FFL-3439: Attribute PHP flag evaluations to the application

Cargo.toml

@@ -219,6 +219,7 @@ hex = { version = "0.4", default-features = false }
 http = { version = "1.1", default-features = false }
 http-body = { version = "1", default-features = false }
 http-body-util = { version = "0.1", default-features = false }
+httpdate = { version = "1.0", default-features = false }
 # allow(workspace-deps-features): httpmock 0.8.0-alpha.1 does not compile
 # without the `cookies` feature: its own `readers.rs` calls `req.cookies()`
 # unconditionally while that method is gated behind `cookies`. Keep it as a
@@ -286,7 +287,7 @@ rmpv = { version = "1.3.0", default-features = false }
 rustc-hash = { version = "2.1.1", default-features = false }
 rustls = { version = "0.23", default-features = false }
 rustls-platform-verifier = { version = "0.6", default-features = false }
-rustls-webpki = { version = ">=0.103.13", default-features = false }
+rustls-webpki = { version = "0.103.16", default-features = false }
 schemars = { version = "0.8.21", default-features = false }
 semver = { version = "1.0", default-features = false }
 serde = { version = "1.0", default-features = false }
@@ -343,6 +344,8 @@ walkdir = { version = "2.4", default-features = false }
 wasm-bindgen-futures = { version = "0.4", default-features = false }
 wasm-bindgen-test = { version = "=0.3.50", default-features = false }
 web-time = { version = "1", default-features = false }
+webpki-root-certs = { version = "1.0.10", default-features = false }
+webpki-roots = { version = "1.0.10", default-features = false }
 windows = { version = "0.59.0", default-features = false }
 windows-sys = { version = "0.52", default-features = false }
 winver = { version = "1.0.0", default-features = false }

components-rs/crashtracker.h

@@ -407,34 +407,6 @@ bool ddog_crasht_init_windows(ddog_CharSlice module,
                               struct ddog_crasht_Metadata metadata);
 #endif
 
-#if (defined(_CRASHTRACKING_COLLECTOR) && defined(_WIN32))
-HRESULT OutOfProcessExceptionEventSignatureCallback(const void *_context,
-                                                    const WER_RUNTIME_EXCEPTION_INFORMATION *_exception_information,
-                                                    int32_t _index,
-                                                    uint16_t *_name,
-                                                    uint32_t *_name_size,
-                                                    uint16_t *_value,
-                                                    uint32_t *_value_size);
-#endif
-
-#if (defined(_CRASHTRACKING_COLLECTOR) && defined(_WIN32))
-HRESULT OutOfProcessExceptionEventDebuggerLaunchCallback(const void *_context,
-                                                         const WER_RUNTIME_EXCEPTION_INFORMATION *_exception_information,
-                                                         BOOL *_is_custom_debugger,
-                                                         uint16_t *_debugger_launch,
-                                                         uint32_t *_debugger_launch_size,
-                                                         BOOL *_is_debugger_auto_launch);
-#endif
-
-#if (defined(_CRASHTRACKING_COLLECTOR) && defined(_WIN32))
-HRESULT OutOfProcessExceptionEventCallback(const void *context,
-                                           const WER_RUNTIME_EXCEPTION_INFORMATION *exception_information,
-                                           BOOL *_ownership_claimed,
-                                           uint16_t *_event_name,
-                                           uint32_t *_size,
-                                           uint32_t *_signature_count);
-#endif
-
 /**
  * # Safety
  * The `crash_info` can be null, but if non-null it must point to a Builder made by this module,

tests/Common/FeatureFlags/flag_evaluation_wire.inc

@@ -77,7 +77,7 @@ try {
     $rows = array();
     $exposureCount = 0;
     $identity = true;
-    $evaluationIdentityAbsent = true;
+    $evaluationIdentity = true;
     $protectedBytesAbsent = true;
     foreach ($captures as $capture) {
         list($request, $headers, $payload) = $capture;
@@ -95,10 +95,15 @@ try {
             if (strpos($capture[3], 'ffe-error-pii-canary@example.test') !== false) {
                 throw new RuntimeException('raw error text reached the payload');
             }
-            // Application attribution is deferred to FFL-3438/FFL-3439.
-            $evaluationIdentityAbsent = $evaluationIdentityAbsent && $payload['context'] === array();
+            $context = $payload['context'];
+            ksort($context);
+            $evaluationIdentity = $evaluationIdentity
+                && $context === array('env' => 'test', 'service' => 'php-ffe-wire', 'version' => 'wire-version');
             foreach ($payload['flagEvaluations'] as $row) {
-                $evaluationIdentityAbsent = $evaluationIdentityAbsent && !isset($row['context']['dd']);
+                // Environment and application version belong only on the batch.
+                $evaluationIdentity = $evaluationIdentity
+                    && isset($row['context']['dd'])
+                    && $row['context']['dd'] === array('service' => 'php-ffe-wire');
                 $key = $row['flag']['key'];
                 if (isset($rows[$key])) {
                     $rows[$key]['evaluation_count'] += $row['evaluation_count'];
@@ -120,7 +125,7 @@ try {
     }
     echo 'exposure_service=php-ffe-wire', "\n";
     echo 'identity='; var_dump($identity);
-    echo 'evaluation_application_identity_absent='; var_dump($evaluationIdentityAbsent);
+    echo 'evaluation_application_identity='; var_dump($evaluationIdentity);
     echo 'exposures='; var_dump($exposureCount);
     echo 'consented_count='; var_dump($rows['consented']['evaluation_count']);
     echo 'consented_subject='; var_dump($rows['consented']['targeting_key']);

