reqly 0.4.0__tar.gz → 0.5.0__tar.gz

{reqly-0.4.0 → reqly-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: reqly
-Version: 0.4.0
+Version: 0.5.0
 Summary: Self-hosted API monitoring for FastAPI, Flask, Django, Starlette and Litestar in two lines: latency percentiles, error rates and release tracking per route, with deploy-aware alerts and weekly AI anomaly reports.
 Author: Tanish Poddar
 License-Expression: GPL-3.0-or-later
@@ -110,6 +110,34 @@ MIDDLEWARE = [
 REQLY = {"service_name": "checkout-api", "api_key": "your-ingest-key"}  # optional
 ```
 
+**Any other WSGI or ASGI app** (Bottle, Pyramid, Falcon, CherryPy, a bare ASGI app) — wrap it
+and serve the result. A `route_resolver` returns the route template, because only the framework
+knows it; without one every request is recorded as `__unmatched__`, never as a raw path:
+
+```python
+app = reqly.instrument_wsgi(
+    app, service_name="checkout-api",
+    route_resolver=lambda environ: environ["bottle.route"].rule,  # Bottle
+)
+# Pyramid: environ["bfg.routes.route"].pattern; ASGI: reqly.instrument_asgi(app, route_resolver=...)
+```
+
+**Who is calling** — tag each request with its API consumer. The id is hashed (HMAC-SHA256
+with your secret salt) before it leaves the app:
+
+```python
+reqly.instrument(app, consumer_header="X-API-Key", consumer_salt=os.environ["REQLY_CONSUMER_SALT"])
+# or any logic: consumer=lambda info: info.headers.get("x-tenant-id")
+```
+
+**LLM cost per route** — record token usage where you call a model; the collector prices it:
+
+```python
+completion = client.chat.completions.create(model="gpt-4o-mini", messages=messages)
+reqly.record_llm_response(completion)   # OpenAI / Anthropic responses, or:
+reqly.record_llm_usage("gpt-4o-mini", input_tokens=1200, output_tokens=240)
+```
+
 `instrument()` detects the framework by itself — no decorators, no middleware to wire up.
 Routes are recorded as templates in one style across frameworks: Django's
 `users/<int:pk>/` and DRF's `^users/(?P<pk>[^/.]+)/$` both become `/users/{pk}/`.
@@ -131,6 +159,9 @@ In the Reqly dashboard and collector:
 - **Deploy markers and per-release health** — each release's error rate and p95
 - **Hourly alerts** to Slack, Discord or a webhook when a route breaks from its usual
   weekday-hour pattern, with **root-cause hints**
+- **Top consumers** — requests and error rate per API client, and which clients an incident
+  hit (in the alert itself)
+- **LLM cost per route** — tokens and estimated spend per route and model
 - **API surface vs your OpenAPI spec** — undocumented endpoints that get traffic, documented
   ones nobody calls, and deprecated ones still in use (`push_openapi=True`)
 - **Weekly AI report** — statistics find the anomalies, Groq (gpt-oss-120b) writes the
@@ -166,6 +197,10 @@ Resolution order: **argument → environment variable → default**.
 | `max_batch_size` | `REQLY_MAX_BATCH_SIZE` | `200` |
 | `max_queue_size` | `REQLY_MAX_QUEUE_SIZE` | `2000` |
 | `ignore_routes` | `REQLY_IGNORE_ROUTES` (comma-separated) | `/health,/metrics` |
+| `consumer_header` | `REQLY_CONSUMER_HEADER` | `None` — header that identifies the caller, e.g. `X-API-Key` |
+| `consumer` | — | `None` — `callable(RequestInfo) -> str \| None`, instead of a header |
+| `consumer_salt` | `REQLY_CONSUMER_SALT` | `None` — secret for hashing consumer ids (set it) |
+| `hash_consumer` | `REQLY_HASH_CONSUMER` | `True` — `False` sends ids unhashed (only for non-secret ids) |
 | `push_openapi` | `REQLY_PUSH_OPENAPI` | `False` — upload the app's OpenAPI spec (FastAPI, Litestar) on the first request |
 | `capture_request_body` | `REQLY_CAPTURE_REQUEST_BODY` | `False` (not implemented yet) |
 
@@ -204,7 +239,8 @@ are shipped instead of silently queuing forever.
 | Litestar | 2.0+ |
 | Flask | 2.3+ |
 | Django | 4.2+, sync and async views; DRF and Django Ninja |
-| Collector | any version; `release`, `environment` and body sizes are stored by collector 0.3.0+ and ignored by older ones; `push_openapi` needs 0.7.0+ |
+| Other WSGI / ASGI | any, with `instrument_wsgi()` / `instrument_asgi()` and a `route_resolver` |
+| Collector | any version; `release`, `environment` and body sizes are stored by collector 0.3.0+ and ignored by older ones; `push_openapi` needs 0.7.0+; consumer and LLM views need 0.8.0+ |
 
 ## Self-hosting the collector
 

{reqly-0.4.0 → reqly-0.5.0}/README.md

@@ -63,6 +63,34 @@ MIDDLEWARE = [
 REQLY = {"service_name": "checkout-api", "api_key": "your-ingest-key"}  # optional
 ```
 
