Address comment + some doc about using feature flags

Author: KevinFairise2

docs/tutorials/cli/create-command.md

@@ -134,3 +134,62 @@ $ dda agent-release data
 │                   │ └───┴────────┘ │
 ...
 ```
+
+## Using feature flags
+
+You can guard behavior behind feature flags using the `app.features` manager. It evaluates a remote flag for the current user/machine with a default fallback.
+
+
+Update the command to check a flag before performing the network request:
+
+/// tab | :octicons-file-code-16: src/dda/cli/agent_release/data/__init__.py
+```python hl_lines="15 23-28 31-36"
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dda.cli.base import dynamic_command, pass_app
+
+if TYPE_CHECKING:
+    from dda.cli.application import Application
+
+
+@dynamic_command(
+    short_help="Show Agent release data",
+    features=["http"],
+)
+@pass_app
+def cmd(app: Application) -> None:
+    """
+    Show Agent release data.
+    """
+    # Check a feature flag to enable this command's behavior
+    # Replace "agent-release-enabled" with your flag key
+    enabled = app.features.enabled(
+        "agent-release-enabled",
+        default_value=True,
+        extra_attributes={"module": "agent-release"},
+    )
+    if not enabled:
+        app.display_warning("This command is currently disabled by feature flag.")
+        return
+
+    import httpx
+
+    base = "https://raw.githubusercontent.com"
+    repo = "DataDog/datadog-agent"
+    branch = "main"
+    path = "release.json"
+    with app.status("Fetching Agent release data"):
+        response = httpx.get(f"{base}/{repo}/{branch}/{path}")
+
+    response.raise_for_status()
+    app.display_table(response.json())
+```
+///
+
+/// note
+`app.features.enabled(key, default_value, extra_attributes)` returns the evaluated value for `key`, or `default_value` if the flag is not found. The client automatically includes base context like platform, CI, environment, and user; you can add `extra_attributes` to refine targeting.
+///
+
+

src/dda/cli/application.py

@@ -128,7 +128,7 @@ def telemetry(self) -> TelemetryManager:
         return TelemetryManager(self)
 
     @cached_property
-    def ff(self) -> FeatureFlagManager:
+    def features(self) -> FeatureFlagManager:
         from dda.feature_flags.manager import FeatureFlagManager
 
         return FeatureFlagManager(self)

src/dda/feature_flags/client.py

@@ -1,10 +1,13 @@
 # SPDX-FileCopyrightText: 2025-present Datadog, Inc. <[email protected]>
 #
 # SPDX-License-Identifier: MIT
+from __future__ import annotations
+
 import json
-from typing import Any, Optional
+from typing import TYPE_CHECKING, Any, Optional
 
-from dda.utils.network.http.client import get_http_client
+if TYPE_CHECKING:
+    from dda.cli.application import Application
 
 
 class DatadogFeatureFlag:
@@ -15,10 +18,7 @@ class DatadogFeatureFlag:
     /Users/kevin.fairise/dd/openfeature-js-client/packages/browser/src/transport/fetchConfiguration.ts
     """
 
-    def __init__(
-        self,
-        client_token: str,
-    ):
+    def __init__(self, client_token: str | None, app: Application):
         """
         Initialize the Datadog Feature Flag client
 
@@ -32,11 +32,11 @@ def __init__(
             flagging_proxy: Optional proxy URL for flagging configuration requests
             custom_headers: Optional custom headers to add to requests
         """
-        self.client_token = client_token
-        self.env = "Production"
-        self.endpoint_url = f"https://preview.ff-cdn.datadoghq.com/precompute-assignments?dd_env={self.env}"
-        self.application_id = "dda"
-        self.__client = get_http_client()
+        self.__client_token = client_token
+        self.__env = "Production"
+        self.__endpoint_url = f"https://preview.ff-cdn.datadoghq.com/precompute-assignments?dd_env={self.__env}"
+        self.__application_id = "dda"
+        self.__app = app
 
     def _fetch_flags(
         self, targeting_key: str = "", targeting_attributes: Optional[dict[str, Any]] = None
@@ -54,14 +54,17 @@ def _fetch_flags(
         Raises:
             requests.HTTPError: If the API request fails
         """
+        if not self.__client_token:
+            return {}
+
         # Build headers
         headers = {
             "Content-Type": "application/vnd.api+json",
-            "dd-client-token": self.client_token,
+            "dd-client-token": self.__client_token,
         }
 
-        if self.application_id:
-            headers["dd-application-id"] = self.application_id
+        if self.__application_id:
