Flagsmith / Flagsmith/flagsmith
Publishing a feature version bypasses Feature Change Requests
- Dominant language
- Python
- Stars
- 6.6k
- Forks
- 567
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 121
Description
### How are you running Flagsmith
- [X] Self Hosted with Docker
- [X] Self Hosted with Kubernetes
- [X] SaaS at flagsmith.com
- [ ] Some other way (add details in description below)
### Describe the bug
With Feature Change Requests enabled on an environment, a feature version can still be made live through the API without a change request, taking its segment overrides and environment default with it.
### Steps To Reproduce
1. Enable Feature Change Requests on an environment using v2 feature versioning, by setting a minimum number of approvals.
2. `POST /api/v1/environments/{id}/features/{id}/versions/` with `publish_immediately: true`, and the changes in `feature_states_to_create`. It responds `201`, and the version is published and live.
3. Alternatively, `POST` the same without publishing, then `POST` to that version's `publish/` action. It responds `200`, and the version is live.
Either way the change is serving to SDKs, and no change request was involved.
### Expected behavior
Both entry points respond `409` with the `change_requests_enabled` code, matching the newer `update-flag` endpoint, and the version stays unpublished.
### Screenshots
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.