@depup/dd-trace 5.90.0-depup.0

package/packages/dd-trace/src/propagation-hash/index.js

@@ -0,0 +1,145 @@
+'use strict'
+
+const { fnv64 } = require('../datastreams/fnv')
+const log = require('../log')
+
+/**
+ * PropagationHashManager is a singleton that manages the propagation hash computation.
+ * The propagation hash is an FNV-1a 64-bit hash combining:
+ * - Process tags (entrypoint info, package.json name, etc.)
+ * - Container tags hash (received from the Datadog agent)
+ *
+ * This hash is used to correlate traces with database operations (DBM) and
+ * data stream pathways (DSM) for enhanced observability.
+ */
+class PropagationHashManager {
+  _containerTagsHash = null
+  _cachedHash = null
+  _cachedHashString = null
+  _cachedHashBase64 = null
+  _config = null
+
+  /**
+   * Configure the propagation hash manager with tracer config
+   * @param {object} config - Tracer configuration
+   */
+  configure (config) {
+    this._config = config
+  }
+
+  /**
+   * Check if process tags propagation is enabled
+   * @returns {boolean}
+   */
+  isEnabled () {
+    return this._config?.propagateProcessTags?.enabled === true
+  }
+
+  /**
+   * Update the container tags hash received from the agent
+   * @param {string} hash - Container tags hash from agent response
+   */
+  updateContainerTagsHash (hash) {
+    if (hash !== this._containerTagsHash) {
+      log.debug('Updating container tags hash: %s', hash)
+      this._containerTagsHash = hash
+      this._invalidateCache()
+    }
+  }
+
+  /**
+   * Get the propagation hash as a BigInt
+   * @returns {bigint | null} The propagation hash or null if disabled/unavailable
+   */
+  getHash () {
+    if (!this.isEnabled()) {
+      return null
+    }
+    if (this._cachedHash) {
+      return this._cachedHash
+    }
+    this._computeHash()
+    return this._cachedHash
+  }
+
+  /**
+   * Get the propagation hash as a hexadecimal string
+   * @returns {string|null} The propagation hash in hex format or null if disabled/unavailable
+   */
+  getHashString () {
+    const hash = this.getHash()
+    if (!hash) {
+      return null
+    }
+    if (!this._cachedHashString) {
+      this._cachedHashString = hash.toString(16)
+    }
+    return this._cachedHashString
+  }
+
+  /**
+   * Get the propagation hash as a base64 string
+   * @returns {string|null} The propagation hash in base64 format or null if disabled/unavailable
+   */
+  getHashBase64 () {
+    const hash = this.getHash()
+    if (!hash) {
+      return null
+    }
+    if (!this._cachedHashBase64) {
+      // Convert BigInt to 8-byte buffer (64-bit hash)
+      const buffer = Buffer.allocUnsafe(8)
+      // Write as big-endian 64-bit unsigned integer
+      buffer.writeBigUInt64BE(hash, 0)
+      this._cachedHashBase64 = buffer.toString('base64')
+    }
+    return this._cachedHashBase64
+  }
+
+  /**
+   * Compute the propagation hash using FNV-1a algorithm
+   * @private
+   */
+  _computeHash () {
+    try {
+      const processTags = require('../process-tags')
+
+      // Combine process tags and container tags hash
+      // Process tags are already serialized as a comma-separated string
+      const input = processTags.serialized + (this._containerTagsHash || '')
+
+      if (!input) {
+        // If both are empty, don't compute a hash
+        this._cachedHash = null
+        this._cachedHashString = null
+        this._cachedHashBase64 = null
+        return
+      }
+
+      // Compute FNV-1a 64-bit hash
+      this._cachedHash = fnv64(input)
+      this._cachedHashString = null // Will be computed on demand
+      this._cachedHashBase64 = null // Will be computed on demand
+
+      log.debug('Computed propagation hash from input (length=%s): "%s"', input.length, this._cachedHash.toString(16))
+    } catch (e) {
+      log.error('Error computing propagation hash', e)
+      this._cachedHash = null
+      this._cachedHashString = null
+      this._cachedHashBase64 = null
+    }
+  }
+
+  /**
+   * Invalidate the cached hash
+   * @private
+   */
+  _invalidateCache () {
+    this._cachedHash = null
+    this._cachedHashString = null
+    this._cachedHashBase64 = null
+  }
+}
+
+// Export singleton instance
+module.exports = new PropagationHashManager()

