fix: benchmark rust masking via public api

Signed-off-by: lucarlig <luca.carlig@ibm.com>

Author: lucarlig

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": null,
     "lines": null
   },
-  "generated_at": "2026-04-03T13:21:10Z",
+  "generated_at": "2026-04-03T14:47:08Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -22032,7 +22032,7 @@
         "hashed_secret": "4ea8d2335b430796cf3f500368c5b0f5b1dc90f5",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 187,
+        "line_number": 207,
         "type": "Secret Keyword",
         "verified_result": null
       }

mcpgateway/config.py

@@ -351,7 +351,7 @@ class Settings(BaseSettings):
     experimental_validate_io: bool = Field(default=False, description="Enable experimental input validation and output sanitization")
     experimental_rust_request_logging_masking_enabled: bool = Field(
         default=False,
-        description="Enable experimental Rust sidecar for request logging sensitive-data masking",
+        description="Enable experimental Rust native extension for request logging sensitive-data masking",
     )
     validation_middleware_enabled: bool = Field(default=False, description="Enable validation middleware for all requests")
     validation_strict: bool = Field(default=True, description="Strict validation mode - reject on violations")

mcpgateway/middleware/request_logging_middleware.py

@@ -285,7 +285,7 @@ def mask_sensitive_headers(headers):
 
 
 def _load_rust_request_logging_module():
-    """Load the experimental Rust masking sidecar on demand."""
+    """Load the experimental Rust masking native extension on demand."""
     global _RUST_REQUEST_LOGGING_MODULE
 
     if _RUST_REQUEST_LOGGING_MODULE is None:

tests/performance/test_request_logging_masking_sidecar_benchmark.py

@@ -1,9 +1,10 @@
 # -*- coding: utf-8 -*-
-"""Benchmark the request-logging masking Rust sidecar against the Python path."""
+"""Benchmark the request-logging masking Rust native extension against the Python path."""
 
 # Standard
 from __future__ import annotations
 
+from contextlib import contextmanager
 import importlib
 import statistics
 import subprocess
@@ -12,6 +13,7 @@
 from typing import Any, Callable
 
 # First-Party
+import mcpgateway.middleware.request_logging_middleware as request_logging_middleware
 from mcpgateway.config import settings
 from mcpgateway.middleware.request_logging_middleware import mask_sensitive_data, mask_sensitive_headers
 
@@ -24,7 +26,36 @@ def _ensure_sidecar_installed() -> Any:
     return importlib.import_module("request_logging_masking_sidecar")
 
 
+def test_reset_rust_module_handle_keeps_flagged_masking_reloadable() -> None:
+    _ensure_sidecar_installed()
+    request_logging_middleware._RUST_REQUEST_LOGGING_MODULE = object()
+
+    _reset_rust_module_handle()
+
+    with _rust_masking_enabled(True):
+        masked = mask_sensitive_data({"password": "secret"}, 12)  # pragma: allowlist secret
+
+    assert masked == {"password": "******"}  # pragma: allowlist secret
+
+
+@contextmanager
+def _rust_masking_enabled(enabled: bool):
+    original = settings.experimental_rust_request_logging_masking_enabled
+    settings.experimental_rust_request_logging_masking_enabled = enabled
+    try:
+        yield
+    finally:
+        settings.experimental_rust_request_logging_masking_enabled = original
+
+
+def _reset_rust_module_handle() -> None:
+    request_logging_middleware._RUST_REQUEST_LOGGING_MODULE = None
+
+
 def _measure(label: str, fn: Callable[[Any], Any], payload: Any, iterations: int) -> tuple[float, float]:
+    for _ in range(5):
+        fn(payload)
+
     samples = []
     for _ in range(iterations):
         started = time.perf_counter_ns()
@@ -37,6 +68,24 @@ def _measure(label: str, fn: Callable[[Any], Any], payload: Any, iterations: int
     return median_ms, p95_ms
 
 
+def _measure_once(label: str, fn: Callable[[Any], Any], payload: Any) -> float:
+    started = time.perf_counter_ns()
+    fn(payload)
+    elapsed_ms = (time.perf_counter_ns() - started) / 1_000_000
+    print(f"{label}: elapsed={elapsed_ms:.3f}ms")
+    return elapsed_ms
+
+
+def _run_with_rust_masking_enabled(enabled: bool, fn: Callable[[Any], Any], payload: Any) -> Any:
+    with _rust_masking_enabled(enabled):
+        return fn(payload)
+
+
+def _measure_with_rust_masking_enabled(enabled: bool, label: str, fn: Callable[[Any], Any], payload: Any, iterations: int) -> tuple[float, float]:
+    with _rust_masking_enabled(enabled):
+        return _measure(label, fn, payload, iterations)
+
+
 def _assert_parity(python_fn: Callable[[Any], Any], rust_fn: Callable[[Any], Any], payloads: list[Any]) -> None:
     for payload in payloads:
         python_result = python_fn(payload)
@@ -47,29 +96,36 @@ def _assert_parity(python_fn: Callable[[Any], Any], rust_fn: Callable[[Any], Any
 
 def main() -> None:
     sidecar = _ensure_sidecar_installed()
-    settings.experimental_rust_request_logging_masking_enabled = False
+    request_logging_middleware._RUST_REQUEST_LOGGING_MODULE = sidecar
 
     def python_data(payload: Any) -> Any:
         return mask_sensitive_data(payload, 12)
 
     def rust_data(payload: Any) -> Any:
-        return sidecar.mask_sensitive_data(payload, 12)
+        return mask_sensitive_data(payload, 12)
+
+    def python_headers(payload: Any) -> Any:
+        return mask_sensitive_headers(payload)
+
+    def rust_headers(payload: Any) -> Any:
+        return mask_sensitive_headers(payload)
 
