datadog 2.12.2 → 2.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5a27bb8e1291ee014e342297fc3d53aca8a895017281201b1b0a29cd376ba905
-  data.tar.gz: e26c326437e4edcbdfac0ad604514a48c23c31500a68dcc4affb53251aed5f8f
+  metadata.gz: 2c826569b30a9e809d44f98b6371650aa38306e325b2f1ceb79ece2d3fb23360
+  data.tar.gz: 6753a8ac457c797fe29e19f1af4d434e33d6f74aa3b7c9a32394a8d3e5d57f33
 SHA512:
-  metadata.gz: e8dab2f6ed8bc48fb95a4c9c3c28fce16b8eaaceb70179ee12b9a009498dabe498d73b08a25180fdb53642fc78da4388b2c80bbf76a61afd25af53449f2e9375
-  data.tar.gz: 4489a8e084f7873e59b4d2a13d27b9a75f2b95ae0c9b5129edfdb02a58c736890bd5226df765de216010512b9fd0ffad6f82cc373ea8ee995340ef838c721d65
+  metadata.gz: 14445f04bb88f59798ed30ed28c849556556639720d2086f678058021e23ca64ab4740a3e4df1e53cab34e5f18eb785dfeebfd0716c20a75971acb605cdf6884
+  data.tar.gz: b3d8a318c7571747d80bb474478ab4a4ae92c422ba9a6177b6889fc3231bac4666c13d8c77ebd6bf43bd5045f427d6771e3f69531b23903ebdf4673824268f50

data/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## [Unreleased]
 
+## [2.13.0] - 2025-04-02
+
+### Added
+
+* Core: Add `DD_TRACE_EXPERIMENTAL_RUNTIME_ID_ENABLED` experimental option to enable runtime ID collection for runtime metrics. ([#4473][])
+* Tracing: Add support for W3C Baggage API along with automatic extraction and injection, and OpenTelemetry support. ([#4493][], [#4505][])
+* Tracing: Add `DD_APM_TRACING_ENABLED` option to disable APM tracing while keeping other products traces. ([#4498][])
+* Tracing: Add `DD_TRACE_NATIVE_SPAN_EVENTS` option to override span events serialization for agent-less environments. ([#4507][])
+* AppSec: Add stack trace reporting for security events. ([#4526][])
+* AppSec: Improve `devise` instrumentation to support latest Account Takeover (ATO) detection. ([#4433][])
+
+### Changed
+
+* Core: Improve `DD_TAGS` configuration handling to be more consistent across Datadog libraries and Agent. ([#4530][])
+* Tracing: Enable by default 128-bit trace ID logging so that trace IDs are consistent across logs and the Datadog UI. ([#4528][])
+
+### Fixed
+
+* Core: Fix initialization when the library is partially loaded. ([#4498][])
+* Tracing: Fix trace ID propagation by ensuring extraction of 16-character hex values from the `_dd.p.tid` tag in `x-datadog-tags` header. ([#4534][])
+* Tracing: Profiling: Fix warnings printed by `ruby -w`. ([#4547][], [#4549][])
+
 ## [2.12.2] - 2025-03-17
 
 ### Fixed
@@ -3145,7 +3167,8 @@ Release notes: https://github.com/DataDog/dd-trace-rb/releases/tag/v0.3.1
 Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 
 
-[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.12.2...master
+[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.13.0...master
+[2.13.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.12.2...v2.13.0
 [2.12.2]: https://github.com/DataDog/dd-trace-rb/compare/v2.12.1...v2.12.2
 [2.12.1]: https://github.com/DataDog/dd-trace-rb/compare/v2.12.0...v2.12.1
 [2.12.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.11.0...v2.12.0
@@ -4649,8 +4672,20 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#4424]: https://github.com/DataDog/dd-trace-rb/issues/4424
 [#4425]: https://github.com/DataDog/dd-trace-rb/issues/4425
 [#4426]: https://github.com/DataDog/dd-trace-rb/issues/4426
+[#4433]: https://github.com/DataDog/dd-trace-rb/issues/4433
 [#4437]: https://github.com/DataDog/dd-trace-rb/issues/4437
+[#4473]: https://github.com/DataDog/dd-trace-rb/issues/4473
+[#4493]: https://github.com/DataDog/dd-trace-rb/issues/4493
 [#4497]: https://github.com/DataDog/dd-trace-rb/issues/4497
+[#4498]: https://github.com/DataDog/dd-trace-rb/issues/4498
+[#4505]: https://github.com/DataDog/dd-trace-rb/issues/4505
+[#4507]: https://github.com/DataDog/dd-trace-rb/issues/4507
+[#4526]: https://github.com/DataDog/dd-trace-rb/issues/4526
+[#4528]: https://github.com/DataDog/dd-trace-rb/issues/4528
+[#4530]: https://github.com/DataDog/dd-trace-rb/issues/4530
+[#4534]: https://github.com/DataDog/dd-trace-rb/issues/4534
+[#4547]: https://github.com/DataDog/dd-trace-rb/issues/4547
+[#4549]: https://github.com/DataDog/dd-trace-rb/issues/4549
 [@AdrianLC]: https://github.com/AdrianLC
 [@Azure7111]: https://github.com/Azure7111
 [@BabyGroot]: https://github.com/BabyGroot

data/ext/datadog_profiling_native_extension/collectors_thread_context.c

@@ -212,7 +212,7 @@ static VALUE _native_initialize(int argc, VALUE *argv, DDTRACE_UNUSED VALUE _sel
 static VALUE _native_sample(VALUE self, VALUE collector_instance, VALUE profiler_overhead_stack_thread, VALUE allow_exception);
 static VALUE _native_on_gc_start(VALUE self, VALUE collector_instance);
 static VALUE _native_on_gc_finish(VALUE self, VALUE collector_instance);
-static VALUE _native_sample_after_gc(DDTRACE_UNUSED VALUE self, VALUE collector_instance, VALUE reset_monotonic_to_system_state, VALUE allow_exception);
+static VALUE _native_sample_after_gc(DDTRACE_UNUSED VALUE self, VALUE collector_instance, VALUE allow_exception);
 static void update_metrics_and_sample(
   thread_context_collector_state *state,
   VALUE thread_being_sampled,
@@ -297,6 +297,7 @@ static void otel_without_ddtrace_trace_identifiers_for(
 static otel_span otel_span_from(VALUE otel_context, VALUE otel_current_span_key);
 static uint64_t otel_span_id_to_uint(VALUE otel_span_id);
 static VALUE safely_lookup_hash_without_going_into_ruby_code(VALUE hash, VALUE key);
+static VALUE _native_reset_monotonic_to_system_state(DDTRACE_UNUSED VALUE self, VALUE collector_instance);
 
 void collectors_thread_context_init(VALUE profiling_module) {
   VALUE collectors_module = rb_define_module_under(profiling_module, "Collectors");
@@ -321,13 +322,14 @@ void collectors_thread_context_init(VALUE profiling_module) {
   rb_define_singleton_method(testing_module, "_native_sample_allocation", _native_sample_allocation, 3);
   rb_define_singleton_method(testing_module, "_native_on_gc_start", _native_on_gc_start, 1);
   rb_define_singleton_method(testing_module, "_native_on_gc_finish", _native_on_gc_finish, 1);
-  rb_define_singleton_method(testing_module, "_native_sample_after_gc", _native_sample_after_gc, 3);
+  rb_define_singleton_method(testing_module, "_native_sample_after_gc", _native_sample_after_gc, 2);
   rb_define_singleton_method(testing_module, "_native_thread_list", _native_thread_list, 0);
   rb_define_singleton_method(testing_module, "_native_per_thread_context", _native_per_thread_context, 1);
   rb_define_singleton_method(testing_module, "_native_stats", _native_stats, 1);
   rb_define_singleton_method(testing_module, "_native_gc_tracking", _native_gc_tracking, 1);
   rb_define_singleton_method(testing_module, "_native_new_empty_thread", _native_new_empty_thread, 0);
   rb_define_singleton_method(testing_module, "_native_sample_skipped_allocation_samples", _native_sample_skipped_allocation_samples, 2);
+  rb_define_singleton_method(testing_module, "_native_reset_monotonic_to_system_state", _native_reset_monotonic_to_system_state, 1);
   #ifndef NO_GVL_INSTRUMENTATION
     rb_define_singleton_method(testing_module, "_native_on_gvl_waiting", _native_on_gvl_waiting, 1);
     rb_define_singleton_method(testing_module, "_native_gvl_waiting_at_for", _native_gvl_waiting_at_for, 1);
@@ -551,19 +553,9 @@ static VALUE _native_on_gc_finish(DDTRACE_UNUSED VALUE self, VALUE collector_ins
   return Qtrue;
 }
 
