featureflip 2.6.1 → 2.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: edea6a4841539f13194e1e03e76bd7db298e713a0d79ec66327838cc56ed8408
-  data.tar.gz: 5a2d3f0946e19fb1734bc7db35dc1006f5d39f22626cbd147f527c31aa8dbddd
+  metadata.gz: 3d0798d6f9dde45580a5345467cfcbc108b01a0bda1ed9c0224a6e58305ec9bd
+  data.tar.gz: d7a7ceca0d72477e0987ee83b0af3bdcee069f47add6ecc89a42bb7c9cb635e4
 SHA512:
-  metadata.gz: 894e77cfd032b59b62a8b1f9832ad5370d042c20290604b7f836bf9f35c427503f1b29eb3495c80fa02f816ae60e9d6c45c2d9f2074a9621aeb2cdaf1dd9d235
-  data.tar.gz: 472b4f2dbeb2dc1806a7e2dba1128b26bbe52a63833fcdd0c4571abc7b300b7d61ee153fe80cd35462c3782bbedee3b76695093c617a14600972e296f8c3ea53
+  metadata.gz: 2546ac239e8b8c0b120caa1d8286ad9a58e4fe23900a58cb63343ad469e9e324548ebac72ea194c102c023e5de2ef2e88fd344c80d15beb49dfc18803a3bd711
+  data.tar.gz: 6393ec68c36a42813a537fa699e9801132606d273264c142b8d75082c0fc7d260160b27aac53306d49a14bd2d895de2da57e8284690c8affb031076a76500a47

data/lib/featureflip/data_source/streaming.rb

@@ -195,11 +195,27 @@ module Featureflip
         end
       end
 
-      # Capped exponential backoff. failures == 0 means a healthy stream just
-      # closed cleanly; still apply the base floor so we don't busy-loop.
+      # Capped exponential backoff, jittered at every level. failures == 0 means a
+      # healthy stream just closed cleanly; the jitter band's lower bound keeps the
+      # base floor in force so we don't busy-loop.
+      #
+      # Jittering the FIRST reconnect is load-bearing, not cosmetic: the drops this
+      # absorbs are fleet-wide — one edge event severs every stream at once (#2457)
+      # — so every client re-enters here at failures == 0 together. A constant there
+      # replayed the drop's own synchronisation as a reconnect spike one base delay
+      # later (#2508).
       def backoff_delay(failures)
         exponent = failures <= 0 ? 0 : failures - 1
-        [RECONNECT_BASE_DELAY_SECONDS * (2**exponent), MAX_BACKOFF_SECONDS].min
+        with_jitter([RECONNECT_BASE_DELAY_SECONDS * (2**exponent), MAX_BACKOFF_SECONDS].min)
+      end
+
+      # Returns a value in [d/2, d] to de-correlate reconnects across many SDK
+      # instances (thundering-herd avoidance after a shared outage).
+      def with_jitter(delay)
+        return delay if delay <= 0
+
+        half = delay / 2.0
+        half + (rand * half)
       end
 
       # Sleep for `seconds`, but return immediately if stop() fires — so a pending

data/lib/featureflip/evaluation/condition_evaluator.rb

@@ -101,6 +101,10 @@ module Featureflip
         /\A(\d{4}-\d{2}-\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2}))?(\.\d+)?(Z|[+-]\d{2}:?\d{2})?)?\z/
       private_constant :ISO_OPERAND
 
+      # Length of each month in a non-leap year, indexed 1..12. Index 0 is unused padding.
+      DAYS_IN_MONTH = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31].freeze
+      private_constant :DAYS_IN_MONTH
+
       def evaluate_operator(operator, value, targets)
         # Case-insensitive views for the string/relational/date operators.
         ci_value = value.downcase
@@ -232,15 +236,42 @@ module Featureflip
         left.send(op, right)
       end
 
-      # Parses a date-time to a UTC `Time`, mirroring the engine's
-      # TryParseDateTime. ISO-8601 strings honor any timezone offset; a string
-      # without an offset is assumed UTC. A bare integer is treated as Unix time
-      # in seconds. Returns nil when the input parses as neither.
       # DateTimeOffset.MinValue / MaxValue as unix seconds -- the exact bounds the
       # engine's FromUnixTimeSeconds accepts before throwing (#2432).
       MIN_UNIX_SECONDS = -62_135_596_800
       MAX_UNIX_SECONDS = 253_402_300_799
 
