board external comment
", + access="EXTERNAL", + created_by=create_user, + actor=create_user, + ) + intake = Intake.objects.create(name="Board Intake", project=project, workspace=workspace) + deploy_board = DeployBoard.objects.create( + entity_name="project", + entity_identifier=project.id, + project=project, + workspace=workspace, + is_comments_enabled=True, + is_reactions_enabled=True, + is_votes_enabled=True, + intake=intake, + ) + return { + "project": project, + "issue": issue, + "comment": comment, + "intake": intake, + "anchor": deploy_board.anchor, + } + + +@pytest.fixture +def victim(db, workspace, create_user): + """A *different* project in the SAME workspace, not published on ``board``.""" + project = Project.objects.create( + name="Victim Project", identifier="VIC", workspace=workspace, created_by=create_user + ) + state = State.objects.create( + name="Todo", project=project, workspace=workspace, group="backlog", default=True + ) + issue = Issue.objects.create( + name="Victim Issue", workspace=workspace, project=project, state=state, created_by=create_user + ) + comment = IssueComment.objects.create( + issue=issue, + project=project, + workspace=workspace, + comment_html="secret external comment
", + access="EXTERNAL", + created_by=create_user, + actor=create_user, + ) + intake = Intake.objects.create(name="Victim Intake", project=project, workspace=workspace) + return {"project": project, "issue": issue, "comment": comment, "intake": intake} + + +@pytest.fixture +def victim_other_ws(db, create_user): + """A project in a DIFFERENT workspace — exercises the workspace_id binding + (true cross-tenant, matching the advisory's stated impact).""" + uid = uuid4().hex[:8] + owner = User.objects.create(email=f"victim-owner-{uid}@plane.so", username=f"victim_owner_{uid}") + owner.set_password("test-password") + owner.save() + other_ws = Workspace.objects.create(name="Other WS", owner=owner, slug=f"other-ws-{uid}") + WorkspaceMember.objects.create(workspace=other_ws, member=owner, role=20) + project = Project.objects.create( + name="Other WS Project", identifier="OWP", workspace=other_ws, created_by=owner + ) + state = State.objects.create( + name="Todo", project=project, workspace=other_ws, group="backlog", default=True + ) + issue = Issue.objects.create( + name="Other WS Issue", workspace=other_ws, project=project, state=state, created_by=owner + ) + return {"workspace": other_ws, "project": project, "issue": issue} + + +@pytest.fixture +def board_votes_disabled(db, workspace, create_user): + """A published board with voting DISABLED, for the is_votes_enabled gate.""" + project = Project.objects.create( + name="No-Vote Project", identifier="NVP", workspace=workspace, created_by=create_user + ) + ProjectMember.objects.create( + project=project, member=create_user, workspace=workspace, role=20, is_active=True + ) + state = State.objects.create( + name="Todo", project=project, workspace=workspace, group="backlog", default=True + ) + issue = Issue.objects.create( + name="No-Vote Issue", workspace=workspace, project=project, state=state, created_by=create_user + ) + deploy_board = DeployBoard.objects.create( + entity_name="project", + entity_identifier=project.id, + project=project, + workspace=workspace, + is_comments_enabled=True, + is_reactions_enabled=True, + is_votes_enabled=False, + intake=None, + ) + return {"project": project, "issue": issue, "anchor": deploy_board.anchor} + + +@pytest.fixture +def attacker_client(db, workspace): + """An authenticated user who is NOT a member of the victim project.""" + uid = uuid4().hex[:8] + user = User.objects.create(email=f"attacker-{uid}@plane.so", username=f"attacker_{uid}") + user.set_password("test-password") + user.save() + WorkspaceMember.objects.create(workspace=workspace, member=user, role=15) + client = APIClient() + client.force_authenticate(user=user) + return client + + +@pytest.fixture +def internal_comment(db, workspace, board, create_user): + """An INTERNAL (non-public) comment on the board's own issue, with its own + reaction - never shown on the public board, so it must not be readable or + mutable through the public reaction endpoints either.""" + comment = IssueComment.objects.create( + issue=board["issue"], + project=board["project"], + workspace=workspace, + comment_html="internal only