-// This method exists only to enable testing Datadog::Profiling::Collectors::ThreadContext behavior using RSpec.
-// It SHOULD NOT be used for other purposes.
-static VALUE _native_sample_after_gc(DDTRACE_UNUSED VALUE self, VALUE collector_instance, VALUE reset_monotonic_to_system_state, VALUE allow_exception) {
-  ENFORCE_BOOLEAN(reset_monotonic_to_system_state);
+static VALUE _native_sample_after_gc(DDTRACE_UNUSED VALUE self, VALUE collector_instance, VALUE allow_exception) {
   ENFORCE_BOOLEAN(allow_exception);
 
-  thread_context_collector_state *state;
-  TypedData_Get_Struct(collector_instance, thread_context_collector_state, &thread_context_collector_typed_data, state);
-
-  if (reset_monotonic_to_system_state == Qtrue) {
-    state->time_converter_state = (monotonic_to_system_epoch_state) MONOTONIC_TO_SYSTEM_EPOCH_INITIALIZER;
-  }
-
   if (allow_exception == Qfalse) debug_enter_unsafe_context();
 
   thread_context_collector_sample_after_gc(collector_instance);
@@ -2167,3 +2159,12 @@ static VALUE safely_lookup_hash_without_going_into_ruby_code(VALUE hash, VALUE k
 
   return state.result;
 }
+
+static VALUE _native_reset_monotonic_to_system_state(DDTRACE_UNUSED VALUE self, VALUE collector_instance) {
+  thread_context_collector_state *state;
+  TypedData_Get_Struct(collector_instance, thread_context_collector_state, &thread_context_collector_typed_data, state);
+
+  state->time_converter_state = (monotonic_to_system_epoch_state) MONOTONIC_TO_SYSTEM_EPOCH_INITIALIZER;
+
+  return Qtrue;
+}

data/lib/datadog/appsec/actions_handler/serializable_backtrace.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module ActionsHandler
+      # This module serves encapsulates MessagePack serialization for caller locations.
+      #
+      # It serializes part of the stack:
+      # up to 32 frames (configurable)
+      # keeping frames from top and bottom of the stack (75% to 25%, configurable).
+      #
+      # It represents the stack trace that is added to span metastruct field.
+      class SerializableBacktrace
+        CLASS_AND_FUNCTION_NAME_REGEX = /\b((?:\w+::)*\w+)?[#.]?\b(\w+)\z/.freeze
+
+        def initialize(locations:, stack_id:)
+          @stack_id = stack_id
+          @locations = locations
+        end
+
+        def to_msgpack(packer = nil)
+          # JRuby doesn't pass the packer
+          packer ||= MessagePack::Packer.new
+
+          packer.write_map_header(3)
+
+          packer.write('id')
+          packer.write(@stack_id.encode('UTF-8'))
+
+          packer.write('language')
+          packer.write('ruby'.encode('UTF-8'))
+
+          serializable_locations_map = build_serializable_locations_map
+
+          packer.write('frames')
+          packer.write_array_header(serializable_locations_map.size)
+
+          serializable_locations_map.each do |frame_id, location|
+            packer.write_map_header(6)
+
+            packer.write('id')
+            packer.write(frame_id)
+
+            packer.write('text')
+            packer.write(location.to_s.encode('UTF-8'))
+
+            packer.write('file')
+            packer.write(location.path&.encode('UTF-8'))
+
+            packer.write('line')
+            packer.write(location.lineno)
+
+            class_name, function_name = location.label&.match(CLASS_AND_FUNCTION_NAME_REGEX)&.captures
+
+            packer.write('class_name')
+            packer.write(class_name&.encode('UTF-8'))
+
+            packer.write('function')
+            packer.write(function_name&.encode('UTF-8'))
+          end
+
+          packer
+        end
+
+        private
+
+        def build_serializable_locations_map
+          max_depth = Datadog.configuration.appsec.stack_trace.max_depth
+          top_percent = Datadog.configuration.appsec.stack_trace.top_percentage
+
+          drop_from_idx = max_depth * top_percent / 100
+          drop_until_idx = @locations.size - (max_depth - drop_from_idx)
+
+          frame_idx = -1
+          @locations.each_with_object({}) do |location, map|
+            # we are dropping frames from library code without increasing frame index
+            next if location.path&.include?('lib/datadog')
+
+            frame_idx += 1
+
+            next if max_depth != 0 && frame_idx >= drop_from_idx && frame_idx < drop_until_idx
+
+            map[frame_idx] = location
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/actions_handler.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative 'actions_handler/serializable_backtrace'
+
 module Datadog
   module AppSec
     # this module encapsulates functions for handling actions that libddawf returns
@@ -19,7 +21,26 @@ module Datadog
         throw(Datadog::AppSec::Ext::INTERRUPT, action_params)
       end
 
