flipper 0.24.1 → 1.3.0

data/spec/flipper/cloud/message_verifier_spec.rb

@@ -0,0 +1,104 @@
+require 'flipper/cloud/message_verifier'
+
+RSpec.describe Flipper::Cloud::MessageVerifier do
+  let(:payload) { "some payload" }
+  let(:secret) { "secret" }
+  let(:timestamp) { Time.now }
+
+  describe "#generate" do
+    it "generates signature that can be verified" do
+      message_verifier = Flipper::Cloud::MessageVerifier.new(secret: secret)
+      signature = message_verifier.generate(payload, timestamp)
+      header = generate_header(timestamp: timestamp, signature: signature)
+      expect(message_verifier.verify(payload, header)).to be(true)
+    end
+  end
+
+  describe "#header" do
+    it "generates a header in valid format" do
+      version = "v1"
+      message_verifier = Flipper::Cloud::MessageVerifier.new(secret: secret, version: version)
+      signature = message_verifier.generate(payload, timestamp)
+      header = message_verifier.header(signature, timestamp)
+      expect(header).to eq("t=#{timestamp.to_i},#{version}=#{signature}")
+    end
+  end
+
+  describe ".header" do
+    it "generates a header in valid format" do
+      version = "v1"
+      message_verifier = Flipper::Cloud::MessageVerifier.new(secret: secret, version: version)
+      signature = message_verifier.generate(payload, timestamp)
+
+      header = Flipper::Cloud::MessageVerifier.header(signature, timestamp, version)
+      expect(header).to eq("t=#{timestamp.to_i},#{version}=#{signature}")
+    end
+  end
+
+  describe "#verify" do
+    it "raises a InvalidSignature when the header does not have the expected format" do
+      header = "i'm not even a real signature header"
+      expect {
+        message_verifier = Flipper::Cloud::MessageVerifier.new(secret: "secret")
+        message_verifier.verify(payload, header)
+      }.to raise_error(Flipper::Cloud::MessageVerifier::InvalidSignature, "Unable to extract timestamp and signatures from header")
+    end
+
+    it "raises a InvalidSignature when there are no signatures with the expected version" do
+      header = generate_header(version: "v0")
+      expect {
+        message_verifier = Flipper::Cloud::MessageVerifier.new(secret: "secret")
+        message_verifier.verify(payload, header)
+      }.to raise_error(Flipper::Cloud::MessageVerifier::InvalidSignature, /No signatures found with expected version/)
+    end
+
+    it "raises a InvalidSignature when there are no valid signatures for the payload" do
+      header = generate_header(signature: "bad_signature")
+      expect {
+        message_verifier = Flipper::Cloud::MessageVerifier.new(secret: "secret")
+        message_verifier.verify(payload, header)
+      }.to raise_error(Flipper::Cloud::MessageVerifier::InvalidSignature, "No signatures found matching the expected signature for payload")
+    end
+
+    it "raises a InvalidSignature when the timestamp is not within the tolerance" do
+      header = generate_header(timestamp: Time.now - 15)
+      expect {
+        message_verifier = Flipper::Cloud::MessageVerifier.new(secret: secret)
+        message_verifier.verify(payload, header, tolerance: 10)
+      }.to raise_error(Flipper::Cloud::MessageVerifier::InvalidSignature, /Timestamp outside the tolerance zone/)
+    end
+
+    it "returns true when the header contains a valid signature and the timestamp is within the tolerance" do
+      header = generate_header
+      message_verifier = Flipper::Cloud::MessageVerifier.new(secret: "secret")
+      expect(message_verifier.verify(payload, header, tolerance: 10)).to be(true)
+    end
+
+    it "returns true when the header contains at least one valid signature" do
+      header = generate_header + ",v1=bad_signature"
+      message_verifier = Flipper::Cloud::MessageVerifier.new(secret: secret)
+      expect(message_verifier.verify(payload, header, tolerance: 10)).to be(true)
