Flagsmith / Flagsmith/flagsmith

Publishing a feature version bypasses Feature Change Requests

Open
#8,367 0 comments 0 reactions 1 assignee Claimed by @khvn26 View on GitHub
Dominant language
Python
Stars
6.6k
Forks
567
Avg merge
1d 13h
Merged PRs (30d)
121

Description

### How are you running Flagsmith

- [X] Self Hosted with Docker
- [X] Self Hosted with Kubernetes
- [X] SaaS at flagsmith.com
- [ ] Some other way (add details in description below)

### Describe the bug

With Feature Change Requests enabled on an environment, a feature version can still be made live through the API without a change request, taking its segment overrides and environment default with it.

### Steps To Reproduce

1. Enable Feature Change Requests on an environment using v2 feature versioning, by setting a minimum number of approvals.
2. `POST /api/v1/environments/{id}/features/{id}/versions/` with `publish_immediately: true`, and the changes in `feature_states_to_create`. It responds `201`, and the version is published and live.
3. Alternatively, `POST` the same without publishing, then `POST` to that version's `publish/` action. It responds `200`, and the version is live.

Either way the change is serving to SDKs, and no change request was involved.

### Expected behavior

Both entry points respond `409` with the `change_requests_enabled` code, matching the newer `update-flag` endpoint, and the version stays unpublished.

### Screenshots

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.