-      def generate_stack(_action_params); end
+      def generate_stack(action_params)
+        return unless Datadog.configuration.appsec.stack_trace.enabled
+
+        stack_id = action_params['stack_id']
+        return unless stack_id
+
+        active_span = AppSec.active_context&.span
+        return unless active_span
+
+        event_category = Ext::EXPLOIT_PREVENTION_EVENT_CATEGORY
+        tag_key = Ext::TAG_METASTRUCT_STACK_TRACE
+
+        existing_stack_data = active_span.get_metastruct_tag(tag_key).dup || { event_category => [] }
+        max_stack_traces = Datadog.configuration.appsec.stack_trace.max_stack_traces
+        return if max_stack_traces != 0 && existing_stack_data[event_category].count >= max_stack_traces
+
+        backtrace = SerializableBacktrace.new(locations: Array(caller_locations), stack_id: stack_id)
+        existing_stack_data[event_category] << backtrace
+        active_span.set_metastruct_tag(tag_key, existing_stack_data)
+      end
 
       def generate_schema(_action_params); end
     end

data/lib/datadog/appsec/anonymizer.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'digest/sha2'
+
+module Datadog
+  module AppSec
+    # Manual anonymization of the potential PII data
+    module Anonymizer
+      def self.anonymize(payload)
+        raise ArgumentError, "expected String, received #{payload.class}" unless payload.is_a?(String)
+
+        "anon_#{Digest::SHA256.hexdigest(payload)[0, 32]}"
+      end
+    end
+  end
+end

data/lib/datadog/appsec/configuration/settings.rb

@@ -164,6 +164,66 @@ module Datadog
                 end
               end
 
+              settings :stack_trace do
+                option :enabled do |o|
+                  o.type :bool
+                  o.env 'DD_APPSEC_STACK_TRACE_ENABLED'
+                  o.default true
+                end
+
+                # The maximum number of stack trace frames to collect for each stack trace.
+                #
+                # If the stack trace exceeds this limit, the frames are dropped from the middle of the stack trace:
+                # 75% of the frames are kept from the top of the stack trace and 25% from the bottom
+                # (this percentage is also configurable).
+                #
+                # Minimum value is 10.
+                # Set to zero if you don't want any frames to be dropped.
+                #
+                # Default value is 32
+                option :max_depth do |o|
+                  o.type :int
+                  o.env 'DD_APPSEC_MAX_STACK_TRACE_DEPTH'
+                  o.default 32
+
+                  o.setter do |value|
+                    value = 0 if value < 0
+                    value
+                  end
+                end
+
+                # The percentage of frames to keep from the top of the stack trace.
+                #
+                # Default value is 75
+                option :top_percentage do |o|
+                  o.type :int
+                  o.env 'DD_APPSEC_MAX_STACK_TRACE_DEPTH_TOP_PERCENT'
+                  o.default 75
+
+                  o.setter do |value|
+                    value = 100 if value > 100
+                    value = 0 if value.negative?
+                    value
+                  end
+                end
+
+                # Maximum number of stack traces to collect per span.
+                #
+                # Set to zero if you want to collect all stack traces.
+                #
+                # Default value is 2
+                option :max_stack_traces do |o|
+                  o.type :int
+                  o.env 'DD_APPSEC_MAX_STACK_TRACES'
+                  o.default 2
+
+                  o.setter do |value|
+                    value = 0 if value < 0
+                    value
+                  end
+                end
+              end
+
               settings :auto_user_instrumentation do
                 define_method(:enabled?) { get_option(:mode) != DISABLED_AUTO_USER_INSTRUMENTATION_MODE }
 
