Fix stickies bugs, enhance date picker, and optimize API - #9846
Closed
FangYikaii wants to merge 1886 commits into
Closed
FangYikaii wants to merge 1886 commits into
FangYikaii wants to merge 1886 commits into
Conversation
…ectMember (makeplane#8966) * test(api): add regression tests for create-project endpoint Cover three scenarios: - project_lead set to the creator's own user_id - project_lead set to a different workspace member - project_lead omitted (baseline) The first two currently fail on preview because of a UUID coercion bug in ProjectMember.objects.create — see follow-up commit. * fix(api): pass project_lead_id (not User instance) when creating ProjectMember The create-project endpoint built a ProjectMember row with member_id=serializer.instance.project_lead, which resolves to a User instance via Django's related descriptor instead of a UUID. Django's UUIDField coercion then fails with AttributeError: 'User' object has no attribute 'replace', which the generic exception handler converts to a 400 "Please provide valid detail" — but only after the Project row was already persisted, leaving an orphaned project without default states. Fix: - Use project_lead_id (FK ID, no descriptor lookup) on both the guard comparison and the ProjectMember creation. - Wrap the post-save flow in transaction.atomic() so any future exception triggers a clean rollback. - Defer model_activity.delay() with transaction.on_commit() so the activity log only fires after a successful commit. - Capture the exception with log_exception() in the generic catch so future regressions surface in api logs. Note: a related data integrity issue exists where ProjectCreateSerializer doesn't create a ProjectIdentifier row (unlike its frontend counterpart). Out of scope here, will follow up in a separate PR. * fix(api): return 500 on unexpected errors and harden project create Address review feedback from @sriramveeraghanta on PR makeplane#8966: - The catch-all `except Exception` now returns 500 instead of 400. Reusing the generic 400 response on a server-side crash was the anti-pattern that hid the original ghost-create bug for nine months; a 500 lets clients distinguish between "bad input" and "server fault". - The `IntegrityError` branch no longer falls through silently when the message is unrecognised. It re-raises so the catch-all `except` logs the exception and returns a 500. - `transaction.on_commit()` now schedules `model_activity.delay` via `functools.partial` instead of a lambda, avoiding late-binding closure semantics. - `ProjectCreateSerializer.validate()` now rejects `project_lead` values that are not active workspace members, surfacing the error under the `project_lead` field key (rather than as `non_field_errors`) so API clients can react programmatically. * test(api): harden assertions and cover rollback / workspace-membership Address review feedback from @sriramveeraghanta on PR makeplane#8966: - The three existing tests now look up the created project via `Project.objects.get(id=response.data["id"])` instead of `.first()`. The assertion now fails for the right reason if the wrong project is returned by the endpoint. - New `test_create_project_with_lead_not_in_workspace_returns_400` guards the workspace-membership validation added to `ProjectCreateSerializer.validate()`. Expects a 400 with a field-shaped error and zero rows persisted. - New `test_model_activity_not_called_on_rollback` locks in the `transaction.on_commit()` semantics: when an exception is raised inside the atomic block (forced via mocking `State.objects.bulk_create`), the response is 500, no Project / ProjectMember / State rows are persisted, and the deferred `model_activity.delay` task is never dispatched. This prevents a future refactor from silently regressing the rollback contract. * fix(api): mark on_commit dispatch as robust against broker failures Address coderabbit re-review feedback on PR makeplane#8966. Without robust=True, an exception raised by model_activity.delay (e.g., a Celery broker outage) propagates out of the on_commit callback and is caught by the outer `except Exception` handler, which returns a 500 despite the project, ProjectMember rows and default States having already been committed. The client sees a 500 and assumes the create failed — the same class of mismatch between actual state and reported status that the original bug exhibited, just at the post-commit phase. Set robust=True so Django logs the dispatch failure internally via the standard transaction logger and the response stays 201, reflecting the persisted state. Switch from `functools.partial` to a nested function (`_dispatch_model_activity`) for the on_commit callable. Django's robust on_commit logging path reads `func.