datadog 2.30.0 → 2.31.0

data/lib/datadog/ai_guard.rb

@@ -10,7 +10,7 @@ module Datadog
   module AIGuard
     Core::Configuration::Settings.extend(Configuration::Settings)
 
-    # This error is raised when user passes `allow_raise: true` to Evaluation.perform
+    # This error is raised when `allow_raise` is set to true (the default) in Evaluation.perform
     # and AI Guard considers the messages not safe. Intended to be rescued by the user.
     #
     # WARNING: This name must not change, since front-end is using it.
@@ -68,13 +68,14 @@ module Datadog
       #   One or more message objects to be evaluated.
       # @param allow_raise [Boolean]
       #   Whether this method may raise an exception when evaluation result is not ALLOW.
+      #   Defaults to true.
       #
       # @return [Datadog::AIGuard::Evaluation::Result]
       #   The result of AI Guard evaluation.
       # @raise [Datadog::AIGuard::AIGuardAbortError]
       #   If the evaluation results in DENY or ABORT action and `allow_raise` is set to true
       # @public_api
-      def evaluate(*messages, allow_raise: false)
+      def evaluate(*messages, allow_raise: true)
         if enabled?
           Evaluation.perform(messages, allow_raise: allow_raise)
         else
@@ -84,25 +85,42 @@ module Datadog
 
       # Builds a generic evaluation message.
       #
-      # Example:
+      # Accepts either a string content or a block for multi-modal content parts:
       #
       # ```
+      # # String content:
       # Datadog::AIGuard.message(role: :user, content: "Hello, assistant")
+      #
+      # # Multi-modal content with block:
+      # Datadog::AIGuard.message(role: :user) do |m|
+      #   m.text("What's in this image?")
+      #   m.image_url("https://example.com/img.png")
+      # end
       # ```
       #
       # @param role [Symbol]
       #   The role associated with the message.
       #   Must be one of `:assistant`, `:tool`, `:system`, `:developer`, or `:user`.
-      # @param content [String]
-      #   The textual content of the message.
+      # @param content [String, nil]
+      #   The textual content of the message. Cannot be combined with a block.
+      # @yield [builder] A block for building multi-modal content parts.
+      # @yieldparam builder [Datadog::AIGuard::Evaluation::ContentBuilder]
       #
       # @return [Datadog::AIGuard::Evaluation::Message]
       #   A new message instance with the given role and content.
       # @raise [ArgumentError]
-      #   If an invalid role is provided.
+      #   If both content and a block are provided, or if an invalid role is provided.
       # @public_api
-      def message(role:, content:)
-        Evaluation::Message.new(role: role, content: content)
+      def message(role:, content: nil)
+        if block_given?
+          raise ArgumentError, "Cannot pass both content and a block" if content
+
+          builder = Evaluation::ContentBuilder.new
+          yield builder
+          Evaluation::Message.new(role: role, content: builder.parts)
+        else
+          Evaluation::Message.new(role: role, content: content)
+        end
       end
 
       # Builds an assistant message representing a tool call initiated by the model.

data/lib/datadog/appsec/autoload.rb

@@ -7,7 +7,7 @@ if %w[1 true].include?((Datadog::DATADOG_ENV['DD_APPSEC_ENABLED'] || '').downcas
   rescue => e
     Kernel.warn(
       '[datadog] AppSec failed to instrument. No security check will be performed. error: ' \
-      " #{e.class.name} #{e.message}"
+      " #{e.class}: #{e}"
     )
   end
 end

data/lib/datadog/appsec/component.rb

@@ -45,10 +45,15 @@ module Datadog
           settings.appsec.instrument(:devise) unless devise_integration.patcher.patched?
 
