diff --git a/dev-packages/cloudflare-integration-tests/runner.ts b/dev-packages/cloudflare-integration-tests/runner.ts index 984c79480d68..aa2c0ee73dae 100644 --- a/dev-packages/cloudflare-integration-tests/runner.ts +++ b/dev-packages/cloudflare-integration-tests/runner.ts @@ -149,6 +149,8 @@ type StartResult = { completed(): Promise; /** Every non-ignored envelope received so far, matched or not, for count assertions. */ getReceivedEnvelopes(): Envelope[]; + /** The port wrangler serves the worker on, once it is ready. */ + getPort(): Promise; makeRequest( method: 'get' | 'post', path: string, @@ -558,6 +560,9 @@ export function createRunner(...paths: string[]) { getReceivedEnvelopes: function (): Envelope[] { return receivedEnvelopes; }, + getPort: function (): Promise { + return workerPortPromise; + }, makeRequest: async function ( method: 'get' | 'post', path: string, diff --git a/dev-packages/cloudflare-integration-tests/suites/tracing/managed-tunnel/instrument.server.ts b/dev-packages/cloudflare-integration-tests/suites/tracing/managed-tunnel/instrument.server.ts index fce513e4d092..9c7d270a4801 100644 --- a/dev-packages/cloudflare-integration-tests/suites/tracing/managed-tunnel/instrument.server.ts +++ b/dev-packages/cloudflare-integration-tests/suites/tracing/managed-tunnel/instrument.server.ts @@ -3,6 +3,5 @@ import { defineCloudflareOptions, serveTunnelIntegration } from '@sentry/cloudfl export default defineCloudflareOptions((env: { SENTRY_DSN: string }) => ({ dsn: env.SENTRY_DSN, tracesSampleRate: 1, - // A meta-framework answers the tunnel requests, the Worker only drops their server spans. integrations: [serveTunnelIntegration()], })); diff --git a/dev-packages/cloudflare-integration-tests/suites/tracing/managed-tunnel/test.ts b/dev-packages/cloudflare-integration-tests/suites/tracing/managed-tunnel/test.ts index 98e9570be20a..c104d68a30cd 100644 --- a/dev-packages/cloudflare-integration-tests/suites/tracing/managed-tunnel/test.ts +++ b/dev-packages/cloudflare-integration-tests/suites/tracing/managed-tunnel/test.ts @@ -10,7 +10,7 @@ function expectServerSpanAt(path: string) { }; } -it('drops the server span of managed tunnel requests', async ({ signal }) => { +it('answers managed tunnel requests before the app, without a server span', async ({ signal }) => { // Envelopes are expected in order, so a span of the tunnel request would arrive before the last one. const runner = createRunner(__dirname) .expect(expectServerSpanAt('/tunnel-path')) @@ -18,7 +18,8 @@ it('drops the server span of managed tunnel requests', async ({ signal }) => { .start(signal); const tunnelPath = await runner.makeRequest('get', '/tunnel-path'); - expect(await runner.makeRequest('post', tunnelPath!, { data: 'envelope' })).toBe('app'); + // The tunnel rejects the body as an envelope. The app would have answered with a 200. + await runner.makeRequest('post', tunnelPath!, { data: 'envelope', expectError: true }); await runner.makeRequest('get', '/after-tunnel'); await runner.completed(); diff --git a/dev-packages/cloudflare-integration-tests/suites/tunnel-hardening/index.ts b/dev-packages/cloudflare-integration-tests/suites/tunnel-hardening/index.ts new file mode 100644 index 000000000000..96d9669509e0 --- /dev/null +++ b/dev-packages/cloudflare-integration-tests/suites/tunnel-hardening/index.ts @@ -0,0 +1,32 @@ +import * as Sentry from '@sentry/cloudflare'; + +interface Env { + SENTRY_DSN: string; + ALLOWED_DSNS: string; + TUNNEL_PATH: string; +} + +export default Sentry.withSentry( + (env: Env) => ({ + dsn: env.SENTRY_DSN, + integrations: [Sentry.serveTunnelIntegration({ allowedDsns: env.ALLOWED_DSNS.split(',') })], + }), + { + async