feat(aiohttp): Gate user info behind data_collection config (#6874)

Apply the data_collection.user_info setting to the aiohttp integration's
user IP collection under span streaming, giving it precedence over the
legacy send_default_pii boolean when explicitly configured. This covers
both the client.address span attribute and the user.ip_address scope
attribute, mirroring the behavior already shipped for Flask, WSGI, ASGI,
Django, Sanic, Tornado, and Pyramid.

Add test_user_address_with_data_collection_and_span_streaming,
parametrized with the shared DATA_COLLECTION_USER_INFO_CASES matrix from
tests/integrations/utils.py, and remove the now-redundant IP assertion
block from test_sensitive_header_passthrough_with_pii_span_streaming
that its TODO reserved for this change.

Refs PY-2583
Fixes #6746

Author: ericapisani

sentry_sdk/integrations/aiohttp.py

@@ -165,6 +165,8 @@ async def sentry_app_handle(
                             )
 
                         url_attributes = {}
+                        client_address_attributes = {}
+
                         if has_data_collection_enabled(client.options):
                             url_attributes["url.full"] = "%s://%s%s" % (
                                 request.scheme,
@@ -188,6 +190,15 @@ async def sentry_app_handle(
                                         "?" + filtered_query_string
                                     )
 
+                            if request.remote:
+                                if client.options["data_collection"]["user_info"]:
+                                    client_address_attributes["client.address"] = (
+                                        request.remote
+                                    )
+                                    scope.set_attribute(
+                                        SPANDATA.USER_IP_ADDRESS, request.remote
+                                    )
+
                         elif should_send_default_pii():
                             url_full = "%s://%s%s" % (
                                 request.scheme,
@@ -201,12 +212,13 @@ async def sentry_app_handle(
                             url_attributes["url.full"] = url_full
                             url_attributes["url.path"] = request.path
 
-                        client_address_attributes = {}
-                        if should_send_default_pii() and request.remote:
-                            client_address_attributes["client.address"] = request.remote
-                            scope.set_attribute(
-                                SPANDATA.USER_IP_ADDRESS, request.remote
-                            )
+                            if request.remote:
+                                client_address_attributes["client.address"] = (
+                                    request.remote
+                                )
+                                scope.set_attribute(
+                                    SPANDATA.USER_IP_ADDRESS, request.remote
+                                )
 
                         span_ctx = sentry_sdk.traces.start_span(
                             # If this name makes it to the UI, AIOHTTP's URL

tests/integrations/aiohttp/test_aiohttp.py

@@ -26,6 +26,7 @@
 )
 from sentry_sdk.utils import SENSITIVE_DATA_SUBSTITUTE
 from tests.conftest import ApproxDict
+from tests.integrations.utils import DATA_COLLECTION_USER_INFO_CASES
 
 
 @pytest.mark.asyncio
@@ -1208,6 +1209,43 @@ async def hello(request):
     assert "http.request.header.host" in server_span["attributes"]
 
 
+@pytest.mark.asyncio
+@pytest.mark.parametrize("init_kwargs, expect_ip", DATA_COLLECTION_USER_INFO_CASES)
+async def test_user_address_with_data_collection_and_span_streaming(
+    sentry_init, aiohttp_client, capture_items, init_kwargs, expect_ip
+):
+    sentry_init(
+        integrations=[AioHttpIntegration()],
+        traces_sample_rate=1.0,
+        trace_lifecycle="stream",
+        **init_kwargs,
+    )
+
+    async def hello(request):
+        return web.Response(text="hello")
+
+    app = web.Application()
+    app.router.add_get("/", hello)
+
+    items = capture_items("span")
+
+    client = await aiohttp_client(app)
+    resp = await client.get("/")
+    assert resp.status == 200
+
+    sentry_sdk.flush()
+
+    (server_span,) = [item.payload for item in items]
+    assert server_span["attributes"]["sentry.origin"] == "auto.http.aiohttp"
+
+    if expect_ip:
+        assert server_span["attributes"]["client.address"] == "127.0.0.1"
+        assert server_span["attributes"]["user.ip_address"] == "127.0.0.1"
+    else:
+        assert "client.address" not in server_span["attributes"]
+        assert "user.ip_address" not in server_span["attributes"]
+
+
 @pytest.mark.asyncio
 async def test_sensitive_header_scrubbing_span_streaming(
     sentry_init, aiohttp_client, capture_items
@@ -1420,16 +1458,6 @@ async def hello(request):
             == expected["cookie"]
         )
 
-    # client.address and user.ip_address is captured under send_default_pii=True.
-    # TODO: This block will eventually need to be removed from this test into a separate
-    # test once data collection gating is introduced on these values
-    if options["send_default_pii"]:
-        assert server_span["attributes"]["client.address"] == "127.0.0.1"
-        assert server_span["attributes"]["user.ip_address"] == "127.0.0.1"
-    else:
-        assert "user.ip_address" not in server_span["attributes"]
-        assert "client.address" not in server_span["attributes"]
-
 
 @pytest.mark.asyncio
 async def test_sensitive_header_passthrough_with_pii_span_streaming_without_data_collection(