@@ -178,10 +238,10 @@ module Datadog
                     Datadog.logger.warn(
                       'The appsec.auto_user_instrumentation.mode value provided is not supported. ' \
                       "Supported values are: #{AUTO_USER_INSTRUMENTATION_MODES.join(' | ')}. " \
-                      "Using default value: #{IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE}."
+                      "Using value: #{DISABLED_AUTO_USER_INSTRUMENTATION_MODE}."
                     )
 
-                    IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE
+                    DISABLED_AUTO_USER_INSTRUMENTATION_MODE
                   end
                 end
               end
@@ -259,14 +319,6 @@ module Datadog
                 o.type :bool, nilable: true
                 o.env 'DD_APPSEC_SCA_ENABLED'
               end
-
-              settings :standalone do
-                option :enabled do |o|
-                  o.type :bool
-                  o.env 'DD_EXPERIMENTAL_APPSEC_STANDALONE_ENABLED'
-                  o.default false
-                end
-              end
             end
           end
         end

data/lib/datadog/appsec/contrib/auto_instrument.rb

@@ -9,7 +9,7 @@ module Datadog
         def self.patch_all
           integrations = []
 
-          Datadog::AppSec::Contrib::Integration.registry.each do |_name, integration|
+          Datadog::AppSec::Contrib::Integration.registry.each_value do |integration|
             next unless integration.klass.auto_instrument?
 
             integrations << integration.name

data/lib/datadog/appsec/contrib/devise/configuration.rb

@@ -7,19 +7,11 @@ module Datadog
         # A temporary configuration module to accomodate new RFC changes.
         # NOTE: DEV-3 Remove module
         module Configuration
-          MODES_CONVERSION_RULES = {
-            track_user_to_auto_instrumentation: {
-              AppSec::Configuration::Settings::SAFE_TRACK_USER_EVENTS_MODE =>
+          TRACK_USER_EVENTS_CONVERSION_RULES = {
+            AppSec::Configuration::Settings::SAFE_TRACK_USER_EVENTS_MODE =>
               AppSec::Configuration::Settings::ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE,
-              AppSec::Configuration::Settings::EXTENDED_TRACK_USER_EVENTS_MODE =>
+            AppSec::Configuration::Settings::EXTENDED_TRACK_USER_EVENTS_MODE =>
               AppSec::Configuration::Settings::IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE
-            }.freeze,
-            auto_instrumentation_to_track_user: {
-              AppSec::Configuration::Settings::ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE =>
-              AppSec::Configuration::Settings::SAFE_TRACK_USER_EVENTS_MODE,
-              AppSec::Configuration::Settings::IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE =>
-              AppSec::Configuration::Settings::EXTENDED_TRACK_USER_EVENTS_MODE
-            }.freeze
           }.freeze
 
           module_function
@@ -44,30 +36,14 @@ module Datadog
             appsec.auto_user_instrumentation.mode
             appsec.track_user_events.mode
 
-            if !appsec.auto_user_instrumentation.options[:mode].default_precedence? &&
-                appsec.track_user_events.options[:mode].default_precedence?
-              return appsec.auto_user_instrumentation.mode
-            end
-
-            if appsec.auto_user_instrumentation.options[:mode].default_precedence?
-              return MODES_CONVERSION_RULES[:track_user_to_auto_instrumentation].fetch(
+            if !appsec.track_user_events.options[:mode].default_precedence? &&
+                appsec.auto_user_instrumentation.options[:mode].default_precedence?
+              return TRACK_USER_EVENTS_CONVERSION_RULES.fetch(
                 appsec.track_user_events.mode, appsec.auto_user_instrumentation.mode
               )
             end
 