__qualname__` to format the error message; `partial` objects lack that dunder by default, and the `functools.update_wrapper` workaround turns out to be brittle when the wrapped callable is replaced by a Mock (which the new regression test relies on). A nested function exposes `__qualname__` natively, and the locals it closes over are bound at definition time and never rebound before the callback fires, so the late-binding-closure motivation for `partial` over `lambda` does not apply here. A new test, test_response_still_201_when_broker_dispatch_fails, mirrors test_model_activity_not_called_on_rollback to lock in the post-commit branch. It uses `@pytest.mark.django_db(transaction=True)` so the surrounding test transaction is actually committed and the `on_commit` callback fires (the default wrapper suppresses it via rollback). * fix(api): handle unrecognised IntegrityError consistently Address coderabbit re-review feedback on PR makeplane#8966. The previous fix used `raise` inside the IntegrityError handler with the intent of "letting the catch-all `except Exception` below log it and return 500". Coderabbit correctly flagged that `raise` exits the try/except entirely — sibling except clauses don't fire — so unrecognised integrity errors actually skipped `log_exception` and the consistent 500 JSON shape, contradicting the stated intent. Replicate the catch-all behaviour inline: log the exception via `log_exception(e)` and return the same generic 500 response with `{"error": "An unexpected error occurred"}`. The client now gets a uniform error shape regardless of which `except` branch handled it. --------- Co-authored-by: Jose Antonio Martinez <257598434+jamartineztelecoengineer84-dotcom@users.noreply.github.com>
makeplane#9024) * fix: comment quick-actions menu hidden when no actions are available * refactor: remove dead code
…ne#9099) The community AIO Dockerfile declared the VOLUME instruction with single quotes: VOLUME ['/app/data', '/app/logs']. Docker's JSON (exec) form requires double quotes; with single quotes the line is parsed as the shell form and the bracket/comma tokens become literal volume paths ('[/app/data,' and '/app/logs]'). Docker tolerated these non-absolute anonymous volume paths at container create time until Engine 29.5.0, which now rejects them with "invalid mount config for type volume: invalid mount path: '[/app/data,' mount path must be absolute", breaking `docker compose up --force-recreate` and any container recreation for the AIO community image. Switching to the valid JSON array form fixes the parsing.
…9094) * fix(web): fallback when requestIdleCallback is unavailable * refactor: improve idle task scheduling safety in render-if-visible
The webhook dispatcher validated webhook.url before posting but called requests.post() without allow_redirects=False, so a webhook destination could return a 3xx redirect to an internal address (cloud metadata, internal services) and have the worker fetch it and persist the response body to webhook_logs, readable back via the webhook-logs API. Pass allow_redirects=False so the original validate_url() guard is authoritative. Matches the pattern already used by safe_get() in work_item_link_task.py and the behavior of GitHub/Stripe/Slack webhooks.
…ane#9138) * chore(api): add docker compose test runner Adds docker-compose-test.yml at the repo root that boots an isolated postgres / valkey / rabbitmq / minio stack with health checks and tmpfs data dirs, then runs pytest against it and exits. Includes a usage doc under apps/api/tests/RUNNING_TESTS.md and a pointer in AGENTS.md. Prereq: ./setup.sh (generates apps/api/.env). Usage: docker compose -f docker-compose-test.yml up --build \ --abort-on-container-exit --exit-code-from api-tests docker compose -f docker-compose-test.yml down -v * fix(api): correct bugs surfaced by the pytest suite Five small bugs caught by enabling the pytest contract suite end-to-end. Each is independently justifiable: - api/serializers/cycle.py + api/views/cycle.py: CycleCreateSerializer.validate required project_id in the request body, but the view only ever passes it through the URL kwarg. Cycle create/update via the public API was returning 400 "Project ID is required". Read project_id from serializer context (passed by the view) in addition to body/instance. - app/views/api.py: ApiTokenEndpoint.get(pk) and patch(pk) did not filter out is_service=True tokens, so a user could read and modify service tokens through the user token endpoint. The list mode and delete already filter is_service=False; aligned