Skip to content

fix(appsec): normalize sampling priority in the API Security sampler - #9953

Merged
CarlesDD merged 15 commits into
masterfrom
ccapell/APPSEC-68818/refactor-apisec-sampler-single-path
Sep 1, 2026
Merged

CarlesDD merged 15 commits into
masterfrom
ccapell/APPSEC-68818/refactor-apisec-sampler-single-path

Conversation

@CarlesDD

@CarlesDD CarlesDD commented Aug 24, 2026 •

Copy link
Copy Markdown
Contributor

What does this PR do?

Splits the API Security sampler into a transport-agnostic core (sampleRootSpanRequest) and a thin Node HTTP adapter (sampleRequest, signature unchanged). Same split for telemetry: reportRootSpanRequest / reportRequest.

Fixes a bug found on the way: getSpanPriority now coerces the priority to a number before comparing it against the ext/priority constants.

Motivation

The refactor unblocks calling the sampler from AWS Lambda, which has no req/res, without duplicating the TTL cache, the priority guard and the standalone-billing keepTrace into a second path that would drift. The Lambda caller comes in a follow-up PR.

APPSEC-68818

Additional Notes

  • No behaviour change for the HTTP path beyond the priority fix.
  • The 404 carve-out compares Number(statusCode), since Lambda publishes it as a string. Sampling keys are unaffected and there is a test pinning that.

@dd-octo-sts

dd-octo-sts Bot commented Aug 24, 2026 •

Copy link
Copy Markdown
Contributor

Overall package size

Self size: 8.64 MB
Deduped: 9.31 MB
No deduping: 9.31 MB

Dependency sizes | name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.4.0 | 127.33 kB | 447.04 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |

🤖 This report was automatically generated by heaviest-objects-in-the-universe

@datadog-datadog-us1-prod

datadog-datadog-us1-prod Bot commented Aug 24, 2026 •

Copy link
Copy Markdown

Tests

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 98.63% (+0.00%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 9305790 | Docs | View more details | Give us feedback!