+**Any other WSGI or ASGI app** (Bottle, Pyramid, Falcon, CherryPy, a bare ASGI app) — wrap it
+and serve the result. A `route_resolver` returns the route template, because only the framework
+knows it; without one every request is recorded as `__unmatched__`, never as a raw path:
+
+```python
+app = reqly.instrument_wsgi(
+    app, service_name="checkout-api",
+    route_resolver=lambda environ: environ["bottle.route"].rule,  # Bottle
+)
+# Pyramid: environ["bfg.routes.route"].pattern; ASGI: reqly.instrument_asgi(app, route_resolver=...)
+```
+
+**Who is calling** — tag each request with its API consumer. The id is hashed (HMAC-SHA256
+with your secret salt) before it leaves the app:
+
+```python
+reqly.instrument(app, consumer_header="X-API-Key", consumer_salt=os.environ["REQLY_CONSUMER_SALT"])
+# or any logic: consumer=lambda info: info.headers.get("x-tenant-id")
+```
+
+**LLM cost per route** — record token usage where you call a model; the collector prices it:
+
+```python
+completion = client.chat.completions.create(model="gpt-4o-mini", messages=messages)
+reqly.record_llm_response(completion)   # OpenAI / Anthropic responses, or:
+reqly.record_llm_usage("gpt-4o-mini", input_tokens=1200, output_tokens=240)
+```
+
 `instrument()` detects the framework by itself — no decorators, no middleware to wire up.
 Routes are recorded as templates in one style across frameworks: Django's
 `users/<int:pk>/` and DRF's `^users/(?P<pk>[^/.]+)/$` both become `/users/{pk}/`.
@@ -84,6 +112,9 @@ In the Reqly dashboard and collector:
 - **Deploy markers and per-release health** — each release's error rate and p95
 - **Hourly alerts** to Slack, Discord or a webhook when a route breaks from its usual
   weekday-hour pattern, with **root-cause hints**
+- **Top consumers** — requests and error rate per API client, and which clients an incident
+  hit (in the alert itself)
+- **LLM cost per route** — tokens and estimated spend per route and model
 - **API surface vs your OpenAPI spec** — undocumented endpoints that get traffic, documented
   ones nobody calls, and deprecated ones still in use (`push_openapi=True`)
 - **Weekly AI report** — statistics find the anomalies, Groq (gpt-oss-120b) writes the
@@ -119,6 +150,10 @@ Resolution order: **argument → environment variable → default**.
 | `max_batch_size` | `REQLY_MAX_BATCH_SIZE` | `200` |
 | `max_queue_size` | `REQLY_MAX_QUEUE_SIZE` | `2000` |
 | `ignore_routes` | `REQLY_IGNORE_ROUTES` (comma-separated) | `/health,/metrics` |
+| `consumer_header` | `REQLY_CONSUMER_HEADER` | `None` — header that identifies the caller, e.g. `X-API-Key` |
+| `consumer` | — | `None` — `callable(RequestInfo) -> str \| None`, instead of a header |
+| `consumer_salt` | `REQLY_CONSUMER_SALT` | `None` — secret for hashing consumer ids (set it) |
+| `hash_consumer` | `REQLY_HASH_CONSUMER` | `True` — `False` sends ids unhashed (only for non-secret ids) |
 | `push_openapi` | `REQLY_PUSH_OPENAPI` | `False` — upload the app's OpenAPI spec (FastAPI, Litestar) on the first request |
 | `capture_request_body` | `REQLY_CAPTURE_REQUEST_BODY` | `False` (not implemented yet) |
 
