fix: return 400 instead of 500 when request user is invalid (closes #6809)

[botbikamordehai2-sketch]

What

When a request has an unexpected user type (e.g., anonymous, or a user model that is neither FFAdminUser nor an API key), AuthorData.from_request raises a bare ValueError. This propagates to database operations where unvalidated input (like a string 'PROJECT_ID' for an integer field) causes a similar ValueError, resulting in a 500 Internal Server Error.

Fix

Replaced the generic ValueError with Django REST Framework's ValidationError, which automatically results in an HTTP 400 Bad Request response. This aligns with the project's goal of validating input early and returning proper error responses.

Closes #6809

[vercel]

@botbikamordehai2-sketch is attempting to deploy a commit to the Flagsmith Team on Vercel.

A member of the Team first needs to authorize it.

[gemini-code-assist]

Code Review

This pull request modifies the AuthorData.from_request method to raise a Django REST Framework ValidationError instead of a standard Python ValueError when the request user is invalid. The reviewer points out that raising a ValidationError (which results in an HTTP 400 Bad Request) is inappropriate for unauthenticated or anonymous users. Instead, the reviewer suggests raising NotAuthenticated (HTTP 401) for anonymous users to properly trigger authentication flows, and provides a code suggestion to implement this behavior.

[gemini-code-assist]

When the request user is anonymous or not authenticated, raising a ValidationError results in an HTTP 400 Bad Request. However, for unauthenticated requests, returning an HTTP 401 Unauthorized (via NotAuthenticated) is standard and crucial for clients to correctly handle authentication flows (such as redirecting to login or triggering token refresh). We should check if the user is anonymous or missing and raise NotAuthenticated in those cases, while keeping ValidationError for other unexpected authenticated user types.

Suggested change

	from users.models import FFAdminUser
	if type(request.user) is FFAdminUser:
	return cls(user=request.user)
	elif hasattr(request.user, "key"):
	return cls(api_key=request.user.key)
	else:
	from rest_framework.exceptions import NotAuthenticated, ValidationError
	if not request.user or request.user.is_anonymous:
	raise NotAuthenticated()
	if type(request.user) is FFAdminUser:
	return cls(user=request.user)
	elif hasattr(request.user, "key"):
	return cls(api_key=request.user.key)
	else:
	raise ValidationError("Request user must be FFAdminUser or have an API key")

[khvn26]

Any particular reason to use a local import here?

[khvn26]

Seems like there's no test coverage for this line?

Also, the exception message doesn't make sense when presented in an API response.