fix(API): _validate_owner_removal counts non-existent group IDs as removals

api/features/views.py

@@ -448,8 +448,7 @@ def remove_group_owners(self, request, *args, **kwargs):  # type: ignore[no-unty
         serializer.is_valid(raise_exception=True)
         self._validate_owner_removal(
             feature,
-            owners_to_remove=0,
-            group_owners_to_remove=len(serializer.validated_data["group_ids"]),
+            group_ids_to_remove=serializer.validated_data["group_ids"],
         )
         serializer.remove_group_owners(feature)
         response = Response(self.get_serializer(instance=feature).data)
@@ -486,8 +485,7 @@ def remove_owners(self, request, *args, **kwargs):  # type: ignore[no-untyped-de
         feature = self.get_object()
         self._validate_owner_removal(
             feature,
-            owners_to_remove=len(serializer.validated_data["user_ids"]),
-            group_owners_to_remove=0,
+            user_ids_to_remove=serializer.validated_data["user_ids"],
         )
         serializer.remove_users(feature)
 
@@ -496,11 +494,15 @@ def remove_owners(self, request, *args, **kwargs):  # type: ignore[no-untyped-de
     def _validate_owner_removal(
         self,
         feature: Feature,
-        owners_to_remove: int,
-        group_owners_to_remove: int,
+        user_ids_to_remove: typing.Iterable[int] = (),
+        group_ids_to_remove: typing.Iterable[int] = (),
     ) -> None:
         if not feature.project.enforce_feature_owners:
             return
+        owners_to_remove = feature.owners.filter(id__in=user_ids_to_remove).count()
+        group_owners_to_remove = feature.group_owners.filter(
+            id__in=group_ids_to_remove
+        ).count()
         remaining = (
             feature.owners.count()
             - owners_to_remove

api/tests/unit/features/test_unit_features_views.py

@@ -5468,3 +5468,40 @@ def test_remove_group_owners__enforce_owners_user_owners_remain__returns_200(
     feature.refresh_from_db()
     assert group not in feature.group_owners.all()
     assert admin_user in feature.owners.all()
+
+
+def test_remove_group_owners__enforce_owners_nonexistent_group_id_in_request__returns_200(
+    admin_client_new: APIClient,
+    project: Project,
+    feature: Feature,
+    admin_user: FFAdminUser,
+    organisation: Organisation,
+) -> None:
+    # Given
+    project.enforce_feature_owners = True
+    project.save()
+    group = UserPermissionGroup.objects.create(
+        name="Test Group", organisation=organisation
+    )
+    feature.owners.add(admin_user)
+    feature.group_owners.add(group)
+    nonexistent_group_id = group.id + 9999
+
+    url = reverse(
+        "api-v1:projects:project-features-remove-group-owners",
+        args=[project.id, feature.id],
+    )
+    # A stale/non-existent group ID alongside a real one should not inflate
+    # the removal count and block a legitimate removal.
+    data = {"group_ids": [group.id, nonexistent_group_id]}
+
+    # When
+    response = admin_client_new.post(
+        url, data=json.dumps(data), content_type="application/json"
+    )
+
+    # Then
+    assert response.status_code == status.HTTP_200_OK
+    feature.refresh_from_db()
+    assert group not in feature.group_owners.all()
+    assert admin_user in feature.owners.all()