feat: enforce feature ownership project setting by gagantrivedi · Pull Request #7067 · Flagsmith/flagsmith

gagantrivedi · 2026-03-30T09:48:01Z

Thanks for submitting a PR! Please check the boxes below:

I have read the Contributing Guide.
I have added information to docs/ if required so people know about the feature.
I have filled in the "Changes" section below.
I have filled in the "How did you test this code" section below.

Changes

Closes #4432

Add a project-level enforce_feature_owners setting. When enabled:

Feature creation requires at least one user or group owner
The owners/group_owners fields on the create serialiser now accept IDs on write and return nested objects on read (asymmetric PrimaryKeyRelatedField — no API contract break)
The remove-owners/remove-group-owners endpoints prevent removing the last owner
Frontend adds a project setting toggle, owner selection during feature creation, create-button validation, and owner chips in the feature modal header

How did you test this code?

18 new backend tests covering:
- Enforcement on/off for create
- Valid/invalid owner IDs, wrong org groups, users without project access
- Master API key without owners
- Owners read-only on update
- Remove endpoints blocking last owner removal (user and group)
- Project setting PATCH and list
Frontend: manual testing via local dev server
All existing tests pass (247 features, 48 projects)

vercel · 2026-03-30T09:48:08Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
flagsmith-frontend-preview	Ready	Preview, Comment	Apr 1, 2026 2:10am
flagsmith-frontend-staging	Ready	Preview, Comment	Apr 1, 2026 2:10am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Ignored	Preview	Apr 1, 2026 2:10am

codecov · 2026-03-30T09:56:43Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.34%. Comparing base (3f71f16) to head (e6633d3).
⚠️ Report is 25 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #7067    +/-   ##
========================================
  Coverage   98.33%   98.34%            
========================================
  Files        1337     1336     -1     
  Lines       50010    50132   +122     
========================================
+ Hits        49178    49302   +124     
+ Misses        832      830     -2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Add an `enforce_feature_owners` boolean on the Project model. When enabled, feature creation requires at least one user or group owner. The owners/group_owners fields on CreateFeatureSerializer are now asymmetric PrimaryKeyRelatedFields (accept IDs on write, return nested objects on read). The remove-owners and remove-group-owners endpoints also prevent removing the last owner when enforcement is on. Frontend adds the project setting toggle, a FeatureOwnerSelect component for the creation modal, create-button validation, and owner chips in the feature modal header.

…ture_owners - Switch all new tests from deprecated admin_client_original to admin_client_new so they run as both user and master API key - Extract enforcement check into private method

for more information, see https://pre-commit.ci

Merge extra __ segments into the condition part to satisfy the FT003 lint rule: test_{subject}__{condition}__{expected}.

Already covered by admin_client_new parametrisation on test_create_feature__enforce_owners_enabled_no_owners__returns_400.

Already covered by existing test_remove_owners__specified_owner__removes_only_specified.

claude

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, reopen this pull request to trigger a review.

github-actions · 2026-03-31T03:47:22Z

Docker builds report

Image	Build Status	Security report
`ghcr.io/flagsmith/flagsmith-api-test:pr-7067`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-e2e:pr-7067`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-api:pr-7067`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-private-cloud:pr-7067`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-frontend:pr-7067`	Finished ✅	Results ✅

github-actions · 2026-03-31T03:52:03Z

Playwright Test Results (oss - depot-ubuntu-latest-16)

10 passed

Details

10 tests across 7 suites
8.3 seconds
5d60dba
🔄 Run: #15587 (attempt 1)

16 tests across 13 suites
59.9 seconds
e6633d3
🔄 Run: #15599 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

2 passed

Details

2 tests across 2 suites
44.2 seconds
e6633d3
🔄 Run: #15599 (attempt 1)

Zaimwa9

Overall good and well working. Couple of comments:

One refactor sorry but that's part of becoming a frontend 😅
Couple of questions regarding new UI elements (to be hidden or not depending on the config)
One backend NIT

Otherwise good job

Zaimwa9 · 2026-03-31T12:41:39Z

api/features/serializers.py

+        if owners:
+            instance.owners.add(*owners)


On the above (L270), maybe we should skip adding the user as an owner if owners is passed in?

Or NIT: removing it from the owners object?

Done — if owners is explicitly provided, we now skip the auto-add of the creating user. The elif in create() only auto-adds when no explicit owners are passed.

Zaimwa9 · 2026-03-31T13:11:59Z

frontend/web/components/FeatureOwnerSelect.tsx

@@ -0,0 +1,154 @@
+import React, { FC, useState } from 'react'


So actually, this component is great. But we have 2 very similar implementations of assigning users/groups (with the one in settings that has the icon).

It's a small refactor that should be straightforward but let me know if that feels creeping out of scope. It would do a lot of good as moving towards Functional Components and RTK.

The main difference is the old components call the API, your new components trigger a state update. So we should be able to let the parent deal with it and have the components with selectedIds / onAdd / onRemove props

I'd say:

We get rid of this component sorry

We migrate FlagOwnerGroups.js => FlagOwnerGroups.tsx turning it into a Functional Component so we get rid of OrganisationProvider (old store) and use useGetGroupSummariesQuery to get the groups

We migrate FlagOwners.js => FlagOwners.tsx turning it into a Functional Component so we get rid of OrganisationProvider (old store) and use useGetUsersQuery to get the users

For the create part here we pass in the state setter

For the update we pass in directly a callback with the API call (with RTK instead of data.post)

That'd be the best opportunity to do this but I understand if it's too much to ask

I wanted to suggest to add the icon here to make it more obvious that you can add the user and it led me to look into the existing components

Done — migrated both FlagOwners.js → FlagOwners.tsx and FlagOwnerGroups.js → FlagOwnerGroups.tsx as functional components using useGetUsersQuery / useGetGroupSummariesQuery (RTK Query). Both support dual mode via discriminated union props:

Edit mode (id + projectId): manages internal state, calls data.post for add/remove

Create mode (selectedIds + onAdd/onRemove): purely controlled by parent

Deleted FeatureOwnerSelect.tsx — no longer needed.

