snapshot of https://github.com/makeplane/plane.git @ d868349a55de79979eb8b98701bf1702c67ad634 (2026-09-15)

apps/api/plane/app/views/issue/sub_issue.py

@@ -0,0 +1,275 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import json
+
+# Django imports
+from django.utils import timezone
+from django.db.models import OuterRef, Func, F, Q, Value, UUIDField, Subquery, Count, IntegerField
+from django.utils.decorators import method_decorator
+from django.views.decorators.gzip import gzip_page
+from django.contrib.postgres.aggregates import ArrayAgg
+from django.contrib.postgres.fields import ArrayField
+from django.db.models.functions import Coalesce
+
+# Third Party imports
+from rest_framework.response import Response
+from rest_framework import status
+
+# Module imports
+from .. import BaseAPIView
+from plane.app.serializers import IssueSerializer
+from plane.app.permissions import ProjectEntityPermission
+from plane.db.models import Issue, IssueLink, FileAsset, CycleIssue, IssueLabel, IssueAssignee, ModuleIssue
+from plane.bgtasks.issue_activities_task import issue_activity
+from plane.utils.timezone_converter import user_timezone_converter
+from collections import defaultdict
+from plane.utils.host import base_host
+from plane.utils.order_queryset import order_issue_queryset
+
+
+class SubIssuesEndpoint(BaseAPIView):
+    permission_classes = [ProjectEntityPermission]
+
+    @method_decorator(gzip_page)
+    def get(self, request, slug, project_id, issue_id):
+        # SECURITY: scope the parent lookup to the URL project. ProjectEntityPermission
+        # only checks that the caller belongs to `project_id`, not that `issue_id` lives
+        # in it, so an unscoped filter leaks sub-issue metadata across projects in the
+        # same workspace.
+        sub_issues = (
+            Issue.issue_objects.filter(
+                parent_id=issue_id, workspace__slug=slug, project_id=project_id
+            )
+            .annotate(
+                cycle_id=Subquery(
+                    CycleIssue.objects.filter(issue=OuterRef("id"), deleted_at__isnull=True).values("cycle_id")[:1]
+                )
+            )
+            .annotate(
+                link_count=Coalesce(
+                    Subquery(
+                        IssueLink.objects.filter(issue=OuterRef("id"))
+                        .order_by()
+                        .values("issue")
+                        .annotate(count=Count("id"))
+                        .values("count"),
+                        output_field=IntegerField(),
+                    ),
+                    0,
+                )
+            )
+            .annotate(
+                attachment_count=Coalesce(
+                    Subquery(
+                        FileAsset.objects.filter(
+                            issue_id=OuterRef("id"),
+                            entity_type=FileAsset.EntityTypeContext.ISSUE_ATTACHMENT,
+                        )
+                        .order_by()
+                        .values("issue_id")
+                        .annotate(count=Count("id"))
+                        .values("count"),
+                        output_field=IntegerField(),
+                    ),
+                    0,
+                )
+            )
+            .annotate(
+                sub_issues_count=Coalesce(
+                    Subquery(
+                        Issue.issue_objects.filter(parent=OuterRef("id"))
+                        .order_by()
+                        .values("parent")
+                        .annotate(count=Count("id"))
+                        .values("count"),
+                        output_field=IntegerField(),
+                    ),
+                    0,
+                )
+            )
+            .annotate(
+                label_ids=Coalesce(
+                    Subquery(
+                        IssueLabel.objects.filter(issue_id=OuterRef("id"), deleted_at__isnull=True)
+                        .order_by()
+                        .values("issue_id")
+                        .annotate(arr=ArrayAgg("label_id", distinct=True))
+                        .values("arr"),
+                        output_field=ArrayField(UUIDField()),
+                    ),
+                    Value([], output_field=ArrayField(UUIDField())),
+                ),
+                assignee_ids=Coalesce(
+                    Subquery(
+                        IssueAssignee.objects.filter(
+                            issue_id=OuterRef("id"),
+                            assignee__member_project__is_active=True,
+                            deleted_at__isnull=True,
+                        )
+                        .order_by()
+                        .values("issue_id")
+                        .annotate(arr=ArrayAgg("assignee_id", distinct=True))
+                        .values("arr"),
+                        output_field=ArrayField(UUIDField()),
+                    ),
+                    Value([], output_field=ArrayField(UUIDField())),
+                ),
+                module_ids=Coalesce(
+                    Subquery(
+                        ModuleIssue.objects.filter(
+                            issue_id=OuterRef("id"),
+                            module__archived_at__isnull=True,
+                            deleted_at__isnull=True,
+                        )
+                        .order_by()
+                        .values("issue_id")
+                        .annotate(arr=ArrayAgg("module_id", distinct=True))
+                        .values("arr"),
+                        output_field=ArrayField(UUIDField()),
+                    ),
