Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: default session id in frontend api #5083

Merged
merged 3 commits into from
Oct 18, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions src/lib/services/proxy-service.ts
Original file line number Diff line number Diff line change
Expand Up @@ -74,12 +74,19 @@ export class ProxyService {
const client = await this.clientForProxyToken(token);
const definitions = client.getFeatureToggleDefinitions() || [];

const sessionId = context.sessionId || String(Math.random());

Check failure

Code scanning / CodeQL

Insecure randomness High

This uses a cryptographically insecure random number generated at
Math.random()
in a security context.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we're not doing cryptography here


return definitions
.filter((feature) => client.isEnabled(feature.name, context))
.filter((feature) =>
client.isEnabled(feature.name, { ...context, sessionId }),
)
.map((feature) => ({
name: feature.name,
enabled: Boolean(feature.enabled),
variant: client.forceGetVariant(feature.name, context),
variant: client.getVariant(feature.name, {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we don't have to use forceGetVariant anymore. Since we have sessionId we don't have to care how getVariant is implemented locally.

...context,
sessionId,
}),
impressionData: Boolean(feature.impressionData),
}));
}
Expand Down
40 changes: 40 additions & 0 deletions src/test/e2e/api/proxy/proxy.e2e.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -1236,3 +1236,43 @@ test('should return 204 if metrics are disabled', async () => {
})
.expect(204);
});

test('should resolve variable rollout percentage consistently', async () => {
const frontendToken = await createApiToken(ApiTokenType.FRONTEND);
await createFeatureToggle({
name: 'randomFeature',
enabled: true,
strategies: [
{
name: 'flexibleRollout',
constraints: [],
parameters: {
rollout: '50',
stickiness: 'default',
groupId: 'some-new',
},
variants: [
{
name: 'a',
stickiness: 'default',
weightType: 'variable',
weight: 1000,
},
],
},
],
});

for (let i = 0; i < 10; ++i) {
const { body } = await app.request
.get('/api/frontend')
.set('Authorization', frontendToken.secret)
.expect('Content-Type', /json/)
.expect(200);

if (body.toggles.length > 0) {
// disabled variant should not be possible for enabled toggles
expect(body.toggles[0].variant.name).toBe('a');
}
}
});