snapshot of https://github.com/makeplane/plane.git @ d868349a55de79979eb8b98701bf1702c67ad634 (2026-09-15)

apps/api/plane/utils/permissions/__init__.py

@@ -0,0 +1,21 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from .workspace import (
+    WorkSpaceBasePermission,
+    WorkspaceOwnerPermission,
+    WorkSpaceAdminPermission,
+    WorkspaceEntityPermission,
+    WorkspaceViewerPermission,
+    WorkspaceUserPermission,
+)
+from .project import (
+    ProjectBasePermission,
+    ProjectEntityPermission,
+    ProjectMemberPermission,
+    ProjectLitePermission,
+    ProjectAdminPermission,
+)
+from .base import allow_permission, ROLE
+from .page import ProjectPagePermission

apps/api/plane/utils/permissions/base.py

@@ -0,0 +1,77 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from plane.db.models import WorkspaceMember, ProjectMember
+from functools import wraps
+from rest_framework.response import Response
+from rest_framework import status
+
+from enum import Enum
+
+
+class ROLE(Enum):
+    ADMIN = 20
+    MEMBER = 15
+    GUEST = 5
+
+
+def allow_permission(allowed_roles, level="PROJECT", creator=False, model=None):
+    def decorator(view_func):
+        @wraps(view_func)
+        def _wrapped_view(instance, request, *args, **kwargs):
+            # Check for creator if required
+            if creator and model:
+                obj = model.objects.filter(id=kwargs["pk"], created_by=request.user).exists()
+                if obj:
+                    return view_func(instance, request, *args, **kwargs)
+
+            # Convert allowed_roles to their values if they are enum members
+            allowed_role_values = [role.value if isinstance(role, ROLE) else role for role in allowed_roles]
+
+            # Check role permissions
+            if level == "WORKSPACE":
+                if WorkspaceMember.objects.filter(
+                    member=request.user,
+                    workspace__slug=kwargs["slug"],
+                    role__in=allowed_role_values,
+                    is_active=True,
+                ).exists():
+                    return view_func(instance, request, *args, **kwargs)
+            else:
+                is_user_has_allowed_role = ProjectMember.objects.filter(
+                    member=request.user,
+                    workspace__slug=kwargs["slug"],
+                    project_id=kwargs["project_id"],
+                    role__in=allowed_role_values,
+                    is_active=True,
+                ).exists()
+
+                # Return if the user has the allowed role else if they are workspace admin and part of the project regardless of the role # noqa: E501
+                if is_user_has_allowed_role:
+                    return view_func(instance, request, *args, **kwargs)
+                elif (
+                    ProjectMember.objects.filter(
+                        member=request.user,
+                        workspace__slug=kwargs["slug"],
+                        project_id=kwargs["project_id"],
+                        is_active=True,
+                    ).exists()
+                    and WorkspaceMember.objects.filter(
+                        member=request.user,
+                        workspace__slug=kwargs["slug"],
+                        role=ROLE.ADMIN.value,
+                        is_active=True,
+                    ).exists()
+                ):
+                    return view_func(instance, request, *args, **kwargs)
+
+            # Return permission denied if no conditions are met
+            return Response(
+                {"error": "You don't have the required permissions."},
+                status=status.HTTP_403_FORBIDDEN,
+            )
+
+        return _wrapped_view
+
+    return decorator

apps/api/plane/utils/permissions/page.py

@@ -0,0 +1,138 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from plane.db.models import ProjectMember, Page
+from plane.app.permissions import ROLE
+
+
+from rest_framework.permissions import BasePermission, SAFE_METHODS
+
+
+# Permission Mappings for workspace members
+ADMIN = ROLE.ADMIN.value
+MEMBER = ROLE.MEMBER.value
+GUEST = ROLE.GUEST.value
+
+
+class ProjectPagePermission(BasePermission):
+    """
+    Custom permission to control access to pages within a workspace
+    based on user roles, page visibility (public/private), and feature flags.
+    """
+
+    def has_permission(self, request, view):
+        """
+        Check basic project-level permissions before checking object-level permissions.
+        """
+        if request.user.is_anonymous:
+            return False
+
+        user_id = request.user.id
+        slug = view.kwargs.get("slug")
+        page_id = view.kwargs.get("page_id")
+        project_id = view.kwargs.get("project_id")
+
+        # Hook for extended validation
+        extended_access, role = self._check_access_and_get_role(request, slug, project_id)
+        if extended_access is False:
+            return False
+
+        if page_id:
+            # Scope the page to the project in the URL. Resolving the page by
+            # workspace + page_id alone allowed a member of one project to read
+            # pages belonging to another project in the same workspace
+            # (GHSA-g49r / GHSA-ghcr). Require an *active* ProjectPage link (both
+            # conditions on the same relation so they match one row) so a page
+            # removed from the project (soft-deleted link) is also denied.
+            page = Page.objects.filter(
+                id=page_id,
+                workspace__slug=slug,
+                project_pages__project_id=project_id,
+                project_pages__deleted_at__isnull=True,
+            ).first()
+            if page is None:
+                return False
+
+            # Allow access if the user is the owner of the page
+            if page.owned_by_id == user_id:
+                return True
+
+            # Handle private page access
+            if page.access == Page.PRIVATE_ACCESS:
+                return self._has_private_page_action_access(request, slug, page, project_id)
+
+        # Handle public page access
+        return self._has_public_page_action_access(request, role)
+
+    def _check_project_member_access(self, request, slug, project_id):
+        """
+        Check if the user is a project member.
+        """
+        return (
+            ProjectMember.objects.filter(
+                member=request.user,
+                workspace__slug=slug,
+                is_active=True,
+                project_id=project_id,
+            )
+            .values_list("role", flat=True)
+            .first()
+        )
+
+    def _check_access_and_get_role(self, request, slug, project_id):
+        """
+        Hook for extended access checking
+        Returns: True (allow), False (deny), None (continue with normal flow)
+        """
+        role = self._check_project_member_access(request, slug, project_id)
+        if not role:
+            return False, None
+        return True, role
+
+    def _has_private_page_action_access(self, request, slug, page, project_id):
+        """
+        Check access to private pages. Override for feature flag logic.
+        """
+        # Base implementation: only owner can access private pages
+        return False
+
+    def _check_project_action_access(self, request, role):
+        method = request.method
+
+        # Only admins can create (POST) pages
+        if method == "POST":
+            if role in [ADMIN, MEMBER]:
+                return True
+            return False
+
+        # Safe methods (GET, HEAD, OPTIONS) allowed for all active roles
+        if method in SAFE_METHODS:
+            if role in [ADMIN, MEMBER, GUEST]:
+                return True
+            return False
+
+        # PUT/PATCH: Admins and members can update
+        if method in ["PUT", "PATCH"]:
+            if role in [ADMIN, MEMBER]:
+                return True
+            return False
+
+        # DELETE: Only admins can delete
+        if method == "DELETE":
+            if role in [ADMIN]:
+                return True
+            return False
+
+        # Deny by default
+        return False
+
+    def _has_public_page_action_access(self, request, role):
+        """
+        Check if the user has permission to access a public page
+        and can perform operations on the page.
+        """
+        project_member_exists = self._check_project_action_access(request, role)
+        if not project_member_exists:
+            return False
+        return True

