fix(openfeature): honor HTTPS proxies for direct exposures

Author: leoromanovsky

LICENSE-3rdparty.csv

@@ -44,18 +44,21 @@
 "@oxc-project/types","https://github.com/oxc-project/oxc","['MIT']","['Boshen and oxc contributors']"
 "@tybys/wasm-util","https://github.com/toyobayashi/wasm-util","['MIT']","['toyobayashi']"
 "@types/estree","https://github.com/DefinitelyTyped/DefinitelyTyped","['MIT']","['DefinitelyTyped']"
+"agent-base","https://github.com/TooTallNate/proxy-agents","['MIT']","['Nathan Rajlich']"
 "argparse","https://github.com/nodeca/argparse","['Python-2.0']","['nodeca']"
 "astring","https://github.com/davidbonnet/astring","['MIT']","['David Bonnet']"
 "cjs-module-lexer","https://github.com/nodejs/cjs-module-lexer","['MIT']","['Guy Bedford']"
 "crypto-randomuuid","npm:crypto-randomuuid","['MIT']","['Stephen Belanger']"
 "dc-polyfill","https://github.com/DataDog/dc-polyfill","['MIT']","['Thomas Hunter II']"
 "dd-trace","https://github.com/DataDog/dd-trace-js","['(Apache-2.0 OR BSD-3-Clause)']","['Datadog Inc. <info@datadoghq.com>']"
+"debug","https://github.com/debug-js/debug","['MIT']","['TJ Holowaychuk', 'Josh Junon']"
 "detect-newline","https://github.com/sindresorhus/detect-newline","['MIT']","['Sindre Sorhus']"
 "es-module-lexer","https://github.com/guybedford/es-module-lexer","['MIT']","['Guy Bedford']"
 "escape-string-regexp","https://github.com/sindresorhus/escape-string-regexp","['MIT']","['Sindre Sorhus']"
 "esquery","https://github.com/estools/esquery","['BSD-3-Clause']","['Joel Feenstra']"
 "estraverse","https://github.com/estools/estraverse","['BSD-2-Clause']","['estools']"
 "fast-fifo","https://github.com/mafintosh/fast-fifo","['MIT']","['Mathias Buus']"
+"https-proxy-agent","https://github.com/TooTallNate/proxy-agents","['MIT']","['Nathan Rajlich']"
 "import-in-the-middle","https://github.com/nodejs/import-in-the-middle","['Apache-2.0']","['Bryan English']"
 "istanbul-lib-coverage","https://github.com/istanbuljs/istanbuljs","['BSD-3-Clause']","['Krishnan Anantheswaran']"
 "jest-docblock","https://github.com/jestjs/jest","['MIT']","['jestjs']"
@@ -68,13 +71,15 @@
 "lru-cache","https://github.com/isaacs/node-lru-cache","['ISC']","['Isaac Z. Schlueter']"
 "meriyah","https://github.com/meriyah/meriyah","['ISC']","['Kenny F.']"
 "module-details-from-path","https://github.com/watson/module-details-from-path","['MIT']","['Thomas Watson']"
+"ms","https://github.com/vercel/ms","['MIT']","['Vercel, Inc.']"
 "mutexify","https://github.com/mafintosh/mutexify","['MIT']","['Mathias Buus']"
 "node-addon-api","https://github.com/nodejs/node-addon-api","['MIT']","['nodejs']"
 "node-gyp-build","https://github.com/prebuild/node-gyp-build","['MIT']","['Mathias Buus']"
 "opentracing","https://github.com/opentracing/opentracing-javascript","['Apache-2.0']","['opentracing']"
 "oxc-parser","https://github.com/oxc-project/oxc","['MIT']","['Boshen and oxc contributors']"
 "pprof-format","https://github.com/DataDog/pprof-format","['MIT']","['Datadog Inc.']"
 "protobufjs","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
+"proxy-from-env","https://github.com/Rob--W/proxy-from-env","['MIT']","['Rob Wu']"
 "queue-tick","https://github.com/mafintosh/queue-tick","['MIT']","['Mathias Buus']"
 "retry","https://github.com/tim-kos/node-retry","['MIT']","['Tim Koschützki']"
 "rfdc","https://github.com/davidmarkclements/rfdc","['MIT']","['David Mark Clements']"

package.json

@@ -176,8 +176,10 @@
   ],
   "dependencies": {
     "dc-polyfill": "^0.1.11",
+    "https-proxy-agent": "^7.0.6",
     "import-in-the-middle": "^3.3.2",
-    "opentracing": ">=0.14.7"
+    "opentracing": ">=0.14.7",
+    "proxy-from-env": "^2.1.0"
   },
   "optionalDependencies": {
     "@datadog/libdatadog": "0.9.4",

packages/dd-trace/src/evp_proxy/discovery.js

@@ -2,6 +2,9 @@
 
 const { format } = require('node:url')
 
