Add audit logs for project creation and deletion by srijantrpth · Pull Request #8065 · Flagsmith/flagsmith

srijantrpth · 2026-07-22T06:33:06Z

Thanks for submitting a PR! Please check the boxes below:

I have read the Contributing Guide.
I have added information to docs/ if required so people know about the feature.
I have filled in the "Changes" section below.
I have filled in the "How did you test this code" section below.

Changes

Added PROJECT_CREATED_MESSAGE and PROJECT_DELETED_MESSAGE constants in api/audit/constants.py.
Updated ProjectViewSet.perform_create and perform_destroy in api/projects/views.py to automatically record an AuditLog entry upon project creation and deletion.
Added comprehensive unit tests in api/tests/unit/projects/test_unit_projects_views.py to verify audit log generation for both actions.

How did you test this code?

Ran unit tests locally using pytest with the test Django settings and verified that all test cases passed successfully, confirming proper audit log count, message formatting, and object relationship mapping.

vercel · 2026-07-22T06:33:11Z

@srijantrpth is attempting to deploy a commit to the Flagsmith Team on Vercel.

A member of the Team first needs to authorize it.

for more information, see https://pre-commit.ci

coderabbitai · 2026-07-22T06:33:37Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Project audit contracts now include creation and deletion messages and a PROJECT related-object type. Project creation and deletion record AuditLog entries with project identity, formatted messages, related-object metadata, and conditional author handling. Deletion records the audit entry within an atomic transaction before deleting the project. Unit tests cover audit entries produced by both lifecycle operations.

Estimated code review effort: 2 (Simple) | ~10 minutes

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Copilot

Pull request overview

This PR adds explicit audit log entries for project lifecycle events (creation and deletion) so that these actions are visible in organisation audit logs, addressing Issue #7571.

Changes:

Create an AuditLog record when a project is created via the Projects API.
Create an AuditLog record when a project is deleted via the Projects API.
Add unit tests covering the new audit log behaviour.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
api/projects/views.py	Writes audit log records during project create / delete operations.
api/audit/constants.py	Introduces audit log message constants for project created / deleted events.
api/audit/related_object_type.py	Adds `PROJECT` as a new related object type for audit log records.
api/tests/unit/projects/test_unit_projects_views.py	Adds unit tests asserting audit logs are created for project create / delete.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

coderabbitai

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

api/projects/views.py (1)

110-136: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Wrap the project lifecycle writes in a transaction. perform_create() does serializer.save(), UserProjectPermission.objects.create(), and AuditLog.objects.create() as separate writes, and perform_destroy() writes the audit row before instance.delete(). A failure part-way through can leave the project, permissions, and audit trail out of sync. transaction.atomic() around each path keeps them consistent.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 614623b9-245e-4bd2-ad27-0f0f680b392d

📥 Commits

Reviewing files that changed from the base of the PR and between 94ac7af and 69d94a3.

📒 Files selected for processing (4)

api/audit/constants.py
api/audit/related_object_type.py
api/projects/views.py
api/tests/unit/projects/test_unit_projects_views.py

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

for more information, see https://pre-commit.ci

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

api/projects/views.py (1)

130-138: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Wrap the audit insert and delete in transaction.atomic(). In autocommit, instance.delete() can fail after the audit row is written, leaving a deletion audit for a project that still exists.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 96aedf97-5c13-461c-9d42-b2e02623c949

📥 Commits

Reviewing files that changed from the base of the PR and between 69d94a3 and 818d842.

📒 Files selected for processing (1)

api/projects/views.py

for more information, see https://pre-commit.ci

coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

api/projects/views.py (1)

117-125: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Preserve the master API-key actor for creation events.

For master API-key requests, author becomes None but master_api_key is never set. These audit records consequently have no actor, unlike deletion events. Populate master_api_key conditionally here too.

Proposed fix

+        is_master_api_key_user = getattr(
+            self.request.user, "is_master_api_key_user", False
+        )
         AuditLog.objects.create(
             project=project,
-            author=self.request.user
-            if not getattr(self.request.user, "is_master_api_key_user", False)
-            else None,
+            author=None if is_master_api_key_user else self.request.user,
+            master_api_key=self.request.user.key if is_master_api_key_user else None,
             related_object_id=project.id,

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 79932fa6-9afe-47ac-bf1e-2d9c8b6e9457

📥 Commits

Reviewing files that changed from the base of the PR and between b48cf12 and 5052768.

📒 Files selected for processing (1)

api/projects/views.py

coderabbitai

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

api/projects/views.py (1)

131-141: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Clear the project FK on deletion audit rows
AuditLog.project is a real foreign key with on_delete=models.DO_NOTHING, so project=instance can make instance.delete() fail at the database constraint. Set project=None and keep related_object_id=instance.id for the historical record.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ec641dd7-b675-442a-a2c2-2a27f9f3123e

📥 Commits

Reviewing files that changed from the base of the PR and between 5052768 and 183729a.

📒 Files selected for processing (1)

api/projects/views.py

Add audit logs for project creation and deletion

8f7616c

Copilot AI review requested due to automatic review settings July 22, 2026 06:33

srijantrpth requested a review from a team as a code owner July 22, 2026 06:33

srijantrpth requested review from emyller and removed request for a team July 22, 2026 06:33

[pre-commit.ci] auto fixes from pre-commit.com hooks

69d94a3

for more information, see https://pre-commit.ci

Copilot started reviewing on behalf of srijantrpth July 22, 2026 06:33 View session

github-actions Bot added the api Issue related to the REST API label Jul 22, 2026

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Comment thread api/projects/views.py Outdated

Comment thread api/projects/views.py Outdated

Comment thread api/audit/related_object_type.py

coderabbitai Bot reviewed Jul 22, 2026

View reviewed changes

Comment thread api/tests/unit/projects/test_unit_projects_views.py

srijantrpth and others added 3 commits July 22, 2026 12:16

Potential fix for pull request finding

8180c4f

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

[pre-commit.ci] auto fixes from pre-commit.com hooks

818d842

for more information, see https://pre-commit.ci

Update api/tests/unit/projects/test_unit_projects_views.py

b48cf12

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

coderabbitai Bot reviewed Jul 22, 2026

View reviewed changes

srijantrpth and others added 2 commits July 22, 2026 07:00

Wrap project deletion in a transaction to ensure atomicity

4ed9a86

[pre-commit.ci] auto fixes from pre-commit.com hooks

5052768

for more information, see https://pre-commit.ci

coderabbitai Bot reviewed Jul 22, 2026

View reviewed changes

srijantrpth added 2 commits July 22, 2026 07:13

Refactor AuditLog author assignment for master API key users

66779e2

Fix syntax error in AuditLog creation for master API key users

183729a

coderabbitai Bot reviewed Jul 22, 2026

View reviewed changes

Comment thread api/projects/views.py

srijantrpth added 2 commits July 22, 2026 07:18

Add check for master API key user in project creation

675f5a7

Set project to None in AuditLog creation for master API key users

d1c25f8

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add audit logs for project creation and deletion#8065

Add audit logs for project creation and deletion#8065
srijantrpth wants to merge 11 commits into
Flagsmith:mainfrom
srijantrpth:7571-project-audit-logs

srijantrpth commented Jul 22, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jul 22, 2026

Uh oh!

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading

Reviews paused

Walkthrough

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

srijantrpth commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

How did you test this code?

Uh oh!

vercel Bot commented Jul 22, 2026

Uh oh!

coderabbitai Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

srijantrpth commented Jul 22, 2026 •

edited

Loading

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading