Add appropriate labels to the container

Merge remote-tracking branch 'origin/main' into testing
Update go.mod and go.sum
2026-06-05 23:03:48 +00:00 · 2025-02-08 01:27:45 +00:00 · 2025-02-08 00:56:23 +00:00 · 2025-02-07 03:05:38 +00:00 · 2025-02-06 03:04:42 +00:00 · 2025-02-05 03:04:20 +00:00
22 changed files with 979 additions and 288 deletions
@@ -6,3 +6,9 @@ ARG TARGETOS
 COPY --chmod=777 --chown=nonroot:nonroot static/app /go/src/app
 ADD dist/bot-$TARGETOS-$TARGETARCH /go/src/app/graphql-proxy
 ENTRYPOINT ["/go/src/app/graphql-proxy"]
+
+LABEL org.opencontainers.image.maintainer="lukasz@raczylo.com" \
+      org.opencontainers.image.authors="lukasz@raczylo.com" \
+      org.opencontainers.image.title="graphql-monitoring-proxy" \
+      org.opencontainers.image.description="GraphQL monitoring proxy" \
+      org.opencontainers.image.url="https://github.com/lukaszraczylo/graphql-monitoring-proxy"
@@ -13,7 +13,7 @@ help:  ## display this help

 .PHONY: run
 run: build ## run application
-	@LOG_LEVEL=debug PURGE_METRICS_ON_CRAWL=true BLOCK_SCHEMA_INTROSPECTION=false CACHE_TTL=10 JWT_ROLE_RATE_LIMIT=false JWT_ROLE_CLAIM_PATH="Hasura.x-hasura-default-role" JWT_USER_CLAIM_PATH="Hasura.x-hasura-user-id" HOST_GRAPHQL=https://hasura8.lan/ HEALTHCHECK_GRAPHQL_URL=https://hasura8.lan/v1/graphql ./graphql-proxy
+	@LOG_LEVEL=debug PURGE_METRICS_ON_CRAWL=true BLOCK_SCHEMA_INTROSPECTION=true CACHE_TTL=10 JWT_ROLE_RATE_LIMIT=false JWT_ROLE_CLAIM_PATH="Hasura.x-hasura-default-role" JWT_USER_CLAIM_PATH="Hasura.x-hasura-user-id" HOST_GRAPHQL=https://hasura8.lan/ HEALTHCHECK_GRAPHQL_URL=https://hasura8.lan/v1/graphql PORT_GRAPHQL=8111 ./graphql-proxy

 .PHONY: build
 build: ## build the binary
@@ -14,6 +14,7 @@ This project is in active use by [telegram-bot.app](https://telegram-bot.app), a
  - [Endpoints](#endpoints)
  - [Features](#features)
  - [Configuration](#configuration)
+  - [Tracing](#tracing)
  - [Speed](#speed)
    - [Caching](#caching)
    - [Read-only endpoint](#read-only-endpoint)
@@ -40,6 +41,8 @@ I wanted to monitor the queries and responses of our graphql endpoint. Still, we

 You should always try to stick to the latest and greatest version of the graphql-proxy to ensure that it's as much bug-free as possible. Following list will be kept to the maximum of five "most important" bugs and enhancements included in the latest versions.

+* **06/12/2024 - 0.25.12** - Fixes the bug where deeply nested introspection queries were blocked despite of being present on the whitelist. GraphQL proxy will now inspect the queries in depth to find any possible nested introspections.
+
 * **20/08/2024 - 0.23.21+** - Fixes the bug when timeouts were not respected on proxy-graphql line. Affected versions before that were timeouting after 30 seconds which was set as default ( thanks to Jurica Železnjak for reporting ). It also provides a temporary fix for running within kubernetes deployment, when graphql server ( for example - hasura ) took more time to start than the proxy, causing avalanche of errors with "can't proxy the request".

 * **19/08/2024 - 0.21.82+** - Fixed the issue when proxy failed to start if global cache was disabled, therefore not initialized and proxy tried to perform the cache operations during normal query operations.
@@ -105,6 +108,7 @@ In this case, both proxy and websockets will be available under the `/v1/graphql
 | monitor    | Extracting user id from JWT token and adding it as a label to metrics |
 | monitor    | Extracting the query name and type and adding it as a label to metrics|
 | monitor    | Calculating the query duration and adding it to the metrics           |
+| monitor    | OpenTelemetry tracing support with configurable endpoint              |
 | speed      | Caching the queries, together with per-query cache and TTL            |
 | speed      | Support for READ ONLY graphql endpoint                                |
 | security   | Blocking schema introspection                                         |
@@ -153,6 +157,26 @@ You can still use the non-prefixed environment variables in the spirit of the ba
 | `HASURA_EVENT_CLEANER`   | Enable the hasura event cleaner          | `false`                    |
 | `HASURA_EVENT_CLEANER_OLDER_THAN` | The interval for the hasura event cleaner (in days) | `1`                  |
 | `HASURA_EVENT_METADATA_DB` | URL to the hasura metadata database    | `postgresql://localhost:5432/hasura` |
+| `ENABLE_TRACE`            | Enable OpenTelemetry tracing           | `false`                    |
+| `TRACE_ENDPOINT`          | OpenTelemetry collector endpoint       | `localhost:4317`           |
+
+### Tracing
+
+The proxy supports OpenTelemetry tracing to help monitor and debug requests. When enabled, it will create spans for each proxied request and send them to the configured OpenTelemetry collector.
+
+To use tracing:
+
+1. Enable tracing by setting `ENABLE_TRACE=true`
+2. Configure the OpenTelemetry collector endpoint using `TRACE_ENDPOINT` (defaults to `localhost:4317`)
+3. Include trace context in your requests using the `X-Trace-Span` header with the following format:
+
+```json
+{
+  "traceparent": "00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01"
+}
+```
+
+The proxy will extract the trace context from the header and create child spans for each request, allowing you to trace requests through your system.

 ### Speed

@@ -327,3 +351,5 @@ graphql_proxy_cache_hit{microservice="graphql_proxy",pod="hasura-w-proxy-interna
 graphql_proxy_cache_hit{pod="hasura-w-proxy-internal-6b5f4b4bbb-9xwfc",microservice="graphql_proxy"} 1
 graphql_proxy_cache_miss{microservice="graphql_proxy",pod="hasura-w-proxy-internal-6b5f4b4bbb-9xwfc"} 23
 ```
+
+.
@@ -71,13 +71,14 @@ func enableHasuraEventCleaner() {

 func cleanEvents(pool *pgxpool.Pool) {
 	ctx := context.Background()
+	var errors []error
+	var failedQueries []string
+
 	for _, query := range delQueries {
 		_, err := pool.Exec(ctx, fmt.Sprintf(query, cfg.HasuraEventCleaner.ClearOlderThan))
 		if err != nil {
-			cfg.Logger.Error(&libpack_logger.LogMessage{
-				Message: "Failed to execute query",
-				Pairs:   map[string]interface{}{"query": query, "error": err.Error()},
-			})
+			errors = append(errors, err)
+			failedQueries = append(failedQueries, query)
 		} else {
 			cfg.Logger.Debug(&libpack_logger.LogMessage{
 				Message: "Successfully executed query",
@@ -85,4 +86,18 @@ func cleanEvents(pool *pgxpool.Pool) {
 			})
 		}
 	}
+
+	if len(errors) > 0 {
+		var errMsgs []string
+		for _, err := range errors {
+			errMsgs = append(errMsgs, err.Error())
+		}
+		cfg.Logger.Error(&libpack_logger.LogMessage{
+			Message: "Failed to execute some queries",
+			Pairs: map[string]interface{}{
+				"failed_queries": failedQueries,
+				"errors":         errMsgs,
+			},
+		})
+	}
 }
@@ -1,55 +1,71 @@
 module github.com/lukaszraczylo/graphql-monitoring-proxy

-go 1.22.4
+go 1.22.7
+
+toolchain go1.23.4

 require (
-	github.com/VictoriaMetrics/metrics v1.35.1
+	github.com/VictoriaMetrics/metrics v1.35.2
 	github.com/alicebob/miniredis/v2 v2.33.0
 	github.com/avast/retry-go/v4 v4.6.0
-	github.com/goccy/go-json v0.10.3
-	github.com/gofiber/fiber/v2 v2.52.5
+	github.com/goccy/go-json v0.10.5
+	github.com/gofiber/fiber/v2 v2.52.6
 	github.com/gofrs/flock v0.12.1
 	github.com/google/uuid v1.6.0
-	github.com/gookit/goutil v0.6.16
+	github.com/gookit/goutil v0.6.18
 	github.com/graphql-go/graphql v0.8.1
-	github.com/jackc/pgx/v5 v5.7.1
+	github.com/jackc/pgx/v5 v5.7.2
 	github.com/lukaszraczylo/ask v0.0.0-20240916204100-6e9ef53a62d9
 	github.com/lukaszraczylo/go-ratecounter v0.1.12
-	github.com/lukaszraczylo/go-simple-graphql v1.2.25
-	github.com/redis/go-redis/v9 v9.6.1
-	github.com/stretchr/testify v1.9.0
-	github.com/valyala/fasthttp v1.55.0
+	github.com/lukaszraczylo/go-simple-graphql v1.2.41
+	github.com/redis/go-redis/v9 v9.7.0
+	github.com/stretchr/testify v1.10.0
+	github.com/valyala/fasthttp v1.58.0
+	go.opentelemetry.io/otel v1.34.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0
+	go.opentelemetry.io/otel/sdk v1.34.0
+	go.opentelemetry.io/otel/trace v1.34.0
+	google.golang.org/grpc v1.70.0
 )

 require (
 	github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a // indirect
-	github.com/andybalholm/brotli v1.1.0 // indirect
+	github.com/andybalholm/brotli v1.1.1 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/gookit/color v1.5.4 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
-	github.com/klauspost/compress v1.17.9 // indirect
-	github.com/kr/text v0.2.0 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fastrand v1.1.0 // indirect
 	github.com/valyala/histogram v1.2.0 // indirect
 	github.com/valyala/tcplisten v1.0.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/yuin/gopher-lua v1.1.1 // indirect
-	golang.org/x/crypto v0.27.0 // indirect
-	golang.org/x/net v0.29.0 // indirect
-	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/sys v0.25.0 // indirect
-	golang.org/x/term v0.24.0 // indirect
-	golang.org/x/text v0.18.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
+	go.opentelemetry.io/otel/metric v1.34.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
+	golang.org/x/crypto v0.32.0 // indirect
+	golang.org/x/net v0.34.0 // indirect
+	golang.org/x/sync v0.11.0 // indirect
+	golang.org/x/sys v0.30.0 // indirect
+	golang.org/x/term v0.29.0 // indirect
+	golang.org/x/text v0.22.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250204164813-702378808489 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250204164813-702378808489 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
