fix: Keep booleans and numbers distinct in the in operator

Python's bool is a subclass of int, so True == 1 and False == 0. This
caused the in clause operator to match boolean context values against
numeric clause values (and vice versa), e.g. a context where tier is
True incorrectly matched a rule checking tier in [1].

The in operator now rejects a match when exactly one side is a bool,
keeping boolean and numeric JSON values distinct while still matching
True == True and False == False.

Author: keelerm84

ldclient/impl/operators.py

@@ -37,6 +37,10 @@ def _semver_operator(clause_preprocessed: Optional[ClausePreprocessedValue], con
 
 
 def _in(context_value: Any, clause_value: Any, clause_preprocessed: Optional[ClausePreprocessedValue]) -> bool:
+    # bool is a subtype of int in Python, so True == 1 and False == 0. A value should only match a
+    # clause value of the same JSON type, so a boolean and a number must never be considered equal.
+    if isinstance(context_value, bool) != isinstance(clause_value, bool):
+        return False
     return context_value == clause_value
 
 

ldclient/testing/impl/test_operators.py

@@ -33,6 +33,17 @@
         ["endsWith", "z", "xyz", False],
         ["contains", "xyz", "y", True],
         ["contains", "y", "xyz", False],
+        # booleans and numbers must remain distinct (bool is a subtype of int in Python)
+        ["in", True, True, True],
+        ["in", False, False, True],
+        ["in", True, 1, False],
+        ["in", 1, True, False],
+        ["in", True, 1.0, False],
+        ["in", 1.0, True, False],
+        ["in", False, 0, False],
+        ["in", 0, False, False],
+        ["in", False, 0.0, False],
+        ["in", 0.0, False, False],
         # mixed strings and numbers
         ["in", "99", 99, False],
         ["in", 99, "99", False],