ddtrace 1.12.1 → 1.14.0

data/ext/ddtrace_profiling_native_extension/native_extension_helpers.rb

@@ -15,7 +15,7 @@ module Datadog
       # The MJIT header was introduced on 2.6 and removed on 3.3; for other Rubies we rely on debase-ruby_core_source
       CAN_USE_MJIT_HEADER = RUBY_VERSION.start_with?('2.6', '2.7', '3.0.', '3.1.', '3.2.')
 
-      LIBDATADOG_VERSION = '~> 2.0.0.1.0'
+      LIBDATADOG_VERSION = '~> 3.0.0.1.0'
 
       def self.fail_install_if_missing_extension?
         ENV[ENV_FAIL_INSTALL_IF_MISSING_EXTENSION].to_s.strip.downcase == 'true'
@@ -87,6 +87,7 @@ module Datadog
             on_unknown_os? ||
             on_unsupported_cpu_arch? ||
             on_unsupported_ruby_version? ||
+            on_ruby_3_3? ||
             expected_to_use_mjit_but_mjit_is_disabled? ||
             libdatadog_not_available? ||
             libdatadog_not_usable?
@@ -269,6 +270,20 @@ module Datadog
           ruby_version_not_supported if RUBY_VERSION.start_with?('2.1.', '2.2.')
         end
 
+        private_class_method def self.on_ruby_3_3?
+          incompatible_with_3_3 = explain_issue(
+            'the profiler in the current version of ddtrace does not yet support',
+            'Ruby version 3.3.',
+            '(See https://github.com/datadog/dd-trace-rb/issues/3053 for details).',
+            suggested: [
+              'Try upgrading to the latest ddtrace, as this issue may have been',
+              'fixed by now.',
+            ] + CONTACT_SUPPORT,
+          )
+
+          incompatible_with_3_3 if RUBY_VERSION.start_with?('3.3.')
+        end
+
         # On some Rubies, we require the mjit header to be present. If Ruby was installed without MJIT support, we also skip
         # building the extension.
         private_class_method def self.expected_to_use_mjit_but_mjit_is_disabled?

data/ext/ddtrace_profiling_native_extension/private_vm_api_access.c

@@ -302,7 +302,8 @@ VALUE thread_name_for(VALUE thread) {
 // Taken from upstream vm_backtrace.c at commit 5f10bd634fb6ae8f74a4ea730176233b0ca96954 (March 2022, Ruby 3.2 trunk)
 // Copyright (C) 1993-2012 Yukihiro Matsumoto
 // to support our custom rb_profile_frames (see below)
-// Modifications: None
+// Modifications:
+// * Support int first_lineno for Ruby 3.2.0+ (https://github.com/ruby/ruby/pull/6430)
 //
 // `node_id` gets used depending on Ruby VM compilation settings (USE_ISEQ_NODE_ID being defined).
 // To avoid getting false "unused argument" warnings in setups where it's not used, we need to do this weird dance
@@ -322,7 +323,11 @@ calc_pos(const rb_iseq_t *iseq, const VALUE *pc, int *lineno, int *node_id)
             VM_ASSERT(! ISEQ_BODY(iseq)->local_table_size);
             return 0;
         }
-        if (lineno) *lineno = FIX2INT(ISEQ_BODY(iseq)->location.first_lineno);
+        # ifndef NO_INT_FIRST_LINENO // Ruby 3.2+
+          if (lineno) *lineno = ISEQ_BODY(iseq)->location.first_lineno;
+        # else
+          if (lineno) *lineno = FIX2INT(ISEQ_BODY(iseq)->location.first_lineno);
+        #endif
 #ifdef USE_ISEQ_NODE_ID
         if (node_id) *node_id = -1;
 #endif
@@ -767,3 +772,37 @@ check_method_entry(VALUE obj, int can_be_svar)
   // they're always on the main Ractor
   bool ddtrace_rb_ractor_main_p(void) { return true; }
 #endif // NO_RACTORS
+
+// This is a tweaked and inlined version of
+// threadptr_invoke_proc_location + rb_proc_location + iseq_location .
+//
+// It's useful to have here because not all of the methods above are accessible to extensions + to avoid the
+// array allocation that iseq_location did to contain its return value.
+static const rb_iseq_t *maybe_thread_invoke_proc_iseq(VALUE thread_value) {
+  rb_thread_t *thread = thread_struct_from_object(thread_value);
+
+  #ifndef NO_THREAD_INVOKE_ARG // Ruby 2.6+
+    if (thread->invoke_type != thread_invoke_type_proc) return NULL;
+
+    VALUE proc = thread->invoke_arg.proc.proc;
+  #else
+    if (thread->first_func || !thread->first_proc) return NULL;
+
+    VALUE proc = thread->first_proc;
+  #endif
+
+  const rb_iseq_t *iseq = rb_proc_get_iseq(proc, 0);
+  if (iseq == NULL) return NULL;
+
+  rb_iseq_check(iseq);
+  return iseq;
+}
+
+VALUE invoke_location_for(VALUE thread, int *line_location) {
+  const rb_iseq_t *iseq = maybe_thread_invoke_proc_iseq(thread);
+
+  if (iseq == NULL) return Qnil;
+
+  *line_location = NUM2INT(rb_iseq_first_lineno(iseq));
+  return rb_iseq_path(iseq);
+}

