pἰ U d Z ddlmZ ddlZddlZddlZddlmZ dZdZ dZ
i a de d < i a
d
e d < e ad e d
< dade d< d0dZd1dZd2dZd3dZd4dZd5d Zd6d Zd7d!Zd8d$Zd6d%Zd7d&Zd9d'Z d9d(Z d:d;d-Z dav
Shared reader for the local feature flags file.
The file is written by:
- Go resident-agent FeatureFlags plugin (IM360 mode)
- Python FeatureFlagsSync plugin (AV mode)
Other subsystems (e.g. message_status_publisher) use this module
to check individual flag values at runtime.
Supported JSON shapes on disk (readers / ``is_enabled`` / ``get_params``):
- New shape ``{"flags": ["mqtt_tracking"], "params": {"flag": ["A", "B"]}}``
(mirrors the sync API response; carries per-flag string-list params).
- Legacy object ``{"mqtt_tracking": true, ...}`` (still accepted).
- JSON array of enabled names ``["mqtt_tracking"]`` (still accepted).
- Legacy wrapper ``{"flags": ["mqtt_tracking", ...]}`` (still accepted).
The sync API checksum collapses to the legacy sorted-names array when no
params are present, so this agent and older agents agree on the bool-only
case. With params, the canonical form expands to ``{"flags": [...], "params":
{...}}`` with all keys and list members sorted.
The sync plugin also writes ``FLAGS_PLAIN_PATH`` (``/var/imunify360/feature_flags``):
plain text, one enabled flag name per line (sorted), for scripts.
) annotationsN)Anyz"/var/imunify360/feature_flags.jsonz /var/imunify360/feature_flagsmqtt_tracked_methodsdict[str, Any]
_cached_flagsdict[str, list[str]]_cached_paramsfrozenset[str]_cached_mqtt_methods float
_cached_mtimerawr returnc | i S t | t r#i }| D ] }t |t rd||< |S t | t r;| d }t |t rt | S | S i S )z@Map file JSON to a flat name->value dict for :func:`is_enabled`.NTflags)
isinstanceliststrdictget_normalize_flags_from_file)r outiteminners \/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/internals/feature_flags.pyr r 4 s
{ #t ! !D$$$
! D
#t eT " " 5-e44 4
I c @ t | t si S | d }t |t si S i }| D ]C\ }}t |t rt |t
s0d |D }|r|||< D|S )zExtract ``params`` mapping from new-shape file content.
Only the new ``{"flags": [...], "params": {name: [...]}}`` shape carries
params; every other (legacy) shape returns an empty mapping.
paramsc < g | ]}t |t |S r r ).0vs r
z%_params_from_file..U s' ;;;
1c(:(:;1;;;r )r r r itemsr r )r
raw_paramsr namevaluescleaneds r _params_from_filer+ F s c4 ""J j$ ' ' "C"((** f$$$ Jvt,D,D ;;f;;; CI Jr +tuple[dict[str, Any], dict[str, list[str]]]c ^ t j t } n2# t $ r% i ai at ada t
t fcY S w xY w| t k rt
t fS t t 5 }t j | }d d d n # 1 swxY w Y t | at | an # t t j f$ r i ai aY nw xY wt t t" d a| a t
t fS )Nr r! )ospathgetmtime
FLAGS_PATHOSErrorr r frozensetr r openjsonloadr r+ JSONDecodeErrorr MQTT_TRACKED_METHODS_FLAG)mtimefr s r _read_stater; [ sr - ,, - - -
({{
n,,,, -
n,,
*
)A,,C 2377
*3// T) *
%4b99 M . ((sE $' ,AA3C B( C (B,,C /B,0!C C/.C/c ( t \ } }| S Nr; )r _s r _read_flagsr@ x s }}HE1 Lr c ( t \ } }|S r= r> )r? r s r _read_paramsrB } s
IAv Mr r list[str]c t | t t f s$t dt | j t
| }t d | D S )a Return sorted enabled flag names for JSON and plain-text sidecar.
Accepts the same shapes as :func:`_normalize_flags_from_file` (array,
flat map, ``{"flags": [...]}``) so checksums and sidecars match Go
``enabledNamesSortedForChecksum`` / :func:`is_enabled`.
z flags must be list or dict, not c 3 $ K | ] \ }}||V d S r= r! r# kr$ s r z,enabled_flag_names_sorted.. s+ 881a8!888888r ) r r r TypeErrortype__name__r sortedr& )r
normalizeds r enabled_flag_names_sortedrN sx edD\ * *
EtE{{/C E E
,E22J 88
0 0 2 2888 8 88r namesbytesc r t | }t j |dd S )z|JSON array bytes used for sync MD5 when no params are present
(matches correlation_api ``checksum_for_sync_flag_list``).T sort_keysindentrL r5 dumpsencode)rO ordereds r canonical_sync_flag_list_bytesrZ s2 UmmG :ga 8 8 8 ? ? A AAr r c |st | S t | d t | D d}t j |dd S )ae JSON bytes for the sync MD5 over the full response shape.
