[Zaimwa9]

Thanks for submitting a PR! Please check the boxes below:

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Self-hosted installations on PostgreSQL can use Flagsmith's own database as the experimentation warehouse. SDK events reach the table through the follow-up PR.

• Migration 0019 adds the events table as a normal Django model, SDKExperimentationEvent.
• A postgres connection with config {"source": "flagsmith_database"} and no credentials is created connected, and reads that table using Django's default database settings.
• Only allowed on self-hosted PostgreSQL, otherwise 400; delivery status is ignored for these connections.

How did you test this code?

Unit tests against the test Postgres database: validation, Enable, reads from seeded rows and delivery-status handling.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 2, 2026 1:29pm UTC

2 Skipped Deployments

Project	Deployment	Actions	Updated
flagsmith-frontend-preview	Ignored	Preview	Nov 2, 2026 1:29pm UTC
flagsmith-frontend-staging	Ignored	Preview	Nov 2, 2026 1:29pm UTC

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: bd788b5
• Latest commit, not reviewed: 943d0b8

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• Resume reviews
• Review completed - (Check again to review again)

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ce6a72d1-a7c1-4fe9-ab37-7cbd48431f6f

Commits

Reviewing files that changed from the base of the PR and between aac563a and bd788b5.

Files selected for processing: 12

• api/experimentation/migrations/0019_add_sdk_experimentation_event.py
• api/experimentation/models.py
• api/experimentation/results_query.py
• api/experimentation/services.py
• api/experimentation/warehouses/constants.py
• api/experimentation/warehouses/dialect.py
• api/experimentation/warehouses/postgres.py
• api/experimentation/warehouses/queries.py
• api/tests/unit/experimentation/conftest.py
• api/tests/unit/experimentation/test_services.py
• api/tests/unit/experimentation/warehouses/test_postgres.py
• docs/docs/deployment-self-hosting/observability/_events-catalogue.md

Files with no reviewable changes: 2

• api/tests/unit/experimentation/conftest.py
• api/experimentation/warehouses/constants.py

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

The change adds an SDK experimentation event table and allows a PostgreSQL warehouse connection to use the Flagsmith database as its event source. Query dialects now provide the event table name, and query paths use that name. Source configuration validation and credential handling are updated. The change also updates generated connection names, delivery-status handling, and related tests.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: Low · previous review bd788

The new Flagsmith database warehouse source reads events with its own database session. Deployments that set Django's assume_role option would see that session run under the login role's privileges instead. Most installations are unaffected, so the merge risk is low and bounded.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.89%. Comparing base (c964f50) to head (943d0b8).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #8857    +/-   ##
========================================
  Coverage   98.88%   98.89%            
========================================
  Files        1690     1691     +1     
  Lines       70891    71035   +144     
========================================
+ Hits        70104    70248   +144     
  Misses        787      787            

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Zaimwa9]

@themis-blindfold review

[themis-blindfold]

⚖️ Themis review: 🟠 Fix before merge

TL;DR: The new self-hosted database mode can be created as connected even when the runtime API role cannot read its event table. The completed API unit, analysis, and end-to-end checks passed; the remaining automated review is still running.

Area	Score
🎯 Correctness	3/5
🧪 Test coverage	4/5
📐 Code quality	4/5
🚀 Product impact	3/5

🟠 Majors

• api/experimentation/warehouses/postgres.py:404 — Flagsmith-database connections are marked connected without verifying that the runtime session can read the events table.

⚖️ Acknowledged

• Preserve delivery-view privileges during migration reversal — thread resolved by @Zaimwa9
• Describe the required table privileges accurately — thread resolved by @Zaimwa9
• Ensure PostgreSQL test roles are cleaned up on failure — thread resolved by @Zaimwa9
• Propagate Django's configured assumed database role — thread resolved by @Zaimwa9
• Describe the required schema USAGE privilege — thread resolved by @Zaimwa9
• Require only the read privileges needed by the Flagsmith-database source — thread resolved by @coderabbitai[bot]
• SDK-event regular-expression performance risk — thread resolved by @github-advanced-security[bot]

📝 Walkthrough

• Database event storage - adds the Django model and indexes used by the self-hosted event store.
• Warehouse configuration - recognises the flagsmith_database PostgreSQL source, clears credentials, and names it for the environment.
• Read path - selects the application event table through the PostgreSQL dialect while keeping external warehouses on their existing table.
• Connection status - skips warehouse-delivery status for this direct-database mode.

🧪 How to verify

1. Run pytest api/tests/unit/experimentation/warehouses/test_postgres.py api/tests/unit/experimentation/test_views.py against PostgreSQL.
2. Configure the runtime database role without SELECT on experimentation_sdkexperimentationevent; creating this source must return an errored connection rather than connected.
3. Grant SELECT, create the source, seed exposure and conversion rows, then fetch event names and experiment results.
4. Patch between this source and an external PostgreSQL configuration, checking that credentials are cleared and then required as appropriate.
5. Confirm a delivery-status error does not alter the direct-database connection status.
   Automate: add a verification test with a runtime role that lacks access to the Django event table.

Product take: This is a useful self-hosted experimentation foundation, but a green connection badge must mean the API can actually query the store. Until then, operators can complete setup successfully and only discover the failure when results are requested.

🧭 Assumptions & unverified claims

No unverified assumptions or claims.

A warehouse that says “connected” should at least say hello to its own table. · reviewed at bd788b5