-            identification_mode = AppSec::Configuration::Settings::IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE
-            if appsec.auto_user_instrumentation.mode == identification_mode ||
-                appsec.track_user_events.mode == AppSec::Configuration::Settings::EXTENDED_TRACK_USER_EVENTS_MODE
-              return identification_mode
-            end
-
-            AppSec::Configuration::Settings::ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE
-          end
-
-          # NOTE: Remove in next version of tracking
-          def track_user_events_mode
-            MODES_CONVERSION_RULES[:auto_instrumentation_to_track_user]
-              .fetch(auto_user_instrumentation_mode, Datadog.configuration.appsec.track_user_events.mode)
+            appsec.auto_user_instrumentation.mode
           end
         end
       end

data/lib/datadog/appsec/contrib/devise/data_extractor.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require_relative '../../anonymizer'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Devise
+        # Extracts user identification data from Devise resources.
+        # Supports both regular and anonymized data extraction modes.
+        class DataExtractor
+          PRIORITY_ORDERED_ID_KEYS = [:id, 'id', :uuid, 'uuid'].freeze
+          PRIORITY_ORDERED_LOGIN_KEYS = [:email, 'email', :username, 'username', :login, 'login'].freeze
+
+          def initialize(mode:)
+            @mode = mode
+            @devise_scopes = {}
+          end
+
+          def extract_id(object)
+            return if object.nil?
+
+            if object.respond_to?(:[])
+              id = object[PRIORITY_ORDERED_ID_KEYS.find { |key| object[key] }]
+              scope = find_devise_scope(object)
+
+              id = "#{scope}:#{id}" if id && scope
+              return transform(id)
+            end
+
+            id = object.id if object.respond_to?(:id)
+            id ||= object.uuid if object.respond_to?(:uuid)
+
+            scope = find_devise_scope(object)
+            id = "#{scope}:#{id}" if id && scope
+
+            transform(id)
+          end
+
+          def extract_login(object)
+            return if object.nil?
+
+            if object.respond_to?(:[])
+              login = object[PRIORITY_ORDERED_LOGIN_KEYS.find { |key| object[key] }]
+              return transform(login)
+            end
+
+            login = object.email if object.respond_to?(:email)
+            login ||= object.username if object.respond_to?(:username)
+            login ||= object.login if object.respond_to?(:login)
+
+            transform(login)
+          end
+
+          private
+
+          def find_devise_scope(object)
+            return if ::Devise.mappings.count == 1
+
+            @devise_scopes[object.class.name] ||= begin
+              ::Devise.mappings.each_value.find { |mapping| mapping.class_name == object.class.name }&.name
+            end
+          end
+
+          def transform(value)
+            return if value.nil?
+            return value.to_s unless anonymize?
+
+            Anonymizer.anonymize(value.to_s)
+          end
+
+          def anonymize?
+            @mode == AppSec::Configuration::Settings::ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/devise/ext.rb

@@ -6,6 +6,27 @@ module Datadog
       module Devise
         # Devise integration constants
         module Ext
+          EVENT_LOGIN_SUCCESS = 'users.login.success'
+          EVENT_LOGIN_FAILURE = 'users.login.failure'
+          EVENT_SIGNUP = 'users.signup'
+
+          TAG_DD_USR_ID = '_dd.appsec.usr.id'
+          TAG_DD_USR_LOGIN = '_dd.appsec.usr.login'
+          TAG_DD_SIGNUP_MODE = '_dd.appsec.events.users.signup.auto.mode'
+          TAG_DD_COLLECTION_MODE = '_dd.appsec.user.collection_mode'
+          TAG_DD_LOGIN_SUCCESS_MODE = '_dd.appsec.events.users.login.success.auto.mode'
+          TAG_DD_LOGIN_FAILURE_MODE = '_dd.appsec.events.users.login.failure.auto.mode'
+
+          TAG_USR_ID = 'usr.id'
+          TAG_SIGNUP_TRACK = 'appsec.events.users.signup.track'
+          TAG_SIGNUP_USR_ID = 'appsec.events.users.signup.usr.id'
+          TAG_SIGNUP_USR_LOGIN = 'appsec.events.users.signup.usr.login'
+          TAG_LOGIN_FAILURE_TRACK = 'appsec.events.users.login.failure.track'
+          TAG_LOGIN_FAILURE_USR_ID = 'appsec.events.users.login.failure.usr.id'
+          TAG_LOGIN_FAILURE_USR_LOGIN = 'appsec.events.users.login.failure.usr.login'
+          TAG_LOGIN_FAILURE_USR_EXISTS = 'appsec.events.users.login.failure.usr.exists'
+          TAG_LOGIN_SUCCESS_TRACK = 'appsec.events.users.login.success.track'
+          TAG_LOGIN_SUCCESS_USR_LOGIN = 'appsec.events.users.login.success.usr.login'
         end
       end
     end

