Merge branch 'develop' into isaacschlueter/js-3800-vercelaiintegration-experimental_telemetrymetadata-no-longer

Author: isaacs

packages/bun/src/integrations/bunserver.ts

@@ -21,8 +21,11 @@ import {
   filterCollectedUrl,
   filterCollectedUrlQuery,
 } from '@sentry/core';
-import type { ServeOptions } from 'bun';
+import type { Server, ServeOptions } from 'bun';
 import {
+  CLIENT_ADDRESS,
+  CLIENT_PORT,
+  NETWORK_PROTOCOL_NAME,
   SENTRY_OP,
   SENTRY_SEGMENT_NAME_SOURCE,
   URL_DOMAIN,
@@ -242,6 +245,24 @@ function wrapRequestHandler<T extends RouteHandler = RouteHandler>(
     const client = getClient();
     const dataCollection = client?.getDataCollectionOptions();
 
+    if (dataCollection?.userInfo) {
+      // `client.address` is the originating client, so a forwarding header wins over the socket, which
+      // behind a proxy holds the proxy's address.
+      const forwardedFor = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim();
+      // Bun passes the `Server` as the second argument to both `fetch` and route handlers, except
+      // when the handler runs through `server.fetch()`.
+      const socketAddress = getRequestIP(args[1], request);
+      if (forwardedFor || socketAddress?.address) {
+        attributes[CLIENT_ADDRESS] = forwardedFor || socketAddress?.address;
+      }
+      if (socketAddress?.port) {
+        attributes[CLIENT_PORT] = socketAddress.port;
+      }
+    }
+
+    // describes the OSI application-layer protocol (http), not the scheme (might be https)
+    attributes[NETWORK_PROTOCOL_NAME] = 'http';
+
     if (dataCollection) {
       Object.assign(attributes, httpHeadersToSpanAttributes(request.headers.toJSON(), dataCollection));
     }
@@ -308,6 +329,18 @@ function wrapRequestHandler<T extends RouteHandler = RouteHandler>(
   });
 }
 
+function getRequestIP(server: unknown, request: Request): { address: string; port: number } | undefined {
+  if (typeof (server as Partial<Server> | undefined)?.requestIP !== 'function') {
+    return undefined;
+  }
+  try {
+    return (server as Server).requestIP(request) ?? undefined;
+  } catch {
+    // Defensive: never let a failed lookup break the user's handler.
+    return undefined;
+  }
+}
+
 function getSpanAttributesFromParsedUrl(
   parsedUrl: ReturnType<typeof parseStringToURLObject>,
   request: Request,

packages/bun/test/integrations/bunserver.test.ts

@@ -521,6 +521,148 @@ describe('Bun Serve Integration', () => {
   });
 
   describe('data collection', () => {
+    test('captures client address, port and protocol by default', async () => {
+      const server = Bun.serve({
+        async fetch(_req) {
+          return new Response('Bun!');
+        },
+        port,
+      });
+
+      await fetch(`http://localhost:${port}/`);
+
+      await server.stop();
+
+      expect(startSpanSpy).toHaveBeenCalledTimes(1);
+      expect(startSpanSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          attributes: expect.objectContaining({
+            'client.address': expect.stringMatching(/^(127\.0\.0\.1|::1|::ffff:127\.0\.0\.1)$/),
+            'client.port': expect.any(Number),
+            'network.protocol.name': 'http',
+          }),
+        }),
+        expect.any(Function),
+      );
+    });
+
+    test('captures client address on route handlers', async () => {
+      const server = Bun.serve({
+        routes: {
+          '/users/:id': req => new Response(`User ${req.params.id}`),
+        },
+        port,
+      });
+
+      await fetch(`http://localhost:${port}/users/123`);
+
+      await server.stop();
+
+      expect(startSpanSpy).toHaveBeenCalledTimes(1);
+      expect(startSpanSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          attributes: expect.objectContaining({
+            'client.address': expect.stringMatching(/^(127\.0\.0\.1|::1|::ffff:127\.0\.0\.1)$/),
+            'client.port': expect.any(Number),
+          }),
+        }),
+        expect.any(Function),
+      );
+    });
+
+    test('prefers the first x-forwarded-for address over the socket address', async () => {
+      const server = Bun.serve({
+        async fetch(_req) {
+          return new Response('Bun!');
+        },
+        port,
+      });
+
+      await fetch(`http://localhost:${port}/`, {
+        headers: { 'X-Forwarded-For': '203.0.113.7, 10.0.0.1' },
+      });
+
+      await server.stop();
+
+      expect(startSpanSpy).toHaveBeenCalledTimes(1);
+      expect(startSpanSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          attributes: expect.objectContaining({
+            'client.address': '203.0.113.7',
+          }),
+        }),
+        expect.any(Function),
+      );
+    });
+
+    test('does not capture client address when userInfo collection is disabled', async () => {
+      setupClient({ dataCollection: { userInfo: false } });
+
+      const server = Bun.serve({
+        async fetch(_req) {
+          return new Response('Bun!');
+        },
+        port,
+      });
+
+      await fetch(`http://localhost:${port}/`, {
+        headers: { 'X-Forwarded-For': '203.0.113.7' },
+      });
+
+      await server.stop();
+
+      expect(startSpanSpy).toHaveBeenCalledTimes(1);
+      expect(startSpanSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          attributes: expect.not.objectContaining({
+            'client.address': expect.anything(),
+            'client.port': expect.anything(),
+          }),
+        }),
+        expect.any(Function),
+      );
+      expect(startSpanSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          attributes: expect.objectContaining({
+            'network.protocol.name': 'http',
+          }),
+        }),
+        expect.any(Function),
+      );
+    });
+
+    test('leaves client address unset when the handler gets no server', async () => {
+      const server = Bun.serve({
+        async fetch(_req) {
+          return new Response('Bun!');
+        },
+        port,
+      });
+
+      // `server.fetch()` calls the handler with the request only.
+      const response = await server.fetch(new Request(`http://localhost:${port}/`));
+
+      await server.stop();
+
+      expect(await response.text()).toBe('Bun!');
+      expect(startSpanSpy).toHaveBeenCalledTimes(1);
+      expect(startSpanSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          attributes: expect.not.objectContaining({
+            'client.address': expect.anything(),
+            'client.port': expect.anything(),
+          }),
+        }),
+        expect.any(Function),
+      );
+      expect(startSpanSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          attributes: expect.objectContaining({ 'network.protocol.name': 'http' }),
+        }),
+        expect.any(Function),
+      );
+    });
+
     test('keeps PII request headers when dataCollection enables full header collection', async () => {
       setupClient({ dataCollection: { httpHeaders: { request: true, response: true } } });