mirror of
https://github.com/makeplane/plane.git
synced 2026-09-02 12:09:14 +02:00
9fd1d537e2
Addresses Copilot review on #9531. IssueRelationViewSet.list had the same unscoped issue_id as the write handlers: it filtered relations on workspace__slug only, so a member of project A could list the relations of an issue in project B of the same workspace and receive that issue's name, priority, sequence_id, assignee_ids and label_ids. Verified 200 with the foreign issue's name in the body before the fix. Extracts the binding into a module-level issue_in_project() helper (per CodeRabbit) now that list, create and remove_relation all need it — one place to get right, and the next handler added to this file has an obvious thing to call. Adds contract coverage for the list path (cross-project 404 with no name leak, plus an in-project positive control), extends the IssueManager boundary tests to remove_relation and list so all handlers are pinned to the same manager, and pins that a non-UUID related_issue is a 400 rather than a 500 — Copilot flagged that as a 500 risk, but Django raises ValidationError on UUID coercion and BaseViewSet.handle_exception already converts it. The test locks that in. Co-authored-by: Plane AI <noreply@plane.so>