tests/OpenFeature/flag_evaluation_openfeature_wire.phpt

@@ -25,7 +25,7 @@ require __DIR__ . '/../Common/FeatureFlags/flag_evaluation_wire.inc';
 --EXPECT--
 exposure_service=php-ffe-wire
 identity=bool(true)
-evaluation_application_identity_absent=bool(true)
+evaluation_application_identity=bool(true)
 exposures=int(2)
 consented_count=int(2)
 consented_subject=string(7) "subject"

tests/api/Unit/FeatureFlags/flag_evaluation_wire.phpt

@@ -23,7 +23,7 @@ require __DIR__ . '/../../../Common/FeatureFlags/flag_evaluation_wire.inc';
 --EXPECT--
 exposure_service=php-ffe-wire
 identity=bool(true)
-evaluation_application_identity_absent=bool(true)
+evaluation_application_identity=bool(true)
 exposures=int(2)
 consented_count=int(2)
 consented_subject=string(7) "subject"

tests/ext/ffe/flag_evaluation_identity.phpt

@@ -1,5 +1,5 @@
 --TEST--
-FFE evaluations remain deliverable without application identity pending sidecar attribution
+FFE evaluations retain resolved application identity across changes before flush
 --SKIPIF--
 <?php
 if (PHP_VERSION_ID < 70200) die('skip: TEST_PHP_EXTRA_ARGS requires PHP 7.2+');
@@ -45,11 +45,20 @@ try {
             }
             if (strpos($request, '/flagevaluation ') !== false) {
                 $payload = json_decode($body, true);
-                // FFL-3438/FFL-3439 will replace these temporary expectations
-                // with identity supplied by the sidecar before aggregation.
+                $context = $payload['context'];
+                $key = implode('|', array(
+                    isset($context['service']) ? $context['service'] : '',
+                    isset($context['env']) ? $context['env'] : '',
+                    isset($context['version']) ? $context['version'] : '',
+                ));
                 foreach ($payload['flagEvaluations'] as $row) {
-                    $contexts[$row['flag']['key']] = $payload['context'] === array()
-                        && !isset($row['context']['dd']) && $row['evaluation_count'] === 1;
+                    if (isset($contexts[$key])) throw new RuntimeException('duplicate application row');
+                    $contexts[$key] = $row['flag']['key'] === 'same-flag'
+                        && isset($row['context']['dd'])
+                        && $row['context']['dd'] === array('service' => $context['service'])
+                        && $row['evaluation_count'] === 1
+                        && $row['first_evaluation'] === 1700000000123
+                        && $row['last_evaluation'] === 1700000000123;
                 }
             }
             fwrite($connection, "HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\n{}");
@@ -59,9 +68,16 @@ try {
         if (!$status['running']) { $exitCode = $status['exitcode']; break; }
     }
     if ($exitCode !== 0) throw new RuntimeException('child failed: ' . ffeTestProcessRead($pipes[2]));
-    foreach (array('default', 'configured') as $flag) {
-        echo $flag, '='; var_dump($contexts[$flag]);
+    foreach (array(
+        'flag_evaluation_identity_app.php|none|',
+        'app-a|test|v1',
+        'app-b|test|v1',
+        'app-b|production|v1',
+        'app-b|production|v2',
+    ) as $key) {
+        echo $key, '='; var_dump(isset($contexts[$key]) && $contexts[$key]);
     }
+    echo 'application_groups='; var_dump(count($contexts));
 } finally {
     if ($exitCode === null) proc_terminate($process);
     foreach ($pipes as $pipe) fclose($pipe);
@@ -70,5 +86,9 @@ try {
 }
 ?>
 --EXPECT--
-default=bool(true)
-configured=bool(true)
+flag_evaluation_identity_app.php|none|=bool(true)
+app-a|test|v1=bool(true)
+app-b|test|v1=bool(true)
+app-b|production|v1=bool(true)
+app-b|production|v2=bool(true)
+application_groups=int(5)

tests/ext/ffe/stubs/flag_evaluation_identity_app.php

@@ -1,12 +1,18 @@
 <?php
-foreach (array('default', 'configured') as $flag) {
-    if ($flag === 'configured') {
-        ini_set('datadog.service', 'changed-service');
-        ini_set('datadog.env', 'changed-env');
-        ini_set('datadog.version', 'changed-version');
+// Use the same flag and subject throughout. Only application identity may
+// separate these observations; earlier observations must not be relabelled.
+foreach (array(
+    array(),
+    array('service' => 'app-a', 'env' => 'test', 'version' => 'v1'),
+    array('service' => 'app-b'),
+    array('env' => 'production'),
+    array('version' => 'v2'),
+) as $settings) {
+    foreach ($settings as $key => $value) {
+        ini_set('datadog.' . $key, $value);
     }
     if (!\DDTrace\Internal\record_ffe_flag_evaluation(
-        $flag, 'blue', null, null, array(), null, false, false, 1700000000123
+        'same-flag', 'blue', null, null, array(), null, false, false, 1700000000123
     )) throw new RuntimeException('submission rejected');
 }
 dd_trace_synchronous_flush();

tracer/ffe.c

@@ -94,8 +94,8 @@ bool ddtrace_ffe_record_flag_evaluation(zend_string *flag_key, zend_string *vari
         .runtime_default_used = runtime_default_used,
         .observe_full_evaluation_data = observe_full_evaluation_data,
     };
-    // Sidecar application attribution is deferred to FFL-3438/FFL-3439.
-    // The current FFI still requires a context argument.
+    // The sidecar snapshots the connection's application before aggregation.
+    // Do not copy service, environment, and version with every evaluation.
     ddog_FfeTelemetryContext context = {0};
     ddog_FfeSubmissionStatus status = ddog_sidecar_try_submit_ffe_flag_evaluation(
         DATADOG_G(sidecar), &context, &event,