How are you running Flagsmith
Describe the bug
When enforce_feature_owners is enabled, _validate_owner_removal validates whether removing feature owners would leave the feature with zero owners. It uses the count of IDs in the request rather than the count of IDs that actually exist as owners on the feature.
The group owner serializer (FeatureGroupOwnerInputSerializer) does not validate that group IDs exist before processing, so non-existent group IDs pass through to _validate_owner_removal and inflate the removal count. This causes the validation to incorrectly block legitimate operations.
Note: The user owner serializer (UserIdsSerializer) already validates all IDs exist before the view runs, so this bug is only reachable via the group owner endpoint.
Steps To Reproduce
- Create a project with enforce_feature_owners = True
- Create a feature with 1 user owner and 1 group owner
- Call POST /api/v1/projects/{id}/features/{id}/remove-group-owners/ with {"group_ids": [group_id, 999999]}
- Expected: 200 OK - the real group is removed, user owner remains
- Actual: 400 Bad Request - validation calculates 1 + 1 - 2 = 0 and rejects
Expected behavior
The endpoint should filter requested IDs against actual existing owners before counting. Non-existent group IDs should not inflate the removal count.
Additional context
- Frontend sends stale group IDs after a concurrent group removal
- API consumers build group ID lists from cached data that is slightly outdated
- Bulk operations that include IDs from different features
Related PR: #8032
How are you running Flagsmith
Describe the bug
When enforce_feature_owners is enabled, _validate_owner_removal validates whether removing feature owners would leave the feature with zero owners. It uses the count of IDs in the request rather than the count of IDs that actually exist as owners on the feature.
The group owner serializer (FeatureGroupOwnerInputSerializer) does not validate that group IDs exist before processing, so non-existent group IDs pass through to _validate_owner_removal and inflate the removal count. This causes the validation to incorrectly block legitimate operations.
Steps To Reproduce
Expected behavior
The endpoint should filter requested IDs against actual existing owners before counting. Non-existent group IDs should not inflate the removal count.
Additional context
Related PR: #8032