Skip to content

gate the manual verification flow on the open case, not flipper - #350

Open
leowilkin wants to merge 3 commits into
mainfrom
claude/flipper-actor-limit-exceeded-c96272
Open

leowilkin wants to merge 3 commits into
mainfrom
claude/flipper-actor-limit-exceeded-c96272

Conversation

@leowilkin

@leowilkin leowilkin commented Oct 25, 2026 •

Copy link
Copy Markdown
Member

what happened

opening a verification case 500'd in production with
Flipper::Adapters::ActorLimit::LimitExceeded: Actor limit of 100 exceeded for feature manual_verification_call_2026_07_03 — flipper 1.3+ caps stored actors at 100 per feature because every enabled? check loads the whole set.

the fix

the flag was only ever a hand-synced mirror of "this identity has an open case": enabled on case open, revoked on approve/deny/withdraw, and checked right next to an open-case lookup at both call sites. so, per review, flipper is out of this flow entirely:

  • redirect_to_open_manual_case and set_case gate directly on verification_cases.open_cases (one indexed exists?)
  • enable_flag! / revoke_flag! / close_out! and their aasm hooks are gone; the backend create action no longer touches flipper
  • the feature's entry is gone from flipper_features.yml
  • no migration — flipper state is ops data, so the dead feature and its stored actors get deleted from the flipper UI after this merges

the trade: no flipper kill switch for the flow anymore — turning it off means a deploy (or withdrawing the open cases).

after merging

  • delete manual_verification_call_2026_07_03 in the flipper UI (housekeeping only; nothing reads it once this deploys)
  • the outage left open cases whose creation committed but then 500'd before the invitation email was sent — they sit in requested with no link. this change gives them access automatically (their case is open), but staff should resend the link on each: VerificationCase.where(status: "requested", link_sent_at: nil)

testing

  • the three touched spec files: 98 examples, 0 failures (run with -P isolation; CI runs no rspec)
  • rubocop and brakeman clean

opening a case enabled a stored flipper actor per identity, which hit
flipper's 100-actor cap and 500'd case creation
(Flipper::Adapters::ActorLimit::LimitExceeded). the actor list was a
hand-synced mirror of "identities with an open case", so membership is
now the :has_open_verification_case group, computed from the cases
table — nothing per-actor to enable, revoke, or leak. a data migration
enables the group once and drops the stored actors.
@leowilkin
leowilkin requested a review from 24c02 October 25, 2026 19:27
@24c02

24c02 commented Oct 25, 2026 via email

Copy link
Copy Markdown
Member

per review: the flag was only ever a hand-synced mirror of "identity
has an open case", so gate directly on that instead. the migration now
removes the feature and its ~100 stored actors (which had hit flipper's
100-actor cap and 500'd case creation).
@leowilkin leowilkin changed the title replace manual-verification flag actors with a computed flipper group gate the manual verification flow on the open case, not flipper Oct 25, 2026
@leowilkin

leowilkin commented Oct 25, 2026 •

Copy link
Copy Markdown
Member Author

mm.. not a flipper anymore

@24c02

24c02 commented Oct 25, 2026 via email

Copy link
Copy Markdown
Member

per review: flipper state is ops data, not schema — the dead feature and
its stored actors get deleted from the flipper UI instead.
@leowilkin

Copy link
Copy Markdown
Member Author

we already gate the feature based on who we invite through the admin UI, so I don't think it needs a feature-wide flipper. and... yes the migration is gone. it was removing the flipper flag from the db, but I can do that myself, or.. just not do it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants