refactor: add PROPERTY_OPERATORS constant for match_property (#448)

* feat: add semver targeting support to local flag evaluation

Implement 9 semver comparison operators (semver_eq, semver_neq, semver_gt, semver_gte, semver_lt, semver_lte, semver_tilde, semver_caret, semver_wildcard) for feature flag local evaluation. Uses regex-based parsing that matches the server-side sortableSemver behavior to handle v-prefix, whitespace, pre-release suffixes, and non-standard version formats.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

* fix: guard against ReDoS in semver regex parsing

Add input length limit before regex search to prevent polynomial
backtracking on adversarial input (CodeQL py/polynomial-redos).

* fix: replace regex with string parsing to resolve ReDoS warning

Replace SEMVER_EXTRACT_RE regex with simple string splitting to
eliminate nested quantifiers that CodeQL flagged as polynomial-redos.

* refactor: inline semver operator tuple to match existing patterns

* refactor: add PROPERTY_OPERATORS constant for match_property

Extract all operator strings into a single source-of-truth tuple and
validate against it early in match_property, replacing the fallthrough
at the end of the function.

* refactor: split PROPERTY_OPERATORS into composable sub-groups

Break the flat tuple into category-specific tuples (EQUALITY_OPERATORS,
STRING_OPERATORS, etc.) that compose into PROPERTY_OPERATORS via
concatenation. The semver dispatch code now references
SEMVER_OPERATORS and SEMVER_COMPARISON_OPERATORS instead of
repeating the full operator lists inline.

* fix: add unreachable fallthrough to satisfy mypy return check

* add release

---------

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

Author: dmarticus

.sampo/changesets/resolute-guardian-ilmarinen.md

@@ -0,0 +1,5 @@
+---
+pypi/posthog: patch
+---
+
+add PROPERTY_OPERATORS constant for match_property

posthog/feature_flags.py

@@ -18,6 +18,30 @@
 
 NONE_VALUES_ALLOWED_OPERATORS = ["is_not"]
 
+# All operators supported by match_property, grouped by category.
+EQUALITY_OPERATORS = ("exact", "is_not", "is_set", "is_not_set")
+STRING_OPERATORS = ("icontains", "not_icontains", "regex", "not_regex")
+NUMERIC_OPERATORS = ("gt", "gte", "lt", "lte")
+DATE_OPERATORS = ("is_date_before", "is_date_after")
+SEMVER_COMPARISON_OPERATORS = (
+    "semver_eq",
+    "semver_neq",
+    "semver_gt",
+    "semver_gte",
+    "semver_lt",
+    "semver_lte",
+)
+SEMVER_RANGE_OPERATORS = ("semver_tilde", "semver_caret", "semver_wildcard")
+SEMVER_OPERATORS = SEMVER_COMPARISON_OPERATORS + SEMVER_RANGE_OPERATORS
+
+PROPERTY_OPERATORS = (
+    EQUALITY_OPERATORS
+    + STRING_OPERATORS
+    + NUMERIC_OPERATORS
+    + DATE_OPERATORS
+    + SEMVER_OPERATORS
+)
+
 
 class InconclusiveMatchError(Exception):
     pass
@@ -385,6 +409,9 @@ def match_property(property, property_values) -> bool:
     operator = property.get("operator") or "exact"
     value = property.get("value")
 
+    if operator not in PROPERTY_OPERATORS:
+        raise InconclusiveMatchError(f"Unknown operator {operator}")
+
     if key not in property_values:
         raise InconclusiveMatchError(
             "can't match properties without a given property value"
@@ -505,32 +532,15 @@ def compare(lhs, rhs, operator):
                 "The date provided must be a string or date object"
             )
 
-    if operator in (
-        "semver_eq",
-        "semver_neq",
-        "semver_gt",
-        "semver_gte",
-        "semver_lt",
-        "semver_lte",
-        "semver_tilde",
-        "semver_caret",
-        "semver_wildcard",
-    ):
+    if operator in SEMVER_OPERATORS:
         try:
             override_parsed = parse_semver(override_value)
         except (ValueError, TypeError):
             raise InconclusiveMatchError(
                 f"Person property value '{override_value}' is not a valid semver"
             )
 
-        if operator in (
-            "semver_eq",
-            "semver_neq",
-            "semver_gt",
-            "semver_gte",
-            "semver_lt",
-            "semver_lte",
-        ):
+        if operator in SEMVER_COMPARISON_OPERATORS:
             try:
                 flag_parsed = parse_semver(value)
             except (ValueError, TypeError):
@@ -578,7 +588,8 @@ def compare(lhs, rhs, operator):
                 )
             return lower <= override_parsed < upper
 
-    # if we get here, we don't know how to handle the operator
+    # Unreachable: all operators in PROPERTY_OPERATORS are handled above,
+    # and unknown operators are rejected at the top of this function.
     raise InconclusiveMatchError(f"Unknown operator {operator}")