@@ -1,49 +1,63 @@
-github.com/VictoriaMetrics/metrics v1.35.1 h1:o84wtBKQbzLdDy14XeskkCZih6anG+veZ1SwJHFGwrU=
-github.com/VictoriaMetrics/metrics v1.35.1/go.mod h1:r7hveu6xMdUACXvB8TYdAj8WEsKzWB0EkpJN+RDtOf8=
+github.com/VictoriaMetrics/metrics v1.35.2 h1:Bj6L6ExfnakZKYPpi7mGUnkJP4NGQz2v5wiChhXNyWQ=
+github.com/VictoriaMetrics/metrics v1.35.2/go.mod h1:r7hveu6xMdUACXvB8TYdAj8WEsKzWB0EkpJN+RDtOf8=
 github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a h1:HbKu58rmZpUGpz5+4FfNmIU+FmZg2P3Xaj2v2bfNWmk=
 github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=
 github.com/alicebob/miniredis/v2 v2.33.0 h1:uvTF0EDeu9RLnUEG27Db5I68ESoIxTiXbNUiji6lZrA=
 github.com/alicebob/miniredis/v2 v2.33.0/go.mod h1:MhP4a3EU7aENRi9aO+tHfTBZicLqQevyi/DJpoj6mi0=
-github.com/andybalholm/brotli v1.1.0 h1:eLKJA0d02Lf0mVpIDgYnqXcUn0GqVmEFny3VuID1U3M=
-github.com/andybalholm/brotli v1.1.0/go.mod h1:sms7XGricyQI9K10gOSf56VKKWS4oLer58Q+mhRPtnY=
+github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7XdTA=
+github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
 github.com/avast/retry-go/v4 v4.6.0 h1:K9xNA+KeB8HHc2aWFuLb25Offp+0iVRXEvFx8IinRJA=
 github.com/avast/retry-go/v4 v4.6.0/go.mod h1:gvWlPhBVsvBbLkVGDg/KwvBv0bEkCOLRRSHKIr2PyOE=
 github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
 github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
 github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
 github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
-github.com/goccy/go-json v0.10.3 h1:KZ5WoDbxAIgm2HNbYckL0se1fHD6rz5j4ywS6ebzDqA=
-github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
-github.com/gofiber/fiber/v2 v2.52.5 h1:tWoP1MJQjGEe4GB5TUGOi7P2E0ZMMRx5ZTG4rT+yGMo=
-github.com/gofiber/fiber/v2 v2.52.5/go.mod h1:KEOE+cXMhXG0zHc9d8+E38hoX+ZN7bhOtgeF2oT6jrQ=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
+github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/goccy/go-reflect v1.2.0 h1:O0T8rZCuNmGXewnATuKYnkL0xm6o8UNOJZd/gOkb9ms=
+github.com/goccy/go-reflect v1.2.0/go.mod h1:n0oYZn8VcV2CkWTxi8B9QjkCoq6GTtCEdfmR66YhFtE=
+github.com/gofiber/fiber/v2 v2.52.6 h1:Rfp+ILPiYSvvVuIPvxrBns+HJp8qGLDnLJawAu27XVI=
+github.com/gofiber/fiber/v2 v2.52.6/go.mod h1:YEcBbO/FB+5M1IZNBP9FO3J9281zgPAreiI1oqg8nDw=
 github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
 github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gookit/color v1.5.4 h1:FZmqs7XOyGgCAxmWyPslpiok1k05wmY3SJTytgvYFs0=
 github.com/gookit/color v1.5.4/go.mod h1:pZJOeOS8DM43rXbp4AZo1n9zCU2qjpcRko0b6/QJi9w=
-github.com/gookit/goutil v0.6.16 h1:9fRMCF4X9abdRD5+2HhBS/GwafjBlTUBjRtA5dgkvuw=
-github.com/gookit/goutil v0.6.16/go.mod h1:op2q8AoPDFSiY2+qkHxcBWQMYxOLQ1GbLXqe7vrwscI=
+github.com/gookit/goutil v0.6.18 h1:MUVj0G16flubWT8zYVicIuisUiHdgirPAkmnfD2kKgw=
+github.com/gookit/goutil v0.6.18/go.mod h1:AY/5sAwKe7Xck+mEbuxj0n/bc3qwrGNe3Oeulln7zBA=
 github.com/graphql-go/graphql v0.8.1 h1:p7/Ou/WpmulocJeEx7wjQy611rtXGQaAcXGqanuMMgc=
 github.com/graphql-go/graphql v0.8.1/go.mod h1:nKiHzRM0qopJEwCITUuIsxk9PlVlwIiiI8pnJEhordQ=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.0 h1:VD1gqscl4nYs1YxVuSdemTrSgTKrwOWDK0FVFMqm+Cg=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.0/go.mod h1:4EgsQoS4TOhJizV+JTFg40qx1Ofh3XmXEQNBpgvNT40=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.7.1 h1:x7SYsPBYDkHDksogeSmZZ5xzThcTgRz++I5E+ePFUcs=
-github.com/jackc/pgx/v5 v5.7.1/go.mod h1:e7O26IywZZ+naJtWWos6i6fvWK+29etgITqrqHLfoZA=
+github.com/jackc/pgx/v5 v5.7.2 h1:mLoDLV6sonKlvjIEsV56SkWNCnuNv531l94GaIzO+XI=
+github.com/jackc/pgx/v5 v5.7.2/go.mod h1:ncY89UGWxg82EykZUwSpUKEfccBGGYq1xjrOpsbsfGQ=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
-github.com/klauspost/compress v1.17.9 h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA=
-github.com/klauspost/compress v1.17.9/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
+github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
+github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -52,33 +66,32 @@ github.com/lukaszraczylo/ask v0.0.0-20240916204100-6e9ef53a62d9 h1:pL8B9mjv6RPUf
 github.com/lukaszraczylo/ask v0.0.0-20240916204100-6e9ef53a62d9/go.mod h1:M+UVdyqZs++xtEPrascaVmZdOMhCnxjZ2SgH+xHpR0c=
 github.com/lukaszraczylo/go-ratecounter v0.1.12 h1:VO6hHYGw/Jy9JUizXf/bS0AI2QX1ueWWAWckMFVJ/w4=
 github.com/lukaszraczylo/go-ratecounter v0.1.12/go.mod h1:TqXEOCtFJStk1i0tkipprv1kiDHGon1MVUisjSTBSKM=
-github.com/lukaszraczylo/go-simple-graphql v1.2.25 h1:qufWMftg+DXlZcQZGHRKukLPxJWH3oNK+r2J9wNolFg=
-github.com/lukaszraczylo/go-simple-graphql v1.2.25/go.mod h1:coYAAtPYeMgIoNhDblnyVeZwCKBXw5BGMPexpJGE0mg=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/lukaszraczylo/go-simple-graphql v1.2.41 h1:RNFEjntCsjvKA5VADdio3zid3nH0+rO9qdKJvXmRpfQ=
+github.com/lukaszraczylo/go-simple-graphql v1.2.41/go.mod h1:i0R9B7tR025qduN4/t6ujolMBdWyiMlAppqczrnPfLc=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/redis/go-redis/v9 v9.6.1 h1:HHDteefn6ZkTtY5fGUE8tj8uy85AHk6zP7CpzIAM0y4=
-github.com/redis/go-redis/v9 v9.6.1/go.mod h1:0C0c6ycQsdpVNQpxb1njEQIqkx5UcsM8FJCQLgE9+RA=
+github.com/redis/go-redis/v9 v9.7.0 h1:HhLSs+B6O021gwzl+locl0zEDnyNkxMtf/Z3NNBMa9E=
+github.com/redis/go-redis/v9 v9.7.0/go.mod h1:f6zhXITC7JUJIlPEiBOTXxJgPLdZcA93GewI7inzyWw=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
-github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
-github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
-github.com/valyala/fasthttp v1.55.0 h1:Zkefzgt6a7+bVKHnu/YaYSOPfNYNisSVBo/unVCf8k8=
-github.com/valyala/fasthttp v1.55.0/go.mod h1:NkY9JtkrpPKmgwV3HTaS2HWaJss9RSIsRVfcxxoHiOM=
+github.com/valyala/fasthttp v1.58.0 h1:GGB2dWxSbEprU9j0iMJHgdKYJVDyjrOwF9RE59PbRuE=
+github.com/valyala/fasthttp v1.58.0/go.mod h1:SYXvHHaFp7QZHGKSHmoMipInhrI5StHrhDTYVEjK/Kw=
 github.com/valyala/fastrand v1.1.0 h1:f+5HkLW4rsgzdNoleUOB69hyT9IlD2ZQh9GyDMfb5G8=
 github.com/valyala/fastrand v1.1.0/go.mod h1:HWqCzkrkg6QXT8V2EXWvXCoow7vLwOFN002oeRzjapQ=
 github.com/valyala/histogram v1.2.0 h1:wyYGAZZt3CpwUiIb9AU/Zbllg1llXyrtApRS815OLoQ=
@@ -87,24 +100,53 @@ github.com/valyala/tcplisten v1.0.0 h1:rBHj/Xf+E1tRGZyWIWwJDiRY0zc1Js+CV5DqwacVS
 github.com/valyala/tcplisten v1.0.0/go.mod h1:T0xQ8SeCZGxckz9qRXTfG43PvQ/mcWh7FwZEA7Ioqkc=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
+github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
+github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
 github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
 github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
-golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
-golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
+go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 h1:OeNbIYk/2C15ckl7glBlOBp5+WlYsOElzTNmiPW/x60=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0/go.mod h1:7Bept48yIeqxP2OZ9/AqIpYS94h2or0aB4FypJTc8ZM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 h1:tgJ0uaNS4c98WRNUEx5U3aDlrDOI5Rs+1Vifcw4DJ8U=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0/go.mod h1:U7HYyW0zt/a9x5J1Kjs+r1f/d4ZHnYFclhYY2+YbeoE=
+go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ=
+go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE=
+go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A=
+go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU=
+go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
+go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
+go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k=
+go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
+go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
+go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
+golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
 golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561 h1:MDc5xs78ZrZr3HMQugiXOAkSZtfTpbJLDr/lwfgO53E=
 golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
-golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
-golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
+golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
+golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
+golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
-golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM=
-golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8=
-golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
-golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
+golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
+golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
+golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
+golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
+google.golang.org/genproto/googleapis/api v0.0.0-20250204164813-702378808489 h1:fCuMM4fowGzigT89NCIsW57Pk9k2D12MMi2ODn+Nk+o=
+google.golang.org/genproto/googleapis/api v0.0.0-20250204164813-702378808489/go.mod h1:iYONQfRdizDB8JJBybql13nArx91jcUk7zCXEsOofM4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250204164813-702378808489 h1:5bKytslY8ViY0Cj/ewmRtrWHW64bNF03cAatUUFCdFI=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250204164813-702378808489/go.mod h1:8BS3B93F/U1juMFq9+EDk+qOT5CO1R9IzXxG3PTqiRk=
+google.golang.org/grpc v1.70.0 h1:pWFv03aZoHzlRKHWicjsZytKAiYCtNS0dHbXnIdq7jQ=
+google.golang.org/grpc v1.70.0/go.mod h1:ofIJqVKDXx/JiXrwr2IG4/zwdH9txy3IlF40RmcJSQw=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -27,9 +27,16 @@ var (
