修正协议处理并解耦可选遥测

internal/telemetry/http.go

@@ -0,0 +1,23 @@
+package telemetry
+
+import (
+	"net/http"
+
+	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+	"go.opentelemetry.io/otel/propagation"
+)
+
+func WrapHTTP(handler http.Handler, providers *Providers, propagators propagation.TextMapPropagator) http.Handler {
+	if providers == nil {
+		return handler
+	}
+
+	options := []otelhttp.Option{
+		otelhttp.WithTracerProvider(providers.Tracer),
+		otelhttp.WithMeterProvider(providers.Meter),
+	}
+	if propagators != nil {
+		options = append(options, otelhttp.WithPropagators(propagators))
+	}
+	return otelhttp.NewHandler(handler, "workload-sts.http", options...)
+}

internal/telemetry/http_test.go

@@ -0,0 +1,45 @@
+package telemetry
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	metricnoop "go.opentelemetry.io/otel/metric/noop"
+	sdktrace "go.opentelemetry.io/otel/sdk/trace"
+	"go.opentelemetry.io/otel/sdk/trace/tracetest"
+)
+
+func TestWrapHTTPWithoutProvidersReturnsOriginalHandler(t *testing.T) {
+	handler := http.HandlerFunc(func(http.ResponseWriter, *http.Request) {})
+	if got := WrapHTTP(handler, nil, nil); got == nil {
+		t.Fatal("WrapHTTP() returned nil")
+	}
+}
+
+func TestWrapHTTPDoesNotCaptureCredentialValues(t *testing.T) {
+	const canary = "canary-secret-token"
+	recorder := tracetest.NewSpanRecorder()
+	tracerProvider := sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(recorder))
+	t.Cleanup(func() { _ = tracerProvider.Shutdown(t.Context()) })
+
+	handler := WrapHTTP(http.HandlerFunc(func(response http.ResponseWriter, _ *http.Request) {
+		response.WriteHeader(http.StatusNoContent)
+	}), &Providers{Tracer: tracerProvider, Meter: metricnoop.NewMeterProvider()}, nil)
+
+	request := httptest.NewRequest(http.MethodGet, "/oauth2/jwks?subject_token="+canary, nil)
+	request.Header.Set("Authorization", "Bearer "+canary)
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, request)
+
+	spans := recorder.Ended()
+	if len(spans) != 1 {
+		t.Fatalf("ended spans = %d, want 1", len(spans))
+	}
+	for _, attribute := range spans[0].Attributes() {
+		if strings.Contains(attribute.Value.Emit(), canary) {
+			t.Fatalf("span attribute %q captured credential canary", attribute.Key)
+		}
+	}
+}