test: Port the audit fixes to Boot 4 WebFlux

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: runningcode

sentry-spring-boot-4/src/integrationTestWebflux/kotlin/io/sentry/spring/boot4/webfluxintegrationtest/CacheController.kt

@@ -0,0 +1,43 @@
+package io.sentry.spring.boot4.webfluxintegrationtest
+
+import java.util.concurrent.ConcurrentHashMap
+import org.springframework.cache.annotation.CacheEvict
+import org.springframework.cache.annotation.CachePut
+import org.springframework.cache.annotation.Cacheable
+import org.springframework.stereotype.Service
+import org.springframework.web.bind.annotation.DeleteMapping
+import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.PathVariable
+import org.springframework.web.bind.annotation.PostMapping
+import org.springframework.web.bind.annotation.RequestBody
+import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RestController
+
+@RestController
+@RequestMapping("/cache/")
+class CacheController(private val todoCache: TodoCache) {
+  @GetMapping("{id}") fun get(@PathVariable("id") id: Long): Todo? = todoCache.get(id)
+
+  @PostMapping fun save(@RequestBody todo: Todo): Todo = todoCache.save(todo)
+
+  @DeleteMapping("{id}") fun delete(@PathVariable("id") id: Long) = todoCache.delete(id)
+}
+
+/** Reads and writes todos through Spring's cache abstraction, which Sentry traces. */
+@Service
+class TodoCache {
+  private val store = ConcurrentHashMap<Long, Todo>()
+
+  @Cacheable(value = ["todos"], key = "#id") fun get(id: Long): Todo? = store[id]
+
+  @CachePut(value = ["todos"], key = "#todo.id")
+  fun save(todo: Todo): Todo {
+    store[todo.id!!] = todo
+    return todo
+  }
+
+  @CacheEvict(value = ["todos"], key = "#id")
+  fun delete(id: Long) {
+    store.remove(id)
+  }
+}

sentry-spring-boot-4/src/integrationTestWebflux/kotlin/io/sentry/spring/boot4/webfluxintegrationtest/CacheWebfluxIntegrationTest.kt

@@ -0,0 +1,35 @@
+package io.sentry.spring.boot4.webfluxintegrationtest
+
+import com.google.common.truth.Truth.assertThat
+import io.sentry.test.hasSpanWithOp
+import io.sentry.test.transaction
+import kotlin.test.Test
+import org.springframework.http.HttpEntity
+import org.springframework.http.HttpMethod
+
+class CacheWebfluxIntegrationTest : WebfluxIntegrationTest() {
+
+  @Test
+  fun `cache put and get produce spans`() {
+    val saved = restTemplate.postForEntity("/cache/", Todo(1L, "test-todo"), Todo::class.java)
+    assertThat(saved.statusCode.value()).isEqualTo(200)
+    assertThat(awaitTransaction("POST /cache/").hasSpanWithOp("cache.put")).isTrue()
+
+    val fetched = restTemplate.getForEntity("/cache/1", Todo::class.java)
+    assertThat(fetched.statusCode.value()).isEqualTo(200)
+    assertThat(fetched.body!!.title).isEqualTo("test-todo")
+    assertThat(awaitTransaction("GET /cache/{id}").hasSpanWithOp("cache.get")).isTrue()
+  }
+
+  @Test
+  fun `cache evict produces span`() {
+    val response =
+      restTemplate.exchange("/cache/1", HttpMethod.DELETE, HttpEntity.EMPTY, Void::class.java)
+    assertThat(response.statusCode.value()).isEqualTo(200)
+
+    assertThat(awaitTransaction("DELETE /cache/{id}").hasSpanWithOp("cache.evict")).isTrue()
+  }
+
+  private fun awaitTransaction(name: String) =
+    server.awaitEnvelope { it.transaction()?.transaction == name }.transaction()!!
+}

sentry-spring-boot-4/src/integrationTestWebflux/kotlin/io/sentry/spring/boot4/webfluxintegrationtest/DistributedTracingWebfluxIntegrationTest.kt

@@ -4,6 +4,7 @@ import com.google.common.truth.Truth.assertThat
 import io.sentry.SentryEnvelope
 import io.sentry.protocol.SentryId
 import io.sentry.test.transaction
+import kotlin.random.Random
 import kotlin.test.Test
 import org.springframework.http.HttpEntity
 import org.springframework.http.HttpHeaders
@@ -27,26 +28,26 @@ class DistributedTracingWebfluxIntegrationTest : WebfluxIntegrationTest() {
       )
     assertThat(status).isEqualTo(500)
 
-    awaitTransaction("GET /tracing/{id}", traceId)
+    val incoming = awaitTransaction("GET /tracing/{id}", traceId).transaction()!!
+    assertThat(incoming.request?.url).endsWith("/tracing/1")
     awaitTransaction("GET /person/{id}", traceId)
   }
 
