feat(server-utils): Instrument graphql v17 via native tracing channels

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/instrument.mjs

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ integrations: [Sentry.graphqlIntegration({ ignoreResolveSpans: false })],
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/scenario.mjs

@@ -0,0 +1,40 @@
+import * as Sentry from '@sentry/node';
+import { graphql, GraphQLInt, GraphQLNonNull, GraphQLObjectType, GraphQLSchema, GraphQLString } from 'graphql';
+
+// Built programmatically (not via `buildSchema(sdl)`) so no `graphql:parse` fires at module load.
+const UserType = new GraphQLObjectType({
+ name: 'User',
+ // `name` has no resolver, so it uses graphql's default property resolver (a "trivial" resolve).
+ fields: { name: { type: GraphQLString } },
+});
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ user: {
+ type: UserType,
+ args: { id: { type: new GraphQLNonNull(GraphQLInt) } },
+ resolve: (_, { id }) => ({ name: `user-${id}` }),
+ },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan(
+ {
+ name: 'Test Transaction',
+ op: 'transaction',
+ },
+ async () => {
+ await graphql({ schema, source: '{ hello }' });
+ await graphql({ schema, source: 'query GetUser { user(id: 1) { name } }' });
+ },
+ );
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/test.ts

@@ -0,0 +1,62 @@
+import { afterAll, expect } from 'vitest';
+import { conditionalTest } from '../../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../../utils/runner';
+
+// With `ignoreResolveSpans: false`, the channel path also subscribes `graphql:resolve` and emits a
+// span per non-trivial field resolver. `ignoreTrivialResolveSpans` defaults to true, so graphql's
+// default property resolver (the `name` field) is skipped. graphql 17 requires Node >= 22.
+conditionalTest({ min: 22 })('GraphQL tracing channel Test > resolve spans', () => {
+ afterAll(() => {
+ cleanupChildProcesses();
+ });
+
+ const expectedResolveSpan = (path: string, fieldName: string, parentName: string) =>
+ expect.objectContaining({
+ description: `graphql.resolve ${path}`,
+ op: 'graphql',
+ origin: 'auto.graphql.diagnostic_channel',
+ data: expect.objectContaining({
+ 'graphql.field.name': fieldName,
+ 'graphql.field.path': path,
+ 'graphql.parent.name': parentName,
+ }),
+ });
+
+ const EXPECTED_TRANSACTION = {
+ // Root span renamed with the (sorted) operation names. useOperationNameForRootSpan defaults to true.
+ transaction: 'Test Transaction (query, query GetUser)',
+ spans: expect.arrayContaining([
+ expect.objectContaining({ description: 'query', op: 'graphql' }),
+ expect.objectContaining({ description: 'query GetUser', op: 'graphql' }),
+ expectedResolveSpan('hello', 'hello', 'Query'),
+ expectedResolveSpan('user', 'user', 'Query'),
+ ]),
+ };
+
+ createEsmAndCjsTests(
+ __dirname,
+ 'scenario.mjs',
+ 'instrument.mjs',
+ (createTestRunner, test) => {
+ test('emits resolver spans when ignoreResolveSpans is false', async () => {
+ await createTestRunner().expect({ transaction: EXPECTED_TRANSACTION }).start().completed();
+ });
+
+ test('skips the default property resolver (trivial resolve) by default', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ // `user.name` uses graphql's default property resolver, so no span is emitted for it.
+ expect(spans.find(span => span.description === 'graphql.resolve user.name')).toBeUndefined();
+ // ...but the user-defined resolvers do produce spans.
+ expect(spans.find(span => span.description === 'graphql.resolve user')).toBeDefined();
+ },
+ })
+ .start()
+ .completed();
+ });
+ },
+ { additionalDependencies: { graphql: '^17' } },
+ );
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/scenario.mjs

@@ -0,0 +1,71 @@
+import * as Sentry from '@sentry/node';
+import {
+ graphql,
+ GraphQLBoolean,
+ GraphQLInt,
+ GraphQLNonNull,
+ GraphQLObjectType,
+ GraphQLSchema,
+ GraphQLString,
+} from 'graphql';
+
+// Build the schema programmatically rather than via `buildSchema(sdl)`: the SDL form parses at module
+// load, which would publish a `graphql:parse` event outside any transaction (an orphan span).
+const UserType = new GraphQLObjectType({
+ name: 'User',
+ fields: { name: { type: GraphQLString } },
+});
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ user: {
+ type: UserType,
+ args: { id: { type: new GraphQLNonNull(GraphQLInt) } },
+ resolve: (_, { id }) => ({ name: `user-${id}` }),
+ },
+ boom: {
+ type: GraphQLString,
+ resolve: () => {
+ throw new Error('resolver failed');
+ },
+ },
+ },
+ }),
+ mutation: new GraphQLObjectType({
+ name: 'Mutation',
+ fields: {
+ login: {
+ type: GraphQLBoolean,
+ args: { email: { type: new GraphQLNonNull(GraphQLString) } },
+ resolve: (_, { email }) => Boolean(email),
+ },
+ },
+ }),
+});
+
+async function run() {
+ // Let the integration's deferred channel subscription and OpenTelemetry's async-context setup
+ // finish before issuing operations. In a real server graphql runs per-request, long after init;
+ // here it would otherwise race init within the same tick.
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan(
+ {
+ name: 'Test Transaction',
+ op: 'transaction',
+ },
+ async () => {
+ await graphql({ schema, source: '{ hello }' });
+ await graphql({ schema, source: 'query GetUser { user(id: 42) { name } }' });
+ // Inline literal carries a value, to assert it is redacted out of `graphql.document`.
+ await graphql({ schema, source: 'mutation Login { login(email: "secret@example.com") }' });
+ // A resolver throw surfaces as `result.errors`, which must flag the execute span as errored.
+ await graphql({ schema, source: 'query Boom { boom }' });
+ },
+ );
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/test.ts

@@ -0,0 +1,116 @@
+import { afterAll, expect } from 'vitest';
+import { conditionalTest } from '../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../utils/runner';
+
+// graphql >= 17 publishes its operations via `node:diagnostics_channel`, so the SDK subscribes to
+// those channels (`subscribeGraphqlDiagnosticChannels`) instead of the vendored OTel patcher. This
+// suite pins `^17` and asserts the diagnostics-channel path: graphql semconv attributes, redacted
+// document text, span relationships, and that the legacy OTel path does NOT also fire (no double
+// instrumentation). graphql 17 requires Node >= 22, so this suite is skipped on older Node.
+conditionalTest({ min: 22 })('GraphQL tracing channel Test', () => {
+ afterAll(() => {
+ cleanupChildProcesses();
+ });
+
+ const expectedExecuteSpan = (description: string, extraData: Record<string, unknown> = {}) =>
+ expect.objectContaining({
+ description,
+ op: 'graphql',
+ origin: 'auto.graphql.diagnostic_channel',
+ data: expect.objectContaining(extraData),
+ });
+
+ const EXPECTED_TRANSACTION = {
+ // Root span renamed with the (sorted) operation names. useOperationNameForRootSpan defaults to true.
+ transaction: 'Test Transaction (mutation Login, query, query Boom, query GetUser)',
+ spans: expect.arrayContaining([
+ expect.objectContaining({ description: 'graphql.parse', op: 'graphql' }),
+ expect.objectContaining({ description: 'graphql.validate', op: 'graphql' }),
+ // anonymous query -> span named after the operation type only
+ expectedExecuteSpan('query', { 'graphql.operation.type': 'query' }),
+ expectedExecuteSpan('query GetUser', {
+ 'graphql.operation.type': 'query',
+ 'graphql.operation.name': 'GetUser',
+ // the inline `42` literal is redacted out of the document
+ 'graphql.document': 'query GetUser { user(id: *) { name } }',
+ }),
+ expectedExecuteSpan('mutation Login', {
+ 'graphql.operation.type': 'mutation',
+ // the inline email literal must be redacted to `"*"`, so the raw value can never leak
+ 'graphql.document': 'mutation Login { login(email: "*") }',
+ }),
+ ]),
+ };
+
+ createEsmAndCjsTests(
+ __dirname,
+ 'scenario.mjs',
+ 'instrument.mjs',
+ (createTestRunner, test) => {
+ test('subscribes to graphql >= 17 diagnostics channels with graphql semconv attributes', async () => {
+ await createTestRunner().expect({ transaction: EXPECTED_TRANSACTION }).start().completed();
+ });
+
+ test('does not double-instrument: the vendored OTel graphql patcher does not fire on 17', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ // The vendored OTel path (origin `auto.graphql.otel.graphql`) must be inactive on 17+.
+ expect(spans.find(span => span.origin === 'auto.graphql.otel.graphql')).toBeUndefined();
+ // ...while the diagnostics-channel path is active.
+ expect(spans.find(span => span.origin === 'auto.graphql.diagnostic_channel')).toBeDefined();
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('never leaks raw inline literal values into graphql.document', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ for (const span of spans) {
+ const document = span.data?.['graphql.document'];
+ if (typeof document === 'string') {
+ expect(document).not.toContain('secret@example.com');
+ }
+ }
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('flags the execute span as errored when a resolver throws', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ const boomSpan = spans.find(span => span.description === 'query Boom');
+ expect(boomSpan).toBeDefined();
+ expect(boomSpan?.status).toBe('internal_error');
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('parents the execute span to the surrounding transaction', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ const executeSpan = spans.find(span => span.description === 'query GetUser');
+ expect(executeSpan).toBeDefined();
+ expect(executeSpan?.parent_span_id).toBe(event.contexts?.trace?.span_id);
+ },
+ })
+ .start()
+ .completed();
+ });
+ },
+ { additionalDependencies: { graphql: '^17' } },
+ );
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/instrument-disabled.mjs

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ integrations: [Sentry.graphqlIntegration({ useOperationNameForRootSpan: false })],
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/scenario-disabled.mjs

@@ -0,0 +1,21 @@
+import * as Sentry from '@sentry/node';
+import { GraphQLObjectType, GraphQLSchema, GraphQLString, graphql } from 'graphql';
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan({ name: 'Test Transaction', op: 'transaction' }, async () => {
+ await graphql({ schema, source: 'query GetHello { hello }' });
+ });
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/scenario-multiple.mjs

@@ -0,0 +1,23 @@
+import * as Sentry from '@sentry/node';
+import { GraphQLObjectType, GraphQLSchema, GraphQLString, graphql } from 'graphql';
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ world: { type: GraphQLString, resolve: () => 'hello' },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan({ name: 'Test Transaction', op: 'transaction' }, async () => {
+ await graphql({ schema, source: 'query GetWorld { world }' });
+ await graphql({ schema, source: 'query GetHello { hello }' });
+ });
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/instrument.mjs

