featureflip 2.4.2 → 2.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aecafb52584cdd159977d5675c171b745b05be804b20c5a375edceb5dd719e8c
-  data.tar.gz: 61e57b0db95b63da79bacc9c0f9af36ff24525cbf44f50f15a18f79124574a0a
+  metadata.gz: a41a0e3edb8d4325e4a0784930973f07ad8339e7b25b127f076bc7cfade0d948
+  data.tar.gz: 6ceb86141220f142710e6a0937af742270c61961ff87f583a2d727bab1c6ee65
 SHA512:
-  metadata.gz: 2419e95a82d2512a886d535e03cfb644668424873e383af9713503c772e8fa14faa45b734ac4419705f7511fc69fbe61bab0cacd2f98a24e9ca57e67cbdb5978
-  data.tar.gz: b6c7d2b7e1c4cc9c9aca050b9e97af993ec6201b7caf95f33bc2c6e0cdb8dc6a698c3eb3998f1805051e7f2e73907ea76a7f94a458a02b2f9185a347b4dc3f8f
+  metadata.gz: 013af1bacae587f2dd832bd7004ac4a94a45e8d635c64204d8ea892d4e62c80112d07856856d097f03393f4bbf7c3aef7d54c378672db9c61623d9053b8e3e3b
+  data.tar.gz: 822537c99bfdd30d8f2f4b16b9b8592d2cd23fdaccaf2cea0333fccdf68f0998877bf124da0060ec63abc0fb347f6506ad10f0fc235d8f22291de50a68f20a33

data/lib/featureflip/client.rb

@@ -16,7 +16,12 @@ module Featureflip
       new(core)
     end
 
+    # A closed handle reports false (#2287). Every variation accessor here was
+    # already guarded, so a closed client correctly served defaults while still
+    # claiming to be initialized. close releases the core -- stopping streaming
+    # and polling -- so the store it would read can never update again.
     def initialized?
+      return false if @closed
       @core.initialized?
     end
 

data/lib/featureflip/data_source/streaming.rb

@@ -234,8 +234,23 @@ module Featureflip
           flags, segments = @http_client.parse_flags_response(JSON.parse(data))
           @on_sync&.call(flags, segments)
         end
-      rescue StandardError
-        # Swallow event processing errors
+      rescue MalformedPayloadError => e
+        # A payload that violates the wire contract is discarded WHOLESALE rather
+        # than partially applied — a half-parsed snapshot silently mis-evaluates
+        # every flag it touches, which is strictly worse than serving the previous
+        # config until the next frame. See packages/CLAUDE.md.
+        #
+        # Never silent: a dropped `sync` means reconnect resync is not happening,
+        # and staying quiet about exactly this is how #2279 ran undetected.
+        @config.logger&.warn(
+          "Featureflip: discarding malformed #{event_type} payload: #{e.message}"
+        )
+      rescue StandardError => e
+        # Other event-processing errors must not kill the stream thread, but they
+        # are still worth surfacing — this used to swallow silently.
+        @config.logger&.warn(
+          "Featureflip: error handling #{event_type} event: #{e.class}: #{e.message}"
+        )
       end
     end
   end

data/lib/featureflip/errors.rb

@@ -2,4 +2,13 @@ module Featureflip
   class Error < StandardError; end
   class ConfigurationError < Error; end
   class InitializationError < Error; end
+
+  # Raised when a config payload violates the wire contract — e.g. an enum field
+  # arriving as a number where the contract specifies a string.
+  #
+  # Deliberately NOT raised for an unrecognised enum *string*: that is how a newer
+  # server introduces a new operator, and the evaluator already degrades an unknown
+  # operator to no-match. Only a TYPE violation is rejected, because that can never
+  # be a legitimate newer-server payload. See #2285.
+  class MalformedPayloadError < Error; end
 end

data/lib/featureflip/evaluation/condition_evaluator.rb

@@ -32,6 +32,14 @@ module Featureflip
         targets = condition.values.map(&:to_s)
 
         result = evaluate_operator(condition.operator, str_value, targets)
+
+        # Issue #2262: an unrecognised operator fails CLOSED. `!nil` is `true`
+        # in Ruby, so without this guard a negated unknown operator would match
+        # every user and roll the flag out to 100% of traffic. The realistic
+        # trigger is a new operator shipped server-side reaching an SDK pinned
+        # to an older version.
+        return false if result.nil?
+
         condition.negate ? !result : result
       end
 
