mirror of
https://github.com/makeplane/plane.git
synced 2026-09-02 12:09:14 +02:00
7a5dd57549
list() already restricts a GUEST-role member to global views they own, but retrieve() only checked workspace membership, not ownership. Since get_queryset()'s access-based clause is unconditionally true (access is read-only and defaults to Public), a guest who owned no views could still fetch any other member's global view directly by id. Mirror the project-scoped IssueViewViewSet.retrieve(), which already reapplies this same restriction, and update the PR's own contract test (test_workspace_guest_can_read_a_global_view) which had asserted 200 for this exact case — it now asserts 404, matching the "missing view" branch already established on this endpoint. Added a positive control confirming a guest can still read a view they own. Co-authored-by: Plane AI <noreply@plane.so>