Merge the audit fixes from the branches below, and port them to the Boot 4 OTLP suite

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: runningcode

sentry-spring-boot-4/src/integrationTestOtlp/kotlin/io/sentry/spring/boot4/otlpintegrationtest/DistributedTracingIntegrationTest.kt

@@ -4,6 +4,7 @@ import com.google.common.truth.Truth.assertThat
 import io.sentry.SentryEnvelope
 import io.sentry.protocol.SentryId
 import io.sentry.test.transaction
+import kotlin.random.Random
 import kotlin.test.Test
 import org.springframework.http.HttpEntity
 import org.springframework.http.HttpHeaders
@@ -27,26 +28,26 @@ class DistributedTracingIntegrationTest : IntegrationTest() {
       )
     assertThat(status).isEqualTo(500)
 
-    awaitTransaction("GET /tracing/{id}", traceId)
+    val incoming = awaitTransaction("GET /tracing/{id}", traceId).transaction()!!
+    assertThat(incoming.request?.url).endsWith("/tracing/1")
     awaitTransaction("GET /person/{id}", traceId)
   }
 
   @Test
   fun `unsampled trace sends no transactions`() {
     val traceId = SentryId()
+    // An id only this request uses, because a mishandled header could start a trace of its own.
+    val id = Random.nextLong(2, Long.MAX_VALUE)
     val status =
       get(
-        "/tracing/1",
+        "/tracing/$id",
         sentryTrace = "$traceId-424cffc8f94feeee-0",
         baggage =
           "sentry-public_key=502f25099c204a2fbf4cb16edc5975d1,sentry-sample_rand=0.456789,sentry-sample_rate=0.5,sentry-sampled=false,sentry-trace_id=$traceId,sentry-transaction=HTTP%20GET",
       )
     assertThat(status).isEqualTo(500)
 
-    server.assertNoEnvelope {
-      isTransaction(it, "GET /tracing/{id}", traceId) ||
-        isTransaction(it, "GET /person/{id}", traceId)
-    }
+    server.assertNoEnvelope { isForRequest(it, id) }
   }
 
   @Test
@@ -63,6 +64,8 @@ class DistributedTracingIntegrationTest : IntegrationTest() {
 
     val incoming = awaitTransaction("GET /tracing/{id}", traceId).header.traceContext!!
     val outgoing = awaitTransaction("GET /person/{id}", traceId).header.traceContext!!
+    assertThat(incoming.traceId).isEqualTo(traceId)
+    assertThat(outgoing.traceId).isEqualTo(traceId)
     assertThat(incoming.sampleRand).isNotNull()
     assertThat(outgoing.sampleRand).isEqualTo(incoming.sampleRand)
   }
@@ -81,6 +84,8 @@ class DistributedTracingIntegrationTest : IntegrationTest() {
 
     val incoming = awaitTransaction("GET /tracing/{id}", traceId).header.traceContext!!
     val outgoing = awaitTransaction("GET /person/{id}", traceId).header.traceContext!!
+    assertThat(incoming.traceId).isEqualTo(traceId)
+    assertThat(outgoing.traceId).isEqualTo(traceId)
     assertThat(incoming.sampleRate).isNotEqualTo("0.5")
     assertThat(outgoing.sampleRate).isEqualTo(incoming.sampleRate)
   }
@@ -130,6 +135,12 @@ class DistributedTracingIntegrationTest : IntegrationTest() {
       isTransaction(it, name, traceId)
     }
 
+  /** Whether [envelope] is a transaction for `/tracing/[id]` or the `/person/[id]` it calls. */
+  private fun isForRequest(envelope: SentryEnvelope, id: Long): Boolean {
+    val url = envelope.transaction()?.request?.url ?: return false
+    return url.endsWith("/tracing/$id") || url.endsWith("/person/$id")
+  }
+
   private fun isTransaction(envelope: SentryEnvelope, name: String, traceId: SentryId): Boolean {
     val transaction = envelope.transaction() ?: return false
     return transaction.transaction == name && transaction.contexts.trace?.traceId == traceId

sentry-spring-boot-4/src/integrationTestOtlp/kotlin/io/sentry/spring/boot4/otlpintegrationtest/GraphqlIntegrationTest.kt

@@ -67,6 +67,8 @@ class GraphqlIntegrationTest : IntegrationTest() {
     val tasks = response["data"]["tasks"]
     assertThat(tasks.size()).isEqualTo(5)
     assertThat(tasks[0]["id"].asString()).isEqualTo("T1")
+    assertThat(tasks[0]["assigneeId"].asString()).isEqualTo("A3")
+    assertThat(tasks[0]["creatorId"].asString()).isEqualTo("C3")
     assertThat(tasks[0]["assignee"]["id"].asString()).isEqualTo("A3")
     assertThat(tasks[0]["creator"]["id"].asString()).isEqualTo("C3")