           security_engine = SecurityEngine::Engine.new(appsec_settings: settings.appsec, telemetry: telemetry)
-          new(security_engine: security_engine, telemetry: telemetry)
-        rescue
-          Datadog.logger.warn('AppSec is disabled, see logged errors above')
-
+          new(security_engine: security_engine)
+        rescue => e
+          Datadog.logger.warn("AppSec is disabled: #{e.class}: #{e}; there may be additional logged errors above")
+
+          # Not reporting to telemetry here because some of the rescued exceptions
+          # have already been reported by the code that raised them
+          # (e.g. SecurityEngine::Engine.new reports WAF init failures).
+          # TODO: reconsider whether telemetry reporting belongs here
+          # (single catch-all) or in the downstream code (as it is now).
           nil
         end
 
@@ -70,11 +75,10 @@ module Datadog
         end
       end
 
-      attr_reader :security_engine, :telemetry
+      attr_reader :security_engine
 
-      def initialize(security_engine:, telemetry:)
+      def initialize(security_engine:)
         @security_engine = security_engine
-        @telemetry = telemetry
       end
 
       def reconfigure!

data/lib/datadog/appsec/contrib/rack/gateway/request.rb

@@ -25,7 +25,7 @@ module Datadog
             def query
               ::Rack::Utils.parse_query(request.query_string)
             rescue => e
-              Datadog.logger.debug { "AppSec: Failed to parse request query string: #{e.class}: #{e.message}" }
+              Datadog.logger.debug { "AppSec: Failed to parse request query string: #{e.class}: #{e}" }
               AppSec.telemetry.report(e, description: 'AppSec: Failed to parse request query string')
 
               {}

data/lib/datadog/appsec/contrib/rack/gateway/watcher.rb

@@ -116,17 +116,16 @@ module Datadog
                 gateway.watch('rack.request.finish') do |stack, gateway_request|
                   context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
 
-                  if context.span.nil? || !gateway.pushed?('appsec.events.user_lifecycle')
-                    next stack.call(gateway_request.request)
-                  end
+                  next stack.call(gateway_request.request) if context.span.nil?
 
                   gateway_request.headers.each do |name, value|
-                    if !Ext::COLLECTABLE_REQUEST_HEADERS.include?(name) &&
-                        !Ext::IDENTITY_COLLECTABLE_REQUEST_HEADERS.include?(name)
-                      next
+                    if Ext::COLLECTABLE_REQUEST_HEADERS.include?(name)
+                      context.span["http.request.headers.#{name}"] ||= value
                     end
 
-                    context.span["http.request.headers.#{name}"] ||= value
+                    if context.state[:has_identity_event] && Ext::IDENTITY_COLLECTABLE_REQUEST_HEADERS.include?(name)
+                      context.span["http.request.headers.#{name}"] ||= value
+                    end
                   end
 
                   stack.call(gateway_request.request)

data/lib/datadog/appsec/contrib/rails/patcher.rb

@@ -138,7 +138,7 @@ module Datadog
               end
             rescue => e
               error_message = 'Failed to get application routes'
-              Datadog.logger.error("#{error_message}, #{e.class}: #{e.message}")
+              Datadog.logger.error("#{error_message}, #{e.class}: #{e}")
               AppSec.telemetry.report(e, description: error_message)
             end
           end
@@ -148,7 +148,7 @@ module Datadog
               Datadog::AppSec::Contrib::Rails::Patcher.report_routes_via_telemetry(::Rails.application.routes.routes)
             rescue => e
               error_message = 'Failed to get application routes'
-              Datadog.logger.error("#{error_message}, #{e.class}: #{e.message}")
+              Datadog.logger.error("#{error_message}, #{e.class}: #{e}")
               AppSec.telemetry.report(e, description: error_message)
             end
           end

data/lib/datadog/appsec/instrumentation/gateway.rb

@@ -10,18 +10,9 @@ module Datadog
       class Gateway
         def initialize
           @middlewares = Hash.new { |h, k| h[k] = [] }
-          @pushed_events = {}
         end
 
-        # NOTE: Be careful with pushed names because every pushed event name
-        #       is recorded in order to provide an ability to any subscriber
-        #       to check wether an arbitrary event had happened.
-        #
-        # WARNING: If we start pushing generated names we should consider
-        #          limiting the storage of pushed names.
         def push(name, env, &block)
-          @pushed_events[name] = true
-
           block ||= -> {}
           middlewares_for_name = @middlewares[name]
 
@@ -44,10 +35,6 @@ module Datadog
         def watch(name, &block)
           @middlewares[name] << Middleware.new(&block)
         end
-
-        def pushed?(name)
-          @pushed_events.key?(name)
-        end
       end
 
       # NOTE: This left as-is and will be depricated soon.

data/lib/datadog/appsec/monitor/gateway/watcher.rb

@@ -26,6 +26,7 @@ module Datadog
             def watch_user_id(gateway = Instrumentation.gateway)
               gateway.watch('identity.set_user') do |stack, user|
                 context = AppSec.active_context
+                context.state[:has_identity_event] = true
 
                 if user.id.nil? && user.login.nil? && user.session_id.nil?
                   Datadog.logger.debug { 'AppSec: skipping WAF check because no user information was provided' }
@@ -57,6 +58,7 @@ module Datadog
             def watch_user_login(gateway = Instrumentation.gateway)
               gateway.watch('appsec.events.user_lifecycle') do |stack, kind|
                 context = AppSec.active_context
+                context.state[:has_identity_event] = true
 
                 next stack.call(kind) unless WATCHED_LOGIN_EVENTS.include?(kind)
 

data/lib/datadog/appsec/utils/http/media_type.rb

@@ -68,8 +68,7 @@ module Datadog
                 name.downcase! # steep:ignore NoMethod
                 value.downcase!
 
-                # See https://github.com/soutaro/steep/issues/2051
-                parameters[name] = value # steep:ignore ArgumentTypeMismatch
+                parameters[name] = value
               end
             end
 

data/lib/datadog/appsec/utils/http/url_encoded.rb

@@ -30,9 +30,9 @@ module Datadog
               #
               # @type var key: ::String
               # @type var value: ::String
-              key, value = pair.split('=', 2).map! do |value| #: ::String
+              key, value = pair.split('=', 2).map! do |value|
                 CGI.unescape(value)
-              end
+              end #: [::String, ::String]
 
               if (stored = memo[key])
                 if stored.is_a?(Array)

data/lib/datadog/appsec.rb

@@ -11,25 +11,21 @@ module Datadog
   module AppSec
     class << self
       def enabled?
-        Datadog.configuration.appsec.enabled
+        !!components.appsec
       end
 
       def rasp_enabled?
-        Datadog.configuration.appsec.rasp_enabled
+        # TODO this should take rasp_enabled flag from the settings in
+        # the appsec component rather than reading global configuration.
+        enabled? && Datadog.configuration.appsec.rasp_enabled
       end
 
       def active_context
         Datadog::AppSec::Context.active
       end
 
-      # NOTE:  This is a temporary workaround for type checking.
-      #
-      #        We want to move from possible nil-component to the disabled-component
-      #        on an initialization error. Technically, telemetry will be never
-      #        used if AppSec was not able to initialize, so it's safe to assume
-      #        that telemetry will never be used and will be nil at the same time.
       def telemetry
-        components.appsec&.telemetry || components.telemetry
+        components.telemetry
       end
 
       def security_engine

data/lib/datadog/core/configuration/base.rb

@@ -24,9 +24,21 @@ module Datadog
           # e.g. `settings :foo { option :bar }` --> `config.foo.bar`
           # @param [Symbol] name option name. Methods will be created based on this name.
           def settings(name, &block)
-            settings_class = new_settings_class(name, &block)
-
-            option(name) do |o|
+            nested_settings_path = settings_path ? "#{settings_path}.#{name}" : name.to_s
+            settings_class = new_settings_class(name, nested_settings_path, &block)
+            # Record the child settings class on the owning class so
+            # Options::ClassMethods#settings_path= can later propagate any path
+            # changes down to nested settings classes.
+            #
+            # Example:
+            #   settings :cache_key { option :enabled }
+            # creates a child class whose initial settings_path is "cache_key".
+            # If a contrib integration later assigns the parent path to
+            # "tracing.active_support", settings_children lets us update the
+            # nested class to "tracing.active_support.cache_key" as well.
+            settings_children[name] = settings_class
+
+            option(name, is_settings: true) do |o|
               o.default { settings_class.new }
 
               o.resetter do |value|
@@ -40,9 +52,9 @@ module Datadog
 
           private
 
-          def new_settings_class(name, &block)
+          def new_settings_class(name, settings_path, &block)
             Class.new { include Configuration::Base }.tap do |klass|
-              klass.instance_variable_set(:@settings_name, name)
+              klass.instance_variable_set(:@settings_path, settings_path)
               klass.instance_eval(&block) if block
             end
           end

data/lib/datadog/core/configuration/components.rb

@@ -12,6 +12,7 @@ require_relative '../telemetry/component'
 require_relative '../workers/runtime_metrics'
 require_relative '../remote/component'
 require_relative '../utils/at_fork_monkey_patch'
+require_relative '../utils/spawn_monkey_patch'
 require_relative '../utils/only_once'
 require_relative '../../tracing/component'
 require_relative '../../profiling/component'
@@ -22,6 +23,7 @@ require_relative '../../open_feature/component'
 require_relative '../../error_tracking/component'
 require_relative '../crashtracking/component'
 require_relative '../environment/agent_info'
+require_relative '../environment/identity'
 require_relative '../process_discovery'
 require_relative '../../data_streams/processor'
 
@@ -31,7 +33,7 @@ module Datadog
       # Global components for the trace library.
       class Components
         # Class-level constant to ensure fork patch is applied only once
-        AT_FORK_ONLY_ONCE = Utils::OnlyOnce.new
+        PATCH_ONLY_ONCE = Utils::OnlyOnce.new
 
         class << self
           def build_health_metrics(settings, logger, telemetry)
@@ -128,8 +130,11 @@ module Datadog
           Deprecations.log_deprecations_from_all_sources(@logger)
 
           # Register fork handling once globally
-          self.class::AT_FORK_ONLY_ONCE.run do
+          self.class::PATCH_ONLY_ONCE.run do
             Utils::AtForkMonkeyPatch.apply!
+            Utils::SpawnMonkeyPatch.apply!(
+              lineage_envs_provider: Core::Environment::Identity.method(:runtime_propagation_envs),
+            )
 
             # Register callback that calls Components.after_fork
             Utils::AtForkMonkeyPatch.at_fork(:child) do
@@ -172,6 +177,11 @@ module Datadog
 
           # Configure non-privileged components.
           Datadog::Tracing::Contrib::Component.configure(settings)
+
+          # Load the core Rails Railtie when Rails is present so all products benefit from Rails-specific setup.
+          if defined?(::Rails::Railtie)
+            require_relative '../contrib/rails/railtie'
+          end
         end
 
         # Called when a fork is detected
@@ -204,14 +214,13 @@ module Datadog
             end
           end
 
-          if settings.remote.enabled && old_state&.remote_started?
+          if remote && old_state&.remote_started?
             # The library was reconfigured and previously it already started
             # the remote component (i.e., it received at least one request
             # through the installed Rack middleware which started the remote).
             # If the new configuration also has remote enabled, start the
             # new remote right away.
-            # remote should always be not nil here but steep doesn't know this.
-            remote&.start
+            remote.start
           end
 
           # This should stay here, not in initialize. During reconfiguration, the order of the calls is:
@@ -279,11 +288,15 @@ module Datadog
           unused_statsd = (old_statsd - (old_statsd & new_statsd))
           unused_statsd.each(&:close)
 
-          # enqueue closing event before stopping telemetry so it will be sent out on shutdown
+          Core::ProcessDiscovery.shutdown!
+
+          # Shut down telemetry last so that all other components may
+          # report shutdown errors.
+          #
+          # Enqueue closing event before stopping telemetry so it will be
+          # sent out on shutdown.
           telemetry.emit_closing! unless replacement&.telemetry&.enabled
           telemetry.shutdown!
-
-          Core::ProcessDiscovery.shutdown!
         end
 
