refactor: introduce EnvironmentIndex to make the served environment set runtime-mutable - #17
refactor: introduce EnvironmentIndex to make the served environment set runtime-mutable#17gagantrivedi wants to merge 20 commits into
Conversation
Environments are now held in an EnvironmentRegistry that indexes each record under its client key and every server key, replacing the immutable key_mapping/server_to_client maps built at startup. Records carry an EnvSource so statically configured environments can never be evicted by future inventory reconciliation. Adds EnvironmentsCache::remove_environment and EnvironmentService::evict_environment so an environment can be forgotten at runtime, including the endpoint caches that are consulted before the key gate. Splits fetch_environment into a server-key picker and a reusable fetch_document(server_key, if_modified_since). No behaviour change for existing configs; the poll-failure log now prints the client key instead of the server-side secret.
An omitted field now behaves like an explicitly empty list (which was already accepted), so a future discovery-only config needs no static pairs. Statically configured pairs keep working exactly as before.
main() now only loads settings and logging before delegating, so an alternative binary can compose the proxy from the library crate.
The exhaustive literal broke compilation whenever AppSettings gained a field; the other test files already spread from default().
The type is the domain concept of which environments the proxy serves, not a service, so it moves out of services/ to src/environments.rs beside cache/ — matching how comparable Rust proxies place such state (e.g. unleash-edge's feature_cache). Drops the services re-export: EnvironmentService is its only consumer.
Names the content: the key set of one environment (client key, server keys, provenance). Also unabbreviates EnvSource to EnvironmentSource and renames records() to snapshot() so no 'record' vocabulary is left.
Nothing reads it: an environment's provenance only matters to the reconciliation that later phases introduce, and staticness is derivable there from the immutable environment_key_pairs settings. Reintroduce an explicit field if that derivation proves awkward.
Evict implies cache-pressure expulsion; this is a deliberate removal from the served set, and the cache trait already calls its half remove_environment, so the whole family now shares the verb.
A config that lists the same server key for two environments is a misconfiguration we choose not to defend against; removal now just drops the entry's keys unconditionally.
Endpoint-cache lookups run before the key gate, so an in-flight request that passed the gate could write its result after remove_environment's clears and have it served indefinitely; the poll loop, iterating a pre-removal snapshot, could likewise re-insert a removed environment's document and pin it until restart. Every cache write now re-checks the index afterwards and clears what it wrote if the key no longer resolves — remove_environment un-indexes before clearing, so one of the two clears always runs last. Removal also clears caches even when the key is unknown, so repeating it cleans any residue. The interleavings themselves aren't deterministically testable without injection points; the tests pin each guard's behaviour instead.
Mirrors HashMap::insert and makes insert symmetric with remove: when a later phase rotates keys via insert, the caller needs the dropped server keys to invalidate request caches, which are keyed by presented key and consulted before the key gate.
The duplicated-server-key failure shape, the /health-stays-red state a key-less environment creates, and the actual reason run() lives in the library were all design decisions living only in review threads.
A typo'd environment_key_pairs field name silently parses as an empty
set (serde ignores unknown fields), leaving a healthy-looking proxy
that rejects everything. Also pins the serde default with a test that
{} parses to an empty, valid config.
Nothing besides main.rs ever called it; the composition-binary story it served is speculative, and it can return the day something real needs it. The empty-config warning moves with the body.
The endpoint response cache is deprecated and disabled by default; without it every request passes the key gate, so a cache write racing a removal is not servable residue worth guarding against. The poll re-insertion guard on the main environments cache stays — that cache is load-bearing.
gagantrivedi
changed the title
|
@CodeRabbit review |
✅ Action performedReview finished.
|
📝 WalkthroughWalkthroughThe proxy now uses Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: 🟠 High · up to The runtime-mutable environment index can currently mishandle colliding keys and can briefly serve data fetched for a replaced environment. These are concrete correctness risks that could expose the wrong environment’s flags or identities, so the PR is not merge-ready until collision handling and replacement validation are fixed. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 7f797395-a335-4f14-b32b-be624b0136a6
📒 Files selected for processing (8)
src/cache/environment.rssrc/config/settings.rssrc/environments.rssrc/lib.rssrc/main.rssrc/services/environment.rstests/test_lru_cache.rstests/test_remove_environment.rs
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.
| for server_key in &keys.server_keys { | ||
| by_key.insert(server_key.key.clone(), Arc::clone(&keys)); | ||
| } | ||
| by_key.insert(keys.client_key.clone(), keys); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
Reject key collisions before modifying by_key.
EnvironmentKeyPair permits duplicate server keys and client keys that match another indexed key. Line 104 overwrites the existing owner. A later removal of the original environment removes that shared entry, even when it now belongs to the replacement environment.
Require every client key and server key to be unique across the index. Reject an update atomically when it conflicts with another environment.
| /// The poll-loop counterpart: the loop iterates a snapshot, so a | ||
| /// removal completing mid-fetch would have its environment's data | ||
| /// re-inserted by put_environment and pinned until restart. | ||
| async fn discard_environment_if_removed(&self, keys: &EnvironmentKeys) { | ||
| if self.environments.resolve(&keys.client_key).is_none() { | ||
| self.cache.remove_environment(&keys.client_key).await; | ||
| self.clear_endpoint_caches(keys).await; | ||
| } |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Reject a poll result when the indexed environment was replaced.
Line 115 checks only that client_key still resolves. If EnvironmentIndex::insert replaces an environment with the same client key during fetch_environment, the old snapshot writes its document at line 68 and this check succeeds. The proxy can then serve data fetched with the replaced server key.
Use the snapshot Arc<EnvironmentKeys> as a generation token. Keep the result only when the current resolved entry is the same instance. Add a concurrent replacement test for this case.
2 participants
Thanks for submitting a PR! Please check the boxes below:
docs/if required so people know about the feature.Changes
Contributes to Flagsmith/edge-proxy#128
Groundwork for environment auto-discovery: the served environment set becomes runtime-mutable. No behaviour change — static
environment_key_pairsconfigs work exactly as today; discovery itself is a follow-up PR.EnvironmentIndex(src/environments.rs) replaces the startup-built key maps. Each environment is indexed under its client key and every server key;insert/removereturn the replaced/removed entry so callers can invalidate caches.resolve_key()replaces the three unknown-key gates (ser.keys still 503 on/flags//identitiesas today — fixed in a follow-up).remove_environmentstops serving an environment and clears everything cached for it; the poll loop re-checks the index after each write so a removal completing mid-fetch can't pin stale data.environment_key_pairsis now optional; a startup warning fires when nothing is configured.ser.secret.Accepted, deliberately: duplicated server keys are last-one-wins, and endpoint-response-cache residue on a racing removal is not guarded against (that cache is deprecated and disabled by default).
How did you test this code?
cargo test: 63 green, including index unit tests andtests/test_remove_environment.rs(removed environments are rejected, not served from primed caches, for both key kinds). No existing test expectations changed. Clippy and fmt clean.