@@ -157,7 +192,8 @@ are shipped instead of silently queuing forever.
 | Litestar | 2.0+ |
 | Flask | 2.3+ |
 | Django | 4.2+, sync and async views; DRF and Django Ninja |
-| Collector | any version; `release`, `environment` and body sizes are stored by collector 0.3.0+ and ignored by older ones; `push_openapi` needs 0.7.0+ |
+| Other WSGI / ASGI | any, with `instrument_wsgi()` / `instrument_asgi()` and a `route_resolver` |
+| Collector | any version; `release`, `environment` and body sizes are stored by collector 0.3.0+ and ignored by older ones; `push_openapi` needs 0.7.0+; consumer and LLM views need 0.8.0+ |
 
 ## Self-hosting the collector
 

{reqly-0.4.0 → reqly-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "reqly"
-version = "0.4.0"
+version = "0.5.0"
 description = "Self-hosted API monitoring for FastAPI, Flask, Django, Starlette and Litestar in two lines: latency percentiles, error rates and release tracking per route, with deploy-aware alerts and weekly AI anomaly reports."
 readme = "README.md"
 requires-python = ">=3.9"

{reqly-0.4.0 → reqly-0.5.0}/reqly/__init__.py

@@ -4,10 +4,18 @@ import logging
 
 from .core.client import ReqlyClient
 from .core.config import Config, _get_sdk_version
+from .core.request_context import RequestInfo, record_llm_response, record_llm_usage
 
 __version__ = _get_sdk_version()
 
-__all__ = ["instrument"]
+__all__ = [
+    "instrument",
+    "instrument_asgi",
+    "instrument_wsgi",
+    "record_llm_usage",
+    "record_llm_response",
+    "RequestInfo",
+]
 
 logger = logging.getLogger("reqly")
 
@@ -34,7 +42,8 @@ def _detect_framework(app) -> str:
     raise TypeError(
         "reqly.instrument(): could not detect framework for app of type "
         f"{type(app)!r}. Supported: FastAPI, Starlette, Litestar, Flask "
-        "(Django: add reqly.integrations.django.ReqlyMiddleware to MIDDLEWARE)."
+        "(Django: add reqly.integrations.django.ReqlyMiddleware to MIDDLEWARE; any other "
+        "WSGI/ASGI app: reqly.instrument_wsgi() / reqly.instrument_asgi())."
     )
 
 
@@ -66,6 +75,10 @@ def instrument(
     release: str | None = None,
     environment: str | None = None,
     push_openapi: bool | None = None,
+    consumer_header: str | None = None,
+    consumer=None,
+    consumer_salt: str | None = None,
+    hash_consumer: bool | None = None,
 ) -> ReqlyClient | None:
     """Instrument a FastAPI, Starlette, Litestar or Flask app with one line.
     (Django: add ``reqly.integrations.django.ReqlyMiddleware`` to MIDDLEWARE.)
@@ -74,6 +87,11 @@ def instrument(
     environment variable (REQLY_*) > default. See core.config.Config
     for the full list of environment variables.
 