         # Returns the current state of various components.

data/lib/datadog/core/configuration/config_helper.rb

@@ -40,6 +40,12 @@ module Datadog
           !get_environment_variable(name).nil?
         end
 
+        # Returns the source environment as a Hash. Used when the full environment
+        # must be passed through (e.g. Process.spawn child env).
+        def to_h
+          @source_env.to_h
+        end
+
         alias_method :has_key?, :key?
         alias_method :include?, :key?
         alias_method :member?, :key?
@@ -97,4 +103,7 @@ module Datadog
       end
     end
   end
+  unless const_defined?(:DATADOG_ENV, false)
+    DATADOG_ENV = Core::Configuration::ConfigHelper.new
+  end
 end

data/lib/datadog/core/configuration/option.rb

@@ -77,6 +77,16 @@ module Datadog
           @precedence_set = Precedence::DEFAULT
         end
 
+        # Computes the name of the option with the settings path.
+        # E.g. "tracing.rails.middleware_names" for the "middleware_names" option in the "tracing.rails" settings.
+        # @return [String] the name of the option with the settings path
+        def name_with_settings_path
+          @name_with_settings_path ||= begin
+            settings_path = @context.class.settings_path
+            settings_path.nil? ? definition.name.to_s : "#{settings_path}.#{definition.name}"
+          end
+        end
+
         # Overrides the current value for this option if the `precedence` is equal or higher than
         # the previously set value.
         # The first call to `#set` will always store the value regardless of precedence.
@@ -89,7 +99,7 @@ module Datadog
             # This should be uncommon, as higher precedence values tend to
             # happen later in the application lifecycle.
             Datadog.logger.info do
-              "Option '#{definition.name}' not changed to '#{value}' (precedence: #{precedence.name}) because the higher " \
+              "Option '#{name_with_settings_path}' not changed to '#{value}' (precedence: #{precedence.name}) because the higher " \
                 "precedence value '#{@value}' (precedence: #{@precedence_set.name}) was already set."
             end
 
@@ -178,6 +188,21 @@ module Datadog
           precedence_set == Precedence::DEFAULT
         end
 
+        def settings?
+          @definition.is_settings
+        end
+
+        def values_per_precedence
+          # value_per_precedence is only filled after we call `get` once.
+          get unless @is_set
+
+          @value_per_precedence.each_with_object({}) do |(precedence, value), result|
+            next if value.equal?(UNSET)
+
+            result[precedence] = value
+          end
+        end
+
         private
 
         def coerce_env_variable(value)
@@ -216,7 +241,7 @@ module Datadog
             value
           else
             raise InvalidDefinitionError,
-              "The option #{@definition.name} is using an unsupported type option for env coercion `#{@definition.type}`"
+              "The option #{name_with_settings_path} is using an unsupported type option for env coercion `#{@definition.type}`"
           end
         end
 
@@ -239,10 +264,10 @@ module Datadog
 
           if raise_error
             error_msg = if @definition.type_options[:nilable]
-              "The setting `#{@definition.name}` inside your app's `Datadog.configure` block expects a " \
+              "The setting `#{name_with_settings_path}` inside your app's `Datadog.configure` block expects a " \
               "#{@definition.type} or `nil`, but a `#{value.class}` was provided (#{value.inspect})." \
             else
-              "The setting `#{@definition.name}` inside your app's `Datadog.configure` block expects a " \
+              "The setting `#{name_with_settings_path}` inside your app's `Datadog.configure` block expects a " \
               "#{@definition.type}, but a `#{value.class}` was provided (#{value.inspect})." \
             end
 