+      # Whether +date+ -- always "YYYY-MM-DD", since only canonicalize_iso calls this --
+      # names a day that exists.
+      #
+      # ISO_OPERAND matches the SHAPE of a calendar date and a character class cannot
+      # express "is a real day", so "2024-02-30", "2023-02-29" and "2024-04-31" all pass
+      # the grammar. The engine, csharp, go, python and java then reject them at parse;
+      # ruby, js and php ROLLED THEM OVER into the 1st of the following month, so one
+      # saved rule served different variations to two users purely by which SDK their
+      # service ran (#2491).
+      #
+      # Hand-rolled rather than delegated to Date.valid_date?, which applies the Italian
+      # calendar reform by DEFAULT and so rejects 1582-10-05..14 -- dates the engine
+      # resolves normally. Passing Date::GREGORIAN would fix that, but computing the
+      # arithmetic identically in ruby, js and php is what keeps the accepted set a
+      # property of THIS contract rather than of three separate calendars.
+      #
+      # Proleptic Gregorian, matching the engine: the leap rule applies at every year
+      # rather than from a reform date onward.
+      def real_calendar_day?(date)
+        year = date[0, 4].to_i
+        month = date[5, 2].to_i
+        day = date[8, 2].to_i
+
+        # Month 0 and day 0 are the shapes only php mishandled, rolling each BACKWARDS
+        # into the previous year ("2024-00-01" -> 2023-12-01, "2024-01-00" -> 2023-12-31).
+        return false if month < 1 || month > 12 || day < 1
+
+        leap_day = month == 2 && year % 4 == 0 && (year % 100 != 0 || year % 400 == 0) ? 1 : 0
+        day <= DAYS_IN_MONTH[month] + leap_day
+      end
+
       # Rewrites an accepted ISO operand into the strict extended form Time.iso8601
       # parses: "T" separator, seconds present, offset spelled "+HH:MM" or "Z".
       # Returns nil when the operand is not an accepted ISO shape.
@@ -249,6 +280,12 @@ module Featureflip
         return nil if m.nil?
 
         date, hh, mm, ss, frac, off = m.captures
+
+        # Checked on the WRITTEN date, before any offset is applied. Validating the
+        # resolved UTC components instead would accept "2024-02-30T00:00:00+05:00",
+        # which lands on 2024-02-29T19:00Z -- a date that does exist.
+        return nil unless real_calendar_day?(date)
+
         return "#{date}T00:00:00Z" if hh.nil?
 
         # The engine's DateTimeOffset.TryParse rejects hour 24 outright rather than
@@ -264,6 +301,10 @@ module Featureflip
         "#{date}T#{hh}:#{mm}:#{ss}#{frac}#{off}"
       end
 
+      # Parses a date-time to a UTC `Time`, mirroring the engine's
+      # TryParseDateTime. ISO-8601 strings honor any timezone offset; a string
+      # without an offset is assumed UTC. A bare integer is treated as Unix time
+      # in seconds. Returns nil when the input parses as neither.
       def parse_datetime(value)
         s = value.to_s
         # Trim exactly the engine's whitespace class, then reject anything still
@@ -276,10 +317,35 @@ module Featureflip
           begin
             # Offset-less forms were canonicalized to an explicit "Z", mirroring
             # DateTimeOffset.TryParse with AssumeUniversal.
-            return Time.iso8601(iso).utc
+            t = Time.iso8601(iso).utc
+
+            # The SAME range the integer branch below enforces, applied to the
+            # RESOLVED instant. The engine parses with DateTimeOffset.TryParse, so its
+            # accepted set is bounded by DateTimeOffset's range and it returns false
+            # outside it; ruby, js, php, go and java all resolve past both ends --
+            # year 0 to a real instant, and a 4-digit year plus an offset to one
+            # beyond either bound (#2500).
+            #
+            # Checked on the RESOLVED instant, deliberately unlike the WRITTEN-triple
+            # check in real_calendar_day?. The two answer different questions: whether
+            # the operand names a real DAY is a property of what was written
+            # ("2024-02-30T00:00:00+05:00" lands on a real UTC day but names none),
+            # whereas whether it is REPRESENTABLE is a property of what it resolves to
+            # -- the offset is exactly what carries "0001-01-01T00:00:00+05:00" under
+            # the floor and "9999-12-31T23:59:59-05:00" over the ceiling.
+            #
+            # to_i floors, matching the other SDKs: a fractional second is always a
+            # non-negative addend, so "0000-12-31T23:59:59.5Z" floors to MIN-1 and is
+            # rejected while "0001-01-01T00:00:00.5Z" floors to MIN and is kept.
+            seconds = t.to_i
+            return nil if seconds < MIN_UNIX_SECONDS || seconds > MAX_UNIX_SECONDS
+
+            return t
           rescue ArgumentError
-            # A syntactically-valid but non-existent date (e.g. 2024-02-31) --
-            # fall through to the Unix-seconds fallback, which will also reject it.
+            # An unreal day is already gone (real_calendar_day?), so this now only
+            # catches the out-of-range minute and second the grammar's \d{2} still
+            # admits ("00:99", "00:00:99"), which every other SDK rejects too. Falls
+            # through to the Unix-seconds fallback, which rejects a non-integer.
           end
         end
 