@codecov

codecov Bot commented Aug 24, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.63%. Comparing base (89aebac) to head (9305790).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff            @@
##           master    #9953    +/-   ##
========================================
  Coverage   98.62%   98.63%            
========================================
  Files         996      996            
  Lines      152130   152275   +145     
  Branches    13173    13100    -73     
========================================
+ Hits       150043   150193   +150     
+ Misses       2087     2082     -5     
Flag Coverage Δ
aiguard 63.16% <ø> (+<0.01%) ⬆️
aiguard-integration 58.96% <ø> (-0.04%) ⬇️
apm-bucket-0 62.49% <ø> (-0.03%) ⬇️
apm-bucket-1 67.94% <ø> (-0.02%) ⬇️
apm-bucket-2 67.50% <ø> (-0.02%) ⬇️
apm-bucket-3 64.35% <ø> (-0.02%) ⬇️
apm-capabilities-tracing 62.52% <52.03%> (-0.05%) ⬇️
apm-integrations-aerospike 60.50% <ø> (-0.03%) ⬇️
apm-integrations-confluentinc-kafka-javascript 66.62% <ø> (+0.01%) ⬆️
apm-integrations-couchbase 61.02% <ø> (-0.03%) ⬇️
apm-integrations-http 66.28% <100.00%> (+0.04%) ⬆️
apm-integrations-kafkajs 67.20% <ø> (-0.02%) ⬇️
apm-integrations-next 63.84% <ø> (-0.02%) ⬇️
apm-integrations-prisma 61.89% <ø> (-0.02%) ⬇️
appsec 76.75% <100.00%> (+0.01%) ⬆️
appsec-express_fastify_graphql 72.70% <100.00%> (+0.01%) ⬆️
appsec-integration 49.56% <95.93%> (+0.03%) ⬆️
appsec-kafka_ldapjs_lodash 67.41% <ø> (-0.05%) ⬇️
appsec-mongodb-core_mongoose_mysql 70.65% <100.00%> (+0.01%) ⬆️
appsec-next 57.17% <97.56%> (+0.04%) ⬆️
appsec-node-serialize_passport_postgres 70.13% <100.00%> (+0.01%) ⬆️
appsec-sourcing_stripe_template 68.56% <100.00%> (+0.02%) ⬆️
debugger 69.06% <ø> (-0.04%) ⬇️
instrumentations-bucket-0 56.07% <ø> (-0.03%) ⬇️
instrumentations-bucket-1 64.16% <ø> (-0.02%) ⬇️
instrumentations-bucket-10 53.28% <ø> (-0.02%) ⬇️
instrumentations-bucket-11 65.68% <100.00%> (+0.04%) ⬆️
instrumentations-bucket-12 61.38% <ø> (-0.03%) ⬇️
instrumentations-bucket-13 56.27% <ø> (-0.03%) ⬇️
instrumentations-bucket-14 55.72% <ø> (-0.03%) ⬇️
instrumentations-bucket-2 56.92% <ø> (-0.02%) ⬇️
instrumentations-bucket-3 57.17% <ø> (-0.02%) ⬇️
instrumentations-bucket-4 63.78% <ø> (-0.02%) ⬇️
instrumentations-bucket-5 56.52% <ø> (-0.03%) ⬇️
instrumentations-bucket-6 58.13% <ø> (-0.02%) ⬇️
instrumentations-bucket-7 65.65% <ø> (-0.02%) ⬇️
instrumentations-bucket-8 62.91% <ø> (-0.02%) ⬇️
instrumentations-bucket-9 64.51% <ø> (-0.02%) ⬇️
instrumentations-instrumentation-couchbase 54.68% <ø> (-0.03%) ⬇️
instrumentations-instrumentation-zlib 55.75% <ø> (-0.03%) ⬇️
instrumentations-integration-esbuild 34.52% <ø> (-0.01%) ⬇️
llmobs-ai_anthropic_bedrock 66.70% <ø> (+<0.01%) ⬆️
llmobs-bucket-1 64.83% <ø> (-0.03%) ⬇️
llmobs-openai 66.69% <ø> (-0.02%) ⬇️
llmobs-openai-agents_vertex-ai 63.97% <ø> (-0.02%) ⬇️
llmobs-sdk 75.90% <ø> (-0.03%) ⬇️
master-coverage 98.63% <100.00%> (?)
openfeature 59.59% <ø> (+<0.01%) ⬆️
openfeature-unit 58.27% <ø> (-0.03%) ⬇️
platform-core_esbuild_instrumentations-misc 41.09% <ø> (-0.01%) ⬇️
platform-integration 64.80% <ø> (+<0.01%) ⬆️
platform-shimmer_unit-guardrails_webpack 38.92% <ø> (-0.01%) ⬇️
