[APPSEC-56188] Replace Scope with Context

[Strech]

What does this PR do?

Replace irresponsible class AppSec::Scope with AppSec::Context and move some functionality into it.

Motivation:

In order to implement RASP/WAF telemetry and metrics we need to adjust the domain of the AppSec. The main point - AppSec::Context represents request context and hides complexity of the security engine calls (and gathering statistics) from the instrumentation.

You will see some obvious issues with existing code because of that change, but that's the plan. We move slowly with a guaranteed compatibility.

Change log entry

No.

Additional Notes:

This is the first PR which establishes the base to develop metrics collection. In this PR introduces as minimum as possible changes to stay compatible, but move forward.

How to test the change?

CI (specifically systems tests) should be enough.

[datadog-datadog-prod-us1]

Datadog Report

Branch report: appsec-56188-replace-scope-with-context
Commit report: 4c768f4
Test service: dd-trace-rb

❌ 12 Failed (0 Known Flaky), 22186 Passed, 1476 Skipped, 4m 51.62s Total Time

❌ Failed Tests (12)

This report shows up to 5 failed tests.

• Datadog::AppSec::Contrib::GraphQL::Reactive::Multiplex.subscribe all addresses have been published does call the waf context with the right arguments - rspec - Details

  Expand for error

   the Datadog::AppSec::Context class does not implement the instance method: run
   
   Failure/Error:
     expect(context).to receive(:run).with(
       { 'graphql.server.all_resolvers' => expected_arguments },
       {},
       Datadog.configuration.appsec.waf_timeout
     ).and_return(waf_result)
   
     the Datadog::AppSec::Context class does not implement the instance method: run
   ...
  

• Datadog::AppSec::Contrib::GraphQL::Reactive::Multiplex.subscribe behaves like waf result is a match yields result and blocking action. The publish method catches the resul as well - rspec - Details

  Expand for error

   #<InstanceDouble(Datadog::AppSec::Context) (anonymous)> received unexpected message :[] with (:trace)
   
   Failure/Error: ::GraphQL::Execution::Multiplex.new(schema: schema, queries: queries, context: context, max_complexity: nil)
     #<InstanceDouble(Datadog::AppSec::Context) (anonymous)> received unexpected message :[] with (:trace)
   Shared Example Group: "waf result" called from ./spec/datadog/appsec/contrib/graphql/reactive/multiplex_spec.rb:61
   /usr/local/bundle/gems/graphql-2.3.6/lib/graphql/execution/multiplex.rb:35:in \`initialize'
   ./spec/datadog/tracing/contrib/graphql/support/application.rb:54:in \`block in <main>'
   ./spec/datadog/appsec/contrib/graphql/reactive/multiplex_spec.rb:62:in \`block in <main>'
   ./spec/datadog/appsec/reactive/shared_examples.rb:25:in \`block in <main>'
   ./spec/datadog/tracing/contrib/support/tracer_helpers.rb:96:in \`block in TracerHelpers'
   ...
  

• Datadog::AppSec::Contrib::GraphQL::Reactive::Multiplex.subscribe behaves like waf result is a match yields result and no blocking action - rspec - Details

  Expand for error

   #<InstanceDouble(Datadog::AppSec::Context) (anonymous)> received unexpected message :[] with (:trace)
   
   Failure/Error: ::GraphQL::Execution::Multiplex.new(schema: schema, queries: queries, context: context, max_complexity: nil)
     #<InstanceDouble(Datadog::AppSec::Context) (anonymous)> received unexpected message :[] with (:trace)
   Shared Example Group: "waf result" called from ./spec/datadog/appsec/contrib/graphql/reactive/multiplex_spec.rb:61
   /usr/local/bundle/gems/graphql-2.3.6/lib/graphql/execution/multiplex.rb:35:in \`initialize'
   ./spec/datadog/tracing/contrib/graphql/support/application.rb:54:in \`block in <main>'
   ./spec/datadog/appsec/contrib/graphql/reactive/multiplex_spec.rb:62:in \`block in <main>'
   ./spec/datadog/appsec/reactive/shared_examples.rb:13:in \`block in <main>'
   ./spec/datadog/tracing/contrib/support/tracer_helpers.rb:96:in \`block in TracerHelpers'
   ...
  

• Datadog::AppSec::Contrib::GraphQL::Reactive::Multiplex.subscribe behaves like waf result is invalid_call does not yield - rspec - Details

  Expand for error

   #<InstanceDouble(Datadog::AppSec::Context) (anonymous)> received unexpected message :[] with (:trace)
   
   Failure/Error: ::GraphQL::Execution::Multiplex.new(schema: schema, queries: queries, context: context, max_complexity: nil)
     #<InstanceDouble(Datadog::AppSec::Context) (anonymous)> received unexpected message :[] with (:trace)
   Shared Example Group: "waf result" called from ./spec/datadog/appsec/contrib/graphql/reactive/multiplex_spec.rb:61
   /usr/local/bundle/gems/graphql-2.3.6/lib/graphql/execution/multiplex.rb:35:in \`initialize'
   ./spec/datadog/tracing/contrib/graphql/support/application.rb:54:in \`block in <main>'
   ./spec/datadog/appsec/contrib/graphql/reactive/multiplex_spec.rb:62:in \`block in <main>'
   ./spec/datadog/appsec/reactive/shared_examples.rb:49:in \`block in <main>'
   ./spec/datadog/tracing/contrib/support/tracer_helpers.rb:96:in \`block in TracerHelpers'
   ...
  

• Datadog::AppSec::Contrib::GraphQL::Reactive::Multiplex.subscribe behaves like waf result is invalid_flow does not yield - rspec - Details

  Expand for error

   #<InstanceDouble(Datadog::AppSec::Context) (anonymous)> received unexpected message :[] with (:trace)
   
   Failure/Error: ::GraphQL::Execution::Multiplex.new(schema: schema, queries: queries, context: context, max_complexity: nil)
     #<InstanceDouble(Datadog::AppSec::Context) (anonymous)> received unexpected message :[] with (:trace)
   Shared Example Group: "waf result" called from ./spec/datadog/appsec/contrib/graphql/reactive/multiplex_spec.rb:61
   /usr/local/bundle/gems/graphql-2.3.6/lib/graphql/execution/multiplex.rb:35:in \`initialize'
   ./spec/datadog/tracing/contrib/graphql/support/application.rb:54:in \`block in <main>'
   ./spec/datadog/appsec/contrib/graphql/reactive/multiplex_spec.rb:62:in \`block in <main>'
   ./spec/datadog/appsec/reactive/shared_examples.rb:73:in \`block in <main>'
   ./spec/datadog/tracing/contrib/support/tracer_helpers.rb:96:in \`block in TracerHelpers'
   ...
  

[pr-commenter]

Benchmarks

Benchmark execution time: 2025-01-10 16:44:21

Comparing candidate commit 4c768f4 in PR branch appsec-56188-replace-scope-with-context with baseline commit 12add3a in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 31 metrics, 2 unstable metrics.