", + access="INTERNAL", + created_by=create_user, + actor=create_user, + ) + reaction = CommentReaction.objects.create( + project=board["project"], + workspace=workspace, + comment=comment, + actor=create_user, + reaction="fire", + ) + return {"comment": comment, "reaction": reaction} + + +@pytest.fixture +def board_issue_reaction(db, workspace, board, create_user): + """A reaction already on the board's own issue, for destroy() coverage.""" + return IssueReaction.objects.create( + project=board["project"], + workspace=workspace, + issue=board["issue"], + actor=create_user, + reaction="smile", + ) + + +@pytest.fixture +def victim_issue_reaction(db, victim, create_user): + """A reaction the same user owns, but on an issue in a DIFFERENT project + (not published by ``board``) - exercises the project binding on destroy().""" + return IssueReaction.objects.create( + project=victim["project"], + workspace=victim["project"].workspace, + issue=victim["issue"], + actor=create_user, + reaction="smile", + ) + + +# --------------------------------------------------------------------------- # +# Cross-tenant WRITE — must be rejected (404 for issue/comment binding, +# 400 for the intake binding mismatch, per each endpoint's contract below) +# --------------------------------------------------------------------------- # +@pytest.mark.contract +class TestSpacesBoardObjectScope: + @pytest.mark.django_db + def test_cannot_comment_on_issue_outside_board_project(self, attacker_client, board, victim): + response = attacker_client.post( + comments_url(board["anchor"], victim["issue"].id), + {"comment_html": "injected
"}, + format="json", + ) + assert response.status_code == status.HTTP_404_NOT_FOUND, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + assert not IssueComment.objects.filter( + issue_id=victim["issue"].id, comment_html="injected
" + ).exists() + + @pytest.mark.django_db + def test_cannot_react_to_issue_outside_board_project(self, attacker_client, board, victim): + response = attacker_client.post( + issue_reactions_url(board["anchor"], victim["issue"].id), + {"reaction": "smile"}, + format="json", + ) + assert response.status_code == status.HTTP_404_NOT_FOUND, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + + @pytest.mark.django_db + def test_cannot_vote_on_issue_outside_board_project(self, attacker_client, board, victim): + response = attacker_client.post( + votes_url(board["anchor"], victim["issue"].id), + {"vote": 1}, + format="json", + ) + assert response.status_code == status.HTTP_404_NOT_FOUND, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + + @pytest.mark.django_db + def test_cannot_react_to_comment_outside_board_project(self, attacker_client, board, victim): + response = attacker_client.post( + comment_reactions_url(board["anchor"], victim["comment"].id), + {"reaction": "smile"}, + format="json", + ) + assert response.status_code == status.HTTP_404_NOT_FOUND, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + + @pytest.mark.django_db + def test_cannot_create_intake_issue_with_foreign_intake(self, attacker_client, board, victim): + response = attacker_client.post( + intake_issues_url(board["anchor"], victim["intake"].id), + {"issue": {"name": "injected intake"}}, + format="json", + ) + assert response.status_code == status.HTTP_400_BAD_REQUEST, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + + @pytest.mark.django_db + def test_cannot_comment_on_issue_in_other_workspace(self, attacker_client, board, victim_other_ws): + """The guard binds on workspace_id too — a board's anchor cannot reach an + issue in a different workspace (true cross-tenant vector).""" + response = attacker_client.post( + comments_url(board["anchor"], victim_other_ws["issue"].id), + {"comment_html": "injected cross-ws
"}, + format="json", + ) + assert response.status_code == status.HTTP_404_NOT_FOUND, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + assert not IssueComment.objects.filter( + issue_id=victim_other_ws["issue"].id, comment_html="injected cross-ws
" + ).exists() + + # ----------------------------------------------------------------------- # + # Feature gate — vote create must honor is_votes_enabled (parity fix) + # ----------------------------------------------------------------------- # + @pytest.mark.django_db + def test_cannot_vote_when_votes_disabled(self, session_client, board_votes_disabled): + response = session_client.post( + votes_url(board_votes_disabled["anchor"], board_votes_disabled["issue"].id), + {"vote": 1}, + format="json", + ) + assert response.status_code == status.HTTP_400_BAD_REQUEST, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + + # ----------------------------------------------------------------------- # + # Cross-project READ leak — comment list must not surface other projects + # ----------------------------------------------------------------------- # + @pytest.mark.django_db + def test_comment_list_does_not_leak_cross_project(self, attacker_client, board, victim): + response = attacker_client.get(comments_url(board["anchor"], victim["issue"].id)) + assert response.status_code == status.HTTP_200_OK, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + results = response.data["results"] if isinstance(response.data, dict) else response.data + returned_ids = {str(c["id"]) for c in results} + assert str(victim["comment"].id) not in returned_ids, ( + "Victim project's EXTERNAL comment leaked through another board's anchor" + ) + + @pytest.mark.django_db + def test_comment_list_returns_own_project_comments(self, session_client, board): + """Positive control: the board's own EXTERNAL comments are still listed + (guards against an over-broad project_id filter returning nothing).""" + response = session_client.get(comments_url(board["anchor"], board["issue"].id)) + assert response.status_code == status.HTTP_200_OK, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + results = response.data["results"] if isinstance(response.data, dict) else response.data + returned_ids = {str(c["id"]) for c in results} + assert str(board["comment"].id) in returned_ids, ( + "Board's own EXTERNAL comment was wrongly filtered out" + ) + + # ----------------------------------------------------------------------- # + # Positive controls — legitimate writes on the board's own issue still work + # ----------------------------------------------------------------------- # + @pytest.mark.django_db + def test_can_comment_on_issue_in_board_project(self, session_client, board): + response = session_client.post( + comments_url(board["anchor"], board["issue"].id), + {"comment_html": "legit
"}, + format="json", + ) + assert response.status_code == status.HTTP_201_CREATED, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + + @pytest.mark.django_db + def test_can_vote_on_issue_in_board_project(self, session_client, board): + response = session_client.post( + votes_url(board["anchor"], board["issue"].id), + {"vote": 1}, + format="json", + ) + assert response.status_code == status.HTTP_201_CREATED, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + + @pytest.mark.django_db + def test_can_react_to_issue_in_board_project(self, session_client, board): + response = session_client.post( + issue_reactions_url(board["anchor"], board["issue"].id), + {"reaction": "smile"}, + format="json", + ) + assert response.status_code == status.HTTP_201_CREATED, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + + @pytest.mark.django_db + def test_can_react_to_comment_in_board_project(self, session_client, board): + response = session_client.post( + comment_reactions_url(board["anchor"], board["comment"].id), + {"reaction": "smile"}, + format="json", + ) + assert response.status_code == status.HTTP_201_CREATED, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + + @pytest.mark.django_db + def test_can_create_intake_issue_with_own_intake(self, session_client, board): + response = session_client.post( + intake_issues_url(board["anchor"], board["intake"].id), + {"issue": {"name": "legit intake issue"}}, + format="json", + ) + assert response.status_code == status.HTTP_200_OK, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + + +# --------------------------------------------------------------------------- # +# Read/update/delete scope gaps — the board-scope guards were only applied to +# create(). A caller could still read reactions on an INTERNAL (non-public) +# comment, or reach a comment/reaction they authored through a board it does +# not belong to, via list/update/delete. These mirror the create() coverage +# above for the list/partial_update/destroy paths. +# --------------------------------------------------------------------------- # +@pytest.mark.contract +class TestSpacesBoardObjectScopeMutations: + # ----------------------------------------------------------------------- # + # CommentReactionPublicViewSet — INTERNAL comments must stay invisible + # ----------------------------------------------------------------------- # + @pytest.mark.django_db + def test_comment_reaction_list_does_not_leak_internal_comment(self, session_client, board, internal_comment): + response = session_client.get(comment_reactions_url(board["anchor"], internal_comment["comment"].id)) + assert response.status_code == status.HTTP_200_OK, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + results = response.data["results"] if isinstance(response.data, dict) else response.data + returned_ids = {str(r["id"]) for r in results} + assert str(internal_comment["reaction"].id) not in returned_ids, ( + "Reaction on an INTERNAL comment leaked through the public reaction list" + ) + + @pytest.mark.django_db + def test_cannot_delete_reaction_on_internal_comment(self, session_client, board, internal_comment): + response = session_client.delete( + comment_reaction_detail_url(board["anchor"], internal_comment["comment"].id, "fire") + ) + assert response.status_code == status.HTTP_404_NOT_FOUND, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + assert CommentReaction.objects.filter(id=internal_comment["reaction"].id).exists(), ( + "Reaction on an INTERNAL comment was deleted through the public board" + ) + + @pytest.mark.django_db + def test_can_delete_own_reaction_on_external_comment(self, session_client, board, create_user): + reaction = CommentReaction.objects.create( + project=board["project"], + workspace=board["project"].workspace, + comment=board["comment"], + actor=create_user, + reaction="tada", + ) + response = session_client.delete(comment_reaction_detail_url(board["anchor"], board["comment"].id, "tada")) + assert response.status_code == status.HTTP_204_NO_CONTENT, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + assert not CommentReaction.objects.filter(id=reaction.id).exists() + + # ----------------------------------------------------------------------- # + # IssueCommentPublicViewSet.partial_update / destroy — must bind pk to + # this board's project + workspace + issue_id, not just the actor + # ----------------------------------------------------------------------- # + @pytest.mark.django_db + def test_cannot_update_comment_reached_through_wrong_board(self, session_client, board, victim): + response = session_client.patch( + comment_detail_url(board["anchor"], board["issue"].id, victim["comment"].id), + {"comment_html": "hijacked
"}, + format="json", + ) + assert response.status_code == status.HTTP_404_NOT_FOUND, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + victim["comment"].refresh_from_db() + assert victim["comment"].comment_html != "hijacked
" + + @pytest.mark.django_db + def test_cannot_delete_comment_reached_through_wrong_board(self, session_client, board, victim): + response = session_client.delete(comment_detail_url(board["anchor"], board["issue"].id, victim["comment"].id)) + assert response.status_code == status.HTTP_404_NOT_FOUND, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + assert IssueComment.objects.filter(id=victim["comment"].id).exists() + + @pytest.mark.django_db + def test_can_update_own_comment_in_board_project(self, session_client, board): + response = session_client.patch( + comment_detail_url(board["anchor"], board["issue"].id, board["comment"].id), + {"comment_html": "edited
"}, + format="json", + ) + assert response.status_code == status.HTTP_200_OK, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + + @pytest.mark.django_db + def test_can_delete_own_comment_in_board_project(self, session_client, board): + response = session_client.delete(comment_detail_url(board["anchor"], board["issue"].id, board["comment"].id)) + assert response.status_code == status.HTTP_204_NO_CONTENT, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + assert not IssueComment.objects.filter(id=board["comment"].id).exists() + + # ----------------------------------------------------------------------- # + # IssueReactionPublicViewSet.destroy — must bind to project, not just + # workspace + # ----------------------------------------------------------------------- # + @pytest.mark.django_db + def test_cannot_delete_reaction_on_issue_outside_board_project( + self, session_client, board, victim, victim_issue_reaction + ): + response = session_client.delete(issue_reaction_detail_url(board["anchor"], victim["issue"].id, "smile")) + assert response.status_code == status.HTTP_404_NOT_FOUND, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + assert IssueReaction.objects.filter(id=victim_issue_reaction.id).exists(), ( + "Reaction on an issue outside the board's project was deleted through this board" + ) + + @pytest.mark.django_db + def test_can_delete_own_reaction_on_issue_in_board_project(self, session_client, board, board_issue_reaction): + response = session_client.delete(issue_reaction_detail_url(board["anchor"], board["issue"].id, "smile")) + assert response.status_code == status.HTTP_204_NO_CONTENT, ( + f"Got {response.status_code}: {getattr(response, 'data', None)!r}" + ) + assert not IssueReaction.objects.filter(id=board_issue_reaction.id).exists()