plugins-browser-bunyan_bullmq_cassandra 66.23% <ø> (-0.02%) ⬇️
plugins-bucket-0 60.90% <ø> (-0.03%) ⬇️
plugins-bucket-1 58.13% <ø> (-0.01%) ⬇️
plugins-bucket-11 67.67% <ø> (-0.02%) ⬇️
plugins-bucket-18 65.44% <ø> (-0.02%) ⬇️
plugins-bucket-19 64.93% <ø> (-0.01%) ⬇️
plugins-bucket-20 68.63% <ø> (-0.03%) ⬇️
plugins-bucket-4 61.07% <ø> (-0.03%) ⬇️
plugins-cookie_cookie-parser_crypto 55.66% <ø> (-0.03%) ⬇️
plugins-fastify_fetch_fs 65.36% <ø> (+0.01%) ⬆️
plugins-generic-pool_google-cloud-pubsub_grpc 68.93% <ø> (-0.02%) ⬇️
plugins-handlebars_hapi_hono 63.58% <ø> (-0.02%) ⬇️
plugins-ioredis_knex_langgraph 61.60% <ø> (-0.02%) ⬇️
plugins-ldapjs_light-my-request_limitd-client 63.30% <ø> (-0.02%) ⬇️
plugins-lodash_mariadb_memcached 63.79% <ø> (+0.08%) ⬆️
plugins-moleculer_mongodb_mongodb-core 66.04% <ø> (-0.02%) ⬇️
plugins-mongoose_multer_mysql 63.90% <ø> (-0.02%) ⬇️
plugins-mysql2_nats_node-serialize 66.11% <ø> (-0.02%) ⬇️
plugins-opensearch_passport-http_pino 64.00% <ø> (-0.02%) ⬇️
plugins-postgres_process_pug 63.04% <ø> (-0.02%) ⬇️
plugins-redis_router_sequelize 66.61% <ø> (-0.02%) ⬇️
plugins-test-and-upstream-rhea_undici_url 65.96% <ø> (-0.02%) ⬇️
plugins-valkey_vm_winston 62.36% <ø> (+0.02%) ⬆️
plugins-ws 64.42% <ø> (-0.03%) ⬇️
profiling 66.20% <ø> (-0.01%) ⬇️
serverless-aws-sdk-aws-sdk 55.42% <ø> (-0.03%) ⬇️
serverless-aws-sdk-base-inject-field 55.24% <ø> (-0.03%) ⬇️
serverless-aws-sdk-bedrockruntime 58.66% <ø> (+0.39%) ⬆️
serverless-aws-sdk-client 60.02% <ø> (-0.04%) ⬇️
serverless-aws-sdk-dynamodb 59.11% <ø> (-0.03%) ⬇️
serverless-aws-sdk-eventbridge 57.62% <ø> (-0.03%) ⬇️
serverless-aws-sdk-kinesis 63.07% <ø> (-0.04%) ⬇️
serverless-aws-sdk-lambda 61.04% <ø> (-0.04%) ⬇️
serverless-aws-sdk-s3 59.15% <ø> (-0.04%) ⬇️
serverless-aws-sdk-serverless-peer-service 63.64% <ø> (-0.04%) ⬇️
serverless-aws-sdk-sns 63.96% <ø> (-0.04%) ⬇️
serverless-aws-sdk-sqs 64.42% <ø> (-0.04%) ⬇️
serverless-aws-sdk-stepfunctions 59.01% <ø> (-0.04%) ⬇️
serverless-aws-sdk-util 55.85% <ø> (-0.03%) ⬇️
serverless-bucket-0 57.76% <ø> (-0.01%) ⬇️
serverless-bucket-1 63.67% <ø> (-0.02%) ⬇️
test-optimization-cucumber 70.54% <ø> (+0.02%) ⬆️
test-optimization-cypress 64.79% <ø> (+0.08%) ⬆️
test-optimization-jest 72.11% <ø> (-0.09%) ⬇️
test-optimization-mocha 71.99% <ø> (+0.06%) ⬆️
test-optimization-playwright-playwright-atr 59.81% <ø> (-0.05%) ⬇️
test-optimization-playwright-playwright-efd 60.49% <ø> (+<0.01%) ⬆️
test-optimization-playwright-playwright-final-status 60.05% <ø> (-0.04%) ⬇️
test-optimization-playwright-playwright-impacted-tests 60.17% <ø> (+0.09%) ⬆️
test-optimization-playwright-playwright-reporting 61.14% <ø> (-0.04%) ⬇️
test-optimization-playwright-playwright-test-management 61.22% <ø> (-0.05%) ⬇️
test-optimization-playwright-playwright-test-span 59.84% <ø> (+<0.01%) ⬆️
test-optimization-selenium 58.88% <ø> (-0.07%) ⬇️
test-optimization-testopt 61.80% <ø> (+0.05%) ⬆️
test-optimization-vitest 72.70% <ø> (+2.02%) ⬆️
test-optimization-vitest-browser 58.70% <ø> (-0.04%) ⬇️
test-optimization-webdriverio 65.53% <ø> (+0.04%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@pr-commenter

