featureflip 2.6.1 → 2.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: edea6a4841539f13194e1e03e76bd7db298e713a0d79ec66327838cc56ed8408
-  data.tar.gz: 5a2d3f0946e19fb1734bc7db35dc1006f5d39f22626cbd147f527c31aa8dbddd
+  metadata.gz: f3d59e135c8bde6e1955c965c186ade207bbb58961bbb95ad949497940efbd8d
+  data.tar.gz: 9a25588388685e6e08f206b4ed623b491e949df2fc448797ba4305cdfdedfd4f
 SHA512:
-  metadata.gz: 894e77cfd032b59b62a8b1f9832ad5370d042c20290604b7f836bf9f35c427503f1b29eb3495c80fa02f816ae60e9d6c45c2d9f2074a9621aeb2cdaf1dd9d235
-  data.tar.gz: 472b4f2dbeb2dc1806a7e2dba1128b26bbe52a63833fcdd0c4571abc7b300b7d61ee153fe80cd35462c3782bbedee3b76695093c617a14600972e296f8c3ea53
+  metadata.gz: ad445faee786f603e3702df154e78afe5ae8d3ca6868be6c4d5dcc97f03fc4006f364cf40d9c2a73d5e0d43744f5074228186b6b3f69a1a97fd03ca678aa037a
+  data.tar.gz: 5bdd2687ecec69386d9cde9f8b0c5190bd4bee4e49f3187f3762263be21e28e6d3dd09517c4b44451f4ddcc969fa70543a7177f91ba6f2b39fd7a785bf590147

data/lib/featureflip/data_source/streaming.rb

@@ -195,11 +195,27 @@ module Featureflip
         end
       end
 
-      # Capped exponential backoff. failures == 0 means a healthy stream just
-      # closed cleanly; still apply the base floor so we don't busy-loop.
+      # Capped exponential backoff, jittered at every level. failures == 0 means a
+      # healthy stream just closed cleanly; the jitter band's lower bound keeps the
+      # base floor in force so we don't busy-loop.
+      #
+      # Jittering the FIRST reconnect is load-bearing, not cosmetic: the drops this
+      # absorbs are fleet-wide — one edge event severs every stream at once (#2457)
+      # — so every client re-enters here at failures == 0 together. A constant there
+      # replayed the drop's own synchronisation as a reconnect spike one base delay
+      # later (#2508).
       def backoff_delay(failures)
         exponent = failures <= 0 ? 0 : failures - 1
-        [RECONNECT_BASE_DELAY_SECONDS * (2**exponent), MAX_BACKOFF_SECONDS].min
+        with_jitter([RECONNECT_BASE_DELAY_SECONDS * (2**exponent), MAX_BACKOFF_SECONDS].min)
+      end
+
+      # Returns a value in [d/2, d] to de-correlate reconnects across many SDK
+      # instances (thundering-herd avoidance after a shared outage).
+      def with_jitter(delay)
+        return delay if delay <= 0
+
+        half = delay / 2.0
+        half + (rand * half)
       end
 
       # Sleep for `seconds`, but return immediately if stop() fires — so a pending

data/lib/featureflip/evaluation/condition_evaluator.rb

@@ -14,14 +14,19 @@ module Featureflip
 
         return condition.negate if attr_value.nil?
 
+        # Resolve the operator ONCE (#2374). Every subsequent decision that keys
+        # off it -- numeric coercion, dispatch -- must read the same normalised
+        # label, or a mis-cased operator takes some paths and not others.
+        operator = normalize_operator(condition.operator)
+
         # Issue #1458: when the attribute is a native numeric (Integer/Float —
         # Ruby's `true`/`false` are NOT Numeric, so booleans are naturally
         # excluded), the equality-family operators coerce the condition values to
         # numbers and compare numerically, so 1.0 matches "1". This mirrors the
         # engine's type-aware path and runs BEFORE stringification — a String
         # attribute (even "1.0") stays on the string path below.
-        if attr_value.is_a?(Numeric) && NUMERIC_EQUALITY_OPERATORS.include?(condition.operator)
-          return evaluate_numeric_equality(condition, attr_value)
+        if attr_value.is_a?(Numeric) && NUMERIC_EQUALITY_OPERATORS.include?(operator)
+          return evaluate_numeric_equality(condition, operator, attr_value)
         end
 
