Fetch Feature Flag with call to Feature Flag Gateway Api

cliv2/go.mod

@@ -15,8 +15,8 @@ require (
 	github.com/snyk/cli-extension-iac v0.0.0-20260206082514-00c443ccee80
 	github.com/snyk/cli-extension-iac-rules v0.0.0-20260206080712-9cbb5f95465d
 	github.com/snyk/cli-extension-mcp-scan v0.0.0-20260205184045-13a21a9b38c4
-	github.com/snyk/cli-extension-os-flows v0.0.0-20260202092920-2b2a978a1e44
-	github.com/snyk/cli-extension-sbom v0.0.0-20260123101300-130043bcdc06
+	github.com/snyk/cli-extension-os-flows v0.0.0-20260204163905-d454493d2360
+	github.com/snyk/cli-extension-sbom v0.0.0-20260210090350-fdca20d5a98d
 	github.com/snyk/cli-extension-secrets v0.0.0-20260203145315-1a9eb913d2f0
 	github.com/snyk/container-cli v0.0.0-20250321132345-1e2e01681dd7
 	github.com/snyk/error-catalog-golang-public v0.0.0-20260205094614-116c03822905
@@ -287,4 +287,6 @@ replace github.com/mattn/go-localereader v0.0.1 => github.com/mattn/go-localerea
 
 // replace github.com/snyk/cli-extension-mcp-scan => ../../cli-extension-mcp-scan
 
+// replace github.com/snyk/cli-extension-sbom => ../../cli-extension-sbom
+
 // replace github.com/snyk/cli-extension-secrets => ../../cli-extension-secrets

cliv2/go.sum

@@ -541,10 +541,10 @@ github.com/snyk/cli-extension-iac-rules v0.0.0-20260206080712-9cbb5f95465d h1:xk
 github.com/snyk/cli-extension-iac-rules v0.0.0-20260206080712-9cbb5f95465d/go.mod h1:ztpTmC4n8MEO0B48M2nL/Q9tb6CkLZ61ZKZbjwhOKRo=
 github.com/snyk/cli-extension-mcp-scan v0.0.0-20260205184045-13a21a9b38c4 h1:NLo25mu6h56KX0bgYAhvrzvMOzxz/L/whqZhiptZfEU=
 github.com/snyk/cli-extension-mcp-scan v0.0.0-20260205184045-13a21a9b38c4/go.mod h1:i/EDskKxg68MtWaIOWFyataAMtcXOb/DQPLxT5jtLRE=
-github.com/snyk/cli-extension-os-flows v0.0.0-20260202092920-2b2a978a1e44 h1:TSnn2lDTtKxqm5JQrjVO5UTlDHCj3MQSP44dZlW2ulQ=
-github.com/snyk/cli-extension-os-flows v0.0.0-20260202092920-2b2a978a1e44/go.mod h1:s3HX7yjdyP5PYe+ZTMyrJA5wv6hCnmfGdh7Nk5la6tY=
-github.com/snyk/cli-extension-sbom v0.0.0-20260123101300-130043bcdc06 h1:qXcnwF3v9IobQzfEpUMTvm/+qlW6I/6QuTjf2o008G4=
-github.com/snyk/cli-extension-sbom v0.0.0-20260123101300-130043bcdc06/go.mod h1:nP8zYxLD7/dfbmfeVt+QJRjOK9LJ9+fKieY/Ph/iYb4=
+github.com/snyk/cli-extension-os-flows v0.0.0-20260204163905-d454493d2360 h1:R5Nu0PJvABfphPQAvZua8wvmSZdVHtLc5rDTtY2+kUY=
+github.com/snyk/cli-extension-os-flows v0.0.0-20260204163905-d454493d2360/go.mod h1:+fWqxiaIYf/fkszK5Iao+9sVf3KZUvmHIG7gtSb6eo0=
+github.com/snyk/cli-extension-sbom v0.0.0-20260210090350-fdca20d5a98d h1:fBtRjn/EzfOy6PUyCTlfZZCMbCC+wf80sNAhWEcUF6I=
+github.com/snyk/cli-extension-sbom v0.0.0-20260210090350-fdca20d5a98d/go.mod h1:OT3GJa4+cbCV8bq3cKtwe2ELHBHRWQb2DkHdyeG8TL4=
 github.com/snyk/cli-extension-secrets v0.0.0-20260203145315-1a9eb913d2f0 h1:LjYHZ+MnBJ9IT/zgU2qCq8+YS2qJFrKJMejOdFC6vCA=
 github.com/snyk/cli-extension-secrets v0.0.0-20260203145315-1a9eb913d2f0/go.mod h1:vj0PtB7L3tdiVLFDJtMuklDIjOBQdzoKQulnMv8/M/c=
 github.com/snyk/code-client-go v1.25.0 h1:1lcg6asMpMWwpaZLKVDdci3OrAv6rRoCsCcT8Ci/fUI=

