feat: add admin flag bypass by epipav · Pull Request #2312 · linuxfoundation/insights

epipav · 2026-09-25T15:31:16Z

LFIDs individually targeted with true on a LaunchDarkly boolean flag skip member-tiers and get the admin x-org-id and x-tier.

The Worker fetches the flag's server-side config from LD_FLAG_URL with LD_SDK_KEY and reads individual targets only; rules and segments are ignored, and a flag that is off yields no admins.
The list is reused for 60 seconds. A LaunchDarkly failure keeps the last list, or falls back to member-tiers.
Admin values are provisional (lfx-admin / admin) until the API's tier collapse defines an admin pool.

Stacked on #2311.

main
- feat: add api gateway worker #2310
  - feat: call member-tiers via m2m #2311
    - feat: add admin flag bypass 👈

cursor · 2026-09-25T15:31:29Z

PR Summary

High Risk
Changes who receives admin org/tier headers on the API gateway entitlement path; mis-targeting or stale cached admin lists could grant elevated access until refresh.

Overview
Adds a LaunchDarkly-driven admin bypass on entitlement cache misses: after PAT→JWT exchange, LFIDs individually targeted with boolean true on the flag at LD_FLAG_URL receive fixed x-org-id / x-tier (lfx-admin / admin) and skip the member-tiers lookup; everyone else still uses pickOrgTier as before.

New flags.ts loads server-side flag JSON with LD_SDK_KEY, derives usernames only from targets and user contextTargets (rules/segments ignored; flag off ⇒ no admins), caches the list for 60s, and on fetch errors retains the previous list or returns empty so resolution falls back to member-tiers. Worker Env, .dev.vars.example, and README document LD_SDK_KEY and LD_FLAG_URL; fetchAdminUsernames is injectable via Deps for tests.

^{Reviewed by Cursor Bugbot for commit eda1b1f. Bugbot is set up for automated code reviews on this repo. Configure here.}

Copilot

Copilot review overview

🟡 Changes recommended

Concurrent cache refreshes can cause periodic LaunchDarkly request stampedes.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Deduplicate concurrent LaunchDarkly refresh requests · New

What changed in this PR

Adds a LaunchDarkly-controlled admin bypass to the API gateway’s entitlement resolution.

Changes:

Parses individually targeted admin LFIDs and caches them for 60 seconds.
Applies provisional admin organization and tier headers.
Adds environment configuration, documentation, and tests.

File	Description
`.dev.vars.example`	Adds LaunchDarkly variables.
`README.md`	Documents admin bypass behavior.
`src/env.ts`	Types LaunchDarkly configuration.
`src/flags.ts`	Fetches, parses, and caches admin targets.
`src/index.ts`	Integrates admin entitlement resolution.
`tests/flags.test.ts`	Tests flag parsing and caching.
`tests/gateway.test.ts`	Tests admin header forwarding.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Copilot review overview

🟡 Changes recommended

Admin authorization currently relies on the noncanonical username claim rather than the immutable JWT subject.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Match admin authorization targets against immutable JWT subject · New

Resolved since last review (1)

Deduplicate concurrent LaunchDarkly refresh requests

Copilot

Copilot review overview

🟡 Changes recommended

The LaunchDarkly request and response handling do not match its polling API, preventing the admin list from loading.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Use supported SDK polling payload instead of per-flag admin endpoint · New

Resolved since last review (1)

Match admin authorization targets against immutable JWT subject

gaspergrom

One question on the flag fetch before this merges, left inline.

gaspergrom · 2026-09-25T19:36:51Z

+  try {
+    const response = await fetch(env.LD_FLAG_URL, { headers: { authorization: env.LD_SDK_KEY } });
+    if (!response.ok) throw new Error(`LaunchDarkly flag request failed: ${response.status}`);
+    cached = { usernames: targetedUsernames(await response.json()), fetchedAt: Date.now() };


How does LD_FLAG_URL map to a real LaunchDarkly endpoint? SDK-key polling normally returns the whole environment's flags and segments, not one flag's on/variations/targets shape. If LD_FLAG_URL points there, flag.on stays undefined and the feature excludes every admin with no error. Does a proxy sit in front of LD and return just this flag, or should this pull the flag by key from the polling response first?

