fix(api): handle null environment in validate_environment

[wavebyrd]

Summary

Fixes #6597

FeatureStateSerializerBasic.validate_environment raises an AttributeError when a request passes null for the environment field. The method tries to access .id on the environment parameter without first checking for None.

Since null=True on the environment column is a historical data layer detail and not intended API behaviour, this rejects null with a ValidationError instead of passing it through.

Changes

• api/features/serializers.py: Added None check in validate_environment that raises ValidationError before accessing environment.id
• api/tests/unit/features/test_unit_features_serializers.py: Added test verifying null environment is rejected with a validation error

Test plan

• New unit test: test_feature_state_serializer_basic__null_environment__returns_validation_error verifies passing environment: None is rejected and does not raise AttributeError
• CI passes existing test suite

[vercel]

Someone is attempting to deploy a commit to the Flagsmith Team on Vercel.

A member of the Team first needs to authorize it.

[emyller]

Thanks for your contribution @wavebyrd!

As I understand, environment is nullable in the data layer only because we failed to constrain it after historical data. I believe the correct resolution might explore preventing a null environment being received in the validation layer.

[wavebyrd]

Thanks for the feedback @emyller — you're right. Updated to raise a ValidationError instead of passing None through. The null environment is now explicitly rejected at the validation layer.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

ValidationError prevents intended context-based environment fallback

High Severity

Raising ValidationError in validate_environment when environment is None prevents the object-level validate() from ever running. In DRF, field-level validation errors block execution of validate(). The validate() method at line 609 has an intentional fallback — attrs.get("environment") or self.context["environment"] — designed to resolve environment from the serializer context when it's absent from request data. Since FeatureState.environment is null=True, DRF passes None through to validate_environment. Returning None here instead of raising would let the fallback work as intended.

Additional Locations (1)

• api/features/serializers.py#L607-L609

 

[cursor]

You have used all of your free Bugbot PR reviews.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[wavebyrd]

Moved the null check into validate() so the context fallback still works. If environment is None after checking both the payload and context, it now raises a ValidationError there instead.

[matthewelwell]

Hi @wavebyrd , can you check this PR please - it looks like you've perhaps made a mistake in a rebase or merge because it's showing 3000+ files changed.

[wavebyrd]

Fixed the rebase - should now show only the 4 commits for this fix. Sorry about that!