[talissoncosta]

Thanks for submitting a PR! Please check the boxes below:

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Contributes to #8889

Stacked on #8940.

Filter the organisation audit log by scope. A Scope control beside the search opens a card:

• Everything, Organisation (members, roles and groups) or Project.
• Project lists the organisation's projects, then that project's environments as toggles.
• The control shows the choice and clears it with its own button. The scope lives in the URL beside the search.

Base components, used here first:

• Popover rebuilt on Floating UI: outside click, Escape and focus handled in one place. The old Popover and FocusMonitor are removed, and the PanelSearch sort menu moves to the new one.
• useOutsideClick accepts the nullable refs React 19 creates.
• Chip gets a toggle mode: a checkbox chip that turns accent and shows a tick when checked.
• SegmentedControl: one choice from a few, as a radio group with arrow keys.
• Radio rebuilt around a native input: keyboard and screen readers now work, a click never unselects, and the dot uses tokens. The scope card's project list uses it.

Two changes here are outside the flag: the PanelSearch sort menu, and the merge strategy radios on the feature import page.

Why Floating UI for the Popover:

• The old one rendered inline and hid with d-none, so parents with overflow: hidden clipped it, and it never flipped near the edge of the window. The new one renders in a portal, flips and shifts to stay on screen, and caps its height to the space left.
• It handles Escape, focus return to the trigger and the ARIA attributes, which the old one had none of. Its outside click relied on jQuery and @ts-ignore.
• @floating-ui/react was already installed through react-datepicker; it is now a direct dependency. It only positions and handles interactions, so it sits under our own components, unlike react-aria or Radix.

Next: the stories, then the RTL tests for these components.

How did you test this code?

• Unit tests for scope parsing, URL round trip, the scope label and environment colours.
• By hand against a local API: picking Organisation filters the list and adds scope=organisation to the URL; the Audit Log tab resets search and scope.
• By hand on the Projects page: the PanelSearch sort menu opens, sorts, and closes on picking an option, outside click and Escape, with focus back on the trigger.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
flagsmith-frontend-preview	Ready	Preview	Nov 13, 2026 8:23pm UTC
flagsmith-frontend-staging	Ready	Preview	Nov 13, 2026 8:23pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Ignored	Preview	Nov 13, 2026 8:23pm UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 1e3f333d-bd36-45c7-a10c-15b7cd5c4ee4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[talissoncosta]

Folded into #8940 for now.

[github-actions]

Docker builds report

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-api-test:pr-8941	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-e2e:pr-8941	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api:pr-8941	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-8941	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith:pr-8941	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-frontend:pr-8941	Finished ✅	Results ✅

[cubic-dev-ai]

8 issues found across 46 files

Confidence score: 3/5

• useAuditLogScopeData.ts can show the previous organisation’s projects while the new query is loading. Use currentData for the project list and colour map.
• ScopeCard.tsx can show a selection that no longer matches the URL after browser back/forward navigation. Sync mode when scope.type changes.
• Chip.tsx drops the remove action when both onChange and onRemove are set. Keep removal available or reject that prop combination.
• Chip.tsx stays visually unchecked when onChange is set without checked, even after a click. Require checked in this mode or manage the state internally.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="frontend/web/components/audit-log/useAuditLogScopeData.ts">

<violation number="1" location="frontend/web/components/audit-log/useAuditLogScopeData.ts:29">
P2: When `organisationId` changes, `projects.data` can still contain the previous organisation's projects while the new query fetches, and `isLoading` remains false. Use `currentData` for the list and colour map, and show loading when fetching without current data.</violation>
</file>

<file name="frontend/web/components/base/Chip/Chip.tsx">

<violation number="1" location="frontend/web/components/base/Chip/Chip.tsx:19">
P2: With `onChange` but no `checked`, the input stays controlled at `false`, so clicks call the callback without ever showing a selected state. Require `checked` in the checkbox mode or manage the omitted case internally.</violation>