         # Pass the raw (case-preserved) strings to the operator dispatcher.
@@ -31,7 +36,7 @@ module Featureflip
         str_value = attr_value.to_s
         targets = condition.values.map(&:to_s)
 
-        result = evaluate_operator(condition.operator, str_value, targets)
+        result = evaluate_operator(operator, str_value, targets)
 
         # Issue #2262: an unrecognised operator fails CLOSED. `!nil` is `true`
         # in Ruby, so without this guard a negated unknown operator would match
@@ -66,7 +71,7 @@ module Featureflip
       # The equality-family operators that get type-aware numeric coercion when
       # the attribute is a native Numeric (Issue #1458). Relational/string ops
       # are deliberately excluded — only these four coerce.
-      NUMERIC_EQUALITY_OPERATORS = %w[Equals NotEquals In NotIn].freeze
+      NUMERIC_EQUALITY_OPERATORS = %w[equals notequals in notin].freeze
       private_constant :NUMERIC_EQUALITY_OPERATORS
 
       # A parsed semantic version: the release core as dot-separated numeric
@@ -101,29 +106,51 @@ module Featureflip
         /\A(\d{4}-\d{2}-\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2}))?(\.\d+)?(Z|[+-]\d{2}:?\d{2})?)?\z/
       private_constant :ISO_OPERAND
 
+      # Length of each month in a non-leap year, indexed 1..12. Index 0 is unused padding.
+      DAYS_IN_MONTH = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31].freeze
+      private_constant :DAYS_IN_MONTH
+
+      # The single definition of "recognised operator" shared by the four
+      # string-typed SDKs (js, go, ruby, php) -- see #2374. Strips underscores
+      # and folds case, so the canonical PascalCase the API emits ("NotEquals"),
+      # the concatenated form go accepted ("notequals", "NOTEQUALS") and the
+      # snake_case form php accepted ("not_equals") all resolve to one label.
+      #
+      # This SDK previously matched the PascalCase labels EXACTLY, so every
+      # mis-cased spelling was simply unknown and failed closed. Normalising by
+      # removal makes the shared rule a superset of what each SDK accepted
+      # before, so no SDK gets stricter and no configuration that evaluated
+      # before stops doing so. The concatenated labels stay unambiguous under
+      # this mapping -- no two operator names collide once underscores go.
+      def normalize_operator(operator)
+        operator.to_s.delete("_").downcase
+      end
+
+      # `operator` arrives already normalised, so the labels below are the
+      # concatenated lowercase form rather than the wire PascalCase.
       def evaluate_operator(operator, value, targets)
         # Case-insensitive views for the string/relational/date operators.
         ci_value = value.downcase
         ci_targets = targets.map(&:downcase)
 
