fix(API): _validate_owner_removal counts non-existent group IDs as removals

[bardock-2393]

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

When enforce_feature_owners is on, removing group owners from a feature could be wrongly rejected with a 400 if the request included a stale or non-existent group ID alongside a real one. The validation counted every ID in the request as a removal, instead of only the IDs that were actually current owners, so a harmless extra ID could make it look like the last owner was being removed.

Contributes to #8038

• _validate_owner_removal now counts only the requested IDs that are actually current owners/group owners of the feature, instead of trusting the request's ID count.

How did you test this code?

Added a regression test (test_remove_group_owners__enforce_owners_nonexistent_group_id_in_request__returns_200) reproducing the issue's exact scenario: a feature with one user owner and one group owner, removing the group owner while also passing a non-existent group ID. Verified it fails with 400 against the old code and passes with the fix. Ran the full test_unit_features_views.py suite (298 passed, 2 pre-existing skips), plus mypy and the project's lint/format pre-commit hooks, all clean.

Review effort: 1/5

[vercel]

@bardock-2393 is attempting to deploy a commit to the Flagsmith Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 95b54905-5348-466f-954a-d7ef7e06b359

📥 Commits

Reviewing files that changed from the base of the PR and between e6e8a9b and 83c36ac.

📒 Files selected for processing (2)

• api/features/views.py
• api/tests/unit/features/test_unit_features_views.py

---

📝 Walkthrough

Walkthrough

The owner removal endpoints now pass requested user and group ID iterables to _validate_owner_removal. The validator counts only existing matching owner relations before enforcing the requirement that at least one owner or group owner remains. A unit test covers removing a real group owner alongside a nonexistent group ID while a user owner remains.

Estimated code review effort: 2 (Simple) | ~10 minutes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}