feat(data-collection): Guard user collection under data_collection.user_info

Author: sl0thentr0py

sentry-rails/lib/sentry/rails/active_job.rb

@@ -37,7 +37,7 @@ def serialize
             sentry_data["trace_propagation_headers"] = headers if headers && !headers.empty?
           end
 
-          if Sentry.configuration.send_default_pii
+          if Sentry.configuration.data_collection.user_info
             user = Sentry.get_current_scope.user
             allowed = user.transform_keys(&:to_s).slice(*USER_FIELDS_ALLOWLIST)
             sentry_data["user"] = allowed unless allowed.empty?

sentry-rails/spec/active_job/shared_examples/tracing/user_propagation.rb

@@ -113,4 +113,52 @@ def perform
       expect(consumer_transaction.user).to eq({})
     end
   end
+
+  context "data collection" do
+    context "when user_info is enabled" do
+      let(:configure_sentry) do
+        proc do |config|
+          config.traces_sample_rate = 1.0
+          config.data_collection.user_info = true
+        end
+      end
+
+      it "propagates user context to the consumer transaction" do
+        Sentry.set_user(full_user)
+
+        successful_job.perform_later
+        Sentry.set_user({})
+
+        drain
+
+        expect(consumer_transaction).not_to be_nil
+        expect(consumer_transaction.user).to eq(
+          id: "u1",
+          email: "alice@example.com",
+          username: "alice"
+        )
+      end
+    end
+
+    context "when user_info is disabled" do
+      let(:configure_sentry) do
+        proc do |config|
+          config.traces_sample_rate = 1.0
+          config.data_collection.user_info = false
+        end
+      end
+
+      it "does not propagate user context to the consumer transaction" do
+        Sentry.set_user(full_user)
+
+        successful_job.perform_later
+        Sentry.set_user({})
+
+        drain
+
+        expect(consumer_transaction).not_to be_nil
+        expect(consumer_transaction.user).to eq({})
+      end
+    end
+  end
 end

sentry-ruby/lib/sentry/event.rb

@@ -28,7 +28,7 @@ class Event
 
     MAX_MESSAGE_SIZE_IN_BYTES = 1024 * 8
 
-    SKIP_INSPECTION_ATTRIBUTES = [:@modules, :@stacktrace_builder, :@send_default_pii, :@trusted_proxies, :@rack_env_whitelist]
+    SKIP_INSPECTION_ATTRIBUTES = [:@modules, :@stacktrace_builder, :@send_default_pii, :@data_collection, :@trusted_proxies, :@rack_env_whitelist]
 
     include CustomInspection
 
@@ -74,6 +74,7 @@ def initialize(configuration:, integration_meta: nil, message: nil)
 
       # configuration options to help events process data
       @send_default_pii = configuration.send_default_pii
+      @data_collection = configuration.data_collection
       @trusted_proxies = configuration.trusted_proxies
       @stacktrace_builder = configuration.stacktrace_builder
       @rack_env_whitelist = configuration.rack_env_whitelist
@@ -103,7 +104,7 @@ def rack_env=(env)
       unless request || env.empty?
         add_request_interface(env)
 
-        user[:ip_address] ||= calculate_real_ip_from_rack(env) if @send_default_pii
+        user[:ip_address] ||= calculate_real_ip_from_rack(env) if @data_collection.user_info
 
         if request_id = Utils::RequestId.read_from(env)
           tags[:request_id] = request_id

sentry-ruby/spec/sentry/event_spec.rb

@@ -170,6 +170,30 @@
         end
       end
     end
+
+    context "data collection" do
+      it "does not auto-populate user information when user_info is disabled" do
+        Sentry.configuration.data_collection.user_info = false
+        Sentry.get_current_scope.apply_to_event(event)
+
+        expect(event.to_h[:user][:ip_address]).to be_nil
+      end
+
+      it "auto-populates user information when user_info is enabled" do
+        Sentry.configuration.data_collection.user_info = true
+        Sentry.get_current_scope.apply_to_event(event)
+
+        expect(event.to_h[:user][:ip_address]).to eq("2.2.2.2")
+      end
+
+      it "preserves explicitly set user data set on the scope even when user_info is disabled" do
+        Sentry.configuration.data_collection.user_info = false
+        Sentry.set_user(id: "user-1", username: "alice")
+        Sentry.get_current_scope.apply_to_event(event)
+
+        expect(event.to_h[:user]).to include(id: "user-1", username: "alice")
+      end
+    end
   end
 
   describe '#to_json_compatible' do