Mirrors correlation_api ``checksum_for_sync_response``: collapses to
the legacy sorted-names array when ``params`` is empty so old agents
keep matching, otherwise expands to the deterministic
``{"flags": [...], "params": {...}}`` form with all keys and list
members sorted.
c 4 i | ]\ }}|t | S r! rL rF s r
z1canonical_sync_response_bytes.. $ CCCDAq1fQiiCCCr r r TrR rS )rZ rL r& r5 rW rX rO r canonicals r canonical_sync_response_bytesrc su 5-e444 CCF6<<>>,B,BCCC I :i4 : : : A A C CCr r/ r c r t | d 5 }t j | }ddd n # 1 swxY w Y n## t t t j f$ r Y dS w xY wt
| }t | }t || }t j
|d S )zMD5 hex of the canonical sync-response form for ``path``.
Returns "" if the file is missing or invalid. Computes the same MD5
the server returned, so a matching checksum lets the agent skip
the response payload on the next sync.
zutf-8)encodingN F)usedforsecurity) r4 r5 r6 r2 UnicodeDecodeErrorr7 rN r+ rc hashlibmd5 hexdigest)r/ r: r rO r payloads r !sync_checksum_hex_from_flags_filerm s
$
)
)
) Q)A,,C ')= > rr %c * *E
s
#
#F+E6::G ;w 6 6 6 @ @ B BBs, A 4 A 8A 8A A A c d t d | D D }t j |dd S )z. s KKKQDKKKr c < h | ]}t |t |S r! r" )r# xs r z1legacy_feature_flags_map_bytes.. s' !I!I!IjC6H6H!I!!I!I!Ir TrR rS rV )rO ds r legacy_feature_flags_map_bytesru sO KK&!I!IU!I!I!IJJKKKA :a4 2 2 2 9 9 ; ;;r c t | d t | D d}t j |dd S )zPersisted form for ``FLAGS_PATH`` carrying both flags and params.
Same canonical shape as ``canonical_sync_response_bytes`` so the file
is self-describing and round-trips through ``sync_checksum_hex_from_flags_file``.
c 4 i | ]\ }}|t | S r! r] rF s r r^ z,sync_response_file_bytes.. r_ r r` TrR rS )rL r& r5 rW rX ra s r sync_response_file_bytesrx s_ CCF6<<>>,B,BCCC I :i4 : : : A A C CCr c | t | }|sdS d | dz S )zPBody for ``FLAGS_PLAIN_PATH``: one name per line, trailing newline if non-empty.r
)rN joinrX )r rO s r $plain_text_payload_for_enabled_flagsr| s? %e , ,E s IIe t # + + - --r c t | t r)t j | dd S t dt
| j )zBSerialize dict flags for writing ``FLAGS_PATH`` (legacy map only).TrR rS zflags must be dict, not )r r r5 rW rX rI rJ rK )r s r $serialize_feature_flags_file_payloadr~ sX % Dz%4:::AACCC
EtE{{/CEE
F
FFr F flag_namedefaultboolc n t }| | }||S t | S )zReturn whether *flag_name* is enabled.
If the file is missing, unreadable, or the flag is absent,
*default* is returned. Defaults to False so unknown flags are
treated as disabled unless the caller explicitly opts in.
)r@ r r )r r r values r
is_enabledr s4
MME IIi E } ;;r c ` t t | d S )zReturn the per-flag string params from the on-disk file.
Empty list when the file is missing/unreadable, the flag is unknown,
or the value did not come from the new structured shape (legacy
bool-only flags carry no params by definition).
r! )r rB r )r s r
get_paramsr s& ""9b11 2 22r c , t t S )u Frozen set of method names whose status events should be enriched
for MQTT tracing. Driven entirely by the server-side
``mqtt_tracked_methods`` flag's params list — the agent has no
hard-coded list, so adding/removing tracked types is a server-side
config change with no agent rollout.
Cached: ``_read_state`` pre-builds the frozenset and invalidates it
when the flags file's mtime changes. On the hot path — every
Reportable message in ``the_sink._call_unlocked`` — this is a single
``os.stat`` syscall plus an identity-stable frozenset return. Two
consecutive calls within the same mtime window return the same
instance.
)r; r r! r r r r s MMM r )r r r r )r r r r )r r, )r r )r r )r r r rC )rO rC r rP )rO rC r r r rP )r/ r r r )r r r rP )F)r r r r r r )r r r rC )r r
)!__doc__
__future__r ri r5 r. typingr r1 FLAGS_PLAIN_PATHr8 r __annotations__r r3 r r r r+ r; r@ rB rN rZ rc rm ru rx r| r~ r r r r! r r r s 4 # " " " " "
1
2 3 "
" " " "') ) ) ) ) (1y{{ 2 2 2 2
$ *) ) ) ):
9 9 9 9 B B B BD D D D(C C C C$< < < < D D D D . . . .G G G G 3 3 3 3 r