fix(features): fix cache isolation for server-only features

[blackjid]

Thanks for submitting a PR! Please check the boxes below:

• I have added information to docs/ if required so people know about the feature!
• I have filled in the "Changes" section below?
• I have filled in the "How did you test this code" section below?
• I have used a Conventional Commit title for this Pull Request

Changes

Fixed a cache isolation bug where server-only features could leak to client requests. And the other way around, where server-only keys could not be presented because they are cached from a client request.

Problem:
The features endpoint cache used only environment.api_key as the cache key. Both CLIENT and SERVER requests shared the same cache, so server-only features cached by server requests could be served to client requests.

Solution:
Updated the cache key to include request origin: f"{environment.api_key}:{request_origin}"

Now CLIENT and SERVER requests have separate cache entries:

• CLIENT: env_123:CLIENT
• SERVER: env_123:SERVER

Files changed:

• api/features/views.py - Fixed cache key
• api/tests/unit/features/test_unit_features_views.py - Added test

How did you test this code?

TDD approach:

1. Added failing test - Created test that demonstrated the bug: server request populated cache, then client request incorrectly got server-only features
2. Implemented fix - Modified cache key to include request origin
3. Test now passes - Client and server requests properly isolated

Results:

# Before fix: FAILED ❌ 
# After fix: PASSED ✅
pytest test_get_flags__server_key_only_feature__cache_isolation_between_client_and_server_keys

# No regressions: ✅
pytest tests/unit/features/test_unit_features_views.py -k "cache"

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Preview	Comments	Updated (UTC)
docs	Ignored	Preview		Sep 22, 2025 7:48pm
flagsmith-frontend-preview	Ignored	Preview		Sep 22, 2025 7:48pm
flagsmith-frontend-staging	Ignored	Preview		Sep 22, 2025 7:48pm

[vercel]

@blackjid is attempting to deploy a commit to the Flagsmith Team on Vercel.

A member of the Team first needs to authorize it.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.99%. Comparing base (dfb41c6) to head (1070611).
⚠️ Report is 19 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6092      +/-   ##
==========================================
- Coverage   98.00%   97.99%   -0.01%     
==========================================
  Files        1277     1278       +1     
  Lines       44980    44925      -55     
==========================================
- Hits        44082    44026      -56     
- Misses        898      899       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[matthewelwell]

Looks good to me.