+    Consumers (who is calling): ``consumer_header="X-API-Key"`` or
+    ``consumer=lambda info: ...`` (gets a RequestInfo, returns an id or
+    None). Ids are HMAC-SHA256-hashed with ``consumer_salt``
+    (REQLY_CONSUMER_SALT) before leaving the app unless ``hash_consumer=False``.
+
     ``push_openapi=True`` (or REQLY_PUSH_OPENAPI=true) uploads the app's
     OpenAPI spec (FastAPI, Litestar) to the collector on the first request,
     so the dashboard can show undocumented, unused and deprecated-but-used
@@ -107,6 +125,10 @@ def instrument(
             release=release,
             environment=environment,
             push_openapi=push_openapi,
+            consumer_header=consumer_header,
+            consumer=consumer,
+            consumer_salt=consumer_salt,
+            hash_consumer=hash_consumer,
         )
         client = ReqlyClient(config)
         if config.push_openapi:
@@ -143,3 +165,58 @@ def instrument(
             exc_info=True,
         )
         return None
+
+
+_GENERIC_OPTIONS = (
+    "service_name", "collector_url", "api_key", "sample_rate", "flush_interval_seconds",
+    "max_batch_size", "max_queue_size", "ignore_routes", "capture_request_body",
+    "release", "environment", "consumer_header", "consumer", "consumer_salt", "hash_consumer",
+)
+
+
+def _generic_client(kind: str, route_resolver, options: dict) -> ReqlyClient:
+    if route_resolver is None:
+        logger.warning(
+            "reqly: instrument_%s() without route_resolver records every request as "
+            "__unmatched__; pass a function that returns the route template", kind,
+        )
+    if options.pop("push_openapi", None):
+        logger.warning("reqly: push_openapi is not available for generic %s apps", kind.upper())
+    unknown = set(options) - set(_GENERIC_OPTIONS)
+    if unknown:
+        logger.warning("reqly: instrument_%s() ignoring unknown options %s", kind, sorted(unknown))
+    return ReqlyClient(Config.resolve(**{key: options.get(key) for key in _GENERIC_OPTIONS}))
+
+
+def instrument_wsgi(app, *, route_resolver=None, **options):
+    """Wrap any WSGI app (Bottle, Pyramid, Falcon, CherryPy...) and return
+    the wrapped app -- serve that one::
+
+        app = reqly.instrument_wsgi(app, service_name="api",
+                                    route_resolver=lambda environ: environ["bottle.route"].rule)
+
+    ``route_resolver(environ)`` runs after the app handled the request and
+    returns the route template or None. ``options`` are those of
+    ``instrument()``. Like ``instrument()``, a failure leaves the app
+    unwrapped instead of raising."""
+    try:
+        from .integrations.wsgi import ReqlyWSGIMiddleware
+
+        return ReqlyWSGIMiddleware(app, _generic_client("wsgi", route_resolver, options), route_resolver)
+    except Exception:
+        logger.warning("reqly: instrument_wsgi() failed, app will run uninstrumented", exc_info=True)
+        return app
+
+
+def instrument_asgi(app, *, route_resolver=None, **options):
+    """Wrap any ASGI app and return the wrapped app. ``route_resolver(scope)``
+    gets a copy of the scope as it arrived; a template the framework puts in
+    ``scope["route"]`` or ``scope["path_template"]`` is used first."""
+    try:
+        from .integrations.fastapi import ReqlyASGIMiddleware
+
+        client = _generic_client("asgi", route_resolver, options)
+        return ReqlyASGIMiddleware(app, client, route_resolver)
+    except Exception:
+        logger.warning("reqly: instrument_asgi() failed, app will run uninstrumented", exc_info=True)
+        return app

{reqly-0.4.0 → reqly-0.5.0}/reqly/core/capture.py

@@ -31,6 +31,10 @@ class RequestEvent:
     host: str = _HOSTNAME
     request_bytes: int | None = None
     response_bytes: int | None = None
+    consumer_id: str | None = None
+    llm_model: str | None = None
+    llm_input_tokens: int | None = None
+    llm_output_tokens: int | None = None
     sdk_version: str = field(default_factory=_get_sdk_version)
 
     def to_dict(self) -> dict:
@@ -59,7 +63,10 @@ def build_event(
     sdk_version: str,
     request_bytes: int | None = None,
     response_bytes: int | None = None,
+    consumer_id: str | None = None,
+    llm: tuple[str, int, int] | None = None,
 ) -> RequestEvent:
+    llm_model, llm_input_tokens, llm_output_tokens = llm if llm else (None, None, None)
     return RequestEvent(
         service_name=service_name,
         method=method,
@@ -71,4 +78,8 @@ def build_event(
         sdk_version=sdk_version,
         request_bytes=request_bytes,
         response_bytes=response_bytes,
+        consumer_id=consumer_id,
+        llm_model=llm_model,
+        llm_input_tokens=llm_input_tokens,
+        llm_output_tokens=llm_output_tokens,
     )