package/packages/dd-trace/src/proxy.js

@@ -0,0 +1,351 @@
+'use strict'
+
+const { getValueFromEnvSources } = require('./config/helper')
+const NoopProxy = require('./noop/proxy')
+const DatadogTracer = require('./tracer')
+const getConfig = require('./config')
+const runtimeMetrics = require('./runtime_metrics')
+const log = require('./log')
+const { setStartupLogPluginManager, startupLog } = require('./startup-log')
+const DynamicInstrumentation = require('./debugger')
+const telemetry = require('./telemetry')
+const nomenclature = require('./service-naming')
+const PluginManager = require('./plugin_manager')
+const NoopDogStatsDClient = require('./noop/dogstatsd')
+const { IS_SERVERLESS } = require('./serverless')
+const {
+  setBaggageItem,
+  getBaggageItem,
+  getAllBaggageItems,
+  removeBaggageItem,
+  removeAllBaggageItems,
+} = require('./baggage')
+
+class LazyModule {
+  constructor (provider) {
+    this.provider = provider
+  }
+
+  enable (...args) {
+    this.module = this.provider()
+    this.module.enable(...args)
+  }
+
+  disable () {
+    this.module?.disable()
+  }
+}
+
+function lazyProxy (...args) {
+  if (IS_SERVERLESS === false) {
+    defineEagerly(...args)
+  } else {
+    defineLazily(...args)
+  }
+}
+
+function defineEagerly (obj, property, getClass, ...args) {
+  const RealClass = getClass()
+
+  obj[property] = new RealClass(...args)
+}
+
+function defineLazily (obj, property, getClass, ...args) {
+  Reflect.defineProperty(obj, property, {
+    get () {
+      const RealClass = getClass()
+      const value = new RealClass(...args)
+
+      Reflect.defineProperty(obj, property, { value, configurable: true, enumerable: true })
+
+      return value
+    },
+    configurable: true,
+    enumerable: true,
+  })
+}
+
+class Tracer extends NoopProxy {
+  constructor () {
+    super()
+
+    this._initialized = false
+    this._nomenclature = nomenclature
+    this._pluginManager = new PluginManager(this)
+    this.dogstatsd = new NoopDogStatsDClient()
+    this._tracingInitialized = false
+    this._flare = new LazyModule(() => require('./flare'))
+    this.setBaggageItem = setBaggageItem
+    this.getBaggageItem = getBaggageItem
+    this.getAllBaggageItems = getAllBaggageItems
+    this.removeBaggageItem = removeBaggageItem
+    this.removeAllBaggageItems = removeAllBaggageItems
+
+    // these requires must work with esm bundler
+    this._modules = {
+      appsec: new LazyModule(() => require('./appsec')),
+      iast: new LazyModule(() => require('./appsec/iast')),
+      llmobs: new LazyModule(() => require('./llmobs')),
+      rewriter: new LazyModule(() => require('./appsec/iast/taint-tracking/rewriter')),
+      openfeature: new LazyModule(() => require('./openfeature')),
+    }
+  }
+
+  /**
+   * @override
+   */
+  init (options) {
+    if (this._initialized) return this
+
+    this._initialized = true
+
+    try {
+      const config = getConfig(options) // TODO: support dynamic code config
+
+      // Configure propagation hash manager for process tags + container tags
+      const propagationHash = require('./propagation-hash')
+      propagationHash.configure(config)
+
+      if (config.crashtracking.enabled) {
+        require('./crashtracking').start(config)
+      }
+
+      if (config.heapSnapshot.count > 0) {
+        require('./heap_snapshots').start(config)
+      }
+
+      telemetry.start(config, this._pluginManager)
+
+      if (config.dogstatsd) {
+        // Custom Metrics
+        lazyProxy(this, 'dogstatsd', () => require('./dogstatsd').CustomMetrics, config)
+      }
+
+      if (config.spanLeakDebug > 0) {
+        const spanleak = require('./spanleak')
+        if (config.spanLeakDebug === spanleak.MODES.LOG) {
+          spanleak.enableLogging()
+        } else if (config.spanLeakDebug === spanleak.MODES.GC_AND_LOG) {
+          spanleak.enableGarbageCollection()
+        }
+        spanleak.startScrubber()
+      }
+
+      if (config.remoteConfig.enabled && !config.isCiVisibility) {
