fix(openfeature): support custom agentless endpoints

Author: leoromanovsky

packages/dd-trace/src/exporters/common/request.js

@@ -50,11 +50,13 @@ function request (data, options, callback) {
   }
 
   // Never put the Datadog API key on a cleartext connection to a non-loopback host; that would
-  // expose it on the wire. Loopback (local agent, dev proxy, tests) is exempt. Strip the key
+  // expose it on the wire. Loopback (local agent, dev proxy, tests) and explicit operator-owned
+  // endpoints are exempt. Strip the key
   // rather than drop the request: the agent proxies telemetry with its own key, while an https
   // intake URL is required to authenticate agentless traffic.
   const hasApiKey = options.headers['dd-api-key'] !== undefined || options.headers['DD-API-KEY'] !== undefined
-  if (hasApiKey && options.protocol === 'http:' && !isLoopbackHost(options.hostname)) {
+  const insecureApiKey = options.protocol === 'http:' && !isLoopbackHost(options.hostname)
+  if (hasApiKey && insecureApiKey && !options.allowInsecureApiKey) {
     log.error(
       'Not sending the Datadog API key over a non-TLS connection to %s. Configure an https intake URL.',
       options.hostname

packages/dd-trace/src/openfeature/agentless_configuration_source.js

@@ -18,9 +18,10 @@ const RETRY_JITTER = 0.2
 /**
  * @typedef {object} AgentlessSourceConfig
  * @property {URL} endpoint
+ * @property {boolean} allowInsecureApiKey
  * @property {number} pollIntervalMs
  * @property {number} requestTimeoutMs
- * @property {string} apiKey
+ * @property {string | undefined} apiKey
  */
 
 /**
@@ -138,7 +139,7 @@ class AgentlessConfigurationSource {
   #request (signal) {
     const headers = getClientLibraryHeaders()
     headers['Accept-Encoding'] = 'gzip'
-    headers['DD-API-KEY'] = this.#config.apiKey
+    if (this.#config.apiKey) headers['DD-API-KEY'] = this.#config.apiKey
     if (this.#etag) headers['If-None-Match'] = this.#etag
 
     /**
@@ -164,6 +165,8 @@ class AgentlessConfigurationSource {
         url: this.#config.endpoint,
         method: 'GET',
         headers,
+        // An explicit operator override may be a cleartext development or dogfooding proxy.
+        allowInsecureApiKey: this.#config.allowInsecureApiKey,
         retry: false,
         signal,
         timeout: this.#config.requestTimeoutMs,

packages/dd-trace/src/openfeature/configuration_source.js

@@ -1,6 +1,5 @@
 'use strict'
 
-const { isLoopbackHost } = require('../exporters/common/url')
 const log = require('../log')
 
 const DEFAULT_AGENTLESS_PATH = '/api/v2/feature-flagging/config/rules-based/server'
@@ -27,14 +26,17 @@ function create (config, applyConfiguration) {
     return
   }
 
+  const hasCustomEndpoint = Boolean(baseUrl?.trim())
+
   try {
-    if (!config.DD_API_KEY) {
-      throw new Error('DD_API_KEY is required for Feature Flagging agentless delivery')
+    if (!hasCustomEndpoint && !config.DD_API_KEY) {
+      throw new Error('DD_API_KEY is required for the Datadog Feature Flagging API')
     }
 
     const AgentlessConfigurationSource = require('./agentless_configuration_source')
     return new AgentlessConfigurationSource({
       endpoint: endpoint(config, baseUrl),
+      allowInsecureApiKey: hasCustomEndpoint,
       pollIntervalMs: Math.min(pollIntervalSeconds, MAX_POLL_INTERVAL_SECONDS) * 1000,
       requestTimeoutMs: requestTimeoutSeconds * 1000,
       apiKey: config.DD_API_KEY,
@@ -74,10 +76,6 @@ function endpoint (config, configuredBaseUrl) {
   if (url.protocol !== 'https:' && url.protocol !== 'http:') {
     throw new Error('Feature Flagging agentless URL must use HTTP or HTTPS')
   }
-  if (url.protocol === 'http:' && !isLoopbackHost(url.hostname)) {
-    throw new Error('Feature Flagging agentless URL must use HTTPS unless it targets loopback')
-  }
-
   if (url.pathname === '' || url.pathname === '/') {
     url.pathname = DEFAULT_AGENTLESS_PATH
   }