<violation number="2" location="frontend/web/components/base/Chip/Chip.tsx:81">
P2: A chip configured with both `onChange` and `onRemove` loses its remove action because this branch returns before rendering the remove button. Keep removal available outside the label, or reject this prop combination in `ChipProps`.</violation>
</file>

<file name="frontend/web/components/audit-log/__tests__/auditLogFilters.test.ts">

<violation number="1" location="frontend/web/components/audit-log/__tests__/auditLogFilters.test.ts:16">
P3: These added test cases omit the required Given/When/Then structure. Add the phase markers to each test body to follow the test convention.</violation>

<violation number="2" location="frontend/web/components/audit-log/__tests__/auditLogFilters.test.ts:77">
P3: This case does not exercise invalid environment IDs because the invalid project makes parsing return `all` first. Add a valid project with an invalid environment to verify environment IDs are filtered.</violation>
</file>

<file name="frontend/web/components/audit-log/OrganisationAuditLogFilters/ScopeCard/ScopeCard.tsx">

<violation number="1" location="frontend/web/components/audit-log/OrganisationAuditLogFilters/ScopeCard/ScopeCard.tsx:34">
P2: `mode` only reads `scope.type` on mount, so browser back/forward while the popover is open leaves the selected segment and visible sections out of sync with the URL. Sync `mode` when `scope.type` changes.</violation>
</file>

<file name="frontend/web/components/audit-log/auditLogScopeFilter.ts">

<violation number="1" location="frontend/web/components/audit-log/auditLogScopeFilter.ts:7">
P3: Repeated `environment` parameters make the label overstate the selection (`?project=12&environment=4&environment=4` shows “2 environments” for one environment); could `toIds` deduplicate its results?</violation>
</file>

<file name="frontend/web/components/audit-log/OrganisationAuditLogFilters/ScopeCard/useScrollSelectedIntoView.ts">

<violation number="1" location="frontend/web/components/audit-log/OrganisationAuditLogFilters/ScopeCard/useScrollSelectedIntoView.ts:15">
P2: When projects are still loading, this one-time effect finds no checked row and never recentres the selection after the query renders it. Rerun the effect when project data changes so a selected project beyond the visible rows is brought into view.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[github-actions]

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #23163 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 1 minute, 11 seconds
 e7f3e59
 🔄 Run: #23163 (attempt 1)

🗂️ Previous results

✅ private-cloud · depot-ubuntu-latest-16 — run #23163 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 3 passed

Details

 3 tests across 3 suites
 43.3 seconds
 e7f3e59
 🔄 Run: #23163 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #23163 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 33.1 seconds
 e7f3e59
 🔄 Run: #23163 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #23163 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 36.9 seconds
 e7f3e59
 🔄 Run: #23163 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #23162 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 4 passed

Details

 4 tests across 4 suites
 18.4 seconds
 01fd0ad
 🔄 Run: #23162 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-16 — run #23162 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 4 passed

Details

 4 tests across 4 suites
 33.7 seconds
 01fd0ad
 🔄 Run: #23162 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #23162 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 33.8 seconds
 01fd0ad
 🔄 Run: #23162 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #23162 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 31.4 seconds
 01fd0ad
 🔄 Run: #23162 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-16 — run #23157 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 3 passed

Details

 3 tests across 3 suites
 34.2 seconds
 a9ad3cd
 🔄 Run: #23157 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #23157 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 2 passed

Details

 2 tests across 2 suites
 33.1 seconds
 a9ad3cd
 🔄 Run: #23157 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #23157 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 3 passed

Details

 3 tests across 3 suites
 45.7 seconds
 a9ad3cd
 🔄 Run: #23157 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #23157 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 34 seconds
 a9ad3cd
 🔄 Run: #23157 (attempt 1)

[github-actions]

Visual Regression

24 screenshots compared. See report for details.
View full report

[cubic-dev-ai]

0 issues found across 3 files (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Requires human review: Auto-approval blocked by 3 unresolved issues from previous reviews.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Requires human review: Adds organisation audit-log scope filtering with URL state, rebuilding Popover, Chip, Radio and SegmentedControl. Declining because dismissed findings leave the scope card stale on back/forward and the Popover still has a known clipping edge case.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>