[pull] preview from makeplane:preview

apps/api/plane/api/serializers/issue.py

@@ -105,18 +105,32 @@ def validate(self, data):
 
         # Validate assignees are from project
         if data.get("assignees", []):
-            data["assignees"] = ProjectMember.objects.filter(
-                project_id=self.context.get("project_id"),
-                is_active=True,
-                role__gte=15,
-                member_id__in=data["assignees"],
-            ).values_list("member_id", flat=True)
+            valid_assignee_ids = set(
+                ProjectMember.objects.filter(
+                    project_id=self.context.get("project_id"),
+                    is_active=True,
+                    role__gte=15,
+                    member_id__in=data["assignees"],
+                ).values_list("member_id", flat=True)
+            )
+            invalid_assignee_ids = set(data["assignees"]) - valid_assignee_ids
+            if invalid_assignee_ids:
+                raise serializers.ValidationError(
+                    f"Assignees {list(invalid_assignee_ids)} are not active members of this project"
+                )
+            data["assignees"] = list(valid_assignee_ids)
 
         # Validate labels are from project
         if data.get("labels", []):
-            data["labels"] = Label.objects.filter(
-                project_id=self.context.get("project_id"), id__in=data["labels"]
-            ).values_list("id", flat=True)
+            valid_label_ids = set(
+                Label.objects.filter(
+                    project_id=self.context.get("project_id"), id__in=data["labels"]
+                ).values_list("id", flat=True)
+            )
+            invalid_label_ids = set(data["labels"]) - valid_label_ids
+            if invalid_label_ids:
+                raise serializers.ValidationError(f"Labels {list(invalid_label_ids)} do not belong to this project")
+            data["labels"] = list(valid_label_ids)
 
         # Check state is from the project only else raise validation error
         if (

apps/api/plane/api/views/cycle.py

@@ -813,7 +813,7 @@ def post(self, request, slug, project_id, cycle_id):
         Only cycles that have ended can be archived.
         """
         cycle = Cycle.objects.get(pk=cycle_id, project_id=project_id, workspace__slug=slug)
-        if cycle.end_date >= timezone.now():
+        if cycle.end_date is None or cycle.end_date >= timezone.now():
             return Response(
                 {"error": "Only completed cycles can be archived"},
                 status=status.HTTP_400_BAD_REQUEST,

apps/api/plane/app/views/cycle/archive.py

@@ -587,7 +587,7 @@ def get(self, request, slug, project_id, pk=None):
     def post(self, request, slug, project_id, cycle_id):
         cycle = Cycle.objects.get(pk=cycle_id, project_id=project_id, workspace__slug=slug)
 
-        if cycle.end_date >= timezone.now():
+        if cycle.end_date is None or cycle.end_date >= timezone.now():
             return Response(
                 {"error": "Only completed cycles can be archived"},
                 status=status.HTTP_400_BAD_REQUEST,