+const { HttpsProxyAgent } = require('https-proxy-agent')
+const { getProxyForUrl } = require('proxy-from-env')
+
 const { fetchAgentInfo } = require('../agent/info')
 const { EVP_SUBDOMAIN_HEADER_NAME } = require('./constants')
 
@@ -15,6 +18,7 @@ const discoveries = new WeakMap()
  * @property {URL} url - Route base URL
  * @property {string} basePath - EVP proxy base path
  * @property {object} headers - Route-specific headers
+ * @property {import('node:https').Agent} [agent] - Optional HTTPS proxy agent
  * @property {EVPRoute} [fallback] - Direct fallback route
  */
 
@@ -84,16 +88,21 @@ function createDirectEVPRoute (config, intake) {
   if (!apiKey || !config.site) return
 
   try {
+    const url = new URL(format({
+      protocol: 'https:',
+      hostname: `${intake}.${config.site}`,
+    }))
+    const proxyUrl = getProxyForUrl(url.href)
+
+    const agent = proxyUrl ? new HttpsProxyAgent(proxyUrl) : undefined
     return {
       mode: 'direct',
-      url: new URL(format({
-        protocol: 'https:',
-        hostname: `${intake}.${config.site}`,
-      })),
+      url,
       basePath: '',
       headers: {
         'DD-API-KEY': apiKey,
       },
+      ...(agent && { agent }),
     }
   } catch {}
 }

packages/dd-trace/src/exporters/common/request.js

@@ -93,7 +93,7 @@ function request (data, options, callback) {
 
   docker.inject(options.headers)
 
-  options.agent = isSecure ? httpsAgent : httpAgent
+  options.agent ??= isSecure ? httpsAgent : httpAgent
 
   /**
    * @param {import('node:http').IncomingMessage} res

packages/dd-trace/src/openfeature/writers/base.js

@@ -22,6 +22,7 @@ const log = require('../../log')
  * @property {URL} url - Route base URL
  * @property {string} endpoint - Route endpoint
  * @property {object} headers - Route-specific headers
+ * @property {import('node:https').Agent} [agent] - Optional HTTPS proxy agent
  */
 
 /**
@@ -269,6 +270,7 @@ class BaseFFEWriter {
       url: route.url,
       endpoint: route.endpoint,
       requestOptions: {
+        ...(route.agent && { agent: route.agent }),
         headers: {
           ...route.headers,
           'Content-Type': 'application/json',

packages/dd-trace/src/openfeature/writers/exposures.js

@@ -94,7 +94,8 @@ class ExposuresWriter extends BaseFFEWriter {
    *   url: URL,
    *   basePath: string,
    *   headers: object,
-   *   fallback?: {url: URL, basePath: string, headers: object}
+   *   agent?: import('node:https').Agent,
+   *   fallback?: {url: URL, basePath: string, headers: object, agent?: import('node:https').Agent}
    * }} [route] - Selected EVP route
    * @returns {void}
    */
@@ -107,11 +108,13 @@ class ExposuresWriter extends BaseFFEWriter {
         url: route.fallback.url,
         endpoint: joinEVPProxyPath(route.fallback.basePath, EXPOSURES_ENDPOINT),
         headers: route.fallback.headers,
+        agent: route.fallback.agent,
       }
       this._setRoutes({
         url: route.url,
         endpoint: joinEVPProxyPath(route.basePath, EXPOSURES_ENDPOINT),
         headers: route.headers,
+        agent: route.agent,
       }, fallbackRoute)
     }
 

packages/dd-trace/test/exporters/common/request.spec.js

@@ -111,6 +111,28 @@ describe('request', function () {
       })
   })
 
+  it('preserves a caller-supplied connection agent', (done) => {
+    const customAgent = new http.Agent()
+    const sandbox = sinon.createSandbox()
+    sandbox.spy(http, 'request')
+    nock('http://test:123').get('/path').reply(200, 'OK')
+
+    request(Buffer.from(''), {
+      agent: customAgent,
+      protocol: 'http:',
+      hostname: 'test',
+      port: 123,
+      path: '/path',
+      method: 'GET',
+    }, (error) => {
+      const callOptions = http.request.getCall(0).args[0]
+      sandbox.restore()
+      customAgent.destroy()
+      assert.strictEqual(callOptions.agent, customAgent)
+      done(error)
+    })
+  })
+
   it('does not retry when retries are disabled', (done) => {
     maxAttempts = 5
     const error = Object.assign(new Error('ECONNRESET'), { code: 'ECONNRESET' })

packages/dd-trace/test/openfeature/evp_proxy-discovery.spec.js

@@ -11,18 +11,24 @@ require('../setup/core')
 describe('OpenFeature local EVP proxy discovery', () => {
   let fetchAgentInfo
   let getLocalEVPProxyDiscovery
+  let getProxyForUrl
+  let HttpsProxyAgent
   let joinEVPProxyPath
   let resolveEVPRoute
 
   beforeEach(() => {
     fetchAgentInfo = sinon.stub()
+    getProxyForUrl = sinon.stub().returns('')
+    HttpsProxyAgent = sinon.stub().callsFake(proxyUrl => ({ proxyUrl }))
 