data/ext/ddtrace_profiling_native_extension/private_vm_api_access.h

@@ -43,3 +43,9 @@ bool ddtrace_rb_ractor_main_p(void);
 
 // See comment on `record_placeholder_stack_in_native_code` for a full explanation of what this means (and why we don't just return 0)
 #define PLACEHOLDER_STACK_IN_NATIVE_CODE -1
+
+// This method provides the file and line of the "invoke location" of a thread (first file:line of the block used to
+// start the thread), if any.
+// This is what Ruby shows in `Thread#to_s`.
+// The file is returned directly, and the line is recorded onto *line_location.
+VALUE invoke_location_for(VALUE thread, int *line_location);

data/ext/ddtrace_profiling_native_extension/stack_recorder.c

@@ -6,6 +6,7 @@
 #include "stack_recorder.h"
 #include "libdatadog_helpers.h"
 #include "ruby_helpers.h"
+#include "time_helpers.h"
 
 // Used to wrap a ddog_prof_Profile in a Ruby object and expose Ruby-level serialization APIs
 // This file implements the native bits of the Datadog::Profiling::StackRecorder class
@@ -208,7 +209,7 @@ static VALUE _native_active_slot(DDTRACE_UNUSED VALUE _self, VALUE recorder_inst
 static VALUE _native_is_slot_one_mutex_locked(DDTRACE_UNUSED VALUE _self, VALUE recorder_instance);
 static VALUE _native_is_slot_two_mutex_locked(DDTRACE_UNUSED VALUE _self, VALUE recorder_instance);
 static VALUE test_slot_mutex_state(VALUE recorder_instance, int slot);
-static ddog_Timespec time_now(void);
+static ddog_Timespec system_epoch_now_timespec(void);
 static VALUE _native_reset_after_fork(DDTRACE_UNUSED VALUE self, VALUE recorder_instance);
 static void serializer_set_start_timestamp_for_next_profile(struct stack_recorder_state *state, ddog_Timespec timestamp);
 static VALUE _native_record_endpoint(DDTRACE_UNUSED VALUE _self, VALUE recorder_instance, VALUE local_root_span_id, VALUE endpoint);
@@ -347,7 +348,7 @@ static VALUE _native_serialize(DDTRACE_UNUSED VALUE _self, VALUE recorder_instan
   struct stack_recorder_state *state;
   TypedData_Get_Struct(recorder_instance, struct stack_recorder_state, &stack_recorder_typed_data, state);
 
