Merge branch 'develop' into na/spring-blog-post

Author: nabramow

app/backend.dev.env

@@ -13,32 +13,26 @@ DATABASE_CONNECTION_STRING=postgresql://postgres:203d805f4b62c0a1b2f1f6b82d4583d
 
 ADD_DUMMY_DATA=1
 
-ENABLE_DONATIONS=0
 STRIPE_API_KEY=sk_test_...
 STRIPE_WEBHOOK_SECRET=whsec_...
 STRIPE_RECURRING_PRODUCT_ID=price_...
 
-ENABLE_STRONG_VERIFICATION=0
 IRIS_ID_PUBKEY=public-key-...
 IRIS_ID_SECRET=secret-...
 # corresponds to private key e6c2fbf3756b387bc09a458a7b85935718ef3eb1c2777ef41d335c9f6c0ab272
 VERIFICATION_DATA_PUBLIC_KEY=dd740a2b2a35bf05041a28257ea439b30f76f056f3698000b71e6470cd82275f
 
-ENABLE_POSTAL_VERIFICATION=0
 MYPOSTCARD_API_KEY=...
 MYPOSTCARD_USERNAME=...
 MYPOSTCARD_PASSWORD=...
 MYPOSTCARD_PRODUCT_CODE=J9GCU
 MYPOSTCARD_CAMPAIGN_ID=295
 
-ENABLE_SMS=0
 SMS_SENDER_ID=invalid
 
 NOTIFICATION_EMAIL_SENDER=Couchers.org
 NOTIFICATION_EMAIL_ADDRESS=notify@couchers.org.invalid
 NOTIFICATION_PREFIX='[DEV] '
-ENABLE_NOTIFICATION_TRANSLATIONS=1
-ENABLE_EMAIL_ICS_ATTACHMENTS=1
 
 REPORTS_EMAIL_RECIPIENT=reports@couchers.org.invalid
 CONTRIBUTOR_FORM_EMAIL_RECIPIENT=forms@couchers.org.invalid
@@ -70,7 +64,6 @@ LISTMONK_API_USERNAME=...
 LISTMONK_API_KEY=...
 LISTMONK_LIST_ID=3
 
-RECAPTHCA_ENABLED=0
 RECAPTHCA_PROJECT_ID=...
 RECAPTHCA_API_KEY=...
 RECAPTHCA_SITE_KEY=...
@@ -89,6 +82,7 @@ EXPERIMENTATION_ENABLED=0
 EXPERIMENTATION_PASS_ALL_GATES=1
 GROWTHBOOK_API_HOST=https://gbapi.couchershq.org
 GROWTHBOOK_CLIENT_KEY=sdk-cGmljeXu1BCzHffE
+GROWTHBOOK_CACHE_PATH=growthbook-features-cache.json
 
 # Moderation auto-approval deadline in seconds (0 to disable)
 MODERATION_AUTO_APPROVE_DEADLINE_SECONDS=10

app/backend/.gitignore

@@ -19,3 +19,6 @@ htmlcov/
 
 # test artifacts
 test_artifacts/
+
+# GrowthBook feature-flag disk cache (GROWTHBOOK_CACHE_PATH)
+growthbook-features-cache.json

app/backend/resources/badges.json

@@ -18,7 +18,8 @@
     {
       "id": "moderator",
       "color": "#c74f5b",
-      "admin_editable": false
+      "admin_editable": false,
+      "flag": "show_moderator_badge"
     },
     {
       "id": "volunteer",

