feat(api): Restrict identity overrides to a single multivariate variant

[khvn26]

Thanks for submitting a PR! Please check the boxes below:

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Contributes to #8597

In this PR, we reject identity override writes, in Core and Edge, unless they pin a single variant at 100% or none for the control value.

This is a breaking change for API clients writing multivariate splits to identity overrides. The dashboard never does.

Existing identity overrides storing a split are left as they are, pending scoping of their migration.

How did you test this code?

Added tests for creating and updating a Core identity override, and creating an Edge one, with no variants, a pinned variant, a split, and a partial variant.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated
docs	Ignored	Preview	Sep 25, 2026 7:51pm UTC
flagsmith-frontend-preview	Ignored	Preview	Sep 25, 2026 7:51pm UTC
flagsmith-frontend-staging	Ignored	Preview	Sep 25, 2026 7:51pm UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a2292e0b-0e43-4f2f-918c-fa3b76c27144

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.81%. Comparing base (9900822) to head (252e236).

Additional details and impacted files

@@                      Coverage Diff                      @@
##           stack/4-environment-flags    #8605      +/-   ##
=============================================================
- Coverage                      98.82%   98.81%   -0.01%     
=============================================================
  Files                           1645     1645              
  Lines                          67561    67591      +30     
=============================================================
+ Hits                           66764    66789      +25     
- Misses                           797      802       +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Docker builds report

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-e2e:pr-8605	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-frontend:pr-8605	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-api-test:pr-8605	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith:pr-8605	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-api:pr-8605	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-8605	Finished ✅	Results ✅

[github-actions]

✅ private-cloud · depot-ubuntu-latest-16 — run #20882 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 2 passed

Details

 2 tests across 2 suites
 49.2 seconds
 252e236
 🔄 Run: #20882 (attempt 1)

🗂️ Previous results

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #20882 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 4 passed

Details

 4 tests across 4 suites
 11.7 seconds
 252e236
 🔄 Run: #20882 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #20882 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 35.1 seconds
 252e236
 🔄 Run: #20882 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #20882 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 31.2 seconds
 252e236
 🔄 Run: #20882 (attempt 1)

[github-actions]

Visual Regression

19 screenshots compared. See report for details.
View full report