-  ddog_Timespec finish_timestamp = time_now();
+  ddog_Timespec finish_timestamp = system_epoch_now_timespec();
   // Need to do this while still holding on to the Global VM Lock; see comments on method for why
   serializer_set_start_timestamp_for_next_profile(state, finish_timestamp);
 
@@ -547,14 +548,9 @@ static VALUE test_slot_mutex_state(VALUE recorder_instance, int slot) {
   }
 }
 
-// Note that this is using CLOCK_REALTIME (e.g. actual time since unix epoch) and not the CLOCK_MONOTONIC as we use in
-// monotonic_wall_time_now_ns (used in other parts of the codebase)
-static ddog_Timespec time_now(void) {
-  struct timespec current_time;
-
-  if (clock_gettime(CLOCK_REALTIME, &current_time) != 0) ENFORCE_SUCCESS_GVL(errno);
-
-  return (ddog_Timespec) {.seconds = current_time.tv_sec, .nanoseconds = (uint32_t) current_time.tv_nsec};
+static ddog_Timespec system_epoch_now_timespec(void) {
+  long now_ns = system_epoch_time_now_ns(RAISE_ON_FAILURE);
+  return (ddog_Timespec) {.seconds = now_ns / SECONDS_AS_NS(1), .nanoseconds = now_ns % SECONDS_AS_NS(1)};
 }
 
 // After the Ruby VM forks, this method gets called in the child process to clean up any leftover state from the parent.

data/ext/ddtrace_profiling_native_extension/time_helpers.c

@@ -5,13 +5,49 @@
 #include "time_helpers.h"
 
 // Safety: This function is assumed never to raise exceptions by callers when raise_on_failure == false
-long monotonic_wall_time_now_ns(bool raise_on_failure) {
-  struct timespec current_monotonic;
+long retrieve_clock_as_ns(clockid_t clock_id, bool raise_on_failure) {
+  struct timespec clock_value;
 
-  if (clock_gettime(CLOCK_MONOTONIC, &current_monotonic) != 0) {
+  if (clock_gettime(clock_id, &clock_value) != 0) {
     if (raise_on_failure) ENFORCE_SUCCESS_GVL(errno);
     return 0;
   }
 
-  return current_monotonic.tv_nsec + SECONDS_AS_NS(current_monotonic.tv_sec);
+  return clock_value.tv_nsec + SECONDS_AS_NS(clock_value.tv_sec);
+}
+
+long monotonic_wall_time_now_ns(bool raise_on_failure) { return retrieve_clock_as_ns(CLOCK_MONOTONIC, raise_on_failure); }
+long system_epoch_time_now_ns(bool raise_on_failure)   { return retrieve_clock_as_ns(CLOCK_REALTIME,  raise_on_failure); }
+
+// Design: The monotonic_to_system_epoch_state struct is kept somewhere by the caller, and MUST be initialized to
+// MONOTONIC_TO_SYSTEM_EPOCH_INITIALIZER.
+//
+// This function is used by the ThreadContext collector to convert monotonic wall time timestamps which are used
+// basically everywhere else in the codebase, into system epoch timestamps, which are needed by the timeline feature.
+//
+// There's a few ways we could have tackled this conversion, e.g. check the system clock on every call, or even
+// use system clock timestamps elsewhere in the code.
+// Using a system clock elsewhere has a few disadvantages (e.g. because it can move around if users adjust the system
+// time). I also wanted to avoid calling system_epoch_time_now_ns(...) on every conversion.
+//
+// Thus I arrived at this solution: we calculate a delta between the monotonic clock and the system clock, and use
+// that to convert the timestamps.
+//
+// To avoid the results of the system clock being off in cases where the system clock is adjusted while the profiler
+// is running, every ~60 seconds of observed monotonic wall time we recalculate the delta. This means that worst case
+// we'll have ~60 seconds of wrongly-timestamped data when the system clock jumps around, and in return we save the
+// overhead of having to look up the system clock on every call to this function.
+long monotonic_to_system_epoch_ns(monotonic_to_system_epoch_state *state, long monotonic_wall_time_ns) {
+  bool reference_needs_update =
+    (state->system_epoch_ns_reference == INVALID_TIME) ||
+    (state->delta_to_epoch_ns + monotonic_wall_time_ns > state->system_epoch_ns_reference + SECONDS_AS_NS(60));
+
+  if (reference_needs_update) {
+    state->system_epoch_ns_reference = system_epoch_time_now_ns(RAISE_ON_FAILURE);
+    long current_monotonic_wall_time_ns = monotonic_wall_time_now_ns(RAISE_ON_FAILURE);
+
+    state->delta_to_epoch_ns = state->system_epoch_ns_reference - current_monotonic_wall_time_ns;
+  }
+
+  return state->delta_to_epoch_ns + monotonic_wall_time_ns;
 }