@@ -150,7 +158,10 @@ module Featureflip
         when "SemverLessThanOrEqual"
           targets.any? { |t| compare_semver(value, t, :<=) }
         else
-          false
+          # Unrecognised operator. `nil` — NOT `false` — so the caller can tell
+          # "cannot evaluate" apart from "evaluated, did not match"; only the
+          # latter may be inverted by `negate` (#2262).
+          nil
         end
       end
 

data/lib/featureflip/http/client.rb

@@ -79,11 +79,26 @@ module Featureflip
         request(method, path, body, retries: retries - 1)
       end
 
+      # Enum fields are strings on the wire. Ruby keeps whatever it is handed and the
+      # evaluator compares against string literals, so a non-string here is stored
+      # verbatim and then silently matches nothing forever — note `value || "And"`
+      # does NOT save us, because 0 is truthy in Ruby (#2285).
+      #
+      # Only the TYPE is checked. An unrecognised enum *string* is how a newer server
+      # introduces a new operator, and the evaluator already degrades that to
+      # no-match; rejecting it would break this SDK against every future server.
+      def require_enum_string!(value, field)
+        return value if value.nil? || value.is_a?(String)
+
+        raise MalformedPayloadError,
+          "#{field} must be a string, got #{value.class} (#{value.inspect})"
+      end
+
       def parse_flag(data)
         Models::FlagConfiguration.new(
           key: data["key"],
           version: data["version"],
-          type: data["type"],
+          type: require_enum_string!(data["type"], "flag.type"),
           enabled: data["enabled"],
           variations: (data["variations"] || []).map { |v| Models::Variation.new(key: v["key"], value: v["value"]) },
           rules: (data["rules"] || []).map { |r| parse_rule(r) },
@@ -114,7 +129,7 @@ module Featureflip
 
       def parse_condition_group(data)
         Models::ConditionGroup.new(
-          operator: data["operator"] || "And",
+          operator: require_enum_string!(data["operator"], "conditionGroup.operator") || "And",
           conditions: (data["conditions"] || []).map { |c| parse_condition(c) }
         )
       end
@@ -122,7 +137,7 @@ module Featureflip
       def parse_condition(data)
         Models::Condition.new(
           attribute: data["attribute"],
-          operator: data["operator"],
+          operator: require_enum_string!(data["operator"], "condition.operator"),
           values: data["values"],
           negate: data["negate"] || false
         )
@@ -134,7 +149,7 @@ module Featureflip
         end
 
         Models::ServeConfig.new(
-          type: data["type"],
+          type: require_enum_string!(data["type"], "serve.type"),
           variation: data["variation"],
           bucket_by: data["bucketBy"],
           salt: data["salt"],
@@ -147,7 +162,7 @@ module Featureflip
           key: data["key"],
           version: data["version"],
           conditions: (data["conditions"] || []).map { |c| parse_condition(c) },
-          condition_logic: data["conditionLogic"] || "And"
+          condition_logic: require_enum_string!(data["conditionLogic"], "segment.conditionLogic") || "And"
         )
       end
     end

data/lib/featureflip/shared_core.rb

@@ -136,23 +136,30 @@ module Featureflip
 
     # --- Evaluation methods ---
 
+    # The typed accessors declare the JSON type they expect so a mismatch degrades
+    # to the caller's default with reason "Error" (#2281/#2286). json_variation
+    # takes no expectation: its value is an arbitrary structure, so there is no
+    # single type to check it against.
     def bool_variation(key, context, default_value)
-      evaluate_flag(key, context, default_value)
+      evaluate_flag(key, context, default_value, expected: :bool)
     end
 
     def string_variation(key, context, default_value)
-      evaluate_flag(key, context, default_value)
+      evaluate_flag(key, context, default_value, expected: :string)
     end
 
     def number_variation(key, context, default_value)
-      evaluate_flag(key, context, default_value)
+      evaluate_flag(key, context, default_value, expected: :number)
     end
 
     def json_variation(key, context, default_value)
       evaluate_flag(key, context, default_value)
     end
 
-    def variation_detail(key, context, default_value)
+    # +expected+ is the JSON type the caller's accessor requires (:bool, :string
+    # or :number), or nil for the generic/JSON accessors, which are not
+    # type-checked because they have no single expected type.
+    def variation_detail(key, context, default_value, expected: nil)
       context = normalize_context(context)
 
       if @test_mode
@@ -190,7 +197,20 @@ module Featureflip
                  result.reason
                end
 