   @Test
   fun `unsampled trace sends no transactions`() {
     val traceId = SentryId()
+    // An id only this request uses, because a mishandled header could start a trace of its own.
+    val id = Random.nextLong(2, Long.MAX_VALUE)
     val status =
       get(
-        "/tracing/1",
+        "/tracing/$id",
         sentryTrace = "$traceId-424cffc8f94feeee-0",
         baggage =
           "sentry-public_key=502f25099c204a2fbf4cb16edc5975d1,sentry-sample_rand=0.456789,sentry-sample_rate=0.5,sentry-sampled=false,sentry-trace_id=$traceId,sentry-transaction=HTTP%20GET",
       )
     assertThat(status).isEqualTo(500)
 
-    server.assertNoEnvelope {
-      isTransaction(it, "GET /tracing/{id}", traceId) ||
-        isTransaction(it, "GET /person/{id}", traceId)
-    }
+    server.assertNoEnvelope { isForRequest(it, id) }
   }
 
   @Test
@@ -63,6 +64,8 @@ class DistributedTracingWebfluxIntegrationTest : WebfluxIntegrationTest() {
 
     val incoming = awaitTransaction("GET /tracing/{id}", traceId).header.traceContext!!
     val outgoing = awaitTransaction("GET /person/{id}", traceId).header.traceContext!!
+    assertThat(incoming.traceId).isEqualTo(traceId)
+    assertThat(outgoing.traceId).isEqualTo(traceId)
     assertThat(incoming.sampleRand).isNotNull()
     assertThat(outgoing.sampleRand).isEqualTo(incoming.sampleRand)
   }
@@ -81,6 +84,8 @@ class DistributedTracingWebfluxIntegrationTest : WebfluxIntegrationTest() {
 
     val incoming = awaitTransaction("GET /tracing/{id}", traceId).header.traceContext!!
     val outgoing = awaitTransaction("GET /person/{id}", traceId).header.traceContext!!
+    assertThat(incoming.traceId).isEqualTo(traceId)
+    assertThat(outgoing.traceId).isEqualTo(traceId)
     assertThat(incoming.sampleRate).isNotEqualTo("0.5")
     assertThat(outgoing.sampleRate).isEqualTo(incoming.sampleRate)
   }
@@ -130,6 +135,12 @@ class DistributedTracingWebfluxIntegrationTest : WebfluxIntegrationTest() {
       isTransaction(it, name, traceId)
     }
 
+  /** Whether [envelope] is a transaction for `/tracing/[id]` or the `/person/[id]` it calls. */
+  private fun isForRequest(envelope: SentryEnvelope, id: Long): Boolean {
+    val url = envelope.transaction()?.request?.url ?: return false
+    return url.endsWith("/tracing/$id") || url.endsWith("/person/$id")
+  }
+
   private fun isTransaction(envelope: SentryEnvelope, name: String, traceId: SentryId): Boolean {
     val transaction = envelope.transaction() ?: return false
     return transaction.transaction == name && transaction.contexts.trace?.traceId == traceId

sentry-spring-boot-4/src/integrationTestWebflux/kotlin/io/sentry/spring/boot4/webfluxintegrationtest/MetricController.kt

@@ -0,0 +1,33 @@
+package io.sentry.spring.boot4.webfluxintegrationtest
+
+import io.sentry.Sentry
+import io.sentry.metrics.MetricsUnit
+import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.PathVariable
+import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RestController
+
+@RestController
+@RequestMapping("/metric/")
+class MetricController {
+  @GetMapping("count")
+  fun count(): String {
+    Sentry.setAttribute("user.type", "admin")
+    Sentry.setAttribute("feature.version", 2)
+    Sentry.metrics().count("countMetric")
+    return "count metric increased"
+  }
+
+  @GetMapping("gauge/{value}")
+  fun gauge(@PathVariable("value") value: Long): String {
+    Sentry.metrics().gauge("memory.free", value.toDouble(), MetricsUnit.Information.BYTE)
+    return "gauge metric tracked"
+  }
+
+  @GetMapping("distribution/{value}")
+  fun distribution(@PathVariable("value") value: Long): String {
+    Sentry.metrics()
+      .distribution("distributionMetric", value.toDouble(), MetricsUnit.Duration.MILLISECOND)
+    return "distribution metric tracked"
+  }
+}

sentry-spring-boot-4/src/integrationTestWebflux/kotlin/io/sentry/spring/boot4/webfluxintegrationtest/MetricsWebfluxIntegrationTest.kt