+    end
+
+    it "returns true when the header contains a valid signature and the timestamp is off but no tolerance is provided" do
+      header = generate_header(timestamp: Time.at(12_345))
+      message_verifier = Flipper::Cloud::MessageVerifier.new(secret: secret)
+      expect(message_verifier.verify(payload, header)).to be(true)
+    end
+  end
+
+  private
+
+  def generate_header(options = {})
+    options[:secret] ||= secret
+    options[:version] ||= "v1"
+
+    message_verifier = Flipper::Cloud::MessageVerifier.new(secret: options[:secret], version: options[:version])
+
+    options[:timestamp] ||= timestamp
+    options[:payload] ||= payload
+    options[:signature] ||= message_verifier.generate(options[:payload], options[:timestamp])
+
+    Flipper::Cloud::MessageVerifier.header(options[:signature], options[:timestamp], options[:version])
+  end
+end

data/spec/flipper/cloud/middleware_spec.rb

@@ -0,0 +1,289 @@
+require 'securerandom'
+require 'flipper/cloud'
+require 'flipper/cloud/middleware'
+require 'flipper/adapters/operation_logger'
+
+RSpec.describe Flipper::Cloud::Middleware do
+  let(:flipper) {
+    Flipper::Cloud.new(token: "regular") do |config|
+      config.local_adapter = Flipper::Adapters::OperationLogger.new(Flipper::Adapters::Memory.new)
+      config.sync_secret = "regular_tasty"
+    end
+  }
+
+  let(:env_flipper) {
+    Flipper::Cloud.new(token: "env") do |config|
+      config.local_adapter = Flipper::Adapters::OperationLogger.new(Flipper::Adapters::Memory.new)
+      config.sync_secret = "env_tasty"
+    end
+  }
+
+  let(:app) { Flipper::Cloud.app(flipper) }
+  let(:response_body) { JSON.generate({features: {}}) }
+  let(:request_body) {
+    JSON.generate({
+      "environment_id" => 1,
+      "webhook_id" => 1,
+      "delivery_id" => SecureRandom.uuid,
+      "action" => "sync",
+    })
+  }
+  let(:timestamp) { Time.now }
+  let(:signature) {
+    Flipper::Cloud::MessageVerifier.new(secret: flipper.sync_secret).generate(request_body, timestamp)
+  }
+  let(:signature_header_value) {
+    Flipper::Cloud::MessageVerifier.new(secret: "").header(signature, timestamp)
+  }
+
+  context 'when initializing middleware with flipper instance' do
+    let(:app) { Flipper::Cloud.app(flipper) }
+
+    it 'uses instance to sync' do
+      Flipper.register(:admins) { |*args| false }
+      Flipper.register(:staff) { |*args| false }
+      Flipper.register(:basic) { |*args| false }
+      Flipper.register(:plus) { |*args| false }
+      Flipper.register(:premium) { |*args| false }
+
+      stub = stub_request_for_token('regular')
+      env = {
+        "HTTP_FLIPPER_CLOUD_SIGNATURE" => signature_header_value,
+      }
+      post '/', request_body, env
+
+      expect(last_response.status).to eq(200)
+      expect(JSON.parse(last_response.body)).to eq({
+        "groups" => [
+          {"name" => "admins"},
+          {"name" => "staff"},
+          {"name" => "basic"},
+          {"name" => "plus"},
+          {"name" => "premium"},
+        ],
+      })
+      expect(stub).to have_been_requested
+    end
+  end
+
+  context 'when signature is invalid' do
+    let(:app) { Flipper::Cloud.app(flipper) }
+    let(:signature) {
+      Flipper::Cloud::MessageVerifier.new(secret: "nope").generate(request_body, timestamp)
+    }
+
+    it 'uses instance to sync' do
+      stub = stub_request_for_token('regular')
+      env = {
+        "HTTP_FLIPPER_CLOUD_SIGNATURE" => signature_header_value,
+      }
+      post '/', request_body, env
+
+      expect(last_response.status).to eq(400)
+      expect(stub).not_to have_been_requested
+    end
+  end
+
+  context "when flipper cloud responds with 402" do
+    let(:app) { Flipper::Cloud.app(flipper) }
+
+    it "results in 402" do
+      Flipper.register(:admins) { |*args| false }
+      Flipper.register(:staff) { |*args| false }
