featureflip 2.4.2 → 2.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aecafb52584cdd159977d5675c171b745b05be804b20c5a375edceb5dd719e8c
-  data.tar.gz: 61e57b0db95b63da79bacc9c0f9af36ff24525cbf44f50f15a18f79124574a0a
+  metadata.gz: f3e88364434f9dced8db82624524bf1ffe905b35b5ae8a062896bfb6c02dc5e6
+  data.tar.gz: 87d5bdaa62bb9f6e8eb0685f235315b31adfb5cd0dbdaac478965144a09709ff
 SHA512:
-  metadata.gz: 2419e95a82d2512a886d535e03cfb644668424873e383af9713503c772e8fa14faa45b734ac4419705f7511fc69fbe61bab0cacd2f98a24e9ca57e67cbdb5978
-  data.tar.gz: b6c7d2b7e1c4cc9c9aca050b9e97af993ec6201b7caf95f33bc2c6e0cdb8dc6a698c3eb3998f1805051e7f2e73907ea76a7f94a458a02b2f9185a347b4dc3f8f
+  metadata.gz: 7b9c0cbfce3e7451f4218dc5a0274a28181d770a5689427d5fba20899702c5a580413b6adcb99482c717708cc2b60cccd5e9ee6dfb423351ff82024befae0477
+  data.tar.gz: d4c066e87770edfa6881cf000d36cc8e7f9f476cc3afebc8b44e5842f2c5946805af79a47dbceb575bd4e50496e56d024b3485fa083d414fb52bf8809b25eff2

data/lib/featureflip/client.rb

@@ -16,7 +16,12 @@ module Featureflip
       new(core)
     end
 
+    # A closed handle reports false (#2287). Every variation accessor here was
+    # already guarded, so a closed client correctly served defaults while still
+    # claiming to be initialized. close releases the core -- stopping streaming
+    # and polling -- so the store it would read can never update again.
     def initialized?
+      return false if @closed
       @core.initialized?
     end
 

data/lib/featureflip/data_source/streaming.rb

@@ -234,8 +234,23 @@ module Featureflip
           flags, segments = @http_client.parse_flags_response(JSON.parse(data))
           @on_sync&.call(flags, segments)
         end
-      rescue StandardError
-        # Swallow event processing errors
+      rescue MalformedPayloadError => e
+        # A payload that violates the wire contract is discarded WHOLESALE rather
+        # than partially applied — a half-parsed snapshot silently mis-evaluates
+        # every flag it touches, which is strictly worse than serving the previous
+        # config until the next frame. See packages/CLAUDE.md.
+        #
+        # Never silent: a dropped `sync` means reconnect resync is not happening,
+        # and staying quiet about exactly this is how #2279 ran undetected.
+        @config.logger&.warn(
+          "Featureflip: discarding malformed #{event_type} payload: #{e.message}"
+        )
+      rescue StandardError => e
+        # Other event-processing errors must not kill the stream thread, but they
+        # are still worth surfacing — this used to swallow silently.
+        @config.logger&.warn(
+          "Featureflip: error handling #{event_type} event: #{e.class}: #{e.message}"
+        )
       end
     end
   end

data/lib/featureflip/errors.rb

@@ -2,4 +2,13 @@ module Featureflip
   class Error < StandardError; end
   class ConfigurationError < Error; end
   class InitializationError < Error; end
+
+  # Raised when a config payload violates the wire contract — e.g. an enum field
+  # arriving as a number where the contract specifies a string.
+  #
+  # Deliberately NOT raised for an unrecognised enum *string*: that is how a newer
+  # server introduces a new operator, and the evaluator already degrades an unknown
+  # operator to no-match. Only a TYPE violation is rejected, because that can never
+  # be a legitimate newer-server payload. See #2285.
+  class MalformedPayloadError < Error; end
 end

data/lib/featureflip/http/client.rb

@@ -79,11 +79,26 @@ module Featureflip
         request(method, path, body, retries: retries - 1)
       end
 
+      # Enum fields are strings on the wire. Ruby keeps whatever it is handed and the
+      # evaluator compares against string literals, so a non-string here is stored
+      # verbatim and then silently matches nothing forever — note `value || "And"`
+      # does NOT save us, because 0 is truthy in Ruby (#2285).
+      #
+      # Only the TYPE is checked. An unrecognised enum *string* is how a newer server
+      # introduces a new operator, and the evaluator already degrades that to
+      # no-match; rejecting it would break this SDK against every future server.
+      def require_enum_string!(value, field)
+        return value if value.nil? || value.is_a?(String)
+
+        raise MalformedPayloadError,
+          "#{field} must be a string, got #{value.class} (#{value.inspect})"
+      end
+
       def parse_flag(data)
         Models::FlagConfiguration.new(
           key: data["key"],
           version: data["version"],
-          type: data["type"],
+          type: require_enum_string!(data["type"], "flag.type"),
           enabled: data["enabled"],
           variations: (data["variations"] || []).map { |v| Models::Variation.new(key: v["key"], value: v["value"]) },
           rules: (data["rules"] || []).map { |r| parse_rule(r) },
@@ -114,7 +129,7 @@ module Featureflip
 
