Add rack middleware for remote IP collection for AI Guard by y9v · Pull Request #5677 · DataDog/dd-trace-rb

y9v · 2026-05-05T12:00:46Z

What does this PR do?
This PR adds collection of http.client_ip and network.client.ip tags to AI Guard via Rack middleware. This middleware is automatically added in Rails when AI Guard is enabled, similar to AppSec.

We want to always collect client IP addresses when AI Guard is used.

Change log entry
Yes. AI Guard: ensure that client IP is always collected when AI Guard is enabled.

Additional Notes:
APPSEC-62200

How to test the change?
CI and manual testing with appsec-app-generator.

dd-octo-sts · 2026-05-05T12:01:16Z

Typing analysis

Note: Ignored files are excluded from the next sections.

`steep:ignore` comments

This PR introduces 4 steep:ignore comments, and clears 2 steep:ignore comments.

steep:ignore comments (+4-2)

❌ Introduced:

lib/datadog/ai_guard/contrib/rack/request_middleware.rb:49
lib/datadog/ai_guard/contrib/rails/patcher.rb:74
lib/datadog/ai_guard/evaluation.rb:29
lib/datadog/ai_guard/evaluation.rb:79

✅ Cleared:

lib/datadog/ai_guard/evaluation.rb:28
lib/datadog/ai_guard/evaluation.rb:78

Untyped methods

This PR introduces 2 untyped methods and 3 partially typed methods, and clears 1 partially typed method. It increases the percentage of typed methods from 61.75% to 62.05% (+0.3%).

Untyped methods (+2-0)

❌ Introduced:

sig/datadog/ai_guard/contrib/rails/patcher.rbs:14
└── def self?.patch_before_initialize: () -> untyped
sig/datadog/ai_guard/contrib/rails/patcher.rbs:18
└── def self?.add_middleware: (untyped app) -> untyped

Partially typed methods (+3-1)

❌ Introduced:

sig/datadog/ai_guard/contrib/integration.rbs:48
└── def self.register: (untyped integration, ::Symbol name, integration_options options) -> RegisteredIntegration
sig/datadog/ai_guard/contrib/rails/patcher.rbs:16
└── def self?.before_initialize: (untyped app) -> void
sig/datadog/ai_guard/contrib/rails/patcher.rbs:20
└── def self?.include_middleware?: (untyped middleware, untyped app) -> bool

✅ Cleared:

sig/datadog/ai_guard/contrib/integration.rbs:46
└── def self.register: (untyped integration, ::Symbol name, integration_options options) -> RegisteredIntegration

Untyped other declarations

This PR introduces 1 untyped other declaration. It increases the percentage of typed other declarations from 78.12% to 78.14% (+0.02%).

Untyped other declarations (+1-0)

❌ Introduced:

sig/datadog/ai_guard/contrib/rails/patcher.rbs:6
└── BEFORE_INITIALIZE_ONLY_ONCE_PER_APP: untyped

If you believe a method or an attribute is rightfully untyped or partially typed, you can add # untyped:accept on the line before the definition to remove it from the stats.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3199f3375c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

pr-commenter · 2026-05-05T13:21:42Z

Benchmarks

Benchmark execution time: 2026-05-07 15:51:31

Comparing candidate commit 4cf1f33 in PR branch ai-guard-remote-ip-collection with baseline commit 5b3d916 in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 45 metrics, 1 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

🟩 = significantly better candidate vs. baseline
🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

datadog-datadog-prod-us1-2 · 2026-05-05T13:25:01Z

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

🎯 Code Coverage (details)
• Patch Coverage: 80.00%
• Overall Coverage: 97.19% (-0.05%)

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 4cf1f33 | Docs | Datadog PR Page | Give us feedback!}

Strech

I think we can slightly improve some typing parts and I have a question over the middlewares order

vpellan · 2026-05-06T15:41:52Z

(I cannot post a comment in the Changes tab...) I don't think the changes in the lockfile should be included in this PR

vpellan

LGTM for the shared parts

Strech

👍🏼 LGTM

y9v self-assigned this May 5, 2026

y9v requested review from a team as code owners May 5, 2026 12:00

y9v requested a review from mabdinur May 5, 2026 12:00

chatgpt-codex-connector Bot reviewed May 5, 2026

View reviewed changes

Comment thread lib/datadog/ai_guard.rb

Strech reviewed May 6, 2026

View reviewed changes

y9v requested a review from Strech May 6, 2026 18:02

vpellan approved these changes May 7, 2026

View reviewed changes

Strech approved these changes May 7, 2026

View reviewed changes

y9v added 9 commits May 7, 2026 17:23

Add rack middleware for remote IP collection for AI Guard

1271906

Fix failing loading spec

01a3e15

Change AI Guard IP tagging to check for AI Guard span

f7939a2

Optimize AI Guard IP tagging

567a741

Fix linter warning

05d1279

Use _dd.ai_guard.executed tag to mark AI Guard execution

925f0a0

Add _dd prefix for temporary AI Guard tag

a96a34d

Remove redundant StandardError in rescue

38bc321

Fix types for AI Guard contrib

4cf1f33

y9v force-pushed the ai-guard-remote-ip-collection branch from d06cd66 to 4cf1f33 Compare May 7, 2026 15:26

y9v enabled auto-merge May 7, 2026 16:10

y9v removed the request for review from mabdinur May 7, 2026 16:11

marcotc approved these changes May 7, 2026

View reviewed changes

y9v disabled auto-merge May 8, 2026 08:05

y9v merged commit aafa486 into master May 8, 2026
584 checks passed

y9v deleted the ai-guard-remote-ip-collection branch May 8, 2026 08:05

dd-octo-sts Bot added this to the 2.33.0 milestone May 8, 2026

Strech mentioned this pull request May 13, 2026

Bump to version 2.33.0 #5746

Merged

Uh oh!

Conversation

y9v commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dd-octo-sts Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Typing analysis

steep:ignore comments

Untyped methods

Untyped other declarations

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

pr-commenter Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Explanation

More details about the CI and significant changes

Uh oh!

datadog-datadog-prod-us1-2 Bot commented May 5, 2026 • edited by datadog-datadog-prod-us1 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Strech left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vpellan commented May 6, 2026

Uh oh!

vpellan left a comment

Choose a reason for hiding this comment

Uh oh!

Strech left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

y9v commented May 5, 2026 •

edited

Loading

dd-octo-sts Bot commented May 5, 2026 •

edited

Loading

`steep:ignore` comments

pr-commenter Bot commented May 5, 2026 •

edited

Loading

datadog-datadog-prod-us1-2 Bot commented May 5, 2026 •

edited by datadog-datadog-prod-us1 Bot

Loading