refactor: introduce EnvironmentIndex to make the served environment set runtime-mutable - #17
Open
gagantrivedi wants to merge 20 commits into
Open
refactor: introduce EnvironmentIndex to make the served environment set runtime-mutable#17gagantrivedi wants to merge 20 commits into
gagantrivedi wants to merge 20 commits into
Conversation
Environments are now held in an EnvironmentRegistry that indexes each record under its client key and every server key, replacing the immutable key_mapping/server_to_client maps built at startup. Records carry an EnvSource so statically configured environments can never be evicted by future inventory reconciliation. Adds EnvironmentsCache::remove_environment and EnvironmentService::evict_environment so an environment can be forgotten at runtime, including the endpoint caches that are consulted before the key gate. Splits fetch_environment into a server-key picker and a reusable fetch_document(server_key, if_modified_since). No behaviour change for existing configs; the poll-failure log now prints the client key instead of the server-side secret.
An omitted field now behaves like an explicitly empty list (which was already accepted), so a future discovery-only config needs no static pairs. Statically configured pairs keep working exactly as before.
main() now only loads settings and logging before delegating, so an alternative binary can compose the proxy from the library crate.
The exhaustive literal broke compilation whenever AppSettings gained a field; the other test files already spread from default().
The type is the domain concept of which environments the proxy serves, not a service, so it moves out of services/ to src/environments.rs beside cache/ — matching how comparable Rust proxies place such state (e.g. unleash-edge's feature_cache). Drops the services re-export: EnvironmentService is its only consumer.
Names the content: the key set of one environment (client key, server keys, provenance). Also unabbreviates EnvSource to EnvironmentSource and renames records() to snapshot() so no 'record' vocabulary is left.
Nothing reads it: an environment's provenance only matters to the reconciliation that later phases introduce, and staticness is derivable there from the immutable environment_key_pairs settings. Reintroduce an explicit field if that derivation proves awkward.
Evict implies cache-pressure expulsion; this is a deliberate removal from the served set, and the cache trait already calls its half remove_environment, so the whole family now shares the verb.
A config that lists the same server key for two environments is a misconfiguration we choose not to defend against; removal now just drops the entry's keys unconditionally.
Endpoint-cache lookups run before the key gate, so an in-flight request that passed the gate could write its result after remove_environment's clears and have it served indefinitely; the poll loop, iterating a pre-removal snapshot, could likewise re-insert a removed environment's document and pin it until restart. Every cache write now re-checks the index afterwards and clears what it wrote if the key no longer resolves — remove_environment un-indexes before clearing, so one of the two clears always runs last. Removal also clears caches even when the key is unknown, so repeating it cleans any residue. The interleavings themselves aren't deterministically testable without injection points; the tests pin each guard's behaviour instead.
Mirrors HashMap::insert and makes insert symmetric with remove: when a later phase rotates keys via insert, the caller needs the dropped server keys to invalidate request caches, which are keyed by presented key and consulted before the key gate.
The duplicated-server-key failure shape, the /health-stays-red state a key-less environment creates, and the actual reason run() lives in the library were all design decisions living only in review threads.
A typo'd environment_key_pairs field name silently parses as an empty
set (serde ignores unknown fields), leaving a healthy-looking proxy
that rejects everything. Also pins the serde default with a test that
{} parses to an empty, valid config.
Nothing besides main.rs ever called it; the composition-binary story it served is speculative, and it can return the day something real needs it. The empty-config warning moves with the body.
The endpoint response cache is deprecated and disabled by default; without it every request passes the key gate, so a cache write racing a removal is not servable residue worth guarding against. The poll re-insertion guard on the main environments cache stays — that cache is load-bearing.
gagantrivedi
changed the title
gagantrivedi
marked this pull request as ready for review
August 22, 2026 09:56
4 tasks
|
@CodeRabbit review |
✅ Action performedReview finished.
|
📝 WalkthroughWalkthroughThe proxy now uses Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: 🟠 High · up to The runtime-mutable environment index can currently mishandle colliding keys and can briefly serve data fetched for a replaced environment. These are concrete correctness risks that could expose the wrong environment’s flags or identities, so the PR is not merge-ready until collision handling and replacement validation are fixed. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 7f797395-a335-4f14-b32b-be624b0136a6
📒 Files selected for processing (8)
src/cache/environment.rssrc/config/settings.rssrc/environments.rssrc/lib.rssrc/main.rssrc/services/environment.rstests/test_lru_cache.rstests/test_remove_environment.rs
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.
Open
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Thanks for submitting a PR! Please check the boxes below:
docs/if required so people know about the feature.Changes
Contributes to Flagsmith/edge-proxy#128
Groundwork for environment auto-discovery: the served environment set becomes runtime-mutable. No behaviour change — static
environment_key_pairsconfigs work exactly as today; discovery itself is a follow-up PR.EnvironmentIndex(src/environments.rs) replaces the startup-built key maps. Each environment is indexed under its client key and every server key;insert/removereturn the replaced/removed entry so callers can invalidate caches.resolve_key()replaces the three unknown-key gates (ser.keys still 503 on/flags//identitiesas today — fixed in a follow-up).remove_environmentstops serving an environment and clears everything cached for it; the poll loop re-checks the index after each write so a removal completing mid-fetch can't pin stale data.environment_key_pairsis now optional; a startup warning fires when nothing is configured.ser.secret.Accepted, deliberately: duplicated server keys are last-one-wins, and endpoint-response-cache residue on a racing removal is not guarded against (that cache is deprecated and disabled by default).
How did you test this code?
cargo test: 63 green, including index unit tests andtests/test_remove_environment.rs(removed environments are rejected, not served from primed caches, for both key kinds). No existing test expectations changed. Clippy and fmt clean.