fix: prevent infinite API loop on invalid environment URLs

[talissoncosta]

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Closes #7283

When the URL contained an environment key that didn't belong to the current project (deleted env, typo, env from another project, stale bookmark, or permission revoked mid-session), the app entered an infinite API request loop and showed a sidebar loader that never resolved. Further requests appeared with the literal string undefined in the path.

Root cause

Two bugs compounded:

1. EnvironmentReadyChecker polled every 1s with no error off-ramp. It only stopped polling on a successful response with is_creating: false — on a 4xx it kept polling forever.
2. Project scoping wasn't checked. The backend returns a single environment by api_key regardless of project scope, so a valid env key belonging to a different project returns 200 OK and the checker falls through to render the page. Downstream components then fire queries with missing or stale env context — some using env?.api_key in URL templates without a fallback, producing /api/v1/environments/undefined/... URLs.

Sibling sidebar components (EnvironmentAside, EnvironmentNavbar) conflated "env list loading" with "env missing from list" and showed loaders forever.

Fix

• EnvironmentReadyChecker: source of truth is now the project's env list (useGetEnvironmentsQuery). If the URL env isn't in the list, render an "Environment not found" state. The single-env poll is kept for the is_creating happy path but now skips once polling is complete or the env is known missing.
• State reset during render (not via useEffect) when the env ID changes, so recovering via URL change is instant and doesn't flash stale children.
• Extracted the three view states into LoadingState, CreatingState, NotFoundState components; render flow is now guard clauses instead of nested ternaries.
• Handled the /environment/create sentinel so the new-env form isn't caught.
• EnvironmentAside: hides the whole sidebar when the env isn't in the project list.
• EnvironmentNavbar: skip: !environment on the change-request queries (no more undefined URL fetches); returns null when env isn't in the list.
• Small cleanup: dropped redundant `${projectId}` template coerces in the two files touched (fixes pre-existing string not assignable to number TS errors).

How did you test this code?

Manual verification on local dev server (ENV=local npm run dev):

• /project/<id>/environment/<invalid-key>/features → shows "Environment not found" in the main area, sidebar hidden, no repeat requests in Network tab.
• /project/<id>/environment/<valid-key>/features → loads features normally.
• /project/<id>/environment/create → create form renders (sentinel preserved).
• From an invalid env → click top tabs / env selector → navigate into a valid env → app recovers without reload.
• Confirmed no /environments/undefined/... URLs fire in any of the above flows.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
flagsmith-frontend-preview	Ready	Preview, Comment	Apr 17, 2026 7:46pm
flagsmith-frontend-staging	Ready	Preview, Comment	Apr 17, 2026 7:46pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Ignored		Apr 17, 2026 7:46pm