         case operator
-        when "Equals"
+        when "equals"
           ci_targets.any? { |t| ci_value == t }
-        when "NotEquals"
+        when "notequals"
           ci_targets.all? { |t| ci_value != t }
-        when "Contains"
+        when "contains"
           ci_targets.any? { |t| ci_value.include?(t) }
-        when "NotContains"
+        when "notcontains"
           ci_targets.all? { |t| !ci_value.include?(t) }
-        when "StartsWith"
+        when "startswith"
           ci_targets.any? { |t| ci_value.start_with?(t) }
-        when "EndsWith"
+        when "endswith"
           ci_targets.any? { |t| ci_value.end_with?(t) }
-        when "In"
+        when "in"
           ci_targets.include?(ci_value)
-        when "NotIn"
+        when "notin"
           !ci_targets.include?(ci_value)
-        when "MatchesRegex"
+        when "matchesregex"
           # Case-sensitive matching on the original-case value and pattern,
           # mirroring the engine (RegexOptions.None). Case-insensitivity is
           # opt-in via the (?i) inline flag in the pattern.
@@ -141,13 +168,13 @@ module Featureflip
         # against ANY condition value (mirroring the server engine), not just
         # values[0]. `.any?` over an empty array is false, so empty values
         # returns false without error.
-        when "GreaterThan"
+        when "greaterthan"
           ci_targets.any? { |t| compare_numeric(ci_value, t, :>) }
-        when "GreaterThanOrEqual"
+        when "greaterthanorequal"
           ci_targets.any? { |t| compare_numeric(ci_value, t, :>=) }
-        when "LessThan"
+        when "lessthan"
           ci_targets.any? { |t| compare_numeric(ci_value, t, :<) }
-        when "LessThanOrEqual"
+        when "lessthanorequal"
           ci_targets.any? { |t| compare_numeric(ci_value, t, :<=) }
         # Date operators compare against the RAW value/targets, not the
         # lowercased copies: downcasing breaks ISO-8601 parsing (the "Z" UTC
@@ -155,23 +182,23 @@ module Featureflip
         # to UTC instants — offsets are honored, no-offset strings are assumed
         # UTC, and a bare integer is treated as Unix seconds — so an unparseable
         # operand matches nothing instead of falling back to a string compare.
-        when "Before"
+        when "before"
           targets.any? { |t| compare_datetime(value, t, :<) }
-        when "After"
+        when "after"
           targets.any? { |t| compare_datetime(value, t, :>) }
         # Semantic-version operators compare against the RAW value/targets:
         # prerelease precedence is case-sensitive (semver §11), so the casing
         # preserved by `evaluate_condition` must not be folded here. An
         # unparseable version matches nothing, like the numeric/date operators.
-        when "SemverEquals"
+        when "semverequals"
           targets.any? { |t| compare_semver(value, t, :==) }
-        when "SemverGreaterThan"
+        when "semvergreaterthan"
           targets.any? { |t| compare_semver(value, t, :>) }
-        when "SemverGreaterThanOrEqual"
+        when "semvergreaterthanorequal"
           targets.any? { |t| compare_semver(value, t, :>=) }
-        when "SemverLessThan"
+        when "semverlessthan"
           targets.any? { |t| compare_semver(value, t, :<) }
-        when "SemverLessThanOrEqual"
+        when "semverlessthanorequal"
           targets.any? { |t| compare_semver(value, t, :<=) }
         else
           # Unrecognised operator. `nil` — NOT `false` — so the caller can tell
@@ -186,21 +213,21 @@ module Featureflip
       # numerically against the attribute. Equals/In match if ANY value is equal;
       # NotEquals/NotIn are their negation. The `negate` flag is then applied,
       # mirroring `evaluate_condition`'s tail.
-      def evaluate_numeric_equality(condition, attr_value)
+      def evaluate_numeric_equality(condition, operator, attr_value)
         target = attr_value.to_f
         any_equal = condition.values.any? do |v|
           n = parse_numeric(v)
           n && n == target
         end
 
-        positive = NUMERIC_EQUALITY_POSITIVE_OPERATORS.include?(condition.operator)
+        positive = NUMERIC_EQUALITY_POSITIVE_OPERATORS.include?(operator)
         result = positive ? any_equal : !any_equal
         condition.negate ? !result : result
       end
 
       # Equals/In are the "positive" members of the equality family (match on
       # equality); NotEquals/NotIn negate the same any-equal test.
-      NUMERIC_EQUALITY_POSITIVE_OPERATORS = %w[Equals In].freeze
+      NUMERIC_EQUALITY_POSITIVE_OPERATORS = %w[equals in].freeze
       private_constant :NUMERIC_EQUALITY_POSITIVE_OPERATORS
 
       # Strict literal parse of a condition value to a Float, reusing the same
@@ -232,15 +259,42 @@ module Featureflip
         left.send(op, right)
       end
 
-      # Parses a date-time to a UTC `Time`, mirroring the engine's
-      # TryParseDateTime. ISO-8601 strings honor any timezone offset; a string
-      # without an offset is assumed UTC. A bare integer is treated as Unix time
-      # in seconds. Returns nil when the input parses as neither.
       # DateTimeOffset.MinValue / MaxValue as unix seconds -- the exact bounds the
       # engine's FromUnixTimeSeconds accepts before throwing (#2432).
       MIN_UNIX_SECONDS = -62_135_596_800
       MAX_UNIX_SECONDS = 253_402_300_799
 
