Files
plane/apps/api
Manish Gupta 6bc666abdb [SECUR-236] chore: drop overlapping per_page + auth fixes, defer to #9429 / #9335
Two parts of this PR fully overlapped existing open PRs against preview, so per
the "drop the most recent on full overlap" call they are removed here:

- per_page non-positive guard (get_per_page) -> covered identically by #9429.
- password sign-in/sign-up rate limiting -> covered (more cleanly, via a
  decorator) by #9335 (GHSA-349j-pjw5-67q4). Reverted rate_limit.py and
  email.py (app + space) and removed the auth unit tests.

This PR now carries only its unique, non-overlapping fixes:
- grouped-paginator cursor bound in paginate() (cap-bypass DoS + negative-slice
  500 that #9429 does not address), with TestCursorBounds.
- Project created_by/updated_by read-only (mass-assignment).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-28 18:05:30 +05:30
..