feat: separate superposition for provider

Author: yuvrajjsingh0

README.md

@@ -309,9 +309,10 @@ For current Keycloak-backed authorization, `AUTH_ADMIN_ISSUER` must be a Keycloa
 
 | Variable | Required | Encrypted | Default | Description |
 |----------|----------|-----------|---------|-------------|
-| `SUPERPOSITION_URL` | Yes | No | - | Superposition service URL |
+| `SUPERPOSITION_URL` | Yes | No | - | Superposition service URL (control-plane calls) |
+| `SUPERPOSITION_RC_URL` | No | No | `SUPERPOSITION_URL` | Superposition service URL used to serve release config |
 | `SUPERPOSITION_ORG_ID` | Yes | No | - | Organization ID in Superposition |
-| `SUPERPOSITION_TOKEN` | No | **Yes** | - | Superposition API token |
+| `SUPERPOSITION_TOKEN` | No | **Yes** | - | Bearer token used to serve release config from `SUPERPOSITION_RC_URL` (for authenticated mode) |
 | `SUPERPOSITION_USER_TOKEN` | No | **Yes** | - | Superposition user token (for authenticated mode) |
 | `SUPERPOSITION_ORG_TOKEN` | No | **Yes** | - | Superposition organization token (for authenticated mode) |
 | `ENABLE_AUTHENTICATED_SUPERPOSITION` | No | No | `false` | Enable authenticated Superposition calls |

airborne_docs/docs/server/configuration.md

@@ -113,20 +113,23 @@ Authorization uses Casbin, with policies persisted in Postgres. These variables
 
 Airborne uses Superposition as its configuration/feature-flag engine for dimensions and release targeting. The base URL and org id are required; the token variables are only needed when Superposition is run in authenticated mode.
 
+Airborne talks to Superposition through two independent paths, which may point at two different deployments. Control-plane writes (dimensions, releases, experiments) go through the Superposition SDK client at `SUPERPOSITION_URL` and authenticate with a cookie built from `SUPERPOSITION_USER_TOKEN` and `SUPERPOSITION_ORG_TOKEN`. Release-config serving (`/release`) resolves live against `SUPERPOSITION_RC_URL` through the provider registry, which authenticates with the `SUPERPOSITION_TOKEN` bearer token.
+
 | Variable | Required | Default / Example | Purpose |
 | --- | --- | --- | --- |
-| `SUPERPOSITION_URL` | **Yes** | `http://localhost:8080` | Base URL of the Superposition service. |
+| `SUPERPOSITION_URL` | **Yes** | `http://localhost:8080` | Base URL of the Superposition service used for control-plane calls (dimensions, releases, experiments). |
+| `SUPERPOSITION_RC_URL` | No | _(falls back to `SUPERPOSITION_URL`)_ | Base URL of the Superposition service that release-config serving (`/release`) resolves against. Set this to point RC serving at a separate Superposition deployment. |
 | `SUPERPOSITION_ORG_ID` | **Yes** | `get-org-id-from-superposition` | Superposition organisation id. Populated by `init-superposition.sh` in dev. |
-| `ENABLE_AUTHENTICATED_SUPERPOSITION` | No | `false` | When `true`, the Superposition SDK client sends auth tokens/cookies; this makes the three token variables below mandatory. |
-| `SUPERPOSITION_TOKEN` | Conditional (secret) | _(unset)_ | Bearer token for Superposition. Used as the SDK bearer token (empty string if unset). |
-| `SUPERPOSITION_USER_TOKEN` | Conditional (secret) | _(unset)_ | User cookie token. **Required when `ENABLE_AUTHENTICATED_SUPERPOSITION=true`** (panics if missing in that mode). |
-| `SUPERPOSITION_ORG_TOKEN` | Conditional (secret) | _(unset)_ | Org cookie token. **Required when `ENABLE_AUTHENTICATED_SUPERPOSITION=true`** (panics if missing in that mode). |
+| `ENABLE_AUTHENTICATED_SUPERPOSITION` | No | `false` | When `true`, Superposition calls are authenticated; this makes the three token variables below mandatory. |
+| `SUPERPOSITION_TOKEN` | Conditional (secret) | _(unset)_ | Bearer token used by the release-config provider registry against `SUPERPOSITION_RC_URL`. **Required when `ENABLE_AUTHENTICATED_SUPERPOSITION=true`** (panics if missing in that mode). |
+| `SUPERPOSITION_USER_TOKEN` | Conditional (secret) | _(unset)_ | User cookie token for the SDK client against `SUPERPOSITION_URL`. **Required when `ENABLE_AUTHENTICATED_SUPERPOSITION=true`** (panics if missing in that mode). |
+| `SUPERPOSITION_ORG_TOKEN` | Conditional (secret) | _(unset)_ | Org cookie token for the SDK client against `SUPERPOSITION_URL`. **Required when `ENABLE_AUTHENTICATED_SUPERPOSITION=true`** (panics if missing in that mode). |
 | `SUPERPOSITION_CLEAR_UNUSED_PROVIDERS` | No | `false` | When `true`, a background task evicts idle per-workspace Superposition providers (see below). When `false`, providers live for the process lifetime. |
 | `SUPERPOSITION_UNUSED_PROVIDER_TTL` | No | `43200` | Idle time, in seconds, after which an unused workspace provider is evicted. Only applied when eviction is enabled. Default is 12 hours. |
 | `SUPERPOSITION_UNUSED_PROVIDER_CHECK_INTERVAL` | No | `1500` | How often, in seconds, the eviction sweep runs. Only applied when eviction is enabled. Default is 25 minutes. |
 | `SUPERPOSITION_MIGRATION_STRATEGY` | No | `PATCH` | Strategy used when reconciling Superposition default configs during the `superposition` boot migration. |
 
