WIP

Author: jandro996

dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/ddwaf/WAFModuleSpecification.groovy

@@ -1,5 +1,8 @@
 package com.datadog.appsec.ddwaf
 
+import com.datadog.ddwaf.WafErrorCode as LibWafErrorCode
+import datadog.trace.api.telemetry.WafMetricCollector.WafErrorCode as InternalWafErrorCode
+
 import com.datadog.appsec.AppSecModule
 import com.datadog.appsec.config.AppSecConfig
 import com.datadog.appsec.config.AppSecData
@@ -17,7 +20,6 @@ import com.datadog.appsec.event.data.MapDataBundle
 import com.datadog.appsec.gateway.AppSecRequestContext
 import com.datadog.appsec.gateway.GatewayContext
 import com.datadog.appsec.report.AppSecEvent
-import com.datadog.ddwaf.WafErrorCode
 import com.datadog.ddwaf.exception.AbstractWafException
 import com.datadog.ddwaf.exception.InternalWafException
 import com.datadog.ddwaf.exception.InvalidArgumentWafException
@@ -1790,7 +1792,7 @@ class WAFModuleSpecification extends DDSpecification {
     0 * _
 
     where:
-    wafErrorCode << WafErrorCode.values()
+    wafErrorCode << LibWafErrorCode.values()
   }
 
   void 'test wafErrorCode metric is increased when waf  call throws #wafErrorCode '() {
@@ -1819,21 +1821,30 @@ class WAFModuleSpecification extends DDSpecification {
     0 * _
 
     where:
-    wafErrorCode << WafErrorCode.values()
+    wafErrorCode << LibWafErrorCode.values()
+  }
+
+  def 'internal-api WafErrorCode enum matches libddwaf-java by name and code'() {
+    given:
+    def libddwaf = com.datadog.ddwaf.WafErrorCode.values().collectEntries { [it.name(), it.code] }
+    def internal = datadog.trace.api.telemetry.WafMetricCollector.WafErrorCode.values().collectEntries { [it.name(), it.code] }
+
+    expect:
+    internal == libddwaf
   }
 
   /**
    * Helper to return a concrete Waf exception for each WafErrorCode
    */
-  static AbstractWafException createWafException(WafErrorCode code) {
+  static AbstractWafException createWafException(LibWafErrorCode code) {
     switch (code) {
-      case WafErrorCode.INVALID_ARGUMENT:
+      case LibWafErrorCode.INVALID_ARGUMENT:
         return new InvalidArgumentWafException(code.code)
-      case WafErrorCode.INVALID_OBJECT:
+      case LibWafErrorCode.INVALID_OBJECT:
         return new InvalidObjectWafException(code.code)
-      case WafErrorCode.INTERNAL_ERROR:
+      case LibWafErrorCode.INTERNAL_ERROR:
         return new InternalWafException(code.code)
-      case WafErrorCode.BINDING_ERROR:
+      case LibWafErrorCode.BINDING_ERROR:
         return new UnclassifiedWafException(code.code)
       default:
         throw new IllegalStateException("Unhandled WafErrorCode: $code")

internal-api/src/main/java/datadog/trace/api/telemetry/WafMetricCollector.java

@@ -610,7 +610,19 @@ public final void increment() {
     }
   }
 
-  enum WafErrorCode {
+  /**
+   * Mirror of the {@code WafErrorCode} enum defined in the {@code libddwaf-java} module.
+   *
+   * <p>This enum is duplicated here to avoid adding a dependency on the native bindings module
+   * (`libddwaf-java`) within the {@code internal-api} module.
+   *
+   * <p>IMPORTANT: If the {@code WafErrorCode} definition in {@code libddwaf-java} is updated, this
+   * enum must be kept in sync manually to ensure correct behavior and compatibility.
+   *
+   * <p>Each enum value represents a specific WAF error condition, typically returned when running a
+   * WAF rule evaluation.
+   */
+  public enum WafErrorCode {
     INVALID_ARGUMENT(-1),
     INVALID_OBJECT(-2),
     INTERNAL_ERROR(-3),