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ integrations: [Sentry.graphqlIntegration({ ignoreResolveSpans: false })],
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/scenario.mjs

@@ -0,0 +1,40 @@
+import * as Sentry from '@sentry/node';
+import { graphql, GraphQLInt, GraphQLNonNull, GraphQLObjectType, GraphQLSchema, GraphQLString } from 'graphql';
+
+// Built programmatically (not via `buildSchema(sdl)`) so no `graphql:parse` fires at module load.
+const UserType = new GraphQLObjectType({
+ name: 'User',
+ // `name` has no resolver, so it uses graphql's default property resolver (a "trivial" resolve).
+ fields: { name: { type: GraphQLString } },
+});
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ user: {
+ type: UserType,
+ args: { id: { type: new GraphQLNonNull(GraphQLInt) } },
+ resolve: (_, { id }) => ({ name: `user-${id}` }),
+ },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan(
+ {
+ name: 'Test Transaction',
+ op: 'transaction',
+ },
+ async () => {
+ await graphql({ schema, source: '{ hello }' });
+ await graphql({ schema, source: 'query GetUser { user(id: 1) { name } }' });
+ },
+ );
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/test.ts

@@ -0,0 +1,62 @@
+import { afterAll, expect } from 'vitest';
+import { conditionalTest } from '../../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../../utils/runner';
+
+// With `ignoreResolveSpans: false`, the channel path also subscribes `graphql:resolve` and emits a
+// span per non-trivial field resolver. `ignoreTrivialResolveSpans` defaults to true, so graphql's
+// default property resolver (the `name` field) is skipped. graphql 17 requires Node >= 22.
+conditionalTest({ min: 22 })('GraphQL tracing channel Test > resolve spans', () => {
+ afterAll(() => {
+ cleanupChildProcesses();
+ });
+
+ const expectedResolveSpan = (path: string, fieldName: string, parentName: string) =>
+ expect.objectContaining({
+ description: `graphql.resolve ${path}`,
+ op: 'graphql',
+ origin: 'auto.graphql.diagnostic_channel',
+ data: expect.objectContaining({
+ 'graphql.field.name': fieldName,
+ 'graphql.field.path': path,
+ 'graphql.parent.name': parentName,
+ }),
+ });
+
+ const EXPECTED_TRANSACTION = {
+ // Root span renamed with the (sorted) operation names. useOperationNameForRootSpan defaults to true.
+ transaction: 'Test Transaction (query, query GetUser)',
+ spans: expect.arrayContaining([
+ expect.objectContaining({ description: 'query', op: 'graphql' }),
+ expect.objectContaining({ description: 'query GetUser', op: 'graphql' }),
+ expectedResolveSpan('hello', 'hello', 'Query'),
+ expectedResolveSpan('user', 'user', 'Query'),
+ ]),
+ };
+
+ createEsmAndCjsTests(
+ __dirname,
+ 'scenario.mjs',
+ 'instrument.mjs',
+ (createTestRunner, test) => {
+ test('emits resolver spans when ignoreResolveSpans is false', async () => {
+ await createTestRunner().expect({ transaction: EXPECTED_TRANSACTION }).start().completed();
+ });
+
+ test('skips the default property resolver (trivial resolve) by default', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ // `user.name` uses graphql's default property resolver, so no span is emitted for it.
+ expect(spans.find(span => span.description === 'graphql.resolve user.name')).toBeUndefined();
+ // ...but the user-defined resolvers do produce spans.
+ expect(spans.find(span => span.description === 'graphql.resolve user')).toBeDefined();
+ },
+ })
+ .start()
+ .completed();
+ });
+ },
+ { additionalDependencies: { graphql: '^17' } },
+ );
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/scenario.mjs

@@ -0,0 +1,71 @@
+import * as Sentry from '@sentry/node';
+import {
+ graphql,
+ GraphQLBoolean,
+ GraphQLInt,
+ GraphQLNonNull,
+ GraphQLObjectType,
+ GraphQLSchema,
+ GraphQLString,
+} from 'graphql';
+
+// Build the schema programmatically rather than via `buildSchema(sdl)`: the SDL form parses at module
+// load, which would publish a `graphql:parse` event outside any transaction (an orphan span).
+const UserType = new GraphQLObjectType({
+ name: 'User',
+ fields: { name: { type: GraphQLString } },
+});
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ user: {
+ type: UserType,
+ args: { id: { type: new GraphQLNonNull(GraphQLInt) } },
+ resolve: (_, { id }) => ({ name: `user-${id}` }),
+ },
+ boom: {
+ type: GraphQLString,
+ resolve: () => {
+ throw new Error('resolver failed');
+ },
+ },
+ },
+ }),
+ mutation: new GraphQLObjectType({
+ name: 'Mutation',
+ fields: {
+ login: {
+ type: GraphQLBoolean,
+ args: { email: { type: new GraphQLNonNull(GraphQLString) } },
+ resolve: (_, { email }) => Boolean(email),
+ },
+ },
+ }),
+});
+
+async function run() {
+ // Let the integration's deferred channel subscription and OpenTelemetry's async-context setup
+ // finish before issuing operations. In a real server graphql runs per-request, long after init;
+ // here it would otherwise race init within the same tick.
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan(
+ {
+ name: 'Test Transaction',
+ op: 'transaction',
+ },
+ async () => {
+ await graphql({ schema, source: '{ hello }' });
+ await graphql({ schema, source: 'query GetUser { user(id: 42) { name } }' });
+ // Inline literal carries a value, to assert it is redacted out of `graphql.document`.
+ await graphql({ schema, source: 'mutation Login { login(email: "secret@example.com") }' });
+ // A resolver throw surfaces as `result.errors`, which must flag the execute span as errored.
+ await graphql({ schema, source: 'query Boom { boom }' });
+ },
+ );
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/test.ts

@@ -0,0 +1,116 @@
+import { afterAll, expect } from 'vitest';
+import { conditionalTest } from '../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../utils/runner';
+
+// graphql >= 17 publishes its operations via `node:diagnostics_channel`, so the SDK subscribes to
+// those channels (`subscribeGraphqlDiagnosticChannels`) instead of the vendored OTel patcher. This
+// suite pins `^17` and asserts the diagnostics-channel path: graphql semconv attributes, redacted
+// document text, span relationships, and that the legacy OTel path does NOT also fire (no double
+// instrumentation). graphql 17 requires Node >= 22, so this suite is skipped on older Node.
+conditionalTest({ min: 22 })('GraphQL tracing channel Test', () => {
+ afterAll(() => {
+ cleanupChildProcesses();
+ });
+
+ const expectedExecuteSpan = (description: string, extraData: Record<string, unknown> = {}) =>
+ expect.objectContaining({
+ description,
+ op: 'graphql',
+ origin: 'auto.graphql.diagnostic_channel',
+ data: expect.objectContaining(extraData),
+ });
+
+ const EXPECTED_TRANSACTION = {
+ // Root span renamed with the (sorted) operation names. useOperationNameForRootSpan defaults to true.
+ transaction: 'Test Transaction (mutation Login, query, query Boom, query GetUser)',
+ spans: expect.arrayContaining([
+ expect.objectContaining({ description: 'graphql.parse', op: 'graphql' }),
+ expect.objectContaining({ description: 'graphql.validate', op: 'graphql' }),
+ // anonymous query -> span named after the operation type only
+ expectedExecuteSpan('query', { 'graphql.operation.type': 'query' }),
+ expectedExecuteSpan('query GetUser', {
+ 'graphql.operation.type': 'query',
+ 'graphql.operation.name': 'GetUser',
+ // the inline `42` literal is redacted out of the document
+ 'graphql.document': 'query GetUser { user(id: *) { name } }',
+ }),
+ expectedExecuteSpan('mutation Login', {
+ 'graphql.operation.type': 'mutation',
+ // the inline email literal must be redacted to `"*"`, so the raw value can never leak
+ 'graphql.document': 'mutation Login { login(email: "*") }',
+ }),
+ ]),
+ };
+
+ createEsmAndCjsTests(
+ __dirname,
+ 'scenario.mjs',
+ 'instrument.mjs',
+ (createTestRunner, test) => {
+ test('subscribes to graphql >= 17 diagnostics channels with graphql semconv attributes', async () => {
+ await createTestRunner().expect({ transaction: EXPECTED_TRANSACTION }).start().completed();
+ });
+
+ test('does not double-instrument: the vendored OTel graphql patcher does not fire on 17', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ // The vendored OTel path (origin `auto.graphql.otel.graphql`) must be inactive on 17+.
+ expect(spans.find(span => span.origin === 'auto.graphql.otel.graphql')).toBeUndefined();
+ // ...while the diagnostics-channel path is active.
+ expect(spans.find(span => span.origin === 'auto.graphql.diagnostic_channel')).toBeDefined();
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('never leaks raw inline literal values into graphql.document', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ for (const span of spans) {
+ const document = span.data?.['graphql.document'];
+ if (typeof document === 'string') {
+ expect(document).not.toContain('secret@example.com');
+ }
+ }
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('flags the execute span as errored when a resolver throws', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ const boomSpan = spans.find(span => span.description === 'query Boom');
+ expect(boomSpan).toBeDefined();
+ expect(boomSpan?.status).toBe('internal_error');
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('parents the execute span to the surrounding transaction', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ const executeSpan = spans.find(span => span.description === 'query GetUser');
+ expect(executeSpan).toBeDefined();
+ expect(executeSpan?.parent_span_id).toBe(event.contexts?.trace?.span_id);
+ },
+ })
+ .start()
+ .completed();
+ });
+ },
+ { additionalDependencies: { graphql: '^17' } },
+ );
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/instrument-disabled.mjs

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ integrations: [Sentry.graphqlIntegration({ useOperationNameForRootSpan: false })],
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/scenario-disabled.mjs

@@ -0,0 +1,21 @@
+import * as Sentry from '@sentry/node';
+import { GraphQLObjectType, GraphQLSchema, GraphQLString, graphql } from 'graphql';
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan({ name: 'Test Transaction', op: 'transaction' }, async () => {
+ await graphql({ schema, source: 'query GetHello { hello }' });
+ });
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/scenario-multiple.mjs

@@ -0,0 +1,23 @@
+import * as Sentry from '@sentry/node';
+import { GraphQLObjectType, GraphQLSchema, GraphQLString, graphql } from 'graphql';
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ world: { type: GraphQLString, resolve: () => 'hello' },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan({ name: 'Test Transaction', op: 'transaction' }, async () => {
+ await graphql({ schema, source: 'query GetWorld { world }' });
+ await graphql({ schema, source: 'query GetHello { hello }' });
+ });
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/instrument.mjs

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ integrations: [Sentry.graphqlIntegration({ ignoreResolveSpans: false })],
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/scenario.mjs

@@ -0,0 +1,40 @@
+import * as Sentry from '@sentry/node';
+import { graphql, GraphQLInt, GraphQLNonNull, GraphQLObjectType, GraphQLSchema, GraphQLString } from 'graphql';
+
+// Built programmatically (not via `buildSchema(sdl)`) so no `graphql:parse` fires at module load.
+const UserType = new GraphQLObjectType({
+ name: 'User',
+ // `name` has no resolver, so it uses graphql's default property resolver (a "trivial" resolve).
+ fields: { name: { type: GraphQLString } },
+});
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ user: {
+ type: UserType,
+ args: { id: { type: new GraphQLNonNull(GraphQLInt) } },
+ resolve: (_, { id }) => ({ name: `user-${id}` }),
+ },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan(
+ {
+ name: 'Test Transaction',
+ op: 'transaction',
+ },
+ async () => {
+ await graphql({ schema, source: '{ hello }' });
+ await graphql({ schema, source: 'query GetUser { user(id: 1) { name } }' });
+ },
+ );
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/test.ts

@@ -0,0 +1,62 @@
+import { afterAll, expect } from 'vitest';
+import { conditionalTest } from '../../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../../utils/runner';
+
+// With `ignoreResolveSpans: false`, the channel path also subscribes `graphql:resolve` and emits a
+// span per non-trivial field resolver. `ignoreTrivialResolveSpans` defaults to true, so graphql's
+// default property resolver (the `name` field) is skipped. graphql 17 requires Node >= 22.
+conditionalTest({ min: 22 })('GraphQL tracing channel Test > resolve spans', () => {
+ afterAll(() => {
+ cleanupChildProcesses();
+ });
+
+ const expectedResolveSpan = (path: string, fieldName: string, parentName: string) =>
+ expect.objectContaining({
+ description: `graphql.resolve ${path}`,
+ op: 'graphql',
+ origin: 'auto.graphql.diagnostic_channel',
+ data: expect.objectContaining({
+ 'graphql.field.name': fieldName,
+ 'graphql.field.path': path,
+ 'graphql.parent.name': parentName,
+ }),
+ });
+
+ const EXPECTED_TRANSACTION = {
+ // Root span renamed with the (sorted) operation names. useOperationNameForRootSpan defaults to true.
+ transaction: 'Test Transaction (query, query GetUser)',
+ spans: expect.arrayContaining([
+ expect.objectContaining({ description: 'query', op: 'graphql' }),
+ expect.objectContaining({ description: 'query GetUser', op: 'graphql' }),
+ expectedResolveSpan('hello', 'hello', 'Query'),
+ expectedResolveSpan('user', 'user', 'Query'),
+ ]),
+ };
+
+ createEsmAndCjsTests(
+ __dirname,
+ 'scenario.mjs',
+ 'instrument.mjs',
+ (createTestRunner, test) => {
+ test('emits resolver spans when ignoreResolveSpans is false', async () => {
+ await createTestRunner().expect({ transaction: EXPECTED_TRANSACTION }).start().completed();
+ });
+
+ test('skips the default property resolver (trivial resolve) by default', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ // `user.name` uses graphql's default property resolver, so no span is emitted for it.
+ expect(spans.find(span => span.description === 'graphql.resolve user.name')).toBeUndefined();
+ // ...but the user-defined resolvers do produce spans.
+ expect(spans.find(span => span.description === 'graphql.resolve user')).toBeDefined();
+ },
+ })
+ .start()
+ .completed();
+ });
+ },
+ { additionalDependencies: { graphql: '^17' } },
+ );
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/scenario.mjs

@@ -0,0 +1,71 @@
+import * as Sentry from '@sentry/node';
+import {
+ graphql,
+ GraphQLBoolean,
+ GraphQLInt,
+ GraphQLNonNull,
+ GraphQLObjectType,
+ GraphQLSchema,
+ GraphQLString,
+} from 'graphql';
+
+// Build the schema programmatically rather than via `buildSchema(sdl)`: the SDL form parses at module
+// load, which would publish a `graphql:parse` event outside any transaction (an orphan span).
+const UserType = new GraphQLObjectType({
+ name: 'User',
+ fields: { name: { type: GraphQLString } },
+});
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ user: {
+ type: UserType,
+ args: { id: { type: new GraphQLNonNull(GraphQLInt) } },
+ resolve: (_, { id }) => ({ name: `user-${id}` }),
+ },
+ boom: {
+ type: GraphQLString,
+ resolve: () => {
+ throw new Error('resolver failed');
+ },
+ },
+ },
+ }),
+ mutation: new GraphQLObjectType({
+ name: 'Mutation',
+ fields: {
+ login: {
+ type: GraphQLBoolean,
+ args: { email: { type: new GraphQLNonNull(GraphQLString) } },
+ resolve: (_, { email }) => Boolean(email),
+ },
+ },
+ }),
+});
+
+async function run() {
+ // Let the integration's deferred channel subscription and OpenTelemetry's async-context setup
+ // finish before issuing operations. In a real server graphql runs per-request, long after init;
+ // here it would otherwise race init within the same tick.
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan(
+ {
+ name: 'Test Transaction',
+ op: 'transaction',
+ },
+ async () => {
+ await graphql({ schema, source: '{ hello }' });
+ await graphql({ schema, source: 'query GetUser { user(id: 42) { name } }' });
+ // Inline literal carries a value, to assert it is redacted out of `graphql.document`.
+ await graphql({ schema, source: 'mutation Login { login(email: "secret@example.com") }' });
+ // A resolver throw surfaces as `result.errors`, which must flag the execute span as errored.
+ await graphql({ schema, source: 'query Boom { boom }' });
+ },
+ );
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/test.ts

@@ -0,0 +1,116 @@
+import { afterAll, expect } from 'vitest';
+import { conditionalTest } from '../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../utils/runner';
+
+// graphql >= 17 publishes its operations via `node:diagnostics_channel`, so the SDK subscribes to
+// those channels (`subscribeGraphqlDiagnosticChannels`) instead of the vendored OTel patcher. This
+// suite pins `^17` and asserts the diagnostics-channel path: graphql semconv attributes, redacted
+// document text, span relationships, and that the legacy OTel path does NOT also fire (no double
+// instrumentation). graphql 17 requires Node >= 22, so this suite is skipped on older Node.
+conditionalTest({ min: 22 })('GraphQL tracing channel Test', () => {
+ afterAll(() => {
+ cleanupChildProcesses();
+ });
+
+ const expectedExecuteSpan = (description: string, extraData: Record<string, unknown> = {}) =>
+ expect.objectContaining({
+ description,
+ op: 'graphql',
+ origin: 'auto.graphql.diagnostic_channel',
+ data: expect.objectContaining(extraData),
+ });
+
+ const EXPECTED_TRANSACTION = {
+ // Root span renamed with the (sorted) operation names. useOperationNameForRootSpan defaults to true.
+ transaction: 'Test Transaction (mutation Login, query, query Boom, query GetUser)',
+ spans: expect.arrayContaining([
+ expect.objectContaining({ description: 'graphql.parse', op: 'graphql' }),
+ expect.objectContaining({ description: 'graphql.validate', op: 'graphql' }),
+ // anonymous query -> span named after the operation type only
+ expectedExecuteSpan('query', { 'graphql.operation.type': 'query' }),
+ expectedExecuteSpan('query GetUser', {
+ 'graphql.operation.type': 'query',
+ 'graphql.operation.name': 'GetUser',
+ // the inline `42` literal is redacted out of the document
+ 'graphql.document': 'query GetUser { user(id: *) { name } }',
+ }),
+ expectedExecuteSpan('mutation Login', {
+ 'graphql.operation.type': 'mutation',
+ // the inline email literal must be redacted to `"*"`, so the raw value can never leak
+ 'graphql.document': 'mutation Login { login(email: "*") }',
+ }),
+ ]),
+ };
+
+ createEsmAndCjsTests(
+ __dirname,
+ 'scenario.mjs',
+ 'instrument.mjs',
+ (createTestRunner, test) => {
+ test('subscribes to graphql >= 17 diagnostics channels with graphql semconv attributes', async () => {
+ await createTestRunner().expect({ transaction: EXPECTED_TRANSACTION }).start().completed();
+ });
+
+ test('does not double-instrument: the vendored OTel graphql patcher does not fire on 17', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ // The vendored OTel path (origin `auto.graphql.otel.graphql`) must be inactive on 17+.
+ expect(spans.find(span => span.origin === 'auto.graphql.otel.graphql')).toBeUndefined();
+ // ...while the diagnostics-channel path is active.
+ expect(spans.find(span => span.origin === 'auto.graphql.diagnostic_channel')).toBeDefined();
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('never leaks raw inline literal values into graphql.document', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ for (const span of spans) {
+ const document = span.data?.['graphql.document'];
+ if (typeof document === 'string') {
+ expect(document).not.toContain('secret@example.com');
+ }
+ }
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('flags the execute span as errored when a resolver throws', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ const boomSpan = spans.find(span => span.description === 'query Boom');
+ expect(boomSpan).toBeDefined();
+ expect(boomSpan?.status).toBe('internal_error');
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('parents the execute span to the surrounding transaction', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ const executeSpan = spans.find(span => span.description === 'query GetUser');
+ expect(executeSpan).toBeDefined();
+ expect(executeSpan?.parent_span_id).toBe(event.contexts?.trace?.span_id);
+ },
+ })
+ .start()
+ .completed();
+ });
+ },
+ { additionalDependencies: { graphql: '^17' } },
+ );
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/instrument-disabled.mjs

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ integrations: [Sentry.graphqlIntegration({ useOperationNameForRootSpan: false })],
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/scenario-disabled.mjs

@@ -0,0 +1,21 @@
+import * as Sentry from '@sentry/node';
+import { GraphQLObjectType, GraphQLSchema, GraphQLString, graphql } from 'graphql';
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan({ name: 'Test Transaction', op: 'transaction' }, async () => {
+ await graphql({ schema, source: 'query GetHello { hello }' });
+ });
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/scenario-multiple.mjs

@@ -0,0 +1,23 @@
+import * as Sentry from '@sentry/node';
+import { GraphQLObjectType, GraphQLSchema, GraphQLString, graphql } from 'graphql';
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ world: { type: GraphQLString, resolve: () => 'hello' },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan({ name: 'Test Transaction', op: 'transaction' }, async () => {
+ await graphql({ schema, source: 'query GetWorld { world }' });
+ await graphql({ schema, source: 'query GetHello { hello }' });
+ });
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/instrument.mjs

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ integrations: [Sentry.graphqlIntegration({ ignoreResolveSpans: false })],
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/scenario.mjs