fetch(request, env) { + const { pathname } = new URL(request.url); + if (pathname === '/health') { + return new Response('ok'); + } + if (pathname === '/done') { + Sentry.captureMessage('done'); + return new Response('done'); + } + // The app's own handler on the tunnel path, which the runtime answers before it. + if (pathname === env.TUNNEL_PATH) { + return new Response('app tunnel handler', { status: 418 }); + } + + return new Response('not found', { status: 404 }); + }, + } satisfies ExportedHandler, +); diff --git a/dev-packages/cloudflare-integration-tests/suites/tunnel-hardening/test.ts b/dev-packages/cloudflare-integration-tests/suites/tunnel-hardening/test.ts new file mode 100644 index 000000000000..a7a10f44c776 --- /dev/null +++ b/dev-packages/cloudflare-integration-tests/suites/tunnel-hardening/test.ts @@ -0,0 +1,51 @@ +import { getTunnelPath } from '@sentry/core'; +import type { FakeIngests } from '@sentry-internal/test-utils'; +import { EXPECTED_TUNNEL_OUTCOMES, runTunnelHardeningCases, startFakeIngests } from '@sentry-internal/test-utils'; +import { afterAll, beforeAll, expect, it } from 'vitest'; +import { createRunner } from '../../runner'; + +// `wrangler dev` stalls the next request after any worker answers before reading a large body, Sentry or not. +const WRANGLER_DEV_STALLS = ['70KB header line', 'binary garbage', 'rejected tunnel with a big unread body, then app']; + +let ingests: FakeIngests; + +beforeAll(async () => { + ingests = await startFakeIngests(); +}); + +afterAll(async () => { + await ingests.close(); +}); + +it('keeps the worker serving whatever is thrown at the tunnel, and reports nothing of its own', async ({ signal }) => { + const runner = createRunner(__dirname) + .withWranglerArgs( + '--var', + `ALLOWED_DSNS:${ingests.allDsns().join(',')}`, + '--var', + `TUNNEL_PATH:${getTunnelPath(ingests.dsn('ok'))}`, + ) + // The first event is the app's own, so the tunnel captured no error along the way. + .expect(envelope => { + expect(envelope[1][0]?.[1]).toMatchObject({ message: 'done' }); + }) + .start(signal); + await runner.makeRequest('get', '/health'); + + const results = await runTunnelHardeningCases({ + port: await runner.getPort(), + ingests, + getTunnelPath, + skip: WRANGLER_DEV_STALLS, + }); + + expect(results.filter(result => result.health !== '200')).toEqual([]); + expect(Object.fromEntries(results.map(result => [result.name, result.outcome]))).toMatchObject( + Object.fromEntries( + Object.entries(EXPECTED_TUNNEL_OUTCOMES).filter(([name]) => !WRANGLER_DEV_STALLS.includes(name)), + ), + ); + + await runner.makeRequest('get', '/done'); + await runner.completed(); +}, 180_000); diff --git a/dev-packages/cloudflare-integration-tests/suites/tunnel-hardening/wrangler.jsonc b/dev-packages/cloudflare-integration-tests/suites/tunnel-hardening/wrangler.jsonc new file mode 100644 index 000000000000..d6be01281f0c --- /dev/null +++ b/dev-packages/cloudflare-integration-tests/suites/tunnel-hardening/wrangler.jsonc @@ -0,0 +1,6 @@ +{ + "name": "worker-name", + "compatibility_date": "2025-06-17", + "main": "index.ts", + "compatibility_flags": ["nodejs_compat"], +} diff --git a/packages/astro/src/integration/index.ts b/packages/astro/src/integration/index.ts index 66b5de50861b..f56e4fa3bd1b 100644 --- a/packages/astro/src/integration/index.ts +++ b/packages/astro/src/integration/index.ts @@ -228,7 +228,11 @@ export const sentryAstro = (options: SentryOptions = {}): AstroIntegration => { // Ref: https://developers.cloudflare.com/workers/runtime-apis/nodejs/ updateConfig({ vite: { - plugins: [sentryCloudflareNodeWarningPlugin()], + // A Pages build gets the same `withSentry` wrap as Workers, which answers managed tunnel requests. + plugins: + command !