feat(flags): support obfuscated assignment keys

[leoromanovsky]

Tracking: FFLSDK-263

Motivation

Readable flag keys can reveal upcoming features. Support obfuscated assignments without changing application evaluation calls.
This reduces readable names in payloads; it does not hide values or prevent dictionary guessing. It is not encryption or response signing.

Changes and Decisions

Advertise support through this header instead of a JSON supported_capabilities field. Existing request fields stay unchanged.

X-DD-FEATURE-FLAGS-CAPABILITIES: assignment-encoding-flag-key-256-v1

Capabilities are sorted and comma-separated. They describe support, not a requirement. The edge still selects plaintext or obfuscated responses through its rollout.

For obfuscated: true, validate obfuscation: {scheme, salt} and hash the application key for lookup. The response scheme remains flag-key-sha256-v1:

lowercase_hex(SHA256(
  UTF8("datadog.feature-flags.flag-key.v1") || 0x00 ||
  decode_hex(salt) || UTF8(application_flag_key)
))

The public salt contains 16 bytes, encoded as 32 lowercase hexadecimal characters. Keys use exact UTF-8 bytes without normalization.

sequenceDiagram
    participant App
    participant SDK as Unity Flags client
    participant Edge as Fastly
    SDK->>Edge: Precompute request + capability header
    Edge-->>SDK: Plaintext, or encoded keys + scheme + salt
    SDK->>SDK: Validate and retain assignments with encoding
    App->>SDK: Evaluate original flag key
    SDK->>SDK: Hash lookup key only for encoded assignments
    SDK-->>App: Original value and evaluation details
    SDK->>SDK: Keep original flag key in telemetry

Loading

• Cache up to 1,024 lookup hashes per descriptor. Do not cache flag values or change exposure deduplication.
• Use System.Security.Cryptography.SHA256. Keep encoded assignments and their metadata together in memory.
• Preserve evaluation calls, values, and original-key exposure and evaluation telemetry.
• Reject invalid encoding metadata without a plaintext retry. Keep fallback assignments only for the same subject and targeting attributes.
• Leave persistence and native bridges unchanged. This implementation does not add a disk cache.
• Live delivery through UnityWebRequest in a mobile player remains unverified. The local transport harness does not establish IL2CPP behavior.

Release requires edge support for the new header. This PR does not deploy backend changes.

Related: edge rollout, browser implementation.

[datadog-prod-us1-4]

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 2 Pipeline jobs failed

DataDog/dd-sdk-unity | unit-test: [2021.3, test_scaffolds/2021 LTS]

View more details · View in GitLab

DataDog/dd-sdk-unity | unit-test: [6000.2, test_scaffolds/6000 LTS]

View more details · View in GitLab

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: c42e1f2 | Docs | View more details | Give us feedback!}

[linear-code]

FFLSDK-263