-Airborne serves release config by resolving each workspace's (organisation + application) configuration live against the Superposition API. To avoid re-creating the SDK client on every request, the server caches one provider per workspace in an in-memory registry. Enabling `SUPERPOSITION_CLEAR_UNUSED_PROVIDERS` starts a background sweep that drops providers that have not been accessed within `SUPERPOSITION_UNUSED_PROVIDER_TTL`, checked every `SUPERPOSITION_UNUSED_PROVIDER_CHECK_INTERVAL`. This bounds memory on servers hosting many rarely-served workspaces.
+Airborne serves release config by resolving each workspace's (organisation + application) configuration live against the Superposition API at `SUPERPOSITION_RC_URL`. To avoid re-creating the SDK client on every request, the server caches one provider per workspace in an in-memory registry. Enabling `SUPERPOSITION_CLEAR_UNUSED_PROVIDERS` starts a background sweep that drops providers that have not been accessed within `SUPERPOSITION_UNUSED_PROVIDER_TTL`, checked every `SUPERPOSITION_UNUSED_PROVIDER_CHECK_INTERVAL`. This bounds memory on servers hosting many rarely-served workspaces.
 
 :::warning[Use the plural env-var name]
 The server reads `SUPERPOSITION_CLEAR_UNUSED_PROVIDERS` (**plural**). The bundled `.env.example` currently writes it as `SUPERPOSITION_CLEAR_UNUSED_PROVIDER` (singular), which the server **ignores** — so a value set on the singular key has no effect. Always set the plural name.

airborne_server/.env.example

@@ -9,8 +9,6 @@ ENABLE_AUTHENTICATED_SUPERPOSITION=false
 SUPERPOSITION_TOKEN=
 SUPERPOSITION_USER_TOKEN=
 SUPERPOSITION_ORG_TOKEN=
-SUPERPOSITION_RC_USER_TOKEN=
-SUPERPOSITION_RC_ORG_TOKEN=
 
