feat(config): update OpenTelemetry OTLP by foukou19 · Pull Request #164 · Decathlon/internal-developer-platform

foukou19 · 2026-10-05T09:42:03Z

PR Description

What this PR Provides

Webhook JWT_BEARER security: client_id_field now accepts any non-empty
claim name (client_id, sub, azp, email, or a custom claim) instead of
only azp or email.
Existing connectors using azp or email keep working without
reconfiguration.
Webhook NONE security: config is now optional. You can omit it, pass
null, or pass {}. A non-empty config is still rejected.
A missing configured claim in the incoming JWT now returns 401
(previously 403). A claim value outside client_id_values still returns
403.
The JWT validator logs the caller identity (webhook_jwt_caller) with the
result ACCEPTED or REJECTED.
OpenTelemetry: library-based setup (no Java agent) with OTLP export of traces
and metrics configured in application.yml.
OpenTelemetry: business attributes on webhook spans
(idp.webhook.identifier, idp.webhook.security.result,
idp.webhook.mapping.result) to ease debugging in Datadog.
Documentation updated in docs/src/concepts/webhooks.md.

Fixes

Review

The reviewer must double-check these points:

The reviewer has tested the feature
The reviewer has reviewed the implementation of the feature
The documentation has been updated
The feature implementation respects the Technical Doc / ADR previously produced
The Pull Request title has a ! after the type/scope to identify the breaking
change in the release note and ensure we will release a major version.

How to test

Initial state:
- A running idp-core instance.
- The product entity template and the product-mapping entity dynamic
  mapping exist.
- A JWT issuer exposing a public HTTPS JWKS endpoint.

JWT_BEARER with a client_id claim:

Create the connector with POST /api/v1/inbound_webhooks:

{
  "identifier": "product",
  "name": "product",
  "description": "product connector",
  "enabled": true,
  "mapping_identifiers": ["product-mapping"],
  "security": {
    "type": "JWT_BEARER",
    "config": {
      "jwks_uri": "xxx/ext/JWKS",
      "client_id_field": "client_id",
      "client_id_values": "C60ee4cXXXXXXXXXXXXXX8ae"
    }
  }
}

Call POST /webhooks/product with Authorization: Bearer <jwt>.
The JWT must contain
"client_id": "C60ee4cXXXXXXXXXXXXXX8ae.
Repeat with client_id_field set to email and azp to check there is
no regression.

Missing claim: call with a JWT without the configured claim.
Wrong value: call with a claim value not in client_id_values.
Missing header: call without the Authorization header.
NONE without config: create or update a webhook with
{"security": {"type": "NONE"}}, then with "config": null and
"config": {}.
NONE with config: send "config": {"a": "b"}.
Observability: set OTEL_EXPORTER_OTLP_ENDPOINT and call a webhook, then
check the trace attributes in Datadog.
Expected results:
- Valid configurations are accepted (201 on creation, 200 on update).
- Authenticated calls are processed and log
  webhook_jwt_caller ... result=ACCEPTED.
- Missing claim or missing header returns 401.
- Wrong claim value returns 403.
- NONE with a non-empty config returns 400.
- Spans carry the three idp.webhook.* attributes.

Breaking changes (if any)

Behavior modification of a component

Context of the Breaking Change

For JWT_BEARER, a JWT that does not contain the configured claim now returns
401 Unauthorized instead of 403 Forbidden.

Result of the Breaking Change

Callers or monitoring that relied on 403 for a missing claim must handle
401. A claim value that is present but not allowed still returns 403.

github-code-quality · 2026-10-05T12:29:14Z

Code Coverage Overview

Languages: Java

Java / code-coverage/jacoco

The overall line coverage in commit a0e304e in the feat/idp-core-observ... branch remains at 91%, unchanged from commit 211769e in the main branch.

Show a line coverage summary of the most impacted files.

