fix(api): update-traits returns 400 for malformed request body

[bardock-2393]

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Closes #7951

The edge identity update-traits endpoint (PUT /api/v1/environments/<api_key>/edge-identities/<uuid>/update-traits/) crashed with a 500 error instead of returning a 400 when the request body wasn't a JSON object — for example, sending a JSON array as the payload.

This happened because the view unpacked the request body directly into a pydantic model (TraitModel(**request.data)). When request.data was a list, Python raised a TypeError on the ** unpacking itself, before pydantic ever got a chance to validate anything, so the existing except pydantic.ValidationError handler never caught it.

The fix adds an explicit check that the request body is a JSON object before unpacking it, returning a standard 400 validation error otherwise — consistent with how the endpoint already reports other validation failures.

How did you test this code?

Added a test (test_edge_identities_update_trait__malformed_payload__returns_400) that sends a JSON array as the request body to the update-traits endpoint and asserts a 400 response. I confirmed this test reproduces the original crash on the unpatched code (fails with the exact TypeError from the linked Sentry issue) and passes with the fix applied.

Ran the full test module for this view (api/tests/integration/edge_api/identities/test_edge_identity_viewset.py, 22 tests) against a local Postgres database — all passing. Also ran ruff (lint + format) and mypy on the changed files with no issues.

[vercel]

@bardock-2393 is attempting to deploy a commit to the Flagsmith Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0f787986-f5ad-4fd0-a0b4-2db4cd916e34

📥 Commits

Reviewing files that changed from the base of the PR and between fc33002 and cd5aca0.

📒 Files selected for processing (2)

• api/edge_api/identities/views.py
• api/tests/integration/edge_api/identities/test_edge_identity_viewset.py

---

📝 Walkthrough

Walkthrough

The update_traits endpoint now validates that request data is a JSON object before creating a TraitModel. Non-object payloads raise a DRF ValidationError. An integration test verifies that a JSON list returns HTTP 400.

Estimated code review effort: 2 (Simple) | ~10 minutes

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.57%. Comparing base (9f3a4ee) to head (cd5aca0).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8199      +/-   ##
==========================================
- Coverage   98.71%   98.57%   -0.15%     
==========================================
  Files        1531     1531              
  Lines       61241    61267      +26     
==========================================
- Hits        60453    60392      -61     
- Misses        788      875      +87     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.