 # AuthN provider settings
 # AUTHN_PROVIDER can be "keycloak" (default), "oidc", "okta", or "auth0"

airborne_server/README.md

@@ -321,12 +321,11 @@ The server relies on a set of environment variables for its configuration. These
 - `AUTH_ADMIN_SCOPES`: Optional space-separated scopes (commonly used for Okta/Auth0).
 - `AUTH_ADMIN_ISSUER`: Issuer URL used to derive Keycloak admin realm/base URL (`.../realms/<realm>`). Required for Keycloak signup/import flows.
 - `SUPERPOSITION_URL`: URL of the Superposition service.
-- `SUPERPOSITION_RC_URL`: URL of the Superposition service used by RC (`/release`) endpoints. Defaults to `SUPERPOSITION_URL` when unset.
-- `ENABLE_AUTHENTICATED_SUPERPOSITION`: Enables cookie-based auth for Superposition SDK requests.
-- `SUPERPOSITION_USER_TOKEN`: User token for Superposition auth cookie (`user=...`).
-- `SUPERPOSITION_ORG_TOKEN`: Org token for Superposition auth cookie (`org_<SUPERPOSITION_ORG_ID>=...`).
-- `SUPERPOSITION_RC_USER_TOKEN`: RC-specific user token for auth cookie; defaults to `SUPERPOSITION_USER_TOKEN` when unset.
-- `SUPERPOSITION_RC_ORG_TOKEN`: RC-specific org token for auth cookie; defaults to `SUPERPOSITION_ORG_TOKEN` when unset.
+- `SUPERPOSITION_RC_URL`: URL of the Superposition service that release-config (`/release`) serving resolves against. Defaults to `SUPERPOSITION_URL` when unset.
+- `ENABLE_AUTHENTICATED_SUPERPOSITION`: Enables authenticated Superposition calls (cookie auth for the SDK client, bearer auth for the release-config provider).
+- `SUPERPOSITION_USER_TOKEN`: User token for Superposition auth cookie (`user=...`), used by the SDK client against `SUPERPOSITION_URL`.
+- `SUPERPOSITION_ORG_TOKEN`: Org token for Superposition auth cookie (`org_<SUPERPOSITION_ORG_ID>=...`), used by the SDK client against `SUPERPOSITION_URL`.
+- `SUPERPOSITION_TOKEN`: Bearer token used by the release-config provider registry against `SUPERPOSITION_RC_URL`.
 - `SUPERPOSITION_ORG_ID`: The organization ID within Superposition used by the server.
 - `AWS_BUCKET`: Name of the S3 bucket for storing package assets.
 - `PUBLIC_ENDPOINT`: The public-facing URL for accessing assets stored in S3.

airborne_server/scripts/encrypt-envs.sh

@@ -125,26 +125,12 @@ upsert_env_raw() {
 
 sync_superposition_rc_env_defaults() {
     local superposition_url superposition_rc_url
-    local superposition_user_token superposition_rc_user_token
-    local superposition_org_token superposition_rc_org_token
 
     superposition_url=$(read_env_raw "SUPERPOSITION_URL")
     superposition_rc_url=$(read_env_raw "SUPERPOSITION_RC_URL")
     if is_value_empty "$superposition_rc_url"; then
         upsert_env_raw "SUPERPOSITION_RC_URL" "$superposition_url"
     fi
-
-    superposition_user_token=$(read_env_raw "SUPERPOSITION_USER_TOKEN")
-    superposition_rc_user_token=$(read_env_raw "SUPERPOSITION_RC_USER_TOKEN")
-    if is_value_empty "$superposition_rc_user_token"; then
-        upsert_env_raw "SUPERPOSITION_RC_USER_TOKEN" "$superposition_user_token"
-    fi
-
-    superposition_org_token=$(read_env_raw "SUPERPOSITION_ORG_TOKEN")
-    superposition_rc_org_token=$(read_env_raw "SUPERPOSITION_RC_ORG_TOKEN")
-    if is_value_empty "$superposition_rc_org_token"; then
-        upsert_env_raw "SUPERPOSITION_RC_ORG_TOKEN" "$superposition_org_token"
-    fi
 }
 
 # Function to encrypt a value using AES-GCM
@@ -187,8 +173,6 @@ SECRETS=(
     "SUPERPOSITION_TOKEN"
     "SUPERPOSITION_USER_TOKEN"
     "SUPERPOSITION_ORG_TOKEN"
-    "SUPERPOSITION_RC_USER_TOKEN"
-    "SUPERPOSITION_RC_ORG_TOKEN"
     "GOOGLE_SERVICE_ACCOUNT_KEY"
 )
 

airborne_server/scripts/init-localstack.sh

@@ -159,26 +159,12 @@ is_value_empty() {
 
 sync_superposition_rc_env_defaults() {
     local superposition_url superposition_rc_url
-    local superposition_user_token superposition_rc_user_token
-    local superposition_org_token superposition_rc_org_token
 
     superposition_url=$(read_env_value "SUPERPOSITION_URL")
     superposition_rc_url=$(read_env_value "SUPERPOSITION_RC_URL")
     if is_value_empty "$superposition_rc_url"; then
         upsert_env_var ".env" "SUPERPOSITION_RC_URL" "$superposition_url"
     fi
-
-    superposition_user_token=$(read_env_value "SUPERPOSITION_USER_TOKEN")
-    superposition_rc_user_token=$(read_env_value "SUPERPOSITION_RC_USER_TOKEN")
-    if is_value_empty "$superposition_rc_user_token"; then
-        upsert_env_var ".env" "SUPERPOSITION_RC_USER_TOKEN" "$superposition_user_token"
-    fi
-
-    superposition_org_token=$(read_env_value "SUPERPOSITION_ORG_TOKEN")
-    superposition_rc_org_token=$(read_env_value "SUPERPOSITION_RC_ORG_TOKEN")
-    if is_value_empty "$superposition_rc_org_token"; then
-        upsert_env_var ".env" "SUPERPOSITION_RC_ORG_TOKEN" "$superposition_org_token"
-    fi
 }
 
 sync_superposition_rc_env_defaults
@@ -220,8 +206,6 @@ SENSITIVE_VARS=(
     "SUPERPOSITION_TOKEN"
     "SUPERPOSITION_USER_TOKEN"
     "SUPERPOSITION_ORG_TOKEN"
-    "SUPERPOSITION_RC_USER_TOKEN"
-    "SUPERPOSITION_RC_ORG_TOKEN"
 )
 
 # Get values from .env.example or .env.generated

airborne_server/src/config.rs

@@ -67,8 +67,6 @@ pub struct AppConfig {
     pub superposition_token: Option<String>,
     pub superposition_user_token: Option<String>,
     pub superposition_org_token: Option<String>,
-    pub superposition_rc_user_token: Option<String>,
-    pub superposition_rc_org_token: Option<String>,
     pub enable_authenticated_superposition: bool,
     pub superposition_clear_unused_providers: bool,
     pub superposition_unused_provider_ttl: u64,
@@ -174,10 +172,6 @@ impl AppConfig {
         let superposition_token = get_optional_secret("SUPERPOSITION_TOKEN")?;
         let superposition_user_token = get_optional_secret("SUPERPOSITION_USER_TOKEN")?;
         let superposition_org_token = get_optional_secret("SUPERPOSITION_ORG_TOKEN")?;
-        let superposition_rc_user_token = get_optional_secret("SUPERPOSITION_RC_USER_TOKEN")?
-            .or_else(|| superposition_user_token.clone());
-        let superposition_rc_org_token = get_optional_secret("SUPERPOSITION_RC_ORG_TOKEN")?
-            .or_else(|| superposition_org_token.clone());
 
         Ok(AppConfig {
             // Server settings
@@ -229,8 +223,6 @@ impl AppConfig {
             superposition_token,
             superposition_user_token,
             superposition_org_token,
-            superposition_rc_user_token,
-            superposition_rc_org_token,
             enable_authenticated_superposition: parse_env(
                 "ENABLE_AUTHENTICATED_SUPERPOSITION",
                 false,

airborne_server/src/main.rs

@@ -246,8 +246,6 @@ async fn main() -> std::io::Result<()> {
             .expect("Failed to complete Keycloak -> Casbin import");
     }
 
-    let superposition_token = app_config.superposition_token.clone().unwrap_or_default();
-
     let dashboard_superposition_url = app_config.superposition_url.clone();
     let rc_superposition_url = app_config.superposition_rc_url.clone();
     let superposition_org_id_env = app_config.superposition_org_id.clone();
@@ -426,13 +424,6 @@ async fn main() -> std::io::Result<()> {
         "SUPERPOSITION_USER_TOKEN",
         "SUPERPOSITION_ORG_TOKEN",
     );
-    let rc_superposition_client = create_superposition_client(
-        rc_superposition_url,
-        app_config.superposition_rc_user_token.clone(),
-        app_config.superposition_rc_org_token.clone(),
-        "SUPERPOSITION_RC_USER_TOKEN or SUPERPOSITION_USER_TOKEN",
-        "SUPERPOSITION_RC_ORG_TOKEN or SUPERPOSITION_ORG_TOKEN",
-    );
 
     let authz_provider = build_authz_provider(
         authz_provider_kind,
@@ -460,16 +451,28 @@ async fn main() -> std::io::Result<()> {
         None
     };
 
-    let provider_url = cac_url + "/";
-    let provider_access_token = format!(
-        "user={}; org_{}={}",
-        app_config.superposition_rc_user_token.clone(), superposition_org_id_env, app_config.superposition_rc_org_token.clone(),
-    );
+    let provider_url = if rc_superposition_url.ends_with('/') {
+        rc_superposition_url.to_string()
+    } else {
+        format!("{rc_superposition_url}/")
+    };
+    // The provider registry authenticates with a bearer token (`AuthMethod::Token`);
+    // it has no hook for the auth cookie the Superposition SDK client uses.
+    let superposition_token = if app_config.enable_authenticated_superposition {
+        app_config.superposition_token.clone().expect(
+            "SUPERPOSITION_TOKEN must be set when ENABLE_AUTHENTICATED_SUPERPOSITION=true to use provider registry features",
+        )
+    } else {
+        app_config
+            .superposition_token
+            .clone()
+            .unwrap_or_else(|| "abcd".to_string())
+    };
 
     let provider_registry = Arc::new(ProviderRegistry::new(
         superposition_org_id_env.clone(),
-        superposition_token.clone(),
-        provider_url.clone(),
+        superposition_token,
+        provider_url,
     ));
 
     if app_config.superposition_clear_unused_providers {
@@ -495,7 +498,6 @@ async fn main() -> std::io::Result<()> {
         s3_client: aws_s3_client,
         cf_client: aws_cloudfront_client,
         superposition_client,
-        rc_superposition_client,
         sheets_hub: hub,
         provider_registry,
     });

airborne_server/src/release.rs

@@ -1248,8 +1248,7 @@ async fn serve_release(
     query: Query<ServeReleaseQueryParams>,
     state: web::Data<AppState>,
 ) -> airborne_types::Result<WithHeaders<Json<ServeReleaseResponse>>> {
-    let superposition_client = state.rc_superposition_client.clone();
-    serve_release_handler(path, req, query, state, superposition_client).await
+    serve_release_handler(path, req, query, state).await
 }
 
 #[get("v2/{organisation}/{application}")]
@@ -1259,8 +1258,7 @@ async fn serve_release_v2(
     query: Query<ServeReleaseQueryParams>,
     state: web::Data<AppState>,
 ) -> airborne_types::Result<WithHeaders<Json<ServeReleaseResponse>>> {
-    let superposition_client = state.rc_superposition_client.clone();
-    serve_release_handler(path, req, query, state, superposition_client).await
+    serve_release_handler(path, req, query, state).await
 }
 
 async fn get_release_config_from_provider(
@@ -1290,7 +1288,6 @@ async fn serve_release_handler(
     req: actix_web::HttpRequest,
     query: Query<ServeReleaseQueryParams>,
     state: web::Data<AppState>,
-    superposition_client: superposition_sdk::Client,
 ) -> airborne_types::Result<WithHeaders<Json<ServeReleaseResponse>>> {
     let (organisation, application) = path.into_inner();
 

airborne_server/src/types.rs

@@ -47,7 +47,6 @@ pub struct AppState {
     pub s3_client: aws_sdk_s3::Client,
     pub cf_client: aws_sdk_cloudfront::Client,
     pub superposition_client: Client,
-    pub rc_superposition_client: Client,
     pub sheets_hub: Option<
         Sheets<hyper_rustls::HttpsConnector<hyper_util::client::legacy::connect::HttpConnector>>,
     >,