fix(cloudflare): Do not add back channel integrations the user removed

CHANGELOG.md

@@ -92,6 +92,10 @@ Work in this release was contributed by @adityareddy-dev, @jpdefo, @Jxxunnn, @ph
 
   These integrations need the vite plugin. Without it, they record nothing, and with `debug: true` the SDK logs a warning.
 
+- **fix(cloudflare): Do not add back channel integrations the user removed**
+
+  When an instrumented package loaded after `init()` (for example through a dynamic `import()`), the SDK added its integration even if the user had removed it. This applied to an `integrations` function that filtered it out, `defaultIntegrations: false`, and a custom `defaultIntegrations` list. The SDK now applies the same rules to a late-loaded integration as to the defaults at `init()`. To do this, it calls an `integrations` function again, once for each package that loads after `init()`.
+
 ## 11.8.0
 
 ### Important Changes

packages/cloudflare/src/baseSdk.ts

@@ -1,5 +1,5 @@
 import type { Integration } from '@sentry/core';
-import { _INTERNAL_isClientClosed, debug, getCurrentScope, setCurrentClient } from '@sentry/core';
+import { _INTERNAL_isClientClosed, debug, getCurrentScope, safeCallback, setCurrentClient } from '@sentry/core';
 import {
   consoleIntegration,
   conversationIdIntegration,
@@ -107,7 +107,9 @@ export function initWithDefaultIntegrations(
     return cached;
   }
 
-  if (options.defaultIntegrations === undefined) {
+  // `false` or a custom list turns off the SDK defaults, late-loaded ones included.
+  const usesSdkDefaults = options.defaultIntegrations === undefined;
+  if (usesSdkDefaults) {
     options.defaultIntegrations = getDefaultIntegrationsImpl(options);
   }
 
@@ -153,12 +155,36 @@ export function initWithDefaultIntegrations(
   // lazily required on first use) stores its subscriber factory on the global
   // marker too late for the default-integrations snapshot above. Its injected
   // snippet emits this event right after storing the factory, so install the
-  // integration on the live client here. `addIntegration` dedupes by
-  // integration name, so already-installed integrations are no-ops.
+  // integration on the live client here, with the same rules as the defaults.
+  // `addIntegration` dedupes by integration name, so an integration the user
+  // configured stays in place.
+  const userIntegrations = options.integrations;
   client.on('orchestrion.module-injected', moduleName => {
     const factory = GLOBAL_OBJ.__SENTRY_ORCHESTRION__?.integrations?.get(moduleName);
-    if (factory) {
-      client.addIntegration(factory());
+    if (!usesSdkDefaults || !factory) {
+      return;
+    }
+
+    const integration = factory();
+    if (typeof userIntegrations !== 'function') {
+      client.addIntegration(integration);
+      return;
+    }
+
+    // Pass the late default through the user's `integrations` function, so a
+    // filter that removed it at init removes it here too. This calls the
+    // function again, once for each late module. If the function throws, skip
+    // the integration, so the module load that emitted the event still works.
+    const kept = safeCallback(
+      DEBUG_BUILD ? 'Error in the `integrations` function, skipping a late-loaded integration:' : '',
+      () =>
+        getIntegrationsToSetup({ defaultIntegrations: [integration], integrations: userIntegrations }).find(
+          ({ name }) => name === integration.name,
+        ),
+      () => undefined,
+    );
+    if (kept) {
+      client.addIntegration(kept);
     }
   });
 

packages/cloudflare/test/sdk.test.ts

@@ -458,6 +458,85 @@ describe('getDefaultIntegrations', () => {
     expect(client?.getIntegrationByName('Mysql')).toBe(userInstance);
   });
 
+  describe('when a channel integration module loads after init', () => {
+    const DSN = 'https://public@dsn.ingest.sentry.io/1337';
+
+    async function loadMysqlLate(client: CloudflareClient | undefined): Promise<void> {
+      const { mysqlIntegration } = await import('@sentry/server-utils');
+      globalThis.__SENTRY_ORCHESTRION__ = {
+        bundler: new Set(['mysql']),
+        integrations: new Map([['mysql', mysqlIntegration]]),
+      };
+      client?.emit('orchestrion.module-injected', 'mysql');
+    }
+
+    test('does not add it when the integrations function filtered it out', async () => {
+      resetSdk();
+      const client = init({
+        dsn: DSN,
+        integrations: defaults => defaults.filter(integration => integration.name !== 'Mysql'),
+      });
+
+      await loadMysqlLate(client);
+
+      expect(client?.getIntegrationByName('Mysql')).toBeUndefined();
+    });
+
+    test('adds it when the integrations function keeps it', async () => {
+      resetSdk();
+      const client = init({ dsn: DSN, integrations: defaults => defaults });
+
+      await loadMysqlLate(client);
+
+      expect(client?.getIntegrationByName('Mysql')).toBeDefined();
+    });
+
+    test('keeps the instance the integrations function configured', async () => {
+      resetSdk();
+      const client = init({
+        dsn: DSN,
+        integrations: defaults => [...defaults, exportedMysqlIntegration()],
+      });
+      const configured = client?.getIntegrationByName('Mysql');
+      expect(configured).toBeDefined();
+
+      await loadMysqlLate(client);
+
+      expect(client?.getIntegrationByName('Mysql')).toBe(configured);
+    });
+
+    test('does not add it and does not throw when the integrations function throws', async () => {
+      resetSdk();
+      let calls = 0;
+      const client = init({
+        dsn: DSN,
+        integrations: defaults => {
+          calls++;
+          if (calls > 1) {
+            throw new Error('integrations failed');
+          }
+          return defaults;
+        },
+      });
+
+      await expect(loadMysqlLate(client)).resolves.toBeUndefined();
+
+      expect(client?.getIntegrationByName('Mysql')).toBeUndefined();
+    });
+
+    test.each([
+      ['false', false as const],
+      ['a custom list', [] as Integration[]],
+    ])('does not add it when defaultIntegrations is %s', async (_label, defaultIntegrations) => {
+      resetSdk();
+      const client = init({ dsn: DSN, defaultIntegrations });
+
+      await loadMysqlLate(client);
+
+      expect(client?.getIntegrationByName('Mysql')).toBeUndefined();
+    });
+  });
+
   test('keeps a channel integration the user configured when its module loads after init', async () => {
     resetSdk();
     const { mysqlIntegration } = await import('@sentry/server-utils');