feat(core): Migrate request data to dataCollection (#21071)

- `httpHeadersToSpanAttributes()` now accepts `ResolvedDataCollection`
and delegates filtering
to `filterKeyValueData()` from the data-collection utils instead of
reimplementing deny/allow logic.
Boolean (`sendDefaultPii`) is still accepted for backward compat with
external callers (TODO for v11 removal).

- `requestDataIntegration` reads `client.getDataCollectionOptions()`
instead of `client.getOptions().sendDefaultPii`.
`DEFAULT_INCLUDE` is now derived from `dataCollection` at call time,
with integration-level `include` options
    overriding per spec.

- `server-subscription.ts` passes `client.getDataCollectionOptions()` to
header attribute creation
  
  closes #21048

Author: chargome

dev-packages/node-integration-tests/suites/tracing/requestData-streamed/instrument-with-datacollection-no-userinfo.mjs

@@ -0,0 +1,13 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+  dsn: 'https://public@dsn.ingest.sentry.io/1337',
+  release: '1.0',
+  tracesSampleRate: 1.0,
+  transport: loggingTransport,
+  traceLifecycle: 'stream',
+  dataCollection: {
+    userInfo: false,
+  },
+});

dev-packages/node-integration-tests/suites/tracing/requestData-streamed/instrument-with-datacollection.mjs

@@ -0,0 +1,13 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+  dsn: 'https://public@dsn.ingest.sentry.io/1337',
+  release: '1.0',
+  tracesSampleRate: 1.0,
+  transport: loggingTransport,
+  traceLifecycle: 'stream',
+  dataCollection: {
+    userInfo: true,
+  },
+});

dev-packages/node-integration-tests/suites/tracing/requestData-streamed/test.ts

@@ -49,6 +49,79 @@ describe('requestData-streamed', () => {
     });
   });
 
+  createEsmAndCjsTests(__dirname, 'server.mjs', 'instrument-with-datacollection.mjs', (createRunner, test) => {
+    test('applies request data attributes when using dataCollection config', async () => {
+      const runner = createRunner()
+        .expect({
+          span: container => {
+            const serverSpan = container.items.find(item => item.is_segment);
+
+            expect(serverSpan).toBeDefined();
+
+            expect(serverSpan?.attributes?.['url.full']).toEqual({
+              type: 'string',
+              value: expect.stringContaining('/test?foo=bar'),
+            });
+
+            expect(serverSpan?.attributes?.['http.request.method']).toEqual({
+              type: 'string',
+              value: 'GET',
+            });
+
+            expect(serverSpan?.attributes?.['url.query']).toEqual({
+              type: 'string',
+              value: 'foo=bar',
+            });
+
+            expect(serverSpan?.attributes?.['http.request.header.host']).toEqual({
+              type: 'string',
+              value: expect.any(String),
+            });
+
+            expect(serverSpan?.attributes?.['user.ip_address']).toEqual({
+              type: 'string',
+              value: expect.any(String),
+            });
+          },
+        })
+        .start();
+
+      await runner.makeRequest('get', '/test?foo=bar');
+
+      await runner.completed();
+    });
+  });
+
+  createEsmAndCjsTests(
+    __dirname,
+    'server.mjs',
+    'instrument-with-datacollection-no-userinfo.mjs',
+    (createRunner, test) => {
+      test('does not include user.ip_address when dataCollection.userInfo is false', async () => {
+        const runner = createRunner()
+          .expect({
+            span: container => {
+              const serverSpan = container.items.find(item => item.is_segment);
+
+              expect(serverSpan).toBeDefined();
+
+              expect(serverSpan?.attributes?.['http.request.header.host']).toEqual({
+                type: 'string',
+                value: expect.any(String),
+              });
+
+              expect(serverSpan?.attributes?.['user.ip_address']).toBeUndefined();
+            },
+          })
+          .start();
+
+        await runner.makeRequest('get', '/test?foo=bar');
+
+        await runner.completed();
+      });
+    },
+  );
+
   createEsmAndCjsTests(__dirname, 'server.mjs', 'instrument-without-request-data.mjs', (createRunner, test) => {
     test('does not apply request data attributes when requestDataIntegration is removed', async () => {
       const runner = createRunner()

packages/core/src/integrations/http/server-subscription.ts

@@ -309,10 +309,7 @@ function buildServerSpanWrap(
             'http.flavor': httpVersion,
             'net.transport': httpVersion?.toUpperCase() === 'QUIC' ? 'ip_udp' : 'ip_tcp',
             ...getRequestContentLengthAttribute(request),
-            ...httpHeadersToSpanAttributes(
-              normalizedRequest.headers || {},
-              client.getOptions().sendDefaultPii ?? false,
-            ),
+            ...httpHeadersToSpanAttributes(normalizedRequest.headers || {}, client.getDataCollectionOptions()),
           },
         },
         span => {
@@ -334,7 +331,7 @@ function buildServerSpanWrap(
               'http.status_code': response.statusCode,
               ...httpHeadersToSpanAttributes(
                 headersToDict(response.headers),
-                client?.getOptions().sendDefaultPii ?? false,
+                client?.getDataCollectionOptions() ?? false,
                 'response',
               ),
             });

packages/core/src/integrations/requestdata.ts

@@ -1,6 +1,8 @@
+import type { Client } from '../client';
 import { getIsolationScope } from '../currentScopes';
 import { defineIntegration } from '../integration';
 import { SEMANTIC_ATTRIBUTE_USER_IP_ADDRESS } from '../semanticAttributes';
+import type { ResolvedDataCollection } from '../types/datacollection';
 import type { Event } from '../types/event';
 import type { IntegrationFn } from '../types/integration';
 import type { QueryParams, RequestEventData } from '../types/request';
@@ -26,36 +28,52 @@ type RequestDataIntegrationOptions = {
   include?: RequestDataIncludeOptions;
 };
 