apps/api/plane/tests/contract/api/test_issue_assignee_label_validation.py

@@ -0,0 +1,136 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+import pytest
+from rest_framework import status
+
+from plane.celery import app as celery_app
+from plane.db.models import Issue, Label, Project, ProjectMember, State, User
+
+
+@pytest.fixture(autouse=True)
+def celery_eager():
+    """
+    Run Celery tasks synchronously in-process instead of publishing to a
+    broker. There's no RabbitMQ/broker in this local sandbox, and these
+    tests only care about the HTTP response contract, not async delivery.
+    """
+    original = celery_app.conf.task_always_eager
+    celery_app.conf.task_always_eager = True
+    celery_app.conf.task_eager_propagates = False
+    yield
+    celery_app.conf.task_always_eager = original
+
+
+@pytest.fixture
+def project(db, workspace, create_user):
+    """Create a test project with the user as an admin member and a default state."""
+    project = Project.objects.create(
+        name="Test Project", identifier="TP", workspace=workspace, created_by=create_user
+    )
+    ProjectMember.objects.create(project=project, member=create_user, role=20, is_active=True)
+    State.objects.create(
+        name="Backlog",
+        color="#000000",
+        group="backlog",
+        default=True,
+        project=project,
+        workspace=workspace,
+        created_by=create_user,
+    )
+    return project
+
+
+@pytest.fixture
+def create_issue(db, project, workspace, create_user):
+    return Issue.objects.create(name="Existing Issue", project=project, workspace=workspace, created_by=create_user)
+
+
+@pytest.fixture
+def outsider_user(db):
+    """A user who exists in the workspace/system but is NOT a member of `project`."""
+    user = User.objects.create(email="outsider@plane.so", username="outsider-user")
+    user.set_password("outsider-password")
+    user.save()
+    return user
+
+
+@pytest.mark.contract
+class TestIssueAssigneeLabelValidationContract:
+    """
+    Contract: creating/updating a work item through the external REST API
+    (``/api/v1/...``) must reject assignee/label ids that don't belong to the
+    project with a 400, instead of silently dropping them and returning
+    200/201. See makeplane/plane#9517.
+    """
+
+    def get_list_url(self, workspace_slug, project_id):
+        return f"/api/v1/workspaces/{workspace_slug}/projects/{project_id}/issues/"
+
+    def get_detail_url(self, workspace_slug, project_id, issue_id):
+        return f"/api/v1/workspaces/{workspace_slug}/projects/{project_id}/issues/{issue_id}/"
+
+    @pytest.mark.django_db
+    def test_create_with_non_member_assignee_is_rejected(self, api_key_client, workspace, project, outsider_user):
+        url = self.get_list_url(workspace.slug, project.id)
+
+        response = api_key_client.post(
+            url, {"name": "New Issue", "assignees": [str(outsider_user.id)]}, format="json"
+        )
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert not Issue.objects.filter(name="New Issue").exists()
+
+    @pytest.mark.django_db
+    def test_create_with_foreign_label_is_rejected(self, api_key_client, workspace, project):
+        other_project = Project.objects.create(name="Other", identifier="OTH", workspace=workspace)
+        foreign_label = Label.objects.create(name="Foreign", project=other_project)
+
+        url = self.get_list_url(workspace.slug, project.id)
+        response = api_key_client.post(
+            url, {"name": "New Issue", "labels": [str(foreign_label.id)]}, format="json"
+        )
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert not Issue.objects.filter(name="New Issue").exists()
+
+    @pytest.mark.django_db
+    def test_update_with_non_member_assignee_is_rejected_and_leaves_assignees_unchanged(
+        self, api_key_client, workspace, project, create_issue, outsider_user
+    ):
+        url = self.get_detail_url(workspace.slug, project.id, create_issue.id)
+
+        response = api_key_client.patch(url, {"assignees": [str(outsider_user.id)]}, format="json")
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert list(create_issue.assignees.all()) == []
+
+    @pytest.mark.django_db
+    def test_create_with_mix_of_valid_and_invalid_assignee_is_rejected_entirely(
+        self, api_key_client, workspace, project, create_user, outsider_user
+    ):
+        """A partially-valid list must reject the whole request, not silently keep only the valid id."""
+        url = self.get_list_url(workspace.slug, project.id)
+
+        response = api_key_client.post(
+            url,
+            {"name": "New Issue", "assignees": [str(create_user.id), str(outsider_user.id)]},
+            format="json",
+        )
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert not Issue.objects.filter(name="New Issue").exists()
+
+    @pytest.mark.django_db
+    def test_create_with_valid_assignee_still_works(self, api_key_client, workspace, project, create_user):
+        """Regression guard: a genuinely valid project member must still be assignable."""
+        url = self.get_list_url(workspace.slug, project.id)
+
+        response = api_key_client.post(
+            url, {"name": "New Issue", "assignees": [str(create_user.id)]}, format="json"
+        )
+
+        assert response.status_code == status.HTTP_201_CREATED
+        issue = Issue.objects.get(name="New Issue")
+        assert list(issue.assignees.values_list("id", flat=True)) == [create_user.id]