     ;({
       getLocalEVPProxyDiscovery,
       joinEVPProxyPath,
       resolveEVPRoute,
     } = proxyquire('../../src/evp_proxy/discovery', {
       '../agent/info': { fetchAgentInfo },
+      'https-proxy-agent': { HttpsProxyAgent },
+      'proxy-from-env': { getProxyForUrl },
     }))
   })
 
@@ -255,6 +261,34 @@ describe('OpenFeature local EVP proxy discovery', () => {
     })
   }
 
+  it('uses the standard HTTPS proxy for direct intake', (done) => {
+    const config = {
+      DD_API_KEY: 'test-api-key',
+      site: 'datadoghq.com',
+      url: new URL('http://serverless-init:8126'),
+    }
+    const proxyUrl = 'http://proxy:8202'
+    getProxyForUrl.returns(proxyUrl)
+    fetchAgentInfo.yields(null, { endpoints: [] })
+    getLocalEVPProxyDiscovery(config).start()
+
+    resolveEVPRoute(
+      config,
+      ['/evp_proxy/v4', '/evp_proxy/v2'],
+      'event-platform-intake',
+      (error, route) => {
+        assert.strictEqual(error, null)
+        assert.deepStrictEqual(route.agent, { proxyUrl })
+        sinon.assert.calledOnceWithExactly(
+          getProxyForUrl,
+          'https://event-platform-intake.datadoghq.com/'
+        )
+        sinon.assert.calledOnceWithExactly(HttpsProxyAgent, proxyUrl)
+        done()
+      }
+    )
+  })
+
   it('does not create a direct route without an API key', (done) => {
     const config = {
       site: 'datadoghq.com',

packages/dd-trace/test/openfeature/writers/exposures.spec.js

@@ -429,10 +429,12 @@ describe('OpenFeature Exposures Writer', () => {
 
     it('should flush events directly to HTTPS intake without the local EVP prefix', () => {
       const url = new URL('https://event-platform-intake.datadoghq.com')
+      const agent = {}
       writer.setEnabled(true, {
         mode: 'direct',
         url,
         basePath: '',
+        agent,
         headers: {
           'DD-API-KEY': 'test-api-key',
         },
@@ -444,6 +446,7 @@ describe('OpenFeature Exposures Writer', () => {
       const [, options] = request.getCall(0).args
       assert.strictEqual(options.url, url)
       assert.strictEqual(options.path, '/api/v2/exposures')
+      assert.strictEqual(options.agent, agent)
       assert.strictEqual(options.headers['DD-API-KEY'], 'test-api-key')
       assert.strictEqual(options.headers['X-Datadog-EVP-Subdomain'], undefined)
     })
@@ -457,6 +460,7 @@ describe('OpenFeature Exposures Writer', () => {
       it(`should switch to direct intake after definitive local ${name}`, async () => {
         const localUrl = new URL('http://serverless-init:8126')
         const directUrl = new URL('https://event-platform-intake.datadoghq.com')
+        const directAgent = {}
         request.onFirstCall().yieldsAsync(error, null, statusCode)
         writer.setEnabled(true, {
           mode: 'local',
@@ -469,6 +473,7 @@ describe('OpenFeature Exposures Writer', () => {
             mode: 'direct',
             url: directUrl,
             basePath: '',
+            agent: directAgent,
             headers: {
               'DD-API-KEY': 'test-api-key',
             },
@@ -484,6 +489,7 @@ describe('OpenFeature Exposures Writer', () => {
         assert.strictEqual(request.firstCall.args[1].path, '/evp_proxy/v4/api/v2/exposures')
         assert.strictEqual(request.secondCall.args[1].url, directUrl)
         assert.strictEqual(request.secondCall.args[1].path, '/api/v2/exposures')
+        assert.strictEqual(request.secondCall.args[1].agent, directAgent)
         assert.strictEqual(request.secondCall.args[1].headers['DD-API-KEY'], 'test-api-key')
 
         writer.append(exposureEvent)

yarn.lock

@@ -2588,7 +2588,7 @@ https-proxy-agent@^5.0.1:
     agent-base "6"
     debug "4"
 
-https-proxy-agent@^7.0.5:
+https-proxy-agent@^7.0.5, https-proxy-agent@^7.0.6:
   version "7.0.6"
   resolved "https://registry.yarnpkg.com/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz#da8dfeac7da130b05c2ba4b59c9b6cd66611a6b9"
   integrity sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==