+            headers["dd-application-id"] = self.__application_id
 
         # Stringify all targeting attributes
         stringified_attributes = {}
@@ -78,7 +81,7 @@ def _fetch_flags(
                 "type": "precompute-assignments-request",
                 "attributes": {
                     "env": {
-                        "dd_env": self.env,
+                        "dd_env": self.__env,
                     },
                     "sdk": {
                         "name": "python-example",
@@ -94,8 +97,9 @@ def _fetch_flags(
 
         try:
             # Make the request
-            response = self.__client.post(self.endpoint_url, headers=headers, json=payload, timeout=10)
-        except Exception:  # noqa: BLE001
+            response = self.__app.http.client().post(self.__endpoint_url, headers=headers, json=payload, timeout=10)
+        except Exception as e:  # noqa: BLE001
+            self.__app.display_warning(f"Error fetching flags: {e}")
             return {}
 
         return response.json()

src/dda/feature_flags/manager.py

@@ -7,8 +7,8 @@
 from typing import TYPE_CHECKING, Any, Optional
 
 from dda.feature_flags.client import DatadogFeatureFlag
+from dda.user.datadog import User
 from dda.utils.ci import running_in_ci
-from dda.utils.user import User
 
 if TYPE_CHECKING:
     from dda.cli.application import Application
@@ -23,25 +23,20 @@ def __init__(self, config: RootConfig) -> None:
 class FeatureFlagManager:
     """
     A class for querying feature flags. This is available as the
-    [`Application.ff`][dda.cli.application.Application.ff] property.
+    [`Application.features`][dda.cli.application.Application.features] property.
     """
 
     def __init__(self, app: Application) -> None:
         self.__app = app
 
-        self.__started = False
-
-        if self.client_token is not None:
-            self.__ff_client = DatadogFeatureFlag(self.client_token)
-            self.__started = True
-
+        self.__ff_client = DatadogFeatureFlag(self.__client_token, self.__app)
         self.__cache: dict[tuple[str, str, tuple[tuple[str, str], ...]], Any] = {}
 
     @cached_property
-    def client_token(self) -> str | None:
+    def __client_token(self) -> str | None:
         from contextlib import suppress
 
-        from dda.utils.secrets.secrets import fetch_client_token, read_client_token, save_client_token
+        from dda.secrets.api import fetch_client_token, read_client_token, save_client_token
 
         client_token: str | None = None
         with suppress(Exception):
@@ -53,23 +48,26 @@ def client_token(self) -> str | None:
         return client_token
 
     @property
-    def user(self) -> FeatureFlagUser:
+    def __user(self) -> FeatureFlagUser:
         return FeatureFlagUser(self.__app.config)
 
-    def get_targeting_key(self) -> str:
+    def __get_targeting_key(self) -> str:
         if running_in_ci():
             import os
 
             return os.getenv("CI_JOB_ID", "default_job_id")
 
-        return self.user.machine_id
+        return self.__user.machine_id
 
-    def check_flag(self, flag_key: str, default_value: Any, extra_attributes: Optional[dict[str, str]] = None) -> bool:
-        if not self.__started:
+    def enabled(
+        self, flag_key: str, *, default_value: bool = False, extra_attributes: Optional[dict[str, str]] = None
+    ) -> bool:
+        if not self.__client_token:
+            self.__app.display_debug("No client token found")
             return default_value
 
-        targeting_key = self.get_targeting_key()
-        targeting_attributes = self._get_base_context()
+        targeting_key = self.__get_targeting_key()
+        targeting_attributes = self.__get_base_context()
         if extra_attributes is not None:
             targeting_attributes.update(extra_attributes)
 
@@ -79,12 +77,14 @@ def check_flag(self, flag_key: str, default_value: Any, extra_attributes: Option
         self.__app.display_debug(
             f"Checking flag {flag_key} with targeting key {targeting_key} and targeting attributes {tuple_attributes}"
         )
-        flag_value = self._check_flag(flag_key, targeting_key, tuple_attributes)
+        flag_value = self.__check_flag(flag_key, targeting_key, tuple_attributes)
         if flag_value is None:
             return default_value
         return flag_value
 
-    def _check_flag(self, flag_key: str, targeting_key: str, targeting_attributes: tuple[tuple[str, str], ...]) -> bool:
+    def __check_flag(
+        self, flag_key: str, targeting_key: str, targeting_attributes: tuple[tuple[str, str], ...]
