Custom event tracking by marksmith · Pull Request #286 · AikidoSec/firewall-ruby

marksmith · 2026-05-27T15:06:11Z

This change adds support for tracking named user events, sent from application code using Aikido::Zen.track_user_event. User events include the event name, user ID, and IP address.

This change extends and should be reviewed after #285.

Summary by Aikido

Security Issues: 0	🔍 Quality Issues: 4	Resolved Issues: 0

🚀 New Features

Added user event tracking end-to-end with API and agent integration

⚡ Enhancements

Handled empty API responses and adjusted event send endpoint

^{More info}

codecov · 2026-05-28T08:22:58Z

Codecov Report

❌ Patch coverage is 66.66667% with 12 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
lib/aikido/zen/api_client.rb	56.25%	6 Missing and 1 partial ⚠️
lib/aikido/zen/agent.rb	50.00%	1 Missing and 2 partials ⚠️
lib/aikido/zen.rb	71.42%	0 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!

timokoessler · 2026-06-19T16:12:35Z

+
+      @config.logger.debug("Reporting #{event_type.upcase} event")
+
+      req = Net::HTTP::Post.new("/api/runtime/events", default_headers)


These events can only be sent to zen.aikido.dev, the old runtime API does not support this.

That's quite an important point for the other agents too. If the agent is unable to connect to zen.aikido.dev, we need to make it really clear that the user events aren't going to work. I wonder if we need a log here, @timokoessler?

Indeed, makes sense. Maybe log if user calls the track() API for the first time? cc. @hansott.

timokoessler · 2026-06-19T16:14:04Z

+    def send_user_event(event)
+      event_type = "user_event"
+
+      if @rate_limiter.throttle?(event_type)


As these events are not send to Aikido Core, maybe not re-use the same rate limiter? (I think this is the case)

aikido-pr-checks · 2026-07-15T07:56:16Z

        response = http.request(request)

        case response
+        when Net::HTTPNoContent


Empty when Net::HTTPNoContent branch is verbose; combine Net::HTTPNoContent with Net::HTTPSuccess in the same when clause or explicitly return nil to simplify the case handling.

Details

✨ AI Reasoning
In the request method an explicit when branch for Net::HTTPNoContent is added with an empty body. This is more verbose than necessary: treating Net::HTTPNoContent together with Net::HTTPSuccess (and handling the empty-body case by returning nil) is a simpler, equally readable approach. Combining them would reduce the number of case arms and clarify intent.

🔧 How do I fix it?
Rewrite the snippet in the simpler, behavior-equivalent form: return a boolean expression directly instead of if cond return true else return false, avoid using lists when they are guaranteed to contain one element, etc.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-07-15T07:56:17Z

      raise
    end

+    def send_user_event(event)


APIClient#send_user_event overlaps in name with APIClient#report but uses a different endpoint and behavior; clarify intent or rename to reflect the specialized behavior (e.g., post_user_event_to_realtime).

Suggested change

def send_user_event(event)

# Posts a user event to the realtime settings updates endpoint, using

# separate rate limiting from standard event reporting.

def send_user_event(event)

Details

✨ AI Reasoning
APIClient#send_user_event was added to send user events but its behavior differs from APIClient#report (different rate-limiter key, different base_url). The method name closely resembles report, making the distinct responsibilities unclear without inspecting implementation.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-07-15T07:56:19Z

      end
    end

+    # @param event [Aikido::Zen::Tracked]


Agent#send_user_event purpose is unclear relative to Agent#report. Clarify how it differs (intent, lifecycle, and expected callers) and fix the incorrect/undefined doc type Aikido::Zen::Tracked.