== 'dev' + ? [sentryCloudflareNodeWarningPlugin(), sentryCloudflareVitePlugin()] + : [sentryCloudflareNodeWarningPlugin()], ssr: { // @sentry/node is required in case we have 2 different @sentry/node // packages installed in the same project. diff --git a/packages/astro/test/integration/cloudflare.test.ts b/packages/astro/test/integration/cloudflare.test.ts index 95c98f59c3a6..32a5b1ff0793 100644 --- a/packages/astro/test/integration/cloudflare.test.ts +++ b/packages/astro/test/integration/cloudflare.test.ts @@ -176,7 +176,7 @@ describe('Cloudflare Pages vs Workers detection', () => { }); expect(baseConfigHookObject.updateConfig).toHaveBeenCalledWith({ - vite: expect.objectContaining({ plugins: ['sentryCloudflareNodeWarningPlugin'] }), + vite: expect.objectContaining({ plugins: ['sentryCloudflareNodeWarningPlugin', 'sentryCloudflareVitePlugin'] }), }); }); @@ -208,7 +208,7 @@ describe('Cloudflare Pages vs Workers detection', () => { }); expect(baseConfigHookObject.updateConfig).toHaveBeenCalledWith({ - vite: expect.objectContaining({ plugins: ['sentryCloudflareNodeWarningPlugin'] }), + vite: expect.objectContaining({ plugins: ['sentryCloudflareNodeWarningPlugin', 'sentryCloudflareVitePlugin'] }), }); }); @@ -270,7 +270,7 @@ directory = "./dist" }); }); - it('does not add Cloudflare Vite plugins for Pages production build', async () => { + it('wraps the Worker entry with `withSentry` for a Pages production build', async () => { getWranglerConfig.mockReturnValue({ filename: 'wrangler.json', content: JSON.stringify({ @@ -290,9 +290,8 @@ directory = "./dist" command: 'build', }); - // Check that sentryCloudflareVitePlugin is NOT in any of the calls expect(baseConfigHookObject.updateConfig).toHaveBeenCalledWith({ - vite: expect.objectContaining({ plugins: ['sentryCloudflareNodeWarningPlugin'] }), + vite: expect.objectContaining({ plugins: ['sentryCloudflareNodeWarningPlugin', 'sentryCloudflareVitePlugin'] }), }); }); diff --git a/packages/cloudflare/src/wrapRequestHandlerWithInit.ts b/packages/cloudflare/src/wrapRequestHandlerWithInit.ts index 1f3ddde1dd6d..a358404bace2 100644 --- a/packages/cloudflare/src/wrapRequestHandlerWithInit.ts +++ b/packages/cloudflare/src/wrapRequestHandlerWithInit.ts @@ -2,6 +2,7 @@ import type { CfProperties, IncomingRequestCfProperties } from '@cloudflare/work import { NETWORK_PROTOCOL_NAME, NETWORK_PROTOCOL_VERSION } from '@sentry/conventions/attributes'; import type { SpanAttributes } from '@sentry/core'; import { getIsolationScope, safeCallback } from '@sentry/core'; +import { _INTERNAL_handleServedTunnelRequest as handleServedTunnelRequest } from '@sentry/core/server'; import { wrapServerRequestHandler } from '@sentry/server-utils/request-handler'; import { DEBUG_BUILD } from './debug-build'; import { getHttpServerRequestOptions } from './integrations/httpServer'; @@ -13,9 +14,13 @@ import { addCloudResourceContext, addCultureContext } from './scope-utils'; import { getInvocationState, getInvocationWaitUntil } from './utils/invocationContext'; import { withInvocationIsolationScope } from './utils/invocationScope'; -function getRequestErrorMechanismType(context: ExecutionContextCompat | undefined): string { +function isDurableObjectContext(context: ExecutionContextCompat | undefined): boolean { // Durable Object fetch handlers use DO state as context (see instrumentDurableObjectWithSentry) - return context && 'storage' in context ? 'auto.faas.cloudflare.durable_object' : 'auto.http.cloudflare'; + return !!context && 'storage' in context; +} + +function getRequestErrorMechanismType(context: ExecutionContextCompat | undefined): string { + return isDurableObjectContext(context) ? 