data/lib/featureflip/events/event_processor.rb

@@ -34,6 +34,22 @@ module Featureflip
         # — see #auto_flush.
         @next_auto_flush_at = 0.0
         @auto_flush_in_flight = false
+
+        # Coalescing state for the drain loop. @auto_flush_in_flight above only ever
+        # guarded the SIZE trigger; nothing stopped the background thread's interval
+        # tick, an explicit Client#flush and a size-triggered flush from entering the
+        # loop together. Two concurrent drains mean two request streams against the
+        # endpoint the backoff gate exists to protect — and a success in one clears
+        # the gate a failure in the other has just armed, re-opening the
+        # one-request-per-event behaviour outright (#2477).
+        #
+        # Generation counters rather than a bare flag: a waiter has to be able to
+        # tell "the drain I was waiting for has finished" from "a later drain is
+        # running", or it would sleep through its own completion.
+        @drain_in_flight = false
+        @drain_started = 0
+        @drain_finished = 0
+        @drain_done = ConditionVariable.new
       end
 
       def queue_event(event)
@@ -58,7 +74,43 @@ module Featureflip
       # at its 10,000-event bound, and posting all of that at once risks a body the server
       # rejects outright. A 413 is non-retryable, so the entire backlog would be dropped by
       # the very path added to preserve it.
+      # At most one drain runs at a time. A caller arriving while one is already
+      # going waits for it and returns — it does NOT start its own, and it does NOT
+      # return early, because a caller that asked for a flush is asking for its
+      # events to be sent. This matches the js/node SDKs, whose flush() has always
+      # returned the in-flight promise (#2477).
       def flush
+        mine = @mutex.synchronize do
+          if @drain_in_flight
+            nil
+          else
+            @drain_in_flight = true
+            @drain_started += 1
+          end
+        end
+
+        if mine.nil?
+          @mutex.synchronize do
+            waiting_for = @drain_started
+            @drain_done.wait(@mutex) while @drain_finished < waiting_for
+          end
+          return
+        end
+
+        begin
+          drain
+        ensure
+          @mutex.synchronize do
+            @drain_in_flight = false
+            @drain_finished = mine
+            @drain_done.broadcast
+          end
+        end
+      end
+
+      # The drain loop itself, callable when coalescing must be bypassed.
+      # Private: #flush is the public entry point, and #stop reaches this directly.
+      private def drain
         loop do
           batch = drain_batch
           return if batch.empty?
@@ -103,7 +155,13 @@ module Featureflip
         # re-queued: nothing will flush again, and retrying until the queue drains would
         # hang shutdown for as long as the endpoint stayed down. One attempt, then let go.
         @mutex.synchronize { @stopped = true }
-        flush
+        # drain, not flush: shutdown must never be the call that gets coalesced
+        # away. If the interval tick's drain happens to be in flight, flush would
+        # wait for it and return, and anything queued after that loop's last look
+        # would be discarded unsent. Two drains overlapping is safe here precisely
+        # because @stopped is already set, so neither can re-queue and there is no
+        # backoff left to disarm.
+        drain
         @mutex.synchronize { @queue.clear }
       end
 

data/lib/featureflip/version.rb

@@ -1,3 +1,3 @@
 module Featureflip
-  VERSION = "2.6.1"
+  VERSION = "2.7.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: featureflip
 version: !ruby/object:Gem::Version
-  version: 2.6.1
+  version: 2.7.0
 platform: ruby
 authors:
 - Featureflip
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-25 00:00:00.000000000 Z
+date: 2026-08-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logger