Fixed malformed headers emitting junk trace IDs

[miloquinn]

• Validate the W3C traceparent header before returning Cloud Logging trace context, so malformed or spoofed headers no longer emit junk trace IDs.
• Parsing is delegated to parseTraceParent from @opentelemetry/core (already a direct dependency) rather than a hand-rolled parser. This enforces the spec rules — hex format, reserved version ff, all-zero trace/span IDs, no extra fields on version 00 — and correctly parses future-version headers that carry extra fields (the spec says receivers should read the first four fields).
• getTraceContext is now a thin mapping: null-object shape on missing/invalid input, and traceFlags & TraceFlags.SAMPLED → sampled.
• Add unit coverage: valid sampled/unsampled headers, a future-version forward-compat case, and a matrix of malformed headers (bad hex, wrong lengths, all-zero IDs, reserved version ff, wrong field count).

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

getTraceContext now uses OpenTelemetry’s parseTraceParent and TraceFlags to validate traceparent values, extract identifiers, and determine sampling. Tests cover missing, sampled, unsampled, future-version, and invalid traceparent inputs.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title matches the main change: validating malformed traceparent headers to avoid junk trace IDs.
Description check	✅ Passed	The description accurately summarizes the traceparent validation and test coverage changes.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/helpers/context-header.ts`:
- Around line 14-20: The version field validation in the isValidTraceContext
logic currently accepts the reserved value `ff`, which violates the W3C Trace
Context specification. Add an additional condition to the isValidTraceContext
validation that explicitly checks version !== 'ff' to reject this reserved
version value, ensuring invalid trace metadata is not emitted downstream.

In `@src/helpers/context-header.unit.test.ts`:
- Around line 40-49: The test matrix in the it.each block for invalid
traceparent validation is missing a regression case for the reserved version
"ff", which means strict version validation isn't fully tested. Add a new
traceparent string to the test array that uses "ff" as the version prefix (the
first segment before the first dash) while keeping the other segments valid,
such as "ff-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01", to ensure the
reserved-version validation is properly covered by the test.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 89b497dc-b473-459c-87c3-db43e1c32658

📥 Commits

Reviewing files that changed from the base of the PR and between 7389379 and 6e6e3c8e4cd44a94631ce85df18268aa9e187dba.

📒 Files selected for processing (2)

• src/helpers/context-header.ts
• src/helpers/context-header.unit.test.ts

[sagzy]

Hey @miloquinn, thanks for your contribution 🙏

I've left some minor comments, this looks good overall! Can you ping me once you've gone through addressing those?