the other two. - bgtasks/work_item_link_task.py: validate_url_ip checked hostname before scheme, so file:///etc/passwd raised "No hostname found" instead of the documented "Only HTTP and HTTPS" error. Swapped the order so the scheme guard matches the docstring intent. - utils/path_validator.py: get_allowed_hosts used `WEB_URL or APP_BASE_URL` so when both are configured to different hosts (the standard local setup: WEB_URL=:8000, APP_BASE_URL=:3000), only one was added to the allow-list. Redirects to APP_BASE_URL then had their next_path stripped because the host wasn't allowed. Include every configured base URL. * chore(api): align pytest tests with current behavior, clear warnings Test-side fixes paired with the product fixes in the previous commit, plus deprecation cleanup that drops the test run from 104 warnings to 0. Tests: - tests/contract/api/test_cycles.py: project fixture sets cycle_view=True; the Project model defaults the flag to False, so cycle create/update always tripped "Cycles are not enabled for this project". - tests/contract/app/test_authentication.py: next_path uses "/workspaces" (validate_next_path rejects values without a leading slash and returns empty, which dropped the path from the redirect URL). - tests/unit/bg_tasks/test_copy_s3_objects.py: mocked sync_with_external_service now returns description_json; the task unconditionally writes the value back to the Issue, and Issue.description_json is NOT NULL on UPDATE. - tests/unit/utils/test_url.py: three length-limit tests placed the URL at char 970+ on a single line, which contains_url truncates away as ReDoS defense (500-char per-line cap). Restructured to keep test intent intact while staying inside the per-line window. Warning cleanup (104 → 0): - settings/common.py: removed USE_L10N=True (deprecated in Django 4.0, removed in 5.0; default is True). - celery.py, settings/local.py, settings/production.py: pythonjsonlogger moved jsonlogger → json; update the import / formatter path.
…ne#9146) - Replace flat pr-description.md / release-notes.md with per-skill folders - Add new branch-name and translate skills - Update release-notes skill to match the GitHub Releases format (v1.2.0)
* fix: harden API token handling against rate-limit tampering and plaintext logging - Make `allowed_rate_limit` read-only on APITokenSerializer so users can no longer raise their own API token rate limit via PATCH (GHSA-xfgr-2x3f-g2cf). - Stop persisting API keys in plaintext in APITokenLogMiddleware: store a SHA-256 hash as the token identifier and redact sensitive request headers (X-Api-Key, Authorization, Cookie) before logging (GHSA-r5p8-cj3q-38cc). * refactor: remove MongoDB log sink and add per-log-type retention Logs are now written to and cleared from PostgreSQL only; MongoDB is no longer used as a log sink or archive. - Drop the MongoDB write/archival paths from the API request logger, the webhook log writer, and the cleanup tasks; Postgres is the sole sink. - Cleanup tasks now hard-delete expired rows in batches via `all_objects` (rows are removed immediately, not soft-deleted). - Add env-backed, per-log-type retention settings: API activity logs (API_ACTIVITY_LOG_RETENTION_DAYS, default 14), webhook logs (WEBHOOK_LOG_RETENTION_DAYS, default 14), email logs (EMAIL_LOG_RETENTION_DAYS, default 7). HARD_DELETE_AFTER_DAYS no longer drives any log cleanup. - Delete settings/mongo.py, remove MONGO_DB_* settings and the plane.mongo loggers, and drop the pymongo dependency. * chore: gitignore local advisories.md notes file * fix: use keyed HMAC-SHA256 for API token log identifier Address CodeQL "weak hashing of sensitive data" by hashing the API key with a SECRET_KEY-keyed HMAC instead of a bare SHA-256. The identifier is a non-reversible tokenization of a high-entropy key (not password storage); keying it also prevents precomputing the digest from a known key value. * chore: address review feedback on log cleanup and request logging - process_logs accepts extra kwargs so jobs enqueued by an older release (with a mongo_log arg) don't fail during a rolling deploy. - Log-cleanup batch delete failures are logged and skipped rather than aborting the run, so a single bad batch can't block the rest. - Extend logger middleware test to assert Authorization and Cookie headers are redacted; add a test that a failing cleanup batch is swallowed. * fix: fall back to default when a log retention env value is invalid Negative (or unparseable) retention values would compute a future cutoff and delete every log row. The retention settings now fall back to their defaults in that case via a shared `_retention_days` helper.
