guard precomputed ETag reuse by context

Validate caller-supplied previous configurations before sending their ETag or reusing them on a 304 response.

Environment: Datadog workspace

Author: leoromanovsky

packages/browser/src/transport/fetchConfiguration.ts

@@ -89,12 +89,15 @@ export async function fetchPrecomputedConfiguration(
   options: PrecomputedConfigurationFetchOptions
 ): Promise<FlagsConfiguration> {
   const url = buildConfigurationUrl(options, 'precomputed')
+  const previousConfiguration = configMatchesContext(options.previousConfiguration, options.context)
+    ? options.previousConfiguration
+    : undefined
   const defaultHeaders = buildConfigurationHeaders(
     options,
     {
       'Content-Type': 'application/vnd.api+json',
-      ...(options.previousConfiguration?.precomputed?.etag && {
-        'If-None-Match': options.previousConfiguration.precomputed.etag,
+      ...(previousConfiguration?.precomputed?.etag && {
+        'If-None-Match': previousConfiguration.precomputed.etag,
       }),
     },
     'precomputed'
@@ -128,8 +131,8 @@ export async function fetchPrecomputedConfiguration(
       },
     }),
   })
-  if (response.status === 304 && options.previousConfiguration?.precomputed) {
-    return { precomputed: options.previousConfiguration.precomputed }
+  if (response.status === 304 && previousConfiguration?.precomputed) {
+    return { precomputed: previousConfiguration.precomputed }
   }
   if (!response.ok) {
     const errorMessage = await getErrorMessage(response)
@@ -156,7 +159,7 @@ export function createFlagsConfigurationFetcher(initConfiguration: FlaggingInitC
       ...initConfiguration,
       context,
       signal,
-      previousConfiguration: configMatchesContext(previousConfiguration, context) ? previousConfiguration : undefined,
+      previousConfiguration,
     })
     previousConfiguration = configuration
     return configuration

packages/browser/test/transport/fetchConfiguration.spec.ts

@@ -384,6 +384,42 @@ describe('createFlagsConfigurationFetcher', () => {
       )
     })
 
+    it('does not reuse a previous precomputed configuration for a different context', async () => {
+      const contextA = { targetingKey: 'user-a' }
+      const contextB = { targetingKey: 'user-b' }
+      const options = { ...baseConfig, flaggingProxy: 'https://proxy.example.com', context: contextA }
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        headers: new Headers({ etag: 'context-a-etag' }),
+        json: jest.fn().mockResolvedValue({ assignments: 'user-a' }),
+      })
+      const previousConfiguration = await fetchPrecomputedConfiguration(options)
+      mockFetch.mockImplementationOnce((_url, init) => {
+        const headers = init?.headers as Record<string, string>
+        if (headers['If-None-Match'] === 'context-a-etag') {
+          return Promise.resolve({ ok: false, status: 304, headers: new Headers() })
+        }
+        return Promise.resolve({
+          ok: true,
+          status: 200,
+          headers: new Headers(),
+          json: jest.fn().mockResolvedValue({ assignments: 'user-b' }),
+        })
+      })
+
+      const result = await fetchPrecomputedConfiguration({
+        ...options,
+        context: contextB,
+        previousConfiguration,
+      })
+
+      expect(result.precomputed).toMatchObject({
+        context: contextB,
+        response: { assignments: 'user-b' },
+      })
+    })
+
     it('decodes a rules configuration response', async () => {
       const bytes = Uint8Array.from(Buffer.from(rulesWire.rules.response, 'base64'))
       mockFetch.mockResolvedValue({