data/ext/ddtrace_profiling_native_extension/time_helpers.h

@@ -6,5 +6,19 @@
 #define RAISE_ON_FAILURE true
 #define DO_NOT_RAISE_ON_FAILURE false
 
+#define INVALID_TIME -1
+
+typedef struct {
+  long system_epoch_ns_reference;
+  long delta_to_epoch_ns;
+} monotonic_to_system_epoch_state;
+
+#define MONOTONIC_TO_SYSTEM_EPOCH_INITIALIZER {.system_epoch_ns_reference = INVALID_TIME, .delta_to_epoch_ns = INVALID_TIME}
+
 // Safety: This function is assumed never to raise exceptions by callers when raise_on_failure == false
 long monotonic_wall_time_now_ns(bool raise_on_failure);
+
+// Safety: This function is assumed never to raise exceptions by callers when raise_on_failure == false
+long system_epoch_time_now_ns(bool raise_on_failure);
+
+long monotonic_to_system_epoch_ns(monotonic_to_system_epoch_state *state, long monotonic_wall_time_ns);

data/lib/datadog/appsec/component.rb

@@ -13,6 +13,15 @@ module Datadog
           return unless settings.respond_to?(:appsec) && settings.appsec.enabled
 
           processor = create_processor(settings)
+          # We want to always instrument user events when AppSec is enabled.
+          # There could be cases in which users use the DD_APPSEC_ENABLED Env variable to
+          # enable AppSec, in that case, Devise is already instrumented.
+          # In the case that users do not use DD_APPSEC_ENABLED, we have to instrument it,
+          # hence the lines above.
+
+          devise_integration = Datadog::AppSec::Contrib::Devise::Integration.new
+          settings.appsec.instrument(:devise) unless devise_integration.patcher.patched?
+
           new(processor: processor)
         end
 

data/lib/datadog/appsec/configuration/settings.rb

@@ -1,223 +1,138 @@
 # frozen_string_literal: true
 
-require 'set'
+require_relative '../../core/utils/duration'
 
