From 000175cb57d6195dcd3ed3e4bc0c3e047f252835 Mon Sep 17 00:00:00 2001 From: Manish Gupta Date: Mon, 27 Jul 2026 12:35:32 +0530 Subject: [PATCH] [WEB-8400] test: cover same-workspace/other-project board scope (CodeRabbit #9481) The negative cases all used a different workspace, so they'd pass even if the project predicate were dropped from get_queryset (workspace slug alone would catch them). Add a board for a different project in the SAME workspace and assert it 404s via project_a's URL, guarding the project_id/entity_identifier scope. Co-Authored-By: Claude Opus 4.8 (1M context) --- ..._deploy_board_cross_workspace_scope_app.py | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/apps/api/plane/tests/contract/app/test_deploy_board_cross_workspace_scope_app.py b/apps/api/plane/tests/contract/app/test_deploy_board_cross_workspace_scope_app.py index 0b4045c31b..10ee6faef1 100644 --- a/apps/api/plane/tests/contract/app/test_deploy_board_cross_workspace_scope_app.py +++ b/apps/api/plane/tests/contract/app/test_deploy_board_cross_workspace_scope_app.py @@ -50,6 +50,19 @@ def own_board(db, workspace, project_a): return _board_for(workspace, project_a) +@pytest.fixture +def sibling_board(db, workspace, create_user): + """A board for a DIFFERENT project in the SAME workspace as project_a. + + Guards the project predicate specifically: a workspace-slug-only scope would + still expose this board through project_a's URL. + """ + other = Project.objects.create( + name="Sibling Project", identifier="SIB", workspace=workspace, created_by=create_user + ) + return _board_for(workspace, other) + + @pytest.fixture def victim_board(db): """A published board in a DIFFERENT workspace the caller has no relation to.""" @@ -94,6 +107,15 @@ class TestDeployBoardCrossWorkspaceScope: victim_board.refresh_from_db() assert victim_board.is_comments_enabled is False + def test_cannot_retrieve_same_workspace_other_project_board( + self, session_client, workspace, project_a, sibling_board + ): + """A board in the same workspace but a different project must 404 via project_a's URL.""" + response = session_client.get(_board_url(workspace.slug, project_a.id, sibling_board.id)) + assert response.status_code == status.HTTP_404_NOT_FOUND, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + def test_can_retrieve_own_board(self, session_client, workspace, project_a, own_board): """Positive control: a project member may retrieve their own board.""" response = session_client.get(_board_url(workspace.slug, project_a.id, own_board.id))