…akeplane#9147) * chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml - Bump turbo from 2.9.4 to 2.9.14 in root package.json and the four production Dockerfiles (web, live, admin, space). - Move pnpm.overrides, onlyBuiltDependencies, and ignoredBuiltDependencies from package.json into pnpm-workspace.yaml. pnpm v10+ no longer reads the pnpm field in package.json, so the full overrides block and most of onlyBuiltDependencies were being silently ignored. - Add @plane/utils as a workspace dependency to the live server. * chore: drop unused allowBuilds block, bump lodash-es to 4.18.1 - Remove the `allowBuilds` block from pnpm-workspace.yaml. It is not a recognized pnpm v10/v11 key and its values were inconsistent with the actual `onlyBuiltDependencies` / `ignoredBuiltDependencies` configuration. - Bump `lodash-es` catalog entry from 4.18.0 to 4.18.1. With overrides now applied workspace-wide, 4.18.0 (marked deprecated as a "bad release") was being enforced everywhere. * fix: use pnpm v11 allowBuilds in place of removed legacy keys `onlyBuiltDependencies` and `ignoredBuiltDependencies` were removed in pnpm v11. They were being silently ignored on this branch, which caused `ERR_PNPM_IGNORED_BUILDS` to fail CI under `--frozen-lockfile`. Replace them with the v11-native `allowBuilds:` block, mapping the previous allowlist to `true` and the previous denylist (sharp) to `false`. Locally verified that the build scripts for @parcel/watcher, @swc/core, esbuild, and msgpackr-extract now run on install.
makeplane#9156) * [WEB-7447] feat: migrate CE telemetry from OTLP traces to OTLP metrics Replace span-based tracing (tracer.py) with OTLP observable gauges, mirroring the approach already used in plane-ee. Key changes: - Add otlp_endpoints.py — shared gRPC/HTTP endpoint helpers - Add telemetry_metrics.py — push_instance_metrics task using MeterProvider + observable gauges (service name: plane-ce-api) - User count excludes bots (is_bot=False) - Page count excludes bot-owned private pages only - Domain derived from WEB_URL env var - Celery beat entry replaced with timedelta schedule + configurable METRICS_PUSH_INTERVAL_MINUTES (default 360 min) - Add explicit opentelemetry-exporter-otlp-proto-grpc dep - Delete tracer.py and telemetry.py (no longer needed) Co-authored-by: Plane AI <noreply@plane.so> * fix: address review comments on CE telemetry metrics - harden grpc_endpoint_from_url for scheme-less OTLP_ENDPOINT values (e.g. "telemetry.plane.so:4317") by prepending "//" before urlparse - fix WEB_URL domain extraction for scheme-less values with same approach - replace N+1 workspace count queries (6×N) with 6 batched annotate(Count) aggregation queries — reduces DB load significantly at WORKSPACE_METRICS_LIMIT - add deterministic ordering (order_by created_at) to workspace slice - harden METRICS_PUSH_INTERVAL_MINUTES env parsing with try/except guard and positive-value validation to avoid crash on malformed input Co-authored-by: Plane AI <noreply@plane.so> * fix: cap METRICS_PUSH_INTERVAL_MINUTES to prevent timedelta overflow Add upper-bound check (10_000_000 minutes) and catch OverflowError alongside ValueError so an arbitrarily large env value cannot crash worker startup via timedelta(minutes=...) OverflowError. Co-authored-by: Plane AI <noreply@plane.so> --------- Co-authored-by: Plane AI <noreply@plane.so>
* fix(web): add Safari fallback for requestIdleCallback * fix(web): use globalThis in idle-task fallbacks Switch idle-task fallback paths from window.* to globalThis.* so the fallback no longer crashes in environments where window is undefined. Also thread IdleRequestOptions through requestIdleFallback so the caller's timeout hint is honored when falling back. Addresses CodeRabbit review feedback on makeplane#9137. --------- Co-authored-by: sriram veeraghanta <veeraghanta.sriram@gmail.com>
…token throttle (makeplane#9161) - Define API_KEY_RATE_LIMIT in plane/settings/common.py and read it via django.conf.settings in ApiKeyRateThrottle instead of os.environ. - Remove ServiceTokenRateThrottle and the service-token branch in BaseAPIView.get_throttles; all API key requests now go through ApiKeyRateThrottle.
makeplane#9163) * fix(api): harden webhook & link-unfurl SSRF (advisory clusters A/B/C) Resolves three overlapping SSRF advisory clusters around webhook delivery and work-item link unfurling: - Cluster A (private-IP validation + PATCH bypass): the webhook PATCH handler passed context={request: request} (the request object as the dict key) so the loopback/disallowed-domain guard silently no-op'd — now context={"request": request}. Hardened IP classification (is_blocked_ip) to also block multicast, unspecified, CGNAT (100.64.0.0/10), and IPv4 embedded in IPv6 transition addresses (IPv4-mapped, NAT64, 6to4, Teredo), robust across Python versions. - Cluster B (DNS-rebinding TOCTOU): validators resolved DNS, then requests resolved it again at connect time. New pinned-IP client (plane/utils/url_security.py) resolves+validates once and connects to the validated IP literal so urllib3 performs no second lookup, while preserving Host header, TLS SNI and certificate verification against the real hostname. - Cluster C (redirect SSRF): webhook delivery never follows redirects; the link crawler follows them manually, re-resolving + re-validating + re-pinning every hop. Also: pin requests==2.33.0 in base.txt (imported directly; the pinning adapter needs the >=2.32 get_connection_with_tls_context hook), and log webhook URL-validation rejections to WebhookLog instead of swallowing them. Tests: new test_url_security.py (pinning, rebinding, redirect re-validation, IP edge cases, TLS SNI) + updated link-task tests. Full unit suite: 178 passed. * fix(api): block OAuth avatar SSRF + add per-advisory SSRF regression tests Verified every SSRF-class advisory against the current code. The webhook / link / favicon reports — including the published CVE-2026-30242 and CVE-2026-39843 and the newer "still bypassable" reports (DNS rebinding GHSA-3856/-fgcv/-9292/-whh3/-4mjx/-6p39/-fv24/-8wvv, IP-classification gaps GHSA-75fg, redirect GHSA-6v37/-jw6g/-mq87) — are resolved by the pinned-IP client + hardened classifier in this branch. The one SSRF family still unresolved was the OAuth avatar path: download_and_upload_avatar() fetched the provider-supplied avatar_url with a raw requests.get (no IP validation, default redirect following), so an attacker-controlled avatar could reach internal addresses and be exfiltrated via the static-asset endpoint (GHSA-cv9p-325g-wmv5, and the avatar hop of the Gitea SSRF GHSA-hx79-5pj5-qh42). It now uses pinned_fetch_following_redirects, which validates + pins every hop and blocks internal targets. Adds test_ssrf_advisories.py: a per-advisory regression map covering webhook IP validation, the PATCH context-key guard, webhook DNS rebinding, webhook redirect, favicon redirect + rebinding, and OAuth avatar SSRF. docker compose test: 199 unit tests pass. * fix(api): address PR review feedback on the SSRF pinned client - url_security: preserve URL-embedded credentials (user:pass@host) as Basic Auth instead of silently dropping them when rewriting to the IP literal (Copilot); bracket IPv6-literal hostnames in the Host header (Copilot); add stream=True support that keeps the session open until the response is closed, and release intermediate redirect hops. - ip_address / work_item_link_task: treat UnicodeError (IDNA failures) from getaddrinfo as a resolution failure, not an uncaught exception (CodeRabbit). - authentication/adapter/base: stream the avatar download so the size cap actually bounds memory, upload the size-bounded buffer (not response.content), and always close the response (CodeRabbit, major). - tests: cover auth preservation, IPv6 Host bracketing, IDNA handling, and streamed session lifetime; drop an unused import. docker compose test: 204 unit tests pass.
Centralize every external dependency version in the pnpm catalog (pnpm-workspace.yaml) and reference them via `catalog:` across all apps and packages. Packages that previously used differing versions were unified to the highest (notably @react-pdf/renderer ^3.4.5 -> ^4.3.0 in apps/web).
…makeplane#9179) * fix(api): return HTTP response from dispatch() exception handler BaseAPIView.dispatch() and BaseViewSet.dispatch() built the proper error Response via handle_exception() but returned the raw exception object instead, causing Django to raise "TypeError: 'Exception' object is not a valid HTTP response". Fix all six occurrences across the api, app, license and space view bases, and add a regression test covering every affected base class. Fixes makeplane#9157 * chore(api): add copyright header to tests/unit/views/__init__.py The empty package init file was missing the AGPL copyright header, failing the Copy Right Check CI (addlicense -check on all tracked .py files).