'auto.faas.cloudflare.durable_object' : 'auto.http.cloudflare'; } export interface RequestHandlerWrapperOptions { @@ -72,6 +77,13 @@ export function wrapRequestHandlerWithInit( // request, where workerd allows publish, and init() above has registered subscribers. flushDeferredChannelEvents(); + // The tunnel answers these before the app, with no span. A Durable Object is only reached through the Worker, + // which answered them already. + const tunnelResponse = !isDurableObjectContext(context) && handleServedTunnelRequest(request); + if (tunnelResponse) { + return tunnelResponse.finally(() => waitUntil?.(flushAndDispose(client))); + } + addCloudResourceContext(isolationScope); const attributes: SpanAttributes = {}; if (request.cf) { diff --git a/packages/nuxt/src/runtime/plugins/sentry-cloudflare.server.ts b/packages/nuxt/src/runtime/plugins/sentry-cloudflare.server.ts index 1893de6a57b1..e206afb555e8 100644 --- a/packages/nuxt/src/runtime/plugins/sentry-cloudflare.server.ts +++ b/packages/nuxt/src/runtime/plugins/sentry-cloudflare.server.ts @@ -1,3 +1,4 @@ +import type { ExecutionContext } from '@cloudflare/workers-types'; import type { CloudflareOptions } from '@sentry/cloudflare'; import { getDefaultIntegrations, setAsyncLocalStorageAsyncContextStrategy } from '@sentry/cloudflare'; import { wrapRequestHandler } from '@sentry/cloudflare/request'; @@ -47,6 +48,34 @@ export const sentryCloudflareNitroPlugin = (nitroApp: NitroApp): void => { const traceDataMap = new WeakMap>(); + // Nitro v3 (Nuxt 5) has no `localFetch`. It hands the Worker's own request to `fetch`, with `ctx` on it. + const nitroV3App = nitroApp as unknown as { localFetch?: unknown; fetch?: (request: Request) => Promise }; + const appFetch = nitroV3App.fetch; + if (typeof nitroV3App.localFetch !== 'function' && typeof appFetch === 'function') { + nitroV3App.fetch = request => { + setAsyncLocalStorageAsyncContextStrategy(); + + const cloudflareOptions = typeof optionsOrFn === 'function' ? optionsOrFn(nitroApp) : optionsOrFn; + const runtime = (request as Request & { runtime?: { cloudflare?: { context?: ExecutionContext } } }).runtime; + + return wrapRequestHandler( + { + options: { + defaultIntegrations: getDefaultIntegrations(cloudflareOptions), + _extendsDefaultIntegrations: cloudflareOptions.defaultIntegrations === undefined, + ...cloudflareOptions, + }, + request, + context: runtime?.cloudflare?.context, + }, + () => appFetch(request), + ); + }; + nitroApp.hooks.hook('error', sentryCaptureErrorHook); + + return; + } + nitroApp.localFetch = new Proxy(nitroApp.localFetch, { async apply(handlerTarget, handlerThisArg, handlerArgs: [string, unknown]) { setAsyncLocalStorageAsyncContextStrategy(); @@ -64,6 +93,9 @@ export const sentryCloudflareNitroPlugin = const request = new Request(url, { method: event.method, headers: event.headers, + // Nitro read the body before calling `localFetch`. The managed tunnel answers from this request, so it + // needs the body; a `GET` or `HEAD` request can't have one. + body: event.method === 'GET' || event.method === 'HEAD' ? undefined : event.body, // @ts-expect-error - 'cf' is a valid property in the RequestInit type for Cloudflare cf: getCfProperties(event), }); diff --git a/packages/nuxt/src/runtime/utils/event-type-check.ts b/packages/nuxt/src/runtime/utils/event-type-check.ts index 1da0d8b2677a..14447c072c64 100644 --- a/packages/nuxt/src/runtime/utils/event-type-check.ts +++ b/packages/nuxt/src/runtime/utils/event-type-check.ts @@ -5,6 +5,8 @@ interface EventBase { host: string; method: string; headers: Record; + /** The request body Nitro already read, e.g. a `Buffer`. */ + body?: BodyInit | null; } interface MinimalCloudflareProps {