@@ -0,0 +1,50 @@
+package io.sentry.spring.boot4.webfluxintegrationtest
+
+import com.google.common.truth.Truth.assertThat
+import io.sentry.Sentry
+import io.sentry.SentryMetricsEvents
+import io.sentry.test.hasMetric
+import io.sentry.test.hasMetricWithAttribute
+import io.sentry.test.metrics
+import kotlin.test.Test
+
+class MetricsWebfluxIntegrationTest : WebfluxIntegrationTest() {
+
+  @Test
+  fun `count metric carries the scope's attributes`() {
+    assertThat(restTemplate.getForObject("/metric/count", String::class.java))
+      .isEqualTo("count metric increased")
+
+    val metrics = awaitMetric("countMetric")
+    assertThat(metrics.hasMetric("countMetric", "counter", 1.0)).isTrue()
+    assertThat(metrics.hasMetricWithAttribute("countMetric", "user.type", "admin")).isTrue()
+    assertThat(metrics.hasMetricWithAttribute("countMetric", "feature.version", 2)).isTrue()
+  }
+
+  @Test
+  fun `gauge metric`() {
+    assertThat(restTemplate.getForObject("/metric/gauge/14", String::class.java))
+      .isEqualTo("gauge metric tracked")
+
+    assertThat(awaitMetric("memory.free").hasMetric("memory.free", "gauge", 14.0)).isTrue()
+  }
+
+  @Test
+  fun `distribution metric`() {
+    assertThat(restTemplate.getForObject("/metric/distribution/23", String::class.java))
+      .isEqualTo("distribution metric tracked")
+
+    assertThat(
+        awaitMetric("distributionMetric").hasMetric("distributionMetric", "distribution", 23.0)
+      )
+      .isTrue()
+  }
+
+  /** Flushes first because metrics are batched before they're sent. */
+  private fun awaitMetric(name: String): SentryMetricsEvents {
+    Sentry.flush(5000)
+    return server
+      .awaitEnvelope { it.metrics()?.items?.any { metric -> metric.name == name } == true }
+      .metrics()!!
+  }
+}

sentry-spring-boot-4/src/integrationTestWebflux/kotlin/io/sentry/spring/boot4/webfluxintegrationtest/WebfluxIntegrationTest.kt

@@ -3,10 +3,10 @@ package io.sentry.spring.boot4.webfluxintegrationtest
 import io.sentry.test.MockSentryServer
 import org.junit.Before
 import org.junit.runner.RunWith
-import org.springframework.beans.factory.annotation.Autowired
+import org.springframework.boot.restclient.RestTemplateBuilder
 import org.springframework.boot.resttestclient.TestRestTemplate
-import org.springframework.boot.resttestclient.autoconfigure.AutoConfigureTestRestTemplate
 import org.springframework.boot.test.context.SpringBootTest
+import org.springframework.boot.test.web.server.LocalServerPort
 import org.springframework.test.context.DynamicPropertyRegistry
 import org.springframework.test.context.DynamicPropertySource
 import org.springframework.test.context.junit4.SpringRunner
@@ -20,14 +20,13 @@ import org.springframework.test.context.junit4.SpringRunner
  * produce.
  */
 @RunWith(SpringRunner::class)
-// Spring Boot 4 only provides TestRestTemplate when asked to.
-@AutoConfigureTestRestTemplate
 @SpringBootTest(
   classes = [WebfluxIntegrationTestApplication::class],
   webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT,
   properties =
     [
       "sentry.traces-sample-rate=1.0",
+      "sentry.enable-cache-tracing=true",
       "sentry.logs.enabled=true",
       "sentry.reactive.thread-local-accessor-enabled=true",
       "sentry.profile-session-sample-rate=1.0",
@@ -36,7 +35,13 @@ import org.springframework.test.context.junit4.SpringRunner
     ],
 )
 abstract class WebfluxIntegrationTest {
-  @Autowired lateinit var restTemplate: TestRestTemplate
+  @LocalServerPort private var port = 0
+
+  // The context's TestRestTemplate comes from the RestTemplateBuilder that Sentry customizes, so
+  // it would add trace headers of its own to the requests tests send. Tests use a plain one.
+  val restTemplate: TestRestTemplate by lazy {
+    TestRestTemplate(RestTemplateBuilder().rootUri("http://localhost:$port"))
+  }
 
   @Before
   fun resetServer() {

sentry-spring-boot-4/src/integrationTestWebflux/kotlin/io/sentry/spring/boot4/webfluxintegrationtest/WebfluxIntegrationTestApplication.kt

@@ -3,6 +3,7 @@ package io.sentry.spring.boot4.webfluxintegrationtest
 import io.sentry.Sentry
 import java.time.Duration
 import org.springframework.boot.autoconfigure.SpringBootApplication
+import org.springframework.cache.annotation.EnableCaching
 import org.springframework.context.annotation.Bean
 import org.springframework.graphql.data.method.annotation.Argument
 import org.springframework.graphql.data.method.annotation.QueryMapping
@@ -20,6 +21,7 @@ import reactor.core.publisher.Mono
 import reactor.core.scheduler.Schedulers
 
 @SpringBootApplication
+@EnableCaching
 class WebfluxIntegrationTestApplication {
   // Built from Spring Boot's builder, which Sentry customizes to trace outgoing requests.
   @Bean fun webClient(builder: WebClient.Builder): WebClient = builder.build()