@@ -0,0 +1,40 @@
+import * as Sentry from '@sentry/node';
+import { graphql, GraphQLInt, GraphQLNonNull, GraphQLObjectType, GraphQLSchema, GraphQLString } from 'graphql';
+
+// Built programmatically (not via `buildSchema(sdl)`) so no `graphql:parse` fires at module load.
+const UserType = new GraphQLObjectType({
+ name: 'User',
+ // `name` has no resolver, so it uses graphql's default property resolver (a "trivial" resolve).
+ fields: { name: { type: GraphQLString } },
+});
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ user: {
+ type: UserType,
+ args: { id: { type: new GraphQLNonNull(GraphQLInt) } },
+ resolve: (_, { id }) => ({ name: `user-${id}` }),
+ },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan(
+ {
+ name: 'Test Transaction',
+ op: 'transaction',
+ },
+ async () => {
+ await graphql({ schema, source: '{ hello }' });
+ await graphql({ schema, source: 'query GetUser { user(id: 1) { name } }' });
+ },
+ );
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/test.ts

@@ -0,0 +1,62 @@
+import { afterAll, expect } from 'vitest';
+import { conditionalTest } from '../../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../../utils/runner';
+
+// With `ignoreResolveSpans: false`, the channel path also subscribes `graphql:resolve` and emits a
+// span per non-trivial field resolver. `ignoreTrivialResolveSpans` defaults to true, so graphql's
+// default property resolver (the `name` field) is skipped. graphql 17 requires Node >= 22.
+conditionalTest({ min: 22 })('GraphQL tracing channel Test > resolve spans', () => {
+ afterAll(() => {
+ cleanupChildProcesses();
+ });
+
+ const expectedResolveSpan = (path: string, fieldName: string, parentName: string) =>
+ expect.objectContaining({
+ description: `graphql.resolve ${path}`,
+ op: 'graphql',
+ origin: 'auto.graphql.diagnostic_channel',
+ data: expect.objectContaining({
+ 'graphql.field.name': fieldName,
+ 'graphql.field.path': path,
+ 'graphql.parent.name': parentName,
+ }),
+ });
+
+ const EXPECTED_TRANSACTION = {
+ // Root span renamed with the (sorted) operation names. useOperationNameForRootSpan defaults to true.
+ transaction: 'Test Transaction (query, query GetUser)',
+ spans: expect.arrayContaining([
+ expect.objectContaining({ description: 'query', op: 'graphql' }),
+ expect.objectContaining({ description: 'query GetUser', op: 'graphql' }),
+ expectedResolveSpan('hello', 'hello', 'Query'),
+ expectedResolveSpan('user', 'user', 'Query'),
+ ]),
+ };
+
+ createEsmAndCjsTests(
+ __dirname,
+ 'scenario.mjs',
+ 'instrument.mjs',
+ (createTestRunner, test) => {
+ test('emits resolver spans when ignoreResolveSpans is false', async () => {
+ await createTestRunner().expect({ transaction: EXPECTED_TRANSACTION }).start().completed();
+ });
+
+ test('skips the default property resolver (trivial resolve) by default', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ // `user.name` uses graphql's default property resolver, so no span is emitted for it.
+ expect(spans.find(span => span.description === 'graphql.resolve user.name')).toBeUndefined();
+ // ...but the user-defined resolvers do produce spans.
+ expect(spans.find(span => span.description === 'graphql.resolve user')).toBeDefined();
+ },
+ })
+ .start()
+ .completed();
+ });
+ },
+ { additionalDependencies: { graphql: '^17' } },
+ );
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/scenario.mjs

@@ -0,0 +1,71 @@
+import * as Sentry from '@sentry/node';
+import {
+ graphql,
+ GraphQLBoolean,
+ GraphQLInt,
+ GraphQLNonNull,
+ GraphQLObjectType,
+ GraphQLSchema,
+ GraphQLString,
+} from 'graphql';
+
+// Build the schema programmatically rather than via `buildSchema(sdl)`: the SDL form parses at module
+// load, which would publish a `graphql:parse` event outside any transaction (an orphan span).
+const UserType = new GraphQLObjectType({
+ name: 'User',
+ fields: { name: { type: GraphQLString } },
+});
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ user: {
+ type: UserType,
+ args: { id: { type: new GraphQLNonNull(GraphQLInt) } },
+ resolve: (_, { id }) => ({ name: `user-${id}` }),
+ },
+ boom: {
+ type: GraphQLString,
+ resolve: () => {
+ throw new Error('resolver failed');
+ },
+ },
+ },
+ }),
+ mutation: new GraphQLObjectType({
+ name: 'Mutation',
+ fields: {
+ login: {
+ type: GraphQLBoolean,
+ args: { email: { type: new GraphQLNonNull(GraphQLString) } },
+ resolve: (_, { email }) => Boolean(email),
+ },
+ },
+ }),
+});
+
+async function run() {
+ // Let the integration's deferred channel subscription and OpenTelemetry's async-context setup
+ // finish before issuing operations. In a real server graphql runs per-request, long after init;
+ // here it would otherwise race init within the same tick.
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan(
+ {
+ name: 'Test Transaction',
+ op: 'transaction',
+ },
+ async () => {
+ await graphql({ schema, source: '{ hello }' });
+ await graphql({ schema, source: 'query GetUser { user(id: 42) { name } }' });
+ // Inline literal carries a value, to assert it is redacted out of `graphql.document`.
+ await graphql({ schema, source: 'mutation Login { login(email: "secret@example.com") }' });
+ // A resolver throw surfaces as `result.errors`, which must flag the execute span as errored.
+ await graphql({ schema, source: 'query Boom { boom }' });
+ },
+ );
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/test.ts

@@ -0,0 +1,116 @@
+import { afterAll, expect } from 'vitest';
+import { conditionalTest } from '../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../utils/runner';
+
+// graphql >= 17 publishes its operations via `node:diagnostics_channel`, so the SDK subscribes to
+// those channels (`subscribeGraphqlDiagnosticChannels`) instead of the vendored OTel patcher. This
+// suite pins `^17` and asserts the diagnostics-channel path: graphql semconv attributes, redacted
+// document text, span relationships, and that the legacy OTel path does NOT also fire (no double
+// instrumentation). graphql 17 requires Node >= 22, so this suite is skipped on older Node.
+conditionalTest({ min: 22 })('GraphQL tracing channel Test', () => {
+ afterAll(() => {
+ cleanupChildProcesses();
+ });
+
+ const expectedExecuteSpan = (description: string, extraData: Record<string, unknown> = {}) =>
+ expect.objectContaining({
+ description,
+ op: 'graphql',
+ origin: 'auto.graphql.diagnostic_channel',
+ data: expect.objectContaining(extraData),
+ });
+
+ const EXPECTED_TRANSACTION = {
+ // Root span renamed with the (sorted) operation names. useOperationNameForRootSpan defaults to true.
+ transaction: 'Test Transaction (mutation Login, query, query Boom, query GetUser)',
+ spans: expect.arrayContaining([
+ expect.objectContaining({ description: 'graphql.parse', op: 'graphql' }),
+ expect.objectContaining({ description: 'graphql.validate', op: 'graphql' }),
+ // anonymous query -> span named after the operation type only
+ expectedExecuteSpan('query', { 'graphql.operation.type': 'query' }),
+ expectedExecuteSpan('query GetUser', {
+ 'graphql.operation.type': 'query',
+ 'graphql.operation.name': 'GetUser',
+ // the inline `42` literal is redacted out of the document
+ 'graphql.document': 'query GetUser { user(id: *) { name } }',
+ }),
+ expectedExecuteSpan('mutation Login', {
+ 'graphql.operation.type': 'mutation',
+ // the inline email literal must be redacted to `"*"`, so the raw value can never leak
+ 'graphql.document': 'mutation Login { login(email: "*") }',
+ }),
+ ]),
+ };
+
+ createEsmAndCjsTests(
+ __dirname,
+ 'scenario.mjs',
+ 'instrument.mjs',
+ (createTestRunner, test) => {
+ test('subscribes to graphql >= 17 diagnostics channels with graphql semconv attributes', async () => {
+ await createTestRunner().expect({ transaction: EXPECTED_TRANSACTION }).start().completed();
+ });
+
+ test('does not double-instrument: the vendored OTel graphql patcher does not fire on 17', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ // The vendored OTel path (origin `auto.graphql.otel.graphql`) must be inactive on 17+.
+ expect(spans.find(span => span.origin === 'auto.graphql.otel.graphql')).toBeUndefined();
+ // ...while the diagnostics-channel path is active.
+ expect(spans.find(span => span.origin === 'auto.graphql.diagnostic_channel')).toBeDefined();
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('never leaks raw inline literal values into graphql.document', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ for (const span of spans) {
+ const document = span.data?.['graphql.document'];
+ if (typeof document === 'string') {
+ expect(document).not.toContain('secret@example.com');
+ }
+ }
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('flags the execute span as errored when a resolver throws', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ const boomSpan = spans.find(span => span.description === 'query Boom');
+ expect(boomSpan).toBeDefined();
+ expect(boomSpan?.status).toBe('internal_error');
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('parents the execute span to the surrounding transaction', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ const executeSpan = spans.find(span => span.description === 'query GetUser');
+ expect(executeSpan).toBeDefined();
+ expect(executeSpan?.parent_span_id).toBe(event.contexts?.trace?.span_id);
+ },
+ })
+ .start()
+ .completed();
+ });
+ },
+ { additionalDependencies: { graphql: '^17' } },
+ );
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/instrument-disabled.mjs

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ integrations: [Sentry.graphqlIntegration({ useOperationNameForRootSpan: false })],
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/scenario-disabled.mjs

@@ -0,0 +1,21 @@
+import * as Sentry from '@sentry/node';
+import { GraphQLObjectType, GraphQLSchema, GraphQLString, graphql } from 'graphql';
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan({ name: 'Test Transaction', op: 'transaction' }, async () => {
+ await graphql({ schema, source: 'query GetHello { hello }' });
+ });
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/scenario-multiple.mjs

@@ -0,0 +1,23 @@
+import * as Sentry from '@sentry/node';
+import { GraphQLObjectType, GraphQLSchema, GraphQLString, graphql } from 'graphql';
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ world: { type: GraphQLString, resolve: () => 'hello' },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan({ name: 'Test Transaction', op: 'transaction' }, async () => {
+ await graphql({ schema, source: 'query GetWorld { world }' });
+ await graphql({ schema, source: 'query GetHello { hello }' });
+ });
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/instrument.mjs

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ integrations: [Sentry.graphqlIntegration({ ignoreResolveSpans: false })],
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/scenario.mjs