LD_FLAG_URL is the per-flag polling path /sdk/latest-flags/insights-public-api, which returns that one flag config (older server SDKs fetch by key this way). tests use that path now in e3dfc40, will confirm against the real env once the SDK key is set

Copilot

Copilot review overview

🟡 Changes recommended

The previously identified LaunchDarkly polling endpoint mismatch remains unresolved and prevents the configured flag from being parsed correctly.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: None

Resolved since last review (1)

Use supported SDK polling payload instead of per-flag admin endpoint

Signed-off-by: anilb <epipav@gmail.com>

Copilot

Copilot review overview

🟡 Changes recommended

The LaunchDarkly request needs a timeout so stalled lookups cannot block entitlement-cache misses.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Add timeout to optional LaunchDarkly lookup · New

+export async function fetchAdminUsernames(env: Env): Promise<string[]> {
+  if (cached && Date.now() - cached.fetchedAt < REFRESH_MS) return cached.usernames;
+  try {
+    const response = await fetch(env.LD_FLAG_URL, { headers: { authorization: env.LD_SDK_KEY } });


gaspergrom

Approving, thanks for the fixes.

Copilot AI balanced review requested due to automatic review settings September 25, 2026 15:31

epipav mentioned this pull request Sep 25, 2026

feat: add api gateway worker #2310

Open

github-actions Bot mentioned this pull request Sep 25, 2026

feat: call member-tiers via m2m #2311

Open

Copilot started reviewing on behalf of epipav September 25, 2026 15:31 View session

Copilot AI reviewed Sep 25, 2026

View reviewed changes

Comment thread workers/api-gateway/src/flags.ts

epipav force-pushed the feat/api-gateway-admin-flag branch from 5d6007d to 0b6ad41 Compare September 25, 2026 16:37

Copilot AI review requested due to automatic review settings September 25, 2026 16:37

Copilot started reviewing on behalf of epipav September 25, 2026 16:38 View session

Copilot AI reviewed Sep 25, 2026

View reviewed changes

Comment thread workers/api-gateway/src/index.ts Outdated

Copilot AI review requested due to automatic review settings September 25, 2026 16:46

epipav force-pushed the feat/api-gateway-admin-flag branch from 0b6ad41 to 0fc6699 Compare September 25, 2026 16:46

Copilot started reviewing on behalf of epipav September 25, 2026 16:46 View session

Copilot AI reviewed Sep 25, 2026

View reviewed changes

Comment thread workers/api-gateway/src/flags.ts

epipav requested a review from gaspergrom September 25, 2026 18:56

epipav assigned themarolt Sep 25, 2026

epipav added this pull request to stack #2313 September 25, 2026 18:56

epipav assigned epipav and themarolt and unassigned themarolt Sep 25, 2026

gaspergrom requested changes Sep 25, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 25, 2026 19:43

epipav force-pushed the feat/api-gateway-admin-flag branch from 0fc6699 to e3dfc40 Compare September 25, 2026 19:43

Copilot started reviewing on behalf of epipav September 25, 2026 19:44 View session

epipav requested a review from gaspergrom September 25, 2026 19:44

Copilot AI reviewed Sep 25, 2026

View reviewed changes

feat: add admin flag bypass

35b3f5b

Signed-off-by: anilb <epipav@gmail.com>

test: use real flag path

eda1b1f

Signed-off-by: anilb <epipav@gmail.com>

Copilot AI review requested due to automatic review settings September 25, 2026 19:52

epipav force-pushed the feat/api-gateway-admin-flag branch from e3dfc40 to eda1b1f Compare September 25, 2026 19:52

Copilot started reviewing on behalf of epipav September 25, 2026 19:53 View session

Copilot AI reviewed Sep 25, 2026

View reviewed changes

gaspergrom approved these changes Sep 25, 2026

View reviewed changes

epipav unassigned themarolt Sep 25, 2026

Navigation Menu

feat: add admin flag bypass - #2312

feat: add admin flag bypass#2312
epipav wants to merge 2 commits into
feat/api-gateway-member-tiersfrom
feat/api-gateway-admin-flag

epipav commented Sep 25, 2026 •

edited by github-actions Bot

Loading

Uh oh!

cursor Bot commented Sep 25, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

gaspergrom left a comment

Uh oh!

gaspergrom Sep 25, 2026

Uh oh!

epipav Sep 25, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

gaspergrom left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

epipav commented Sep 25, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

gaspergrom left a comment

Choose a reason for hiding this comment

Uh oh!

gaspergrom Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

epipav Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

gaspergrom left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

epipav commented Sep 25, 2026 •

edited by github-actions Bot

Loading

cursor Bot commented Sep 25, 2026 •

edited

Loading