Zaimwa9 · 2026-03-31T13:16:34Z

frontend/web/components/feature-summary/FeatureRow.tsx

+                key={chip.id}
+                title={<span className='chip chip--xs'>{chip.label}</span>}
+              >
+                {chip.label}


Maybe replace with the email ? Or just keep the chip and remove the tooltip ?

Done — removed the tooltips, just plain chips now.

Zaimwa9 · 2026-03-31T13:23:34Z

frontend/web/components/feature-summary/FeatureRow.tsx

        >
          <Icon name='copy' />
        </Button>
+        {ownerChips.length > 0 && (


To align with the team:

This is new and visible for every feature now no matter the new config enabled or not. Do we want it?

Same question for the assigned users/groups: they became part of the create form with or without the new config. Is it something we want to introduce or hide ?

Good call — both the owner chips in the header and the owner picker in the create form are now gated on project.enforce_feature_owners. They only show when the setting is enabled. The edit-mode FlagOwners/FlagOwnerGroups in the settings tab still always show (unchanged behaviour).

Zaimwa9 · 2026-03-31T13:25:22Z

frontend/common/types/requests.ts

+      owners?: number[]
+      group_owners?: number[]


We can directly add them to ProjectFlag then

Looked into this — ProjectFlag.owners is typed as User[] (nested objects from the API response), but on create we send number[] (IDs). Moving the number[] into ProjectFlag would conflict with the existing User[] field. The intersection type ProjectFlag & { owners?: number[] } correctly represents this asymmetry, so kept as-is.

- Migrate FlagOwners.js and FlagOwnerGroups.js to functional TSX components with RTK Query, supporting dual mode (edit via API, create via parent callbacks) - Delete FeatureOwnerSelect.tsx (replaced by refactored components) - Remove tooltips from modal header owner chips - Gate owner chips and create-form picker on enforce_feature_owners

github-actions bot added front-end Issue related to the React Front End Dashboard api Issue related to the REST API feature New feature or request labels Mar 30, 2026

gagantrivedi force-pushed the feat/enforce-feature-ownership branch from aca43a4 to 1749d8d Compare March 30, 2026 09:51

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 30, 2026

gagantrivedi force-pushed the feat/enforce-feature-ownership branch from 4c3aa8f to a8b419f Compare March 30, 2026 11:04

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 30, 2026

gagantrivedi force-pushed the feat/enforce-feature-ownership branch from f9b43dc to ca55b0d Compare March 30, 2026 11:15

vercel bot deployed to Preview – flagsmith-frontend-preview March 30, 2026 11:18 View deployment

vercel bot deployed to Preview – flagsmith-frontend-staging March 30, 2026 11:18 View deployment

gagantrivedi and others added 2 commits March 30, 2026 17:04

fixup: use admin_client_new fixture and extract _validate_enforce_fea…

4e0d1e5

…ture_owners - Switch all new tests from deprecated admin_client_original to admin_client_new so they run as both user and master API key - Extract enforcement check into private method

[pre-commit.ci] auto fixes from pre-commit.com hooks

f9a448f

for more information, see https://pre-commit.ci

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 30, 2026

fixup: fix test names to match 3-part naming convention

188ae6c

Merge extra __ segments into the condition part to satisfy the FT003 lint rule: test_{subject}__{condition}__{expected}.

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 30, 2026

fixup: remove redundant master API key test

9acd5b3

Already covered by admin_client_new parametrisation on test_create_feature__enforce_owners_enabled_no_owners__returns_400.

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 31, 2026

fixup: remove redundant remove_owners test

5d60dba

Already covered by existing test_remove_owners__specified_owner__removes_only_specified.

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 31, 2026

gagantrivedi marked this pull request as ready for review March 31, 2026 03:46

gagantrivedi requested a review from a team as a code owner March 31, 2026 03:46

gagantrivedi requested review from Zaimwa9 and kyle-ssg and removed request for a team March 31, 2026 03:46

claude bot reviewed Mar 31, 2026

View reviewed changes

github-actions bot added feature New feature or request and removed feature New feature or request labels Mar 31, 2026

gagantrivedi removed the request for review from kyle-ssg March 31, 2026 10:33

gagantrivedi assigned Zaimwa9 Mar 31, 2026

Zaimwa9 requested changes Mar 31, 2026

View reviewed changes

fixup: skip auto-adding creator when owners are explicitly provided

e67da98

github-actions bot added feature New feature or request and removed feature New feature or request labels Apr 1, 2026

vercel bot deployed to Preview – flagsmith-frontend-preview April 1, 2026 02:10 View deployment

vercel bot deployed to Preview – flagsmith-frontend-staging April 1, 2026 02:10 View deployment

		@@ -0,0 +1,154 @@
		import React, { FC, useState } from 'react'

Conversation

gagantrivedi commented Mar 30, 2026

Changes

How did you test this code?

Uh oh!

vercel bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

claude bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Docker builds report

Uh oh!

github-actions bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Uh oh!

Zaimwa9 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Zaimwa9 Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

vercel bot commented Mar 30, 2026 •

edited

Loading

codecov bot commented Mar 30, 2026 •

edited

Loading

github-actions bot commented Mar 31, 2026 •

edited

Loading

github-actions bot commented Mar 31, 2026 •

edited

Loading

Zaimwa9 Mar 31, 2026 •

edited

Loading