@dargmuesli/nuxt-vio 23.1.2 → 23.1.4

package/app/composables/sentry.ts

@@ -5,7 +5,7 @@ export const useSharedSentryConfig = () => {
   const runtimeConfig = useRuntimeConfig()
 
   return getSharedSentryConfig({
-    enableLogs: runtimeConfig.public.sentry.logs.enable,
+    dataCollection: runtimeConfig.public.sentry.dataCollection,
     environment: runtimeConfig.public.sentry.environment,
     host: runtimeConfig.public.sentry.host,
     isInProduction: runtimeConfig.public.vio.isInProduction,

package/node/networking.ts

@@ -10,6 +10,37 @@ export const getHost = (event: { headers: Headers }) => {
   return host
 }
 
+// derives the origins this project itself talks to, so Sentry's trace context is only propagated
+// to its own services and never to third parties
+export const getTracePropagationTargets = ({
+  baseUrl,
+  services = SERVICES,
+}: {
+  baseUrl?: string
+  services?: Record<string, Service>
+}): string[] => {
+  if (!baseUrl) return []
+
+  let base: URL
+  try {
+    base = new URL(baseUrl)
+  } catch {
+    return []
+  }
+
+  const targets = [base.origin]
+
+  for (const [name, service] of Object.entries(services)) {
+    if (!service.hasSubdomain) continue
+
+    targets.push(
+      `${base.protocol}//${name.replaceAll('_', '-')}.${getRootHost(base.hostname)}`,
+    )
+  }
+
+  return targets
+}
+
 export const getRootHost = (host: string) => {
   const hostParts = host.split('.')
   const hostPartsLast = hostParts[hostParts.length - 1]

package/node/server/node.mjs

@@ -16,5 +16,4 @@ if (fs.existsSync(certPath) && fs.existsSync(keyPath)) {
   process.env.NITRO_SSL_KEY = fs.readFileSync(keyPath, 'utf8')
 }
 
-// await import(path.join(root, '.output/server/sentry.server.config.mjs'))
 await import(path.join(root, 'playground/.output/server/index.mjs'))

package/node/static/sentry.ts

@@ -5,14 +5,40 @@ export const NUXT_PUBLIC_SENTRY_ENVIRONMENT =
 export const NUXT_PUBLIC_SENTRY_HOST = process.env.NUXT_PUBLIC_SENTRY_HOST || ''
 export const NUXT_PUBLIC_SENTRY_LOGS_ENABLE =
   process.env.NUXT_PUBLIC_SENTRY_LOGS_ENABLE !== 'false'
+export const NUXT_PUBLIC_SENTRY_PROFILE_SESSION_SAMPLE_RATE = Number.parseFloat(
+  process.env.NUXT_PUBLIC_SENTRY_PROFILE_SESSION_SAMPLE_RATE ?? '0.1',
+)
+export const NUXT_PUBLIC_SENTRY_PROFILING_ENABLE =
+  process.env.NUXT_PUBLIC_SENTRY_PROFILING_ENABLE !== 'false'
 export const NUXT_PUBLIC_SENTRY_PROJECT_ID =
   process.env.NUXT_PUBLIC_SENTRY_PROJECT_ID || ''
 export const NUXT_PUBLIC_SENTRY_PROJECT_PUBLIC_KEY =
   process.env.NUXT_PUBLIC_SENTRY_PROJECT_PUBLIC_KEY || ''
 export const NUXT_PUBLIC_SENTRY_RELEASE = process.env.RELEASE_NAME
 
