fix(policy-engine): scope loopback suppression per publisher

[sanjulaonline]

Purpose

PR #2879 suppressed the internal loopback LlmProvider hop before publisher
fan-out to prevent duplicate Moesif analytics events. Because the suppression
was a global early return, the same hop was also removed from traffic logging.

That provider hop is the record that isolates the real vendor round-trip, so
dropping it prevents operators from distinguishing vendor latency from gateway
mediation latency.

Fixes #2992

Goals

Suppress the internal loopback provider hop for Moesif while continuing to
deliver it to traffic logging.

Approach

• Added an internal publisher registration that pairs each publisher with its
  loopback-delivery rule without changing the Publisher interface.
• Registered Moesif with suppression enabled and traffic logging with
  suppression explicitly disabled.
• Replaced the global early return with per-publisher filtering during fan-out.
• Kept the existing suppression debug trace, but emit it once and only when a
  publisher is actually skipped.
• Left event preparation and the loopback/direct-peer/XFF validation unchanged.

No new dependencies or configuration changes.

User stories

As an operator investigating a proxied LLM request, I can use the traffic log to
separate vendor latency from gateway mediation while Moesif continues to count
the client request exactly once.

Documentation

N/A — this restores intended traffic-log output without changing configuration
or public APIs.

Automation tests

• Unit tests

  • go test ./internal/analytics/... — passed.
  • Focused loopback, suppression, exactly-one-event, and forged-XFF tests — 11 passed.
  • go test ./... — all 16 policy-engine packages passed.
  • go build ./... — passed.
  • go vet ./internal/analytics/... — passed.
  • go test -race ./internal/analytics — passed.
  • git diff --check — clean.

• Integration tests

  The gateway integration suite was not run locally. The local Windows
  environment has Docker but does not have the host Go and Make toolchain
  required by gateway/it; containerizing the test runner cannot reach the
  Docker Desktop host's published localhost ports without modifying the
  repository test configuration.

  The PR-triggered Gateway Integration Test workflow runs for gateway/**
  changes and will build the coverage images, execute the full gateway
  integration suite, and run both vhost suites.

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes
• Ran FindSecurityBugs plugin and verified report? N/A — Go-only change; the tool is Java-specific
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes

Samples

N/A

Related PRs

• Fix issue of emitting two analytics event per LLM proxy call #2879 introduced the global suppression narrowed by this change.

Test environment

• Go 1.26.5
• Docker 28.4.0 / Compose 2.39.2
• Windows 11

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a8387a36-92b9-4711-b9b4-7ae42185b0dd

📥 Commits

Reviewing files that changed from the base of the PR and between e498dd0 and 64409fc.

📒 Files selected for processing (2)

• gateway/gateway-runtime/policy-engine/internal/analytics/analytics.go
• gateway/gateway-runtime/policy-engine/internal/analytics/analytics_test.go

---

📝 Walkthrough

Walkthrough

Changes

Analytics delivery

Layer / File(s)	Summary
Publisher delivery rules gateway/gateway-runtime/policy-engine/internal/analytics/analytics.go, gateway/gateway-runtime/policy-engine/internal/analytics/analytics_test.go	Publishers now include loopback suppression metadata. Moesif suppresses internal loopback provider events. Traffic logging receives them. Tests use the registered publisher wrapper.
Per-publisher event processing gateway/gateway-runtime/policy-engine/internal/analytics/analytics.go, gateway/gateway-runtime/policy-engine/internal/analytics/analytics_test.go	Process filters events per publisher and logs suppression once when applicable. Tests cover selective delivery, missing peers, logging, exactly-once handling, and panic recovery.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant AnalyticsProcess
  participant MoesifPublisher
  participant TrafficLogPublisher
  AnalyticsProcess->>MoesifPublisher: suppress internal loopback provider event
  AnalyticsProcess->>TrafficLogPublisher: publish internal loopback provider event

Loading

Possibly related PRs

• wso2/api-platform#2879: Introduced the related analytics loopback-suppression logic.
• wso2/api-platform#3006: Also modifies analytics loopback-event suppression and its tests.

Suggested reviewers: rakhitharr, tharsanan1, virajsalaka

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes scoping loopback suppression per publisher.
Description check	✅ Passed	The description covers the required sections, explains the fix, and documents testing, security checks, environment, and documentation impact.
Linked Issues check	✅ Passed	The implementation satisfies issue #2992 by suppressing the provider hop for Moesif while retaining it for traffic logging.
Out of Scope Changes check	✅ Passed	The code and test changes remain focused on publisher-scoped loopback suppression and its expected analytics and traffic-logging behavior.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain modules listed in go.work or their selected dependencies"

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}