@@ -0,0 +1,40 @@
+import * as Sentry from '@sentry/node';
+import { graphql, GraphQLInt, GraphQLNonNull, GraphQLObjectType, GraphQLSchema, GraphQLString } from 'graphql';
+
+// Built programmatically (not via `buildSchema(sdl)`) so no `graphql:parse` fires at module load.
+const UserType = new GraphQLObjectType({
+ name: 'User',
+ // `name` has no resolver, so it uses graphql's default property resolver (a "trivial" resolve).
+ fields: { name: { type: GraphQLString } },
+});
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ user: {
+ type: UserType,
+ args: { id: { type: new GraphQLNonNull(GraphQLInt) } },
+ resolve: (_, { id }) => ({ name: `user-${id}` }),
+ },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan(
+ {
+ name: 'Test Transaction',
+ op: 'transaction',
+ },
+ async () => {
+ await graphql({ schema, source: '{ hello }' });
+ await graphql({ schema, source: 'query GetUser { user(id: 1) { name } }' });
+ },
+ );
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/test.ts

@@ -0,0 +1,62 @@
+import { afterAll, expect } from 'vitest';
+import { conditionalTest } from '../../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../../utils/runner';
+
+// With `ignoreResolveSpans: false`, the channel path also subscribes `graphql:resolve` and emits a
+// span per non-trivial field resolver. `ignoreTrivialResolveSpans` defaults to true, so graphql's
+// default property resolver (the `name` field) is skipped. graphql 17 requires Node >= 22.
+conditionalTest({ min: 22 })('GraphQL tracing channel Test > resolve spans', () => {
+ afterAll(() => {
+ cleanupChildProcesses();
+ });
+
+ const expectedResolveSpan = (path: string, fieldName: string, parentName: string) =>
+ expect.objectContaining({
+ description: `graphql.resolve ${path}`,
+ op: 'graphql',
+ origin: 'auto.graphql.diagnostic_channel',
+ data: expect.objectContaining({
+ 'graphql.field.name': fieldName,
+ 'graphql.field.path': path,
+ 'graphql.parent.name': parentName,
+ }),
+ });
+
+ const EXPECTED_TRANSACTION = {
+ // Root span renamed with the (sorted) operation names. useOperationNameForRootSpan defaults to true.
+ transaction: 'Test Transaction (query, query GetUser)',
+ spans: expect.arrayContaining([
+ expect.objectContaining({ description: 'query', op: 'graphql' }),
+ expect.objectContaining({ description: 'query GetUser', op: 'graphql' }),
+ expectedResolveSpan('hello', 'hello', 'Query'),
+ expectedResolveSpan('user', 'user', 'Query'),
+ ]),
+ };
+
+ createEsmAndCjsTests(
+ __dirname,
+ 'scenario.mjs',
+ 'instrument.mjs',
+ (createTestRunner, test) => {
+ test('emits resolver spans when ignoreResolveSpans is false', async () => {
+ await createTestRunner().expect({ transaction: EXPECTED_TRANSACTION }).start().completed();
+ });
+
+ test('skips the default property resolver (trivial resolve) by default', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ // `user.name` uses graphql's default property resolver, so no span is emitted for it.
+ expect(spans.find(span => span.description === 'graphql.resolve user.name')).toBeUndefined();
+ // ...but the user-defined resolvers do produce spans.
+ expect(spans.find(span => span.description === 'graphql.resolve user')).toBeDefined();
+ },
+ })
+ .start()
+ .completed();
+ });
+ },
+ { additionalDependencies: { graphql: '^17' } },
+ );
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/scenario.mjs

@@ -0,0 +1,71 @@
+import * as Sentry from '@sentry/node';
+import {
+ graphql,
+ GraphQLBoolean,
+ GraphQLInt,
+ GraphQLNonNull,
+ GraphQLObjectType,
+ GraphQLSchema,
+ GraphQLString,
+} from 'graphql';
+
+// Build the schema programmatically rather than via `buildSchema(sdl)`: the SDL form parses at module
+// load, which would publish a `graphql:parse` event outside any transaction (an orphan span).
+const UserType = new GraphQLObjectType({
+ name: 'User',
+ fields: { name: { type: GraphQLString } },
+});
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ user: {
+ type: UserType,
+ args: { id: { type: new GraphQLNonNull(GraphQLInt) } },
+ resolve: (_, { id }) => ({ name: `user-${id}` }),
+ },
+ boom: {
+ type: GraphQLString,
+ resolve: () => {
+ throw new Error('resolver failed');
+ },
+ },
+ },
+ }),
+ mutation: new GraphQLObjectType({
+ name: 'Mutation',
+ fields: {
+ login: {
+ type: GraphQLBoolean,
+ args: { email: { type: new GraphQLNonNull(GraphQLString) } },
+ resolve: (_, { email }) => Boolean(email),
+ },
+ },
+ }),
+});
+
+async function run() {
+ // Let the integration's deferred channel subscription and OpenTelemetry's async-context setup
+ // finish before issuing operations. In a real server graphql runs per-request, long after init;
+ // here it would otherwise race init within the same tick.
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan(
+ {
+ name: 'Test Transaction',
+ op: 'transaction',
+ },
+ async () => {
+ await graphql({ schema, source: '{ hello }' });
+ await graphql({ schema, source: 'query GetUser { user(id: 42) { name } }' });
+ // Inline literal carries a value, to assert it is redacted out of `graphql.document`.
+ await graphql({ schema, source: 'mutation Login { login(email: "secret@example.com") }' });
+ // A resolver throw surfaces as `result.errors`, which must flag the execute span as errored.
+ await graphql({ schema, source: 'query Boom { boom }' });
+ },
+ );
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/test.ts

@@ -0,0 +1,116 @@
+import { afterAll, expect } from 'vitest';
+import { conditionalTest } from '../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../utils/runner';
+
+// graphql >= 17 publishes its operations via `node:diagnostics_channel`, so the SDK subscribes to
+// those channels (`subscribeGraphqlDiagnosticChannels`) instead of the vendored OTel patcher. This
+// suite pins `^17` and asserts the diagnostics-channel path: graphql semconv attributes, redacted
+// document text, span relationships, and that the legacy OTel path does NOT also fire (no double
+// instrumentation). graphql 17 requires Node >= 22, so this suite is skipped on older Node.
+conditionalTest({ min: 22 })('GraphQL tracing channel Test', () => {
+ afterAll(() => {
+ cleanupChildProcesses();
+ });
+
+ const expectedExecuteSpan = (description: string, extraData: Record<string, unknown> = {}) =>
+ expect.objectContaining({
+ description,
+ op: 'graphql',
+ origin: 'auto.graphql.diagnostic_channel',
+ data: expect.objectContaining(extraData),
+ });
+
+ const EXPECTED_TRANSACTION = {
+ // Root span renamed with the (sorted) operation names. useOperationNameForRootSpan defaults to true.
+ transaction: 'Test Transaction (mutation Login, query, query Boom, query GetUser)',
+ spans: expect.arrayContaining([
+ expect.objectContaining({ description: 'graphql.parse', op: 'graphql' }),
+ expect.objectContaining({ description: 'graphql.validate', op: 'graphql' }),
+ // anonymous query -> span named after the operation type only
+ expectedExecuteSpan('query', { 'graphql.operation.type': 'query' }),
+ expectedExecuteSpan('query GetUser', {
+ 'graphql.operation.type': 'query',
+ 'graphql.operation.name': 'GetUser',
+ // the inline `42` literal is redacted out of the document
+ 'graphql.document': 'query GetUser { user(id: *) { name } }',
+ }),
+ expectedExecuteSpan('mutation Login', {
+ 'graphql.operation.type': 'mutation',
+ // the inline email literal must be redacted to `"*"`, so the raw value can never leak
+ 'graphql.document': 'mutation Login { login(email: "*") }',
+ }),
+ ]),
+ };
+
+ createEsmAndCjsTests(
+ __dirname,
+ 'scenario.mjs',
+ 'instrument.mjs',
+ (createTestRunner, test) => {
+ test('subscribes to graphql >= 17 diagnostics channels with graphql semconv attributes', async () => {
+ await createTestRunner().expect({ transaction: EXPECTED_TRANSACTION }).start().completed();
+ });
+
+ test('does not double-instrument: the vendored OTel graphql patcher does not fire on 17', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ // The vendored OTel path (origin `auto.graphql.otel.graphql`) must be inactive on 17+.
+ expect(spans.find(span => span.origin === 'auto.graphql.otel.graphql')).toBeUndefined();
+ // ...while the diagnostics-channel path is active.
+ expect(spans.find(span => span.origin === 'auto.graphql.diagnostic_channel')).toBeDefined();
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('never leaks raw inline literal values into graphql.document', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ for (const span of spans) {
+ const document = span.data?.['graphql.document'];
+ if (typeof document === 'string') {
+ expect(document).not.toContain('secret@example.com');
+ }
+ }
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('flags the execute span as errored when a resolver throws', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ const boomSpan = spans.find(span => span.description === 'query Boom');
+ expect(boomSpan).toBeDefined();
+ expect(boomSpan?.status).toBe('internal_error');
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('parents the execute span to the surrounding transaction', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ const executeSpan = spans.find(span => span.description === 'query GetUser');
+ expect(executeSpan).toBeDefined();
+ expect(executeSpan?.parent_span_id).toBe(event.contexts?.trace?.span_id);
+ },
+ })
+ .start()
+ .completed();
+ });
+ },
+ { additionalDependencies: { graphql: '^17' } },
+ );
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/instrument-disabled.mjs

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ integrations: [Sentry.graphqlIntegration({ useOperationNameForRootSpan: false })],
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/scenario-disabled.mjs

@@ -0,0 +1,21 @@
+import * as Sentry from '@sentry/node';
+import { GraphQLObjectType, GraphQLSchema, GraphQLString, graphql } from 'graphql';
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan({ name: 'Test Transaction', op: 'transaction' }, async () => {
+ await graphql({ schema, source: 'query GetHello { hello }' });
+ });
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/scenario-multiple.mjs

@@ -0,0 +1,23 @@
+import * as Sentry from '@sentry/node';
+import { GraphQLObjectType, GraphQLSchema, GraphQLString, graphql } from 'graphql';
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ world: { type: GraphQLString, resolve: () => 'hello' },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan({ name: 'Test Transaction', op: 'transaction' }, async () => {
+ await graphql({ schema, source: 'query GetWorld { world }' });
+ await graphql({ schema, source: 'query GetHello { hello }' });
+ });
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/instrument.mjs

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ integrations: [Sentry.graphqlIntegration({ ignoreResolveSpans: false })],
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/scenario.mjs

@@ -0,0 +1,40 @@
+import * as Sentry from '@sentry/node';
+import { graphql, GraphQLInt, GraphQLNonNull, GraphQLObjectType, GraphQLSchema, GraphQLString } from 'graphql';
+
+// Built programmatically (not via `buildSchema(sdl)`) so no `graphql:parse` fires at module load.
+const UserType = new GraphQLObjectType({
+ name: 'User',
+ // `name` has no resolver, so it uses graphql's default property resolver (a "trivial" resolve).
+ fields: { name: { type: GraphQLString } },
+});
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ user: {
+ type: UserType,
+ args: { id: { type: new GraphQLNonNull(GraphQLInt) } },
+ resolve: (_, { id }) => ({ name: `user-${id}` }),
+ },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan(
+ {
+ name: 'Test Transaction',
+ op: 'transaction',
+ },
+ async () => {
+ await graphql({ schema, source: '{ hello }' });
+ await graphql({ schema, source: 'query GetUser { user(id: 1) { name } }' });
+ },
+ );
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/test.ts

@@ -0,0 +1,62 @@
+import { afterAll, expect } from 'vitest';
+import { conditionalTest } from '../../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../../utils/runner';
+
+// With `ignoreResolveSpans: false`, the channel path also subscribes `graphql:resolve` and emits a
+// span per non-trivial field resolver. `ignoreTrivialResolveSpans` defaults to true, so graphql's
+// default property resolver (the `name` field) is skipped. graphql 17 requires Node >= 22.
+conditionalTest({ min: 22 })('GraphQL tracing channel Test > resolve spans', () => {
+ afterAll(() => {
+ cleanupChildProcesses();
+ });
+
+ const expectedResolveSpan = (path: string, fieldName: string, parentName: string) =>
+ expect.objectContaining({
+ description: `graphql.resolve ${path}`,
+ op: 'graphql',
+ origin: 'auto.graphql.diagnostic_channel',
+ data: expect.objectContaining({
+ 'graphql.field.name': fieldName,
+ 'graphql.field.path': path,
+ 'graphql.parent.name': parentName,
+ }),
+ });
+
+ const EXPECTED_TRANSACTION = {
+ // Root span renamed with the (sorted) operation names. useOperationNameForRootSpan defaults to true.
+ transaction: 'Test Transaction (query, query GetUser)',
+ spans: expect.arrayContaining([
+ expect.objectContaining({ description: 'query', op: 'graphql' }),
+ expect.objectContaining({ description: 'query GetUser', op: 'graphql' }),
+ expectedResolveSpan('hello', 'hello', 'Query'),
+ expectedResolveSpan('user', 'user', 'Query'),
+ ]),
+ };
+
+ createEsmAndCjsTests(
+ __dirname,
+ 'scenario.mjs',
+ 'instrument.mjs',
+ (createTestRunner, test) => {
+ test('emits resolver spans when ignoreResolveSpans is false', async () => {
+ await createTestRunner().expect({ transaction: EXPECTED_TRANSACTION }).start().completed();
+ });
+
+ test('skips the default property resolver (trivial resolve) by default', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ // `user.name` uses graphql's default property resolver, so no span is emitted for it.
+ expect(spans.find(span => span.description === 'graphql.resolve user.name')).toBeUndefined();
+ // ...but the user-defined resolvers do produce spans.
+ expect(spans.find(span => span.description === 'graphql.resolve user')).toBeDefined();
+ },
+ })
+ .start()
+ .completed();
+ });
+ },
+ { additionalDependencies: { graphql: '^17' } },
+ );
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/scenario.mjs

@@ -0,0 +1,71 @@
+import * as Sentry from '@sentry/node';
+import {
+ graphql,
+ GraphQLBoolean,
+ GraphQLInt,
+ GraphQLNonNull,
+ GraphQLObjectType,
+ GraphQLSchema,
+ GraphQLString,
+} from 'graphql';
+
+// Build the schema programmatically rather than via `buildSchema(sdl)`: the SDL form parses at module
+// load, which would publish a `graphql:parse` event outside any transaction (an orphan span).
+const UserType = new GraphQLObjectType({
+ name: 'User',
+ fields: { name: { type: GraphQLString } },
+});
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ user: {
+ type: UserType,
+ args: { id: { type: new GraphQLNonNull(GraphQLInt) } },
+ resolve: (_, { id }) => ({ name: `user-${id}` }),
+ },
+ boom: {
+ type: GraphQLString,
+ resolve: () => {
+ throw new Error('resolver failed');
+ },
+ },
+ },
+ }),
+ mutation: new GraphQLObjectType({
+ name: 'Mutation',
+ fields: {
+ login: {
+ type: GraphQLBoolean,
+ args: { email: { type: new GraphQLNonNull(GraphQLString) } },
+ resolve: (_, { email }) => Boolean(email),
+ },
+ },
+ }),
+});
+
+async function run() {
+ // Let the integration's deferred channel subscription and OpenTelemetry's async-context setup
+ // finish before issuing operations. In a real server graphql runs per-request, long after init;
+ // here it would otherwise race init within the same tick.
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan(
+ {
+ name: 'Test Transaction',
+ op: 'transaction',
+ },
+ async () => {
+ await graphql({ schema, source: '{ hello }' });
+ await graphql({ schema, source: 'query GetUser { user(id: 42) { name } }' });
+ // Inline literal carries a value, to assert it is redacted out of `graphql.document`.
+ await graphql({ schema, source: 'mutation Login { login(email: "secret@example.com") }' });
+ // A resolver throw surfaces as `result.errors`, which must flag the execute span as errored.
+ await graphql({ schema, source: 'query Boom { boom }' });
+ },
+ );
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/test.ts

@@ -0,0 +1,116 @@
+import { afterAll, expect } from 'vitest';
+import { conditionalTest } from '../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../utils/runner';
+
+// graphql >= 17 publishes its operations via `node:diagnostics_channel`, so the SDK subscribes to
+// those channels (`subscribeGraphqlDiagnosticChannels`) instead of the vendored OTel patcher. This
+// suite pins `^17` and asserts the diagnostics-channel path: graphql semconv attributes, redacted
+// document text, span relationships, and that the legacy OTel path does NOT also fire (no double
+// instrumentation). graphql 17 requires Node >= 22, so this suite is skipped on older Node.
+conditionalTest({ min: 22 })('GraphQL tracing channel Test', () => {
+ afterAll(() => {
+ cleanupChildProcesses();
+ });
+
+ const expectedExecuteSpan = (description: string, extraData: Record<string, unknown> = {}) =>
+ expect.objectContaining({
+ description,
+ op: 'graphql',
+ origin: 'auto.graphql.diagnostic_channel',
+ data: expect.objectContaining(extraData),
+ });
+
+ const EXPECTED_TRANSACTION = {
+ // Root span renamed with the (sorted) operation names. useOperationNameForRootSpan defaults to true.
+ transaction: 'Test Transaction (mutation Login, query, query Boom, query GetUser)',
+ spans: expect.arrayContaining([
+ expect.objectContaining({ description: 'graphql.parse', op: 'graphql' }),
+ expect.objectContaining({ description: 'graphql.validate', op: 'graphql' }),
+ // anonymous query -> span named after the operation type only
+ expectedExecuteSpan('query', { 'graphql.operation.type': 'query' }),
+ expectedExecuteSpan('query GetUser', {
+ 'graphql.operation.type': 'query',
+ 'graphql.operation.name': 'GetUser',
+ // the inline `42` literal is redacted out of the document
+ 'graphql.document': 'query GetUser { user(id: *) { name } }',
+ }),
+ expectedExecuteSpan('mutation Login', {
+ 'graphql.operation.type': 'mutation',
+ // the inline email literal must be redacted to `"*"`, so the raw value can never leak
+ 'graphql.document': 'mutation Login { login(email: "*") }',
+ }),
+ ]),
+ };
+
+ createEsmAndCjsTests(
+ __dirname,
+ 'scenario.mjs',
+ 'instrument.mjs',
+ (createTestRunner, test) => {
+ test('subscribes to graphql >= 17 diagnostics channels with graphql semconv attributes', async () => {
+ await createTestRunner().expect({ transaction: EXPECTED_TRANSACTION }).start().completed();
+ });
+
+ test('does not double-instrument: the vendored OTel graphql patcher does not fire on 17', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ // The vendored OTel path (origin `auto.graphql.otel.graphql`) must be inactive on 17+.
+ expect(spans.find(span => span.origin === 'auto.graphql.otel.graphql')).toBeUndefined();
+ // ...while the diagnostics-channel path is active.
+ expect(spans.find(span => span.origin === 'auto.graphql.diagnostic_channel')).toBeDefined();
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('never leaks raw inline literal values into graphql.document', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ for (const span of spans) {
+ const document = span.data?.['graphql.document'];
+ if (typeof document === 'string') {
+ expect(document).not.toContain('secret@example.com');
+ }
+ }
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('flags the execute span as errored when a resolver throws', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ const boomSpan = spans.find(span => span.description === 'query Boom');
+ expect(boomSpan).toBeDefined();
+ expect(boomSpan?.status).toBe('internal_error');
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('parents the execute span to the surrounding transaction', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ const executeSpan = spans.find(span => span.description === 'query GetUser');
+ expect(executeSpan).toBeDefined();
+ expect(executeSpan?.parent_span_id).toBe(event.contexts?.trace?.span_id);
+ },
+ })
+ .start()
+ .completed();
+ });
+ },
+ { additionalDependencies: { graphql: '^17' } },
+ );
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/instrument-disabled.mjs

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ integrations: [Sentry.graphqlIntegration({ useOperationNameForRootSpan: false })],
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/scenario-disabled.mjs

@@ -0,0 +1,21 @@
+import * as Sentry from '@sentry/node';
+import { GraphQLObjectType, GraphQLSchema, GraphQLString, graphql } from 'graphql';
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan({ name: 'Test Transaction', op: 'transaction' }, async () => {
+ await graphql({ schema, source: 'query GetHello { hello }' });
+ });
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/scenario-multiple.mjs

@@ -0,0 +1,23 @@
+import * as Sentry from '@sentry/node';
+import { GraphQLObjectType, GraphQLSchema, GraphQLString, graphql } from 'graphql';
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ world: { type: GraphQLString, resolve: () => 'hello' },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan({ name: 'Test Transaction', op: 'transaction' }, async () => {
+ await graphql({ schema, source: 'query GetWorld { world }' });
+ await graphql({ schema, source: 'query GetHello { hello }' });
+ });
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/instrument.mjs

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ integrations: [Sentry.graphqlIntegration({ ignoreResolveSpans: false })],
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/scenario.mjs

@@ -0,0 +1,40 @@
+import * as Sentry from '@sentry/node';
+import { graphql, GraphQLInt, GraphQLNonNull, GraphQLObjectType, GraphQLSchema, GraphQLString } from 'graphql';
+
+// Built programmatically (not via `buildSchema(sdl)`) so no `graphql:parse` fires at module load.
+const UserType = new GraphQLObjectType({
+ name: 'User',
+ // `name` has no resolver, so it uses graphql's default property resolver (a "trivial" resolve).
+ fields: { name: { type: GraphQLString } },
+});
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ user: {
+ type: UserType,
+ args: { id: { type: new GraphQLNonNull(GraphQLInt) } },
+ resolve: (_, { id }) => ({ name: `user-${id}` }),
+ },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan(
+ {
+ name: 'Test Transaction',
+ op: 'transaction',
+ },
+ async () => {
+ await graphql({ schema, source: '{ hello }' });
+ await graphql({ schema, source: 'query GetUser { user(id: 1) { name } }' });
+ },
+ );
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/test.ts

