Skip to content

fix(multivariate): Handled missing default_percentage_allocation in option validation#6750

Open
adityapradhan10 wants to merge 15 commits intoFlagsmith:mainfrom
adityapradhan10:fix/insufficient-validation-multivariate
Open

fix(multivariate): Handled missing default_percentage_allocation in option validation#6750
adityapradhan10 wants to merge 15 commits intoFlagsmith:mainfrom
adityapradhan10:fix/insufficient-validation-multivariate

Conversation

@adityapradhan10
Copy link

@adityapradhan10 adityapradhan10 commented Feb 23, 2026

Thanks for submitting a PR! Please check the boxes below:

  • I have read the Contributing Guide.
  • I have added information to docs/ if required so people know about the feature.
  • I have filled in the "Changes" section below.
  • I have filled in the "How did you test this code" section below.

Changes

Closes #6615

Fixes a KeyError when creating or updating multivariate options via the API without specifying optional fields.

Root cause: The validate() method in MultivariateFeatureOptionSerializer accessed attrs["feature"] and attrs["default_percentage_allocation"] directly, causing crashes on partial updates or creates when these fields were omitted.

Fixes a KeyError when creating or updating multivariate options via the API when optional fields are omitted.

Root cause: MultivariateFeatureOptionSerializer.validate() used attrs["feature"] and attrs["default_percentage_allocation"], which raises when those keys are missing on partial updates or when creating via nested routes without sending them.

Fix:

  • feature: Resolved with fallbacks: attrs.get("feature"), then for updates self.instance.feature, then for nested routes the feature from URL kwargs (feature_pk / project_pk). The serializer marks feature as not required via extra_kwargs so POSTs without feature (e.g. when the feature is in the path) still reach validate().
  • default_percentage_allocation: Resolved with attrs.get(..., instance_default_allocation), where instance_default_allocation is the instance value when present, or 100 for creates or legacy rows with NULL. The chosen value is written back into attrs["default_percentage_allocation"] so validation and persistence stay in sync and legacy NULL is corrected on save.

Note: No documentation changes required - this is a bug fix for the existing API behaviour, not a new feature.

How did you test this code?

  • test_create_mv_option__without_feature_in_payload__uses_feature_from_url – Create without feature in the body (feature from URL) → 201 and correct feature / allocation.
  • test_create_mv_option__without_default_percentage_allocation__uses_default – Create without default_percentage_allocation → 201 and value 100.
  • test_create_mv_option__without_default_percentage_allocation_with_existing_sibling_and_total_gt_100__returns_400 – Create without allocation when a sibling has 50% → 400 and "Invalid percentage allocation".
  • test_partial_update_mv_option__without_feature_and_allocation__uses_existing_values – PATCH without feature or default_percentage_allocation → 200 and existing values kept.
  • test_partial_update_mv_option__handles_legacy_null_default_percentage_allocation – Serializer update with an instance that has default_percentage_allocation is None in memory → validates as 100 and persists 100 (legacy NULL handling).
  • test_partial_update_default_percentage_allocation__sibling_total_gt_100__returns_400 – PATCH that would push total allocation over 100% → 400 and "Invalid percentage allocation".

@adityapradhan10 adityapradhan10 requested a review from a team as a code owner February 23, 2026 10:42
@adityapradhan10 adityapradhan10 requested review from Zaimwa9 and removed request for a team February 23, 2026 10:42
@vercel
Copy link

vercel bot commented Feb 23, 2026

@adityapradhan10 is attempting to deploy a commit to the Flagsmith Team on Vercel.

A member of the Team first needs to authorize it.

@github-actions github-actions bot added the api Issue related to the REST API label Feb 23, 2026
Copy link
Member

@khvn26 khvn26 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The fix looks solid to me. Need to address test naming convention/typing.

Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

api Issue related to the REST API

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Insufficient validation in /api/v1/projects/{project_pk}/features/{feature_pk}/mv-options/

2 participants