+// v11's `dataCollection` collects more personal data by default than v10 did. This floor restores
+// the previous, restrictive behavior for the categories v11 started to collect, without redefining
+// Sentry's other defaults. Extending projects can relax or tighten any category through
+// `runtimeConfig.public.sentry.dataCollection`, which is merged over this floor.
+const SENTRY_DATA_COLLECTION_FLOOR: NonNullable<
+  Parameters<typeof Sentry.init>[0]['dataCollection']
+> = {
+  cookies: false,
+  databaseQueryData: false,
+  genAI: {
+    inputs: false,
+    outputs: false,
+  },
+  graphQL: {
+    document: false,
+    variables: false,
+  },
+  httpBodies: [],
+  userInfo: false,
+}
+
 export const getSharedSentryConfig = ({
-  enableLogs,
+  dataCollection,
   environment,
   host,
   isInProduction,
@@ -21,7 +47,7 @@ export const getSharedSentryConfig = ({
   projectPublicKey,
   release,
 }: {
-  enableLogs?: boolean
+  dataCollection?: Parameters<typeof Sentry.init>[0]['dataCollection']
   environment?: string
   host?: string
   isInProduction: boolean
@@ -30,12 +56,23 @@ export const getSharedSentryConfig = ({
   projectPublicKey?: string
   release?: string
 }): Parameters<typeof Sentry.init>[0] => ({
+  dataCollection: {
+    ...SENTRY_DATA_COLLECTION_FLOOR,
+    ...dataCollection,
+    genAI: {
+      ...SENTRY_DATA_COLLECTION_FLOOR.genAI,
+      ...dataCollection?.genAI,
+    },
+    graphQL: {
+      ...SENTRY_DATA_COLLECTION_FLOOR.graphQL,
+      ...dataCollection?.graphQL,
+    },
+  },
   dsn:
     projectPublicKey && host && projectId
       ? `https://${projectPublicKey}@${host}/${projectId}`
       : undefined,
   enabled: isInProduction && !isTesting,
-  enableLogs,
   environment,
   release,
   tracesSampleRate: 1.0,

package/nuxt.config.ts

@@ -154,15 +154,27 @@ export default defineNuxtConfig(
           asyncContext: true,
         },
       },
+      routeRules: {
+        '/**': {
+          headers: {
+            'Document-Policy': 'js-profiling', // required by Sentry's browser profiling (Chromium-based browsers)
+          },
+        },
+      },
       runtimeConfig: {
         public: {
           i18n: {
             baseUrl: SITE_URL,
           },
           sentry: {
+            // merged over this layer's data collection floor, so extending projects can relax or
+            // tighten individual categories of collected data
+            dataCollection: {},
             environment: NUXT_PUBLIC_SENTRY_ENVIRONMENT,
             features: {
               consoleCapture: true,
+              // not every extending project uses GraphQL, so this is opt-in
+              graphqlClient: false,
               pinia: true,
               profiling: true,
               replay: true,

package/package.json

@@ -15,11 +15,12 @@
     "@nuxtjs/seo": "6.0.1",
     "@nuxtjs/turnstile": "1.1.3",
     "@pinia/nuxt": "1.0.3",
-    "@sentry/nuxt": "10.76.2",
+    "@sentry/nuxt": "11.8.0",
+    "@sentry/profiling-node": "11.8.0",
     "@tailwindcss/forms": "0.5.11",
     "@tailwindcss/typography": "0.5.20",
     "@tailwindcss/vite": "4.3.3",
-    "@takumi-rs/core": "2.16.3",
+    "@takumi-rs/core": "2.17.0",
     "@types/lodash-es": "4.17.12",
     "@types/nodemailer": "8.0.2",
     "@urql/core": "6.0.3",
@@ -104,7 +105,7 @@
     "url": "git+https://github.com/dargmuesli/vio.git"
   },
   "type": "module",
-  "version": "23.1.2",
+  "version": "23.1.4",
   "scripts": {
     "build": "pnpm run build:node",
     "build:node": "NUXT_PUBLIC_I18N_BASE_URL=https://app.localhost:3001 nuxt build playground",

package/sentry.client.config.ts

@@ -1,5 +1,7 @@
 import * as Sentry from '@sentry/nuxt'
 
+import { getTracePropagationTargets } from './node/networking'
+
 const runtimeConfig = useRuntimeConfig()
 const sharedSentryConfig = useSharedSentryConfig()
 
@@ -10,26 +12,42 @@ if (sharedSentryConfig.dsn) {
     ...sharedSentryConfig,
     integrations: [
       ...(features.profiling ? [Sentry.browserProfilingIntegration()] : []),
-      ...(features.consoleCapture
-        ? [
-            Sentry.captureConsoleIntegration(),
-            Sentry.consoleLoggingIntegration(),
-          ]
+      ...(features.consoleCapture ? [Sentry.captureConsoleIntegration()] : []),
+      ...(runtimeConfig.public.sentry.logs.enable
+        ? [Sentry.consoleLoggingIntegration()]
         : []),
       Sentry.httpClientIntegration(),
+      ...(features.graphqlClient
+        ? [Sentry.graphqlClientIntegration({ endpoints: [/\/graphql$/] })]
+        : []),
       ...(features.pinia ? [Sentry.piniaIntegration(usePinia())] : []),
-      ...(features.replay ? [Sentry.replayIntegration()] : []),
+      ...(features.replay
+        ? [
+            // replays are personal data, so everything is masked by default (GDPR)
+            Sentry.replayIntegration({
+              maskAllInputs: true,
+              maskAllText: true,
+            }),
+          ]
+        : []),
       Sentry.zodErrorsIntegration(),
     ],
-    profilesSampleRate: features.profiling
+    // v11 replaced `profilesSampleRate` with `profileSessionSampleRate` (defaulting to `0`) and
+    // `profileLifecycle` (defaulting to `'manual'`); both are required to keep the v10 behavior
+    profileLifecycle: 'trace',
+    profileSessionSampleRate: features.profiling
       ? runtimeConfig.public.sentry.profiles.sampleRate
-      : undefined,
+      : 0,
     replaysOnErrorSampleRate: features.replay
       ? runtimeConfig.public.sentry.replays.onError.sampleRate
       : undefined,
     replaysSessionSampleRate: features.replay
       ? runtimeConfig.public.sentry.replays.session.sampleRate
       : undefined,
+    tracePropagationTargets: getTracePropagationTargets({
+      baseUrl: runtimeConfig.public.i18n.baseUrl,
+      services: runtimeConfig.public.vio.services,
+    }),
   })
 } else {
   console.warn(

package/sentry.server.config.ts

@@ -1,4 +1,5 @@
 import * as Sentry from '@sentry/nuxt'
+import { nodeProfilingIntegration } from '@sentry/profiling-node'
 
 import {
   getSharedSentryConfig,
@@ -6,13 +7,14 @@ import {
   NUXT_PUBLIC_SENTRY_ENVIRONMENT,
   NUXT_PUBLIC_SENTRY_HOST,
   NUXT_PUBLIC_SENTRY_LOGS_ENABLE,
+  NUXT_PUBLIC_SENTRY_PROFILE_SESSION_SAMPLE_RATE,
+  NUXT_PUBLIC_SENTRY_PROFILING_ENABLE,
   NUXT_PUBLIC_SENTRY_PROJECT_ID,
   NUXT_PUBLIC_SENTRY_PROJECT_PUBLIC_KEY,
   NUXT_PUBLIC_SENTRY_RELEASE,
 } from './node/static'
 
 const sharedSentryConfig = getSharedSentryConfig({
-  enableLogs: NUXT_PUBLIC_SENTRY_LOGS_ENABLE,
   environment: NUXT_PUBLIC_SENTRY_ENVIRONMENT,
   host: NUXT_PUBLIC_SENTRY_HOST,
   isInProduction: IS_IN_PRODUCTION,
@@ -25,9 +27,19 @@ const sharedSentryConfig = getSharedSentryConfig({
 if (sharedSentryConfig.dsn) {
   Sentry.init({
     ...sharedSentryConfig,
-    integrations: NUXT_PUBLIC_SENTRY_LOGS_ENABLE
-      ? [Sentry.consoleLoggingIntegration()]
-      : [],
+    integrations: [
+      ...(NUXT_PUBLIC_SENTRY_LOGS_ENABLE
+        ? [Sentry.consoleLoggingIntegration()]
+        : []),
+      // v11 moved node profiling into the standalone `@sentry/profiling-node` package
+      ...(NUXT_PUBLIC_SENTRY_PROFILING_ENABLE
+        ? [nodeProfilingIntegration()]
+        : []),
+    ],
+    profileLifecycle: 'trace',
+    profileSessionSampleRate: NUXT_PUBLIC_SENTRY_PROFILING_ENABLE
+      ? NUXT_PUBLIC_SENTRY_PROFILE_SESSION_SAMPLE_RATE
+      : 0,
   })
 } else {
   console.warn(