makeplane#9189) The web/admin/space Docker image builds fail at the Vite/PostCSS step with "Cannot find module '@tailwindcss/postcss'". These apps load the shared @plane/tailwind-config/postcss.config.js, which references the @tailwindcss/postcss plugin by name, but the plugin was only declared as a dependency of packages/tailwind-config. The Docker build installs via turbo prune + 'pnpm fetch' + 'pnpm install --offline', which lays out node_modules so PostCSS resolves the plugin relative to the app directory (apps/<app>), where it is not reachable. A plain 'pnpm install' resolves it from tailwind-config's context instead, which is why local builds passed and masked the issue. Declare @tailwindcss/postcss as a direct devDependency of the three apps that run Vite/PostCSS so it is symlinked into each app's node_modules and resolves under the isolated linker regardless of install flow. Verified by reproducing the exact Docker flow (prune -> fetch -> --frozen-lockfile offline install -> build) for admin, space and web: all install in sync and build successfully with full Tailwind CSS output.
* fix: bump npm deps to resolve Dependabot advisories Resolve 8 open Dependabot alerts (all npm, in pnpm-lock.yaml) by bumping the affected packages in pnpm-workspace.yaml and regenerating the lockfile: - axios 1.15.2 -> 1.16.0 (catalog): CVE-2026-44494/44492/44490/44489 - tmp -> 0.2.6 (override): CVE-2026-44705 path traversal - ws 8.x -> 8.20.1 (catalog + scoped override): CVE-2026-45736 - qs 6.14.2 -> 6.15.2 (override): CVE-2026-8723 DoS - brace-expansion 5.0.5 -> 5.0.6 (override): CVE-2026-45149 DoS brace-expansion and qs were pinned to their vulnerable versions in the overrides block, so the pins had to be bumped directly. ws is scoped to the 8.x major (ws@7.5.10 is below the vulnerable >=8.0.0 floor). All bumps are semver-compatible patch/minor upgrades; no source changes required. * fix: use named axios `create` import after 1.16.0 bump axios 1.16.0 newly exposes `create` as a named export, so oxlint's import/no-named-as-default-member rule now flags `axios.create(...)`. That added one warning to @plane/services (7 > its --max-warnings=6 baseline) and to apps/web and apps/live, failing check:lint — surfaced on this PR because the lockfile change busts Turbo's lint cache. Switch the three `axios.create(...)` call sites to a named `{ create }` import. `create` is a real value+type export in axios 1.16.0 (verified via tsc). isCancel/CancelToken are left as `axios.*`: CancelToken is only a type export (cannot be a value import under verbatimModuleSyntax) and both were already counted within the existing baselines. Verified locally: full `pnpm check:lint` (16/16) and `check:types` (15/15) pass.
…A-9pvm-fcf6-9234) (makeplane#9130) * fix(api): rate-limit magic-code verification and bound per-token attempts The magic-link sign-in / sign-up endpoints accept a 6-digit numeric code (900k-value space, 600s TTL) but never increment a failure counter on a wrong-code verify and extend django.views.View rather than DRF APIView, so DRF's AuthenticationThrottle never runs against them. The space-side generate endpoint also lacked throttle_classes. Combined, this allowed an unauthenticated attacker who knew a victim's email to brute-force the code within the TTL window and log in as the victim. - Add MAX_VERIFY_ATTEMPTS=5 in MagicCodeProvider.set_user_data: failed comparisons now persist verify_attempts in Redis under the remaining TTL and, on hitting the limit, delete the key and raise EMAIL_CODE_ATTEMPT_EXHAUSTED. This is the load-bearing fix - it caps total attempts per issued token regardless of request rate. - Add authentication_throttle_allows() so plain Django Views can apply AuthenticationThrottle without converting to APIView (would change CSRF + request-parsing semantics for the redirect-flow endpoints). - Apply the throttle to MagicSignIn/UpEndpoint and the space variants; add throttle_classes to MagicGenerateSpaceEndpoint to match its app sibling. Refs GHSA-9pvm-fcf6-9234. * fix(api): make verify-attempt increment atomic, expose throttle rate via env Address PR review feedback: - Replace the JSON read-modify-write of verify_attempts with a Lua EVAL script that INCRs a dedicated counter key and EXPIREs it only on the first increment. The previous round-trip was racy: parallel wrong-code requests could