+      Flipper.register(:basic) { |*args| false }
+      Flipper.register(:plus) { |*args| false }
+      Flipper.register(:premium) { |*args| false }
+
+      stub = stub_request_for_token('regular', status: 402)
+      env = {
+        "HTTP_FLIPPER_CLOUD_SIGNATURE" => signature_header_value,
+      }
+      post '/', request_body, env
+
+      expect(last_response.status).to eq(402)
+      expect(last_response.headers["flipper-cloud-response-error-class"]).to eq("Flipper::Adapters::Http::Error")
+      expect(last_response.headers["flipper-cloud-response-error-message"]).to include("Failed with status: 402")
+      expect(stub).to have_been_requested
+    end
+  end
+
+  context "when flipper cloud responds with non-402 and non-2xx code" do
+    let(:app) { Flipper::Cloud.app(flipper) }
+
+    it "results in 500" do
+      Flipper.register(:admins) { |*args| false }
+      Flipper.register(:staff) { |*args| false }
+      Flipper.register(:basic) { |*args| false }
+      Flipper.register(:plus) { |*args| false }
+      Flipper.register(:premium) { |*args| false }
+
+      stub = stub_request_for_token('regular', status: 503)
+      env = {
+        "HTTP_FLIPPER_CLOUD_SIGNATURE" => signature_header_value,
+      }
+      post '/', request_body, env
+
+      expect(last_response.status).to eq(500)
+      expect(last_response.headers["flipper-cloud-response-error-class"]).to eq("Flipper::Adapters::Http::Error")
+      expect(last_response.headers["flipper-cloud-response-error-message"]).to include("Failed with status: 503")
+      expect(stub).to have_been_requested
+    end
+  end
+
+  context "when flipper cloud responds with timeout" do
+    let(:app) { Flipper::Cloud.app(flipper) }
+
+    it "results in 500" do
+      Flipper.register(:admins) { |*args| false }
+      Flipper.register(:staff) { |*args| false }
+      Flipper.register(:basic) { |*args| false }
+      Flipper.register(:plus) { |*args| false }
+      Flipper.register(:premium) { |*args| false }
+
+      stub = stub_request_for_token('regular', status: :timeout)
+      env = {
+        "HTTP_FLIPPER_CLOUD_SIGNATURE" => signature_header_value,
+      }
+      post '/', request_body, env
+
+      expect(last_response.status).to eq(500)
+      expect(last_response.headers["flipper-cloud-response-error-class"]).to eq("Net::OpenTimeout")
+      expect(last_response.headers["flipper-cloud-response-error-message"]).to eq("execution expired")
+      expect(stub).to have_been_requested
+    end
+  end
+
+  context 'when initialized with flipper instance and flipper instance in env' do
+    let(:app) { Flipper::Cloud.app(flipper) }
+    let(:signature) {
+      Flipper::Cloud::MessageVerifier.new(secret: env_flipper.sync_secret).generate(request_body, timestamp)
+    }
+
+    it 'uses env instance to sync' do
+      stub = stub_request_for_token('env')
+      env = {
+        "HTTP_FLIPPER_CLOUD_SIGNATURE" => signature_header_value,
+        'flipper' => env_flipper,
+      }
+      post '/', request_body, env
+
+      expect(last_response.status).to eq(200)
+      expect(stub).to have_been_requested
+    end
+  end
+
+  context 'when initialized without flipper instance but flipper instance in env' do
+    let(:app) { Flipper::Cloud.app }
+    let(:signature) {
+      Flipper::Cloud::MessageVerifier.new(secret: env_flipper.sync_secret).generate(request_body, timestamp)
+    }
+
+    it 'uses env instance to sync' do
+      stub = stub_request_for_token('env')
+      env = {
+        "HTTP_FLIPPER_CLOUD_SIGNATURE" => signature_header_value,
+        'flipper' => env_flipper,
+      }
+      post '/', request_body, env
+
+      expect(last_response.status).to eq(200)
+      expect(stub).to have_been_requested
+    end
+  end
+
+  context 'when initialized with env_key' do
+    let(:app) { Flipper::Cloud.app(flipper, env_key: 'flipper_cloud') }
+    let(:signature) {