 )

 func prepareQueriesAndExemptions() {
+	introspectionAllowedQueries = make(map[string]struct{})
+	allowedUrls = make(map[string]struct{})
+
+	// Process allowed introspection queries
 	for _, q := range cfg.Security.IntrospectionAllowed {
-		introspectionAllowedQueries[strings.ToLower(q)] = struct{}{}
+		cleanQuery := strings.Trim(strings.TrimSpace(q), `"`)
+		introspectionAllowedQueries[strings.ToLower(cleanQuery)] = struct{}{}
 	}
+
+	// Process allowed URLs
 	for _, u := range cfg.Server.AllowURLs {
 		allowedUrls[u] = struct{}{}
 	}
@@ -79,10 +86,6 @@ func parseGraphQLQuery(c *fiber.Ctx) *parseGraphQLQueryResult {
 		if ifNotInTest() {
 			cfg.Monitoring.Increment(libpack_monitoring.MetricsSkipped, nil)
 		}
-		if res.shouldBlock {
-			resultPool.Put(res)
-			return res
-		}
 		return res
 	}

@@ -95,7 +98,6 @@ func parseGraphQLQuery(c *fiber.Ctx) *parseGraphQLQueryResult {
 		if ifNotInTest() {
 			cfg.Monitoring.Increment(libpack_monitoring.MetricsSkipped, nil)
 		}
-		resultPool.Put(res)
 		return res
 	}

@@ -108,7 +110,6 @@ func parseGraphQLQuery(c *fiber.Ctx) *parseGraphQLQueryResult {
 		if ifNotInTest() {
 			cfg.Monitoring.Increment(libpack_monitoring.MetricsFailed, nil)
 		}
-		resultPool.Put(res)
 		return res
 	}

@@ -125,21 +126,11 @@ func parseGraphQLQuery(c *fiber.Ctx) *parseGraphQLQueryResult {
 			}

 			if cfg.Server.HostGraphQLReadOnly != "" {
-				if res.operationType == "" {
-					res.activeEndpoint = cfg.Server.HostGraphQLReadOnly
-				} else if res.operationType != "mutation" {
+				if res.operationType == "" || res.operationType != "mutation" {
 					res.activeEndpoint = cfg.Server.HostGraphQLReadOnly
 				}
 			}

-			cfg.Logger.Debug(&libpack_logger.LogMessage{
-				Message: "Endpoint selection",
-				Pairs: map[string]interface{}{
-					"operationType":    res.operationType,
-					"selectedEndpoint": res.activeEndpoint,
-				},
-			})
-
 			if res.operationType == "mutation" && cfg.Server.ReadOnlyMode {
 				cfg.Logger.Warning(&libpack_logger.LogMessage{
 					Message: "Mutation blocked - server in read-only mode",
@@ -173,8 +164,9 @@ func parseGraphQLQuery(c *fiber.Ctx) *parseGraphQLQueryResult {
 			}

 			if cfg.Security.BlockIntrospection {
-				res.shouldBlock = checkSelections(c, oper.GetSelectionSet().Selections)
-				if res.shouldBlock {
+				if checkSelections(c, oper.GetSelectionSet().Selections) {
+					_ = c.Status(403).SendString("Introspection queries are not allowed")
+					res.shouldBlock = true
 					resultPool.Put(res)
 					return res
 				}
@@ -185,43 +177,70 @@ func parseGraphQLQuery(c *fiber.Ctx) *parseGraphQLQueryResult {
 }

 func checkSelections(c *fiber.Ctx, selections []ast.Selection) bool {
-	stack := make([]ast.Selection, len(selections))
-	copy(stack, selections)
-
-	for len(stack) > 0 {
-		var s ast.Selection
-		s, stack = stack[len(stack)-1], stack[:len(stack)-1]
-
-		if field, ok := s.(*ast.Field); ok {
-			if checkIfContainsIntrospection(c, field.Name.Value) {
-				return true
+	for _, s := range selections {
+		switch sel := s.(type) {
+		case *ast.Field:
+			fieldName := strings.ToLower(sel.Name.Value)
+			if _, exists := introspectionQueries[fieldName]; exists {
+				if len(cfg.Security.IntrospectionAllowed) > 0 {
+					_, allowed := introspectionAllowedQueries[fieldName]
+					if !allowed {
+						return true // Block if this field isn't allowed
+					}
+					// Even if this field is allowed, we need to check its nested selections
+				} else {
+					return true // Block if no allowlist exists
+				}
 			}
-			if field.SelectionSet != nil {
-				stack = append(stack, field.GetSelectionSet().Selections...)
+			// Always check nested selections
+			if sel.SelectionSet != nil {
+				if checkSelections(c, sel.GetSelectionSet().Selections) {
+					return true
+				}
+			}
+		case *ast.InlineFragment:
+			if sel.SelectionSet != nil {
+				if checkSelections(c, sel.GetSelectionSet().Selections) {
+					return true
+				}
 			}
 		}
 	}
 	return false
 }

-func checkIfContainsIntrospection(c *fiber.Ctx, whatever string) bool {
-	whateverLower := strings.ToLower(whatever)
-
-	if _, exists := introspectionQueries[whateverLower]; exists {
-		if len(cfg.Security.IntrospectionAllowed) > 0 {
-			if _, allowed := introspectionAllowedQueries[whateverLower]; allowed {
-				cfg.Logger.Debug(&libpack_logger.LogMessage{
-					Message: "Introspection query allowed, passing through",
-					Pairs:   map[string]interface{}{"query": whatever},
-				})
-				return false
+func checkIfContainsIntrospection(c *fiber.Ctx, query string) bool {
+	blocked := false
+	// Try parsing as a complete query first
+	p, err := parser.Parse(parser.ParseParams{Source: query})
+	if err == nil {
+		// It's a complete query, check all selections
+		for _, def := range p.Definitions {
+			if op, ok := def.(*ast.OperationDefinition); ok {
+				if op.SelectionSet != nil {
+					blocked = checkSelections(c, op.GetSelectionSet().Selections)
+				}
 			}
 		}
+	} else {
+		// Not a complete query, check as a field name
+		whateverLower := strings.ToLower(query)
+		if _, exists := introspectionQueries[whateverLower]; exists {
+			if len(cfg.Security.IntrospectionAllowed) > 0 {
+				if _, allowed := introspectionAllowedQueries[whateverLower]; !allowed {
+					blocked = true
+				}
+			} else {
+				blocked = true
+			}
+		}
+	}
+
+	if blocked {
 		if ifNotInTest() {
 			cfg.Monitoring.Increment(libpack_monitoring.MetricsSkipped, nil)
 		}
 		_ = c.Status(403).SendString("Introspection queries are not allowed")
-		return true
 	}
-	return false
+	return blocked
 }
@@ -3,8 +3,12 @@ package main
 import (
 	"fmt"
 	"strings"
+	"testing"

+	"github.com/goccy/go-json"
 	fiber "github.com/gofiber/fiber/v2"
+	"github.com/graphql-go/graphql/language/ast"
+	"github.com/graphql-go/graphql/language/parser"
 	"github.com/valyala/fasthttp"
 )

@@ -278,23 +282,15 @@ func (suite *Tests) Test_parseGraphQLQuery() {
 		suite.Run(tt.name, func() {
 			cfg = &config{}
 			parseConfig()
-			ctx_headers := func() *fasthttp.RequestHeader {
-				h := fasthttp.RequestHeader{}
-				for k, v := range tt.suppliedQuery.headers {
-					h.Add(k, v)
-				}
-				return &h
-			}()
-
-			ctx_request := fasthttp.Request{
-				Header: *ctx_headers,
+			ctx := suite.app.AcquireCtx(&fasthttp.RequestCtx{})
+			
+			// Set headers
+			for k, v := range tt.suppliedQuery.headers {
+				ctx.Request().Header.Add(k, v)
 			}

-			ctx_request.AppendBody([]byte(tt.suppliedQuery.body))
-
-			ctx := suite.app.AcquireCtx(&fasthttp.RequestCtx{
-				Request: ctx_request,
-			})
+			// Set body
+			ctx.Request().AppendBody([]byte(tt.suppliedQuery.body))

 			// defer func() {
 			// 	cfg = &config{}
@@ -393,7 +389,7 @@ func (suite *Tests) Test_checkAllowedURLs() {
 			ctx.Request().SetRequestURI(tt.path)
 			ctx.Request().URI().SetPath(tt.path)
 			result := checkAllowedURLs(ctx)
-			assert.Equal(tt.expected, result)
+			assert.Equal(tt.expected, result, "Unexpected result in test case: "+tt.name)
 		})
 	}
 }
@@ -408,6 +404,8 @@ func (suite *Tests) Test_checkIfContainsIntrospection() {
 		{"allowed introspection", "__schema", []string{"__schema"}, false},
 		{"disallowed introspection", "__type", []string{"__schema"}, true},
 		{"non-introspection query", "normalQuery", []string{}, false},
+		{"allowed introspection with deep nesting of __typename", "{__schema {queryType {fields {name description __typename}}}}", []string{"__schema", "__typename"}, false},
+		{"disallowed introspection with deep nesting of __typename", "{__type {queryType {fields {name description __typename}}}}", []string{"__type"}, true},
 	}

 	for _, tt := range tests {
@@ -430,3 +428,176 @@ func createTestContext(body string) *fiber.Ctx {
 	ctx.Request().SetBody([]byte(body))
 	return ctx
 }
+
+func (suite *Tests) Test_DeepIntrospectionQueries() {
+	tests := []struct {
+		name     string
+		query    string
+		allowed  []string
+		expected bool
+	}{
+		{
+			name:     "deeply nested single introspection",
+			query:    "query { users { profiles { settings { preferences { __typename } } } } }",
+			allowed:  []string{},
+			expected: true,
+		},
+		{
+			name:     "multiple nested introspections",
+			query:    "query { users { __typename profiles { __schema settings { __type } } } }",
+			allowed:  []string{},
+			expected: true,
+		},
+		{
+			name:     "nested with selective allowlist",
+			query:    "query { users { __typename profiles { __schema settings { __type } } } }",
+			allowed:  []string{"__typename"},
+			expected: true,
+		},
+		{
+			name:     "deeply nested with full allowlist",
+			query:    "query { users { __typename profiles { __schema settings { __type } } } }",
+			allowed:  []string{"__typename", "__schema", "__type"},
+			expected: false,
+		},
+		{
+			name:     "deeply nested with repeated item from allowlist",
+			query:    "query PreloadStaticData {\n  scenario {\n    id\n    name\n    __typename\n  }\n  impact {\n    id\n    description\n    __typename\n  }\n  likelihood {\n    id\n    description\n    __typename\n  }\n  consequence {\n    name\n    __typename\n  }\n  risk_categories {\n    name\n    abbreviation\n    __typename\n  }\n  mitigation {\n    name\n    __typename\n  }\n}",
+			allowed:  []string{"__type", "__typename"},
+			expected: false,
+		},
+		{
+			name:     "deeply nested with repeated item denied",
