mirror of
https://github.com/makeplane/plane.git
synced 2026-09-02 20:19:49 +02:00
96257d141e
Follow-up from adversarial review of the create-path fix: remove_relation had the same gap on the delete side. It filtered IssueRelation on workspace__slug only and never checked that the URL issue_id belongs to the URL project, so a member of one project could delete relations between two issues of a sibling project in the same workspace — verified 204 with deleted_at set on the sibling project's row. Applies the same participant binding as create(): the URL issue must live in the URL project. The IssueRelation row itself stays workspace-scoped, because relations legitimately span projects and either participant's project may remove them. Also returns 404 instead of a 500 when no relation matches — the handler did .first() and then called .delete() on None (AttributeError -> generic 500). Adds coverage for the sibling-project delete, the missing-relation 404, and a positive control, plus tests pinning the IssueManager boundary: comment.py deliberately uses Issue.objects (intake/triage, archived and draft issues must stay commentable) while relation.py uses Issue.issue_objects (matching the body `issues` filter and SubIssuesEndpoint). That axis was previously untested, so "tidying" the two to match would have silently broken commenting on intake items. Co-authored-by: Plane AI <noreply@plane.so>