+        const RemoteConfig = require('./remote_config')
+        const rc = new RemoteConfig(config)
+
+        const tracingRemoteConfig = require('./config/remote_config')
+        tracingRemoteConfig.enable(rc, config, () => {
+          this.#updateTracing(config)
+          this.#updateDebugger(config, rc)
+        })
+
+        rc.setProductHandler('AGENT_CONFIG', (action, conf) => {
+          if (!conf?.name?.startsWith('flare-log-level.')) return
+
+          if (action === 'unapply') {
+            this._flare.disable()
+          } else if (conf.config?.log_level) {
+            this._flare.enable(config)
+            this._flare.module.prepare(conf.config.log_level)
+          }
+        })
+
+        rc.setProductHandler('AGENT_TASK', (action, conf) => {
+          if (action === 'unapply' || !conf) return
+          if (conf.task_type !== 'tracer_flare' || !conf.args) return
+
+          this._flare.enable(config)
+          this._flare.module.send(conf.args)
+        })
+
+        if (this._modules.appsec) {
+          const appsecRemoteConfig = require('./appsec/remote_config')
+          appsecRemoteConfig.enable(rc, config, this._modules.appsec)
+        }
+
+        if (config.dynamicInstrumentation.enabled) {
+          DynamicInstrumentation.start(config, rc)
+        }
+
+        const openfeatureRemoteConfig = require('./openfeature/remote_config')
+        openfeatureRemoteConfig.enable(rc, config, () => this.openfeature)
+      }
+
+      if (config.profiling.enabled === 'true') {
+        this._profilerStarted = this._startProfiler(config)
+      } else {
+        this._profilerStarted = Promise.resolve(false)
+        if (config.profiling.enabled === 'auto') {
+          const { SSIHeuristics } = require('./profiling/ssi-heuristics')
+          const ssiHeuristics = new SSIHeuristics(config)
+          ssiHeuristics.start()
+          ssiHeuristics.onTriggered(() => {
+            this._startProfiler(config)
+            ssiHeuristics.onTriggered() // deregister this callback
+          })
+        }
+      }
+
+      if (config.runtimeMetrics.enabled) {
+        runtimeMetrics.start(config)
+      }
+
+      this.#updateTracing(config)
+
+      this._modules.rewriter.enable(config)
+
+      if (config.tracing && config.isManualApiEnabled) {
+        const TestApiManualPlugin = require('./ci-visibility/test-api-manual/test-api-manual-plugin')
+        this._testApiManualPlugin = new TestApiManualPlugin(this)
+        // `shouldGetEnvironmentData` is passed as false so that we only lazily calculate it
+        // This is the only place where we need to do this because the rest of the plugins
+        // are lazily configured when the library is imported.
+        this._testApiManualPlugin.configure({ ...config, enabled: true }, false)
+      }
+      if (config.ciVisAgentlessLogSubmissionEnabled) {
+        if (getValueFromEnvSources('DD_API_KEY')) {
+          const LogSubmissionPlugin = require('./ci-visibility/log-submission/log-submission-plugin')
+          const automaticLogPlugin = new LogSubmissionPlugin(this)
+          automaticLogPlugin.configure({ ...config, enabled: true })
+        } else {
+          log.warn(
+            // eslint-disable-next-line @stylistic/max-len
+            'DD_AGENTLESS_LOG_SUBMISSION_ENABLED is set, but DD_API_KEY is undefined, so no automatic log submission will be performed.'
+          )
+        }
+      }
+
+      if (config.otelLogsEnabled) {
+        const { initializeOpenTelemetryLogs } = require('./opentelemetry/logs')
+        initializeOpenTelemetryLogs(config)
+      }
+
+      if (config.otelMetricsEnabled) {
+        const { initializeOpenTelemetryMetrics } = require('./opentelemetry/metrics')
+        initializeOpenTelemetryMetrics(config)
+      }
+
+      if (config.isTestDynamicInstrumentationEnabled) {
+        const getDynamicInstrumentationClient = require('./ci-visibility/dynamic-instrumentation')
