feat(core): Drop the server spans of managed tunnel requests

Server SDKs start the incoming request span before a framework hook gets to
answer a tunnel request, so clients with the managed tunnel enabled now add the
tunnel paths to `ignoreSpans`.

Author: logaretm

packages/core/src/client.ts

@@ -41,6 +41,7 @@ import type { ResolvedDataCollection } from './types/datacollection';
 import { createClientReportEnvelope } from './utils/clientreport';
 import { consoleSandbox, debug } from './utils/debug-logger';
 import { dsnToString, makeDsn } from './utils/dsn';
+import { getTunnelIgnoreSpanFilter } from './utils/tunnel';
 import { addItemToEnvelope, createAttachmentEnvelopeItem, getDataCategoryByType } from './utils/envelope';
 import { getPossibleEventMessages, isInternalException } from './utils/eventUtils';
 import { isObjectLike, isParameterizedString, isPlainObject, isPrimitive } from './utils/is';
@@ -271,6 +272,11 @@ export abstract class Client<O extends ClientOptions = ClientOptions> {
       DEBUG_BUILD && debug.warn('No DSN provided, client will not send events.');
     }
 
+    const tunnelSpanFilter = options._managedTunnel && getTunnelIgnoreSpanFilter(options._managedTunnel, this._dsn);
+    if (tunnelSpanFilter) {
+      this._options.ignoreSpans = [...(this._options.ignoreSpans ?? []), tunnelSpanFilter];
+    }
+
     const { beforeSendSpan, traceLifecycle } = this._options;
     // A `beforeSendSpan` callback is only invoked for the span format matching the trace lifecycle,
     // so a mismatch means it is silently never called.

packages/core/src/types/options.ts

@@ -96,7 +96,7 @@ export type IgnoreSpanAttributeValue = string | boolean | number | string[] | bo
  * At least one of the properties (`name`, `op`, or `attributes`) must be set.
  * If multiple are set, all must match for the span to be ignored.
  */
-type IgnoreSpanFilter =
+export type IgnoreSpanFilter =
   | {
       /**
        * Spans with a name matching this pattern will be ignored.

packages/core/src/utils/tunnel.ts

@@ -1,8 +1,10 @@
 import { getEnvelopeEndpointWithUrlEncodedAuth } from '../api';
 import { getClient } from '../currentScopes';
 import { suppressTracing } from '../tracing/trace';
-import type { DsnLike } from '../types/dsn';
-import type { TunnelOptions } from '../types/options';
+import { URL_PATH } from '@sentry/conventions/attributes';
+import type { DsnComponents, DsnLike } from '../types/dsn';
+import type { IgnoreSpanFilter, TunnelOptions } from '../types/options';
+import { escapeStringForRegex } from '../vendor/escapeStringForRegex';
 import { debug } from './debug-logger';
 import { dsnToString, makeDsn } from './dsn';
 import { parseEnvelope } from './envelope';
@@ -82,13 +84,27 @@ export function getTunnelPaths(options?: TunnelOptions): string[] {
     return [];
   }
 
-  if (tunnelOptions.path) {
-    return [tunnelOptions.path];
+  return tunnelPathsFor(tunnelOptions, resolveAllowedDsns(tunnelOptions.allowedDsns));
+}
+
+/**
+ * An `ignoreSpans` filter for the server spans of tunnel requests. Server SDKs start the span before a framework
+ * hook gets to answer the request, so clients add this whenever the managed tunnel is enabled.
+ */
+export function getTunnelIgnoreSpanFilter(
+  tunnelOptions: TunnelOptions,
+  dsn: DsnComponents | undefined,
+): IgnoreSpanFilter | undefined {
+  const allowedDsns = tunnelOptions.allowedDsns ?? (dsn ? [dsnToString(dsn)] : []);
+  const paths = tunnelPathsFor(tunnelOptions, allowedDsns).map(escapeStringForRegex);
+  if (!paths.length) {
+    return undefined;
   }
 
-  return resolveAllowedDsns(tunnelOptions.allowedDsns)
-    .map(dsn => getTunnelPath(dsn))
-    .filter((path): path is string => !!path);
+  const basePath = escapeStringForRegex(tunnelOptions.basePath?.replace(/\/$/, '') ?? '');
+
+  // oxlint-disable-next-line sdk/no-regexp-constructor -- built from escaped config values, not end user input
+  return { attributes: { [URL_PATH]: new RegExp(`^(?:${basePath})?(?:${paths.join('|')})/?$`) } };
 }
 
 /**
@@ -231,3 +247,11 @@ function fnv1a(input: string): number {
   // eslint-disable-next-line no-bitwise
   return hash >>> 0;
 }
+
+function tunnelPathsFor(tunnelOptions: TunnelOptions, allowedDsns: Array<string>): string[] {
+  if (tunnelOptions.path) {
+    return [tunnelOptions.path];
+  }
+
+  return allowedDsns.map(dsn => getTunnelPath(dsn)).filter((path): path is string => !!path);
+}

packages/core/test/lib/utils/tunnel.test.ts

@@ -6,6 +6,7 @@ import { makeDsn } from '../../../src/utils/dsn';
 import { createEnvelope, serializeEnvelope } from '../../../src/utils/envelope';
 import {
   getTunnelPath,
+  getTunnelIgnoreSpanFilter,
   getTunnelPaths,
   handleTunnelRequest,
   handleTunnelRequestIfMatched,
@@ -360,6 +361,62 @@ describe('handleTunnelRequestIfMatched', () => {
   });
 });
 
+describe('getTunnelIgnoreSpanFilter', () => {
+  function urlPathMatcher(filter: ReturnType<typeof getTunnelIgnoreSpanFilter>): RegExp {
+    return (filter as { attributes: { 'url.path': RegExp } }).attributes['url.path'];
+  }
+
+  it("matches the tunnel path of the client's DSN, with or without a trailing slash", () => {
+    const matcher = urlPathMatcher(getTunnelIgnoreSpanFilter({}, makeDsn(TEST_DSN)));
+    const tunnelPath = getTunnelPath(TEST_DSN)!;
+
+    expect(matcher.test(tunnelPath)).toBe(true);
+    expect(matcher.test(`${tunnelPath}/`)).toBe(true);
+    expect(matcher.test(`${tunnelPath}x`)).toBe(false);
+    expect(matcher.test('/api/users')).toBe(false);
+  });
+
+  it('follows allowedDsns, a fixed path and the base path', () => {
+    const otherDsn = 'https://other@o2.ingest.sentry.io/42';
+
+    expect(
+      urlPathMatcher(getTunnelIgnoreSpanFilter({ allowedDsns: [otherDsn] }, makeDsn(TEST_DSN))).test(
+        getTunnelPath(otherDsn)!,
+      ),
+    ).toBe(true);
+    expect(urlPathMatcher(getTunnelIgnoreSpanFilter({ path: '/monitor' }, undefined)).test('/monitor')).toBe(true);
+    expect(
+      urlPathMatcher(getTunnelIgnoreSpanFilter({ basePath: '/app/' }, makeDsn(TEST_DSN))).test(
+        `/app${getTunnelPath(TEST_DSN)}`,
+      ),
+    ).toBe(true);
+  });
+
+  it('returns nothing when there is no path to match', () => {
+    expect(getTunnelIgnoreSpanFilter({}, undefined)).toBeUndefined();
+  });
+});
+
+describe('client with the managed tunnel enabled', () => {
+  it('ignores the server spans of tunnel requests and keeps user filters', () => {
+    const client = new TestClient(
+      getDefaultTestClientOptions({ dsn: TEST_DSN, _managedTunnel: {}, ignoreSpans: ['user-filter'] }),
+    );
+    const ignoreSpans = client.getOptions().ignoreSpans!;
+
+    expect(ignoreSpans[0]).toBe('user-filter');
+    expect(
+      (ignoreSpans[1] as { attributes: { 'url.path': RegExp } }).attributes['url.path'].test(getTunnelPath(TEST_DSN)!),
+    ).toBe(true);
+  });
+
+  it('leaves ignoreSpans alone without the managed tunnel', () => {
+    const client = new TestClient(getDefaultTestClientOptions({ dsn: TEST_DSN }));
+
+    expect(client.getOptions().ignoreSpans).toBeUndefined();
+  });
+});
+
 describe('resolveServerTunnelOption', () => {
   it('keeps a URL as the transport tunnel', () => {
     expect(resolveServerTunnelOption('https://example.com/tunnel')).toEqual({ tunnel: 'https://example.com/tunnel' });