fix: Non-admin project Role request to /projects/ID/features/ID Causes Crash

[novakzaballa]

Thanks for submitting a PR! Please check the boxes below:

• I have run pre-commit to check linting
• I have added information to docs/ if required so people know about the feature!
• I have filled in the "Changes" section below?
• I have filled in the "How did you test this code" section below?
• I have used a Conventional Commit title for this Pull Request

Changes

Tag IDs are only sent when there is permission that have tags. For example DELETE_FEATURE.

Fixes #4286

How did you test this code?

1. Create a role with View Project, View environment, and update feature state, and assign it to test user
2. Log in with the test user
3. Go to the project -> environment that you have permission to access.
4. Select a feature and update the feature state

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

3 Skipped Deployments

Name	Status	Preview	Comments	Updated (UTC)
docs	⬜️ Ignored (Inspect)	Visit Preview		Jul 16, 2024 5:09pm
flagsmith-frontend-preview	⬜️ Ignored (Inspect)	Visit Preview		Jul 16, 2024 5:09pm
flagsmith-frontend-staging	⬜️ Ignored (Inspect)	Visit Preview		Jul 16, 2024 5:09pm

[github-actions]

flagsmith-private-cloud image build and security scan finished ✨

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-private-cloud:pr-4289	Finished ✅	Results ✅

[github-actions]

flagsmith-api image build and security scan finished ✨

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-api:pr-4289	Finished ✅	Results ✅

[github-actions]

flagsmith-frontend image build and security scan finished ✨

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-frontend:pr-4289	Finished ✅	Results ✅

[github-actions]

flagsmith image build and security scan finished ✨

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith:pr-4289	Finished ✅	Results ✅

[github-actions]

flagsmith-e2e image build finished ✨

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-e2e:pr-4289	Finished ✅	Skipped

[github-actions]

Uffizzi Preview deployment-53895 was deleted.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 96.77%. Comparing base (c2a33e6) to head (cdece74).
Report is 40 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4289      +/-   ##
==========================================
+ Coverage   96.60%   96.77%   +0.16%     
==========================================
  Files        1195     1159      -36     
  Lines       39099    38079    -1020     
==========================================
- Hits        37773    36852     -921     
+ Misses       1326     1227      -99     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[matthewelwell]

I don't quite understand how this is any different? From what I can tell, the tag_ids variable is set to an empty list above, which will evaluate as falsy, the same as the default on the has_project_permission method.

Could you add more description and ideally add a test that would replicate the issue?

[github-actions]

Docker builds report

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-api-test:pr-4289	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-e2e:pr-4289	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-frontend:pr-4289	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-api:pr-4289	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith:pr-4289	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-4289	Finished ✅	Results ✅

[novakzaballa]

I don't quite understand how this is any different? From what I can tell, the tag_ids variable is set to an empty list above, which will evaluate as falsy, the same as the default on the has_project_permission method.

Could you add more description and ideally add a test that would replicate the issue?

Change the code so that instead of the value of tag_ids being [], it will be None. This change is based on this line of code:

flagsmith/api/permissions/permission_service.py

Line 74 in cdece74

- If `tag_ids` is None, tags filter will not be applied

This adjustment is needed because when making the GET request to api/v1/projects/id/features/id/, tag-based permissions should not be applied (we should only send an array, in the case of using the DELETE_FEATURE permission)