packages/dd-trace/test/exporters/common/request.spec.js

@@ -847,6 +847,23 @@ describe('request', function () {
       })
     })
 
+    it('keeps dd-api-key over http for an explicitly trusted custom endpoint', (done) => {
+      nock('http://flags.dev.internal', { reqheaders: { 'dd-api-key': 'secret-key' } })
+        .post('/v1/input')
+        .reply(200, 'OK')
+
+      request(Buffer.from(''), {
+        method: 'POST',
+        url: new URL('http://flags.dev.internal/v1/input'),
+        headers: { 'dd-api-key': 'secret-key' },
+        allowInsecureApiKey: true,
+      }, (err, res) => {
+        assert.strictEqual(res, 'OK')
+        sinon.assert.notCalled(log.error)
+        done(err)
+      })
+    })
+
     for (const loopbackHost of ['127.0.0.1', '127.1.2.3', 'localhost', '[::1]']) {
       it(`keeps dd-api-key over http to the loopback host ${loopbackHost}`, (done) => {
         nock(`http://${loopbackHost}:9999`, {

packages/dd-trace/test/openfeature/agentless_configuration_source.spec.js

@@ -48,6 +48,7 @@ describe('AgentlessConfigurationSource', () => {
     applyConfiguration = sinon.stub()
     config = {
       endpoint: new URL('http://127.0.0.1:8080/api/v2/feature-flagging/config/rules-based/server'),
+      allowInsecureApiKey: true,
       pollIntervalMs: 30_000,
       requestTimeoutMs: 2000,
       apiKey: 'test-api-key',
@@ -146,6 +147,7 @@ describe('AgentlessConfigurationSource', () => {
     assert.strictEqual(requests[0].data, '')
     assert.strictEqual(requests[0].options.url, config.endpoint)
     assert.strictEqual(requests[0].options.method, 'GET')
+    assert.strictEqual(requests[0].options.allowInsecureApiKey, config.allowInsecureApiKey)
     assert.strictEqual(requests[0].options.retry, false)
     assert.strictEqual(requests[0].options.timeout, 2000)
     assert.strictEqual(requests[0].options.headers['DD-API-KEY'], 'test-api-key')
@@ -181,13 +183,14 @@ describe('AgentlessConfigurationSource', () => {
     clock.restore()
     clock = undefined
     const body = zlib.gzipSync(responseBody())
-    nock('http://127.0.0.1:8080', {
+    config.endpoint = new URL('http://flags.dev.internal:8080/custom/ufc')
+    nock('http://flags.dev.internal:8080', {
       reqheaders: {
         'accept-encoding': 'gzip',
         'dd-api-key': 'test-api-key',
       },
     })
-      .get('/api/v2/feature-flagging/config/rules-based/server')
+      .get('/custom/ufc')
       .reply(200, body, {
         'content-encoding': 'gzip',
         etag: '"real-path"',
@@ -491,6 +494,22 @@ describe('AgentlessConfigurationSource', () => {
     sinon.assert.notCalled(applyConfiguration)
   })
 