{reqly-0.4.0 → reqly-0.5.0}/reqly/core/client.py

@@ -6,6 +6,7 @@ from .buffer import EventBuffer
 from .capture import build_event
 from .config import Config
 from .openapi_push import OpenAPIPusher
+from .request_context import ConsumerResolver
 from .sampling import Sampler
 from .shipper import Shipper
 
@@ -28,8 +29,16 @@ class ReqlyClient:
         self._disabled = False
         self._ignore_routes = set(config.ignore_routes)
         self._openapi_pusher: OpenAPIPusher | None = None
+        self._consumers: ConsumerResolver | None = None
 
         try:
+            if config.consumer_header or config.consumer is not None:
+                self._consumers = ConsumerResolver(
+                    header=config.consumer_header,
+                    func=config.consumer,
+                    salt=config.consumer_salt,
+                    hash_ids=config.hash_consumer,
+                )
             self._sampler = Sampler(config.sample_rate)
             shipper = Shipper(
                 collector_url=config.collector_url,
@@ -63,7 +72,12 @@ class ReqlyClient:
         error_type: str | None,
         request_bytes: int | None = None,
         response_bytes: int | None = None,
+        request_info=None,
+        llm: tuple[str, int, int] | None = None,
     ) -> None:
+        """``request_info``: zero-argument callable returning a RequestInfo,
+        only called when consumer tracking is on. ``llm``: (model,
+        input_tokens, output_tokens) recorded during the request."""
         if self._disabled:
             return
         try:
@@ -74,6 +88,8 @@ class ReqlyClient:
             if not self._sampler.should_sample():
                 return
             event = build_event(
+                consumer_id=self._consumer_id(request_info),
+                llm=llm,
                 service_name=self.config.service_name,
                 method=method,
                 route=route,
@@ -93,6 +109,16 @@ class ReqlyClient:
             )
             self._disabled = True
 
+    def _consumer_id(self, request_info) -> str | None:
+        if self._consumers is None or request_info is None:
+            return None
+        try:
+            return self._consumers.resolve(request_info)
+        except Exception:
+            # A failing consumer= callable costs the consumer id, not the event.
+            logger.warning("reqly: consumer lookup failed", exc_info=True)
+            return None
+
     def enable_openapi_push(self, spec_factory) -> None:
         """Upload ``spec_factory()`` (the app's OpenAPI document) to the
         collector once, when the first request is recorded."""

{reqly-0.4.0 → reqly-0.5.0}/reqly/core/config.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import os
 from dataclasses import dataclass, field
+from typing import Any
 from importlib.metadata import PackageNotFoundError, version as _pkg_version
 
 
@@ -87,6 +88,10 @@ class Config:
     release: str | None = None
     environment: str | None = None
     push_openapi: bool = False
+    consumer_header: str | None = None
+    consumer: Any = None  # callable(RequestInfo) -> str | None
+    consumer_salt: str | None = None
+    hash_consumer: bool = True
     sdk_version: str = field(default_factory=_get_sdk_version)
 
     @classmethod
@@ -104,6 +109,10 @@ class Config:
         release: str | None = None,
         environment: str | None = None,
         push_openapi: bool | None = None,
+        consumer_header: str | None = None,
+        consumer: Any = None,
+        consumer_salt: str | None = None,
+        hash_consumer: bool | None = None,
     ) -> "Config":
         import sys as _sys
 
@@ -168,4 +177,12 @@ class Config:
                 if push_openapi is not None
                 else _env_bool("REQLY_PUSH_OPENAPI", False)
             ),
+            consumer_header=consumer_header or os.environ.get("REQLY_CONSUMER_HEADER") or None,
+            consumer=consumer,
+            consumer_salt=consumer_salt or os.environ.get("REQLY_CONSUMER_SALT") or None,
+            hash_consumer=(
+                hash_consumer
+                if hash_consumer is not None
+                else _env_bool("REQLY_HASH_CONSUMER", True)
+            ),
         )