 module Datadog
   module AppSec
     module Configuration
-      # Configuration settings, acting as an integration registry
-      # TODO: as with Configuration, this is a trivial implementation
-      class Settings
-        class << self
-          def boolean
-            # @type ^(::String) -> bool
-            ->(v) do # rubocop:disable Style/Lambda
-              case v
-              when /(1|true)/i
-                true
-              when /(0|false)/i, nil
-                false
-              else
-                raise ArgumentError, "invalid boolean: #{v.inspect}"
-              end
-            end
-          end
-
-          # TODO: allow symbols
-          def string
-            # @type ^(::String) -> ::String
-            ->(v) { v.to_s }
-          end
-
-          def integer
-            # @type ^(::String) -> ::Integer
-            ->(v) do # rubocop:disable Style/Lambda
-              case v
-              when /(\d+)/
-                Regexp.last_match(1).to_i
-              else
-                raise ArgumentError, "invalid integer: #{v.inspect}"
-              end
-            end
-          end
-
-          # rubocop:disable Metrics/MethodLength
-          def duration(base = :ns, type = :integer)
-            # @type ^(::String) -> ::Integer | ::Float
-            ->(v) do # rubocop:disable Style/Lambda
-              cast = case type
-                     when :integer, Integer
-                       method(:Integer)
-                     when :float, Float
-                       method(:Float)
-                     else
-                       raise ArgumentError, "invalid type: #{v.inspect}"
-                     end
-
-              scale = case base
-                      when :s
-                        1_000_000_000
-                      when :ms
-                        1_000_000
-                      when :us
-                        1000
-                      when :ns
-                        1
-                      else
-                        raise ArgumentError, "invalid base: #{v.inspect}"
-                      end
-
-              case v
-              when /^(\d+)h$/
-                cast.call(Regexp.last_match(1)) * 1_000_000_000 * 60 * 60 / scale
-              when /^(\d+)m$/
-                cast.call(Regexp.last_match(1)) * 1_000_000_000 * 60 / scale
-              when /^(\d+)s$/
-                cast.call(Regexp.last_match(1)) * 1_000_000_000 / scale
-              when /^(\d+)ms$/
-                cast.call(Regexp.last_match(1)) * 1_000_000 / scale
-              when /^(\d+)us$/
-                cast.call(Regexp.last_match(1)) * 1_000 / scale
-              when /^(\d+)ns$/
-                cast.call(Regexp.last_match(1)) / scale
-              when /^(\d+)$/
-                cast.call(Regexp.last_match(1))
-              else
-                raise ArgumentError, "invalid duration: #{v.inspect}"
-              end
-            end
-          end
-          # rubocop:enable Metrics/MethodLength
-        end
-
+      # Settings
+      module Settings
         # rubocop:disable Layout/LineLength
         DEFAULT_OBFUSCATOR_KEY_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?)key)|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization'
         DEFAULT_OBFUSCATOR_VALUE_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:\s*=[^;]|"\s*:\s*"[^"]+")|bearer\s+[a-z0-9\._\-]+|token:[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L][\w=-]+\.ey[I-L][\w=-]+(?:\.[\w.+\/=-]+)?|[\-]{5}BEGIN[a-z\s]+PRIVATE\sKEY[\-]{5}[^\-]+[\-]{5}END[a-z\s]+PRIVATE\sKEY|ssh-rsa\s*[a-z0-9\/\.+]{100,}'
         # rubocop:enable Layout/LineLength
-
-        DEFAULTS = {
-          enabled: false,
-          ruleset: :recommended,
-          waf_timeout: 5_000, # us
-          waf_debug: false,
-          trace_rate_limit: 100, # traces/s
-          obfuscator_key_regex: DEFAULT_OBFUSCATOR_KEY_REGEX,
-          obfuscator_value_regex: DEFAULT_OBFUSCATOR_VALUE_REGEX,
-        }.freeze
-
-        ENVS = {
-          'DD_APPSEC_ENABLED' => [:enabled, Settings.boolean],
-          'DD_APPSEC_RULES' => [:ruleset, Settings.string],
-          'DD_APPSEC_WAF_TIMEOUT' => [:waf_timeout, Settings.duration(:us)],
-          'DD_APPSEC_WAF_DEBUG' => [:waf_debug, Settings.boolean],
-          'DD_APPSEC_TRACE_RATE_LIMIT' => [:trace_rate_limit, Settings.integer],
-          'DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP' => [:obfuscator_key_regex, Settings.string],
-          'DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP' => [:obfuscator_value_regex, Settings.string],
-        }.freeze
-
-        # Struct constant whisker cast for Steep
-        Integration = _ = Struct.new(:integration) # rubocop:disable Naming/ConstantName
-
-        def initialize
-          @integrations = []
-          # Stores which options have been configured using Datadog.configure block or ENV variables
-          @configured = Set.new
-          @options = DEFAULTS.dup.tap do |options|
-            ENVS.each do |env, (key, conv)|
-              if ENV[env]
-                options[key] = conv.call(ENV[env])
-                @configured << key
-              end
-            end
-          end
-        end
-
-        def enabled
-          # Cast for Steep
-          _ = @options[:enabled]
-        end
-
-        def ruleset
-          # Cast for Steep
-          _ = @options[:ruleset]
+        APPSEC_VALID_TRACK_USER_EVENTS_MODE = [
+          'safe',
+          'extended'
+        ].freeze
+        APPSEC_VALID_TRACK_USER_EVENTS_ENABLED_VALUES = [
+          '1',
+          'true'
+        ].concat(APPSEC_VALID_TRACK_USER_EVENTS_MODE).freeze
+
+        def self.extended(base)
+          base = base.singleton_class unless base.is_a?(Class)
+          add_settings!(base)
         end
 
