From f36cd10e0d91e344e654ecb323db39ad3d790562 Mon Sep 17 00:00:00 2001 From: Manish Gupta Date: Fri, 28 Aug 2026 10:01:29 +0530 Subject: [PATCH] fix: tighten created_at assertions per CodeRabbit review on PR #9704 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit >FORGED_CREATED_AT + timedelta(days=1) only proved the value wasn't the exact forged timestamp (or within a day of it) — a stale-but-different value would still pass. Replaced with a tolerance window around the actual request time, applied identically to both the issue-create and comment-create tests via a shared helper. Co-authored-by: Plane AI --- .../contract/api/test_created_by_forgery.py | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/apps/api/plane/tests/contract/api/test_created_by_forgery.py b/apps/api/plane/tests/contract/api/test_created_by_forgery.py index f3ab40fd1e..8a9a9a6b1e 100644 --- a/apps/api/plane/tests/contract/api/test_created_by_forgery.py +++ b/apps/api/plane/tests/contract/api/test_created_by_forgery.py @@ -36,6 +36,15 @@ from plane.db.models import APIToken, Issue, IssueComment, IssueLink, Project, P FORGED_CREATED_AT = timezone.now() - timedelta(days=3650) # 10 years back — unmistakably not "now" +def _assert_created_at_is_now(created_at): + """`> FORGED_CREATED_AT` alone would pass for any stale-but-not-exactly-forged + value; require it within a tight window of the actual request time instead.""" + now = timezone.now() + assert now - timedelta(minutes=1) <= created_at <= now + timedelta(minutes=1), ( + f"created_at must be generated near the request time, got {created_at}" + ) + + def _create_issue_as(creator, **kwargs): """BaseModel.save() sets created_by from crum's current request/user, and there is no active request in a fixture — get_current_user() returns None @@ -145,9 +154,7 @@ class TestIssueCreateIgnoresBodyCreatedBy: "created_by must be the authenticated caller regardless of what the body requested" ) assert created.created_by_id != admin_user.id - assert created.created_at > FORGED_CREATED_AT + timedelta(days=1), ( - "created_at must not be backdated by a body-supplied value" - ) + _assert_created_at_is_now(created.created_at) # No test for IssueDetailAPIEndpoint.put's external_id-upsert create branch: # confirmed against apps/api/plane/api/urls/work_item.py that @@ -236,9 +243,7 @@ class TestCommentCreateIgnoresBodyCreatedBy: assert comment.created_by_id == member_user.id assert comment.created_by_id != admin_user.id assert comment.actor_id == member_user.id, "actor (the audit-log identity) must also be the real caller" - assert comment.created_at > FORGED_CREATED_AT + timedelta(days=1), ( - "created_at must not be backdated by a body-supplied value" - ) + _assert_created_at_is_now(comment.created_at) @pytest.mark.django_db