feat: Exclude verified Edge Proxy requests from API usage tracking

[gagantrivedi]

Changes

Contributes to Flagsmith/flagsmith-private#256

An Edge Proxy reports the requests it serves through its own usage endpoint, so counting its /environment-document/ fetches here would double-count. APIUsageMiddleware now skips a request when the private edge_proxy app verifies it as the proxy's own — is_edge_proxy_request() checks the X-Proxy-Key value and that the key's grants cover the presented environment. Bare header presence is never trusted, so the header can't be spoofed to dodge metering.

Wired only on non-SaaS deployments with the edge_proxy app installed; SaaS behaviour is untouched.

Stacked on #8305. Before merge: bump the flagsmith-private pin to the release that ships is_edge_proxy_request.

How did you test this code?

19 middleware unit tests: verifier wired only when installed + non-SaaS; verified requests untracked, unverified tracked; a proxy header with no verifier available still tracked (spoof regression); existing tracking cases unchanged. The verifier itself is tested against a real database in flagsmith-private.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs	Ignored	Preview	Aug 29, 2026 10:33am
flagsmith-frontend-preview	Ignored	Preview	Aug 29, 2026 10:33am
flagsmith-frontend-staging	Ignored	Preview	Aug 29, 2026 10:33am

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0a1d1ca5-7f63-4f40-831c-77081dc20b94

📥 Commits

Reviewing files that changed from the base of the PR and between 4330617 and b0a2a51.

📒 Files selected for processing (2)

• api/app_analytics/middleware.py
• api/tests/unit/app_analytics/test_middleware.py

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

APIUsageMiddleware conditionally wires is_edge_proxy_request for non-SaaS deployments with Edge Proxy installed. It skips usage tracking for verified Edge Proxy requests with an X-Environment-Key header. Tests cover deployment wiring, verified and unverified requests, and tracking when the verifier is not wired.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to b0a2a

The PR excludes only verified Edge Proxy requests from API usage tracking while retaining tracking when verification is unavailable; no actionable merge-blocking risk remains after normal checks and review.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gagantrivedi]

Companion PRs for Flagsmith/flagsmith-private#256:

• Proxy-side reporter: feat: Report served-request usage edge-proxy-rs#19 (stacked on feat: sync the served environment set from the proxy config edge-proxy-rs#18)
• Usage ingestion endpoint: Flagsmith/flagsmith-private#282
• Core middleware exclusion: feat: Exclude verified Edge Proxy requests from API usage tracking #8407 (stacked on feat(edge-proxy): Wire the flagsmith-private edge_proxy app into the api #8305)

Merge/deploy order: #282 and 8407 (with the flagsmith-private pin bump) before any proxy build with #19 is deployed, else document polls double-count during the overlap.

[github-actions]

Docker builds report

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-e2e:pr-8407	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api-test:pr-8407	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-frontend:pr-8407	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-api:pr-8407	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith:pr-8407	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-8407	Finished ✅	Results ✅

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.81%. Comparing base (4330617) to head (93225c5).

Additional details and impacted files

@@                     Coverage Diff                     @@
##           feat/edge-proxy-app-wiring    #8407   +/-   ##
===========================================================
  Coverage                       98.81%   98.81%           
===========================================================
  Files                            1621     1621           
  Lines                           66103    66147   +44     
===========================================================
+ Hits                            65319    65363   +44     
  Misses                            784      784           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

✅ oss · depot-ubuntu-latest-arm-16 — run #19949 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 38.1 seconds
 b0a2a51
 🔄 Run: #19949 (attempt 1)

🗂️ Previous results

✅ oss · depot-ubuntu-latest-16 — run #19949 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 41.6 seconds
 b0a2a51
 🔄 Run: #19949 (attempt 1)