-        # EXPERIMENTAL: This configurable is not meant to be publicly used, but
-        #               is very useful for testing. It may change at any point in time.
-        def ip_denylist
-          # Cast for Steep
-          _ = @options[:ip_denylist] || []
-        end
+        # rubocop:disable Metrics/AbcSize,Metrics/MethodLength,Metrics/BlockLength
+        def self.add_settings!(base)
+          base.class_eval do
+            settings :appsec do
+              option :enabled do |o|
+                o.type :bool
+                o.env 'DD_APPSEC_ENABLED'
+                o.default false
+              end
 
-        # EXPERIMENTAL: This configurable is not meant to be publicly used, but
-        #               is very useful for testing. It may change at any point in time.
-        def user_id_denylist
-          # Cast for Steep
-          _ = @options[:user_id_denylist] || []
-        end
+              define_method(:instrument) do |integration_name|
+                if enabled
+                  registered_integration = Datadog::AppSec::Contrib::Integration.registry[integration_name]
+                  if registered_integration
+                    klass = registered_integration.klass
+                    if klass.loaded? && klass.compatible?
+                      instance = klass.new
+                      instance.patcher.patch unless instance.patcher.patched?
+                    end
+                  end
+                end
+              end
 
-        def waf_timeout
-          # Cast for Steep
-          _ = @options[:waf_timeout]
-        end
+              option :ruleset do |o|
+                o.env 'DD_APPSEC_RULES'
+                o.default :recommended
+              end
 
-        def waf_debug
-          # Cast for Steep
-          _ = @options[:waf_debug]
-        end
+              option :ip_denylist do |o|
+                o.type :array
+                o.default []
+              end
 
-        def trace_rate_limit
-          # Cast for Steep
-          _ = @options[:trace_rate_limit]
-        end
+              option :user_id_denylist do |o|
+                o.type :array
+                o.default []
+              end
 
-        def obfuscator_key_regex
-          # Cast for Steep
-          _ = @options[:obfuscator_key_regex]
-        end
+              option :waf_timeout do |o|
+                o.env 'DD_APPSEC_WAF_TIMEOUT' # us
+                o.default 5_000
+                o.setter do |v|
+                  Datadog::Core::Utils::Duration.call(v.to_s, base: :us)
+                end
+              end
 
-        def obfuscator_value_regex
-          # Cast for Steep
-          _ = @options[:obfuscator_value_regex]
-        end
+              option :waf_debug do |o|
+                o.env 'DD_APPSEC_WAF_DEBUG'
+                o.default false
+                o.type :bool
+              end
 
-        def merge(dsl)
-          dsl.options.each do |k, v|
-            unless v.nil?
-              @options[k] = v
-              @configured << k
-            end
-          end
+              option :trace_rate_limit do |o|
+                o.type :int
+                o.env 'DD_APPSEC_TRACE_RATE_LIMIT' # trace/s
+                o.default 100
+              end
 
-          return self unless @options[:enabled]
+              option :obfuscator_key_regex do |o|
+                o.type :string
+                o.env 'DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP'
+                o.default DEFAULT_OBFUSCATOR_KEY_REGEX
+              end
 
