fix(feature_flags): missing context key never satisfies a condition

Conditions read the context with context.get(key), so an absent key was
compared as None. Negative actions (NOT_EQUALS, NOT_IN, KEY_NOT_IN_VALUE,
VALUE_NOT_IN_KEY) therefore matched requests that carried no such key at
all, firing rules meant for one segment on anonymous or partially
populated traffic.

This is a regression from ab9078c (#2052). Until v2.11.0 _match_by_action
returned False for any falsy context value, so a missing key never
matched. That guard was removed to allow falsy values such as 0 and ""
to be compared, and allowing absent keys to match was an unintended side
effect. Restore the original semantics for missing keys by checking key
presence before invoking the comparator, while keeping the #2051
behaviour for keys that are present with a falsy or None value. Time
based actions are unaffected since they never read the user context.

Document the behaviour in the rule actions section.

Fixes #8424

Author: dreamorosi

aws_lambda_powertools/utilities/feature_flags/feature_flags.py

@@ -115,7 +115,7 @@ def _evaluate_conditions(
             return False
 
         for condition in conditions:
-            context_value = context.get(condition.get(schema.CONDITION_KEY, ""))
+            cond_key = condition.get(schema.CONDITION_KEY, "")
             cond_action = condition.get(schema.CONDITION_ACTION, "")
             cond_value = condition.get(schema.CONDITION_VALUE)
 
@@ -125,7 +125,17 @@ def _evaluate_conditions(
                 schema.RuleAction.SCHEDULE_BETWEEN_DATETIME_RANGE.value,
                 schema.RuleAction.SCHEDULE_BETWEEN_DAYS_OF_WEEK.value,
             ):
-                context_value = condition.get(schema.CONDITION_KEY)  # e.g., CURRENT_TIME
+                context_value = cond_key  # e.g., CURRENT_TIME
+            elif cond_key not in context:
+                # A key absent from the context never satisfies a condition. Without this guard, `None`
+                # would be compared as a regular value and negative actions (NOT_EQUALS, NOT_IN, ...) would match.
+                self.logger.debug(
+                    f"rule did not match, context key not found, rule_name={rule_name}, "
+                    f"rule_value={rule_match_value}, name={feature_name}, key={cond_key}",
+                )
+                return False
+            else:
+                context_value = context[cond_key]
 
             if not self._match_by_action(action=cond_action, condition_value=cond_value, context_value=context_value):
                 self.logger.debug(

docs/utilities/feature_flags.md

@@ -444,6 +444,8 @@ The `action` configuration can have the following values, where the expressions
 ???+ info
     The `key` and `value` will be compared to the input from the `context` parameter.
 
+    If a condition's `key` is not present in `context`, the condition never matches, regardless of the action. For example, a `NOT_EQUALS` rule on `tier` will not match a request that carries no `tier` at all.
+
 ???+ "Time based keys"
 
     For time based keys, we provide a list of predefined keys. These will automatically get converted to the corresponding timestamp on each invocation of your Lambda function.

tests/functional/feature_flags/_boto3/test_feature_flags.py

@@ -883,6 +883,71 @@ def test_flags_not_equal_match(mocker, config):
     assert toggle == expected_value
 
 
+@pytest.mark.parametrize(
+    "action, value",
+    [
+        (RuleAction.NOT_EQUALS.value, "premium"),
+        (RuleAction.NOT_IN.value, ["premium", "enterprise"]),
+        (RuleAction.KEY_NOT_IN_VALUE.value, ["premium", "enterprise"]),
+        (RuleAction.VALUE_NOT_IN_KEY.value, "premium"),
+    ],
+)
+def test_flags_negative_action_no_match_when_context_key_missing(mocker, config, action, value):
+    # GIVEN a rule with a negative action on key "tier"
+    mocked_app_config_schema = {
+        "my_feature": {
+            "default": False,
+            "rules": {
+                "non premium users": {
+                    "when_match": True,
+                    "conditions": [
+                        {
+                            "action": action,
+                            "key": "tier",
+                            "value": value,
+                        },
+                    ],
+                },
+            },
+        },
+    }
+    feature_flags = init_feature_flags(mocker, mocked_app_config_schema, config)
+
+    # WHEN evaluating with a context that doesn't carry "tier" at all
+    toggle = feature_flags.evaluate(name="my_feature", context={"username": "a"}, default=False)
+
+    # THEN the rule must not match; a missing key never satisfies a condition
+    assert toggle is False
+
+
+def test_flags_not_equal_match_when_context_key_is_none(mocker, config):
+    # GIVEN a NOT_EQUALS rule on key "tier"
+    mocked_app_config_schema = {
+        "my_feature": {
+            "default": False,
+            "rules": {
+                "non premium users": {
+                    "when_match": True,
+                    "conditions": [
+                        {
+                            "action": RuleAction.NOT_EQUALS.value,
+                            "key": "tier",
+                            "value": "premium",
+                        },
+                    ],
+                },
+            },
+        },
+    }
+    feature_flags = init_feature_flags(mocker, mocked_app_config_schema, config)
+
+    # WHEN the key is present but explicitly set to None
+    toggle = feature_flags.evaluate(name="my_feature", context={"tier": None}, default=False)
+
+    # THEN the value is still compared as usual (None != "premium"), so the rule matches
+    assert toggle is True
+
+
 # Test less than
 def test_flags_less_than_no_match_1(mocker, config):
     expected_value = False