-// TODO(v11): Change defaults based on `sendDefaultPii`
-const DEFAULT_INCLUDE: RequestDataIncludeOptions = {
-  cookies: true,
-  data: true,
-  headers: true,
-  query_string: true,
-  url: true,
-};
-
 const INTEGRATION_NAME = 'RequestData';
 
 const _requestDataIntegration = ((options: RequestDataIntegrationOptions = {}) => {
-  const include = {
-    ...DEFAULT_INCLUDE,
-    ...options.include,
-  };
+  // Per spec, integration-level options override global dataCollection.
+  // When include overrides a category back on that dataCollection turned off,
+  // we flip the dataCollection behavior to true (default denylist filtering).
+  function resolveIncludeAndDataCollection(client: Client): {
+    include: RequestDataIncludeOptions;
+    dataCollection: ResolvedDataCollection;
+  } {
+    const dc = client.getDataCollectionOptions();
+    const dataCollection: ResolvedDataCollection = {
+      ...dc,
+      ...(options.include?.cookies === true && dc.cookies === false && { cookies: true as const }),
+      ...(options.include?.headers === true &&
+        dc.httpHeaders.request === false && {
+          httpHeaders: { ...dc.httpHeaders, request: true as const },
+        }),
+    };
+
+    return {
+      dataCollection,
+      include: {
+        cookies: dataCollection.cookies !== false,
+        // Always attach body data that's already on the scope — dataCollection.httpBodies gates write-time, not read-time
+        data: true,
+        headers: dataCollection.httpHeaders.request !== false,
+        ip: dataCollection.userInfo,
+        query_string: dataCollection.queryParams !== false,
+        // No dataCollection equivalent — URL is always included
+        url: true,
+        ...options.include,
+      },
+    };
+  }
 
   return {
     name: INTEGRATION_NAME,
     processEvent(event, _hint, client) {
       const { sdkProcessingMetadata = {} } = event;
       const { normalizedRequest, ipAddress } = sdkProcessingMetadata;
 
-      const includeWithDefaultPiiApplied: RequestDataIncludeOptions = {
-        ...include,
-        ip: include.ip ?? client.getOptions().sendDefaultPii,
-      };
+      const { include } = resolveIncludeAndDataCollection(client);
 
       if (normalizedRequest) {
-        addNormalizedRequestDataToEvent(event, normalizedRequest, { ipAddress }, includeWithDefaultPiiApplied);
+        addNormalizedRequestDataToEvent(event, normalizedRequest, { ipAddress }, include);
       }
 
       return event;
@@ -68,13 +86,9 @@ const _requestDataIntegration = ((options: RequestDataIntegrationOptions = {}) =
         return;
       }
 
-      const { sendDefaultPii } = client.getOptions();
-      const includeWithDefaultPiiApplied: RequestDataIncludeOptions = {
-        ...include,
-        ip: include.ip ?? sendDefaultPii,
-      };
+      const { include, dataCollection } = resolveIncludeAndDataCollection(client);
 
-      addNormalizedRequestDataToSpan(span, normalizedRequest, ipAddress, includeWithDefaultPiiApplied, sendDefaultPii);
+      addNormalizedRequestDataToSpan(span, normalizedRequest, ipAddress, include, dataCollection);
     },
   };
 }) satisfies IntegrationFn;
@@ -117,7 +131,7 @@ function addNormalizedRequestDataToSpan(
   normalizedRequest: RequestEventData,
   ipAddress: string | undefined,
   include: RequestDataIncludeOptions,
-  sendDefaultPii: boolean | undefined,
+  dataCollection: ResolvedDataCollection,
 ): void {
   const requestData = extractNormalizedRequestData(normalizedRequest, include);
   const attributes: Record<string, unknown> = {};
@@ -142,12 +156,12 @@ function addNormalizedRequestDataToSpan(
     const cookieString = Object.entries(requestData.cookies)
       .map(([name, value]) => `${name}=${value}`)
       .join('; ');
-    const cookieAttributes = httpHeadersToSpanAttributes({ cookie: cookieString }, sendDefaultPii ?? false, 'request');
+    const cookieAttributes = httpHeadersToSpanAttributes({ cookie: cookieString }, dataCollection, 'request');
     safeSetSpanJSONAttributes(span, cookieAttributes);
   }
 
   if (requestData.headers) {
-    const headerAttributes = httpHeadersToSpanAttributes(requestData.headers, sendDefaultPii ?? false, 'request');
+    const headerAttributes = httpHeadersToSpanAttributes(requestData.headers, dataCollection, 'request');
     safeSetSpanJSONAttributes(span, headerAttributes);
   }