pr-commenter Bot commented Aug 24, 2026 •

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-09-01 14:25:42

Comparing candidate commit 9305790 in PR branch ccapell/APPSEC-68818/refactor-apisec-sampler-single-path with baseline commit 89aebac in branch master.

📊 Benchmarking dashboard

Found 0 performance improvements and 0 performance regressions! Performance is the same for 2297 metrics, 13 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:appsec-appsec-enabled-20

  • unstable max_rss_usage [-17.589MB; +5.769MB] or [-9.961%; +3.267%]

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-26

  • unstable max_rss_usage [-16.534MB; +24.905MB] or [-5.902%; +8.890%]

scenario:appsec-iast-with-vulnerability-iast-enabled-default-config-20

  • unstable max_rss_usage [-24.630MB; +47.975MB] or [-6.593%; +12.841%]

scenario:appsec-iast-with-vulnerability-iast-enabled-default-config-26

  • unstable max_rss_usage [-18470.337KB; +17273.537KB] or [-5.714%; +5.343%]

scenario:debugger-line-probe-with-snapshot-minimal-24

  • unstable max_rss_usage [-12.684MB; +16.198MB] or [-5.132%; +6.555%]

scenario:debugger-line-probe-without-snapshot-26

  • unstable max_rss_usage [-9.905MB; +19.210MB] or [-3.780%; +7.331%]

scenario:dogstatsd-with-tags-20

  • unstable cpu_user_time [-413.776ms; +262.131ms] or [-8.503%; +5.387%]
  • unstable execution_time [-415.153ms; +263.391ms] or [-8.392%; +5.324%]
  • unstable throughput [-89108.255op/s; +137308.902op/s] or [-5.249%; +8.088%]

scenario:plugin-claude-agent-sdk-compact-stream-scan-26

  • unstable cpu_usage_percentage [-7.361%; +4.406%]

scenario:plugin-graphql-long-with-depth-on-max-20

  • unstable max_rss_usage [-12.590MB; +7.606MB] or [-8.746%; +5.283%]

scenario:plugin-mongodb-core-deep-aggregate-26

  • unstable execution_time [-106.135ms; +180.460ms] or [-3.903%; +6.636%]

scenario:test-optimization-large-suite-20

  • unstable max_rss_usage [-5.222MB; +8.491MB] or [-6.333%; +10.298%]

@chatgpt-codex-connector

This comment was marked as resolved.

@CarlesDD
CarlesDD marked this pull request as ready for review August 25, 2026 08:52
@CarlesDD
CarlesDD requested review from a team as code owners August 25, 2026 08:52
chatgpt-codex-connector[bot]

This comment was marked as resolved.

@CarlesDD
CarlesDD marked this pull request as draft August 25, 2026 09:13
chatgpt-codex-connector[bot]

This comment was marked as resolved.

@CarlesDD
CarlesDD marked this pull request as ready for review August 27, 2026 07:01
chatgpt-codex-connector[bot]

This comment was marked as resolved.

@CarlesDD
CarlesDD marked this pull request as draft August 31, 2026 21:10
Comment thread packages/dd-trace/src/appsec/api_security/sampler.js
@CarlesDD
CarlesDD marked this pull request as ready for review September 1, 2026 12:20
@CarlesDD
CarlesDD enabled auto-merge (squash) September 1, 2026 12:26
chatgpt-codex-connector[bot]

This comment was marked as resolved.

@CarlesDD
CarlesDD disabled auto-merge September 1, 2026 12:31
@CarlesDD
CarlesDD marked this pull request as draft September 1, 2026 12:31
@CarlesDD
CarlesDD marked this pull request as ready for review September 1, 2026 14:32
@CarlesDD
CarlesDD merged commit 67c9007 into master Sep 1, 2026
805 of 807 checks passed
@CarlesDD
CarlesDD deleted the ccapell/APPSEC-68818/refactor-apisec-sampler-single-path branch September 1, 2026 14:56
@dd-octo-sts dd-octo-sts Bot mentioned this pull request Sep 2, 2026
@dd-octo-sts dd-octo-sts Bot mentioned this pull request Sep 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants