Flagsmith / Flagsmith/flagsmith
API accepts multivariate percentage splits over 100%
- Dominant language
- Python
- Stars
- 6.6k
- Forks
- 567
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 121
Description
### How are you running Flagsmith
- [x] SaaS at flagsmith.com
### Describe the bug
When a feature state ends up with `MultivariateFeatureStateValue.percentage_allocation` rows summing to more than 100%, [`process_environment_update`](https://github.com/Flagsmith/flagsmith/blob/dca4942a23acb60df3bb0d2764d266152727be6d/api/environments/tasks.py#L31-L44) fails when [`map_feature_state_to_engine`](https://github.com/Flagsmith/flagsmith/blob/dca4942a23acb60df3bb0d2764d266152727be6d/api/util/mappers/engine.py#L153) raises a Pydantic `ValidationError` from `FeatureStateModel`. While that state persists, the environment document on DynamoDB is never rewritten, so the Edge API keeps serving the previous value of every flag in that environment regardless of what the dashboard shows.
### Acceptance criteria
- It is not possible to leave a feature state's `MultivariateFeatureStateValue.percentage_allocation` rows summing to more than 100% in the database, by any means.
### How to reproduce
There is one [observed case](https://flagsmith.sentry.io/issues/7015694923/) in production, with unclear reproduction steps. I was able to reproduce it in the API via `mv-options`:
1. Pick a feature whose env-default feature state already has multivariate percentage allocations summing to 100%.
2. `POST /api/v1/projects//features//mv-options/` with a body whose `default_percentage_allocation` is greater than zero.
3. `GET /api/v1/environments//featurestates/?feature=` and observe the env-default feature state's `multivariate_feature_state_values` now summing to more than 100%.
In the above screenshot, the dashboard displays the faulty MV setup, with an error message, when it already exists.
Contributor guide
Assessment
This issue has not been assessed yet.