feat(graphql): Apply outgoing response body policy

adinauer · claude · adinauer · commit fa5bc9887561 · 2026-07-17T15:17:50.000+02:00
Use the Data Collection outgoing response body decision when attaching GraphQL execution results. Preserve the sendDefaultPii and maxRequestBodySize gate when Data Collection is absent.

Co-Authored-By: Claude &lt;noreply@anthropic.com&gt;
diff --git a/sentry-graphql-core/src/main/java/io/sentry/graphql/ExceptionReporter.java b/sentry-graphql-core/src/main/java/io/sentry/graphql/ExceptionReporter.java
@@ -62,9 +62,10 @@ private boolean isAllowedToAttachRequestBody(final @NotNull IScopes scopes) {
   }
 
   private boolean isAllowedToAttachResponseBody(final @NotNull IScopes scopes) {
-    final @NotNull SentryOptions options = scopes.getOptions();
-    return options.isSendDefaultPii()
-        && !SentryOptions.RequestSize.NONE.equals(options.getMaxRequestBodySize());
+    return scopes
+        .getOptions()
+        .getDataCollectionResolver()
+        .isOutgoingResponseBodyWithLegacyBodyGate();
   }
 
   private void setRequestDetailsOnEvent(
diff --git a/sentry-graphql-core/src/test/kotlin/io/sentry/graphql/ExceptionReporterTest.kt b/sentry-graphql-core/src/test/kotlin/io/sentry/graphql/ExceptionReporterTest.kt
@@ -12,6 +12,7 @@ import graphql.schema.GraphQLObjectType
 import graphql.schema.GraphQLScalarType
 import graphql.schema.GraphQLSchema
 import io.sentry.Hint
+import io.sentry.HttpBodyType
 import io.sentry.IScope
 import io.sentry.IScopes
 import io.sentry.KeyValueCollectionBehavior
@@ -253,6 +254,124 @@ class ExceptionReporterTest {
       )
   }
 
+  @Test
+  fun `legacy options can disable outgoing response data`() {
+    val options = SentryOptions().also { it.maxRequestBodySize = SentryOptions.RequestSize.ALWAYS }
+    val exceptionReporter = fixture.getSut(options)
+
+    exceptionReporter.captureThrowable(
+      fixture.exception,
+      ExceptionReporter.ExceptionDetails(
+        fixture.scopes,
+        fixture.instrumentationExecutionParameters,
+        false,
+      ),
+      fixture.executionResult,
+    )
+
+    verify(fixture.scopes)
+      .captureEvent(
+        org.mockito.kotlin.check { assertNull(it.contexts.response) },
+        any<Hint>(),
+      )
+  }
+
+  @Test
+  fun `legacy request body size can disable outgoing response data`() {
+    val options = SentryOptions().also { it.isSendDefaultPii = true }
+    val exceptionReporter = fixture.getSut(options)
+
+    exceptionReporter.captureThrowable(
+      fixture.exception,
+      ExceptionReporter.ExceptionDetails(
+        fixture.scopes,
+        fixture.instrumentationExecutionParameters,
+        false,
+      ),
+      fixture.executionResult,
+    )
+
+    verify(fixture.scopes)
+      .captureEvent(
+        org.mockito.kotlin.check { assertNull(it.contexts.response) },
+        any<Hint>(),
+      )
+  }
+
+  @Test
+  fun `data collection response ignores legacy request body options`() {
+    val options =
+      SentryOptions().also {
+        it.maxRequestBodySize = SentryOptions.RequestSize.NONE
+        it.dataCollection.httpBodies = setOf(HttpBodyType.OUTGOING_RESPONSE)
+      }
+    val exceptionReporter = fixture.getSut(options)
+
+    exceptionReporter.captureThrowable(
+      fixture.exception,
+      ExceptionReporter.ExceptionDetails(
+        fixture.scopes,
+        fixture.instrumentationExecutionParameters,
+        false,
+      ),
+      fixture.executionResult,
+    )
+
+    verify(fixture.scopes)
+      .captureEvent(
+        org.mockito.kotlin.check { assertNotNull(it.contexts.response?.data) },
+        any<Hint>(),
+      )
+  }
+
+  @Test
+  fun `data collection can disable outgoing response data`() {
+    val options = fixture.defaultOptions.also { it.dataCollection.httpBodies = emptySet() }
+    val exceptionReporter = fixture.getSut(options)
+
+    exceptionReporter.captureThrowable(
+      fixture.exception,
+      ExceptionReporter.ExceptionDetails(
+        fixture.scopes,
+        fixture.instrumentationExecutionParameters,
+        false,
+      ),
+      fixture.executionResult,
+    )
+
+    verify(fixture.scopes)
+      .captureEvent(
+        org.mockito.kotlin.check { assertNull(it.contexts.response) },
+        any<Hint>(),
+      )
+  }
+
+  @Test
+  fun `data collection namespace default enables outgoing response data`() {
+    val options =
+      SentryOptions().also {
+        it.maxRequestBodySize = SentryOptions.RequestSize.NONE
+        it.dataCollection.cookies = KeyValueCollectionBehavior.off()
+      }
+    val exceptionReporter = fixture.getSut(options)
+
+    exceptionReporter.captureThrowable(
+      fixture.exception,
+      ExceptionReporter.ExceptionDetails(
+        fixture.scopes,
+        fixture.instrumentationExecutionParameters,
+        false,
+      ),
+      fixture.executionResult,
+    )
+
+    verify(fixture.scopes)
+      .captureEvent(
+        org.mockito.kotlin.check { assertNotNull(it.contexts.response?.data) },
+        any<Hint>(),
+      )
+  }
+
   @Test
   fun `does not attach query or variables if sendDefaultPii is false`() {
     val exceptionReporter =
diff --git a/sentry/api/sentry.api b/sentry/api/sentry.api
@@ -435,6 +435,7 @@ public final class io/sentry/DataCollectionResolver {
 	public fun isIncomingResponseBody ()Z
 	public fun isOutgoingRequestBody ()Z
 	public fun isOutgoingResponseBody ()Z
+	public fun isOutgoingResponseBodyWithLegacyBodyGate ()Z
 	public fun isUserInfo ()Z
 }
 
