fix(nestjs): Improve control flow exception filtering (#19524)

Our conditions for dropping control flow errors were a bit broad,
leading to silently dropping errors from being sent to Sentry including
`axios` errors.

Closes #19519

Author: nicohrubec

dev-packages/e2e-tests/test-applications/nestjs-basic/package.json

@@ -21,6 +21,7 @@
     "@nestjs/platform-express": "^10.0.0",
     "@sentry/nestjs": "latest || *",
     "reflect-metadata": "^0.2.0",
+    "axios": "1.13.5",
     "rxjs": "^7.8.1"
   },
   "devDependencies": {

dev-packages/e2e-tests/test-applications/nestjs-basic/src/app.controller.ts

@@ -67,6 +67,11 @@ export class AppController {
     return this.appService.testExpectedRpcException(id);
   }
 
+  @Get('test-axios-error/:id')
+  async testAxiosError(@Param('id') id: string) {
+    return this.appService.testAxiosError(id);
+  }
+
   @Get('test-span-decorator-async')
   async testSpanDecoratorAsync() {
     return { result: await this.appService.testSpanDecoratorAsync() };

dev-packages/e2e-tests/test-applications/nestjs-basic/src/app.service.ts

@@ -3,6 +3,7 @@ import { RpcException } from '@nestjs/microservices';
 import { Cron, SchedulerRegistry } from '@nestjs/schedule';
 import * as Sentry from '@sentry/nestjs';
 import { SentryCron, SentryTraced } from '@sentry/nestjs';
+import { AxiosError } from 'axios';
 
 const monitorConfig = {
   schedule: {
@@ -42,6 +43,17 @@ export class AppService {
     throw new RpcException(`This is an expected RPC exception with id ${id}`);
   }
 
+  testAxiosError(id: string) {
+    throw new AxiosError(
+      `This is an axios error with id ${id}`,
+      'ERR_BAD_RESPONSE',
+      undefined,
+      undefined,
+      // Simulating an upstream API 502 response
+      { status: 502, statusText: 'Bad Gateway', headers: {}, config: { headers: {} }, data: {} } as any,
+    );
+  }
+
   @SentryTraced('wait and return a string')
   async wait() {
     await new Promise(resolve => setTimeout(resolve, 500));

dev-packages/e2e-tests/test-applications/nestjs-basic/tests/errors.test.ts

@@ -34,6 +34,24 @@ test('Sends exception to Sentry', async ({ baseURL }) => {
   });
 });
 
+test('Sends AxiosError to Sentry', async ({ baseURL }) => {
+  const errorEventPromise = waitForError('nestjs-basic', event => {
+    return !event.type && event.exception?.values?.[0]?.value === 'This is an axios error with id 123';
+  });
+
+  const response = await fetch(`${baseURL}/test-axios-error/123`);
+  expect(response.status).toBe(500);
+
+  const errorEvent = await errorEventPromise;
+
+  expect(errorEvent.exception?.values).toHaveLength(1);
+  expect(errorEvent.exception?.values?.[0]?.value).toBe('This is an axios error with id 123');
+  expect(errorEvent.exception?.values?.[0]?.mechanism).toEqual({
+    handled: false,
+    type: 'auto.http.nestjs.global_filter',
+  });
+});
+
 test('Does not send HttpExceptions to Sentry', async ({ baseURL }) => {
   let errorEventOccurred = false;
 

packages/nestjs/src/helpers.ts

@@ -1,13 +1,34 @@
 /**
- * Determines if the exception is an expected control flow error.
- * - HttpException errors will have a status property
- * - RpcException errors will have an error property
+ * Determines if the exception is an expected NestJS control flow error.
+ * - HttpException have getStatus and getResponse methods: https://github.com/nestjs/nest/blob/master/packages/microservices/exceptions/rpc-exception.ts
+ * - RpcException have getError and initMessage methods: https://github.com/nestjs/nest/blob/master/packages/common/exceptions/http.exception.ts
+ *
+ * We cannot use `instanceof HttpException` here because this file is imported
+ * from the main entry point (via decorators.ts), and importing @nestjs/common at that
+ * point would load it before OpenTelemetry instrumentation can patch it, breaking instrumentations.
  *
  * @returns `true` if the exception is expected and should not be reported to Sentry, otherwise `false`.
  */
 export function isExpectedError(exception: unknown): boolean {
-  if (typeof exception === 'object' && exception !== null) {
-    return 'status' in exception || 'error' in exception;
+  if (typeof exception !== 'object' || exception === null) {
+    return false;
+  }
+
+  const ex = exception as Record<string, unknown>;
+
+  // HttpException
+  if (
+    typeof ex.getStatus === 'function' &&
+    typeof ex.getResponse === 'function' &&
+    typeof ex.initMessage === 'function'
+  ) {
+    return true;
+  }
+
+  // RpcException
+  if (typeof ex.getError === 'function' && typeof ex.initMessage === 'function') {
+    return true;
   }
+
   return false;
 }

packages/nestjs/test/helpers.test.ts

@@ -0,0 +1,25 @@
+import { HttpException, HttpStatus } from '@nestjs/common';
+import { describe, expect, it } from 'vitest';
+import { isExpectedError } from '../src/helpers';
+
+describe('isExpectedError', () => {
+  it('should return true for HttpException', () => {
+    expect(isExpectedError(new HttpException('Bad Request', HttpStatus.BAD_REQUEST))).toBe(true);
+  });
+
+  it('should return true for RpcException-like objects', () => {
+    const rpcLike = {
+      getError: () => 'some error',
+      initMessage: () => {},
+    };
+    expect(isExpectedError(rpcLike)).toBe(true);
+  });
+
+  it('should return false for plain Error', () => {
+    expect(isExpectedError(new Error('test'))).toBe(false);
+  });
+
+  it('should return false for object with status property', () => {
+    expect(isExpectedError({ status: 502, message: 'Bad Gateway' })).toBe(false);
+  });
+});