+        // We instantiate the client but do not start the Worker here. The worker is started lazily
+        getDynamicInstrumentationClient(config)
+      }
+    } catch (e) {
+      log.error('Error initialising tracer', e)
+    }
+
+    return this
+  }
+
+  _startProfiler (config) {
+    // do not stop tracer initialization if the profiler fails to be imported
+    try {
+      return require('./profiler').start(config)
+    } catch (e) {
+      log.error(
+        'Error starting profiler. For troubleshooting tips, see <https://dtdg.co/nodejs-profiler-troubleshooting>',
+        e
+      )
+    }
+  }
+
+  #updateTracing (config) {
+    if (config.tracing !== false) {
+      if (config.appsec.enabled) {
+        this._modules.appsec.enable(config)
+      }
+      if (config.llmobs.enabled) {
+        this._modules.llmobs.enable(config)
+      }
+      if (!this._tracingInitialized) {
+        const prioritySampler = config.apmTracingEnabled === false
+          ? require('./standalone').configure(config)
+          : undefined
+        this._tracer = new DatadogTracer(config, prioritySampler)
+        this.dataStreamsCheckpointer = this._tracer.dataStreamsCheckpointer
+        lazyProxy(this, 'appsec', () => require('./appsec/sdk'), this._tracer, config)
+        lazyProxy(this, 'llmobs', () => require('./llmobs/sdk'), this._tracer, this._modules.llmobs, config)
+        if (config.experimental?.aiguard?.enabled) {
+          lazyProxy(this, 'aiguard', () => require('./aiguard/sdk'), this._tracer, config)
+        }
+        this._tracingInitialized = true
+      }
+      if (config.experimental.flaggingProvider.enabled) {
+        this._modules.openfeature.enable(config)
+        lazyProxy(this, 'openfeature', () => require('./openfeature/flagging_provider'), this._tracer, config)
+      }
+      if (config.iast.enabled) {
+        this._modules.iast.enable(config, this._tracer)
+      }
+      // This needs to be after the IAST module is enabled
+    } else if (this._tracingInitialized) {
+      this._modules.appsec.disable()
+      this._modules.iast.disable()
+      this._modules.llmobs.disable()
+      this._modules.openfeature.disable()
+    }
+
+    if (this._tracingInitialized) {
+      this._tracer.configure(config)
+      this._pluginManager.configure(config)
+      DynamicInstrumentation.configure(config)
+      setStartupLogPluginManager(this._pluginManager)
+      startupLog()
+    }
+  }
+
+  /**
+   * Updates the debugger (Dynamic Instrumentation) state based on remote config changes.
+   * Handles starting, stopping, and reconfiguring the debugger dynamically.
+   *
+   * @param {object} config - The tracer configuration object
+   * @param {object} rc - The RemoteConfig instance
+   */
+  #updateDebugger (config, rc) {
+    const shouldBeEnabled = config.dynamicInstrumentation.enabled
+    const isCurrentlyStarted = DynamicInstrumentation.isStarted()
+
+    if (shouldBeEnabled) {
+      if (isCurrentlyStarted) {
+        log.debug('[proxy] Reconfiguring Dynamic Instrumentation via remote config')
+        DynamicInstrumentation.configure(config)
+      } else {
+        log.debug('[proxy] Starting Dynamic Instrumentation via remote config')
+        DynamicInstrumentation.start(config, rc)
+      }
+    } else if (isCurrentlyStarted) {
+      log.debug('[proxy] Stopping Dynamic Instrumentation via remote config')
+      DynamicInstrumentation.stop()
+    }
+  }
+
+  /**
+   * @override
+   */
+  profilerStarted () {
+    if (!this._profilerStarted) {
+      // injection hardening: this is only ever invoked from tests.
+      throw new Error('profilerStarted() must be called after init()')
+    }
+    return this._profilerStarted
+  }
+
+  /**
+   * @override
+   */
+  use () {
+    this._pluginManager.configurePlugin(...arguments)
+    return this
+  }
+
+  /**
+   * @override
+   */
+  get TracerProvider () {
+    return require('./opentelemetry/tracer_provider')
+  }
+}
+
+module.exports = Tracer