+			query:    "query PreloadStaticData {\n  scenario {\n    id\n    name\n    __typename\n  }\n  impact {\n    id\n    description\n    __typename\n  }\n  likelihood {\n    id\n    description\n    __typename\n  }\n  consequence {\n    name\n    __typename\n  }\n  risk_categories {\n    name\n    abbreviation\n    __typename\n  }\n  mitigation {\n    name\n    __typename\n  }\n}",
+			allowed:  []string{},
+			expected: true,
+		},
+	}
+
+	for _, tt := range tests {
+		suite.Run(tt.name, func() {
+			cfg.Security.BlockIntrospection = true
+			cfg.Security.IntrospectionAllowed = tt.allowed
+			introspectionAllowedQueries = make(map[string]struct{})
+			for _, q := range tt.allowed {
+				introspectionAllowedQueries[strings.ToLower(q)] = struct{}{}
+			}
+			body := map[string]interface{}{
+				"query": tt.query,
+			}
+			bodyBytes, _ := json.Marshal(body)
+			ctx := fiber.New().AcquireCtx(&fasthttp.RequestCtx{})
+			ctx.Request().SetBody(bodyBytes)
+			parseGraphQLQuery(ctx)
+			if tt.expected {
+				suite.Equal(403, ctx.Response().StatusCode())
+			} else {
+				suite.Equal(200, ctx.Response().StatusCode())
+			}
+		})
+	}
+}
+
+func TestIntrospectionQueryHandling(t *testing.T) {
+	tests := []struct {
+		name               string
+		blockIntrospection bool
+		allowedQueries     []string
+		query              string
+		wantBlocked        bool
+	}{
+		{
+			name:               "allows __typename when in allowed list",
+			blockIntrospection: true,
+			allowedQueries:     []string{"__typename"},
+			query: `{
+							users {
+									id
+									name
+									__typename
+							}
+					}`,
+			wantBlocked: false,
+		},
+		{
+			name:               "case insensitive matching for allowed queries",
+			blockIntrospection: true,
+			allowedQueries:     []string{"__TYPENAME"},
+			query: `{
+							users {
+									__typename
+							}
+					}`,
+			wantBlocked: false,
+		},
+		{
+			name:               "blocks other introspection queries",
+			blockIntrospection: true,
+			allowedQueries:     []string{"__typename"},
+			query: `{
+							__schema {
+									types {
+											name
+									}
+							}
+					}`,
+			wantBlocked: true,
+		},
+		{
+			name:               "allows multiple __typename occurrences",
+			blockIntrospection: true,
+			allowedQueries:     []string{"__typename"},
+			query: `{
+							users {
+									__typename
+									posts {
+											__typename
+									}
+							}
+					}`,
+			wantBlocked: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Setup config
+			cfg = &config{
+				Security: struct {
+					IntrospectionAllowed []string
+					BlockIntrospection   bool
+				}{
+					IntrospectionAllowed: tt.allowedQueries,
+					BlockIntrospection:   tt.blockIntrospection,
+				},
+			}
+
+			// Initialize allowed queries
+			prepareQueriesAndExemptions()
+
+			// Parse query
+			p, err := parser.Parse(parser.ParseParams{Source: tt.query})
+			if err != nil {
+				t.Fatalf("failed to parse query: %v", err)
+			}
+
+			// Create mock fiber context
+			app := fiber.New()
+			ctx := app.AcquireCtx(&fasthttp.RequestCtx{})
+			defer app.ReleaseCtx(ctx)
+
+			// Check selections
+			var blocked bool
+			for _, def := range p.Definitions {
+				if op, ok := def.(*ast.OperationDefinition); ok {
+					blocked = checkSelections(ctx, op.GetSelectionSet().Selections)
+					break
+				}
+			}
+
+			if blocked != tt.wantBlocked {
+				t.Errorf("checkSelections() blocked = %v, want %v", blocked, tt.wantBlocked)
+			}
+		})
+	}
+}
@@ -2,7 +2,6 @@ package libpack_logger

 import (
 	"bytes"
-	"flag"
 	"fmt"
 	"io"
 	"os"
@@ -16,16 +15,14 @@ import (
 )

 const (
-	_ = iota
-	LEVEL_DEBUG
+	LEVEL_DEBUG = iota
 	LEVEL_INFO
 	LEVEL_WARN
 	LEVEL_ERROR
 	LEVEL_FATAL
 )

-var LevelNames = [...]string{
-	"none",
+var levelNames = []string{
 	"debug",
 	"info",
 	"warn",
@@ -34,74 +31,103 @@ var LevelNames = [...]string{
 }

 const (
-	defaultFormat     = time.RFC3339
+	defaultTimeFormat = time.RFC3339
 	defaultMinLevel   = LEVEL_INFO
 	defaultShowCaller = false
 )

-var defaultOutput = os.Stdout
-
+// Logger represents the logging object with configurations.
 type Logger struct {
 	output      io.Writer
-	format      string
+	timeFormat  string
 	minLogLevel int
 	showCaller  bool
 }

+// LogMessage represents a log message with optional pairs.
 type LogMessage struct {
-	output  io.Writer
-	Pairs   map[string]any
+	Pairs   map[string]interface{}
 	Message string
 }

-func (m *LogMessage) String() string {
-	return m.Message
+// bufferPool is used to reuse bytes.Buffer for efficiency.
+var bufferPool = sync.Pool{
+	New: func() interface{} {
+		return new(bytes.Buffer)
+	},
 }

+// fieldNames allows customization of output field names.
 var fieldNames = map[string]string{
 	"timestamp": "timestamp",
 	"level":     "level",
 	"message":   "message",
 }

+// New creates a new Logger with default settings.
 func New() *Logger {
 	return &Logger{
-		format:      defaultFormat,
+		timeFormat:  defaultTimeFormat,
 		minLogLevel: defaultMinLevel,
-		output:      defaultOutput,
+		output:      os.Stdout,
 		showCaller:  defaultShowCaller,
 	}
 }

+// SetOutput sets the output destination for the logger.
 func (l *Logger) SetOutput(output io.Writer) *Logger {
 	l.output = output
 	return l
 }

-var bufferPool = sync.Pool{
-	New: func() any {
-		return new(bytes.Buffer)
-	},
-}
-
-var defaultPairs = make(map[string]any)
-
+// GetLogLevel returns the log level integer corresponding to the given level name.
 func GetLogLevel(level string) int {
-	for i, name := range LevelNames {
-		if name == strings.ToLower(level) {
+	level = strings.ToLower(level)
+	for i, name := range levelNames {
+		if name == level {
 			return i
 		}
 	}
 	return defaultMinLevel
 }

+// SetTimeFormat sets the time format for the logger's timestamp field.
+func (l *Logger) SetTimeFormat(format string) *Logger {
+	l.timeFormat = format
+	return l
+}
+
+// SetMinLogLevel sets the minimum log level for the logger.
+func (l *Logger) SetMinLogLevel(level int) *Logger {
+	l.minLogLevel = level
+	return l
+}
+
+// SetFieldName allows customizing the field names in log output.
+func (l *Logger) SetFieldName(field, name string) *Logger {
+	fieldNames[field] = name
+	return l
+}
+
+// SetShowCaller enables or disables including the caller information in log output.
+func (l *Logger) SetShowCaller(show bool) *Logger {
+	l.showCaller = show
+	return l
+}
+
+// shouldLog determines if the message should be logged based on the logger's minimum log level.
+func (l *Logger) shouldLog(level int) bool {
+	return level >= l.minLogLevel
+}
+
+// log writes the log message with the given level.
 func (l *Logger) log(level int, m *LogMessage) {
 	if m.Pairs == nil {
-		m.Pairs = defaultPairs
+		m.Pairs = make(map[string]interface{})
 	}

-	m.Pairs[fieldNames["timestamp"]] = time.Now().Format(l.format)
-	m.Pairs[fieldNames["level"]] = LevelNames[level]
+	m.Pairs[fieldNames["timestamp"]] = time.Now().Format(l.timeFormat)
+	m.Pairs[fieldNames["level"]] = levelNames[level]
 	m.Pairs[fieldNames["message"]] = m.Message

 	if l.showCaller {
@@ -109,93 +135,73 @@ func (l *Logger) log(level int, m *LogMessage) {
 	}

 	buffer := bufferPool.Get().(*bytes.Buffer)
-	defer bufferPool.Put(buffer)
 	buffer.Reset()
+	defer bufferPool.Put(buffer)

-	var encoder = json.NewEncoder(buffer)
+	encoder := json.NewEncoder(buffer)
 	err := encoder.Encode(m.Pairs)
 	if err != nil {
-		fmt.Println("Error marshalling log message:", err)
+		fmt.Fprintln(os.Stderr, "Error marshalling log message:", err)
 		return
 	}

-	// if not running in test - use stderr and stdout, otherwise - use logger's output setting
-	if flag.Lookup("test.v") != nil {
-		m.output = os.Stdout
-		if level >= LEVEL_ERROR {
-			m.output = os.Stderr
-		}
+	_, err = l.output.Write(buffer.Bytes())
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "Error writing log message:", err)
 	}
-
-	// Use logger's output setting instead of os.Stdout or os.Stderr
-	l.output.Write(buffer.Bytes())
 }

+// Debug logs a debug-level message.
 func (l *Logger) Debug(m *LogMessage) {
 	if l.shouldLog(LEVEL_DEBUG) {
 		l.log(LEVEL_DEBUG, m)
 	}
 }

+// Info logs an info-level message.
 func (l *Logger) Info(m *LogMessage) {
 	if l.shouldLog(LEVEL_INFO) {
 		l.log(LEVEL_INFO, m)
 	}
 }

+// Warn logs a warning-level message.
 func (l *Logger) Warn(m *LogMessage) {
 	if l.shouldLog(LEVEL_WARN) {
 		l.log(LEVEL_WARN, m)
 	}
 }

+// Warning is an alias for Warn.
 func (l *Logger) Warning(m *LogMessage) {
 	l.Warn(m)
 }

+// Error logs an error-level message.
 func (l *Logger) Error(m *LogMessage) {
 	if l.shouldLog(LEVEL_ERROR) {
 		l.log(LEVEL_ERROR, m)
 	}
 }

+// Fatal logs a fatal-level message.
 func (l *Logger) Fatal(m *LogMessage) {
 	if l.shouldLog(LEVEL_FATAL) {
 		l.log(LEVEL_FATAL, m)
 	}
 }

+// Critical logs a critical-level message and exits the application.
 func (l *Logger) Critical(m *LogMessage) {
 	l.Fatal(m)
 	os.Exit(1)
 }

-func (l *Logger) shouldLog(level int) bool {
-	return level >= l.minLogLevel
-}
-
-func (l *Logger) SetFormat(format string) *Logger {
-	l.format = format
-	return l
-}
-
-func (l *Logger) SetMinLogLevel(level int) *Logger {
-	l.minLogLevel = level
-	return l
-}
-
-func (l *Logger) SetFieldName(field, name string) *Logger {
-	fieldNames[field] = name
-	return l
-}
-
-func (l *Logger) SetShowCaller(show bool) *Logger {
-	l.showCaller = show
-	return l
-}
-
+// getCaller retrieves the file and line number of the caller.
 func getCaller() string {
-	_, file, line, ok := runtime.Caller(3)
+	// Skip 3 stack frames: getCaller -> log -> [Debug|Info|...]