Show fix

Suggested change

# @param event [Aikido::Zen::Tracked]

# Asynchronously sends user-triggered events to Aikido, skipping enqueue

# if reporting is disabled.

#

# @param event [Object] a user event payload.

Details

✨ AI Reasoning
A method was added that enqueues and sends user events from the Agent layer. Its name send_user_event overlaps with the existing report method, and the doc annotation references Aikido::Zen::Tracked (not defined here). It's not obvious how send_user_event differs from report or when to use one vs the other without reading its implementation.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

timokoessler · 2026-07-22T14:42:01Z

    end
  end
+
+  class UserEvent


Todo: This event needs to be updated to follow new spec: https://github.com/AikidoSec/zen-specs/blob/main/features/custom_event_tracking.md

marksmith requested review from hansott and tomaisthorpe May 27, 2026 15:06

aikido-pr-checks Bot reviewed May 27, 2026

View reviewed changes

Comment thread lib/aikido/zen/agent.rb Outdated

marksmith force-pushed the custom-event-tracking branch 2 times, most recently from 17f3482 to 23ffc5f Compare May 28, 2026 08:21

marksmith force-pushed the custom-event-tracking branch from 23ffc5f to 29ebef3 Compare May 29, 2026 11:22

marksmith force-pushed the custom-event-tracking branch 4 times, most recently from 925d1bd to 03c8326 Compare June 19, 2026 15:42

marksmith requested a review from timokoessler June 19, 2026 15:57

timokoessler reviewed Jun 19, 2026

View reviewed changes

marksmith force-pushed the custom-event-tracking branch 3 times, most recently from 03c8326 to a13654a Compare June 26, 2026 12:20

aikido-pr-checks Bot reviewed Jun 26, 2026

View reviewed changes

Comment thread lib/aikido/zen.rb

marksmith force-pushed the custom-event-tracking branch 2 times, most recently from 8bf6fbd to 306b86f Compare June 30, 2026 08:43

marksmith added 4 commits July 15, 2026 09:55

Add track user events

dcc8521

Add test

2457241

Fix endpoint for send user events

a724e0a

Fix test

e32b408

marksmith force-pushed the custom-event-tracking branch from c71014a to e32b408 Compare July 15, 2026 07:55

aikido-pr-checks Bot reviewed Jul 15, 2026

View reviewed changes

timokoessler reviewed Jul 22, 2026

View reviewed changes

Navigation Menu

Uh oh!

Custom event tracking - #286

Custom event tracking#286
marksmith wants to merge 4 commits into
mainfrom
custom-event-tracking

marksmith commented May 27, 2026 •

edited by aikido-pr-checks Bot

Loading

Uh oh!

Uh oh!

codecov Bot commented May 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

timokoessler Jun 19, 2026

Uh oh!

tomaisthorpe Jun 22, 2026

Uh oh!

timokoessler Jun 22, 2026

Uh oh!

timokoessler Jun 19, 2026

Uh oh!

Uh oh!

aikido-pr-checks Bot Jul 15, 2026

Uh oh!

aikido-pr-checks Bot Jul 15, 2026 •

edited

Loading

Uh oh!

aikido-pr-checks Bot Jul 15, 2026 •

edited

Loading

Uh oh!

timokoessler Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		@config.logger.debug("Reporting #{event_type.upcase} event")

		req = Net::HTTP::Post.new("/api/runtime/events", default_headers)

-    # @param event [Aikido::Zen::Tracked]
+    # Asynchronously sends user-triggered events to Aikido, skipping enqueue
+    # if reporting is disabled.
+    #
+    # @param event [Object] a user event payload.

Uh oh!

Conversation

marksmith commented May 27, 2026 • edited by aikido-pr-checks Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by Aikido

Uh oh!

Uh oh!

codecov Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

timokoessler Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

tomaisthorpe Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

timokoessler Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

timokoessler Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

aikido-pr-checks Bot Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

timokoessler Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

marksmith commented May 27, 2026 •

edited by aikido-pr-checks Bot

Loading

codecov Bot commented May 28, 2026 •

edited

Loading

aikido-pr-checks Bot Jul 15, 2026 •

edited

Loading

aikido-pr-checks Bot Jul 15, 2026 •

edited

Loading