+  it('omits a missing API key and reports the endpoint authentication failure', async () => {
+    delete config.apiKey
+    responses.push({ statusCode: 401 })
+
+    source().start()
+    await flush()
+
+    assert.strictEqual(Object.hasOwn(requests[0].options.headers, 'DD-API-KEY'), false)
+    sinon.assert.calledOnceWithExactly(
+      log.warn,
+      'Feature Flagging agentless endpoint returned HTTP %d; verify DD_API_KEY is configured and valid',
+      401
+    )
+    sinon.assert.notCalled(applyConfiguration)
+  })
+
   it('uses fixed-delay polling after a request completes', async () => {
     responses.push(
       { pending: true },

packages/dd-trace/test/openfeature/configuration_source.spec.js

@@ -52,6 +52,7 @@ describe('OpenFeature configuration source', () => {
       'https://ufc-server.ff-cdn.datadoghq.com/api/v2/feature-flagging/config/rules-based/server?dd_env=my+env'
     )
     assert.strictEqual(resolved.apiKey, 'test-api-key')
+    assert.strictEqual(resolved.allowInsecureApiKey, false)
     assert.strictEqual(resolved.pollIntervalMs, 30_000)
     assert.strictEqual(resolved.requestTimeoutMs, 5000)
   })
@@ -93,6 +94,18 @@ describe('OpenFeature configuration source', () => {
     })
   }
 
+  it('allows a cleartext custom endpoint for local development and proxies', () => {
+    config.featureFlags.DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_BASE_URL =
+      'http://flags.dev.internal:8080'
+
+    const resolved = createSourceConfig()
+    assert.strictEqual(
+      resolved.endpoint.toString(),
+      'http://flags.dev.internal:8080/api/v2/feature-flagging/config/rules-based/server'
+    )
+    assert.strictEqual(resolved.allowInsecureApiKey, true)
+  })
+
   it('preserves an exact configured path and query', () => {
     config.featureFlags.DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_BASE_URL =
       'https://example.com/custom/ufc?tenant=one'
@@ -156,20 +169,6 @@ describe('OpenFeature configuration source', () => {
     sinon.assert.notCalled(AgentlessConfigurationSource)
   })
 
-  it('rejects cleartext non-loopback endpoints', () => {
-    config.featureFlags.DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_BASE_URL = 'http://flags.example.test'
-
-    const source = configurationSource.create(config, sinon.spy())
-
-    assert.strictEqual(source, undefined)
-    sinon.assert.calledOnceWithMatch(
-      log.error,
-      'Unable to configure Feature Flagging configuration source',
-      sinon.match.instanceOf(Error)
-    )
-    sinon.assert.notCalled(AgentlessConfigurationSource)
-  })
-
   it('rejects malformed endpoints without logging their sensitive value', () => {
     const sentinel = 'sensitive-value'
     config.featureFlags.DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_BASE_URL = `https://${sentinel} value`
@@ -187,15 +186,27 @@ describe('OpenFeature configuration source', () => {
     assert.strictEqual(log.error.firstCall.args[1].cause, undefined)
   })
 
-  it('requires an API key without enabling a source', () => {
+  it('creates a source for a custom API without a Datadog API key', () => {
+    delete config.DD_API_KEY
+    config.featureFlags.DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_BASE_URL =
+      'https://flags.example.test/custom/ufc'
+
+    const source = configurationSource.create(config, sinon.spy())
+
+    assert.ok(source instanceof AgentlessConfigurationSource)
+    assert.strictEqual(AgentlessConfigurationSource.firstCall.args[0].apiKey, undefined)
+    sinon.assert.notCalled(log.error)
+  })
+
+  it('requires a Datadog API key for the default Datadog API', () => {
     delete config.DD_API_KEY
 
     const source = configurationSource.create(config, sinon.spy())
 
     sinon.assert.calledOnceWithMatch(
       log.error,
       'Unable to configure Feature Flagging configuration source',
-      sinon.match.instanceOf(Error)
+      sinon.match.has('message', 'DD_API_KEY is required for the Datadog Feature Flagging API')
     )
     assert.strictEqual(source, undefined)
     sinon.assert.notCalled(AgentlessConfigurationSource)