apps/api/plane/tests/unit/serializers/test_issue_serializer_api.py

@@ -0,0 +1,61 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+import pytest
+
+from plane.api.serializers.issue import IssueSerializer
+from plane.db.models import Project, ProjectMember, Label, User
+
+
+@pytest.mark.unit
+class TestIssueSerializerAssigneeAndLabelValidation:
+    """Test that IssueSerializer rejects invalid assignees/labels instead of silently dropping them"""
+
+    @pytest.mark.django_db
+    def test_rejects_assignee_who_is_not_an_active_project_member(self, db, workspace, create_user):
+        """An assignee id that isn't an active project member (role >= 15) must raise a validation error"""
+        project = Project.objects.create(name="Test Project", identifier="TEST", workspace=workspace)
+
+        outsider = User.objects.create(
+            email="outsider@example.com", first_name="Out", last_name="Sider", username="outsider"
+        )
+        # Not a member of the project at all
+
+        serializer = IssueSerializer(
+            data={"name": "Test Issue", "assignees": [str(outsider.id)]},
+            context={"project_id": project.id, "workspace_id": workspace.id},
+        )
+
+        assert not serializer.is_valid()
+        assert "assignees" in str(serializer.errors).lower() or "assignee" in str(serializer.errors).lower()
+
+    @pytest.mark.django_db
+    def test_rejects_label_that_does_not_belong_to_project(self, db, workspace, create_user):
+        """A label id that belongs to a different project must raise a validation error"""
+        project = Project.objects.create(name="Test Project", identifier="TEST", workspace=workspace)
+        other_project = Project.objects.create(name="Other Project", identifier="OTHER", workspace=workspace)
+
+        foreign_label = Label.objects.create(name="Foreign Label", project=other_project)
+
+        serializer = IssueSerializer(
+            data={"name": "Test Issue", "labels": [str(foreign_label.id)]},
+            context={"project_id": project.id, "workspace_id": workspace.id},
+        )
+
+        assert not serializer.is_valid()
+        assert "labels" in str(serializer.errors).lower() or "label" in str(serializer.errors).lower()
+
+    @pytest.mark.django_db
+    def test_accepts_assignee_who_is_an_active_project_member(self, db, workspace, create_user):
+        """A valid active project member id should still be accepted"""
+        project = Project.objects.create(name="Test Project", identifier="TEST", workspace=workspace)
+        ProjectMember.objects.create(project=project, member=create_user, role=15, is_active=True)
+
+        serializer = IssueSerializer(
+            data={"name": "Test Issue", "assignees": [str(create_user.id)]},
+            context={"project_id": project.id, "workspace_id": workspace.id},
+        )
+
+        assert serializer.is_valid(), serializer.errors
+        assert list(serializer.validated_data["assignees"]) == [create_user.id]

apps/web/core/store/issue/helpers/base-issues.store.ts

@@ -1212,7 +1212,7 @@ export abstract class BaseIssuesStore implements IBaseIssuesStore {
     const issueId = issue?.id ?? issueBeforeUpdate?.id;
     if (!issueId) return;
 
-    // Get display filters to check if 'Show sub Work items' is enabled - Donot add Work item to main list if disabled.
+    // Get display filters to check if 'Show sub Work items' is enabled - Do not add Work item to main list if disabled.
     const isShowWorkItemsEnabled = this.issueFilterStore.issueFilters?.displayFilters?.sub_issue ?? false;
 
     // get issueUpdates from another method by passing down the three arguments

packages/editor/package.json

@@ -37,6 +37,7 @@
     "@floating-ui/react": "catalog:",
     "@headlessui/react": "catalog:",
     "@hocuspocus/provider": "catalog:",
+    "@makeplane/propel": "catalog:",
     "@plane/constants": "workspace:*",
     "@plane/hooks": "workspace:*",
     "@plane/propel": "workspace:*",

packages/editor/src/components/links/link-edit-view.tsx

@@ -5,7 +5,7 @@
  */
 
 import type { Node } from "@tiptap/pm/model";
-import { Link2Off } from "lucide-react";
+import { UnlinkOutline } from "@makeplane/propel/icons";
 import { useCallback, useEffect, useRef, useState } from "react";
 // components
 import type { LinkViewProps, LinkViews } from "@/components/links";
@@ -148,7 +148,7 @@ export function LinkEditView({ viewProps }: LinkEditViewProps) {
       <InputView label="Text" placeholder="Enter Text to display" value={localText} onChange={handleTextChange} />
       <div className="bg-strong mb-1 h-[1px] w-full gap-2" />
       <div className="flex items-center gap-2 text-13 text-secondary">
-        <Link2Off size={14} className="inline-block" />
+        <UnlinkOutline width={14} height={14} className="inline-block" />
         <button onClick={removeLink} className="cursor-pointer transition-colors hover:text-placeholder">
           Remove Link
         </button>