reqly-0.5.0/reqly/core/request_context.py

@@ -0,0 +1,167 @@
+"""Per-request state the integrations collect besides timing: who the
+caller is (consumer) and what LLM usage the request caused.
+
+LLM usage is recorded from inside the request handler with
+``reqly.record_llm_usage()``, so it lives in a ContextVar the middleware
+sets when the request starts. The variable holds a mutable accumulator, so
+usage recorded in a thread-pool copy of the context (Starlette runs sync
+endpoints that way) still lands on the request's accumulator.
+"""
+
+from __future__ import annotations
+
+import contextvars
+import hashlib
+import hmac
+import logging
+from dataclasses import dataclass, field
+from typing import Any, Callable, Mapping, Optional
+
+logger = logging.getLogger("reqly")
+
+_CONSUMER_HASH_HEX = 16
+_MAX_CONSUMER_LEN = 128
+_MAX_MODEL_LEN = 255
+
+
+@dataclass
+class RequestInfo:
+    """What a ``consumer=`` callable receives: the method, path, headers
+    (lower-case names) and the framework's own request object as ``raw``
+    (an ASGI scope, a Flask/Django request or a WSGI environ)."""
+
+    method: str
+    path: str
+    headers: Mapping[str, str]
+    raw: Any = None
+
+
+# --- LLM usage -----------------------------------------------------------------
+
+
+@dataclass
+class LLMUsage:
+    tokens_by_model: dict = field(default_factory=dict)  # model -> [input, output]
+
+    def add(self, model: str, input_tokens: int, output_tokens: int) -> None:
+        totals = self.tokens_by_model.setdefault(model, [0, 0])
+        totals[0] += input_tokens
+        totals[1] += output_tokens
+
+    def summary(self) -> tuple[str, int, int] | None:
+        """(model, input_tokens, output_tokens) for the event. A request
+        that used several models is attributed to the one with the most
+        tokens and carries the token totals of all of them."""
+        if not self.tokens_by_model:
+            return None
+        model = max(self.tokens_by_model, key=lambda m: sum(self.tokens_by_model[m]))
+        input_total = sum(t[0] for t in self.tokens_by_model.values())
+        output_total = sum(t[1] for t in self.tokens_by_model.values())
+        return model, input_total, output_total
+
+
+_current_usage: contextvars.ContextVar[Optional[LLMUsage]] = contextvars.ContextVar(
+    "reqly_llm_usage", default=None
+)
+
+
+def begin_request() -> contextvars.Token:
+    return _current_usage.set(LLMUsage())
+
+
+def end_request(token: contextvars.Token | None) -> tuple[str, int, int] | None:
+    usage = _current_usage.get()
+    if token is not None:
+        try:
+            _current_usage.reset(token)
+        except ValueError:  # token from another context; nothing to restore
+            _current_usage.set(None)
+    return usage.summary() if usage is not None else None
+
+
+def _as_count(value) -> int:
+    count = int(value or 0)
+    if count < 0:
+        raise ValueError("token counts can't be negative")
+    return count
+
+
+def record_llm_usage(model: str, input_tokens: int = 0, output_tokens: int = 0) -> None:
+    """Attribute LLM token usage to the request being served. Call it after
+    each model call inside a request handler; calls add up. Outside an
+    instrumented request it does nothing. Never raises."""
+    try:
+        usage = _current_usage.get()
+        if usage is None:
+            logger.debug("reqly: record_llm_usage() outside an instrumented request, ignored")
+            return
+        usage.add(str(model)[:_MAX_MODEL_LEN], _as_count(input_tokens), _as_count(output_tokens))
+    except Exception:
+        logger.warning("reqly: record_llm_usage() failed", exc_info=True)
+
+
+def _field(obj, name):
+    return obj.get(name) if isinstance(obj, Mapping) else getattr(obj, name, None)
+
+
+def record_llm_response(response) -> None:
+    """``record_llm_usage()`` from a provider response object or dict:
+    OpenAI-style (``usage.prompt_tokens`` / ``completion_tokens``, also
+    Groq, Mistral, vLLM, LiteLLM...), OpenAI Responses API and Anthropic
+    (``usage.input_tokens`` / ``output_tokens``). Never raises."""
+    try:
+        usage = _field(response, "usage")
+        if usage is None:
+            return
+        input_tokens = _field(usage, "prompt_tokens")
+        output_tokens = _field(usage, "completion_tokens")
+        if input_tokens is None and output_tokens is None:
+            input_tokens = _field(usage, "input_tokens")
+            output_tokens = _field(usage, "output_tokens")
+        record_llm_usage(_field(response, "model") or "unknown", input_tokens or 0, output_tokens or 0)
+    except Exception:
+        logger.warning("reqly: record_llm_response() failed", exc_info=True)
+
+
+# --- consumers -----------------------------------------------------------------
+
+ConsumerCallable = Callable[[RequestInfo], Optional[str]]
+
+
+class ConsumerResolver:
+    """Turns a request into a consumer id: from a header or a callable,
+    then (by default) HMAC-SHA256 with the app's salt, truncated -- the raw
+    API key or user id never leaves the app."""
+
+    def __init__(
+        self,
+        *,
+        header: str | None,
+        func: ConsumerCallable | None,
+        salt: str | None,
+        hash_ids: bool,
+    ) -> None:
+        self._header = header.lower() if header else None
+        self._func = func
+        self._salt = (salt or "").encode()
+        self._hash = hash_ids
+        if hash_ids and not salt:
+            logger.warning(
+                "reqly: consumer tracking without REQLY_CONSUMER_SALT -- hashed ids of guessable "
+                "values (user ids, emails) can be reversed by trying candidates; set a secret salt"
+            )
+
+    @property
+    def enabled(self) -> bool:
+        return bool(self._header or self._func)
+
+    def resolve(self, info_factory: Callable[[], RequestInfo]) -> str | None:
+        info = info_factory()
+        value = self._func(info) if self._func is not None else info.headers.get(self._header)
+        if value is None or value == "":
+            return None
+        value = str(value)
+        if not self._hash:
+            return value[:_MAX_CONSUMER_LEN]
+        digest = hmac.new(self._salt, value.encode(), hashlib.sha256).hexdigest()
+        return digest[:_CONSUMER_HASH_HEX]