+      # Whether +date+ -- always "YYYY-MM-DD", since only canonicalize_iso calls this --
+      # names a day that exists.
+      #
+      # ISO_OPERAND matches the SHAPE of a calendar date and a character class cannot
+      # express "is a real day", so "2024-02-30", "2023-02-29" and "2024-04-31" all pass
+      # the grammar. The engine, csharp, go, python and java then reject them at parse;
+      # ruby, js and php ROLLED THEM OVER into the 1st of the following month, so one
+      # saved rule served different variations to two users purely by which SDK their
+      # service ran (#2491).
+      #
+      # Hand-rolled rather than delegated to Date.valid_date?, which applies the Italian
+      # calendar reform by DEFAULT and so rejects 1582-10-05..14 -- dates the engine
+      # resolves normally. Passing Date::GREGORIAN would fix that, but computing the
+      # arithmetic identically in ruby, js and php is what keeps the accepted set a
+      # property of THIS contract rather than of three separate calendars.
+      #
+      # Proleptic Gregorian, matching the engine: the leap rule applies at every year
+      # rather than from a reform date onward.
+      def real_calendar_day?(date)
+        year = date[0, 4].to_i
+        month = date[5, 2].to_i
+        day = date[8, 2].to_i
+
+        # Month 0 and day 0 are the shapes only php mishandled, rolling each BACKWARDS
+        # into the previous year ("2024-00-01" -> 2023-12-01, "2024-01-00" -> 2023-12-31).
+        return false if month < 1 || month > 12 || day < 1
+
+        leap_day = month == 2 && year % 4 == 0 && (year % 100 != 0 || year % 400 == 0) ? 1 : 0
+        day <= DAYS_IN_MONTH[month] + leap_day
+      end
+
       # Rewrites an accepted ISO operand into the strict extended form Time.iso8601
       # parses: "T" separator, seconds present, offset spelled "+HH:MM" or "Z".
       # Returns nil when the operand is not an accepted ISO shape.
@@ -249,6 +303,12 @@ module Featureflip
         return nil if m.nil?
 
         date, hh, mm, ss, frac, off = m.captures
+
+        # Checked on the WRITTEN date, before any offset is applied. Validating the
+        # resolved UTC components instead would accept "2024-02-30T00:00:00+05:00",
+        # which lands on 2024-02-29T19:00Z -- a date that does exist.
+        return nil unless real_calendar_day?(date)
+
         return "#{date}T00:00:00Z" if hh.nil?
 
         # The engine's DateTimeOffset.TryParse rejects hour 24 outright rather than
@@ -264,6 +324,10 @@ module Featureflip
         "#{date}T#{hh}:#{mm}:#{ss}#{frac}#{off}"
       end
 
+      # Parses a date-time to a UTC `Time`, mirroring the engine's
+      # TryParseDateTime. ISO-8601 strings honor any timezone offset; a string
+      # without an offset is assumed UTC. A bare integer is treated as Unix time
+      # in seconds. Returns nil when the input parses as neither.
       def parse_datetime(value)
         s = value.to_s
         # Trim exactly the engine's whitespace class, then reject anything still
@@ -276,10 +340,35 @@ module Featureflip
           begin
             # Offset-less forms were canonicalized to an explicit "Z", mirroring
             # DateTimeOffset.TryParse with AssumeUniversal.
-            return Time.iso8601(iso).utc
+            t = Time.iso8601(iso).utc
+
+            # The SAME range the integer branch below enforces, applied to the
+            # RESOLVED instant. The engine parses with DateTimeOffset.TryParse, so its
+            # accepted set is bounded by DateTimeOffset's range and it returns false
+            # outside it; ruby, js, php, go and java all resolve past both ends --
+            # year 0 to a real instant, and a 4-digit year plus an offset to one
+            # beyond either bound (#2500).
+            #
+            # Checked on the RESOLVED instant, deliberately unlike the WRITTEN-triple
+            # check in real_calendar_day?. The two answer different questions: whether
+            # the operand names a real DAY is a property of what was written
+            # ("2024-02-30T00:00:00+05:00" lands on a real UTC day but names none),
+            # whereas whether it is REPRESENTABLE is a property of what it resolves to
+            # -- the offset is exactly what carries "0001-01-01T00:00:00+05:00" under
+            # the floor and "9999-12-31T23:59:59-05:00" over the ceiling.
+            #
+            # to_i floors, matching the other SDKs: a fractional second is always a
+            # non-negative addend, so "0000-12-31T23:59:59.5Z" floors to MIN-1 and is
+            # rejected while "0001-01-01T00:00:00.5Z" floors to MIN and is kept.
+            seconds = t.to_i
+            return nil if seconds < MIN_UNIX_SECONDS || seconds > MAX_UNIX_SECONDS
+
+            return t
           rescue ArgumentError
-            # A syntactically-valid but non-existent date (e.g. 2024-02-31) --
-            # fall through to the Unix-seconds fallback, which will also reject it.
+            # An unreal day is already gone (real_calendar_day?), so this now only
+            # catches the out-of-range minute and second the grammar's \d{2} still
+            # admits ("00:99", "00:00:99"), which every other SDK rejects too. Falls
+            # through to the Unix-seconds fallback, which rejects a non-integer.
           end
         end
 

