posthog-ruby 3.27.1 → 3.28.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 125a7a9c4063477324ed9654c1035ff28e959cb6c389dfbcfc5ee08bb17153ab
-  data.tar.gz: b02e50631f58cb0e119184c1556766c55ee0e1ae578514620b6217a916207b7e
+  metadata.gz: 8c845018be0215ef9e7b28c605f4ed856815d4eb63076c2b76aa307a04fa5a47
+  data.tar.gz: 9e0779372eea8be6e073c3d200159f7f1ac31986b3390147987368935f4710f4
 SHA512:
-  metadata.gz: 1adee637ab5766731429e73e4bd41b102c9bb33fc285b75b4a62dd173a6fa0c4825ee47ff87b007d8cc8c517c8eab6103b33337b62fd4504497c2c127580c7c2
-  data.tar.gz: 82c8accf93eede6fe7c4748967377b7fa9a1ffc28f7c9ed85e6355ba81d2312962767488436af285c57e0bfc9ebcd442dd486157644b708e9dbd03ad045fd712
+  metadata.gz: 74eff3ba167884c7059a1dfed30ac4774d17bac42885096373f6949cead1bbb4d81c226ff8dd1c59361b824760c046027fa5470bf65fb416002a8c564f2b577f
+  data.tar.gz: 42b6c6c956e45ab5352c1e9f93a5210c188fa129df7c24da1ca8efec6781baa820564a1bce965fc00176c69ab25273e8873c1220c821899ee14ce210c267bee4

data/lib/posthog/feature_flags.rb

@@ -500,6 +500,21 @@ module PostHog
       end
     end
 
+    def self.parse_finite_number(value)
+      case value
+      when String
+        return unless /\A[+-]?([0-9]+(\.[0-9]*)?|\.[0-9]+)([eE][+-]?[0-9]+)?\z/.match?(value)
+      when Integer, Float
+        # JSON numbers remain supported alongside numeric strings.
+      else
+        return unless defined?(::BigDecimal) && value.is_a?(::BigDecimal)
+      end
+
+      number = value.to_f
+      number if number.finite?
+    end
+    private_class_method :parse_finite_number
+
     def self.relative_date_parse_for_feature_flag_matching(value)
       match = /^-?([0-9]+)([a-z])$/.match(value)
       parsed_dt = DateTime.now.new_offset(0)
@@ -734,20 +749,13 @@ module PostHog
       when 'not_regex'
         PostHog::Utils.is_valid_regex(value.to_s) && Regexp.new(value.to_s).match(override_value.to_s).nil?
       when 'gt', 'gte', 'lt', 'lte'
-        parsed_value = nil
-        begin
-          parsed_value = Float(value)
-        rescue StandardError # rubocop:disable Lint/SuppressedException
-        end
-        if !parsed_value.nil? && !override_value.nil?
-          if override_value.is_a?(String)
-            compare(override_value, value.to_s, operator)
-          else
-            compare(override_value, parsed_value, operator)
-          end
-        else
-          compare(override_value.to_s, value.to_s, operator)
-        end
+        parsed_value = parse_finite_number(value)
+        raise InconclusiveMatchError, 'Invalid numeric condition' if parsed_value.nil?
+
+        parsed_override = parse_finite_number(override_value)
+        return false if parsed_override.nil?
+
+        compare(parsed_override, parsed_value, operator)
       when 'is_date_before', 'is_date_after'
         override_date = PostHog::Utils.convert_to_datetime(override_value.to_s)
         parsed_date = relative_date_parse_for_feature_flag_matching(value.to_s)
@@ -1110,6 +1118,13 @@ module PostHog
                                       groups: {}, group_properties: {}, snapshot: _evaluation_snapshot)
       flag_filters = flag[:filters] || {}
 
+      # Holdouts precede release conditions: a held-out identifier is excluded from
+      # the flag's targeting entirely rather than bucketed into one of its variants.
+      # The per-condition aggregation handled below never changes holdout membership,
+      # so this uses the flag-level bucketing identity the caller resolved.
+      holdout_variant = holdout_variant_for(flag_filters[:holdout], distinct_id)
+      return holdout_variant unless holdout_variant.nil?
+
       flag_conditions = flag_filters[:groups] || []
       flag_aggregation = flag_filters[:aggregation_group_type_index]
       early_exit = flag_filters[:early_exit] == true
@@ -1233,6 +1248,36 @@ module PostHog
       (Integer(hash_key[0..14], 16).to_f / 0xfffffffffffffff)
     end
 
+    # An experiment holdout excludes an identifier from the flag's release conditions
+    # entirely, resolving it to the synthetic variant "holdout-<id>". That variant does
+    # not need to exist in `filters.multivariate.variants`. Returns nil when the flag has
+    # no usable holdout or the identifier falls outside it, leaving ordinary evaluation
+    # unchanged.
+    def holdout_variant_for(holdout, bucketing_value)
+      return nil unless holdout.is_a?(Hash)
+
+      id = holdout[:id]
+      exclusion_percentage = holdout[:exclusion_percentage]
+      return nil if id.nil? || !exclusion_percentage.is_a?(Numeric)
+
+      # The server clamps an out-of-range percentage rather than rejecting it, and treats
+      # 100 as everyone without hashing, so a full holdout can't miss on a hash boundary.
+      # Fractional percentages are kept as-is.
+      percentage = exclusion_percentage.to_f.clamp(0, 100)
+      return nil if percentage < 100 && _holdout_hash(bucketing_value) > (percentage / 100)
+
+      "holdout-#{id}"
+    end
+
+    # Holdout membership hashes `holdout-<bucketing value>` with no separator, salt, flag
+    # key or holdout id taking part, so one identity lands in the same holdout population
+    # on every flag, the way the server buckets it. The dot-separated flag hash above
+    # selects a different population and must not be reused here.
+    def _holdout_hash(bucketing_value)
+      hash_key = Digest::SHA1.hexdigest "holdout-#{bucketing_value}"
+      (Integer(hash_key[0..14], 16).to_f / 0xfffffffffffffff)
+    end
+
     def get_matching_variant(flag, distinct_id)
       hash_value = _hash(flag[:key], distinct_id, 'variant')
       matching_variant = variant_lookup_table(flag).find do |variant|

data/lib/posthog/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PostHog
-  VERSION = '3.27.1'
+  VERSION = '3.28.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: posthog-ruby
 version: !ruby/object:Gem::Version
-  version: 3.27.1
+  version: 3.28.1
 platform: ruby
 authors:
 - ''