Flagsmith / Flagsmith/flagsmith

fix: _validate_owner_removal counts request IDs instead of actual existing owners

Open
#8,038 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
6.6k
Forks
567
Avg merge
1d 13h
Merged PRs (30d)
121

Description

### How are you running Flagsmith
- [ ] SaaS at flagsmith.com

### Describe the bug
When enforce_feature_owners is enabled, _validate_owner_removal validates whether removing feature owners would leave the feature with zero owners. It uses the **count of IDs in the request** rather than the count of IDs that **actually exist as owners** on the feature.

The group owner serializer (FeatureGroupOwnerInputSerializer) does not validate that group IDs exist before processing, so non-existent group IDs pass through to _validate_owner_removal and inflate the removal count. This causes the validation to incorrectly block legitimate operations.

> **Note:** The user owner serializer (UserIdsSerializer) already validates all IDs exist before the view runs, so this bug is only reachable via the group owner endpoint.

### Steps To Reproduce
1. Create a project with enforce_feature_owners = True
2. Create a feature with 1 user owner and 1 group owner
3. Call POST /api/v1/projects/{id}/features/{id}/remove-group-owners/ with {"group_ids": [group_id, 999999]}
4. **Expected**: 200 OK - the real group is removed, user owner remains
5. **Actual**: 400 Bad Request - validation calculates 1 + 1 - 2 = 0 and rejects

### Expected behavior
The endpoint should filter requested IDs against actual existing owners before counting. Non-existent group IDs should not inflate the removal count.

### Additional context
- Frontend sends stale group IDs after a concurrent group removal
- API consumers build group ID lists from cached data that is slightly outdated
- Bulk operations that include IDs from different features

Related PR: #8032

Contributor guide

Open the contributing guide

Research direction

Start at _validate_owner_removal and FeatureGroupOwnerInputSerializer, then reproduce the group-owner removal request with one valid and one nonexistent group ID. Check the related PR #8032 and the group owner endpoint behavior; done means nonexistent IDs no longer affect owner-count validation and the documented request returns 200 while preserving remaining owners.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
40/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.