File	`main` 211769e	`feat/idp-core-observ...` a0e304e	+/-
`com/decathlon/i...ationUtils.java`	87%	86%	-1%
`com/decathlon/i...nProcessor.java`	98%	98%	0%
`com/decathlon/i...okSecurity.java`	100%	100%	0%
`com/decathlon/i...ionService.java`	100%	100%	0%
`com/decathlon/i...tractDtoIn.java`	100%	100%	0%
`com/decathlon/i...hookMapper.java`	100%	100%	0%
`com/decathlon/i...yProcessor.java`	100%	100%	0%
`com/decathlon/i...yValidator.java`	87%	89%	+2%

_{Updated October 07, 2026 16:23 UTC}

Signed-off-by: foukou19 <ferial.oukoukas@decathlon.com>

Copilot

Copilot review overview

🟡 Changes recommended

Default startup and OTLP header configuration issues can prevent or misroute telemetry exports.

Review effort: Balanced
Findings: 2 · 2

Open (4)

Mapping results overwrite each other on the current span · New
Tracing defaults to enabled instead of remaining opt-in · New
Add coverage for omitted config normalization · New
Remove obsolete commented-out test · New

What changed in this PR

Updates OpenTelemetry export and webhook observability while broadening JWT claim support and allowing omitted configuration for unsecured webhooks.

Changes:

Adds OTLP tracing/metrics dependencies and configuration.
Adds webhook security and mapping trace attributes.
Supports custom JWT identity claims and optional NONE security configuration.

File	Description
`pom.xml`	Adds OpenTelemetry and Micrometer dependencies.
`src/main/resources/application.yml`	Configures OTLP exporters and Camel tracing.
`JwtBearerSecurityValidator.java`	Accepts custom identity claims.
`JwtBearerSecurityValidatorTest.java`	Tests custom JWT claims.
`SecurityProcessor.java`	Records webhook security trace attributes.
`IngestionProcessor.java`	Records ingestion mapping outcomes.
`InboundWebhookSecurityContractDtoIn.java`	Makes security config optional.
`WebhookSecurityValidationService.java`	Handles absent `NONE` configuration.
`WebhookSecurity.java`	Normalizes absent `NONE` configuration.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

  tracing:
    # Tracing is disabled by default and only enabled via environment variables (OTEL_TRACING_ENABLED).
-    enabled: false
+    enabled: ${OTEL_TRACING_ENABLED:true}


 public record InboundWebhookSecurityContractDtoIn(
    @NotBlank(message = WEBHOOK_CONNECTOR_SECURITY_TYPE_MANDATORY) String type,
-    @NotNull(message = WEBHOOK_CONNECTOR_SECURITY_CONFIG_MANDATORY) Map<String, String> config) {
+    Map<String, String> config) {


Copilot

Copilot review overview

🟡 Changes recommended

Telemetry defaults risk breaking unconfigured deployments, mapping results are lossy, and claimed JWT audit logging is missing.

Review effort: Balanced
Findings: 1 · 3 · 3

Open (7)

Missing safe defaults for new telemetry configuration placeholders · New
Mapping results overwrite the webhook span attribute · New
Add structured JWT caller outcome logging · New
Tracing defaults to enabled instead of remaining opt-in
Indent NONE tab content beneath its marker · New
Update deployment docs for management OTLP HTTP configuration · New
Add coverage for omitted config normalization

Resolved since last review (2)

Mapping results overwrite each other on the current span
Remove obsolete commented-out test

+        case null, default -> log.warn("Unsupported or null mapping action: {}", mapping.action());
+      }
+
+      Span.current().setAttribute(SPAN_ATTRIBUTE_MAPPING_RESULT, "SUCCESS");


+=== "NONE"
+
+```json
+{
+  "type": "NONE"
+}
+```
+
+For `NONE`, you can omit `config`, set it to `null`, or pass `{}`. Any non-empty `config` is rejected.


+    traces:
+      export:
+        url: ${OTEL_EXPORTER_OTLP_ENDPOINT}
+        protocol: ${OTEL_EXPORTER_OTLP_PROTOCOL:http/protobuf}


Copilot

🟡 Changes recommended

OTLP configuration and multi-mapping telemetry currently produce incorrect or misleading operational behavior.