{reqly-0.4.0 → reqly-0.5.0}/reqly/integrations/django.py

@@ -31,6 +31,7 @@ from django.core.exceptions import MiddlewareNotUsed
 from ..core.capture import normalize_route
 from ..core.client import ReqlyClient
 from ..core.config import Config
+from ..core.request_context import RequestInfo, begin_request, end_request
 
 logger = logging.getLogger("reqly")
 
@@ -42,7 +43,7 @@ _client_lock = threading.Lock()
 _CONFIG_KEYS = (
     "service_name", "collector_url", "api_key", "sample_rate", "flush_interval_seconds",
     "max_batch_size", "max_queue_size", "ignore_routes", "capture_request_body",
-    "release", "environment",
+    "release", "environment", "consumer_header", "consumer", "consumer_salt", "hash_consumer",
 )
 
 # <int:pk>, <slug:slug>, <pk>  ->  {pk}
@@ -102,14 +103,22 @@ class ReqlyMiddleware:
         if self._is_async:
             return self.__acall__(request)
         start = time.perf_counter()
-        response = self.get_response(request)
-        self._record(request, response, start)
+        token = begin_request()
+        try:
+            response = self.get_response(request)
+        finally:
+            llm = end_request(token)
+        self._record(request, response, start, llm)
         return response
 
     async def __acall__(self, request):
         start = time.perf_counter()
-        response = await self.get_response(request)
-        self._record(request, response, start)
+        token = begin_request()
+        try:
+            response = await self.get_response(request)
+        finally:
+            llm = end_request(token)
+        self._record(request, response, start, llm)
         return response
 
     def process_exception(self, request, exception):
@@ -118,7 +127,7 @@ class ReqlyMiddleware:
         setattr(request, _EXCEPTION_ATTR, exception)
         return None
 
-    def _record(self, request, response, start: float) -> None:
+    def _record(self, request, response, start: float, llm=None) -> None:
         try:
             duration_ms = (time.perf_counter() - start) * 1000
             match = getattr(request, "resolver_match", None)
@@ -135,6 +144,13 @@ class ReqlyMiddleware:
                 error_type=type(exception).__name__ if exception is not None else None,
                 request_bytes=int(content_length) if content_length and content_length.isdigit() else None,
                 response_bytes=None if getattr(response, "streaming", False) else len(response.content),
+                request_info=lambda: RequestInfo(
+                    method=request.method,
+                    path=request.path,
+                    headers={k.lower(): v for k, v in request.headers.items()},
+                    raw=request,
+                ),
+                llm=llm,
             )
         except Exception:
             # record_request is already fail-open; this guards the attribute