package/packages/dd-trace/src/random_sampler.js

@@ -0,0 +1,40 @@
+'use strict'
+
+/**
+ * `RandomSampler` determines whether or not to sample an operation based on random chance.
+ *
+ * Use this class **only** when the operation you are sampling does **not have access**
+ * to a `Span` or its `SpanContext`.
+ *
+ * If a `Span` or its `SpanContext` **is** available, use the `Sampler` class instead as
+ * it uses a deterministic sampling algorithm consistent across all languages.
+ */
+class RandomSampler {
+  /**
+   * @param {number} rate
+   */
+  constructor (rate) {
+    this._rate = rate
+  }
+
+  /**
+   * @returns {number}
+   */
+  rate () {
+    return this._rate
+  }
+
+  /**
+   * Determines whether an operation should be sampled based on the configured sampling rate.
+   *
+   * Returns `true` if the sampling decision passes (i.e., the operation should be sampled).
+   * This happens if the sampling rate is `1` (i.e., always sample) or if a random value falls below the rate.
+   *
+   * @returns {boolean} `true` if the operation should be sampled, otherwise `false`.
+   */
+  isSampled () {
+    return this._rate === 1 || Math.random() < this._rate
+  }
+}
+
+module.exports = RandomSampler

package/packages/dd-trace/src/rate_limiter.js

@@ -0,0 +1,82 @@
+'use strict'
+
+const limiter = require('../../../vendor/dist/limiter')
+
+class RateLimiter {
+  /**
+   * @param {number} rateLimit - Allowed units per interval. Negative means unlimited, 0 disables.
+   * @param {'second'|'minute'|'hour'|'day'} [interval='second'] - Time window for the limiter.
+   */
+  constructor (rateLimit, interval = 'second') {
+    this._rateLimit = Number.parseInt(String(rateLimit))
+    // The limiter constructor accepts a token count number and an interval string
+    this._limiter = new limiter.RateLimiter(this._rateLimit, interval)
+    this._tokensRequested = 0
+    this._prevIntervalTokens = 0
+    this._prevTokensRequested = 0
+  }
+
+  /**
+   * Attempts to consume a token and reports whether it was allowed.
+   * Updates internal counters used for effective rate computation.
+   *
+   * @returns {boolean}
+   */
+  isAllowed () {
+    const curIntervalStart = this._limiter.curIntervalStart
+    const curIntervalTokens = this._limiter.tokensThisInterval
+    const allowed = this._isAllowed()
+
+    if (curIntervalStart === this._limiter.curIntervalStart) {
+      this._tokensRequested++
+    } else {
+      this._prevIntervalTokens = curIntervalTokens
+      this._prevTokensRequested = this._tokensRequested
+      this._tokensRequested = 1
+    }
+
+    return allowed
+  }
+
+  /**
+   * Returns the fraction of allowed requests over requested ones in the
+   * current and previous intervals combined.
+   *
+   * @returns {number}
+   */
+  effectiveRate () {
+    if (this._rateLimit < 0) return 1
+    if (this._rateLimit === 0) return 0
+    if (this._tokensRequested === 0) return 1
+
+    const allowed = this._prevIntervalTokens + this._limiter.tokensThisInterval
+    const requested = this._prevTokensRequested + this._tokensRequested
+
+    return allowed / requested
+  }
+
+  /**
+   * Internal token consumption without counter side-effects.
+   * @returns {boolean}
+   */
+  _isAllowed () {
+    if (this._rateLimit < 0) return true
+    if (this._rateLimit === 0) return false
+
+    return this._limiter.tryRemoveTokens(1)
+  }
+
+  /**
+   * Effective rate within the current interval only.
+   * @returns {number}
+   */
+  _currentWindowRate () {
+    if (this._rateLimit < 0) return 1
+    if (this._rateLimit === 0) return 0
+    if (this._tokensRequested === 0) return 1
+
+    return this._limiter.tokensThisInterval / this._tokensRequested
+  }
+}
+
+module.exports = RateLimiter