-          # patcher.patch may call configure again, hence merge might be called again so it needs to be reentrant
-          dsl.instruments.each do |instrument|
-            # TODO: error handling
-            registered_integration = Datadog::AppSec::Contrib::Integration.registry[instrument.name]
-            @integrations << Integration.new(registered_integration)
+              option :obfuscator_value_regex do |o|
+                o.type :string
+                o.env 'DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP'
+                o.default DEFAULT_OBFUSCATOR_VALUE_REGEX
+              end
 
-            # TODO: move to a separate apply step
-            klass = registered_integration.klass
-            if klass.loaded? && klass.compatible?
-              instance = klass.new
-              instance.patcher.patch
+              settings :track_user_events do
+                option :enabled do |o|
+                  o.default true
+                  o.type :bool
+                  o.env 'DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING'
+                  o.env_parser do |env_value|
+                    if env_value == 'disabled'
+                      false
+                    else
+                      APPSEC_VALID_TRACK_USER_EVENTS_ENABLED_VALUES.include?(env_value.strip.downcase)
+                    end
+                  end
+                end
+
+                option :mode do |o|
+                  o.type :string
+                  o.env 'DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING'
+                  o.default 'safe'
+                  o.setter do |v|
+                    if APPSEC_VALID_TRACK_USER_EVENTS_MODE.include?(v)
+                      v
+                    elsif v == 'disabled'
+                      'safe'
+                    else
+                      Datadog.logger.warn(
+                        'The appsec.track_user_events.mode value provided is not supported.' \
+                        'Supported values are: safe | extended.' \
+                        'Using default value `safe`'
+                      )
+                      'safe'
+                    end
+                  end
+                end
+              end
             end
           end
-
-          self
-        end
-
-        private
-
-        def default?(option)
-          !@configured.include?(option)
-        end
-
-        # Restore to original state, for testing only.
-        def reset!
-          initialize
         end
+        # rubocop:enable Metrics/AbcSize,Metrics/MethodLength,Metrics/BlockLength
       end
     end
   end

data/lib/datadog/appsec/configuration.rb

@@ -5,86 +5,7 @@ require_relative 'configuration/settings'
 module Datadog
   module AppSec
     # Configuration for AppSec
-    # TODO: this is a trivial implementation, check with shareable code with
-    # tracer and other products
     module Configuration
-      def self.included(base)
-        base.extend(ClassMethods)
-      end
-
-      # Configuration DSL implementation
-      class DSL
-        # Struct constant whisker cast for Steep
-        Instrument = _ = Struct.new(:name) # rubocop:disable Naming/ConstantName
-
-        def initialize
-          @instruments = []
-          @options = {}
-        end
-
-        attr_reader :instruments, :options
-
-        def instrument(name)
-          @instruments << Instrument.new(name)
-        end
-
-        def enabled=(value)
-          options[:enabled] = value
-        end
-
-        def ruleset=(value)
-          options[:ruleset] = value
-        end
-
-        def ip_denylist=(value)
-          options[:ip_denylist] = value
-        end
-
-        def user_id_denylist=(value)
-          options[:user_id_denylist] = value
-        end
-
-        # in microseconds
-        def waf_timeout=(value)
-          options[:waf_timeout] = value
-        end
-
-        def waf_debug=(value)
-          options[:waf_debug] = value
-        end
-
-        def trace_rate_limit=(value)
-          options[:trace_rate_limit] = value
-        end
-
-        def obfuscator_key_regex=(value)
-          options[:obfuscator_key_regex] = value
-        end
-
-        def obfuscator_value_regex=(value)
-          options[:obfuscator_value_regex] = value
-        end
-      end
-
-      # class-level methods for Configuration
-      module ClassMethods
-        def configure
-          dsl = DSL.new
-          yield dsl
-          settings.merge(dsl)
-          settings
-        end
-
-        def settings
-          @settings ||= Settings.new
-        end
-
-        private
-
-        def default_setting?(setting)
-          settings.send(:default?, setting)
-        end
-      end
     end
   end
 end