Skip to content

Enable APIsec telemetry test for Node.js #7145

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
CarlesDD merged 9 commits into from
Jun 25, 2026
+23 −5
Merged

Enable APIsec telemetry test for Node.js #7145

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
d50d2af
Enable test for Node.js
CarlesDD Jun 16, 2026
d1bc143
Adapt apisec telemetry test to expect more than one framework
CarlesDD Jun 16, 2026
bb635c1
Fix manifest
CarlesDD Jun 16, 2026
853ce0d
Trigger pipeline
CarlesDD Jun 16, 2026
7da0e98
Fix linting issue
CarlesDD Jun 16, 2026
c297e6e
Cap variants to teset
CarlesDD Jun 16, 2026
b93a4fd
Trigger pipeline
CarlesDD Jun 16, 2026
638f448
Merge branch 'main' into ccapell/APPSEC-62704/nodejs-api-sec-metrics
CarlesDD Jun 25, 2026
18600c1
Merge branch 'main' into ccapell/APPSEC-62704/nodejs-api-sec-metrics
CarlesDD Jun 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion manifests/nodejs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,13 @@ manifest:
tests/appsec/api_security/test_apisec_sampling.py::Test_API_Security_Sampling_Different_Status: *ref_5_27_0
tests/appsec/api_security/test_apisec_sampling.py::Test_API_Security_Sampling_Rate: irrelevant (new api security sampling algorithm implemented)
tests/appsec/api_security/test_apisec_sampling.py::Test_API_Security_Sampling_With_Delay: *ref_5_27_0
tests/appsec/api_security/test_apisecurity_telemetry.py: missing_feature
tests/appsec/api_security/test_apisecurity_telemetry.py:
- weblog_declaration:
express4: *ref_5_110_0
express5: *ref_5_110_0
fastify: *ref_5_110_0
nextjs: *ref_5_110_0
"*": irrelevant (testing additional variants does not provide extra value here)
tests/appsec/api_security/test_custom_data_classification.py::Test_API_Security_Custom_Data_Classification_Capabilities: *ref_5_76_0
tests/appsec/api_security/test_custom_data_classification.py::Test_API_Security_Custom_Data_Classification_Multiple_Scanners: *ref_5_76_0
tests/appsec/api_security/test_custom_data_classification.py::Test_API_Security_Custom_Data_Classification_Negative: *ref_5_76_0
Expand Down
20 changes: 16 additions & 4 deletions tests/appsec/api_security/test_apisecurity_telemetry.py
View file
Open in desktop

@CarlesDD CarlesDD Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When a request is blocked early (during incomingHttpRequestStart, before framework middleware runs), the span's component tag is still http (the framework-specific value never gets set).
For that reason the test accepts both the framework name and http as valid framework tags: the former for normal requests, the latter for early-blocked ones.

Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ def _extract_telemetry_metrics(datas: list[dict]) -> list[dict]:
return [m for m in metrics if m["metric"].startswith("api_security")]


FRAMEWORKS = {
FRAMEWORKS: dict[str, dict[str, str | list[str]]] = {
"python": {
"flask-poc": "flask",
"uwsgi-poc": "flask",
Expand All @@ -38,6 +38,13 @@ def _extract_telemetry_metrics(datas: list[dict]) -> list[dict]:
"net-http-orchestrion": "net/http",
"uds-echo": "github.com/labstack/echo/v4",
},
"nodejs": {
# blocked requests emit 'http' because framework middleware never runs for them
"express4": ["express", "http"],
"express5": ["express", "http"],
"fastify": ["fastify", "http"],
"nextjs": "http",
},
}


Expand Down Expand Up @@ -86,11 +93,16 @@ def test_shema_metric(self):
metric_data["metric"] in ["api_security.request.schema", "api_security.request.no_schema"]
for metric_data in datas
), "Only api_security.request.schema metrics should be present, no missing routes should be generated"
expected_frameworks = FRAMEWORKS.get(context.library.name, {}).get(
context.weblog_variant, context.weblog_variant
)
if isinstance(expected_frameworks, str):
expected_frameworks = [expected_frameworks]
# check all metrics have correct tags
for m in datas:
metric_data = m
assert metric_data["namespace"] == "appsec"
assert metric_data["type"] == "count"
assert metric_data["tags"] == [
f"framework:{FRAMEWORKS.get(context.library.name, {}).get(context.weblog_variant, context.weblog_variant)}"
], f"framework tag unknown for {context.library.name} {context.weblog_variant}"
assert any(metric_data["tags"] == [f"framework:{fw}"] for fw in expected_frameworks), (
Comment thread
CarlesDD marked this conversation as resolved.
f"unexpected framework tag for {context.library.name} {context.weblog_variant}: got {metric_data['tags']}, expected one of {[f'framework:{fw}' for fw in expected_frameworks]}"
)
Loading