From 95a92f87488eec91289d8ba15172f230006c575c Mon Sep 17 00:00:00 2001 From: Prakash Date: Sun, 20 Sep 2026 18:13:33 +0530 Subject: [PATCH] fix: return 404 instead of 500 for invalid identity_pk in feature states IdentityFeatureStateViewSet.get_queryset() passed the raw identity_pk URL kwarg directly into a queryset filter, causing Django's ORM to raise an unhandled ValueError when the value wasn't a valid integer (e.g. a malformed or non-numeric ID). Use get_object_or_404 to resolve the identity first, matching the existing pattern already used in this same class's `all()` action. Fixes #7361 --- api/features/views.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/api/features/views.py b/api/features/views.py index db62e6f445f1..be8bcc0ddda9 100644 --- a/api/features/views.py +++ b/api/features/views.py @@ -877,7 +877,8 @@ def get_queryset(self): # type: ignore[no-untyped-def] if getattr(self, "swagger_fake_view", False): return FeatureState.objects.none() - return super().get_queryset().filter(identity__pk=self.kwargs["identity_pk"]) # type: ignore[no-untyped-call] + identity = get_object_or_404(Identity, pk=self.kwargs["identity_pk"]) + return super().get_queryset().filter(identity=identity) # type: ignore[no-untyped-call] @action(methods=["GET"], detail=False) def all(self, request, *args, **kwargs): # type: ignore[no-untyped-def]