-      value = result.value.nil? ? default_value : result.value
+      served = result.value
+      value = served.nil? ? default_value : served
+
+      # A typed accessor asked for a specific JSON type and the SERVED value is not
+      # it. Degrade to the caller's default and report Error so the mismatch is
+      # detectable, rather than handing back a String where the caller's code
+      # expects true/false (#2281/#2286). Checking `served` rather than `value`
+      # matters: a variation whose value is genuinely JSON null has already been
+      # replaced by default_value above, and that substitute would pass any check.
+      if expected && !value_matches_type?(served, expected)
+        value = default_value
+        reason = "Error"
+      end
+
       record_evaluation(key, context, result.variation_key)
       notify_inspectors(
         key, context, value,
@@ -221,25 +241,29 @@ module Featureflip
       return unless @event_processor
 
       context = normalize_context(context)
-      @event_processor.queue_event({
+      @event_processor.queue_event(compact_event({
         type: "Custom",
         flagKey: event_key,
-        userId: context["user_id"]&.to_s,
-        metadata: metadata || {},
+        userId: resolve_event_user_id(context),
+        metadata: metadata,
         timestamp: Time.now.utc.iso8601
-      })
+      }))
     end
 
     def identify(context)
       return unless @event_processor
 
       context = normalize_context(context)
-      @event_processor.queue_event({
+      # Strip both identity spellings so the id is carried once, at the top
+      # level, and not duplicated inside the attribute bag.
+      attributes = context.reject { |k, _| IDENTITY_KEYS.include?(k) }
+      @event_processor.queue_event(compact_event({
         type: "Identify",
         flagKey: "$identify",
-        userId: context["user_id"]&.to_s,
+        userId: resolve_event_user_id(context),
+        metadata: attributes,
         timestamp: Time.now.utc.iso8601
-      })
+      }))
     end
 
     def flush
@@ -367,17 +391,27 @@ module Featureflip
       @event_processor.start
     end
 
-    def evaluate_flag(key, context, default_value)
+    def evaluate_flag(key, context, default_value, expected: nil)
       if @test_mode
         return @test_values.fetch(key, default_value)
       end
 
-      detail = variation_detail(key, context, default_value)
+      detail = variation_detail(key, context, default_value, expected: expected)
       detail.value
     rescue StandardError
       default_value
     end
 
+    # True when +value+ is of the JSON type the caller's typed accessor requires.
+    def value_matches_type?(value, expected)
+      case expected
+      when :bool then value == true || value == false
+      when :string then value.is_a?(String)
+      when :number then value.is_a?(Numeric)
+      else true
+      end
+    end
+
     def get_segment(key)
       @store.get_segment(key)
     end
@@ -387,16 +421,43 @@ module Featureflip
       context.transform_keys(&:to_s)
     end
 
+    # Both spellings of the identity are accepted on an event context; the
+    # canonical +user_id+ wins when a caller supplies both. The evaluator
+    # already aliases these for bucketing, so events have to as well or an
+    # alias caller gets every event attributed to nil.
+    IDENTITY_KEYS = %w[user_id userId].freeze
+
+    def resolve_event_user_id(context)
+      raw = context["user_id"]
+      raw = context["userId"] if raw.nil?
+      raw&.to_s
+    end
+
+    # +userId+ and +metadata+ are optional on the wire. Omit them rather than
+    # sending nulls or empty bags, matching the other SDKs.
+    #
+    # +metadata+ is caller-supplied and untyped, so the emptiness check is
+    # guarded: a caller passing a non-collection must not take a NoMethodError
+    # into their request path just to record an analytics event.
+    def compact_event(event)
+      event.delete(:userId) if event[:userId].nil?
+      metadata = event[:metadata]
+      if metadata.nil? || (metadata.respond_to?(:empty?) && metadata.empty?)
+        event.delete(:metadata)
+      end
+      event
+    end
+
     def record_evaluation(key, context, variation_key)
       return unless @event_processor
 
-      @event_processor.queue_event({
+      @event_processor.queue_event(compact_event({
         type: "Evaluation",
         flagKey: key,
-        userId: context["user_id"]&.to_s,
+        userId: resolve_event_user_id(context),
         variation: variation_key,
         timestamp: Time.now.utc.iso8601
-      })
+      }))
     end
 
     # Fire the registered evaluation inspectors. Called once per variation call

data/lib/featureflip/version.rb

@@ -1,3 +1,3 @@
 module Featureflip
-  VERSION = "2.4.2"
+  VERSION = "2.5.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: featureflip
 version: !ruby/object:Gem::Version
-  version: 2.4.2
+  version: 2.5.1
 platform: ruby
 authors:
 - Featureflip
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-05 00:00:00.000000000 Z
+date: 2026-08-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logger