packages/editor/src/components/links/link-preview.tsx

@@ -4,8 +4,7 @@
  * See the LICENSE file for details.
  */
 
-import { Link2Off } from "lucide-react";
-import { CopyIcon, GlobeIcon, EditIcon } from "@plane/propel/icons";
+import { CopyOutline, EditOutline, GlobeOutline, UnlinkOutline } from "@makeplane/propel/icons";
 // components
 import type { LinkViewProps, LinkViews } from "@/components/links";
 
@@ -36,22 +35,22 @@ export function LinkPreview({
       }}
     >
       <div className="shadow-md flex items-center gap-3 rounded-sm border-2 border-subtle bg-layer-1 p-2 text-11 text-tertiary">
-        <GlobeIcon width={14} height={14} className="inline-block" />
+        <GlobeOutline width={14} height={14} className="inline-block" />
         <p>{url?.length > 40 ? url.slice(0, 40) + "..." : url}</p>
         <div className="flex gap-2">
           <button onClick={copyLinkToClipboard} className="cursor-pointer transition-colors hover:text-primary">
-            <CopyIcon width={14} height={14} className="inline-block" />
+            <CopyOutline width={14} height={14} className="inline-block" />
           </button>
           {editor.isEditable && (
             <>
               <button
                 onClick={() => switchView("LinkEditView")}
                 className="cursor-pointer transition-colors hover:text-primary"
               >
-                <EditIcon width={14} height={14} className="inline-block" />
+                <EditOutline width={14} height={14} className="inline-block" />
               </button>
               <button onClick={removeLink} className="cursor-pointer transition-colors hover:text-primary">
-                <Link2Off size={14} className="inline-block" />
+                <UnlinkOutline width={14} height={14} className="inline-block" />
               </button>
             </>
           )}

packages/editor/src/components/menus/block-menu-options.tsx

@@ -7,7 +7,7 @@
 import type { Node as ProseMirrorNode } from "@tiptap/pm/model";
 import { TableMap } from "@tiptap/pm/tables";
 import type { Editor } from "@tiptap/react";
-import { MoveHorizontal } from "lucide-react";
+import { DragDropOutline } from "@makeplane/propel/icons";
 // constants
 import { CORE_EXTENSIONS } from "@/constants/extension";
 // types
@@ -84,7 +84,7 @@ const setTableToFullWidth = (editor: Editor): void => {
 
 export const getNodeOptions = (editor: Editor): BlockMenuOption[] => [
   {
-    icon: MoveHorizontal,
+    icon: DragDropOutline,
     key: "table-full-width",
     label: "Fit to width",
     isDisabled: !editor.isActive(CORE_EXTENSIONS.TABLE),

packages/editor/src/components/menus/block-menu.tsx

@@ -17,7 +17,7 @@ import {
 import type { Editor } from "@tiptap/react";
 import type { LucideIcon } from "lucide-react";
 import { useCallback, useEffect, useRef, useState } from "react";
-import { CopyIcon, TrashIcon } from "@plane/propel/icons";
+import { CopyOutline, DeleteOutline } from "@makeplane/propel/icons";
 import type { ISvgIcons } from "@plane/propel/icons";
 import { cn } from "@plane/utils";
 // constants
@@ -150,7 +150,7 @@ export function BlockMenu(props: Props) {
 
   const MENU_ITEMS: BlockMenuOption[] = [
     {
-      icon: TrashIcon,
+      icon: DeleteOutline,
       key: "delete",
       label: "Delete",
       onClick: (_e) => {
@@ -159,7 +159,7 @@ export function BlockMenu(props: Props) {
       },
     },
     {
-      icon: CopyIcon,
+      icon: CopyOutline,
       key: "duplicate",
       label: "Duplicate",
       isDisabled: