Flagsmith / Flagsmith/flagsmith
fix: _validate_owner_removal counts request IDs instead of actual existing owners
- Dominant language
- Python
- Stars
- 6.6k
- Forks
- 567
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 121
Description
### How are you running Flagsmith
- [ ] SaaS at flagsmith.com
### Describe the bug
When enforce_feature_owners is enabled, _validate_owner_removal validates whether removing feature owners would leave the feature with zero owners. It uses the **count of IDs in the request** rather than the count of IDs that **actually exist as owners** on the feature.
The group owner serializer (FeatureGroupOwnerInputSerializer) does not validate that group IDs exist before processing, so non-existent group IDs pass through to _validate_owner_removal and inflate the removal count. This causes the validation to incorrectly block legitimate operations.
> **Note:** The user owner serializer (UserIdsSerializer) already validates all IDs exist before the view runs, so this bug is only reachable via the group owner endpoint.
### Steps To Reproduce
1. Create a project with enforce_feature_owners = True
2. Create a feature with 1 user owner and 1 group owner
3. Call POST /api/v1/projects/{id}/features/{id}/remove-group-owners/ with {"group_ids": [group_id, 999999]}
4. **Expected**: 200 OK - the real group is removed, user owner remains
5. **Actual**: 400 Bad Request - validation calculates 1 + 1 - 2 = 0 and rejects
### Expected behavior
The endpoint should filter requested IDs against actual existing owners before counting. Non-existent group IDs should not inflate the removal count.
### Additional context
- Frontend sends stale group IDs after a concurrent group removal
- API consumers build group ID lists from cached data that is slightly outdated
- Bulk operations that include IDs from different features
Related PR: #8032
Contributor guide
Research direction
Start at _validate_owner_removal and FeatureGroupOwnerInputSerializer, then reproduce the group-owner removal request with one valid and one nonexistent group ID. Check the related PR #8032 and the group owner endpoint behavior; done means nonexistent IDs no longer affect owner-count validation and the documented request returns 200 while preserving remaining owners.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 40/100