fix(Audit): Retrieving records via /api/v1/audit/ with a master API key results in error

[bardock-2393]

Thanks for submitting a PR! Please check the boxes below:

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Listing audit log records with a Master API Key returns a 500 instead of the records. Anyone driving Flagsmith through the Terraform provider, a CI script, or a SIEM/compliance pipeline cannot read the audit log at all with the credential they already use for everything else — the endpoint fails before it gets as far as checking what the key is allowed to see.

The endpoint assumed the caller was always a signed-in user, and looked up their organisations by following a database relation that only exists for real user accounts. A Master API Key is not a user account, so that lookup fell over.

• /api/v1/audit/ now returns audit logs for Master API Key callers instead of erroring.
• Who can see what is unchanged: an admin key sees its own organisation's records, and a non-admin key sees nothing — the same rule already applied to admin and non-admin users.
• The six Platform Hub endpoints had the same underlying assumption and were also erroring for Master API Keys. They are fixed by the same change, and covered by a test.
• Removed two now-redundant type: ignore comments in the surrounding code.

Closes #6583

Review effort: 2/5

How did you test this code?

Added tests that fail on main and pass with this change:

• /api/v1/audit/ with an admin Master API Key returns the organisation's records. Without the fix this reproduces the reported TypeError: Field 'id' expected a number but got <APIKeyUser> exactly.
• /api/v1/audit/ with a non-admin Master API Key returns an empty list, matching the existing behaviour for non-admin users.
• /api/v1/audit/ with an admin Master API Key belonging to a different organisation returns an empty list, so the fix does not leak records across organisations.
• Platform Hub organisations endpoint with an admin Master API Key returns that organisation. Without the fix this raises AttributeError: 'APIKeyUser' object has no attribute 'get_admin_organisations'.

The existing tests covering user-authenticated access to this endpoint (regular user, and admin of another organisation) still pass unchanged, which is what confirms the visibility rules did not shift.

Also ran the full backend suite (4518 passed, 48 skipped — the only errors were InfluxDB connection failures from that service not running locally, in tests unrelated to this change), mypy in strict mode across the codebase, and pre-commit over the changed files.

[vercel]

@bardock-2393 is attempting to deploy a commit to the Flagsmith Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8e14232f-3679-4681-99cc-ccf588f71563

📥 Commits

Reviewing files that changed from the base of the PR and between 6c88198 and 5f59100.

📒 Files selected for processing (7)

• api/api_keys/user.py
• api/audit/views.py
• api/tests/unit/audit/test_unit_audit_views.py
• api/tests/unit/platform_hub/test_views.py
• api/tests/unit/users/test_unit_users_models.py
• api/users/abc.py
• api/users/models.py

---

📝 Walkthrough

Walkthrough

Adds get_admin_organisations() to the user contract and implements it for API-key and administrator users. Audit views now use this method to restrict project and organisation visibility. Tests cover administrator, non-administrator, and cross-organisation master API keys for audit logs and platform-hub organisations. Type annotations are also updated.

Estimated code review effort: 3 (Moderate) | ~20 minutes

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.59%. Comparing base (6c88198) to head (5f59100).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8275      +/-   ##
==========================================
- Coverage   98.73%   98.59%   -0.15%     
==========================================
  Files        1567     1567              
  Lines       62379    62416      +37     
==========================================
- Hits        61591    61538      -53     
- Misses        788      878      +90     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.