+    ) -> bool:
         cache_key = (flag_key, targeting_key, targeting_attributes)
         if cache_key in self.__cache:
             return self.__cache[cache_key]
@@ -98,10 +98,10 @@ def _check_flag(self, flag_key: str, targeting_key: str, targeting_attributes: t
         self.__cache[cache_key] = flag_value
         return flag_value
 
-    def _get_base_context(self) -> dict[str, str]:
+    def __get_base_context(self) -> dict[str, str]:
         return {
             "platform": "toto",
             "ci": "true" if running_in_ci() else "false",
             "env": "prod",
-            "user": self.user.email,
+            "user": self.__user.email,
         }

src/dda/utils/secrets/__init__.py renamed to src/dda/secrets/__init__.py

@@ -37,12 +37,12 @@ def save_client_token(client_token: str) -> None:
 
 
 def fetch_api_key() -> str:
-    from dda.utils.secrets.vault import fetch_secret
+    from dda.secrets.vault import fetch_secret
 
     return fetch_secret("group/subproduct-agent/deva", "telemetry-api-key")
 
 
 def fetch_client_token() -> str:
-    from dda.utils.secrets.vault import fetch_secret
+    from dda.secrets.vault import fetch_secret
 
     return fetch_secret("group/subproduct-agent/deva", "feature-flags-client-token")

src/dda/utils/secrets/secrets.py renamed to src/dda/secrets/api.py

@@ -14,10 +14,10 @@
 import psutil
 import watchfiles
 
+from dda.secrets.api import fetch_api_key, read_api_key, save_api_key
 from dda.telemetry.constants import DaemonEnvVars
 from dda.telemetry.daemon.handler import finalize_error
 from dda.utils.fs import Path
-from dda.utils.secrets.secrets import fetch_api_key, read_api_key, save_api_key
 
 if TYPE_CHECKING:
     from collections.abc import AsyncIterator

src/dda/utils/secrets/vault.py renamed to src/dda/secrets/vault.py

@@ -7,7 +7,7 @@
 from functools import cached_property
 from typing import TYPE_CHECKING
 
-from dda.utils.user import User
+from dda.user.datadog import User
 
 if TYPE_CHECKING:
     from dda.cli.application import Application
@@ -78,7 +78,7 @@ def api_key(self) -> str | None:
 
         from contextlib import suppress
 
-        from dda.utils.secrets.secrets import fetch_api_key, read_api_key, save_api_key
+        from dda.secrets.api import fetch_api_key, read_api_key, save_api_key
 
         api_key: str | None = None
         with suppress(Exception):

src/dda/telemetry/daemon/__main__.py

@@ -0,0 +1,3 @@
+# SPDX-FileCopyrightText: 2025-present Datadog, Inc. <[email protected]>
+#
+# SPDX-License-Identifier: MIT