Skip to content

feat(user-access-policy): browser match dimension for access rules - #3162

Merged
HughParry merged 4 commits into
mainfrom
feat/2095-browser-restriction
Sep 1, 2026
Merged

feat(user-access-policy): browser match dimension for access rules#3162
HughParry merged 4 commits into
mainfrom
feat/2095-browser-restriction

Conversation

@HughParry

Copy link
Copy Markdown
Contributor

No description provided.

Mirrors the existing `os` dimension: rules can now be scoped to the browser
classified server-side from the request User-Agent, so a customer can restrict
their captcha traffic to the browsers their app supports.

Also adds `os` and `browser` to the Redis split-query scalar field list.
`SCALAR_USER_SCOPE_FIELDS` there was never updated when the OS dimension landed
a week earlier, so an OS-only rule emitted no probe of its own and was reachable
only via the `no-user-scope` fall-through — sharing that probe's candidate
budget with genuine client-wide blocks.
@HughParry

Copy link
Copy Markdown
Contributor Author

Not ready for review — still watching CI.

@HughParry

Copy link
Copy Markdown
Contributor Author

Verified end to end on a local stack (provider + portal + demo, Mongo/Redis in docker):

  • A browser: firefox Block rule seeded in Mongo synced through the job pipeline to Redis and fanned out across all four demo site keys.
  • Against the provider's frictionless endpoint on the demo site key: a Firefox User-Agent gets 403 Forbidden at the block middleware, while Chrome and Safari pass it and reach the handler.

Also corrects a claim in the changeset: I'd written that the Redis index needs rebuilding on deploy. It does not — createRedisIndex hashes the index definition and drops/recreates when it changes. Confirmed locally: after the schema change the index came back carrying the browser TAG field and the stored hash moved to match. Changeset updated.

HughParry and others added 2 commits September 1, 2026 16:27
Keeps only what the code cannot say: why the classifier is duplicated rather
than imported, why its branch order matters, why the request scope populates
browser unconditionally, and what the split-query probe test is guarding.
@HughParry
HughParry enabled auto-merge (squash) September 1, 2026 16:01
@HughParry
HughParry merged commit 7fd6eb2 into main Sep 1, 2026
12 checks passed
@HughParry
HughParry deleted the feat/2095-browser-restriction branch September 1, 2026 16:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant