feat(http): [Data Collection 11] Apply response header policy

sentry-apollo-3/src/main/java/io/sentry/apollo3/SentryApollo3HttpInterceptor.kt

@@ -279,6 +279,21 @@ constructor(
     return getHeaders(headers)
   }
 
+  private fun getResponseHeaders(headers: List<HttpHeader>): MutableMap<String, String>? {
+    if (scopes.options.dataCollectionResolver.isDataCollectionConfigured) {
+      val responseHeaders = mutableMapOf<String, String>()
+      for (header in headers) {
+        responseHeaders[header.name] = header.value
+      }
+      return HttpUtils.filterHeaders(
+          responseHeaders,
+          scopes.options.dataCollectionResolver.httpResponseHeaders,
+        )
+        .toMutableMap()
+    }
+    return getHeaders(headers)
+  }
+
   private fun getHeaders(headers: List<HttpHeader>): MutableMap<String, String>? {
     // Headers are only sent if isSendDefaultPii is enabled due to PII
     if (!scopes.options.isSendDefaultPii) {
@@ -405,7 +420,7 @@ constructor(
             } else {
               null
             }
-          headers = getHeaders(response.headers)
+          headers = getResponseHeaders(response.headers)
           statusCode = response.statusCode
 
           response.body?.buffer?.size?.ifHasValidLength { contentLength ->

sentry-apollo-3/src/test/java/io/sentry/apollo3/SentryApollo3InterceptorClientErrors.kt

@@ -435,6 +435,38 @@ class SentryApollo3InterceptorClientErrors {
       )
   }
 
+  @Test
+  fun `data collection filters response headers`() {
+    val sut =
+      fixture.getSut(responseBody = fixture.responseBodyNotOk) {
+        dataCollection.httpHeaders.response = KeyValueCollectionBehavior.denyList("content-length")
+      }
+    executeQuery(sut)
+
+    verify(fixture.scopes)
+      .captureEvent(
+        check {
+          assertEquals("[Filtered]", it.contexts.response!!.headers?.get("Content-Length"))
+        },
+        any<Hint>(),
+      )
+  }
+
+  @Test
+  fun `data collection can disable response headers`() {
+    val sut =
+      fixture.getSut(responseBody = fixture.responseBodyNotOk) {
+        dataCollection.httpHeaders.response = KeyValueCollectionBehavior.off()
+      }
+    executeQuery(sut)
+
+    verify(fixture.scopes)
+      .captureEvent(
+        check { assertTrue(it.contexts.response!!.headers!!.isEmpty()) },
+        any<Hint>(),
+      )
+  }
+
   @Test
   fun `capture errors with more response context if sendDefaultPii is enabled`() {
     val sut = fixture.getSut(responseBody = fixture.responseBodyNotOk, sendDefaultPii = true)

sentry-apollo-4/src/main/java/io/sentry/apollo4/SentryApollo4HttpInterceptor.kt

@@ -278,6 +278,21 @@ constructor(
     return getHeaders(headers)
   }
 
+  private fun getResponseHeaders(headers: List<HttpHeader>): MutableMap<String, String>? {
+    if (scopes.options.dataCollectionResolver.isDataCollectionConfigured) {
+      val responseHeaders = mutableMapOf<String, String>()
+      for (header in headers) {
+        responseHeaders[header.name] = header.value
+      }
+      return HttpUtils.filterHeaders(
+          responseHeaders,
+          scopes.options.dataCollectionResolver.httpResponseHeaders,
+        )
+        .toMutableMap()
+    }
+    return getHeaders(headers)
+  }
+
   private fun getHeaders(headers: List<HttpHeader>): MutableMap<String, String>? {
     // Headers are only sent if isSendDefaultPii is enabled due to PII
     if (!scopes.options.isSendDefaultPii) {
@@ -404,7 +419,7 @@ constructor(
             } else {
               null
             }
-          headers = getHeaders(response.headers)
+          headers = getResponseHeaders(response.headers)
           statusCode = response.statusCode
 
           response.body?.buffer?.size?.ifHasValidLength { contentLength ->

sentry-apollo-4/src/test/java/io/sentry/apollo4/SentryApollo4BuilderExtensionsClientErrorsTest.kt

