Skip to content

fix: _validate_owner_removal counts request IDs instead of actual existing owners #8038

Description

@Marnie0415

How are you running Flagsmith

  • SaaS at flagsmith.com

Describe the bug

When enforce_feature_owners is enabled, _validate_owner_removal validates whether removing feature owners would leave the feature with zero owners. It uses the count of IDs in the request rather than the count of IDs that actually exist as owners on the feature.

The group owner serializer (FeatureGroupOwnerInputSerializer) does not validate that group IDs exist before processing, so non-existent group IDs pass through to _validate_owner_removal and inflate the removal count. This causes the validation to incorrectly block legitimate operations.

Note: The user owner serializer (UserIdsSerializer) already validates all IDs exist before the view runs, so this bug is only reachable via the group owner endpoint.

Steps To Reproduce

  1. Create a project with enforce_feature_owners = True
  2. Create a feature with 1 user owner and 1 group owner
  3. Call POST /api/v1/projects/{id}/features/{id}/remove-group-owners/ with {"group_ids": [group_id, 999999]}
  4. Expected: 200 OK - the real group is removed, user owner remains
  5. Actual: 400 Bad Request - validation calculates 1 + 1 - 2 = 0 and rejects

Expected behavior

The endpoint should filter requested IDs against actual existing owners before counting. Non-existent group IDs should not inflate the removal count.

Additional context

  • Frontend sends stale group IDs after a concurrent group removal
  • API consumers build group ID lists from cached data that is slightly outdated
  • Bulk operations that include IDs from different features

Related PR: #8032

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions