feat: enforce unique flag keys in manifest validation

[kriscoleman]

This PR

Add duplicate flag key detection to the Validate() function. This catches cases where a manifest JSON file is manually edited to contain duplicate keys within the flags object. Standard JSON unmarshaling silently accepts duplicates (taking the last value), so we use a token-based approach to detect them during validation.

Related Issues

Fixes #193

How to test

• unit test is provided which should pass

to try it for realsies:

• create a example manifest in this project with duplicate keys
• perform any openfeature command against the manifest and it should detect the duplicate keys as validate is called pre-emptively for all manifest commands.

[gemini-code-assist]

Summary of Changes

Hello @kriscoleman, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the manifest validation process by introducing a mechanism to detect duplicate flag keys. This change prevents potential data integrity issues that could arise from malformed manifests where flag keys are unintentionally duplicated, providing clearer error feedback and ensuring that each flag is uniquely defined.

Highlights

• Duplicate Flag Key Detection: Implemented a new validation step to detect and report duplicate flag keys within the 'flags' object of a manifest. This addresses cases where manual edits might introduce redundant keys, which standard JSON unmarshaling would silently overwrite.
• Token-Based JSON Parsing: Introduced a custom token-based JSON parsing mechanism using encoding/json.Decoder to explicitly identify duplicate keys, as the default json.Unmarshal behavior silently accepts the last value for duplicate keys.
• Comprehensive Unit Tests: Added extensive unit tests covering various scenarios for duplicate flag keys, including single, multiple, and triple duplicates, as well as edge cases like invalid JSON, missing 'flags' objects, and non-object 'flags' values, ensuring the robustness of the new validation logic.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces a valuable feature to detect duplicate flag keys during manifest validation, which is a great improvement as standard JSON unmarshaling would silently ignore these. The implementation uses a token-based parsing approach which is appropriate for this task. The accompanying unit tests are thorough and cover a good range of scenarios. My main feedback is focused on improving the robustness of error handling within the new parsing logic to ensure that malformed JSON doesn't lead to incomplete or incorrect validation results.

[georgesdugue]

UAT looks great!

Trying to add a duplicate key

Performing an openfeature command when the manifest has duplicate keys

The only improvement I'd suggest for a later iteration is, when adding a new flag, to either find a way to detect the duplicate key early or allow the user to change the key name without having to start over.

[georgesdugue]

Great work, @kriscoleman

[kriscoleman]

The only improvement I'd suggest for a later iteration is, when adding a new flag, to either find a way to detect the duplicate key early or allow the user to change the key name without having to start over.

Great ideas, I can follow up with some of this, it will make for good UX improvements