fix(traceloop-sdk): Fixes gRPC exporter initialisation with insecure OTLP (#3481)

Author: boscoraju-snyk

packages/traceloop-sdk/tests/test_sdk_initialization.py

@@ -1,4 +1,5 @@
 import pytest
+from unittest.mock import patch
 from openai import OpenAI
 from traceloop.sdk.decorators import workflow
 
@@ -8,6 +9,51 @@ def openai_client():
     return OpenAI()
 
 
+class TestInitSpansExporter:
+    """Tests for init_spans_exporter with different URL schemes."""
+
+    @pytest.mark.parametrize("endpoint", [
+        "http://localhost:4318",
+        "https://localhost:4318",
+        "HTTP://localhost:4318",
+    ])
+    def test_http_schemes(self, endpoint):
+        from traceloop.sdk.tracing.tracing import init_spans_exporter
+        from opentelemetry.exporter.otlp.proto.http.trace_exporter import OTLPSpanExporter
+        assert isinstance(init_spans_exporter(endpoint, {}), OTLPSpanExporter)
+
+    @pytest.mark.parametrize("endpoint,expected_endpoint", [
+        ("http://localhost:4318", "http://localhost:4318/v1/traces"),
+        ("http://localhost:4318/", "http://localhost:4318/v1/traces"),
+        ("http://localhost:4318/v1/traces", "http://localhost:4318/v1/traces"),
+        ("https://api.example.com", "https://api.example.com/v1/traces"),
+        ("  http://localhost:4318  ", "http://localhost:4318/v1/traces"),
+    ])
+    def test_http_endpoint_construction(self, endpoint, expected_endpoint):
+        from traceloop.sdk.tracing.tracing import init_spans_exporter
+        from opentelemetry.exporter.otlp.proto.http.trace_exporter import OTLPSpanExporter
+
+        with patch.object(OTLPSpanExporter, "__init__", return_value=None) as mock:
+            init_spans_exporter(endpoint, {})
+            mock.assert_called_once_with(endpoint=expected_endpoint, headers={})
+
+    @pytest.mark.parametrize("endpoint,expected_endpoint,insecure", [
+        ("grpc://localhost:4317", "localhost:4317", True),
+        ("GRPC://host:4317", "host:4317", True),
+        ("grpcs://localhost:4317", "localhost:4317", False),
+        ("GRPCS://host:4317", "host:4317", False),
+        ("  grpc://localhost:4317  ", "localhost:4317", True),  # whitespace stripped
+        ("localhost:4317", "localhost:4317", True),  # no scheme = insecure gRPC
+    ])
+    def test_grpc_schemes(self, endpoint, expected_endpoint, insecure):
+        from traceloop.sdk.tracing.tracing import init_spans_exporter
+        from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter
+
+        with patch.object(OTLPSpanExporter, "__init__", return_value=None) as mock:
+            init_spans_exporter(endpoint, {})
+            mock.assert_called_once_with(endpoint=expected_endpoint, headers={}, insecure=insecure)
+
+
 @pytest.mark.vcr
 def test_resource_attributes(exporter, openai_client):
     openai_client.chat.completions.create(

packages/traceloop-sdk/traceloop/sdk/tracing/tracing.py

@@ -1,6 +1,7 @@
 import atexit
 import logging
 import os
+from urllib.parse import urlparse
 
 
 from colorama import Fore
@@ -291,10 +292,45 @@ def is_llm_span(span) -> bool:
 
 
 def init_spans_exporter(api_endpoint: str, headers: Dict[str, str]) -> SpanExporter:
-    if "http" in api_endpoint.lower() or "https" in api_endpoint.lower():
-        return HTTPExporter(endpoint=f"{api_endpoint}/v1/traces", headers=headers)
-    else:
-        return GRPCExporter(endpoint=f"{api_endpoint}", headers=headers)
+    """
+    Initialize a span exporter based on the endpoint URL scheme.
+
+    Supported schemes:
+        - http:// or https:// → HTTP exporter
+        - grpc:// → gRPC exporter (insecure)
+        - grpcs:// → gRPC exporter (secure/TLS)
+        - No scheme → gRPC exporter (insecure, for backward compatibility)
+
+    Args:
+        api_endpoint: The endpoint URL (with or without scheme)
+        headers: Headers to include with the exporter requests
+
+    Returns:
+        SpanExporter: Configured HTTP or gRPC exporter
+    """
+    parsed = urlparse(api_endpoint.strip())
+
+    match parsed.scheme.lower():
+        case "http" | "https":
+            base_url = api_endpoint.strip().rstrip('/')
+            if not base_url.endswith('/v1/traces'):
+                endpoint = f"{base_url}/v1/traces"
+            else:
+                endpoint = base_url
+            return HTTPExporter(endpoint=endpoint, headers=headers)
+        case "grpc":
+            return GRPCExporter(
+                endpoint=parsed.netloc, headers=headers, insecure=True
+            )
+        case "grpcs":
+            return GRPCExporter(
+                endpoint=parsed.netloc, headers=headers, insecure=False
+            )
+        case _:
+            # No scheme → default to insecure gRPC for backward compatibility
+            return GRPCExporter(
+                endpoint=api_endpoint.strip(), headers=headers, insecure=True
+            )
 
 
 def default_span_processor_on_start(span: Span, parent_context: Context | None = None):