feat: enforce feature ownership project setting by gagantrivedi · Pull Request #7067 · Flagsmith/flagsmith

gagantrivedi · 2026-03-30T09:48:01Z

Thanks for submitting a PR! Please check the boxes below:

I have read the Contributing Guide.
I have added information to docs/ if required so people know about the feature.
I have filled in the "Changes" section below.
I have filled in the "How did you test this code" section below.

Changes

Closes #4432

Add a project-level enforce_feature_owners setting. When enabled:

Feature creation requires at least one user or group owner
The owners/group_owners fields on the create serialiser now accept IDs on write and return nested objects on read (asymmetric PrimaryKeyRelatedField — no API contract break)
The remove-owners/remove-group-owners endpoints prevent removing the last owner
Frontend adds a project setting toggle, owner selection during feature creation, create-button validation, and owner chips in the feature modal header

How did you test this code?

18 new backend tests covering:
- Enforcement on/off for create
- Valid/invalid owner IDs, wrong org groups, users without project access
- Master API key without owners
- Owners read-only on update
- Remove endpoints blocking last owner removal (user and group)
- Project setting PATCH and list
Frontend: manual testing via local dev server
All existing tests pass (247 features, 48 projects)

vercel · 2026-03-30T09:48:08Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
flagsmith-frontend-preview	Ready	Preview, Comment	Apr 1, 2026 2:02pm
flagsmith-frontend-staging	Ready	Preview, Comment	Apr 1, 2026 2:02pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Ignored	Preview	Apr 1, 2026 2:02pm

codecov · 2026-03-30T09:56:43Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.34%. Comparing base (3f71f16) to head (9a3dffb).
⚠️ Report is 27 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #7067    +/-   ##
========================================
  Coverage   98.33%   98.34%            
========================================
  Files        1337     1336     -1     
  Lines       50010    50132   +122     
========================================
+ Hits        49178    49302   +124     
+ Misses        832      830     -2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Add an `enforce_feature_owners` boolean on the Project model. When enabled, feature creation requires at least one user or group owner. The owners/group_owners fields on CreateFeatureSerializer are now asymmetric PrimaryKeyRelatedFields (accept IDs on write, return nested objects on read). The remove-owners and remove-group-owners endpoints also prevent removing the last owner when enforcement is on. Frontend adds the project setting toggle, a FeatureOwnerSelect component for the creation modal, create-button validation, and owner chips in the feature modal header.

…ture_owners - Switch all new tests from deprecated admin_client_original to admin_client_new so they run as both user and master API key - Extract enforcement check into private method

for more information, see https://pre-commit.ci

Merge extra __ segments into the condition part to satisfy the FT003 lint rule: test_{subject}__{condition}__{expected}.

Already covered by admin_client_new parametrisation on test_create_feature__enforce_owners_enabled_no_owners__returns_400.

Already covered by existing test_remove_owners__specified_owner__removes_only_specified.

claude

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, reopen this pull request to trigger a review.

github-actions · 2026-03-31T03:47:22Z

Docker builds report

Image	Build Status	Security report
`ghcr.io/flagsmith/flagsmith-e2e:pr-7067`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-api-test:pr-7067`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-api:pr-7067`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-private-cloud:pr-7067`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith:pr-7067`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-frontend:pr-7067`	Finished ✅	Results ✅

github-actions · 2026-03-31T03:52:03Z

Playwright Test Results (oss - depot-ubuntu-latest-16)

10 passed

Details

10 tests across 7 suites
8.3 seconds
5d60dba
🔄 Run: #15587 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

10 passed

Details

10 tests across 7 suites
27.7 seconds
5d60dba
🔄 Run: #15587 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

2 passed

Details

2 tests across 2 suites
50.5 seconds
5d60dba
🔄 Run: #15587 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

2 passed

Details

2 tests across 2 suites
57.7 seconds
5d60dba
🔄 Run: #15587 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

10 passed

Details

10 tests across 7 suites
39.1 seconds
e67da98
🔄 Run: #15598 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

10 passed

Details

10 tests across 7 suites
46.1 seconds
e67da98
🔄 Run: #15598 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

16 passed

Details

16 tests across 13 suites
54.1 seconds
e67da98
🔄 Run: #15598 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

2 passed

Details

2 tests across 2 suites
50.8 seconds
e67da98
🔄 Run: #15598 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

10 passed

Details

10 tests across 7 suites
24.4 seconds
e6633d3
🔄 Run: #15599 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

10 passed

Details

10 tests across 7 suites
10.8 seconds
e6633d3
🔄 Run: #15599 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

16 passed

Details

16 tests across 13 suites
59.9 seconds
e6633d3
🔄 Run: #15599 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

2 passed

Details

2 tests across 2 suites
44.2 seconds
e6633d3
🔄 Run: #15599 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

10 passed

Details

10 tests across 7 suites
9.3 seconds
f6ce2cd
🔄 Run: #15601 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

10 passed

Details

10 tests across 7 suites
48.4 seconds
f6ce2cd
🔄 Run: #15601 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

16 passed

Details

16 tests across 13 suites
26.1 seconds
f6ce2cd
🔄 Run: #15601 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

2 passed

Details

2 tests across 2 suites
44 seconds
f6ce2cd
🔄 Run: #15601 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

10 passed

Details

10 tests across 7 suites
47.8 seconds
9a3dffb
🔄 Run: #15613 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

10 passed

Details

10 tests across 7 suites
41.9 seconds
9a3dffb
🔄 Run: #15613 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

2 passed

Details

2 tests across 2 suites
51.2 seconds
9a3dffb
🔄 Run: #15613 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
1 minute, 12 seconds
9a3dffb
🔄 Run: #15613 (attempt 1)

