42,12 @@ export const telemetryClient = {
             context,
         });
     },
+
+    /**
+     * Sets the authenticated user's id so every subsequently emitted event
+     * carries it as `CloudUserId`.
+     */
+    setUserId(userId: string): void {
+        sdkClient.setUserId(userId);
+    },
 };
diff --git a/src/core/uipath.ts b/src/core/uipath.ts
@@ -52,6 +52,13 @@ export class UiPath implements IUiPath {
   // deployments). Not accepted via the public constructor; lives here so the
   // SDK can flow it through to BaseService.config without polluting BaseConfig.
   #metaFolderKey?: string;
+  // Org/tenant ids captured from the meta tags before the constructor config
+  // is merged in. The `uipath:org-name`/`uipath:tenant-name` meta tags always
+  // carry org/tenant *ids* in coded-app deployments, whereas a
+  // constructor-supplied `orgName`/`tenantName` may be actual names — so the
+  // telemetry ids must be read from the meta tags.
+  #metaOrgId?: string;
+  #metaTenantId?: string;
 
   /** Read-only config for user convenience */
   public readonly config!: Readonly<BaseConfig>;
@@ -60,6 +67,8 @@ export class UiPath implements IUiPath {
     // Load configuration from meta tags
     const configFromMetaTags = loadFromMetaTags();
     this.#metaFolderKey = configFromMetaTags?.folderKey;
+    this.#metaOrgId = configFromMetaTags?.orgName;
+    this.#metaTenantId = configFromMetaTags?.tenantName;
 
     // Merge configuration: constructor config overrides meta tags
     const mergedConfig = config ? { ...configFromMetaTags, ...config } : configFromMetaTags;
@@ -113,9 +122,11 @@ export class UiPath implements IUiPath {
       tenantName: internalConfig.tenantName
     };
 
-    // Initialize telemetry with SDK configuration
+    // Initialize telemetry with SDK configuration.
     telemetryClient.initialize({
       baseUrl: config.baseUrl,
+      orgId: this.#metaOrgId,
+      tenantId: this.#metaTenantId,
       orgName: config.orgName,
       tenantName: config.tenantName,
       clientId: hasOAuthAuth ? config.clientId : undefined,
@@ -138,6 +149,8 @@ export class UiPath implements IUiPath {
     // Load from meta tags
     const metaConfig = loadFromMetaTags();
     this.#metaFolderKey = metaConfig?.folderKey;
+    this.#metaOrgId = metaConfig?.orgName;
+    this.#metaTenantId = metaConfig?.tenantName;
 
     // Merge with any partial config from constructor (constructor overrides meta tags)
     const merged = { ...metaConfig, ...this.#partialConfig };
diff --git a/src/utils/encoding/index.ts b/src/utils/encoding/index.ts
@@ -1,2 +1,3 @@
 export * from './base64';
 export * from './folder-path';
+export * from './jwt';
diff --git a/src/utils/encoding/jwt.ts b/src/utils/encoding/jwt.ts
@@ -0,0 +1,39 @@
+/**
+ * JWT decoding helpers — payload inspection only, no signature verification.
+ */
+import { decodeBase64 } from './base64';
+
+const BASE64URL_DASH_RE = /-/g;
+const BASE64URL_UNDERSCORE_RE = /_/g;
+
+/**
+ * Converts a base64url-encoded JWT segment to standard base64 with padding.
+ */
+function base64UrlToBase64(value: string): string {
+  const base64 = value
+    .replace(BASE64URL_DASH_RE, '+')
+    .replace(BASE64URL_UNDERSCORE_RE, '/');
+  return base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');
+}
+
+/**
+ * Extracts the user id (`sub` claim) from a JWT access token payload.
+ * Returns an empty string for opaque (non-JWT) tokens or malformed payloads.
+ *
+ * @param token - The access token to inspect
+ * @returns The user id, or an empty string if it cannot be extracted
+ */
+export function extractUserIdFromToken(token: string): string {
+  try {
+    const payload = token.split('.')[1];
+    if (!payload) {
+      return '';
+    }
+
+    const claims = JSON.parse(decodeBase64(base64UrlToBase64(payload))) as Record<string, unknown>;
+    const sub = claims['sub'];
+    return typeof sub === 'string' && sub ? sub : '';
+  } catch {
+    return '';
+  }
+}
diff --git a/tests/unit/core/auth/token-manager-telemetry.test.ts b/tests/unit/core/auth/token-manager-telemetry.test.ts
@@ -0,0 +1,69 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { TokenManager } from '@/core/auth/token-manager';
+import { ExecutionContext } from '@/core/context/execution';
+import type { Config } from '@/core/config/config';
+import { telemetryClient } from '@/core/telemetry';
+import { TEST_CONSTANTS } from '@tests/utils/constants/common';
+import { TEST_USER_ID, createTestJwt } from '@tests/utils/jwt';
+
+// ---------------------------------------------------------------------------
+// Mock platform — plain (non-embedded, non-Action-Center) environment
+// ---------------------------------------------------------------------------
+vi.mock('@/utils/platform', () => ({
+  isBrowser: false,
+  isInActionCenter: false,
+  isHostEmbedded: false,
+  embeddingOrigin: null,
+}));
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function makeManager() {
+  const context = new ExecutionContext();
+  const config: Config = {
+    baseUrl: TEST_CONSTANTS.BASE_URL,
+    orgName: TEST_CONSTANTS.ORGANIZATION_ID,
+    tenantName: TEST_CONSTANTS.TENANT_ID,
+    secret: TEST_CONSTANTS.CLIENT_SECRET,
+  };
+  return new TokenManager(context, config, false);
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+describe('TokenManager — telemetry user id wiring', () => {
+  let setUserIdSpy!: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    setUserIdSpy = vi.spyOn(telemetryClient, 'setUserId').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    setUserIdSpy.mockRestore();
+  });
+
+  it('feeds the user id extracted from a JWT token to telemetry on setToken', () => {
+    const manager = makeManager();
+
+    manager.setToken({
+      token: createTestJwt({ sub: TEST_USER_ID }),
+      type: 'oauth',
+    });
+
+    expect(setUserIdSpy).toHaveBeenCalledTimes(1);
+    expect(setUserIdSpy).toHaveBeenCalledWith(TEST_USER_ID);
+  });
+
+  it('feeds an empty user id to telemetry for an opaque (non-JWT) token', () => {
+    const manager = makeManager();
+
+    manager.setToken({
+      token: 'rt_opaque-personal-access-token',
+      type: 'secret',
+    });
+
+    expect(setUserIdSpy).toHaveBeenCalledWith('');
+  });
+});
diff --git a/tests/unit/core/uipath.test.ts b/tests/unit/core/uipath.test.ts
diff --git a/tests/unit/utils/encoding/jwt.test.ts b/tests/unit/utils/encoding/jwt.test.ts
diff --git a/tests/utils/jwt.ts b/tests/utils/jwt.ts