read the same value and both write the same incremented count, letting an attacker exceed MAX_VERIFY_ATTEMPTS under concurrency. Counter is now reset on each new token issuance and cleared on successful verify / exhaustion. - Make AuthenticationThrottle.rate configurable via the AUTHENTICATION_RATE_LIMIT env var (default 10/minute, down from 30 to tighten the budget on unauth auth-adjacent endpoints). Document it in deployments/aio and deployments/cli variables.env. * test(api): cover magic-code attempt cap, counter reset, and auth throttle Add the contract tests called out in the PR test plan: - TestMagicSignInVerifyAttempts: - test_exhausted_after_max_wrong_attempts: after MAX_VERIFY_ATTEMPTS wrong codes the next verify redirects with EMAIL_CODE_ATTEMPT_ EXHAUSTED_SIGN_IN and both Redis keys are deleted; a follow-up verify reports EXPIRED. - test_counter_increments_on_each_wrong_attempt: the dedicated verify_attempts counter advances by exactly one per wrong POST, matching the atomic Lua INCR. - test_counter_resets_on_token_regeneration: regenerating the magic-link clears the counter so the user isn't pre-locked-out by a prior session's wrong attempts. - TestMagicSignUpVerifyAttempts.test_signup_exhausted_after_max_wrong_attempts: the sign-up endpoint returns EMAIL_CODE_ATTEMPT_EXHAUSTED_SIGN_UP on the exhausting attempt. - TestAuthenticationThrottle: exercises authentication_throttle_allows on the plain-View redirect-flow endpoints by patching the rate down and asserting RATE_LIMIT_EXCEEDED is appended to the redirect URL once the per-IP budget is exceeded, for both magic-sign-in and magic-sign-up. Each new class clears Django cache (DRF throttle storage) and the per-email Redis keys around every test so runs are independent. * fix(api): clamp remaining_ttl to >=1 for verify-attempt counter EXPIRE ri.ttl() returns 0 when the token has less than one second remaining (Redis floors to whole seconds). The previous clamp only caught None and < 0, so a sub-second TTL would pass through and the Lua script's EXPIRE counter 0 would immediately delete the key — letting an attacker bypass MAX_VERIFY_ATTEMPTS during the final second of the token's life. Switch the comparison to <= 0. Narrow real-world impact (sub-second window, throttle still bounds the rate) but the cap should hold regardless of timing.
* fix: UI border and shadow on the dropdown menu usability * fix: shadow-md and border strong
…lane#9212) The public REST API GenericAssetEndpoint (/api/v1/workspaces/<slug>/assets/) declared no permission class, inheriting only IsAuthenticated. Since APIKeyAuthentication does not bind a token to a workspace and the workspace is read straight from the URL slug, any valid Personal Access Token could read (GET), create (POST), and modify (PATCH) assets in a workspace the caller is not a member of — a cross-workspace IDOR, the public-API sibling of the CVE-2026-46558 dashboard asset fix. Add permission_classes = [WorkspaceUserPermission] so every method requires active workspace membership, matching the dashboard fix semantics. Also add contract regression tests covering cross-workspace GET/POST/PATCH (now 403) and a positive control confirming members retain access. Also ignore the local /security/ advisory notes folder.
…akeplane#9215) * fix: bump react-router and vitest to resolve Dependabot advisories Resolves 6 open Dependabot alerts (all npm, manifest pnpm-lock.yaml): - react-router 7.12.0 -> 7.15.0 (fixes GHSA-8x6r-g9mw-2r78 [high], GHSA-49rj-9fvp-4h2h [high], GHSA-8646-j5j9-6r62 [high], GHSA-2j2x-hqr9-3h42 [medium], GHSA-f22v-gfqf-p8f3 [medium]) - vitest 4.0.x -> 4.1.x (fixes GHSA-5xrq-8626-4rwp [critical]) Aligned lockstep siblings to avoid peer-dependency mismatches: @react-router/dev|node|serve -> 7.15.0, @vitest/coverage-v8 -> ^4.1.0. Edited catalog entries in pnpm-workspace.yaml and regenerated pnpm-lock.yaml; verified with pnpm install --frozen-lockfile. * fix: raise vitest catalog floor to ^4.1.8 to match security advisory The critical advisory GHSA-5xrq-8626-4rwp is patched in vitest 4.1.8, but the catalog specifiers were ^4.1.0, which permits resolving to vulnerable 4.1.0-4.1.7. Align the floor with the documented patched version for vitest and @vitest/coverage-v8 so a future lockfile refresh cannot reintroduce a vulnerable Vitest stack. Resolved version is unchanged (4.1.8).