@@ -276,7 +301,7 @@ module Datadog
             true # No validation is performed when option is typeless
           else
             raise InvalidDefinitionError,
-              "The option #{@definition.name} is using an unsupported type option `#{@definition.type}`"
+              "The option #{name_with_settings_path} is using an unsupported type option `#{@definition.type}`"
           end
         end
 

data/lib/datadog/core/configuration/option_definition.rb

@@ -10,28 +10,36 @@ module Datadog
         IDENTITY = ->(new_value, _old_value) { new_value }
 
         attr_reader \
+          :is_settings,
           :default,
           :default_proc,
           :env,
           :env_parser,
           :name,
           :after_set,
+          :skip_telemetry,
           :resetter,
           :setter,
           :type,
           :type_options
 
-        def initialize(name, meta, &block)
-          @default = meta[:default]
-          @default_proc = meta[:default_proc]
-          @env = meta[:env]
-          @env_parser = meta[:env_parser]
+        def initialize(name, attributes, &block)
+          # When a settings is defined using the config DSL, an option is also created.
+          # See Datadog::Core::Configuration::Base::ClassMethods#settings for more details.
+          # This flag is used to indicate that the option is a settings option.
+          @is_settings = attributes[:is_settings]
+
+          @default = attributes[:default]
+          @default_proc = attributes[:default_proc]
+          @env = attributes[:env]
+          @env_parser = attributes[:env_parser]
           @name = name.to_sym
-          @after_set = meta[:after_set]
-          @resetter = meta[:resetter]
-          @setter = meta[:setter] || block || IDENTITY
-          @type = meta[:type]
-          @type_options = meta[:type_options]
+          @after_set = attributes[:after_set]
+          @skip_telemetry = attributes[:skip_telemetry]
+          @resetter = attributes[:resetter]
+          @setter = attributes[:setter] || block || IDENTITY
+          @type = attributes[:type]
+          @type_options = attributes[:type_options]
         end
 
         # Creates a new Option, bound to the context provided.
@@ -49,6 +57,8 @@ module Datadog
             :helpers
 
           def initialize(name, options = {})
+            @is_settings = options.fetch(:is_settings, false)
+
             @env = nil
             @env_parser = nil
             @default = nil
@@ -56,6 +66,7 @@ module Datadog
             @helpers = {}
             @name = name.to_sym
             @after_set = nil
+            @skip_telemetry = false
             @resetter = nil
             @setter = OptionDefinition::IDENTITY
             @type = nil
@@ -95,6 +106,16 @@ module Datadog
             @after_set = block
           end
 
+          # This should only be set to true for options that are manually modified
+          # before being added to the telemetry payload in app_started.rb.
+          # E.g. telemetry is skipped for `tracing.writer_options`, but in app_started.rb,
+          # we send two separate entries for the buffer_size and flush_interval values.
+          # Standard: We want to keep this method as skip_telemetry(value),
+          # not skip_telemetry = value, so attr_writer is not used.
+          def skip_telemetry(value) # standard:disable Style/TrivialAccessors
+            @skip_telemetry = value
+          end
+
           def resetter(&block)
             @resetter = block
           end
@@ -119,6 +140,8 @@ module Datadog
             env(options[:env]) if options.key?(:env)
             env_parser(&options[:env_parser]) if options.key?(:env_parser)
             after_set(&options[:after_set]) if options.key?(:after_set)
+            # Steep: https://github.com/soutaro/steep/issues/1979
+            skip_telemetry(options[:skip_telemetry]) if options.key?(:skip_telemetry) # steep:ignore ArgumentTypeMismatch
             resetter(&options[:resetter]) if options.key?(:resetter)
             # Steep: https://github.com/soutaro/steep/issues/1979
             setter(&options[:setter]) if options.key?(:setter) # steep:ignore BlockTypeMismatch
@@ -126,16 +149,19 @@ module Datadog
           end
 
           def to_definition
-            OptionDefinition.new(@name, meta)
+            OptionDefinition.new(@name, attributes)
           end
 
-          def meta
+          def attributes
             {
+              is_settings: @is_settings,
+
               default: @default,
               default_proc: @default_proc,
               env: @env,
               env_parser: @env_parser,
               after_set: @after_set,
+              skip_telemetry: @skip_telemetry,
               resetter: @resetter,
               setter: @setter,
               type: @type,