修正协议处理并解耦可选遥测

internal/httpapi/router.go

@@ -5,10 +5,6 @@ import (
 	"net/http"
 
 	"github.com/go-chi/chi/v5"
-	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
-	"go.opentelemetry.io/otel/metric"
-	"go.opentelemetry.io/otel/propagation"
-	"go.opentelemetry.io/otel/trace"
 )
 
 type Endpoints struct {
@@ -19,13 +15,7 @@ type Endpoints struct {
 	Ready    http.Handler
 }
 
-type Telemetry struct {
-	TracerProvider trace.TracerProvider
-	MeterProvider  metric.MeterProvider
-	Propagators    propagation.TextMapPropagator
-}
-
-func NewRouter(endpoints Endpoints, telemetry Telemetry) (http.Handler, error) {
+func NewRouter(endpoints Endpoints) (http.Handler, error) {
 	if endpoints.Metadata == nil || endpoints.Token == nil || endpoints.JWKS == nil || endpoints.Health == nil || endpoints.Ready == nil {
 		return nil, errors.New("all HTTP endpoints are required")
 	}
@@ -37,15 +27,5 @@ func NewRouter(endpoints Endpoints, telemetry Telemetry) (http.Handler, error) {
 	router.Get("/healthz", endpoints.Health.ServeHTTP)
 	router.Get("/readyz", endpoints.Ready.ServeHTTP)
 
-	options := make([]otelhttp.Option, 0, 3)
-	if telemetry.TracerProvider != nil {
-		options = append(options, otelhttp.WithTracerProvider(telemetry.TracerProvider))
-	}
-	if telemetry.MeterProvider != nil {
-		options = append(options, otelhttp.WithMeterProvider(telemetry.MeterProvider))
-	}
-	if telemetry.Propagators != nil {
-		options = append(options, otelhttp.WithPropagators(telemetry.Propagators))
-	}
-	return otelhttp.NewHandler(router, "workload-sts.http", options...), nil
+	return router, nil
 }

internal/httpapi/router_test.go

@@ -3,11 +3,7 @@ package httpapi
 import (
 	"net/http"
 	"net/http/httptest"
-	"strings"
 	"testing"
-
-	sdktrace "go.opentelemetry.io/otel/sdk/trace"
-	"go.opentelemetry.io/otel/sdk/trace/tracetest"
 )
 
 func TestRouterExposesOnlySpecifiedMethods(t *testing.T) {
@@ -20,7 +16,7 @@ func TestRouterExposesOnlySpecifiedMethods(t *testing.T) {
 		JWKS:     endpoint,
 		Health:   endpoint,
 		Ready:    endpoint,
-	}, Telemetry{})
+	})
 	if err != nil {
 		t.Fatalf("NewRouter() error = %v", err)
 	}
@@ -53,43 +49,7 @@ func TestRouterExposesOnlySpecifiedMethods(t *testing.T) {
 }
 
 func TestRouterRequiresEveryEndpoint(t *testing.T) {
-	if _, err := NewRouter(Endpoints{}, Telemetry{}); err == nil {
+	if _, err := NewRouter(Endpoints{}); err == nil {
 		t.Fatal("NewRouter() error = nil, want missing endpoint error")
 	}
 }
-
-func TestRouterTelemetryDoesNotCaptureCredentialValues(t *testing.T) {
-	const canary = "canary-secret-token"
-	recorder := tracetest.NewSpanRecorder()
-	tracerProvider := sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(recorder))
-	t.Cleanup(func() { _ = tracerProvider.Shutdown(t.Context()) })
-
-	endpoint := http.HandlerFunc(func(response http.ResponseWriter, _ *http.Request) {
-		response.WriteHeader(http.StatusNoContent)
-	})
-	router, err := NewRouter(Endpoints{
-		Metadata: endpoint,
-		Token:    endpoint,
-		JWKS:     endpoint,
-		Health:   endpoint,
-		Ready:    endpoint,
-	}, Telemetry{TracerProvider: tracerProvider})
-	if err != nil {
-		t.Fatalf("NewRouter() error = %v", err)
-	}
-
-	request := httptest.NewRequest(http.MethodGet, "/oauth2/jwks?subject_token="+canary, nil)
-	request.Header.Set("Authorization", "Bearer "+canary)
-	response := httptest.NewRecorder()
-	router.ServeHTTP(response, request)
-
-	spans := recorder.Ended()
-	if len(spans) != 1 {
-		t.Fatalf("ended spans = %d, want 1", len(spans))
-	}
-	for _, attribute := range spans[0].Attributes() {
-		if strings.Contains(attribute.Value.Emit(), canary) {
-			t.Fatalf("span attribute %q captured credential canary", attribute.Key)
-		}
-	}
-}