app/backend/src/couchers/config.py

@@ -40,26 +40,21 @@
     ("GEOLITE2_ASN_MMDB_FILE_LOCATION", str, ""),
     # Whether to try adding dummy data
     ("ADD_DUMMY_DATA", bool),
-    # Donations
-    ("ENABLE_DONATIONS", bool),
+    # Donations (gated at runtime by the `donations_enabled` feature flag)
     ("STRIPE_API_KEY", str),
     ("STRIPE_WEBHOOK_SECRET", str),
     ("STRIPE_RECURRING_PRODUCT_ID", str),
-    # Strong verification through Iris ID
-    ("ENABLE_STRONG_VERIFICATION", bool),
+    # Strong verification through Iris ID (gated at runtime by the `strong_verification_enabled` feature flag)
     ("IRIS_ID_PUBKEY", str),
     ("IRIS_ID_SECRET", str),
     ("VERIFICATION_DATA_PUBLIC_KEY", bytes),
-    # Postal verification
-    ("ENABLE_POSTAL_VERIFICATION", bool),
-    # MyPostcard API credentials
+    # Postal verification (MyPostcard API; gated at runtime by the `postal_verification_enabled` feature flag)
     ("MYPOSTCARD_API_KEY", str),
     ("MYPOSTCARD_USERNAME", str),
     ("MYPOSTCARD_PASSWORD", str),
     ("MYPOSTCARD_PRODUCT_CODE", str),
     ("MYPOSTCARD_CAMPAIGN_ID", str),
-    # SMS
-    ("ENABLE_SMS", bool),
+    # SMS (gated at runtime by the `sms_enabled` feature flag)
     ("SMS_SENDER_ID", str),
     # Email
     ("ENABLE_EMAIL", bool),
@@ -69,8 +64,6 @@
     ("NOTIFICATION_EMAIL_ADDRESS", str),
     # An optional prefix for email subject, e.g. [STAGING]
     ("NOTIFICATION_PREFIX", str, ""),
-    ("ENABLE_NOTIFICATION_TRANSLATIONS", bool),
-    ("ENABLE_EMAIL_ICS_ATTACHMENTS", bool),
     # Address to send emails about reported users
     ("REPORTS_EMAIL_RECIPIENT", str),
     # Address to send contributor forms when users sign up/fill the form
@@ -108,8 +101,7 @@
     ("LISTMONK_API_USERNAME", str),
     ("LISTMONK_API_KEY", str),
     ("LISTMONK_LIST_ID", int),
-    # Google recaptcha antibot
-    ("RECAPTHCA_ENABLED", bool),
+    # Google recaptcha antibot (gated at runtime by the `recaptcha_enabled` feature flag)
     ("RECAPTHCA_PROJECT_ID", str),
     ("RECAPTHCA_API_KEY", str),
     ("RECAPTHCA_SITE_KEY", str),
@@ -122,6 +114,9 @@
     # GrowthBook SDK configuration
     ("GROWTHBOOK_API_HOST", str, "https://cdn.growthbook.io"),
     ("GROWTHBOOK_CLIENT_KEY", str, ""),
+    # Disk path for the last-known-good feature payload, used as a cold-start fallback when GrowthBook
+    # is unreachable. Required when experimentation is enabled so we never start on in-code defaults.
+    ("GROWTHBOOK_CACHE_PATH", str, ""),
     # Moderation auto-approval deadline in seconds (0 to disable auto-approval)
     ("MODERATION_AUTO_APPROVE_DEADLINE_SECONDS", int),
     # User ID of the bot user for automated moderation actions
@@ -147,32 +142,35 @@ def check_config(cfg: dict[str, Any]) -> None:
             raise Exception("Production site must be over HTTPS")
         if not cfg["ENABLE_EMAIL"]:
             raise Exception("Production site must have email enabled")
-        if not cfg["ENABLE_SMS"]:
-            raise Exception("Production site must have SMS enabled")
         if cfg["IN_TEST"]:
             raise Exception("IN_TEST while not DEV")
 
-    if cfg["ENABLE_DONATIONS"]:
+        # Donations are gated at runtime by the `donations_enabled` feature flag, which can be flipped on
+        # remotely at any time, so prod must always have Stripe credentials present so the feature can run.
         if not cfg["STRIPE_API_KEY"] or not cfg["STRIPE_WEBHOOK_SECRET"] or not cfg["STRIPE_RECURRING_PRODUCT_ID"]:
-            raise Exception("No Stripe API key/recurring donation ID but donations enabled")
+            raise Exception("Stripe credentials must be configured in production")
 
-    if cfg["ENABLE_STRONG_VERIFICATION"]:
+        # The following features are gated at runtime by feature flags (`strong_verification_enabled`,
+        # `postal_verification_enabled`, `recaptcha_enabled`), which can be flipped on remotely at any
+        # time, so prod must always have their credentials present.
         if not cfg["IRIS_ID_PUBKEY"] or not cfg["IRIS_ID_SECRET"] or not cfg["VERIFICATION_DATA_PUBLIC_KEY"]:
-            raise Exception("No Iris ID pubkey/secret or verification data pubkey but strong verification enabled")
-
-    if cfg["ENABLE_POSTAL_VERIFICATION"]:
+            raise Exception("Iris ID credentials must be configured in production")
         if (
             not cfg["MYPOSTCARD_API_KEY"]
             or not cfg["MYPOSTCARD_USERNAME"]
             or not cfg["MYPOSTCARD_PASSWORD"]
             or not cfg["MYPOSTCARD_PRODUCT_CODE"]
             or not cfg["MYPOSTCARD_CAMPAIGN_ID"]
         ):
-            raise Exception("MyPostcard API credentials not configured but postal verification enabled")
+            raise Exception("MyPostcard API credentials must be configured in production")
+        if not cfg["RECAPTHCA_PROJECT_ID"] or not cfg["RECAPTHCA_API_KEY"] or not cfg["RECAPTHCA_SITE_KEY"]:
+            raise Exception("reCAPTCHA credentials must be configured in production")
 
     if cfg["EXPERIMENTATION_ENABLED"]:
         if not cfg["GROWTHBOOK_CLIENT_KEY"]:
             raise Exception("No GrowthBook client key but experimentation enabled")
+        if not cfg["GROWTHBOOK_CACHE_PATH"]:
+            raise Exception("No GrowthBook cache path but experimentation enabled")
 
 
 def make_config() -> dict[str, Any]:

app/backend/src/couchers/constants.py

@@ -103,14 +103,6 @@
 
 GHOST_USERNAME = "ghost"
 
