fix(environments): validate project field in environment creation#7063
fix(environments): validate project field in environment creation#7063nielskaspers wants to merge 3 commits intoFlagsmith:mainfrom
Conversation
…s/ (Flagsmith#6599) Validate that the `project` field is a valid integer before querying the database. Previously, passing a non-integer string (e.g. '<Project ID>') caused an unhandled ValueError resulting in a 500 response. Now returns 403 (permission denied) for invalid values, consistent with how missing or non-existent projects are handled. Follows the same validation pattern used in FeatureSegmentPermissions.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
@nielskaspers is attempting to deploy a commit to the Flagsmith Team on Vercel. A member of the Team first needs to authorize it. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #7063 +/- ##
==========================================
- Coverage 98.33% 98.27% -0.07%
==========================================
Files 1337 1336 -1
Lines 50010 50072 +62
==========================================
+ Hits 49178 49207 +29
- Misses 832 865 +33 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Zaimwa9
left a comment
Zaimwa9
left a comment
There was a problem hiding this comment.
Thanks for the contribution! Small NIT comments on the tests that could be addressed while we are working on this
api/tests/unit/environments/permissions/test_unit_environments_permissions.py
Outdated
Show resolved
Hide resolved
api/tests/unit/environments/permissions/test_unit_environments_permissions.py
Outdated
Show resolved
Hide resolved
- Parametrize invalid project tests to avoid shared module-level mocks
- Use fresh mock instances per test to prevent shared state
- Add test for string-encoded integer project ID ("42") that should pass
|
Hi @nielskaspers , sorry for the delay in getting back to you. From what I see we are just missing a typing error. You can check with And i'll happily approve after |
Resolves mypy type-arg error for generic dict type. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Fixed! Added type parameters to the |
|
The latest updates on your projects. Learn more about Vercel for GitHub. 3 Skipped Deployments
|
2 participants
Summary
projectfield is a valid integer before querying the database inEnvironmentPermissions.has_permission<Project ID>) caused an unhandledValueErroratProject.objects.get(), resulting in a 500 responseIssue
Fixes #6599
Changes
api/environments/permissions/permissions.py: Addedint()validation with(TypeError, ValueError)handling before the ORM query, following the same pattern used inFeatureSegmentPermissionsQimport