+      Flipper::Cloud::MessageVerifier.new(secret: env_flipper.sync_secret).generate(request_body, timestamp)
+    }
+
+    it 'uses provided env key instead of default' do
+      stub = stub_request_for_token('env')
+      env = {
+        "HTTP_FLIPPER_CLOUD_SIGNATURE" => signature_header_value,
+        'flipper' => flipper,
+        'flipper_cloud' => env_flipper,
+      }
+      post '/', request_body, env
+
+      expect(last_response.status).to eq(200)
+      expect(stub).to have_been_requested
+    end
+  end
+
+  context 'when initializing lazily with a block' do
+    let(:app) { Flipper::Cloud.app(-> { flipper }) }
+
+    it 'works' do
+      stub = stub_request_for_token('regular')
+      env = {
+        "HTTP_FLIPPER_CLOUD_SIGNATURE" => signature_header_value,
+      }
+      post '/', request_body, env
+
+      expect(last_response.status).to eq(200)
+      expect(stub).to have_been_requested
+    end
+  end
+
+  context 'when using older /webhooks path' do
+    let(:app) { Flipper::Cloud.app(flipper) }
+
+    it 'uses instance to sync' do
+      Flipper.register(:admins) { |*args| false }
+      Flipper.register(:staff) { |*args| false }
+      Flipper.register(:basic) { |*args| false }
+      Flipper.register(:plus) { |*args| false }
+      Flipper.register(:premium) { |*args| false }
+
+      stub = stub_request_for_token('regular')
+      env = {
+        "HTTP_FLIPPER_CLOUD_SIGNATURE" => signature_header_value,
+      }
+      post '/webhooks', request_body, env
+
+      expect(last_response.status).to eq(200)
+      expect(JSON.parse(last_response.body)).to eq({
+        "groups" => [
+          {"name" => "admins"},
+          {"name" => "staff"},
+          {"name" => "basic"},
+          {"name" => "plus"},
+          {"name" => "premium"},
+        ],
+      })
+      expect(stub).to have_been_requested
+    end
+  end
+
+  describe 'Request method unsupported' do
+    it 'skips middleware' do
+      get '/'
+      expect(last_response.status).to eq(404)
+      expect(last_response.content_type).to eq("application/json")
+      expect(last_response.body).to eq("{}")
+    end
+  end
+
+  describe 'Inspecting the built Rack app' do
+    it 'returns a String' do
+      expect(Flipper::Cloud.app(flipper).inspect).to eq("Flipper::Cloud")
+    end
+  end
+
+  private
+
+  def stub_request_for_token(token, status: 200)
+    stub = stub_request(:get, "https://www.flippercloud.io/adapter/features?exclude_gate_names=true").
+      with({
+        headers: {
+          'flipper-cloud-token' => token,
+        },
+      })
+    if status == :timeout
+      stub.to_timeout
+    else
+      stub.to_return(status: status, body: response_body)
+    end
+  end
+end

data/spec/flipper/cloud/telemetry/backoff_policy_spec.rb

@@ -0,0 +1,107 @@
+require 'flipper/cloud/telemetry/backoff_policy'
+
+RSpec.describe Flipper::Cloud::Telemetry::BackoffPolicy do
+  context "#initialize" do
+    it "with no options" do
+      policy = described_class.new
+      expect(policy.min_timeout_ms).to eq(1_000)
+      expect(policy.max_timeout_ms).to eq(30_000)
+      expect(policy.multiplier).to eq(1.5)
+      expect(policy.randomization_factor).to eq(0.5)
+    end
+
+    it "with options" do
+      policy = described_class.new({
+        min_timeout_ms: 1234,
+        max_timeout_ms: 5678,
+        multiplier: 24,
+        randomization_factor: 0.4,
+      })
+      expect(policy.min_timeout_ms).to eq(1234)
+      expect(policy.max_timeout_ms).to eq(5678)
+      expect(policy.multiplier).to eq(24)
+      expect(policy.randomization_factor).to eq(0.4)
+    end
+
+    it "with min higher than max" do
+      expect {
+        described_class.new({
+          min_timeout_ms: 2,
+          max_timeout_ms: 1,
+        })
+      }.to raise_error(ArgumentError, ":min_timeout_ms (2) must be <= :max_timeout_ms (1)")
+    end
+
+    it "with invalid min_timeout_ms" do