+	const depth = 3
+	_, file, line, ok := runtime.Caller(depth)
 	if !ok {
 		return "unknown:0"
 	}
@@ -55,14 +55,9 @@ func Benchmark_NewLogger(b *testing.B) {
 	for _, tt := range tests {
 		b.Run(tt.name, func(b *testing.B) {
 			for i := 0; i < b.N; i++ {
-				got := New()
-
-				if tt.triggers.ModFormat.Format != "" {
-					got = got.SetFormat(tt.triggers.ModFormat.Format)
-				}
-
+				logger := New()
 				if tt.triggers.ModLevel.Level != 0 {
-					got = got.SetMinLogLevel(tt.triggers.ModLevel.Level)
+					logger.SetMinLogLevel(tt.triggers.ModLevel.Level)
 				}
 			}
 		})
@@ -3,7 +3,6 @@ package libpack_logger
 import (
 	"bytes"
 	"fmt"
-	"os"
 	"reflect"
 	"testing"
 	"time"
@@ -11,36 +10,12 @@ import (
 	"github.com/goccy/go-json"
 )

-func captureStderr(f func()) string {
-	originalStderr := os.Stderr
-	r, w, _ := os.Pipe()
-	os.Stderr = w
-	f()
-	w.Close()
-	var buf bytes.Buffer
-	buf.ReadFrom(r)
-	os.Stderr = originalStderr
-	return buf.String()
-}
-
-func captureStdOut(f func()) string {
-	originalStdout := os.Stdout
-	r, w, _ := os.Pipe()
-	os.Stdout = w
-	f()
-	w.Close()
-	var buf bytes.Buffer
-	buf.ReadFrom(r)
-	os.Stdout = originalStdout
-	return buf.String()
-}
-
 func (suite *LoggerTestSuite) Test_LogMessageString() {
 	msg := &LogMessage{
 		Message: "test message",
 	}

-	assert.Equal("test message", msg.String())
+	assert.Equal("test message", msg.Message)
 }

 func callLoggerMethod(logger *Logger, methodName string, message *LogMessage) {
@@ -125,7 +100,7 @@ func (suite *LoggerTestSuite) Test_LogsLevelsPrint() {

 			// Set logger's minimum log level
 			logger.SetMinLogLevel(tt.loggerMinLevel)
-			fmt.Println("Logger min log level:", LevelNames[logger.minLogLevel])
+			fmt.Println("Logger min log level:", levelNames[logger.minLogLevel])

 			// Call the logging method
 			callLoggerMethod(logger, tt.method, msg)
@@ -143,7 +118,7 @@ func (suite *LoggerTestSuite) Test_LogsLevelsPrint() {
 				if !containsLogMessage(logOutput, tt.message) {
 					t.Errorf("Expected log message %q, but got %q", tt.message, logOutput)
 				}
-				assert.Equal(LevelNames[tt.messageLogLevel], loggedMessage["level"])
+				assert.Equal(levelNames[tt.messageLogLevel], loggedMessage["level"])
 				if tt.pairs != nil {
 					for k, v := range tt.pairs {
 						assert.Equal(v, loggedMessage[k])
@@ -161,9 +136,9 @@ func containsLogMessage(logOutput, expectedMessage string) bool {
 }

 func (suite *LoggerTestSuite) Test_SetFormat() {
-	logger := New().SetFormat(time.RFC3339Nano)
+	logger := New().SetTimeFormat(time.RFC3339Nano)

-	assert.Equal(time.RFC3339Nano, logger.format)
+	assert.Equal(time.RFC3339Nano, logger.timeFormat)
 }

 func (suite *LoggerTestSuite) Test_SetMinLogLevel() {
@@ -1,6 +1,7 @@
 package main

 import (
+	"context"
 	"flag"
 	"os"
 	"strings"
@@ -13,52 +14,58 @@ import (
 	libpack_cache "github.com/lukaszraczylo/graphql-monitoring-proxy/cache"
 	libpack_config "github.com/lukaszraczylo/graphql-monitoring-proxy/config"
 	libpack_logging "github.com/lukaszraczylo/graphql-monitoring-proxy/logging"
+	libpack_tracing "github.com/lukaszraczylo/graphql-monitoring-proxy/tracing"
 )

 var (
-	cfg  *config
-	once sync.Once
+	cfg    *config
+	once   sync.Once
+	tracer *libpack_tracing.TracingSetup
 )

-// function get value from the env where the value can be anything
+// getDetailsFromEnv retrieves the value from the environment or returns the default.
 func getDetailsFromEnv[T any](key string, defaultValue T) T {
 	var result any
-	if _, ok := os.LookupEnv("GMP_" + key); ok {
-		key = "GMP_" + key
+	envKey := "GMP_" + key
+	if _, ok := os.LookupEnv(envKey); !ok {
+		envKey = key
 	}
 	switch v := any(defaultValue).(type) {
 	case string:
-		result = envutil.Getenv(key, v)
+		result = envutil.Getenv(envKey, v)
 	case int:
-		result = envutil.GetInt(key, v)
+		result = envutil.GetInt(envKey, v)
 	case bool:
-		result = envutil.GetBool(key, v)
+		result = envutil.GetBool(envKey, v)
 	default:
 		result = defaultValue
 	}
 	return result.(T)
 }

+// parseConfig loads and parses the configuration.
 func parseConfig() {
 	libpack_config.PKG_NAME = "graphql_proxy"
 	c := config{}
+	// Server configurations
 	c.Server.PortGraphQL = getDetailsFromEnv("PORT_GRAPHQL", 8080)
 	c.Server.PortMonitoring = getDetailsFromEnv("MONITORING_PORT", 9393)
 	c.Server.HostGraphQL = getDetailsFromEnv("HOST_GRAPHQL", "http://localhost/")
 	c.Server.HostGraphQLReadOnly = getDetailsFromEnv("HOST_GRAPHQL_READONLY", "")
+	// Client configurations
 	c.Client.JWTUserClaimPath = getDetailsFromEnv("JWT_USER_CLAIM_PATH", "")
 	c.Client.JWTRoleClaimPath = getDetailsFromEnv("JWT_ROLE_CLAIM_PATH", "")
 	c.Client.RoleFromHeader = getDetailsFromEnv("ROLE_FROM_HEADER", "")
 	c.Client.RoleRateLimit = getDetailsFromEnv("ROLE_RATE_LIMIT", false)
-	/* in-memory cache */
+	// In-memory cache
 	c.Cache.CacheEnable = getDetailsFromEnv("ENABLE_GLOBAL_CACHE", false)
 	c.Cache.CacheTTL = getDetailsFromEnv("CACHE_TTL", 60)
-	/* redis cache */
+	// Redis cache
 	c.Cache.CacheRedisEnable = getDetailsFromEnv("ENABLE_REDIS_CACHE", false)
 	c.Cache.CacheRedisURL = getDetailsFromEnv("CACHE_REDIS_URL", "localhost:6379")
 	c.Cache.CacheRedisPassword = getDetailsFromEnv("CACHE_REDIS_PASSWORD", "")
 	c.Cache.CacheRedisDB = getDetailsFromEnv("CACHE_REDIS_DB", 0)
-	/* security */
+	// Security configurations
 	c.Security.BlockIntrospection = getDetailsFromEnv("BLOCK_SCHEMA_INTROSPECTION", false)
 	c.Security.IntrospectionAllowed = func() []string {
 		urls := getDetailsFromEnv("ALLOWED_INTROSPECTION", "")
@@ -68,10 +75,14 @@ func parseConfig() {
 		return strings.Split(urls, ",")
 	}()
 	c.LogLevel = strings.ToUpper(getDetailsFromEnv("LOG_LEVEL", "info"))
-	c.Logger = libpack_logging.New().SetMinLogLevel(libpack_logging.GetLogLevel(c.LogLevel)).SetFieldName("timestamp", "ts").SetFieldName("message", "msg").SetShowCaller(false)
+	// Logger setup
+	c.Logger = libpack_logging.New().SetMinLogLevel(libpack_logging.GetLogLevel(c.LogLevel)).
+		SetFieldName("timestamp", "ts").SetFieldName("message", "msg").SetShowCaller(false)
+	// Health check
 	c.Server.HealthcheckGraphQL = getDetailsFromEnv("HEALTHCHECK_GRAPHQL_URL", "")
 	c.Client.GQLClient = graphql.NewConnection()
 	c.Client.GQLClient.SetEndpoint(c.Server.HealthcheckGraphQL)
+	// Server modes
 	c.Server.AccessLog = getDetailsFromEnv("ENABLE_ACCESS_LOG", false)
 	c.Server.ReadOnlyMode = getDetailsFromEnv("READ_ONLY_MODE", false)
 	c.Server.AllowURLs = func() []string {
@@ -83,22 +94,56 @@ func parseConfig() {
 	}()
 	c.Client.ClientTimeout = getDetailsFromEnv("PROXIED_CLIENT_TIMEOUT", 120)
 	c.Client.FastProxyClient = createFasthttpClient(c.Client.ClientTimeout)
-	proxy.WithClient(c.Client.FastProxyClient) // setting the global proxy client here instead of per request
+	proxy.WithClient(c.Client.FastProxyClient) // Setting the global proxy client
+	// API configurations
 	c.Server.EnableApi = getDetailsFromEnv("ENABLE_API", false)
 	c.Server.ApiPort = getDetailsFromEnv("API_PORT", 9090)
 	c.Api.BannedUsersFile = getDetailsFromEnv("BANNED_USERS_FILE", "/go/src/app/banned_users.json")
 	c.Server.PurgeOnCrawl = getDetailsFromEnv("PURGE_METRICS_ON_CRAWL", false)
 	c.Server.PurgeEvery = getDetailsFromEnv("PURGE_METRICS_ON_TIMER", 0)
+	// Hasura event cleaner
 	c.HasuraEventCleaner.Enable = getDetailsFromEnv("HASURA_EVENT_CLEANER", false)
 	c.HasuraEventCleaner.ClearOlderThan = getDetailsFromEnv("HASURA_EVENT_CLEANER_OLDER_THAN", 1)
 	c.HasuraEventCleaner.EventMetadataDb = getDetailsFromEnv("HASURA_EVENT_METADATA_DB", "")
+	// Tracing configuration
+	c.Tracing.Enable = getDetailsFromEnv("ENABLE_TRACE", false)
+	c.Tracing.Endpoint = getDetailsFromEnv("TRACE_ENDPOINT", "localhost:4317")
 	cfg = &c

+	// Initialize tracing if enabled
+	if cfg.Tracing.Enable {
+		if cfg.Tracing.Endpoint == "" {
+			cfg.Logger.Warning(&libpack_logging.LogMessage{
+				Message: "Tracing endpoint not configured, using default localhost:4317",
+			})
+			cfg.Tracing.Endpoint = "localhost:4317"
+		}
+
+		var err error
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+
+		tracer, err = libpack_tracing.NewTracing(ctx, cfg.Tracing.Endpoint)
+		if err != nil {
+			cfg.Logger.Error(&libpack_logging.LogMessage{
+				Message: "Failed to initialize tracing",
+				Pairs:   map[string]interface{}{"error": err.Error()},
+			})
+		} else {
+			cfg.Logger.Info(&libpack_logging.LogMessage{
+				Message: "Tracing initialized",
+				Pairs:   map[string]interface{}{"endpoint": cfg.Tracing.Endpoint},
+			})
+		}
+	}
+
+	// Initialize cache if enabled
 	if cfg.Cache.CacheEnable || cfg.Cache.CacheRedisEnable {
 		cacheConfig := &libpack_cache.CacheConfig{
 			Logger: cfg.Logger,
 			TTL:    cfg.Cache.CacheTTL,
 		}
+		// Redis cache configurations
 		if cfg.Cache.CacheRedisEnable {
 			cacheConfig.Redis.Enable = true
 			cacheConfig.Redis.URL = cfg.Cache.CacheRedisURL
@@ -121,8 +166,19 @@ func main() {
 	StartMonitoringServer()
 	time.Sleep(5 * time.Second)
 	StartHTTPProxy()
+
+	// Cleanup tracing on exit
+	if tracer != nil {
+		if err := tracer.Shutdown(context.Background()); err != nil {
+			cfg.Logger.Error(&libpack_logging.LogMessage{
+				Message: "Error shutting down tracer",
+				Pairs:   map[string]interface{}{"error": err.Error()},
+			})
+		}
+	}
 }

+// ifNotInTest checks if the program is not running in a test environment.