data/lib/featureflip/events/event_processor.rb

@@ -34,6 +34,22 @@ module Featureflip
         # — see #auto_flush.
         @next_auto_flush_at = 0.0
         @auto_flush_in_flight = false
+
+        # Coalescing state for the drain loop. @auto_flush_in_flight above only ever
+        # guarded the SIZE trigger; nothing stopped the background thread's interval
+        # tick, an explicit Client#flush and a size-triggered flush from entering the
+        # loop together. Two concurrent drains mean two request streams against the
+        # endpoint the backoff gate exists to protect — and a success in one clears
+        # the gate a failure in the other has just armed, re-opening the
+        # one-request-per-event behaviour outright (#2477).
+        #
+        # Generation counters rather than a bare flag: a waiter has to be able to
+        # tell "the drain I was waiting for has finished" from "a later drain is
+        # running", or it would sleep through its own completion.
+        @drain_in_flight = false
+        @drain_started = 0
+        @drain_finished = 0
+        @drain_done = ConditionVariable.new
       end
 
       def queue_event(event)
@@ -58,7 +74,43 @@ module Featureflip
       # at its 10,000-event bound, and posting all of that at once risks a body the server
       # rejects outright. A 413 is non-retryable, so the entire backlog would be dropped by
       # the very path added to preserve it.
+      # At most one drain runs at a time. A caller arriving while one is already
+      # going waits for it and returns — it does NOT start its own, and it does NOT
+      # return early, because a caller that asked for a flush is asking for its
+      # events to be sent. This matches the js/node SDKs, whose flush() has always
+      # returned the in-flight promise (#2477).
       def flush
+        mine = @mutex.synchronize do
+          if @drain_in_flight
+            nil
+          else
+            @drain_in_flight = true
+            @drain_started += 1
+          end
+        end
+
+        if mine.nil?
+          @mutex.synchronize do
+            waiting_for = @drain_started
+            @drain_done.wait(@mutex) while @drain_finished < waiting_for
+          end
+          return
+        end
+
+        begin
+          drain
+        ensure
+          @mutex.synchronize do
+            @drain_in_flight = false
+            @drain_finished = mine
+            @drain_done.broadcast
+          end
+        end
+      end
+
+      # The drain loop itself, callable when coalescing must be bypassed.
+      # Private: #flush is the public entry point, and #stop reaches this directly.
+      private def drain
         loop do
           batch = drain_batch
           return if batch.empty?
@@ -103,7 +155,13 @@ module Featureflip
         # re-queued: nothing will flush again, and retrying until the queue drains would
         # hang shutdown for as long as the endpoint stayed down. One attempt, then let go.
         @mutex.synchronize { @stopped = true }
-        flush
+        # drain, not flush: shutdown must never be the call that gets coalesced
+        # away. If the interval tick's drain happens to be in flight, flush would
+        # wait for it and return, and anything queued after that loop's last look
+        # would be discarded unsent. Two drains overlapping is safe here precisely
+        # because @stopped is already set, so neither can re-queue and there is no
+        # backoff left to disarm.
+        drain
         @mutex.synchronize { @queue.clear }
       end
 

data/lib/featureflip/version.rb

@@ -1,3 +1,3 @@
 module Featureflip
-  VERSION = "2.6.1"
+  VERSION = "2.8.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: featureflip
 version: !ruby/object:Gem::Version
-  version: 2.6.1
+  version: 2.8.0
 platform: ruby
 authors:
 - Featureflip
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-25 00:00:00.000000000 Z
+date: 2026-09-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logger