laskoviymishka commented on code in PR #1343: URL: https://github.com/apache/iceberg-go/pull/1343#discussion_r3494993996
########## metrics/reporters.go: ########## @@ -0,0 +1,141 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package metrics + +import ( + "context" + "log/slog" + "sync" +) + +// NopReporter is a [Reporter] that discards every report. It is the default +// when no reporter is configured, so that instrumentation is free unless a user +// opts in. The zero value is ready to use. +type NopReporter struct{} + +var _ Reporter = NopReporter{} + +// Report implements [Reporter] and does nothing. +func (NopReporter) Report(context.Context, MetricsReport) {} + +// LoggingReporter is a [Reporter] that logs each report via an [slog.Logger]. It +// is a convenient default for development and debugging. +type LoggingReporter struct { + logger *slog.Logger +} + +var _ Reporter = (*LoggingReporter)(nil) + +// NewLoggingReporter returns a [LoggingReporter] that logs to logger. If logger +// is nil, [slog.Default] is used. +func NewLoggingReporter(logger *slog.Logger) *LoggingReporter { + if logger == nil { + logger = slog.Default() + } + + return &LoggingReporter{logger: logger} +} + +// Report logs report at info level. +func (r *LoggingReporter) Report(ctx context.Context, report MetricsReport) { + if report == nil { + return + } + r.logger.InfoContext(ctx, "iceberg metrics report", "report", report) +} + +// InMemoryReporter is a [Reporter] that retains every report it receives. It is +// primarily intended for tests and inspection. It is safe for concurrent use. +type InMemoryReporter struct { + mu sync.Mutex + reports []MetricsReport +} + +var _ Reporter = (*InMemoryReporter)(nil) + +// Report appends report to the retained set. +func (r *InMemoryReporter) Report(_ context.Context, report MetricsReport) { + if report == nil { + return + } + r.mu.Lock() + defer r.mu.Unlock() + r.reports = append(r.reports, report) +} + +// Reports returns a copy of the reports received so far, in arrival order. +func (r *InMemoryReporter) Reports() []MetricsReport { + r.mu.Lock() + defer r.mu.Unlock() + + return append([]MetricsReport(nil), r.reports...) +} + +// Reset discards all retained reports. +func (r *InMemoryReporter) Reset() { + r.mu.Lock() + defer r.mu.Unlock() + r.reports = nil +} + +// Combine returns a [Reporter] that forwards each report to all of the given +// reporters in order. nil reporters are skipped. A panic in one reporter must +// not prevent the others from receiving the report, so each call is isolated; +// in keeping with the [Reporter] contract a misbehaving reporter never affects +// the observed operation. A recovered panic is logged at debug level via +// [slog.Default] so a broken reporter is not entirely invisible. +// +// As a convenience, Combine with no reporters returns [NopReporter], and with a +// single non-nil reporter returns that reporter directly. The per-reporter +// panic recovery therefore applies only when two or more reporters are +// combined: a lone reporter is returned unwrapped and runs exactly as it would +// if called directly, without the safety net. +func Combine(reporters ...Reporter) Reporter { + nonNil := make([]Reporter, 0, len(reporters)) + for _, r := range reporters { + if r != nil { + nonNil = append(nonNil, r) + } + } + + switch len(nonNil) { Review Comment: Typed-nil slips through here and defeats the isolation guarantee. `var lr *LoggingReporter = nil; Combine(lr)` passes the `r != nil` filter above (the interface is non-nil even though the concrete pointer is nil), hits this `case 1`, and gets returned unwrapped — so a later `.Report()` dereferences `r.logger` and panics with no `compositeReporter` recover to catch it. That's the exact failure mode the doc promises to prevent. I'd always wrap in `compositeReporter`, even for one reporter — it drops the fast path but kills the whole bug class, and the cost is one range over a one-element slice. It also closes the related gap that `Combine(oneReporter)` doesn't currently get the isolation the doc advertises. If you'd rather keep the passthrough, the filter needs a reflect-based typed-nil check instead. wdyt? ########## metrics/reporters_test.go: ########## @@ -0,0 +1,143 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package metrics + +import ( + "context" + "sync" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// testReport is a minimal MetricsReport. The marker is unexported (sealed to +// this package), so report values can only be created from within the +// package — this white-box test is how we exercise the reporters until the +// concrete report types land. +type testReport struct{ name string } + +func (testReport) isMetricsReport() {} + +// countingReporter records how many reports it received. +type countingReporter struct { + mu sync.Mutex + count int +} + +func (c *countingReporter) Report(context.Context, MetricsReport) { + c.mu.Lock() + defer c.mu.Unlock() + c.count++ +} + +func (c *countingReporter) calls() int { + c.mu.Lock() + defer c.mu.Unlock() + + return c.count +} + +// panickingReporter always panics, to verify Combine isolates failures. +type panickingReporter struct{} + +func (panickingReporter) Report(context.Context, MetricsReport) { panic("boom") } + +func TestNopReporter(t *testing.T) { + // NopReporter must accept anything, including nil, without panicking. + assert.NotPanics(t, func() { + NopReporter{}.Report(context.Background(), nil) + NopReporter{}.Report(context.Background(), testReport{}) + }) +} + +func TestInMemoryReporter(t *testing.T) { + var r InMemoryReporter + require.Empty(t, r.Reports()) + + r.Report(context.Background(), nil) // ignored + require.Empty(t, r.Reports()) + + r.Report(context.Background(), testReport{name: "a"}) + r.Report(context.Background(), testReport{name: "b"}) + + got := r.Reports() + require.Len(t, got, 2) + assert.Equal(t, testReport{name: "a"}, got[0]) + assert.Equal(t, testReport{name: "b"}, got[1]) + + // Reports returns a copy: mutating it must not affect the reporter. + got[0] = nil + require.Len(t, r.Reports(), 2) + + r.Reset() + require.Empty(t, r.Reports()) +} + +func TestLoggingReporterNilLoggerAndReport(t *testing.T) { + r := NewLoggingReporter(nil) // must fall back to slog.Default + require.NotNil(t, r) + assert.NotPanics(t, func() { Review Comment: This asserts only NotPanics — it'd still pass if the `InfoContext` call were deleted, logged at the wrong level, or dropped the report value. For the reporter we're calling the "convenient default for dev/debugging", a silently-broken log call is exactly what nobody would notice. table_test.go has the prior art: swap in a `slog.NewTextHandler` over a `bytes.Buffer`, then assert the output contains "iceberg metrics report" and the report value, at INFO level. ########## metrics/reporters.go: ########## @@ -0,0 +1,141 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package metrics + +import ( + "context" + "log/slog" + "sync" +) + +// NopReporter is a [Reporter] that discards every report. It is the default +// when no reporter is configured, so that instrumentation is free unless a user +// opts in. The zero value is ready to use. +type NopReporter struct{} + +var _ Reporter = NopReporter{} + +// Report implements [Reporter] and does nothing. +func (NopReporter) Report(context.Context, MetricsReport) {} + +// LoggingReporter is a [Reporter] that logs each report via an [slog.Logger]. It +// is a convenient default for development and debugging. +type LoggingReporter struct { + logger *slog.Logger +} + +var _ Reporter = (*LoggingReporter)(nil) + +// NewLoggingReporter returns a [LoggingReporter] that logs to logger. If logger +// is nil, [slog.Default] is used. +func NewLoggingReporter(logger *slog.Logger) *LoggingReporter { + if logger == nil { + logger = slog.Default() + } + + return &LoggingReporter{logger: logger} +} + +// Report logs report at info level. +func (r *LoggingReporter) Report(ctx context.Context, report MetricsReport) { + if report == nil { + return + } + r.logger.InfoContext(ctx, "iceberg metrics report", "report", report) +} + +// InMemoryReporter is a [Reporter] that retains every report it receives. It is +// primarily intended for tests and inspection. It is safe for concurrent use. +type InMemoryReporter struct { + mu sync.Mutex + reports []MetricsReport +} + +var _ Reporter = (*InMemoryReporter)(nil) + +// Report appends report to the retained set. +func (r *InMemoryReporter) Report(_ context.Context, report MetricsReport) { + if report == nil { + return + } + r.mu.Lock() + defer r.mu.Unlock() + r.reports = append(r.reports, report) +} + +// Reports returns a copy of the reports received so far, in arrival order. +func (r *InMemoryReporter) Reports() []MetricsReport { + r.mu.Lock() + defer r.mu.Unlock() + + return append([]MetricsReport(nil), r.reports...) +} + +// Reset discards all retained reports. +func (r *InMemoryReporter) Reset() { + r.mu.Lock() + defer r.mu.Unlock() + r.reports = nil +} + +// Combine returns a [Reporter] that forwards each report to all of the given +// reporters in order. nil reporters are skipped. A panic in one reporter must +// not prevent the others from receiving the report, so each call is isolated; +// in keeping with the [Reporter] contract a misbehaving reporter never affects +// the observed operation. A recovered panic is logged at debug level via +// [slog.Default] so a broken reporter is not entirely invisible. +// +// As a convenience, Combine with no reporters returns [NopReporter], and with a +// single non-nil reporter returns that reporter directly. The per-reporter +// panic recovery therefore applies only when two or more reporters are +// combined: a lone reporter is returned unwrapped and runs exactly as it would +// if called directly, without