cliv2/internal/proxy/interceptor/legacyfeatureflaginterceptor.go

@@ -0,0 +1,78 @@
+package interceptor
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"regexp"
+
+	"github.com/elazarl/goproxy"
+	"github.com/snyk/go-application-framework/pkg/workflow"
+)
+
+const FeatureFlagShowMavenBuildScope = "internal_snyk_show_maven_scope_enabled"
+const FeatureFlagShowNpmBuildScope = "internal_snyk_show_npm_scope_enabled"
+
+type legacyFeatureFlagInterceptor struct {
+	requestCondition goproxy.ReqCondition
+	invocationCtx    workflow.InvocationContext
+}
+
+type featureFlagResponse struct {
+	OK bool `json:"ok"`
+}
+
+func (ni legacyFeatureFlagInterceptor) GetCondition() goproxy.ReqCondition {
+	return ni.requestCondition
+}
+
+// GetHandler for legacyFeatureFlagInterceptor will re-route all registry requests from the proxy to the configured feature flag values.
+// This ensures that we can control feature flag values for the legacy CLI from the CLIv2 configuration.
+// Currently, only the "show-maven-build-scope" and "show-npm-scope" feature flags are supported.
+func (ni legacyFeatureFlagInterceptor) GetHandler() goproxy.FuncReqHandler {
+	return func(req *http.Request, proxyCtx *goproxy.ProxyCtx) (*http.Request, *http.Response) {
+		ni.invocationCtx.GetEnhancedLogger().Printf("legacyFeatureFlagInterceptor handling request for %s", req.URL.Path)
+		var configKey string
+		switch req.URL.Path {
+		case "/v1/cli-config/feature-flags/show-maven-build-scope":
+			configKey = FeatureFlagShowMavenBuildScope
+		case "/v1/cli-config/feature-flags/show-npm-scope":
+			configKey = FeatureFlagShowNpmBuildScope
+		default:
+			return req, nil
+		}
+
+		enabled := ni.invocationCtx.
+			GetConfiguration().
+			GetBool(configKey)
+
+		payload := featureFlagResponse{OK: enabled}
+		b, err := json.Marshal(payload)
+		if err != nil {
+			return req, nil
+		}
+
+		resp := &http.Response{
+			StatusCode: http.StatusOK,
+			Status:     "200 OK",
+			Header:     make(http.Header),
+			Body:       io.NopCloser(bytes.NewReader(b)),
+			Request:    req,
+		}
+		resp.Header.Set("Content-Type", "application/json")
+		ni.invocationCtx.GetEnhancedLogger().Printf("legacyFeatureFlagInterceptor response for %s is %v", configKey, enabled)
+
+		return req, resp
+	}
+}
+
+func NewLegacyFeatureFlagInterceptor(invocationCtx workflow.InvocationContext) Interceptor {
+	i := legacyFeatureFlagInterceptor{
+		requestCondition: goproxy.UrlMatches(
+			regexp.MustCompile(`/cli-config/feature-flags/(show-maven-build-scope|show-npm-scope)/?(?:\?.*)?$`),
+		),
+		invocationCtx: invocationCtx,
+	}
+	return i
+}

cliv2/internal/proxy/interceptor/legacyfeatureflaginterceptor_test.go

@@ -0,0 +1,96 @@
+package interceptor
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/rs/zerolog"
+	"github.com/snyk/go-application-framework/pkg/mocks"
+
+	"github.com/elazarl/goproxy"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLegacyFeatureFlagInterceptor_Routing(t *testing.T) {
+	tests := []struct {
+		name         string
+		path         string
+		shouldHandle bool
+		configKey    string // only used when shouldHandle == true
+	}{
+		{
+			name:         "maven path",
+			path:         "https://example.com/v1/cli-config/feature-flags/show-maven-build-scope?org=abc",
+			shouldHandle: true,
+			configKey:    FeatureFlagShowMavenBuildScope,
+		},
+		{
+			name:         "npm path",
+			path:         "https://example.com/v1/cli-config/feature-flags/show-npm-scope?org=abc",
+			shouldHandle: true,
+			configKey:    FeatureFlagShowNpmBuildScope,
+		},
+		{
+			name:         "other path",
+			path:         "https://example.com/api/v1/other-endpoint",
+			shouldHandle: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctrl := gomock.NewController(t)
+			defer ctrl.Finish()
+
+			configMock := mocks.NewMockConfiguration(ctrl)
+
+			// Only expect config access when the interceptor should handle the path.
+			if tt.shouldHandle {
+				configMock.EXPECT().
+					GetBool(tt.configKey).
+					Return(true).
+					AnyTimes()
+			}
+
+			invocationCtxMock := mocks.NewMockInvocationContext(ctrl)
+			invocationCtxMock.EXPECT().
+				GetConfiguration().
+				Return(configMock).
+				AnyTimes()
+
+			interceptor := NewLegacyFeatureFlagInterceptor(invocationCtxMock)
+			handler := interceptor.GetHandler()
+
+			req := httptest.NewRequest(http.MethodGet, tt.path, nil)
+			proxyCtx := &goproxy.ProxyCtx{}
+
+			matched := interceptor.GetCondition().HandleReq(req, proxyCtx)
+			assert.Equal(t, tt.shouldHandle, matched)
+
+			if !tt.shouldHandle {
+				return
+			}
+
+			logger := zerolog.Nop()
+			invocationCtxMock.EXPECT().GetEnhancedLogger().Return(&logger).AnyTimes()
+
+			_, resp := handler(req, proxyCtx)
+			assert.NotNil(t, resp)
+			defer func() { _ = resp.Body.Close() }()
+
+			assert.Equal(t, http.StatusOK, resp.StatusCode)
+			assert.Equal(t, "application/json", resp.Header.Get("Content-Type"))
+
+			bodyBytes, err := io.ReadAll(resp.Body)
+			assert.NoError(t, err)
+
+			var parsed featureFlagResponse
+			assert.NoError(t, json.Unmarshal(bodyBytes, &parsed))
+			assert.True(t, parsed.OK)
+		})
+	}
+}

cliv2/pkg/basic_workflows/legacycli.go

@@ -190,6 +190,7 @@ func createInternalProxy(config configuration.Configuration, debugLogger *zerolo
 	}
 
 	wrapperProxy.RegisterInterceptor(interceptor.NewV1AnalyticsInterceptor(invocation))
+	wrapperProxy.RegisterInterceptor(interceptor.NewLegacyFeatureFlagInterceptor(invocation))
 	// The networkinjector intercepts all requests from the legacy CLI and re-routes them to the existing networking
 	// layer. It should therefore be kept as the last interceptor in the chain, as it circuit breaks goproxy's own
 	// routing. Any interceptor added later will not be called.