Expand appsec integrations to Laminas Framework by estringana · Pull Request #3716 · DataDog/dd-trace-php

estringana · 2026-03-20T10:28:04Z

Add AAP support to Laminas framework

This PR introduces AAP support to the Laminas framework, enabling improved observability and authentication-related event tracking.

Features added

Provide http.route
Captures and exposes the resolved route for incoming requests.
Collect endpoints at startup
Gathers and registers available endpoints during application bootstrap.
Login success event
Emits an event when a user successfully authenticates.
Login failure event
Emits an event when authentication fails.
Authenticated request events
Tracks requests performed by authenticated users.
Collect path parameters
Extracts and includes route path parameters in the collected data.

Limitations / Missing features

Signup events
Not implemented because Laminas does not provide a built-in signup mechanism. This functionality is application-specific and must be implemented by developers if needed.

Reviewer checklist

Test coverage seems ok.
Appropriate labels assigned.

datadog-prod-us1-4 · 2026-03-23T11:30:05Z

✨ Fix all issues with BitsAI or with Cursor

⚠️ Warnings

❄️ 2 New flaky tests detected

Endpoints are sent() from com.datadog.appsec.php.integration.Laminas33Tests (Fix with Cursor)
Assertion failed: 

assert endpoints.size() == 13
       |         |      |
       []        0      false

Assertion failed: 

assert endpoints.size() == 13
       |         |      |
...
path params trigger WAF block and laminas http route template() from com.datadog.appsec.php.integration.Laminas33Tests (Fix with Cursor)

ℹ️ Info

No other issues found (see more)

🧪 All tests passed

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 60.65% (-0.05%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 34e06b6 | Docs | Datadog PR Page | Give us feedback!}

codecov-commenter · 2026-03-23T11:32:11Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.74%. Comparing base (78ecdb0) to head (d2866e8).
⚠️ Report is 16 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3716      +/-   ##
==========================================
- Coverage   68.81%   68.74%   -0.08%     
==========================================
  Files         166      166              
  Lines       19030    19030              
  Branches     1797     1797              
==========================================
- Hits        13096    13082      -14     
- Misses       5121     5135      +14     
  Partials      813      813

Flag	Coverage Δ
helper-rust-integration	`78.82% <ø> (-0.03%)`	⬇️
helper-rust-unit	`49.17% <ø> (-0.20%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 4 files with indirect coverage changes

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 78ecdb0...d2866e8. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

pr-commenter · 2026-03-23T13:39:02Z

Benchmarks [ tracer ]

Benchmark execution time: 2026-04-14 15:46:16

Comparing candidate commit a35cd52 in PR branch estringana/add-laminas-appsec-integration with baseline commit df43587 in branch master.

Found 0 performance improvements and 6 performance regressions! Performance is the same for 188 metrics, 0 unstable metrics.

scenario:MessagePackSerializationBench/benchMessagePackSerialization-opcache

🟥 execution_time [+3.785µs; +5.055µs] or [+3.818%; +5.100%]

scenario:PDOBench/benchPDOOverhead-opcache

🟥 execution_time [+8.038µs; +9.869µs] or [+3.365%; +4.131%]

scenario:PDOBench/benchPDOOverheadWithDBM-opcache

🟥 execution_time [+7.608µs; +9.649µs] or [+3.175%; +4.027%]

scenario:PHPRedisBench/benchRedisOverhead

🟥 execution_time [+33.225µs; +41.437µs] or [+3.496%; +4.360%]

scenario:SamplingRuleMatchingBench/benchRegexMatching1

🟥 execution_time [+31.682ns; +109.118ns] or [+2.139%; +7.366%]

scenario:SamplingRuleMatchingBench/benchRegexMatching3

🟥 execution_time [+44.495ns; +120.705ns] or [+2.997%; +8.131%]

github-actions · 2026-03-23T14:28:29Z

Snapshots difference summary

The following differences have been observed in committed snapshots. It is meant to help the reviewer.
The diff is simplistic, so please check some files anyway while we improve it.

If you need to update snapshots, please refer to CONTRIBUTING.md

cataphract · 2026-04-16T09:43:50Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 140b8c4617

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-16T09:52:39Z

+                $adapter = $hook->args[0] ?? null;
+                $userLogin = null;
+
+                if ($adapter && method_exists($adapter, 'getIdentity')) {
+                    $userLogin = $adapter->getIdentity();


Derive login from configured adapter on auth failures

The failure path only inspects $hook->args[0] for the adapter, so applications that use setAdapter($adapter) followed by authenticate() (no argument) emit login-failure events without a user identifier. That drops automated identification data for a common Laminas authentication flow and makes failure telemetry much less useful.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-04-16T09:52:39Z

+                    if ($event->getRouteMatch() === null) {
+                        return;
+                    }


Register endpoints even when route match is null

Endpoint collection is gated on getRouteMatch() !== null, so requests that route to 404/no-match paths skip collection entirely. If early traffic is mostly unmatched (or an app primarily serves unmatched probes), are_endpoints_collected() can remain false and endpoints may never be registered despite the router being available.

Useful? React with 👍 / 👎.

cataphract · 2026-04-23T17:34:53Z

+        if ($route instanceof \Laminas\Router\Http\Part) {
+            $base = self::partRouteBaseTemplate($route);
+            $base = $base ?? '';
+            if (!$hasChild) {
+                return $base !== '' ? $base : null;
+            }
+            $child = self::httpRouteTemplateFromNamedRouteStack($route, $segments[1]);
+            if ($child === null) {
+                return $base !== '' ? $base : null;
+            }
+
+            return $base . $child;
+        }
+
+        if ($route instanceof \Laminas\Router\Http\TreeRouteStack && $hasChild) {
+            return self::httpRouteTemplateFromNamedRouteStack($route, $segments[1]);
+        }
+
+        if ($hasChild) {
+            return self::httpRouteTemplateFromMatchedRoute($route, null);
+        }


Wouldn't this cause the route name to be set multiple times? For the individual parts and for the high level router? I think you should not call this method unless it's the top level.

cataphract · 2026-04-23T18:01:22Z

+        return $out;
+    }
+
+    private static function walkRouteStackCollectEndpointRows(


Part children are only populated on first match(). The onRoute hook fires after one path through the route tree is matched, so only the subtree along the matched path is materialized. You need to force this materialization.

See the in the other comment when I added extra routes with child routes. Those are not found by the Endpoints are sent test.

estringana force-pushed the estringana/add-laminas-appsec-integration branch from 820057d to eae5325 Compare March 23, 2026 11:22

estringana added 8 commits April 13, 2026 12:38

Add ato appsec events to Laminas

bb07192

Add path_params to laminas

96dc760

Fix laminas tests

da58311

Add http.route

cc8c1f8

Add appsec integration test

6bc7031

Update rest laminas snapshots

9f6b905

Add endpoint collection to Laminas

a00defc

Extract http.route instead of generating it

651e235

estringana force-pushed the estringana/add-laminas-appsec-integration branch from d2866e8 to 651e235 Compare April 13, 2026 10:39

Remove http.route from laminas

9b662b3

estringana force-pushed the estringana/add-laminas-appsec-integration branch from c199b10 to 9b662b3 Compare April 13, 2026 14:28

estringana added 7 commits April 13, 2026 17:33

Fix routes generation

a609187

Refactor Laminas integration

e459f8f

Fix integration tests

a35cd52

Improving login tracking events

a8835ae

Add http.route to laminas

ce653bd

Remove http.route from rest endpoints

efba4e7

Fix laminas rest

140b8c4

estringana marked this pull request as ready for review April 15, 2026 13:24

estringana requested review from a team as code owners April 15, 2026 13:24

chatgpt-codex-connector Bot reviewed Apr 16, 2026

View reviewed changes

cataphract requested changes Apr 23, 2026

View reviewed changes

estringana added 5 commits April 30, 2026 16:44

Amend dynamic routes on Laminas

e0b3991

Filter out system path params

2ac3a5d

Expand php supported versions

59d28f1

Fix extracting http verb

0508196

Avoid calling twice to waf on auth requests

b6e2fdc

estringana force-pushed the estringana/add-laminas-appsec-integration branch from 979e638 to b6e2fdc Compare May 4, 2026 15:36

estringana added 4 commits May 5, 2026 12:05

Revert check for multiple auth calls

3b4aca1

Amend issue with getting routes

d9144c3

Improve collecting routes

ed63020

Avoid pushing partial addresses

34e06b6

Conversation

estringana commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Add AAP support to Laminas framework

Features added

Limitations / Missing features

Reviewer checklist

Uh oh!

datadog-prod-us1-4 Bot commented Mar 23, 2026 • edited by datadog-prod-us1-3 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

ℹ️ Info

Uh oh!

codecov-commenter commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

pr-commenter Bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks [ tracer ]

scenario:MessagePackSerializationBench/benchMessagePackSerialization-opcache

scenario:PDOBench/benchPDOOverhead-opcache

scenario:PDOBench/benchPDOOverheadWithDBM-opcache

scenario:PHPRedisBench/benchRedisOverhead

scenario:SamplingRuleMatchingBench/benchRegexMatching1

scenario:SamplingRuleMatchingBench/benchRegexMatching3

Uh oh!

github-actions Bot commented Mar 23, 2026

Snapshots difference summary

Uh oh!

cataphract commented Apr 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cataphract Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cataphract Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

estringana commented Mar 20, 2026 •

edited

Loading

datadog-prod-us1-4 Bot commented Mar 23, 2026 •

edited by datadog-prod-us1-3 Bot

Loading

codecov-commenter commented Mar 23, 2026 •

edited

Loading

pr-commenter Bot commented Mar 23, 2026 •

edited

Loading