 func ifNotInTest() bool {
 	return flag.Lookup("test.v") == nil
 }
@@ -1,6 +1,7 @@
 package main

 import (
+	"fmt"
 	"os"
 	"testing"
 	"time"
@@ -11,6 +12,7 @@ import (
 	libpack_logging "github.com/lukaszraczylo/graphql-monitoring-proxy/logging"
 	assertions "github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/suite"
+	"github.com/valyala/fasthttp"
 )

 type Tests struct {
@@ -138,3 +140,122 @@ func (suite *Tests) Test_getDetailsFromEnv() {
 		})
 	}
 }
+
+func (suite *Tests) TestIntrospectionEnvironmentConfig() {
+	// Save original env vars
+	oldEnv := make(map[string]string)
+	varsToSave := []string{
+		"BLOCK_SCHEMA_INTROSPECTION",
+		"ALLOWED_INTROSPECTION",
+		"GMP_BLOCK_SCHEMA_INTROSPECTION",
+		"GMP_ALLOWED_INTROSPECTION",
+	}
+	for _, env := range varsToSave {
+		if val, exists := os.LookupEnv(env); exists {
+			oldEnv[env] = val
+			os.Unsetenv(env)
+		}
+	}
+	defer func() {
+		// Restore original env vars
+		for k, v := range oldEnv {
+			os.Setenv(k, v)
+		}
+	}()
+
+	tests := []struct {
+		name         string
+		envVars      map[string]string
+		query        string
+		wantBlocked  bool
+		wantEndpoint string
+	}{
+		{
+			name: "basic typename allowed",
+			envVars: map[string]string{
+				"BLOCK_SCHEMA_INTROSPECTION": "true",
+				"ALLOWED_INTROSPECTION":      "__typename",
+			},
+			query: `{
+							users {
+									id
+									__typename
+							}
+					}`,
+			wantBlocked: false,
+		},
+		{
+			name: "GMP prefix takes precedence",
+			envVars: map[string]string{
+				"BLOCK_SCHEMA_INTROSPECTION":     "false",
+				"GMP_BLOCK_SCHEMA_INTROSPECTION": "true",
+				"ALLOWED_INTROSPECTION":          "__type",
+				"GMP_ALLOWED_INTROSPECTION":      "__typename",
+			},
+			query: `{
+							users {
+									__typename
+							}
+					}`,
+			wantBlocked: false,
+		},
+		{
+			name: "multiple allowed queries",
+			envVars: map[string]string{
+				"BLOCK_SCHEMA_INTROSPECTION": "true",
+				"ALLOWED_INTROSPECTION":      "__typename,__schema",
+			},
+			query: `{
+							__schema {
+									types {
+											name
+											__typename
+									}
+							}
+					}`,
+			wantBlocked: false,
+		},
+		{
+			name: "multiple allowed queries with one of them blocked",
+			envVars: map[string]string{
+				"BLOCK_SCHEMA_INTROSPECTION": "true",
+				"ALLOWED_INTROSPECTION":      "__schema",
+			},
+			query: `{
+							__schema {
+									types {
+											name
+											__typename
+									}
+							}
+					}`,
+			wantBlocked: true,
+		},
+	}
+
+	for _, tt := range tests {
+		suite.Run(tt.name, func() {
+			// Set test env vars
+			for k, v := range tt.envVars {
+				os.Setenv(k, v)
+			}
+
+			// Reset global config
+			cfg = nil
+			parseConfig()
+
+			// Create test request
+			app := fiber.New()
+			ctx := app.AcquireCtx(&fasthttp.RequestCtx{})
+			defer app.ReleaseCtx(ctx)
+			ctx.Request().Header.SetMethod("POST")
+			ctx.Request().SetBody([]byte(fmt.Sprintf(`{"query": %q}`, tt.query)))
+
+			result := parseGraphQLQuery(ctx)
+			assert.Equal(tt.wantBlocked, result.shouldBlock)
+			for k := range tt.envVars {
+				os.Unsetenv(k)
+			}
+		})
+	}
+}
@@ -4,8 +4,12 @@ import (
 	libpack_monitoring "github.com/lukaszraczylo/graphql-monitoring-proxy/monitoring"
 )

+// StartMonitoringServer initializes and starts the monitoring server.
 func StartMonitoringServer() {
-	cfg.Monitoring = libpack_monitoring.NewMonitoring(&libpack_monitoring.InitConfig{PurgeOnCrawl: cfg.Server.PurgeOnCrawl, PurgeEvery: cfg.Server.PurgeEvery})
+	cfg.Monitoring = libpack_monitoring.NewMonitoring(&libpack_monitoring.InitConfig{
+		PurgeOnCrawl: cfg.Server.PurgeOnCrawl,
+		PurgeEvery:   cfg.Server.PurgeEvery,
+	})
 	cfg.Monitoring.AddMetricsPrefix("graphql_proxy")
 	cfg.Monitoring.RegisterDefaultMetrics()
 }
@@ -17,7 +17,6 @@ var sortedLabelKeysCache = struct {
 }{}

 func (ms *MetricsSetup) get_metrics_name(name string, labels map[string]string) string {
-	const unknownPodName = "unknown"
 	var buf bytes.Buffer

 	podName := getPodName()
@@ -3,20 +3,25 @@ package main
 import (
 	"bytes"
 	"compress/gzip"
+	"context"
 	"crypto/tls"
 	"fmt"
 	"io"
 	"net/url"
 	"time"

+	"go.opentelemetry.io/otel/trace"
+
 	"github.com/avast/retry-go/v4"
 	"github.com/gofiber/fiber/v2"
 	"github.com/gofiber/fiber/v2/middleware/proxy"
 	libpack_logger "github.com/lukaszraczylo/graphql-monitoring-proxy/logging"
 	libpack_monitoring "github.com/lukaszraczylo/graphql-monitoring-proxy/monitoring"
+	libpack_tracing "github.com/lukaszraczylo/graphql-monitoring-proxy/tracing"
 	"github.com/valyala/fasthttp"
 )

+// createFasthttpClient creates and configures a fasthttp client.
 func createFasthttpClient(timeout int) *fasthttp.Client {
 	return &fasthttp.Client{
 		Name:                     "graphql_proxy",
@@ -29,11 +34,35 @@ func createFasthttpClient(timeout int) *fasthttp.Client {
 		WriteTimeout:                  time.Duration(timeout) * time.Second,
 		MaxIdleConnDuration:           time.Duration(timeout) * time.Second,
 		MaxConnDuration:               time.Duration(timeout) * time.Second,
-		DisableHeaderNamesNormalizing: true,
+		DisableHeaderNamesNormalizing: false,
 	}
 }

+// proxyTheRequest handles the request proxying logic.
 func proxyTheRequest(c *fiber.Ctx, currentEndpoint string) error {
+	if cfg.Tracing.Enable && tracer != nil {
+		var span trace.Span
+		spanCtx := context.Background()
+		// Extract trace information from header
+		if traceHeader := c.Get("X-Trace-Span"); traceHeader != "" {
+			spanInfo, err := libpack_tracing.ParseTraceHeader(traceHeader)
+			if err != nil {
+				cfg.Logger.Warning(&libpack_logger.LogMessage{
+					Message: "Failed to parse trace header",
+					Pairs:   map[string]interface{}{"error": err.Error()},
+				})
+			} else {
+				if extractedSpanCtx, err := tracer.ExtractSpanContext(spanInfo); err == nil {
+					spanCtx = trace.ContextWithSpanContext(spanCtx, extractedSpanCtx)
+				}
+			}
+		}
+
+		// Start a new span
+		span, _ = tracer.StartSpan(spanCtx, "proxy_request")
+		defer span.End()
+	}
+
 	if !checkAllowedURLs(c) {
 		cfg.Logger.Error(&libpack_logger.LogMessage{
 			Message: "Request blocked",
@@ -51,7 +80,7 @@ func proxyTheRequest(c *fiber.Ctx, currentEndpoint string) error {
 		return fmt.Errorf("invalid URL: %v", err)
 	}

-	if cfg.LogLevel == "debug" {
+	if cfg.LogLevel == "DEBUG" {
 		logDebugRequest(c)
 	}

@@ -61,7 +90,7 @@ func proxyTheRequest(c *fiber.Ctx, currentEndpoint string) error {
 			if proxyErr != nil {
 				return proxyErr
 			}
-			if c.Response().StatusCode() != 200 {
+			if c.Response().StatusCode() != fiber.StatusOK {
 				return fmt.Errorf("received non-200 response from the GraphQL server: %d", c.Response().StatusCode())
 			}
 			return nil
@@ -94,11 +123,12 @@ func proxyTheRequest(c *fiber.Ctx, currentEndpoint string) error {
 		return fmt.Errorf("failed to proxy request: %v", err)
 	}

-	if cfg.LogLevel == "debug" {
+	if cfg.LogLevel == "DEBUG" {
 		logDebugResponse(c)
 	}

-	if c.Response().Header.Peek("Content-Encoding") != nil && string(c.Response().Header.Peek("Content-Encoding")) == "gzip" {
+	if bytes.EqualFold(c.Response().Header.Peek("Content-Encoding"), []byte("gzip")) {
+		// Decompress gzip response
 		reader, err := gzip.NewReader(bytes.NewReader(c.Response().Body()))
 		if err != nil {
 			cfg.Logger.Error(&libpack_logger.LogMessage{
@@ -122,7 +152,7 @@ func proxyTheRequest(c *fiber.Ctx, currentEndpoint string) error {
 		c.Response().Header.Del("Content-Encoding")
 	}

-	if c.Response().StatusCode() != 200 {
+	if c.Response().StatusCode() != fiber.StatusOK {
 		if ifNotInTest() {
 			cfg.Monitoring.Increment(libpack_monitoring.MetricsFailed, nil)
 		}
@@ -133,6 +163,7 @@ func proxyTheRequest(c *fiber.Ctx, currentEndpoint string) error {
 	return nil
 }

+// logDebugRequest logs the request details when in debug mode.
 func logDebugRequest(c *fiber.Ctx) {
 	cfg.Logger.Debug(&libpack_logger.LogMessage{
 		Message: "Proxying the request",
@@ -145,6 +176,7 @@ func logDebugRequest(c *fiber.Ctx) {
 	})
 }

+// logDebugResponse logs the response details when in debug mode.
 func logDebugResponse(c *fiber.Ctx) {
 	cfg.Logger.Debug(&libpack_logger.LogMessage{
 		Message: "Received proxied response",
@@ -87,23 +87,17 @@ func (suite *Tests) Test_proxyTheRequest() {
 				cfg.Server.HostGraphQLReadOnly = tt.hostRO
 			}

-			ctx_headers := func() *fasthttp.RequestHeader {
-				h := fasthttp.RequestHeader{}
-				for k, v := range tt.headers {
-					h.Add(k, v)
-				}
-				return &h
-			}()
-
-			ctx_request := fasthttp.Request{
-				Header: *ctx_headers,
+			ctx := suite.app.AcquireCtx(&fasthttp.RequestCtx{})
+			
+			// Set headers
+			for k, v := range tt.headers {
+				ctx.Request().Header.Add(k, v)
 			}
-			ctx_request.SetBody([]byte(tt.body))
-			ctx_request.SetRequestURI(tt.path)
-			ctx_request.Header.SetMethod("POST")
-			ctx := suite.app.AcquireCtx(&fasthttp.RequestCtx{
-				Request: ctx_request,
-			})
+
+			// Set body and other request properties
+			ctx.Request().SetBody([]byte(tt.body))
+			ctx.Request().SetRequestURI(tt.path)
+			ctx.Request().Header.SetMethod("POST")
 			res := parseGraphQLQuery(ctx)
 			assert.NotNil(ctx, "Fiber context is nil", tt.name)
 			err := proxyTheRequest(ctx, res.activeEndpoint)
@@ -10,6 +10,7 @@ import (
 	libpack_logger "github.com/lukaszraczylo/graphql-monitoring-proxy/logging"
 )

+// RateLimitConfig holds the rate limit configuration for a role
 type RateLimitConfig struct {
 	RateCounterTicker *goratecounter.RateCounter
 	Interval          time.Duration `json:"interval"`
@@ -21,6 +22,7 @@ var (
 	rateLimitMu sync.RWMutex
 )

+// loadRatelimitConfig loads the rate limit configurations from file
 func loadRatelimitConfig() error {
 	paths := []string{"/go/src/app/ratelimit.json", "./ratelimit.json", "./static/app/default-ratelimit.json"}
 	for _, path := range paths {
@@ -59,7 +61,7 @@ func loadConfigFromPath(path string) error {
 			Interval: value.Interval,
 		})

-		if cfg.LogLevel == "debug" {
+		if cfg.LogLevel == "DEBUG" {
 			cfg.Logger.Debug(&libpack_logger.LogMessage{
 				Message: "Setting ratelimit config for role",
 				Pairs: map[string]interface{}{
@@ -83,6 +85,7 @@ func loadConfigFromPath(path string) error {
 	return nil
 }

+// rateLimitedRequest checks if a request should be rate-limited
 func rateLimitedRequest(userID, userRole string) bool {
 	rateLimitMu.RLock()
 	roleConfig, ok := rateLimits[userRole]
@@ -3,7 +3,6 @@ package main
 import (
 	"fmt"
 	"strconv"
-	"sync"
 	"time"

 	"github.com/goccy/go-json"
@@ -21,14 +20,7 @@ const (
 	healthCheckQueryStr = `{ __typename }`
 )

-var (
-	ctxPool = sync.Pool{
-		New: func() interface{} {
-			return new(fiber.Ctx)
-		},
-	}
-)
-
+// StartHTTPProxy initializes and starts the HTTP proxy server.
 func StartHTTPProxy() {
 	cfg.Logger.Debug(&libpack_logger.LogMessage{
 		Message: "Starting the HTTP proxy",
@@ -71,15 +63,18 @@ func StartHTTPProxy() {
 	}
 }

+// proxyTheRequestToDefault proxies the request to the default GraphQL endpoint.
 func proxyTheRequestToDefault(c *fiber.Ctx) error {
 	return proxyTheRequest(c, cfg.Server.HostGraphQL)
 }

+// AddRequestUUID adds a unique request UUID to the context.
 func AddRequestUUID(c *fiber.Ctx) error {
 	c.Locals("request_uuid", uuid.NewString())
 	return c.Next()
 }

+// checkAllowedURLs checks if the requested URL is allowed.
 func checkAllowedURLs(c *fiber.Ctx) bool {
 	if len(allowedUrls) == 0 {
 		return true
@@ -89,6 +84,7 @@ func checkAllowedURLs(c *fiber.Ctx) bool {
 	return ok
 }

+// healthCheck performs a health check on the GraphQL server.
 func healthCheck(c *fiber.Ctx) error {
 	if len(cfg.Server.HealthcheckGraphQL) > 0 {
 		cfg.Logger.Debug(&libpack_logger.LogMessage{
@@ -103,16 +99,17 @@ func healthCheck(c *fiber.Ctx) error {
 				Pairs:   map[string]interface{}{"error": err.Error()},
 			})
 			cfg.Monitoring.Increment(libpack_monitoring.MetricsFailed, nil)
-			return c.Status(500).SendString("Can't reach the GraphQL server with {__typename} query")
+			return c.Status(fiber.StatusInternalServerError).SendString("Can't reach the GraphQL server with {__typename} query")
 		}
 	}

 	cfg.Logger.Debug(&libpack_logger.LogMessage{
 		Message: "Health check returning OK",
 	})
-	return c.Status(200).SendString("Health check OK")
+	return c.Status(fiber.StatusOK).SendString("Health check OK")
 }

+// processGraphQLRequest handles the incoming GraphQL requests.
 func processGraphQLRequest(c *fiber.Ctx) error {
 	startTime := time.Now()

@@ -124,7 +121,7 @@ func processGraphQLRequest(c *fiber.Ctx) error {
 	}

 	if checkIfUserIsBanned(c, extractedUserID) {
-		return c.Status(403).SendString("User is banned")
+		return c.Status(fiber.StatusForbidden).SendString("User is banned")
 	}

 	if cfg.Client.RoleFromHeader != "" {
@@ -139,13 +136,13 @@ func processGraphQLRequest(c *fiber.Ctx) error {
 			Pairs:   map[string]interface{}{"user_id": extractedUserID, "role_name": extractedRoleName},
 		})
 		if !rateLimitedRequest(extractedUserID, extractedRoleName) {
-			return c.Status(429).SendString("Rate limit exceeded, try again later")
+			return c.Status(fiber.StatusTooManyRequests).SendString("Rate limit exceeded, try again later")
 		}
 	}

-	parsedResult := parseGraphQLQuery(c)
+	parsedResult := parseGraphQLQuery(c) // Ensure this function is defined elsewhere
 	if parsedResult.shouldBlock {
-		return c.Status(403).SendString("Request blocked")
+		return c.Status(fiber.StatusForbidden).SendString("Request blocked")
 	}

 	if parsedResult.shouldIgnore {
@@ -165,7 +162,7 @@ func processGraphQLRequest(c *fiber.Ctx) error {
 		}
 	}

-	wasCached := false
+	wasCached := false //nolint:ineffassign

 	if parsedResult.cacheRefresh {
 		cfg.Logger.Debug(&libpack_logger.LogMessage{
@@ -208,7 +205,7 @@ func processGraphQLRequest(c *fiber.Ctx) error {
 				Pairs:   map[string]interface{}{"error": err.Error()},
 			})
 			cfg.Monitoring.Increment(libpack_monitoring.MetricsFailed, nil)
-			return c.Status(500).SendString("Can't proxy the request - try again later")
+			return c.Status(fiber.StatusInternalServerError).SendString("Can't proxy the request - try again later")
 		}
 	}

@@ -217,6 +214,7 @@ func processGraphQLRequest(c *fiber.Ctx) error {
 	return nil
 }

+// proxyAndCacheTheRequest proxies and caches the request if needed.
 func proxyAndCacheTheRequest(c *fiber.Ctx, queryCacheHash string, cacheTime int, currentEndpoint string) error {
 	if err := proxyTheRequest(c, currentEndpoint); err != nil {
 		cfg.Logger.Error(&libpack_logger.LogMessage{
@@ -224,7 +222,7 @@ func proxyAndCacheTheRequest(c *fiber.Ctx, queryCacheHash string, cacheTime int,
 			Pairs:   map[string]interface{}{"error": err.Error()},
 		})
 		cfg.Monitoring.Increment(libpack_monitoring.MetricsFailed, nil)
-		return c.Status(500).SendString("Can't proxy the request - try again later")
+		return c.Status(fiber.StatusInternalServerError).SendString("Can't proxy the request - try again later")
 	}

 	libpack_cache.CacheStoreWithTTL(queryCacheHash, c.Response().Body(), time.Duration(cacheTime)*time.Second)
@@ -232,6 +230,7 @@ func proxyAndCacheTheRequest(c *fiber.Ctx, queryCacheHash string, cacheTime int,
 	return c.Send(c.Response().Body())
 }

+// logAndMonitorRequest logs and monitors the request processing.