+      expect {
+        described_class.new({
+          min_timeout_ms: -1,
+        })
+      }.to raise_error(ArgumentError, ":min_timeout_ms must be >= 0 but was -1")
+    end
+
+    it "with invalid max_timeout_ms" do
+      expect {
+        described_class.new({
+          max_timeout_ms: -1,
+        })
+      }.to raise_error(ArgumentError, ":max_timeout_ms must be >= 0 but was -1")
+    end
+
+    it "from env" do
+      ENV.update(
+        "FLIPPER_BACKOFF_MIN_TIMEOUT_MS" => "1000",
+        "FLIPPER_BACKOFF_MAX_TIMEOUT_MS" => "2000",
+        "FLIPPER_BACKOFF_MULTIPLIER" => "1.9",
+        "FLIPPER_BACKOFF_RANDOMIZATION_FACTOR" => "0.1",
+      )
+
+      policy = described_class.new
+      expect(policy.min_timeout_ms).to eq(1000)
+      expect(policy.max_timeout_ms).to eq(2000)
+      expect(policy.multiplier).to eq(1.9)
+      expect(policy.randomization_factor).to eq(0.1)
+    end
+  end
+
+  context "#next_interval" do
+    it "works" do
+      policy = described_class.new({
+        min_timeout_ms: 1_000,
+        max_timeout_ms: 10_000,
+        multiplier: 2,
+        randomization_factor: 0.5,
+      })
+
+      expect(policy.next_interval).to be_within(500).of(1000)
+      expect(policy.next_interval).to be_within(1000).of(2000)
+      expect(policy.next_interval).to be_within(2000).of(4000)
+      expect(policy.next_interval).to be_within(4000).of(8000)
+    end
+
+    it "caps maximum duration at max_timeout_secs" do
+      policy = described_class.new({
+        min_timeout_ms: 1_000,
+        max_timeout_ms: 10_000,
+        multiplier: 2,
+        randomization_factor: 0.5,
+      })
+      10.times { policy.next_interval }
+      expect(policy.next_interval).to eq(10_000)
+    end
+  end
+
+  it "can reset" do
+    policy = described_class.new({
+      min_timeout_ms: 1_000,
+      max_timeout_ms: 10_000,
+      multiplier: 2,
+      randomization_factor: 0.5,
+    })
+    10.times { policy.next_interval }
+
+    expect(policy.attempts).to eq(10)
+    policy.reset
+    expect(policy.attempts).to eq(0)
+  end
+end

data/spec/flipper/cloud/telemetry/metric_spec.rb

@@ -0,0 +1,87 @@
+require 'flipper/cloud/telemetry/metric'
+
+RSpec.describe Flipper::Cloud::Telemetry::Metric do
+  it 'has key, result and time' do
+    metric = described_class.new(:search, true, 1696793160)
+    expect(metric.key).to eq(:search)
+    expect(metric.result).to eq(true)
+    expect(metric.time).to eq(1696793160)
+  end
+
+  it "clamps time to minute" do
+    metric = described_class.new(:search, true, 1696793204)
+    expect(metric.time).to eq(1696793160)
+  end
+
+  describe "#eql?" do
+    it "returns true when key, time and result are the same" do
+      metric = described_class.new(:search, true, 1696793204)
+      other = described_class.new(:search, true, 1696793204)
+      expect(metric.eql?(other)).to be(true)
+    end
+
+    it "returns false for other class" do
+      metric = described_class.new(:search, true, 1696793204)
+      other = Object.new
+      expect(metric.eql?(other)).to be(false)
+    end
+
+    it "returns false for sub class" do
+      metric = described_class.new(:search, true, 1696793204)
+      other = Class.new(described_class).new(:search, true, 1696793204)
+      expect(metric.eql?(other)).to be(false)
+    end
+
+    it "returns false if key is different" do
+      metric = described_class.new(:search, true, 1696793204)
+      other = described_class.new(:other, true, 1696793204)
+      expect(metric.eql?(other)).to be(false)
+    end
+
+    it "returns false if time is different" do
+      metric = described_class.new(:search, true, 1696793204)
+      other = described_class.new(:search, true, 1696793204 - 60 - 60)
+      expect(metric.eql?(other)).to be(false)
+    end
+
+    it "returns true with different times if times are in same minute" do
