Skip to content

fix(API): enforce lower case feature names on the backend - #8195

Open
bardock-2393 wants to merge 1 commit into
Flagsmith:mainfrom
bardock-2393:fix/backend-enforce-lowercase-feature-names
Open

fix(API): enforce lower case feature names on the backend#8195
bardock-2393 wants to merge 1 commit into
Flagsmith:mainfrom
bardock-2393:fix/backend-enforce-lowercase-feature-names

Conversation

@bardock-2393

Copy link
Copy Markdown
Contributor

Thanks for submitting a PR! Please check the boxes below:

  • I have read the Contributing Guide.
  • I have added information to docs/ if required so people know about the feature.
  • I have filled in the "Changes" section below.
  • I have filled in the "How did you test this code" section below.

Changes

Closes #8171

Project.only_allow_lower_case_feature_names is a project setting (on by default) that's supposed to require feature names to be lower case. Until now it was only ever enforced client-side by the web app, so anyone creating a feature directly via the API (curl, a script, an SDK) could give it a mixed-case name even when the project setting says otherwise.

This PR makes the backend enforce the same rule when a feature is created via the API, so the setting means what it says regardless of which client is used.

How did you test this code?

Added unit tests covering:

  • Project.is_feature_name_valid with only_allow_lower_case_feature_names on and off, combined with the existing regex check.
  • The feature creation endpoint returning a 400 with a clear error message when the name isn't lower case, still returning 201 for lower-case names, and still allowing mixed-case names when the project setting is disabled.

Also updated a handful of pre-existing tests that happened to create features with mixed-case names against the default project (where the setting is on), so they now use lower-case names.

Project.only_allow_lower_case_feature_names was only ever read by the
frontend, so creating a feature via the API with a mixed-case name
silently bypassed the rule. is_feature_name_valid now enforces it
alongside the existing regex check.
@bardock-2393
bardock-2393 requested a review from a team as a code owner July 31, 2026 17:24
@bardock-2393
bardock-2393 requested review from khvn26 and removed request for a team July 31, 2026 17:24
@vercel

vercel Bot commented Jul 31, 2026

Copy link
Copy Markdown

@bardock-2393 is attempting to deploy a commit to the Flagsmith Team on Vercel.

A member of the Team first needs to authorize it.

@coderabbitai

coderabbitai Bot commented Jul 31, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1719ea28-50fe-44a6-979e-1cb53f00600f

📥 Commits

Reviewing files that changed from the base of the PR and between 10a3bb7 and 24235c3.

📒 Files selected for processing (4)
  • api/features/serializers.py
  • api/projects/models.py
  • api/tests/unit/features/test_unit_features_views.py
  • api/tests/unit/projects/test_unit_projects_models.py

📝 Walkthrough

Walkthrough

Feature creation now rejects uppercase characters when lower-case-only feature names are enabled. Project validation applies the same rule before the optional regular expression check. Unit tests cover lower-case, mixed-case, and uppercase names, including the disabled setting. Existing feature fixtures now use lower-case names.

Estimated code review effort: 2 (Simple) | ~10 minutes

✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Fix failing CI checks

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added the api Issue related to the REST API label Jul 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

api Issue related to the REST API

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Feature name format only enforced by frontend

1 participant