datasette/datasette/views
Alex Garcia f4db0eb521 Make db.query spans match OpenTelemetry semantic conventions
Three corrections to the emitted data, bundled because changing what is on
the wire after operators have built dashboards on it is a breaking change -
so they belong in the first release that ships spans at all, not a later one.

db.query is now SpanKind.CLIENT. Trace UIs key their database rendering off
the span kind rather than off db.system, so the spans rendered as ordinary
internal work despite carrying db.system and db.query.text. The three child
spans stay INTERNAL on purpose: db.query.execute, db.write.execute and
db.write.queue_wait are Datasette's decomposition of one logical query, not
three database calls, and queue_wait touches no database at all - marking
them CLIENT would make one query look like several to anything counting
spans by kind.

The instrumentation scope now carries the Datasette version and a schema
URL, so a backend can tell which Datasette produced a span. The URL is
1.29.0 rather than the latest semconv release because that is the highest
version at which every name emitted here is the current spelling: db.system
was renamed to db.system.name in 1.30.0 and this code still emits the older
form. Claiming a later schema would be false, and would stop a consumer
translating that name forward, since the claim asserts the rename already
happened.

db.operation.name is the statement's leading keyword matched against a fixed
allowlist, not a parse. On a public instance the SQL is attacker-controlled
and this attribute is a candidate metric dimension in a later phase, so
echoing back an arbitrary first token would let a visitor's typo mint a
permanent series. Anything unrecognised gets no attribute rather than a
wrong one. execute_write_script() does not set it at all, since semantic
conventions say not to extract an operation name from query text that can
hold several statements.

db.collection.name comes only from a new table= argument on
Database.execute(), and is never derived from the SQL: deriving it would be
a parse, and on an instance where anyone can create a table the value set
has no ceiling. It is passed from every query in the table and row views
that targets exactly one user table. Internal-catalog reads and the row
view's cross-table foreign key counts are deliberately left without it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-15 14:05:39 -07:00
..
__init__.py Upgrade to ruff>=0.16.0 (#2857) 2026-07-25 15:47:08 -07:00
base.py Upgrade to ruff>=0.16.0 (#2857) 2026-07-25 15:47:08 -07:00
database.py Block framing of stored-query mutation forms 2026-09-09 08:39:03 -07:00
execute_write.py Add a default execution time limit to writes 2026-09-08 21:17:03 -07:00
index.py Upgrade to ruff>=0.16.0 (#2857) 2026-07-25 15:47:08 -07:00
query_helpers.py Upgrade to ruff>=0.16.0 (#2857) 2026-07-25 15:47:08 -07:00
row.py Make db.query spans match OpenTelemetry semantic conventions 2026-09-15 14:05:39 -07:00
special.py Refuse API token creation from restricted actors 2026-09-09 08:38:40 -07:00
stored_queries.py Block framing of stored-query mutation forms 2026-09-09 08:39:03 -07:00
table.py Make db.query spans match OpenTelemetry semantic conventions 2026-09-15 14:05:39 -07:00
table_create_alter.py Reject structured row writes to virtual and shadow tables 2026-09-10 16:52:25 -07:00
table_extras.py Filter incoming foreign-key relationships by view permission 2026-09-10 16:52:52 -07:00