-    python_headers = mask_sensitive_headers
-    rust_headers = sidecar.mask_sensitive_headers
+    # Warm the lazy import path once so the benchmark measures steady-state masking work.
+    _run_with_rust_masking_enabled(True, rust_data, {"warmupToken": "warmup"})
+    _run_with_rust_masking_enabled(True, rust_headers, {"Authorization": "Bearer warmup"})
 
     _assert_parity(
-        python_data,
-        rust_data,
+        lambda payload: _run_with_rust_masking_enabled(False, python_data, payload),
+        lambda payload: _run_with_rust_masking_enabled(True, rust_data, payload),
         [
             {"password": "secret", "nested": {"authToken": "abc", "ok": "value"}},
             {"token_count": 3, "tokenizer": "ok", "privateKey": "secret"},
             [{"jwt_token": "abc"}, {"normal": "value"}],
         ],
     )
     _assert_parity(
-        python_headers,
-        rust_headers,
+        lambda payload: _run_with_rust_masking_enabled(False, python_headers, payload),
+        lambda payload: _run_with_rust_masking_enabled(True, rust_headers, payload),
         [
             {"Authorization": "Bearer abc", "Cookie": "jwt_token=abc; theme=dark", "X-Trace-Id": "123"},
             {"X-Auth-Count": "5", "X-Api-Key": "secret"},
@@ -110,8 +166,12 @@ def rust_data(payload: Any) -> Any:
 
     for name, python_fn, rust_fn, payload, iterations in scenarios:
         print(f"\n{name} ({iterations} iterations)")
-        python_median, _ = _measure("python", python_fn, payload, iterations)
-        rust_median, _ = _measure("rust", rust_fn, payload, iterations)
+        _reset_rust_module_handle()
+        with _rust_masking_enabled(True):
+            _measure_once("rust first_public_call", rust_fn, payload)
+            _measure_once("rust warmup", rust_fn, payload)
+        python_median, _ = _measure_with_rust_masking_enabled(False, "python", python_fn, payload, iterations)
+        rust_median, _ = _measure_with_rust_masking_enabled(True, "rust-public-api", rust_fn, payload, iterations)
         print(f"speedup={python_median / rust_median:.2f}x")
 
 

tests/unit/mcpgateway/middleware/test_request_logging_middleware.py

@@ -137,6 +137,26 @@ def test_mask_sensitive_data_uses_rust_sidecar_when_enabled(monkeypatch):
     rust_module.mask_sensitive_data.assert_called_once_with({"password": "secret", "username": "user"}, 10)  # pragma: allowlist secret
 
 
+def test_mask_sensitive_data_missing_sidecar_is_hard_failure_when_enabled(monkeypatch):
+    monkeypatch.setattr("mcpgateway.middleware.request_logging_middleware.settings.experimental_rust_request_logging_masking_enabled", True, raising=False)
+
+    with patch("mcpgateway.middleware.request_logging_middleware._load_rust_request_logging_module", side_effect=ModuleNotFoundError("missing sidecar")):
+        with pytest.raises(ModuleNotFoundError, match="missing sidecar"):
+            mask_sensitive_data({"password": "secret"})  # pragma: allowlist secret
+
+
+def test_mask_sensitive_headers_uses_rust_sidecar_when_enabled(monkeypatch):
+    rust_module = MagicMock()
+    rust_module.mask_sensitive_headers.return_value = {"Authorization": "******", "X-Custom": "ok"}
+    monkeypatch.setattr("mcpgateway.middleware.request_logging_middleware.settings.experimental_rust_request_logging_masking_enabled", True, raising=False)
+
+    with patch("mcpgateway.middleware.request_logging_middleware._load_rust_request_logging_module", return_value=rust_module):
+        masked = mask_sensitive_headers({"Authorization": "Bearer abc", "X-Custom": "ok"})
+
+    assert masked == {"Authorization": "******", "X-Custom": "ok"}
+    rust_module.mask_sensitive_headers.assert_called_once_with({"Authorization": "Bearer abc", "X-Custom": "ok"})
+
+
 def test_mask_sensitive_headers_missing_sidecar_is_hard_failure_when_enabled(monkeypatch):
     monkeypatch.setattr("mcpgateway.middleware.request_logging_middleware.settings.experimental_rust_request_logging_masking_enabled", True, raising=False)