data/lib/datadog/appsec/contrib/devise/integration.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require_relative '../integration'
-
 require_relative 'patcher'
 
 module Datadog

data/lib/datadog/appsec/contrib/devise/patcher.rb

@@ -1,15 +1,22 @@
 # frozen_string_literal: true
 
-require_relative 'patcher/authenticatable_patch'
-require_relative 'patcher/rememberable_patch'
-require_relative 'patcher/registration_controller_patch'
+require_relative '../../../core/utils/only_once'
+
+require_relative 'tracking_middleware'
+require_relative 'patches/signup_tracking_patch'
+require_relative 'patches/signin_tracking_patch'
+require_relative 'patches/skip_signin_tracking_patch'
 
 module Datadog
   module AppSec
     module Contrib
       module Devise
-        # Patcher for AppSec on Devise
+        # Devise patcher
         module Patcher
+          GUARD_ONCE_PER_APP = Hash.new do |hash, key|
+            hash[key] = Datadog::Core::Utils::OnlyOnce.new
+          end
+
           module_function
 
           def patched?
@@ -21,29 +28,35 @@ module Datadog
           end
 
           def patch
-            patch_authenticatable_strategy
-            patch_rememberable_strategy
-            patch_registration_controller
-
-            Patcher.instance_variable_set(:@patched, true)
-          end
-
-          def patch_authenticatable_strategy
-            ::Devise::Strategies::Authenticatable.prepend(AuthenticatablePatch)
-          end
+            ::ActiveSupport.on_load(:before_initialize) do |app|
+              GUARD_ONCE_PER_APP[app].run do
+                begin
+                  app.middleware.insert_after(Warden::Manager, TrackingMiddleware)
+                rescue RuntimeError
+                  AppSec.telemetry.error('AppSec: unable to insert Devise TrackingMiddleware')
+                end
+              end
+            end
 
-          def patch_rememberable_strategy
-            return unless ::Devise::STRATEGIES.include?(:rememberable)
+            ::ActiveSupport.on_load(:after_initialize) do
+              if ::Devise::RegistrationsController.descendants.empty?
+                ::Devise::RegistrationsController.prepend(Patches::SignupTrackingPatch)
+              else
+                ::Devise::RegistrationsController.descendants.each do |controller|
+                  controller.prepend(Patches::SignupTrackingPatch)
+                end
+              end
+            end
 
-            # Rememberable strategy is required in autoloaded Rememberable model
-            ::Devise::Models::Rememberable # rubocop:disable Lint/Void
-            ::Devise::Strategies::Rememberable.prepend(RememberablePatch)
-          end
+            ::Devise::Strategies::Authenticatable.prepend(Patches::SigninTrackingPatch)
 
-          def patch_registration_controller
-            ::ActiveSupport.on_load(:after_initialize) do
-              ::Devise::RegistrationsController.prepend(RegistrationControllerPatch)
+            if ::Devise::STRATEGIES.include?(:rememberable)
+              # Rememberable strategy is required in autoloaded Rememberable model
+              require 'devise/models/rememberable'
+              ::Devise::Strategies::Rememberable.prepend(Patches::SkipSigninTrackingPatch)
             end
+
+            Patcher.instance_variable_set(:@patched, true)
           end
         end
       end