Feature Flags -- IN does not appear to work

[gwlester]

We were attempting to enable a feature if a user was in a given group?
Configuration:

{
  "unhidden": {
    "default": false,
    "rules": {
      "Allow Admins": {
        "when_match": true,
        "conditions": [
          {
            "action": "IN",
            "key": "enterpriseGroups",
            "value": "Ent_Agents"
          }
        ]
      }
    }
  },
  "hidden": {
    "default": false
  }
}

Context:

{
   "username":"NRavuru@msaqa.local",
   "enterpriseGroups":[
      "Ent_Agents Only-Admin",
      "Ent_Scout-SSO",
      "Ent_Agents",
      "ENT_Nuxeo_SSO_Dev",
      "Ent_PropView-SSO",
      "Ent_Bonds-SSO",
      "Ent_PMTAgentDashboard-PaymentROTP",
      "Ent_Agents-Independent",
      "Ent_E1PQADashboard-SSO",
      "Ent_Nuxeo-SSO-Preprod-General",
      "ENT_FusionPC-MSA-Producer-CSR-Preprod"
   ],
   "agencyOnlyGroups":[
      "SuperAdmin"
   ],
   "locationCodes":["180032","280473","320074",]
}

all_features: list[str] = feature_flags.get_enabled_features(context=context)

Expected Behavior

We expected the variable all_features to be a list with one element as follows:

• unhidden

Current Behavior

all_features is an empty list.

Possible Solution

Steps to Reproduce (for bugs)

1. see details above.

Environment

• Powertools version used: 1.20.2
• Packaging format (Layers, PyPi): Layers
• AWS Lambda function runtime: 3.8
• Debugging logs

How to enable debug mode**

# paste logs here

[heitorlessa]

Hey @gwlester thanks for flagging it! That's odd, we basically call __contains__ as part of the IN rule action

Could you try running this locally with debug mode enabled and paste logs here?

cc @risenberg-cyberark in case you ran into this.

PS: Our test for this can be quickly updated to try and reproduce it.

[gwlester]

@heitorlessa , @risenberg-cyberark
I finally looked at the test cases and I see what is wrong. The current code is expecting the key to contain a single value in the context object and the value to be a list that is checked to see if the key's value is in it.

That is totally the opposite of what I expected and was attempting to do -- I was giving value as a single value and attempting to see if it was in the list given by key in the context object.

So, how do ya'll want me to handle this -- a feature request for a different condition -- if so any suggestion on what to call it instead of IN and NOT_IN???? I'm thinking IN_KEY and NOT_IN_KEY.

[gwlester]

Since I can't push up to a new branch to create a Push Request (or need instruction on how to do so), here is some suggested fixes:

In schema.py, change the definition of RuleAction to:

class RuleAction(str, Enum):
    EQUALS = "EQUALS"
    STARTSWITH = "STARTSWITH"
    ENDSWITH = "ENDSWITH"
    IN = "IN"
    NOT_IN = "NOT_IN"
    KEY_IN_VALUE = "KEY_IN_VALUE"
    KEY_NOT_IN_VALUE = "KEY_NOT_IN_VALUE"
    VALUE_IN_KEY = "VALUE_IN_KEY"
    VALUE_NOT_IN_KEY = "VALUE_NOT_IN_KEY"

In feature_flags.py, change the definition of mapping_by_action in _match_by_action to:

        mapping_by_action = {
            schema.RuleAction.EQUALS.value: lambda a, b: a == b,
            schema.RuleAction.STARTSWITH.value: lambda a, b: a.startswith(b),
            schema.RuleAction.ENDSWITH.value: lambda a, b: a.endswith(b),
            schema.RuleAction.IN.value: lambda a, b: a in b,
            schema.RuleAction.NOT_IN.value: lambda a, b: a not in b,
            schema.RuleAction.KEY_IN_VALUE.value: lambda a, b: a in b,
            schema.RuleAction.KEY_NOT_IN_VALUE.value: lambda a, b: a not in b,
            schema.RuleAction.VALUE_IN_KEY.value: lambda a, b: b in a,
            schema.RuleAction.VALUE_NOT_IN_KEY.value: lambda a, b: b not in a,
        }

[gwlester]

Actually, for clarity sake, I'd suggest the following conditions:

• KEY_IN_VALUE (this is the current IN, which I guess should be kept)
• KEY_NOT_IN_VALUE (this is the current NOT_IN, which I guess should be kept)
• VALUE_IN_KEY
• VALUE_NOT_IN_KEY

[ran-isenberg]

It used to be contains but some people found it confusing so it was renamed so IN, and yes, the value is supposed to be a list.
I think having all 4 actions are a bit confusing.

[heitorlessa]

Now available as part of 1.21.0 - thank you so much for the fix

https://github.com/awslabs/aws-lambda-powertools-python/releases/tag/v1.21.0