Zaimwa9

Overall good and well working. Couple of comments:

One refactor sorry but that's part of becoming a frontend 😅
Couple of questions regarding new UI elements (to be hidden or not depending on the config)
One backend NIT

Otherwise good job

api/features/serializers.py

frontend/web/components/FeatureOwnerSelect.tsx

frontend/web/components/feature-summary/FeatureRow.tsx

frontend/common/types/requests.ts

- Migrate FlagOwners.js and FlagOwnerGroups.js to functional TSX components with RTK Query, supporting dual mode (edit via API, create via parent callbacks) - Delete FeatureOwnerSelect.tsx (replaced by refactored components) - Remove tooltips from modal header owner chips - Gate owner chips and create-form picker on enforce_feature_owners

Zaimwa9

Tested new changes 🟢

github-actions bot added front-end Issue related to the React Front End Dashboard api Issue related to the REST API feature New feature or request labels Mar 30, 2026

gagantrivedi force-pushed the feat/enforce-feature-ownership branch from aca43a4 to 1749d8d Compare March 30, 2026 09:51

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 30, 2026

gagantrivedi force-pushed the feat/enforce-feature-ownership branch from 4c3aa8f to a8b419f Compare March 30, 2026 11:04

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 30, 2026

gagantrivedi force-pushed the feat/enforce-feature-ownership branch from f9b43dc to ca55b0d Compare March 30, 2026 11:15

vercel bot deployed to Preview – flagsmith-frontend-preview March 30, 2026 11:18 View deployment

vercel bot deployed to Preview – flagsmith-frontend-staging March 30, 2026 11:18 View deployment

gagantrivedi and others added 2 commits March 30, 2026 17:04

fixup: use admin_client_new fixture and extract _validate_enforce_fea…

4e0d1e5

…ture_owners - Switch all new tests from deprecated admin_client_original to admin_client_new so they run as both user and master API key - Extract enforcement check into private method

[pre-commit.ci] auto fixes from pre-commit.com hooks

f9a448f

for more information, see https://pre-commit.ci

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 30, 2026

fixup: fix test names to match 3-part naming convention

188ae6c

Merge extra __ segments into the condition part to satisfy the FT003 lint rule: test_{subject}__{condition}__{expected}.

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 30, 2026

fixup: remove redundant master API key test

9acd5b3

Already covered by admin_client_new parametrisation on test_create_feature__enforce_owners_enabled_no_owners__returns_400.

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 31, 2026

fixup: remove redundant remove_owners test

5d60dba

Already covered by existing test_remove_owners__specified_owner__removes_only_specified.

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 31, 2026

gagantrivedi marked this pull request as ready for review March 31, 2026 03:46

gagantrivedi requested a review from a team as a code owner March 31, 2026 03:46

claude bot reviewed Mar 31, 2026

View reviewed changes

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 31, 2026

gagantrivedi removed the request for review from kyle-ssg March 31, 2026 10:33

gagantrivedi assigned Zaimwa9 Mar 31, 2026

Zaimwa9 requested changes Mar 31, 2026

View reviewed changes

fixup: skip auto-adding creator when owners are explicitly provided

e67da98

github-actions bot added feature New feature or request and removed feature New feature or request labels Apr 1, 2026

vercel bot deployed to Preview – flagsmith-frontend-preview April 1, 2026 02:10 View deployment

vercel bot deployed to Preview – flagsmith-frontend-staging April 1, 2026 02:10 View deployment

feat: migrated-owners-components-to-rtk

f6ce2cd

github-actions bot added feature New feature or request and removed feature New feature or request labels Apr 1, 2026

vercel bot deployed to Preview – flagsmith-frontend-preview April 1, 2026 09:01 View deployment

vercel bot deployed to Preview – flagsmith-frontend-staging April 1, 2026 09:01 View deployment

khvn26 previously approved these changes Apr 1, 2026

View reviewed changes

kyle-ssg mentioned this pull request Apr 1, 2026

fix: Skip logout endpoint in e2e #7089

Merged

4 tasks

feat: added-error-management-and-fixed-group-owners-mismatch

9a3dffb

Zaimwa9 dismissed khvn26’s stale review via 9a3dffb April 1, 2026 13:59

github-actions bot added feature New feature or request and removed feature New feature or request labels Apr 1, 2026

vercel bot deployed to Preview – flagsmith-frontend-staging April 1, 2026 14:01 View deployment

vercel bot deployed to Preview – flagsmith-frontend-preview April 1, 2026 14:02 View deployment

Zaimwa9 approved these changes Apr 1, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: enforce feature ownership project setting#7067

feat: enforce feature ownership project setting#7067
gagantrivedi wants to merge 10 commits intomainfrom
feat/enforce-feature-ownership

gagantrivedi commented Mar 30, 2026

Uh oh!

vercel bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

codecov bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

claude bot left a comment

Uh oh!

github-actions bot commented Mar 31, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 31, 2026 •

edited

Loading

Uh oh!

Zaimwa9 left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Zaimwa9 left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

gagantrivedi commented Mar 30, 2026

Changes

How did you test this code?

Uh oh!

vercel bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

claude bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Docker builds report

Uh oh!

github-actions bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Uh oh!

Zaimwa9 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Zaimwa9 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

vercel bot commented Mar 30, 2026 •

edited

Loading

codecov bot commented Mar 30, 2026 •

edited

Loading

github-actions bot commented Mar 31, 2026 •

edited

Loading

github-actions bot commented Mar 31, 2026 •

edited

Loading