Skip to content

fix: include specific IDs in owner validation errors#7116

Open
gagantrivedi wants to merge 1 commit intomainfrom
claude/fix-owner-validation-messages-01VVXBFmv5f1gfwWgPEdnqFs
Open

fix: include specific IDs in owner validation errors#7116
gagantrivedi wants to merge 1 commit intomainfrom
claude/fix-owner-validation-messages-01VVXBFmv5f1gfwWgPEdnqFs

Conversation

@gagantrivedi
Copy link
Copy Markdown
Member

Thanks for submitting a PR! Please check the boxes below:

  • I have read the Contributing Guide.
  • I have added information to docs/ if required so people know about the feature.
  • I have filled in the "Changes" section below.
  • I have filled in the "How did you test this code" section below.

Changes

Addresses 2 nit comments from @khvn26 on #7067:

  • validate_owners: error message now includes the specific user IDs that lack project access (e.g. "Users with ids [3, 7] do not have access to this project.") instead of the generic "Some users do not have access to this project."
  • validate_group_owners: error message now includes the specific group IDs that belong to the wrong organisation (e.g. "Groups with ids [5] do not belong to this project's organisation.") instead of the generic "Some groups do not belong to this project's organisation."

Both validators now collect all invalid entries before raising, so a single error reports every problematic ID at once.

How did you test this code?

  • Updated existing tests (test_create_feature__group_owner_from_different_org__returns_400 and test_create_feature__owner_without_project_access__returns_400) to assert the specific IDs appear in the error response.

Address review feedback from PR #7067:
- Include user IDs in error message when users don't have project access
- Include group IDs in error message when groups belong to wrong organisation

This helps users understand exactly which owners/groups are invalid.
@gagantrivedi gagantrivedi requested a review from a team as a code owner April 3, 2026 03:35
@gagantrivedi gagantrivedi requested review from Zaimwa9 and removed request for a team April 3, 2026 03:35
Copy link
Copy Markdown

@claude claude bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, reopen this pull request to trigger a review.

@vercel
Copy link
Copy Markdown

vercel bot commented Apr 3, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments
Project Deployment Actions Updated (UTC)
docs Ignored Ignored Apr 3, 2026 3:35am
flagsmith-frontend-preview Ignored Ignored Apr 3, 2026 3:35am
flagsmith-frontend-staging Ignored Ignored Apr 3, 2026 3:35am

Request Review

@github-actions github-actions bot added api Issue related to the REST API fix labels Apr 3, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 3, 2026

Docker builds report

Image Build Status Security report
ghcr.io/flagsmith/flagsmith-e2e:pr-7116 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith-api-test:pr-7116 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith-frontend:pr-7116 Finished ✅ Results
ghcr.io/flagsmith/flagsmith-api:pr-7116 Finished ✅ Results
ghcr.io/flagsmith/flagsmith:pr-7116 Finished ✅ Results
ghcr.io/flagsmith/flagsmith-private-cloud:pr-7116 Finished ✅ Results

@codecov
Copy link
Copy Markdown

codecov bot commented Apr 3, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.34%. Comparing base (e8ce5ab) to head (c68c12a).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #7116   +/-   ##
=======================================
  Coverage   98.34%   98.34%           
=======================================
  Files        1336     1336           
  Lines       50128    50132    +4     
=======================================
+ Hits        49298    49302    +4     
  Misses        830      830           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 3, 2026

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  42.2 seconds
commit  c68c12a
info  🔄 Run: #15681 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  49.3 seconds
commit  c68c12a
info  🔄 Run: #15681 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  16 passed

Details

stats  16 tests across 13 suites
duration  56.2 seconds
commit  c68c12a
info  🔄 Run: #15681 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  50.1 seconds
commit  c68c12a
info  🔄 Run: #15681 (attempt 1)

Copy link
Copy Markdown
Member

@khvn26 khvn26 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Trying to understand which error messages would be more helpful to the user.

if not user.has_project_permission(VIEW_PROJECT, project)
]
if invalid_users:
invalid_user_ids = [user.id for user in invalid_users]
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe emails or uuids?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Returning email would be a data leak and returning uuid when you have supplied id is even more confusing?

if group.organisation_id != project.organisation_id
]
if invalid_groups:
invalid_group_ids = [group.id for group in invalid_groups]
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe group names?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as above — I don't think it makes sense to output different params than the input.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

api Issue related to the REST API fix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants