From bf90934d059ea157593babdd140c330782db8681 Mon Sep 17 00:00:00 2001 From: itz-puneet Date: Fri, 4 Sep 2026 02:59:45 +0530 Subject: [PATCH] test(node): Assert absence of PII attributes in OpenAI integration tests The OpenAI integration tests assert which attributes are present when `sendDefaultPii` is disabled, but never assert that the PII-gated attributes are absent. A regression which leaked prompt or response content onto spans would therefore pass the existing suite. Adds an explicit check over every span in the envelope, for both `instrument.mjs` (recording disabled) scenarios, covering the four content-bearing attributes which the paired `instrument-with-pii.mjs` tests assert are present: - `gen_ai.input_messages` - `gen_ai.system_instructions` - `gen_ai.response.text` - `gen_ai.embeddings.input` Iterating the whole envelope rather than the individually inspected spans also catches content leaking onto spans the tests do not assert against directly. The same gap exists in the anthropic, langchain and google-genai suites; happy to follow up in a separate PR. Co-Authored-By: Claude Opus 5 --- .../suites/tracing/openai/test.ts | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/dev-packages/node-integration-tests/suites/tracing/openai/test.ts b/dev-packages/node-integration-tests/suites/tracing/openai/test.ts index 4b166d7a38d2..1026b1257e34 100644 --- a/dev-packages/node-integration-tests/suites/tracing/openai/test.ts +++ b/dev-packages/node-integration-tests/suites/tracing/openai/test.ts @@ -322,6 +322,16 @@ describe('OpenAI integration', () => { type: 'string', value: 'auto.ai.openai', }); + + // PII attributes must never be recorded when `sendDefaultPii` is disabled. + // Asserting over every span in the envelope catches attributes leaking onto + // spans which are not individually inspected above. + for (const span of container.items) { + expect(span.attributes[GEN_AI_INPUT_MESSAGES]).toBeUndefined(); + expect(span.attributes[GEN_AI_SYSTEM_INSTRUCTIONS]).toBeUndefined(); + expect(span.attributes[GEN_AI_RESPONSE_TEXT]).toBeUndefined(); + expect(span.attributes[GEN_AI_EMBEDDINGS_INPUT]).toBeUndefined(); + } }, }) .start() @@ -845,6 +855,16 @@ describe('OpenAI integration', () => { type: 'integer', value: 10, }); + + // PII attributes must never be recorded when `sendDefaultPii` is disabled. + // Asserting over every span in the envelope catches attributes leaking onto + // spans which are not individually inspected above. + for (const span of container.items) { + expect(span.attributes[GEN_AI_INPUT_MESSAGES]).toBeUndefined(); + expect(span.attributes[GEN_AI_SYSTEM_INSTRUCTIONS]).toBeUndefined(); + expect(span.attributes[GEN_AI_RESPONSE_TEXT]).toBeUndefined(); + expect(span.attributes[GEN_AI_EMBEDDINGS_INPUT]).toBeUndefined(); + } }, }) .start()