diff --git a/sentry/src/main/java/io/sentry/DataCollectionResolver.java b/sentry/src/main/java/io/sentry/DataCollectionResolver.java
@@ -104,6 +104,10 @@ public boolean isOutgoingResponseBody() {
     return isHttpBodyEnabled(HttpBodyType.OUTGOING_RESPONSE, options.isSendDefaultPii());
   }
 
+  public boolean isOutgoingResponseBodyWithLegacyBodyGate() {
+    return isHttpBodyEnabled(HttpBodyType.OUTGOING_RESPONSE, isLegacyGraphqlBodyEnabled());
+  }
+
   private boolean isLegacyGraphqlBodyEnabled() {
     return options.isSendDefaultPii()
         && !SentryOptions.RequestSize.NONE.equals(options.getMaxRequestBodySize());
diff --git a/sentry/src/test/java/io/sentry/DataCollectionResolverTest.kt b/sentry/src/test/java/io/sentry/DataCollectionResolverTest.kt
@@ -128,6 +128,37 @@ class DataCollectionResolverTest {
     assertThat(options.dataCollectionResolver.isGraphqlVariablesWithLegacyBodyGate).isTrue()
   }
 
+  @Test
+  fun `outgoing response legacy body variant preserves the legacy size gate`() {
+    val options =
+      SentryOptions().apply {
+        isSendDefaultPii = true
+        maxRequestBodySize = SentryOptions.RequestSize.NONE
+      }
+
+    assertThat(options.dataCollectionResolver.isOutgoingResponseBodyWithLegacyBodyGate).isFalse()
+
+    options.maxRequestBodySize = SentryOptions.RequestSize.SMALL
+
+    assertThat(options.dataCollectionResolver.isOutgoingResponseBodyWithLegacyBodyGate).isTrue()
+  }
+
+  @Test
+  fun `outgoing response legacy body variant uses data collection when namespace is explicit`() {
+    val options =
+      SentryOptions().apply {
+        isSendDefaultPii = false
+        maxRequestBodySize = SentryOptions.RequestSize.NONE
+        dataCollection.graphql.setDocument(true)
+      }
+
+    assertThat(options.dataCollectionResolver.isOutgoingResponseBodyWithLegacyBodyGate).isTrue()
+
+    options.dataCollection.httpBodies = emptySet()
+
+    assertThat(options.dataCollectionResolver.isOutgoingResponseBodyWithLegacyBodyGate).isFalse()
+  }
+
   @Test
   fun `GraphQL legacy body variants ignore the size option when namespace is explicit`() {
     val options =

Original file line number	Diff line number	Diff line change
`@@ -62,9 +62,10 @@ private boolean isAllowedToAttachRequestBody(final @NotNull IScopes scopes) {`
`62`	`62`	`}`
`63`	`63`
`64`	`64`	`private boolean isAllowedToAttachResponseBody(final @NotNull IScopes scopes) {`
`65`		`- final @NotNull SentryOptions options = scopes.getOptions();`
`66`		`- return options.isSendDefaultPii()`
`67`		`- && !SentryOptions.RequestSize.NONE.equals(options.getMaxRequestBodySize());`
	`65`	`+ return scopes`
	`66`	`+ .getOptions()`
	`67`	`+ .getDataCollectionResolver()`
	`68`	`+ .isOutgoingResponseBodyWithLegacyBodyGate();`
`68`	`69`	`}`
`69`	`70`
`70`	`71`	`private void setRequestDetailsOnEvent(`
Original file line number	Diff line number	Diff line change
`@@ -435,6 +435,7 @@ public final class io/sentry/DataCollectionResolver {`
`435`	`435`	`public fun isIncomingResponseBody ()Z`
`436`	`436`	`public fun isOutgoingRequestBody ()Z`
`437`	`437`	`public fun isOutgoingResponseBody ()Z`
	`438`	`+ public fun isOutgoingResponseBodyWithLegacyBodyGate ()Z`
`438`	`439`	`public fun isUserInfo ()Z`
`439`	`440`	`}`
`440`	`441`