@@ -428,6 +428,21 @@ abstract class SentryApollo4BuilderExtensionsClientErrorsTest(
       )
   }
 
+  @Test
+  fun `data collection can disable response headers`() {
+    val sut =
+      fixture.getSut(responseBody = fixture.responseBodyNotOk) {
+        dataCollection.httpHeaders.response = KeyValueCollectionBehavior.off()
+      }
+    executeQuery(sut)
+
+    verify(fixture.scopes)
+      .captureEvent(
+        check { assertTrue(it.contexts.response!!.headers!!.isEmpty()) },
+        any<Hint>(),
+      )
+  }
+
   @Test
   fun `capture errors with more response context if sendDefaultPii is enabled`() {
     val sut = fixture.getSut(responseBody = fixture.responseBodyNotOk, sendDefaultPii = true)

sentry-ktor-client/src/main/java/io/sentry/ktorClient/SentryKtorClientUtils.kt

@@ -48,7 +48,7 @@ internal object SentryKtorClientUtils {
       io.sentry.protocol.Response().apply {
         // Set-Cookie is only sent if isSendDefaultPii is enabled due to PII
         cookies = if (scopes.options.isSendDefaultPii) response.headers["Set-Cookie"] else null
-        headers = getHeaders(scopes, response.headers)
+        headers = getResponseHeaders(scopes, response.headers)
         statusCode = response.status.value
         try {
           bodySize = response.bodyAsBytes().size.toLong()
@@ -80,6 +80,19 @@ internal object SentryKtorClientUtils {
     return getHeaders(scopes, headers)
   }
 
+  private fun getResponseHeaders(scopes: IScopes, headers: Headers): MutableMap<String, String>? {
+    if (scopes.options.dataCollectionResolver.isDataCollectionConfigured) {
+      val responseHeaders =
+        headers.toMap().mapValues { (_, values) -> values.joinToString(",") }.toMutableMap()
+      return HttpUtils.filterHeaders(
+          responseHeaders,
+          scopes.options.dataCollectionResolver.httpResponseHeaders,
+        )
+        .toMutableMap()
+    }
+    return getHeaders(scopes, headers)
+  }
+
   private fun getHeaders(scopes: IScopes, headers: Headers): MutableMap<String, String>? {
     // Headers are only sent if isSendDefaultPii is enabled due to PII
     if (!scopes.options.isSendDefaultPii) {

sentry-ktor-client/src/test/java/io/sentry/ktorClient/SentryKtorClientPluginTest.kt

@@ -306,6 +306,59 @@ class SentryKtorClientPluginTest {
       )
   }
 
+  @Test
+  fun `data collection filters response headers`(): Unit = runBlocking {
+    val sut =
+      fixture.getSut(
+        captureFailedRequests = true,
+        httpStatusCode = 500,
+        optionsConfiguration =
+          Sentry.OptionsConfiguration {
+            it.dataCollection.httpHeaders.response = KeyValueCollectionBehavior.denyList("response")
+          },
+      )
+
+    sut.get(fixture.server.url("/hello").toString())
+
+    verify(fixture.scopes)
+      .captureEvent(
+        check<SentryEvent> {
+          assertEquals(
+            "[Filtered]",
+            it.contexts.response!!
+              .headers!!
+              .entries
+              .firstOrNull { header ->
+                header.key.equals("myResponseHeader", ignoreCase = true)
+              }
+              ?.value,
+          )
+        },
+        any<Hint>(),
+      )
+  }
+
+  @Test
+  fun `data collection can disable response headers`(): Unit = runBlocking {
+    val sut =
+      fixture.getSut(
+        captureFailedRequests = true,
+        httpStatusCode = 500,
+        optionsConfiguration =
+          Sentry.OptionsConfiguration {
+            it.dataCollection.httpHeaders.response = KeyValueCollectionBehavior.off()
+          },
+      )
+
+    sut.get(fixture.server.url("/hello").toString())
+
+    verify(fixture.scopes)
+      .captureEvent(
+        check<SentryEvent> { assertTrue(it.contexts.response!!.headers!!.isEmpty()) },
+        any<Hint>(),
+      )
+  }
+
   @Test
   fun `does not capture headers when sendDefaultPii is disabled`(): Unit = runBlocking {
     val sut =

sentry-okhttp/src/main/java/io/sentry/okhttp/SentryOkHttpUtils.kt

@@ -49,7 +49,7 @@ internal object SentryOkHttpUtils {
       io.sentry.protocol.Response().apply {
         // Set-Cookie is only sent if isSendDefaultPii is enabled due to PII
         cookies = if (scopes.options.isSendDefaultPii) response.headers["Set-Cookie"] else null
-        headers = getHeaders(scopes, response.headers)
+        headers = getResponseHeaders(scopes, response.headers)
         statusCode = response.code
 
         response.body?.contentLength().ifHasValidLength { bodySize = it }
@@ -85,6 +85,24 @@ internal object SentryOkHttpUtils {
     return getHeaders(scopes, requestHeaders)
   }
 
+  private fun getResponseHeaders(
+    scopes: IScopes,
+    responseHeaders: Headers,
+  ): MutableMap<String, String>? {
+    if (scopes.options.dataCollectionResolver.isDataCollectionConfigured) {
+      val headers = mutableMapOf<String, String>()
+      for (i in 0 until responseHeaders.size) {
+        headers[responseHeaders.name(i)] = responseHeaders.value(i)
+      }
+      return HttpUtils.filterHeaders(
+          headers,
+          scopes.options.dataCollectionResolver.httpResponseHeaders,
+        )
+        .toMutableMap()
+    }
+    return getHeaders(scopes, responseHeaders)
+  }
+
   private fun getHeaders(scopes: IScopes, requestHeaders: Headers): MutableMap<String, String>? {
     // Headers are only sent if isSendDefaultPii is enabled due to PII
     if (!scopes.options.isSendDefaultPii) {

sentry-okhttp/src/test/java/io/sentry/okhttp/SentryOkHttpUtilsTest.kt

@@ -158,6 +158,40 @@ class SentryOkHttpUtilsTest {
       .captureEvent(check { assertTrue(it.request!!.headers!!.isEmpty()) }, any<Hint>())
   }
 
+  @Test
+  fun `data collection filters response headers`() {
+    val sut = fixture.getSut {
+      dataCollection.httpHeaders.response = KeyValueCollectionBehavior.denyList("response")
+    }
+    val request = getRequest()
+    val response = sut.newCall(request).execute()
+
+    SentryOkHttpUtils.captureClientError(fixture.scopes, request, response)
+
+    verify(fixture.scopes)
+      .captureEvent(
+        check {
+          assertEquals("[Filtered]", it.contexts.response!!.headers!!["myResponseHeader"])
+          assertEquals("[Filtered]", it.contexts.response!!.headers!!["Set-Cookie"])
+        },
+        any<Hint>(),
+      )
+  }
+
+  @Test
+  fun `data collection can disable response headers`() {
+    val sut = fixture.getSut {
+      dataCollection.httpHeaders.response = KeyValueCollectionBehavior.off()
+    }
+    val request = getRequest()
+    val response = sut.newCall(request).execute()
+
+    SentryOkHttpUtils.captureClientError(fixture.scopes, request, response)
+
+    verify(fixture.scopes)
+      .captureEvent(check { assertTrue(it.contexts.response!!.headers!!.isEmpty()) }, any<Hint>())
+  }
+
   @Test
   fun `captureClientError without sendDefaultPii does not send headers`() {
     val sut = fixture.getSut(sendDefaultPii = false)