+      metric = described_class.new(:search, true, 1696793204)
+      other = described_class.new(:search, true, 1696793206)
+      expect(metric.eql?(other)).to be(true)
+    end
+
+    it "returns false if result is different" do
+      metric = described_class.new(:search, true, 1696793204)
+      other = described_class.new(:search, false, 1696793204)
+      expect(metric.eql?(other)).to be(false)
+    end
+  end
+
+  describe "#hash" do
+    it "returns hash based on class, key, time and result" do
+      metric = described_class.new(:search, true, 1696793204)
+      expect(metric.hash).to eq([described_class, metric.key, metric.time, metric.result].hash)
+    end
+  end
+
+  describe "#as_json" do
+    it "returns key time and result" do
+      metric = described_class.new(:search, true, 1696793160)
+      expect(metric.as_json).to eq({
+        "key" => "search",
+        "result" => true,
+        "time" => 1696793160,
+      })
+    end
+
+    it "can include other hashes" do
+      metric = described_class.new(:search, true, 1696793160)
+      expect(metric.as_json(with: {"value" => 2})).to eq({
+        "key" => "search",
+        "result" => true,
+        "time" => 1696793160,
+        "value" => 2,
+      })
+    end
+  end
+end

data/spec/flipper/cloud/telemetry/metric_storage_spec.rb

@@ -0,0 +1,58 @@
+require 'flipper/cloud/telemetry/metric_storage'
+require 'flipper/cloud/telemetry/metric'
+
+RSpec.describe Flipper::Cloud::Telemetry::MetricStorage do
+  describe "#increment" do
+    it "increments the counter for the metric" do
+      metric_storage = described_class.new
+      storage = metric_storage.instance_variable_get(:@storage)
+      metric = Flipper::Cloud::Telemetry::Metric.new(:search, true, 1696793160)
+      other = Flipper::Cloud::Telemetry::Metric.new(:search, false, 1696793160)
+
+      metric_storage.increment(metric)
+      expect(storage[metric].value).to be(1)
+
+      5.times { metric_storage.increment(metric) }
+      expect(storage[metric].value).to be(6)
+
+      metric_storage.increment(other)
+      expect(storage[other].value).to be(1)
+    end
+  end
+
+  describe "#drain" do
+    it "returns clears metrics and return hash" do
+      metric_storage = described_class.new
+      storage = metric_storage.instance_variable_get(:@storage)
+      storage[Flipper::Cloud::Telemetry::Metric.new(:search, true, 1696793160)] = Concurrent::AtomicFixnum.new(10)
+      storage[Flipper::Cloud::Telemetry::Metric.new(:search, false, 1696793161)] = Concurrent::AtomicFixnum.new(15)
+      storage[Flipper::Cloud::Telemetry::Metric.new(:plausible, true, 1696793162)] = Concurrent::AtomicFixnum.new(25)
+      storage[Flipper::Cloud::Telemetry::Metric.new(:administrator, true, 1696793164)] = Concurrent::AtomicFixnum.new(1)
+      storage[Flipper::Cloud::Telemetry::Metric.new(:administrator, false, 1696793164)] = Concurrent::AtomicFixnum.new(24)
+
+      drained = metric_storage.drain
+      expect(drained).to be_frozen
+      expect(drained).to eq({
+        Flipper::Cloud::Telemetry::Metric.new(:search, true, 1696793160) => 10,
+        Flipper::Cloud::Telemetry::Metric.new(:search, false, 1696793161) => 15,
+        Flipper::Cloud::Telemetry::Metric.new(:plausible, true, 1696793162) => 25,
+        Flipper::Cloud::Telemetry::Metric.new(:administrator, true, 1696793164) => 1,
+        Flipper::Cloud::Telemetry::Metric.new(:administrator, false, 1696793164) => 24,
+      })
+      expect(storage.keys).to eq([])
+    end
+  end
+
+  describe "#empty?" do
+    it "returns true if empty" do
+      metric_storage = described_class.new
+      expect(metric_storage).to be_empty
+    end
+
+    it "returns false if not empty" do
+      metric_storage = described_class.new
+      metric_storage.increment Flipper::Cloud::Telemetry::Metric.new(:search, true, 1696793160)
+      expect(metric_storage).not_to be_empty
+    end
+  end
+end