the safety net. +func Combine(reporters ...Reporter) Reporter { + nonNil := make([]Reporter, 0, len(reporters)) + for _, r := range reporters { + if r != nil { + nonNil = append(nonNil, r) + } + } + + switch len(nonNil) { + case 0: + return NopReporter{} + case 1: + return nonNil[0] + default: + return compositeReporter(nonNil) + } +} + +type compositeReporter []Reporter + Review Comment: `_ = recover()` drops the panic completely — no log, no type, no signal. The doc framing ("a misbehaving reporter never affects the observed operation") is right, but the contract is "don't propagate", not "stay silent". A reporter that nil-derefs in prod just shows up as mysteriously-missing metrics with nothing to grep for. The rest of the codebase re-surfaces recovers (schema.go, visitors.go do `if r := recover(); r != nil { ... }`). I'd match that — at minimum `slog.Warn` the reporter type (`%T`) and the recovered value before continuing. To wire a logger in cleanly, `compositeReporter` could become a struct with a `*slog.Logger` field that `Combine` sets, rather than the bare slice. ########## metrics/reporters_test.go: ########## @@ -0,0 +1,143 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package metrics + +import ( + "context" + "sync" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// testReport is a minimal MetricsReport. The marker is unexported (sealed to +// this package), so report values can only be created from within the +// package — this white-box test is how we exercise the reporters until the +// concrete report types land. +type testReport struct{ name string } + +func (testReport) isMetricsReport() {} + +// countingReporter records how many reports it received. +type countingReporter struct { + mu sync.Mutex + count int +} + +func (c *countingReporter) Report(context.Context, MetricsReport) { + c.mu.Lock() + defer c.mu.Unlock() + c.count++ +} + +func (c *countingReporter) calls() int { + c.mu.Lock() + defer c.mu.Unlock() + + return c.count +} + +// panickingReporter always panics, to verify Combine isolates failures. +type panickingReporter struct{} + +func (panickingReporter) Report(context.Context, MetricsReport) { panic("boom") } + +func TestNopReporter(t *testing.T) { + // NopReporter must accept anything, including nil, without panicking. + assert.NotPanics(t, func() { + NopReporter{}.Report(context.Background(), nil) + NopReporter{}.Report(context.Background(), testReport{}) + }) +} + +func TestInMemoryReporter(t *testing.T) { + var r InMemoryReporter + require.Empty(t, r.Reports()) + + r.Report(context.Background(), nil) // ignored + require.Empty(t, r.Reports()) + + r.Report(context.Background(), testReport{name: "a"}) + r.Report(context.Background(), testReport{name: "b"}) + + got := r.Reports() + require.Len(t, got, 2) + assert.Equal(t, testReport{name: "a"}, got[0]) + assert.Equal(t, testReport{name: "b"}, got[1]) + + // Reports returns a copy: mutating it must not affect the reporter. + got[0] = nil + require.Len(t, r.Reports(), 2) + + r.Reset() + require.Empty(t, r.Reports()) +} + +func TestLoggingReporterNilLoggerAndReport(t *testing.T) { + r := NewLoggingReporter(nil) // must fall back to slog.Default + require.NotNil(t, r) + assert.NotPanics(t, func() { + r.Report(context.Background(), nil) + r.Report(context.Background(), testReport{name: "x"}) + }) +} + +func TestCombine(t *testing.T) { + t.Run("no reporters returns Nop", func(t *testing.T) { + assert.IsType(t, NopReporter{}, Combine()) + assert.IsType(t, NopReporter{}, Combine(nil, nil)) + }) + + t.Run("single reporter returned directly", func(t *testing.T) { + c := &countingReporter{} + assert.Same(t, c, Combine(c)) + assert.Same(t, c, Combine(nil, c, nil)) + }) + + t.Run("fans out to all", func(t *testing.T) { + a, b := &countingReporter{}, &countingReporter{} + Combine(a, b).Report(context.Background(), testReport{}) + assert.Equal(t, 1, a.calls()) + assert.Equal(t, 1, b.calls()) + }) + + t.Run("isolates a panicking reporter", func(t *testing.T) { + after := &countingReporter{} + r := Combine(panickingReporter{}, after) + assert.NotPanics(t, func() { + r.Report(context.Background(), testReport{}) + }) + assert.Equal(t, 1, after.calls(), "reporters after a panic still run") + }) +} + +func TestInMemoryReporterConcurrent(t *testing.T) { Review Comment: The whole point of this test is race detection, but `test-race` in the Makefile only covers `./codec/...`, not `./metrics/...` — so on a normal run this just checks that 100 goroutines finish, which they always will. I'd extend `test-race` to include `./metrics/...` in this PR, since the test exists for exactly that. While here, the production pattern is concurrent `Report()` plus a foreground `Reports()`/`Reset()`. A goroutine looping on `Reports()` while the writers run would actually exercise the read-under-write path under `-race`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