-# Donation drive start date - set to None to disable donation drive banner
-# When set, users who haven't donated since this date will see a donation banner
-DONATION_DRIVE_START: datetime | None = None
-
-DONATION_GOAL_USD = 5000
-# exclude big donations from Aapeli + Itsi that we're hoping to do without :)
-DONATION_OFFSET_USD = 2000
-
 # Photo gallery limits
 GALLERY_MAX_PHOTOS_NOT_VERIFIED = 2
 GALLERY_MAX_PHOTOS_VERIFIED = 5

app/backend/src/couchers/context.py

@@ -2,6 +2,7 @@
 
 import grpc
 
+from couchers import experimentation
 from couchers.i18n import LocalizationContext
 
 if TYPE_CHECKING:
@@ -82,6 +83,7 @@ def __init__(
         self.__is_interactive = is_interactive
         self.__logged_in = self._user_id is not None
         self.__cookies: list[str] = []
+        self.__response_headers: list[tuple[str, str]] = []
         self._growthbook: GrowthBook | None = None
 
         if self.__is_interactive:
@@ -138,8 +140,15 @@ def set_cookies(self, cookies: list[str]) -> None:
         self.__verify_interactive()
         self.__cookies += cookies
 
+    def set_response_headers(self, headers: list[tuple[str, str]]) -> None:
+        """
+        Sets extra HTTP response headers (forwarded by Envoy as gRPC initial metadata)
+        """
+        self.__verify_interactive()
+        self.__response_headers += headers
+
     def _send_cookies(self) -> None:
-        data = tuple([("set-cookie", cookie) for cookie in self.__cookies])
+        data = tuple([("set-cookie", cookie) for cookie in self.__cookies]) + tuple(self.__response_headers)
         self._grpc_context.send_initial_metadata(data)  # type: ignore[union-attr]
 
     @property
@@ -179,6 +188,30 @@ def token(self) -> str:
     def localization(self) -> LocalizationContext:
         return self.__localization
 
+    # Feature-flag evaluation methods mirror the OpenFeature evaluation API, evaluating for this
+    # context's user. The gating lives in experimentation; we just pass our cached per-request
+    # evaluator. The in-code default is honored even for flags not yet set up in GrowthBook.
+    def get_boolean_value(self, flag_key: str, default: bool) -> bool:
+        return experimentation._boolean_value(flag_key, default, self._get_growthbook)
+
+    def get_string_value(self, flag_key: str, default: str) -> str:
+        return experimentation._feature_value(flag_key, default, self._get_growthbook)
+
+    def get_integer_value(self, flag_key: str, default: int) -> int:
+        return experimentation._feature_value(flag_key, default, self._get_growthbook)
+
+    def get_float_value(self, flag_key: str, default: float) -> float:
+        return experimentation._feature_value(flag_key, default, self._get_growthbook)
+
+    def get_object_value[T](self, flag_key: str, default: T) -> T:
+        return experimentation._feature_value(flag_key, default, self._get_growthbook)
+
+    def _get_growthbook(self) -> GrowthBook:
+        if self._growthbook is None:
+            # _user_id is None when logged out: evaluate anonymously, falling through to defaults.
+            self._growthbook = experimentation._create_evaluator(self._user_id)
+        return self._growthbook
+
 
 def make_interactive_context(
     grpc_context: grpc.ServicerContext,

app/backend/src/couchers/db.py

@@ -6,6 +6,7 @@
 from contextlib import contextmanager
 from os import getpid
 from threading import get_ident
+from typing import TYPE_CHECKING
 
 from alembic import command
 from alembic.config import Config
@@ -19,7 +20,6 @@
 
 from couchers.config import config
 from couchers.constants import SERVER_THREADS, WORKER_THREADS
-from couchers.context import CouchersContext
 from couchers.models import (
     Cluster,
     ClusterRole,
@@ -33,6 +33,9 @@
 )
 from couchers.sql import where_users_column_visible
 
+if TYPE_CHECKING:
+    from couchers.context import CouchersContext
+
 # Register psycopg (psycopg3) as the default driver for postgresql:// URLs
 # This must happen before any engine is created
 registry.register("postgresql", "sqlalchemy.dialects.postgresql.psycopg", "PGDialect_psycopg")