+                    Value([], output_field=ArrayField(UUIDField())),
+                ),
+            )
+            .annotate(state_group=F("state__group"))
+        )
+
+        # Ordering
+        order_by_param = request.GET.get("order_by", "-created_at")
+        group_by = request.GET.get("group_by", False)
+
+        if order_by_param:
+            sub_issues, order_by_param = order_issue_queryset(sub_issues, order_by_param)
+
+        sub_issues = list(
+            sub_issues.values(
+                "id",
+                "name",
+                "state_id",
+                "sort_order",
+                "completed_at",
+                "estimate_point",
+                "priority",
+                "start_date",
+                "target_date",
+                "sequence_id",
+                "project_id",
+                "parent_id",
+                "cycle_id",
+                "module_ids",
+                "label_ids",
+                "assignee_ids",
+                "sub_issues_count",
+                "created_at",
+                "updated_at",
+                "created_by",
+                "updated_by",
+                "attachment_count",
+                "link_count",
+                "is_draft",
+                "archived_at",
+                "state_group",
+            )
+        )
+
+        # create's a dict with state group name with their respective issue id's
+        result = defaultdict(list)
+        for sub_issue in sub_issues:
+            result[sub_issue["state_group"]].append(str(sub_issue["id"]))
+
+        datetime_fields = ["created_at", "updated_at"]
+        sub_issues = user_timezone_converter(sub_issues, datetime_fields, request.user.user_timezone)
+        # Grouping
+        if group_by:
+            result_dict = defaultdict(list)
+
+            for issue in sub_issues:
+                if group_by == "assignees__ids":
+                    if issue["assignee_ids"]:
+                        assignee_ids = issue["assignee_ids"]
+                        for assignee_id in assignee_ids:
+                            result_dict[str(assignee_id)].append(issue)
+                    elif issue["assignee_ids"] == []:
+                        result_dict["None"].append(issue)
+
+                elif group_by:
+                    result_dict[str(issue[group_by])].append(issue)
+
+            return Response(
+                {"sub_issues": result_dict, "state_distribution": result},
+                status=status.HTTP_200_OK,
+            )
+        return Response(
+            {"sub_issues": sub_issues, "state_distribution": result},
+            status=status.HTTP_200_OK,
+        )
+
+    # Assign multiple sub issues
+    def post(self, request, slug, project_id, issue_id):
+        # SECURITY: bind the parent issue to the URL workspace + project. A bare
+        # pk lookup let any project member re-parent issues under a parent in a
+        # different project/workspace.
+        parent_issue = Issue.issue_objects.filter(
+            pk=issue_id, workspace__slug=slug, project_id=project_id
+        ).first()
+        if parent_issue is None:
+            return Response(
+                {"error": "Parent issue not found"},
+                status=status.HTTP_404_NOT_FOUND,
+            )
+        sub_issue_ids = request.data.get("sub_issue_ids", [])
+
+        if not len(sub_issue_ids):
+            return Response(
+                {"error": "Sub Issue IDs are required"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        # Scope to workspace + project to prevent cross-project/cross-tenant IDOR
+        sub_issues = Issue.issue_objects.filter(
+            id__in=sub_issue_ids, workspace__slug=slug, project_id=project_id
+        )
+
+        for sub_issue in sub_issues:
+            sub_issue.parent = parent_issue
+
+        _ = Issue.objects.bulk_update(sub_issues, ["parent"], batch_size=10)
+
+        # Only the issues that were actually re-parented — i.e. the project-scoped
+        # `sub_issues`, not the raw caller-supplied ids. Otherwise a cross-project id
+        # (excluded from the update above) would still fire issue_activity, whose task
+        # does an unscoped Issue.objects.get and bumps updated_at on a foreign issue.
+        scoped_sub_issue_ids = [str(sub_issue.id) for sub_issue in sub_issues]
+
+        updated_sub_issues = Issue.issue_objects.filter(
+            id__in=scoped_sub_issue_ids, workspace__slug=slug, project_id=project_id
+        ).annotate(state_group=F("state__group"))
+
+        # Track the issue
+        _ = [
+            issue_activity.delay(
+                type="issue.activity.updated",
+                requested_data=json.dumps({"parent": str(issue_id)}),
+                actor_id=str(request.user.id),
+                issue_id=sub_issue_id,
+                project_id=str(project_id),
+                current_instance=json.dumps({"parent": sub_issue_id}),
+                epoch=int(timezone.now().timestamp()),
+                notification=True,
+                origin=base_host(request=request, is_app=True),
+            )
+            for sub_issue_id in scoped_sub_issue_ids
+        ]
+
+        # create's a dict with state group name with their respective issue id's
+        result = defaultdict(list)
+        for sub_issue in updated_sub_issues:
+            result[sub_issue.state_group].append(str(sub_issue.id))
+
+        serializer = IssueSerializer(updated_sub_issues, many=True)
+        return Response(
+            {"sub_issues": serializer.data, "state_distribution": result},
+            status=status.HTTP_200_OK,
+        )