feat: enforce feature ownership project setting by gagantrivedi · Pull Request #7067 · Flagsmith/flagsmith

gagantrivedi · 2026-03-30T09:48:01Z

Thanks for submitting a PR! Please check the boxes below:

I have read the Contributing Guide.
I have added information to docs/ if required so people know about the feature.
I have filled in the "Changes" section below.
I have filled in the "How did you test this code" section below.

Changes

Closes #4432

Add a project-level enforce_feature_owners setting. When enabled:

Feature creation requires at least one user or group owner
The owners/group_owners fields on the create serialiser now accept IDs on write and return nested objects on read (asymmetric PrimaryKeyRelatedField — no API contract break)
The remove-owners/remove-group-owners endpoints prevent removing the last owner
Frontend adds a project setting toggle, owner selection during feature creation, create-button validation, and owner chips in the feature modal header

How did you test this code?

18 new backend tests covering:
- Enforcement on/off for create
- Valid/invalid owner IDs, wrong org groups, users without project access
- Master API key without owners
- Owners read-only on update
- Remove endpoints blocking last owner removal (user and group)
- Project setting PATCH and list
Frontend: manual testing via local dev server
All existing tests pass (247 features, 48 projects)

vercel · 2026-03-30T09:48:08Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
flagsmith-frontend-preview	Ready	Preview, Comment	Apr 1, 2026 2:02pm
flagsmith-frontend-staging	Ready	Preview, Comment	Apr 1, 2026 2:02pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Ignored	Preview	Apr 1, 2026 2:02pm

codecov · 2026-03-30T09:56:43Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.34%. Comparing base (3f71f16) to head (9a3dffb).
⚠️ Report is 40 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #7067    +/-   ##
========================================
  Coverage   98.33%   98.34%            
========================================
  Files        1337     1336     -1     
  Lines       50010    50132   +122     
========================================
+ Hits        49178    49302   +124     
+ Misses        832      830     -2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Add an `enforce_feature_owners` boolean on the Project model. When enabled, feature creation requires at least one user or group owner. The owners/group_owners fields on CreateFeatureSerializer are now asymmetric PrimaryKeyRelatedFields (accept IDs on write, return nested objects on read). The remove-owners and remove-group-owners endpoints also prevent removing the last owner when enforcement is on. Frontend adds the project setting toggle, a FeatureOwnerSelect component for the creation modal, create-button validation, and owner chips in the feature modal header.

…ture_owners - Switch all new tests from deprecated admin_client_original to admin_client_new so they run as both user and master API key - Extract enforcement check into private method

for more information, see https://pre-commit.ci

Merge extra __ segments into the condition part to satisfy the FT003 lint rule: test_{subject}__{condition}__{expected}.

Already covered by admin_client_new parametrisation on test_create_feature__enforce_owners_enabled_no_owners__returns_400.

Already covered by existing test_remove_owners__specified_owner__removes_only_specified.

Zaimwa9

Overall good and well working. Couple of comments:

One refactor sorry but that's part of becoming a frontend 😅
Couple of questions regarding new UI elements (to be hidden or not depending on the config)
One backend NIT

Otherwise good job

api/features/serializers.py

frontend/web/components/FeatureOwnerSelect.tsx

frontend/web/components/feature-summary/FeatureRow.tsx

frontend/common/types/requests.ts

- Migrate FlagOwners.js and FlagOwnerGroups.js to functional TSX components with RTK Query, supporting dual mode (edit via API, create via parent callbacks) - Delete FeatureOwnerSelect.tsx (replaced by refactored components) - Remove tooltips from modal header owner chips - Gate owner chips and create-form picker on enforce_feature_owners

Zaimwa9

Tested new changes 🟢

khvn26

Looks good bar 2 nits

api/features/serializers.py

Address review feedback from PR #7067: - Include user IDs in error message when users don't have project access - Include group IDs in error message when groups belong to wrong organisation This helps users understand exactly which owners/groups are invalid.

github-actions bot added front-end Issue related to the React Front End Dashboard api Issue related to the REST API feature New feature or request labels Mar 30, 2026

gagantrivedi force-pushed the feat/enforce-feature-ownership branch from aca43a4 to 1749d8d Compare March 30, 2026 09:51

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 30, 2026

gagantrivedi force-pushed the feat/enforce-feature-ownership branch from 4c3aa8f to a8b419f Compare March 30, 2026 11:04

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 30, 2026

gagantrivedi force-pushed the feat/enforce-feature-ownership branch from f9b43dc to ca55b0d Compare March 30, 2026 11:15

vercel bot deployed to Preview – flagsmith-frontend-preview March 30, 2026 11:18 View deployment

vercel bot deployed to Preview – flagsmith-frontend-staging March 30, 2026 11:18 View deployment

gagantrivedi and others added 2 commits March 30, 2026 17:04

fixup: use admin_client_new fixture and extract _validate_enforce_fea…

4e0d1e5

…ture_owners - Switch all new tests from deprecated admin_client_original to admin_client_new so they run as both user and master API key - Extract enforcement check into private method

[pre-commit.ci] auto fixes from pre-commit.com hooks

f9a448f

for more information, see https://pre-commit.ci

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 30, 2026

fixup: fix test names to match 3-part naming convention

188ae6c

Merge extra __ segments into the condition part to satisfy the FT003 lint rule: test_{subject}__{condition}__{expected}.

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 30, 2026

fixup: remove redundant master API key test

9acd5b3

Already covered by admin_client_new parametrisation on test_create_feature__enforce_owners_enabled_no_owners__returns_400.

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 31, 2026

fixup: remove redundant remove_owners test

5d60dba

Already covered by existing test_remove_owners__specified_owner__removes_only_specified.

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 31, 2026

gagantrivedi marked this pull request as ready for review March 31, 2026 03:46

gagantrivedi requested a review from a team as a code owner March 31, 2026 03:46

Zaimwa9 requested changes Mar 31, 2026

View reviewed changes

fixup: skip auto-adding creator when owners are explicitly provided

e67da98

github-actions bot added feature New feature or request and removed feature New feature or request labels Apr 1, 2026

vercel bot deployed to Preview – flagsmith-frontend-preview April 1, 2026 02:10 View deployment

vercel bot deployed to Preview – flagsmith-frontend-staging April 1, 2026 02:10 View deployment

feat: migrated-owners-components-to-rtk

f6ce2cd

github-actions bot added feature New feature or request and removed feature New feature or request labels Apr 1, 2026

vercel bot deployed to Preview – flagsmith-frontend-preview April 1, 2026 09:01 View deployment

vercel bot deployed to Preview – flagsmith-frontend-staging April 1, 2026 09:01 View deployment

khvn26 previously approved these changes Apr 1, 2026

View reviewed changes

kyle-ssg mentioned this pull request Apr 1, 2026

fix: Skip logout endpoint in e2e #7089

Merged

4 tasks

feat: added-error-management-and-fixed-group-owners-mismatch

9a3dffb

Zaimwa9 dismissed khvn26’s stale review via 9a3dffb April 1, 2026 13:59

github-actions bot added feature New feature or request and removed feature New feature or request labels Apr 1, 2026

vercel bot deployed to Preview – flagsmith-frontend-staging April 1, 2026 14:01 View deployment

vercel bot deployed to Preview – flagsmith-frontend-preview April 1, 2026 14:02 View deployment

Zaimwa9 approved these changes Apr 1, 2026

View reviewed changes

Zaimwa9 requested a review from khvn26 April 2, 2026 08:05

khvn26 approved these changes Apr 2, 2026

View reviewed changes

api/features/serializers.py Show resolved Hide resolved

api/features/serializers.py Show resolved Hide resolved

gagantrivedi merged commit e8ce5ab into main Apr 3, 2026
37 checks passed

gagantrivedi deleted the feat/enforce-feature-ownership branch April 3, 2026 00:58

flagsmithdev mentioned this pull request Apr 2, 2026

chore(main): release 2.226.0 #7106

Merged

gagantrivedi mentioned this pull request Apr 3, 2026

fix: include specific IDs in owner validation errors #7116

Open

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: enforce feature ownership project setting#7067

feat: enforce feature ownership project setting#7067
gagantrivedi merged 10 commits intomainfrom
feat/enforce-feature-ownership

gagantrivedi commented Mar 30, 2026

Uh oh!

vercel bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

codecov bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

Zaimwa9 left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Zaimwa9 left a comment

Uh oh!

khvn26 left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

gagantrivedi commented Mar 30, 2026

Changes

How did you test this code?

Uh oh!

vercel bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Zaimwa9 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Zaimwa9 left a comment

Choose a reason for hiding this comment

Uh oh!

khvn26 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vercel bot commented Mar 30, 2026 •

edited

Loading

codecov bot commented Mar 30, 2026 •

edited

Loading