9 open findings

Use supported Spring Boot OTLP trace properties · New
Gate OTLP metrics export behind explicit opt-in · New
Mapping results overwrite the webhook span attribute
Tracing defaults to enabled instead of remaining opt-in
Fix table delimiter spacing for markdownlint · New
Add coverage for omitted and null config values · New
Update deployment docs for management OTLP HTTP configuration
Indent NONE tab content beneath its marker
Add coverage for omitted config normalization

2 resolved since last review

Missing safe defaults for new telemetry configuration placeholders
Add structured JWT caller outcome logging

🧠 Review effort: Balanced

+    traces:
+      export:
+        url: ${OTEL_EXPORTER_OTLP_ENDPOINT:}
+        protocol: ${OTEL_EXPORTER_OTLP_PROTOCOL:http/protobuf}


+    metrics:
+      export:
+        url: ${OTEL_EXPORTER_OTLP_ENDPOINT:}
+        protocol: ${OTEL_EXPORTER_OTLP_PROTOCOL:http/protobuf}


foukou19 · 2026-10-07T15:22:11Z

 public record InboundWebhookSecurityContractDtoIn(
    @NotBlank(message = WEBHOOK_CONNECTOR_SECURITY_TYPE_MANDATORY) String type,
-    @NotNull(message = WEBHOOK_CONNECTOR_SECURITY_CONFIG_MANDATORY) Map<String, String> config) {
+    Map<String, String> config) {


config is optional for NONE, so I dropped @NotNull (type stays @notblank
Other strategies still reject a missing config).
I added tests that truly omit it: controller (omitted and null for NONE on POST and PUT, 400 for non-empty NONE config and for HMAC_SHA256 without config)

Signed-off-by: foukou19 <ferial.oukoukas@decathlon.com>

sonarqubecloud · 2026-10-07T16:23:13Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
93.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

foukou19 force-pushed the feat/idp-core-observability-otel-starter branch from 9cc79e6 to c803b56 Compare October 5, 2026 12:24

feat(config): update OpenTelemetry OTLP

b98b630

Signed-off-by: foukou19 <ferial.oukoukas@decathlon.com>

foukou19 force-pushed the feat/idp-core-observability-otel-starter branch from c803b56 to b98b630 Compare October 6, 2026 09:32

foukou19 requested a balanced review from Copilot October 7, 2026 08:21

Copilot started reviewing on behalf of foukou19 October 7, 2026 08:22 View session

Copilot AI reviewed Oct 7, 2026

View reviewed changes

foukou19 force-pushed the feat/idp-core-observability-otel-starter branch 3 times, most recently from 6b8f4ed to 6b68405 Compare October 7, 2026 09:24

foukou19 requested a balanced review from Copilot October 7, 2026 09:44

Copilot started reviewing on behalf of foukou19 October 7, 2026 09:45 View session

Copilot AI reviewed Oct 7, 2026

View reviewed changes

foukou19 force-pushed the feat/idp-core-observability-otel-starter branch 4 times, most recently from 2c23b12 to 241409d Compare October 7, 2026 14:35

foukou19 requested a balanced review from Copilot October 7, 2026 14:47

Copilot started reviewing on behalf of foukou19 October 7, 2026 14:48 View session

Copilot AI reviewed Oct 7, 2026

View reviewed changes

feat(config): Adapt webhooks security configuration

76f3ec9

Signed-off-by: foukou19 <ferial.oukoukas@decathlon.com>

foukou19 force-pushed the feat/idp-core-observability-otel-starter branch from bb086c7 to 76f3ec9 Compare October 7, 2026 15:19

foukou19 force-pushed the feat/idp-core-observability-otel-starter branch from a0e304e to 76f3ec9 Compare October 7, 2026 16:42

Navigation Menu

Repository navigation

feat(config): update OpenTelemetry OTLP - #164

feat(config): update OpenTelemetry OTLP#164
foukou19 wants to merge 2 commits into
mainfrom
feat/idp-core-observability-otel-starter

foukou19 commented Oct 5, 2026 •

edited

Loading

Uh oh!

github-code-quality Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

foukou19 Oct 7, 2026

Uh oh!

sonarqubecloud Bot commented Oct 7, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

foukou19 commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Description

What this PR Provides

Fixes

Review

How to test

Breaking changes (if any)

Context of the Breaking Change

Result of the Breaking Change

Uh oh!

github-code-quality Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

Java / code-coverage/jacoco

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

foukou19 Oct 7, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Oct 7, 2026

Quality Gate passed

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

foukou19 commented Oct 5, 2026 •

edited

Loading

github-code-quality Bot commented Oct 5, 2026 •

edited

Loading