Add react-doctor for React lint/a11y/perf/architecture diagnostics: - Add react-doctor devDependency and "doctor" npm script - Add .claude/skills/react-doctor skill for local triage workflow - Add GitHub Actions workflow to scan PRs and track health score
…plane#9203) * refactor: migrate types from apps/web to @plane/types * [WEB-238] resolved lint errors * [WEB-238] Resolved coderabbit comments
…keplane#9224) User-controlled values (work item titles, labels, etc.) were written raw into openpyxl worksheet cells, so values beginning with = were stored as live formula cells in exported XLSX files. Apply the same formula-trigger sanitization already used for CSV exports to XLSX cell values and header rows in both export formatters, and sanitize CSV header rows in the porters formatter for parity.
…e#9225) The custom API key authentication only verified that the APIToken row was active and unexpired; it never checked the owning user's is_active flag. DRF's IsAuthenticated only checks user.is_authenticated (always True for a real User), so a user whose account was deactivated could keep using a previously issued API key indefinitely. Add user__is_active=True to the validate_api_token() lookup so a token tied to a disabled account is treated as invalid (a generic AuthenticationFailed, avoiding account-state disclosure). Applied to both the external API middleware (plane/api) and the identical, currently unused copy in plane/app to prevent the gap from being reintroduced. Adds unit coverage on validate_api_token and an end-to-end contract test proving GET /api/v1/users/me/ is denied once the account is deactivated.
Enhance research v3 features and manage workspaces with access control
Scope research profile access by workspace, make import previews side-effect free, and expose metadata-only context resources. Synchronize v3 documentation and workspace package versions at 3.0.1.
Route MinIO presigned POST uploads through the bucket-prefix path so production CORS preflights reach object storage. Add regression coverage and bump the synchronized patch version to 3.0.2.
Keep research access failures on the requested page with explicit recovery states, add consistent feedback and confirmations to report and organisation workflows, and improve list/navigation empty states. Fix ICU interpolation and release the synchronized workspace packages as 3.0.3.
Use Asia/Shanghai for new business records and migrate existing timezone fields while preserving UTC system time semantics.
Replace the legacy roster contract with the required eleven-column template, resolve existing TEAM and advisor relationships safely, cap effective advisors at three, and update reports, UI, tests, documentation, and release metadata for the breaking 4.0.0 change.
Remove nested button markup across work item properties and shared menu entry points while preserving compound navigation behavior and valid trigger refs. Add frontend structure/state regressions and backend comment deletion contracts, then release the patch as 4.0.1.
Harden research workspace boundaries and streamline workflows
Disable modal isolation for module, cycle and label options containing a search input. Add interaction regressions and release patch 4.0.2.
Accept the supplied student and advisor templates, preserve degree values, show actionable import errors, and document the production deployment flow.
feat: enhance user import functionality with new fields and actions - Updated user import hints and actions in English and Chinese locales. - Added new fields for user import rows and batches to support additional data. - Implemented new API methods for bulk deactivation and reactivation of imported accounts. - Introduced migration for user import review and account source management. fix: improve error handling and validation for imported accounts - Added checks for existing workspace members and duplicate identities during import. - Enhanced the user import process with detailed error messages for better user feedback.
Enhance user import functionality and improve error handling
Clarify import review states, make organization hierarchy creation more discoverable, and protect account lifecycle operations with focused component coverage. Remove the committed roster export containing credentials and bump workspace versions to 4.3.0.
feat(research): refine roster administration workflows
Add single-person entry, reviewable batch approval previews, transactional identity-safe provisioning, relationship repair, searchable organisation mapping, and isolated browser contract coverage. Bump package versions to 4.4.0 for the feature release.
Contributor
|
Hi @FangYikaii, thanks for opening this. It looks like the develop branch of your fork, with the full research product on it, so I'm guessing it was meant for your own repo rather than ours. Parts of it (OIDC, approvals, audit logs) also sit on Plane's paid plans (https://plane.so/pricing), so it isn't something we'd take into the community edition. Closing this one. If the stickies and date picker fixes from the title are in there, a small PR with just those would be welcome. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Type of Change
Screenshots and Media (if applicable)
Test Scenarios
References