package/packages/dd-trace/src/remote_config/apply_states.js

@@ -0,0 +1,7 @@
+'use strict'
+
+module.exports = {
+  UNACKNOWLEDGED: 1,
+  ACKNOWLEDGED: 2,
+  ERROR: 3,
+}

package/packages/dd-trace/src/remote_config/capabilities.js

@@ -0,0 +1,47 @@
+'use strict'
+
+module.exports = {
+  ASM_ACTIVATION: 1n << 1n,
+  ASM_IP_BLOCKING: 1n << 2n,
+  ASM_DD_RULES: 1n << 3n,
+  ASM_EXCLUSIONS: 1n << 4n,
+  ASM_REQUEST_BLOCKING: 1n << 5n,
+  ASM_RESPONSE_BLOCKING: 1n << 6n,
+  ASM_USER_BLOCKING: 1n << 7n,
+  ASM_CUSTOM_RULES: 1n << 8n,
+  ASM_CUSTOM_BLOCKING_RESPONSE: 1n << 9n,
+  ASM_TRUSTED_IPS: 1n << 10n,
+  ASM_API_SECURITY_SAMPLE_RATE: 1n << 11n, // deprecated
+  APM_TRACING_SAMPLE_RATE: 1n << 12n,
+  APM_TRACING_LOGS_INJECTION: 1n << 13n,
+  APM_TRACING_HTTP_HEADER_TAGS: 1n << 14n,
+  APM_TRACING_CUSTOM_TAGS: 1n << 15n,
+  ASM_PROCESSOR_OVERRIDES: 1n << 16n,
+  ASM_CUSTOM_DATA_SCANNERS: 1n << 17n,
+  ASM_EXCLUSION_DATA: 1n << 18n,
+  APM_TRACING_ENABLED: 1n << 19n,
+  ASM_RASP_SQLI: 1n << 21n,
+  ASM_RASP_LFI: 1n << 22n,
+  ASM_RASP_SSRF: 1n << 23n,
+  ASM_RASP_SHI: 1n << 24n,
+  APM_TRACING_SAMPLE_RULES: 1n << 29n,
+  ASM_AUTO_USER_INSTRUM_MODE: 1n << 31n,
+  ASM_ENDPOINT_FINGERPRINT: 1n << 32n,
+  ASM_SESSION_FINGERPRINT: 1n << 33n,
+  ASM_NETWORK_FINGERPRINT: 1n << 34n,
+  ASM_HEADER_FINGERPRINT: 1n << 35n,
+  ASM_RASP_CMDI: 1n << 37n,
+  APM_TRACING_ENABLE_DYNAMIC_INSTRUMENTATION: 1n << 38n,
+  APM_TRACING_ENABLE_CODE_ORIGIN: 1n << 40n,
+  APM_TRACING_ENABLE_LIVE_DEBUGGING: 1n << 41n,
+  ASM_DD_MULTICONFIG: 1n << 42n,
+  ASM_TRACE_TAGGING_RULES: 1n << 43n,
+  ASM_EXTENDED_DATA_COLLECTION: 1n << 44n,
+  APM_TRACING_MULTICONFIG: 1n << 45n,
+  FFE_FLAG_CONFIGURATION_RULES: 1n << 46n,
+  /*
+    DO NOT ADD ARBITRARY CAPABILITIES IN YOUR CODE
+    UNLESS THEY ARE ALREADY DEFINED IN THE BACKEND SOURCE OF TRUTH
+    DOING SO TRIGGERS BACKEND ALERTS
+  */
+}