       def parse_condition_group(data)
         Models::ConditionGroup.new(
-          operator: data["operator"] || "And",
+          operator: require_enum_string!(data["operator"], "conditionGroup.operator") || "And",
           conditions: (data["conditions"] || []).map { |c| parse_condition(c) }
         )
       end
@@ -122,7 +137,7 @@ module Featureflip
       def parse_condition(data)
         Models::Condition.new(
           attribute: data["attribute"],
-          operator: data["operator"],
+          operator: require_enum_string!(data["operator"], "condition.operator"),
           values: data["values"],
           negate: data["negate"] || false
         )
@@ -134,7 +149,7 @@ module Featureflip
         end
 
         Models::ServeConfig.new(
-          type: data["type"],
+          type: require_enum_string!(data["type"], "serve.type"),
           variation: data["variation"],
           bucket_by: data["bucketBy"],
           salt: data["salt"],
@@ -147,7 +162,7 @@ module Featureflip
           key: data["key"],
           version: data["version"],
           conditions: (data["conditions"] || []).map { |c| parse_condition(c) },
-          condition_logic: data["conditionLogic"] || "And"
+          condition_logic: require_enum_string!(data["conditionLogic"], "segment.conditionLogic") || "And"
         )
       end
     end

data/lib/featureflip/shared_core.rb

@@ -136,23 +136,30 @@ module Featureflip
 
     # --- Evaluation methods ---
 
+    # The typed accessors declare the JSON type they expect so a mismatch degrades
+    # to the caller's default with reason "Error" (#2281/#2286). json_variation
+    # takes no expectation: its value is an arbitrary structure, so there is no
+    # single type to check it against.
     def bool_variation(key, context, default_value)
-      evaluate_flag(key, context, default_value)
+      evaluate_flag(key, context, default_value, expected: :bool)
     end
 
     def string_variation(key, context, default_value)
-      evaluate_flag(key, context, default_value)
+      evaluate_flag(key, context, default_value, expected: :string)
     end
 
     def number_variation(key, context, default_value)
-      evaluate_flag(key, context, default_value)
+      evaluate_flag(key, context, default_value, expected: :number)
     end
 
     def json_variation(key, context, default_value)
       evaluate_flag(key, context, default_value)
     end
 
-    def variation_detail(key, context, default_value)
+    # +expected+ is the JSON type the caller's accessor requires (:bool, :string
+    # or :number), or nil for the generic/JSON accessors, which are not
+    # type-checked because they have no single expected type.
+    def variation_detail(key, context, default_value, expected: nil)
       context = normalize_context(context)
 
       if @test_mode
@@ -190,7 +197,20 @@ module Featureflip
                  result.reason
                end
 
-      value = result.value.nil? ? default_value : result.value
+      served = result.value
+      value = served.nil? ? default_value : served
+
+      # A typed accessor asked for a specific JSON type and the SERVED value is not
+      # it. Degrade to the caller's default and report Error so the mismatch is
+      # detectable, rather than handing back a String where the caller's code
+      # expects true/false (#2281/#2286). Checking `served` rather than `value`
+      # matters: a variation whose value is genuinely JSON null has already been
+      # replaced by default_value above, and that substitute would pass any check.
+      if expected && !value_matches_type?(served, expected)
+        value = default_value
+        reason = "Error"
+      end
+
       record_evaluation(key, context, result.variation_key)
       notify_inspectors(
         key, context, value,
@@ -367,17 +387,27 @@ module Featureflip
       @event_processor.start
     end
 
-    def evaluate_flag(key, context, default_value)
+    def evaluate_flag(key, context, default_value, expected: nil)
       if @test_mode
         return @test_values.fetch(key, default_value)
       end
 
-      detail = variation_detail(key, context, default_value)
+      detail = variation_detail(key, context, default_value, expected: expected)
       detail.value
     rescue StandardError
       default_value
     end
 
+    # True when +value+ is of the JSON type the caller's typed accessor requires.
+    def value_matches_type?(value, expected)
+      case expected
+      when :bool then value == true || value == false
+      when :string then value.is_a?(String)
+      when :number then value.is_a?(Numeric)
+      else true
+      end
+    end
+
     def get_segment(key)
       @store.get_segment(key)
     end

data/lib/featureflip/version.rb

@@ -1,3 +1,3 @@
 module Featureflip
-  VERSION = "2.4.2"
+  VERSION = "2.5.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: featureflip
 version: !ruby/object:Gem::Version
-  version: 2.4.2
+  version: 2.5.0
 platform: ruby
 authors:
 - Featureflip
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-05 00:00:00.000000000 Z
+date: 2026-08-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logger