fix: project admin feature import permissions (#8421)

Author: bakirFS

api/features/import_export/permissions.py

@@ -17,10 +17,9 @@ def has_permission(self, request: Request, view: APIView) -> bool:
         environment = Environment.objects.select_related(
             "project__organisation",
         ).get(id=view.kwargs["environment_id"])
-        organisation = environment.project.organisation
 
-        # Since feature imports can be destructive, use org admin.
-        return request.user.is_organisation_admin(organisation)  # type: ignore[union-attr,no-any-return]
+        # Since feature imports can be destructive, use project admin.
+        return request.user.is_project_admin(environment.project)  # type: ignore[union-attr,no-any-return]
 
 
 class CreateFeatureExportPermissions(IsAuthenticated):

api/tests/unit/features/import_export/test_unit_features_import_export_views.py

@@ -254,6 +254,31 @@ def test_feature_import__already_processing__returns_bad_request(
     ]
 
 
+def test_feature_import__project_admin__creates_import(
+    staff_client: APIClient,
+    environment: Environment,
+    with_project_permissions: WithProjectPermissionsCallable,
+) -> None:
+    # Given
+    with_project_permissions(admin=True)  # type: ignore[call-arg]
+    assert FeatureImport.objects.count() == 0
+    url = reverse(
+        "api-v1:features:feature-import",
+        args=[environment.id],
+    )
+
+    file_data = b"[]"
+    uploaded_file = SimpleUploadedFile("test.23.json", file_data)
+    data = {"file": uploaded_file, "strategy": OVERWRITE_DESTRUCTIVE}
+
+    # When
+    response = staff_client.post(url, data=data, format="multipart")
+
+    # Then
+    assert response.status_code == 201
+    assert FeatureImport.objects.count() == 1
+
+
 def test_feature_import__unauthorized_user__returns_forbidden(
     staff_client: APIClient,
     environment: Environment,

frontend/web/components/import-export/FeatureImport.tsx

@@ -127,7 +127,7 @@ const FeatureExport: FC<FeatureExportType> = ({ projectId }) => {
           setFileData(null)
           refetch()
         } else {
-          toast('Failed to import flags')
+          toast('Failed to import flags', 'danger')
         }
       })
     }

frontend/web/components/import-export/ImportPage.tsx

@@ -13,10 +13,10 @@ import Button from 'components/base/forms/Button'
 import PanelSearch from 'components/PanelSearch'
 import TabItem from 'components/navigation/TabMenu/TabItem'
 import FeatureImport from './FeatureImport'
-import AccountStore from 'common/stores/account-store'
 import Constants from 'common/constants'
 import { useHistory } from 'react-router-dom'
-import { OrganisationPermission } from 'common/types/permissions.types'
+import { ProjectPermission } from 'common/types/permissions.types'
+import { useHasPermission } from 'common/providers/Permission'
 
 type ImportPageType = {
   projectId: string
@@ -25,6 +25,12 @@ type ImportPageType = {
 
 const ImportPage: FC<ImportPageType> = ({ projectId, projectName }) => {
   const history = useHistory()
+  const { isLoading: isLoadingPermission, permission: isProjectAdmin } =
+    useHasPermission({
+      id: projectId,
+      level: 'project',
+      permission: ProjectPermission.ADMIN,
+    })
   const [LDKey, setLDKey] = useState<string>('')
   const [importId, setImportId] = useState<number>()
   const [isLoading, setIsLoading] = useState<boolean>(false)
@@ -93,15 +99,19 @@ const ImportPage: FC<ImportPageType> = ({ projectId, projectName }) => {
     })
   }
 
-  const isAdmin = AccountStore.isAdmin()
+  if (isLoadingPermission) {
+    return (
+      <div className='text-center mt-4'>
+        <Loader />
+      </div>
+    )
+  }
 
-  if (!isAdmin) {
+  if (!isProjectAdmin) {
     return (
       <div
         dangerouslySetInnerHTML={{
-          __html: Constants.organisationPermissions(
-            OrganisationPermission.ADMIN,
-          ),
+          __html: Constants.projectPermissions(ProjectPermission.ADMIN),
         }}
         className='mt-4'
       />