@@ -0,0 +1,62 @@
+import { afterAll, expect } from 'vitest';
+import { conditionalTest } from '../../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../../utils/runner';
+
+// With `ignoreResolveSpans: false`, the channel path also subscribes `graphql:resolve` and emits a
+// span per non-trivial field resolver. `ignoreTrivialResolveSpans` defaults to true, so graphql's
+// default property resolver (the `name` field) is skipped. graphql 17 requires Node >= 22.
+conditionalTest({ min: 22 })('GraphQL tracing channel Test > resolve spans', () => {
+ afterAll(() => {
+ cleanupChildProcesses();
+ });
+
+ const expectedResolveSpan = (path: string, fieldName: string, parentName: string) =>
+ expect.objectContaining({
+ description: `graphql.resolve ${path}`,
+ op: 'graphql',
+ origin: 'auto.graphql.diagnostic_channel',
+ data: expect.objectContaining({
+ 'graphql.field.name': fieldName,
+ 'graphql.field.path': path,
+ 'graphql.parent.name': parentName,
+ }),
+ });
+
+ const EXPECTED_TRANSACTION = {
+ // Root span renamed with the (sorted) operation names. useOperationNameForRootSpan defaults to true.
+ transaction: 'Test Transaction (query, query GetUser)',
+ spans: expect.arrayContaining([
+ expect.objectContaining({ description: 'query', op: 'graphql' }),
+ expect.objectContaining({ description: 'query GetUser', op: 'graphql' }),
+ expectedResolveSpan('hello', 'hello', 'Query'),
+ expectedResolveSpan('user', 'user', 'Query'),
+ ]),
+ };
+
+ createEsmAndCjsTests(
+ __dirname,
+ 'scenario.mjs',
+ 'instrument.mjs',
+ (createTestRunner, test) => {
+ test('emits resolver spans when ignoreResolveSpans is false', async () => {
+ await createTestRunner().expect({ transaction: EXPECTED_TRANSACTION }).start().completed();
+ });
+
+ test('skips the default property resolver (trivial resolve) by default', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ // `user.name` uses graphql's default property resolver, so no span is emitted for it.
+ expect(spans.find(span => span.description === 'graphql.resolve user.name')).toBeUndefined();
+ // ...but the user-defined resolvers do produce spans.
+ expect(spans.find(span => span.description === 'graphql.resolve user')).toBeDefined();
+ },
+ })
+ .start()
+ .completed();
+ });
+ },
+ { additionalDependencies: { graphql: '^17' } },
+ );
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/scenario.mjs

@@ -0,0 +1,71 @@
+import * as Sentry from '@sentry/node';
+import {
+ graphql,
+ GraphQLBoolean,
+ GraphQLInt,
+ GraphQLNonNull,
+ GraphQLObjectType,
+ GraphQLSchema,
+ GraphQLString,
+} from 'graphql';
+
+// Build the schema programmatically rather than via `buildSchema(sdl)`: the SDL form parses at module
+// load, which would publish a `graphql:parse` event outside any transaction (an orphan span).
+const UserType = new GraphQLObjectType({
+ name: 'User',
+ fields: { name: { type: GraphQLString } },
+});
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ user: {
+ type: UserType,
+ args: { id: { type: new GraphQLNonNull(GraphQLInt) } },
+ resolve: (_, { id }) => ({ name: `user-${id}` }),
+ },
+ boom: {
+ type: GraphQLString,
+ resolve: () => {
+ throw new Error('resolver failed');
+ },
+ },
+ },
+ }),
+ mutation: new GraphQLObjectType({
+ name: 'Mutation',
+ fields: {
+ login: {
+ type: GraphQLBoolean,
+ args: { email: { type: new GraphQLNonNull(GraphQLString) } },
+ resolve: (_, { email }) => Boolean(email),
+ },
+ },
+ }),
+});
+
+async function run() {
+ // Let the integration's deferred channel subscription and OpenTelemetry's async-context setup
+ // finish before issuing operations. In a real server graphql runs per-request, long after init;
+ // here it would otherwise race init within the same tick.
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan(
+ {
+ name: 'Test Transaction',
+ op: 'transaction',
+ },
+ async () => {
+ await graphql({ schema, source: '{ hello }' });
+ await graphql({ schema, source: 'query GetUser { user(id: 42) { name } }' });
+ // Inline literal carries a value, to assert it is redacted out of `graphql.document`.
+ await graphql({ schema, source: 'mutation Login { login(email: "secret@example.com") }' });
+ // A resolver throw surfaces as `result.errors`, which must flag the execute span as errored.
+ await graphql({ schema, source: 'query Boom { boom }' });
+ },
+ );
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/test.ts

@@ -0,0 +1,116 @@
+import { afterAll, expect } from 'vitest';
+import { conditionalTest } from '../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../utils/runner';
+
+// graphql >= 17 publishes its operations via `node:diagnostics_channel`, so the SDK subscribes to
+// those channels (`subscribeGraphqlDiagnosticChannels`) instead of the vendored OTel patcher. This
+// suite pins `^17` and asserts the diagnostics-channel path: graphql semconv attributes, redacted
+// document text, span relationships, and that the legacy OTel path does NOT also fire (no double
+// instrumentation). graphql 17 requires Node >= 22, so this suite is skipped on older Node.
+conditionalTest({ min: 22 })('GraphQL tracing channel Test', () => {
+ afterAll(() => {
+ cleanupChildProcesses();
+ });
+
+ const expectedExecuteSpan = (description: string, extraData: Record<string, unknown> = {}) =>
+ expect.objectContaining({
+ description,
+ op: 'graphql',
+ origin: 'auto.graphql.diagnostic_channel',
+ data: expect.objectContaining(extraData),
+ });
+
+ const EXPECTED_TRANSACTION = {
+ // Root span renamed with the (sorted) operation names. useOperationNameForRootSpan defaults to true.
+ transaction: 'Test Transaction (mutation Login, query, query Boom, query GetUser)',
+ spans: expect.arrayContaining([
+ expect.objectContaining({ description: 'graphql.parse', op: 'graphql' }),
+ expect.objectContaining({ description: 'graphql.validate', op: 'graphql' }),
+ // anonymous query -> span named after the operation type only
+ expectedExecuteSpan('query', { 'graphql.operation.type': 'query' }),
+ expectedExecuteSpan('query GetUser', {
+ 'graphql.operation.type': 'query',
+ 'graphql.operation.name': 'GetUser',
+ // the inline `42` literal is redacted out of the document
+ 'graphql.document': 'query GetUser { user(id: *) { name } }',
+ }),
+ expectedExecuteSpan('mutation Login', {
+ 'graphql.operation.type': 'mutation',
+ // the inline email literal must be redacted to `"*"`, so the raw value can never leak
+ 'graphql.document': 'mutation Login { login(email: "*") }',
+ }),
+ ]),
+ };
+
+ createEsmAndCjsTests(
+ __dirname,
+ 'scenario.mjs',
+ 'instrument.mjs',
+ (createTestRunner, test) => {
+ test('subscribes to graphql >= 17 diagnostics channels with graphql semconv attributes', async () => {
+ await createTestRunner().expect({ transaction: EXPECTED_TRANSACTION }).start().completed();
+ });
+
+ test('does not double-instrument: the vendored OTel graphql patcher does not fire on 17', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ // The vendored OTel path (origin `auto.graphql.otel.graphql`) must be inactive on 17+.
+ expect(spans.find(span => span.origin === 'auto.graphql.otel.graphql')).toBeUndefined();
+ // ...while the diagnostics-channel path is active.
+ expect(spans.find(span => span.origin === 'auto.graphql.diagnostic_channel')).toBeDefined();
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('never leaks raw inline literal values into graphql.document', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ for (const span of spans) {
+ const document = span.data?.['graphql.document'];
+ if (typeof document === 'string') {
+ expect(document).not.toContain('secret@example.com');
+ }
+ }
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('flags the execute span as errored when a resolver throws', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ const boomSpan = spans.find(span => span.description === 'query Boom');
+ expect(boomSpan).toBeDefined();
+ expect(boomSpan?.status).toBe('internal_error');
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('parents the execute span to the surrounding transaction', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ const executeSpan = spans.find(span => span.description === 'query GetUser');
+ expect(executeSpan).toBeDefined();
+ expect(executeSpan?.parent_span_id).toBe(event.contexts?.trace?.span_id);
+ },
+ })
+ .start()
+ .completed();
+ });
+ },
+ { additionalDependencies: { graphql: '^17' } },
+ );
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/instrument-disabled.mjs

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ integrations: [Sentry.graphqlIntegration({ useOperationNameForRootSpan: false })],
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/scenario-disabled.mjs

@@ -0,0 +1,21 @@
+import * as Sentry from '@sentry/node';
+import { GraphQLObjectType, GraphQLSchema, GraphQLString, graphql } from 'graphql';
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan({ name: 'Test Transaction', op: 'transaction' }, async () => {
+ await graphql({ schema, source: 'query GetHello { hello }' });
+ });
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/scenario-multiple.mjs

@@ -0,0 +1,23 @@
+import * as Sentry from '@sentry/node';
+import { GraphQLObjectType, GraphQLSchema, GraphQLString, graphql } from 'graphql';
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ world: { type: GraphQLString, resolve: () => 'hello' },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan({ name: 'Test Transaction', op: 'transaction' }, async () => {
+ await graphql({ schema, source: 'query GetWorld { world }' });
+ await graphql({ schema, source: 'query GetHello { hello }' });
+ });
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/instrument.mjs

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ integrations: [Sentry.graphqlIntegration({ ignoreResolveSpans: false })],
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/scenario.mjs

@@ -0,0 +1,40 @@
+import * as Sentry from '@sentry/node';
+import { graphql, GraphQLInt, GraphQLNonNull, GraphQLObjectType, GraphQLSchema, GraphQLString } from 'graphql';
+
+// Built programmatically (not via `buildSchema(sdl)`) so no `graphql:parse` fires at module load.
+const UserType = new GraphQLObjectType({
+ name: 'User',
+ // `name` has no resolver, so it uses graphql's default property resolver (a "trivial" resolve).
+ fields: { name: { type: GraphQLString } },
+});
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ user: {
+ type: UserType,
+ args: { id: { type: new GraphQLNonNull(GraphQLInt) } },
+ resolve: (_, { id }) => ({ name: `user-${id}` }),
+ },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan(
+ {
+ name: 'Test Transaction',
+ op: 'transaction',
+ },
+ async () => {
+ await graphql({ schema, source: '{ hello }' });
+ await graphql({ schema, source: 'query GetUser { user(id: 1) { name } }' });
+ },
+ );
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/resolvers/test.ts

@@ -0,0 +1,62 @@
+import { afterAll, expect } from 'vitest';
+import { conditionalTest } from '../../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../../utils/runner';
+
+// With `ignoreResolveSpans: false`, the channel path also subscribes `graphql:resolve` and emits a
+// span per non-trivial field resolver. `ignoreTrivialResolveSpans` defaults to true, so graphql's
+// default property resolver (the `name` field) is skipped. graphql 17 requires Node >= 22.
+conditionalTest({ min: 22 })('GraphQL tracing channel Test > resolve spans', () => {
+ afterAll(() => {
+ cleanupChildProcesses();
+ });
+
+ const expectedResolveSpan = (path: string, fieldName: string, parentName: string) =>
+ expect.objectContaining({
+ description: `graphql.resolve ${path}`,
+ op: 'graphql',
+ origin: 'auto.graphql.diagnostic_channel',
+ data: expect.objectContaining({
+ 'graphql.field.name': fieldName,
+ 'graphql.field.path': path,
+ 'graphql.parent.name': parentName,
+ }),
+ });
+
+ const EXPECTED_TRANSACTION = {
+ // Root span renamed with the (sorted) operation names. useOperationNameForRootSpan defaults to true.
+ transaction: 'Test Transaction (query, query GetUser)',
+ spans: expect.arrayContaining([
+ expect.objectContaining({ description: 'query', op: 'graphql' }),
+ expect.objectContaining({ description: 'query GetUser', op: 'graphql' }),
+ expectedResolveSpan('hello', 'hello', 'Query'),
+ expectedResolveSpan('user', 'user', 'Query'),
+ ]),
+ };
+
+ createEsmAndCjsTests(
+ __dirname,
+ 'scenario.mjs',
+ 'instrument.mjs',
+ (createTestRunner, test) => {
+ test('emits resolver spans when ignoreResolveSpans is false', async () => {
+ await createTestRunner().expect({ transaction: EXPECTED_TRANSACTION }).start().completed();
+ });
+
+ test('skips the default property resolver (trivial resolve) by default', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ // `user.name` uses graphql's default property resolver, so no span is emitted for it.
+ expect(spans.find(span => span.description === 'graphql.resolve user.name')).toBeUndefined();
+ // ...but the user-defined resolvers do produce spans.
+ expect(spans.find(span => span.description === 'graphql.resolve user')).toBeDefined();
+ },
+ })
+ .start()
+ .completed();
+ });
+ },
+ { additionalDependencies: { graphql: '^17' } },
+ );
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/scenario.mjs

@@ -0,0 +1,71 @@
+import * as Sentry from '@sentry/node';
+import {
+ graphql,
+ GraphQLBoolean,
+ GraphQLInt,
+ GraphQLNonNull,
+ GraphQLObjectType,
+ GraphQLSchema,
+ GraphQLString,
+} from 'graphql';
+
+// Build the schema programmatically rather than via `buildSchema(sdl)`: the SDL form parses at module
+// load, which would publish a `graphql:parse` event outside any transaction (an orphan span).
+const UserType = new GraphQLObjectType({
+ name: 'User',
+ fields: { name: { type: GraphQLString } },
+});
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ user: {
+ type: UserType,
+ args: { id: { type: new GraphQLNonNull(GraphQLInt) } },
+ resolve: (_, { id }) => ({ name: `user-${id}` }),
+ },
+ boom: {
+ type: GraphQLString,
+ resolve: () => {
+ throw new Error('resolver failed');
+ },
+ },
+ },
+ }),
+ mutation: new GraphQLObjectType({
+ name: 'Mutation',
+ fields: {
+ login: {
+ type: GraphQLBoolean,
+ args: { email: { type: new GraphQLNonNull(GraphQLString) } },
+ resolve: (_, { email }) => Boolean(email),
+ },
+ },
+ }),
+});
+
+async function run() {
+ // Let the integration's deferred channel subscription and OpenTelemetry's async-context setup
+ // finish before issuing operations. In a real server graphql runs per-request, long after init;
+ // here it would otherwise race init within the same tick.
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan(
+ {
+ name: 'Test Transaction',
+ op: 'transaction',
+ },
+ async () => {
+ await graphql({ schema, source: '{ hello }' });
+ await graphql({ schema, source: 'query GetUser { user(id: 42) { name } }' });
+ // Inline literal carries a value, to assert it is redacted out of `graphql.document`.
+ await graphql({ schema, source: 'mutation Login { login(email: "secret@example.com") }' });
+ // A resolver throw surfaces as `result.errors`, which must flag the execute span as errored.
+ await graphql({ schema, source: 'query Boom { boom }' });
+ },
+ );
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/test.ts

@@ -0,0 +1,116 @@
+import { afterAll, expect } from 'vitest';
+import { conditionalTest } from '../../../utils';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../utils/runner';
+
+// graphql >= 17 publishes its operations via `node:diagnostics_channel`, so the SDK subscribes to
+// those channels (`subscribeGraphqlDiagnosticChannels`) instead of the vendored OTel patcher. This
+// suite pins `^17` and asserts the diagnostics-channel path: graphql semconv attributes, redacted
+// document text, span relationships, and that the legacy OTel path does NOT also fire (no double
+// instrumentation). graphql 17 requires Node >= 22, so this suite is skipped on older Node.
+conditionalTest({ min: 22 })('GraphQL tracing channel Test', () => {
+ afterAll(() => {
+ cleanupChildProcesses();
+ });
+
+ const expectedExecuteSpan = (description: string, extraData: Record<string, unknown> = {}) =>
+ expect.objectContaining({
+ description,
+ op: 'graphql',
+ origin: 'auto.graphql.diagnostic_channel',
+ data: expect.objectContaining(extraData),
+ });
+
+ const EXPECTED_TRANSACTION = {
+ // Root span renamed with the (sorted) operation names. useOperationNameForRootSpan defaults to true.
+ transaction: 'Test Transaction (mutation Login, query, query Boom, query GetUser)',
+ spans: expect.arrayContaining([
+ expect.objectContaining({ description: 'graphql.parse', op: 'graphql' }),
+ expect.objectContaining({ description: 'graphql.validate', op: 'graphql' }),
+ // anonymous query -> span named after the operation type only
+ expectedExecuteSpan('query', { 'graphql.operation.type': 'query' }),
+ expectedExecuteSpan('query GetUser', {
+ 'graphql.operation.type': 'query',
+ 'graphql.operation.name': 'GetUser',
+ // the inline `42` literal is redacted out of the document
+ 'graphql.document': 'query GetUser { user(id: *) { name } }',
+ }),
+ expectedExecuteSpan('mutation Login', {
+ 'graphql.operation.type': 'mutation',
+ // the inline email literal must be redacted to `"*"`, so the raw value can never leak
+ 'graphql.document': 'mutation Login { login(email: "*") }',
+ }),
+ ]),
+ };
+
+ createEsmAndCjsTests(
+ __dirname,
+ 'scenario.mjs',
+ 'instrument.mjs',
+ (createTestRunner, test) => {
+ test('subscribes to graphql >= 17 diagnostics channels with graphql semconv attributes', async () => {
+ await createTestRunner().expect({ transaction: EXPECTED_TRANSACTION }).start().completed();
+ });
+
+ test('does not double-instrument: the vendored OTel graphql patcher does not fire on 17', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ // The vendored OTel path (origin `auto.graphql.otel.graphql`) must be inactive on 17+.
+ expect(spans.find(span => span.origin === 'auto.graphql.otel.graphql')).toBeUndefined();
+ // ...while the diagnostics-channel path is active.
+ expect(spans.find(span => span.origin === 'auto.graphql.diagnostic_channel')).toBeDefined();
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('never leaks raw inline literal values into graphql.document', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ for (const span of spans) {
+ const document = span.data?.['graphql.document'];
+ if (typeof document === 'string') {
+ expect(document).not.toContain('secret@example.com');
+ }
+ }
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('flags the execute span as errored when a resolver throws', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ const boomSpan = spans.find(span => span.description === 'query Boom');
+ expect(boomSpan).toBeDefined();
+ expect(boomSpan?.status).toBe('internal_error');
+ },
+ })
+ .start()
+ .completed();
+ });
+
+ test('parents the execute span to the surrounding transaction', async () => {
+ await createTestRunner()
+ .expect({
+ transaction: event => {
+ const spans = event.spans || [];
+ const executeSpan = spans.find(span => span.description === 'query GetUser');
+ expect(executeSpan).toBeDefined();
+ expect(executeSpan?.parent_span_id).toBe(event.contexts?.trace?.span_id);
+ },
+ })
+ .start()
+ .completed();
+ });
+ },
+ { additionalDependencies: { graphql: '^17' } },
+ );
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/instrument-disabled.mjs

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ integrations: [Sentry.graphqlIntegration({ useOperationNameForRootSpan: false })],
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/instrument.mjs

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+ dsn: 'https://public@dsn.ingest.sentry.io/1337',
+ release: '1.0',
+ tracesSampleRate: 1.0,
+ transport: loggingTransport,
+});

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/scenario-disabled.mjs

@@ -0,0 +1,21 @@
+import * as Sentry from '@sentry/node';
+import { GraphQLObjectType, GraphQLSchema, GraphQLString, graphql } from 'graphql';
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan({ name: 'Test Transaction', op: 'transaction' }, async () => {
+ await graphql({ schema, source: 'query GetHello { hello }' });
+ });
+}
+
+run();

dev-packages/node-integration-tests/suites/tracing/graphql-tracing-channel/useOperationNameForRootSpan/scenario-multiple.mjs

@@ -0,0 +1,23 @@
+import * as Sentry from '@sentry/node';
+import { GraphQLObjectType, GraphQLSchema, GraphQLString, graphql } from 'graphql';
+
+const schema = new GraphQLSchema({
+ query: new GraphQLObjectType({
+ name: 'Query',
+ fields: {
+ hello: { type: GraphQLString, resolve: () => 'world' },
+ world: { type: GraphQLString, resolve: () => 'hello' },
+ },
+ }),
+});
+
+async function run() {
+ await new Promise(resolve => setTimeout(resolve, 100));
+
+ await Sentry.startSpan({ name: 'Test Transaction', op: 'transaction' }, async () => {
+ await graphql({ schema, source: 'query GetWorld { world }' });
+ await graphql({ schema, source: 'query GetHello { hello }' });
+ });
+}
+
+run();