 func logAndMonitorRequest(c *fiber.Ctx, userID, opType, opName string, wasCached bool, duration time.Duration, startTime time.Time) {
 	labels := map[string]string{
 		"op_type": opType,
@@ -12,8 +12,12 @@ type config struct {
 	Logger     *libpack_logging.Logger
 	LogLevel   string
 	Monitoring *libpack_monitoring.MetricsSetup
-	Api        struct{ BannedUsersFile string }
-	Client     struct {
+	Tracing    struct {
+		Enable   bool
+		Endpoint string
+	}
+	Api    struct{ BannedUsersFile string }
+	Client struct {
 		GQLClient        *graphql.BaseClient
 		FastProxyClient  *fasthttp.Client
 		JWTUserClaimPath string
@@ -0,0 +1,105 @@
+package tracing
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
+	"go.opentelemetry.io/otel/propagation"
+	"go.opentelemetry.io/otel/sdk/resource"
+	sdktrace "go.opentelemetry.io/otel/sdk/trace"
+	semconv "go.opentelemetry.io/otel/semconv/v1.21.0"
+	"go.opentelemetry.io/otel/trace"
+)
+
+type TracingSetup struct {
+	tracerProvider *sdktrace.TracerProvider
+	tracer         trace.Tracer
+}
+
+type TraceSpanInfo struct {
+	TraceParent string `json:"traceparent"`
+}
+
+// NewTracing creates a new tracing setup with OTLP exporter
+func NewTracing(ctx context.Context, endpoint string) (*TracingSetup, error) {
+	if ctx.Err() != nil {
+		return nil, fmt.Errorf("invalid context: %v", ctx.Err())
+	}
+	if endpoint == "" {
+		return nil, fmt.Errorf("endpoint cannot be empty")
+	}
+
+	exporter, err := otlptracegrpc.New(ctx,
+		otlptracegrpc.WithEndpoint(endpoint),
+		otlptracegrpc.WithInsecure(),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create trace exporter: %w", err)
+	}
+
+	res, err := resource.New(ctx,
+		resource.WithAttributes(
+			semconv.ServiceName("graphql-monitoring-proxy"),
+		),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create resource: %w", err)
+	}
+
+	tracerProvider := sdktrace.NewTracerProvider(
+		sdktrace.WithBatcher(exporter),
+		sdktrace.WithResource(res),
+	)
+	otel.SetTracerProvider(tracerProvider)
+	otel.SetTextMapPropagator(propagation.TraceContext{})
+
+	tracer := tracerProvider.Tracer("graphql-monitoring-proxy")
+
+	return &TracingSetup{
+		tracerProvider: tracerProvider,
+		tracer:         tracer,
+	}, nil
+}
+
+// ExtractSpanContext extracts span context from TraceSpanInfo
+func (ts *TracingSetup) ExtractSpanContext(spanInfo *TraceSpanInfo) (trace.SpanContext, error) {
+	carrier := propagation.MapCarrier{
+		"traceparent": spanInfo.TraceParent,
+	}
+	ctx := context.Background()
+	ctx = otel.GetTextMapPropagator().Extract(ctx, carrier)
+	spanCtx := trace.SpanContextFromContext(ctx)
+	if !spanCtx.IsValid() {
+		return trace.SpanContext{}, fmt.Errorf("invalid span context")
+	}
+	return spanCtx, nil
+}
+
+// ParseTraceHeader parses X-Trace-Span header content
+func ParseTraceHeader(headerContent string) (*TraceSpanInfo, error) {
+	var spanInfo TraceSpanInfo
+	if err := json.Unmarshal([]byte(headerContent), &spanInfo); err != nil {
+		return nil, fmt.Errorf("failed to parse trace header: %w", err)
+	}
+	return &spanInfo, nil
+}
+
+// Shutdown cleanly shuts down the tracer provider
+func (ts *TracingSetup) Shutdown(ctx context.Context) error {
+	if ts.tracerProvider == nil {
+		return nil
+	}
+	return ts.tracerProvider.Shutdown(ctx)
+}
+
+// StartSpan starts a new span with the given name and parent context
+func (ts *TracingSetup) StartSpan(ctx context.Context, name string) (trace.Span, context.Context) {
+	if ts.tracer == nil {
+		return trace.SpanFromContext(ctx), ctx
+	}
+	ctx, span := ts.tracer.Start(ctx, name)
+	return span, ctx
+}
@@ -0,0 +1,103 @@
+package tracing
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"go.opentelemetry.io/otel/trace"
+)
+
+func TestParseTraceHeader(t *testing.T) {
+	tests := []struct {
+		name    string
+		header  string
+		want    *TraceSpanInfo
+		wantErr bool
+	}{
+		{
+			name:   "valid trace header",
+			header: `{"traceparent": "00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01"}`,
+			want: &TraceSpanInfo{
+				TraceParent: "00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01",
+			},
+			wantErr: false,
+		},
+		{
+			name:    "invalid json",
+			header:  `{"traceparent": invalid}`,
+			want:    nil,
+			wantErr: true,
+		},
+		{
+			name:    "empty header",
+			header:  "",
+			want:    nil,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := ParseTraceHeader(tt.header)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("ParseTraceHeader() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if !tt.wantErr {
+				gotJSON, _ := json.Marshal(got)
+				wantJSON, _ := json.Marshal(tt.want)
+				if string(gotJSON) != string(wantJSON) {
+					t.Errorf("ParseTraceHeader() = %v, want %v", string(gotJSON), string(wantJSON))
+				}
+			}
+		})
+	}
+}
+
+func TestNewTracing(t *testing.T) {
+	// Skip actual connection tests since they require a running collector
+	t.Run("empty endpoint", func(t *testing.T) {
+		ctx := context.Background()
+		_, err := NewTracing(ctx, "")
+		assert.Error(t, err, "Expected error for empty endpoint")
+		assert.Contains(t, err.Error(), "endpoint cannot be empty")
+	})
+
+	t.Run("invalid context", func(t *testing.T) {
+		ctx, cancel := context.WithCancel(context.Background())
+		cancel() // Cancel the context immediately
+		_, err := NewTracing(ctx, "localhost:4317")
+		assert.Error(t, err, "Expected error for invalid context")
+	})
+}
+
+func TestTracingSetup_ExtractSpanContext(t *testing.T) {
+	ts := &TracingSetup{}
+	spanInfo := &TraceSpanInfo{
+		TraceParent: "invalid-traceparent",
+	}
+
+	_, err := ts.ExtractSpanContext(spanInfo)
+	assert.Error(t, err, "Expected error for invalid traceparent")
+	assert.Contains(t, err.Error(), "invalid span context")
+}
+
+func TestTracingSetup_StartSpan(t *testing.T) {
+	ts := &TracingSetup{}
+	ctx := context.Background()
+
+	span, newCtx := ts.StartSpan(ctx, "test-span")
+	assert.NotNil(t, span, "Expected non-nil span even when tracer is nil")
+	assert.NotNil(t, newCtx, "Expected non-nil context")
+	assert.Equal(t, trace.SpanFromContext(ctx), span, "Expected span from context when tracer is nil")
+}
+
+func TestTracingSetup_Shutdown(t *testing.T) {
+	ts := &TracingSetup{}
+	ctx := context.Background()
+
+	err := ts.Shutdown(ctx)
+	assert.NoError(t, err, "Expected no error when shutting down nil tracer provider")
+}
Author	SHA1	Message	Date
lukaszraczylo	322a0b4929	Add appropriate labels to the container	2025-02-08 01:27:45 +00:00
lukaszraczylo	aab31c4bce	Merge remote-tracking branch 'origin/main' into testing	2025-02-08 00:56:23 +00:00
lukaszraczylo	93e078971c	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-02-07 03:05:38 +00:00
lukaszraczylo	589f22fe33	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-02-06 03:04:42 +00:00
lukaszraczylo	e43d6f8df3	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-02-05 03:04:20 +00:00
lukaszraczylo	68dd114da1	fixup! fixup! fixup! Staticheck fixes	2025-01-30 22:45:24 +00:00
lukaszraczylo	478a420b6b	fixup! fixup! Staticheck fixes	2025-01-30 22:10:59 +00:00
lukaszraczylo	d4dd3636f3	fixup! Staticheck fixes	2025-01-30 11:25:10 +00:00
lukaszraczylo	fa24095b88	Staticheck fixes	2025-01-29 23:42:58 +00:00
lukaszraczylo	15d1dd7164	fixup! Add tracing and relevant tests (#21 )	2025-01-29 22:15:14 +00:00
lukaszraczylo	97a74c9603	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-01-29 03:03:16 +00:00
lukaszraczylo	79605280f7	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-01-28 03:03:17 +00:00
lukaszraczylo	7cb6aa05a8	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-01-25 03:02:14 +00:00
lukaszraczylo	e42b494d1c	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-01-24 03:03:24 +00:00
lukaszraczylo	89582d368d	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-01-22 03:04:21 +00:00
lukaszraczylo	06bf63613b	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-01-18 03:02:02 +00:00
lukaszraczylo	36f163de8f	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-01-17 03:03:12 +00:00
lukaszraczylo	197201363f	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-01-14 03:01:58 +00:00
lukaszraczylo	0e35e24829	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-01-11 03:06:12 +00:00
lukaszraczylo	7a064935c6	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-01-09 03:18:24 +00:00
lukaszraczylo	6af5aefe54	Add tracing and relevant tests (#21 ) * Add tracing and relevant tests. * fixup! Add tracing and relevant tests. * gofmt the code 🤷 * fixup! gofmt the code 🤷	2025-01-08 18:29:25 +00:00
lukaszraczylo	dda7044284	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-01-08 03:05:56 +00:00
lukaszraczylo	4a20ce2fba	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-01-07 03:07:30 +00:00
lukaszraczylo	8a65a692b7	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-01-06 03:08:28 +00:00
lukaszraczylo	8a2c96f6ce	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-01-05 03:09:06 +00:00
lukaszraczylo	932b780503	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-01-01 03:10:20 +00:00
lukaszraczylo	14a7ed80d9	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-12-22 03:09:00 +00:00
lukaszraczylo	55cb61cc07	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-12-20 03:06:09 +00:00
Thomas P.	8bd2bdfd9c	fix(proxy): handle lowercase Location header (#20 ) When the upstream server returns a redirect HTTP response code but its "Location" header is in lowercase, the proxy will retry the request 5 times and eventually fail with an "missing Location header for http redirect" error. Since the HTTP spec says header names are case-insensitive, we should handle this case properly. Adjust fasthttp options accordingly Ref: https://github.com/valyala/fasthttp/issues/1361	2024-12-19 18:49:24 +00:00
lukaszraczylo	55e7d99b6a	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-12-19 03:10:57 +00:00
lukaszraczylo	241c985bb4	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-12-13 03:17:21 +00:00
lukaszraczylo	19b3b3e596	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-12-12 03:15:48 +00:00
lukaszraczylo	5852a4c356	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-12-11 03:14:53 +00:00
lukaszraczylo	e814345069	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-12-10 03:17:22 +00:00
lukaszraczylo	984e448ff0	fixup! fixup! Fixes the code for additional test cases.	2024-12-06 13:27:59 +00:00
lukaszraczylo	5799f8ca7c	fixup! Fixes the code for additional test cases.	2024-12-06 13:22:18 +00:00
lukaszraczylo	ac84c69812	Fixes the code for additional test cases.	2024-12-06 12:54:36 +00:00
lukaszraczylo	e54bbe8249	Additional tests to ensure that schema introspection is working as expected	2024-12-06 12:03:37 +00:00
lukaszraczylo	ed3966e577	If the field is allowed, continue checking remaining fields.	2024-12-06 11:58:34 +00:00
lukaszraczylo	6a52a9f673	Fixes the issue with case comparison.	2024-12-06 11:49:47 +00:00
lukaszraczylo	1ca05a7a2a	Release 0.24.x - changes the query introspection.	2024-12-06 11:27:01 +00:00
lukaszraczylo	eb1b4b4eb7	Enhance the tests to cover the end status code as well.	2024-12-06 11:15:38 +00:00
lukaszraczylo	fc9bab47fb	Fix query introspection blocking on deeply nested types.	2024-12-06 11:04:26 +00:00
lukaszraczylo	cbe2afe539	Gather cleaner event errors and display as a group rather than separately.	2024-12-06 09:39:26 +00:00
lukaszraczylo	2190744729	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-12-06 03:14:57 +00:00
lukaszraczylo	0a96d139b6	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-12-05 03:15:42 +00:00
lukaszraczylo	1c1ac06e11	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-11-10 03:06:36 +00:00
lukaszraczylo	b2a67df3b6	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-11-09 03:03:58 +00:00
lukaszraczylo	3805e63f95	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-11-08 03:04:48 +00:00
lukaszraczylo	8abf731867	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-10-29 03:08:04 +00:00
lukaszraczylo	4e9db9a5c7	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-10-18 03:07:24 +00:00
lukaszraczylo	615836ab36	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-10-15 03:08:28 +00:00
lukaszraczylo	a51f37c0a2	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-10-12 03:04:33 +00:00
lukaszraczylo	6b31e5c4c0	Little code cleanup. (#19 )	2024-10-10 10:34:23 +01:00
lukaszraczylo	d919a1df75	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-10-10 03:07:51 +00:00
lukaszraczylo	71216bc247	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-10-06 03:09:06 +00:00
lukaszraczylo	e07ac59aee	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-10-05 03:05:04 +00:00
lukaszraczylo	baa30bfba9	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-10-04 03:06:10 +00:00
lukaszraczylo	f210f51e17	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-10-03 03:06:39 +00:00
lukaszraczylo	b09821a0b1	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-09-29 03:09:30 +00:00
lukaszraczylo	f835ad4e42	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-09-25 03:08:57 +00:00
lukaszraczylo	659e27bbf6	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-09-24 03:06:01 +00:00