apps/api/plane/utils/permissions/project.py

@@ -0,0 +1,146 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Third Party imports
+from rest_framework.permissions import SAFE_METHODS, BasePermission
+
+# Module import
+from plane.db.models import ProjectMember, WorkspaceMember
+from plane.db.models.project import ROLE
+
+
+class ProjectBasePermission(BasePermission):
+    def has_permission(self, request, view):
+        if request.user.is_anonymous:
+            return False
+
+        ## Safe Methods -> Handle the filtering logic in queryset
+        if request.method in SAFE_METHODS:
+            return WorkspaceMember.objects.filter(
+                workspace__slug=view.workspace_slug, member=request.user, is_active=True
+            ).exists()
+
+        ## Only workspace owners or admins can create the projects
+        if request.method == "POST":
+            return WorkspaceMember.objects.filter(
+                workspace__slug=view.workspace_slug,
+                member=request.user,
+                role__in=[ROLE.ADMIN.value, ROLE.MEMBER.value],
+                is_active=True,
+            ).exists()
+
+        project_member_qs = ProjectMember.objects.filter(
+            workspace__slug=view.workspace_slug,
+            member=request.user,
+            project_id=view.project_id,
+            is_active=True,
+        )
+
+        ## Only project admins or workspace admin who is part of the project can access
+
+        if project_member_qs.filter(role=ROLE.ADMIN.value).exists():
+            return True
+        else:
+            return (
+                project_member_qs.exists()
+                and WorkspaceMember.objects.filter(
+                    member=request.user,
+                    workspace__slug=view.workspace_slug,
+                    role=ROLE.ADMIN.value,
+                    is_active=True,
+                ).exists()
+            )
+
+
+class ProjectMemberPermission(BasePermission):
+    def has_permission(self, request, view):
+        if request.user.is_anonymous:
+            return False
+
+        ## Safe Methods -> Handle the filtering logic in queryset
+        if request.method in SAFE_METHODS:
+            return ProjectMember.objects.filter(
+                workspace__slug=view.workspace_slug,
+                member=request.user,
+                project_id=view.project_id,
+                is_active=True,
+            ).exists()
+        ## Only workspace owners or admins can create the projects
+        if request.method == "POST":
+            return WorkspaceMember.objects.filter(
+                workspace__slug=view.workspace_slug,
+                member=request.user,
+                role__in=[ROLE.ADMIN.value, ROLE.MEMBER.value],
+                is_active=True,
+            ).exists()
+
+        ## Only Project Admins can update project attributes
+        return ProjectMember.objects.filter(
+            workspace__slug=view.workspace_slug,
+            member=request.user,
+            role__in=[ROLE.ADMIN.value, ROLE.MEMBER.value],
+            project_id=view.project_id,
+            is_active=True,
+        ).exists()
+
+
+class ProjectEntityPermission(BasePermission):
+    def has_permission(self, request, view):
+        if request.user.is_anonymous:
+            return False
+
+        # Handle requests based on project__identifier
+        if hasattr(view, "project_identifier") and view.project_identifier:
+            if request.method in SAFE_METHODS:
+                return ProjectMember.objects.filter(
+                    workspace__slug=view.workspace_slug,
+                    member=request.user,
+                    project__identifier=view.project_identifier,
+                    is_active=True,
+                ).exists()
+
+        ## Safe Methods -> Handle the filtering logic in queryset
+        if request.method in SAFE_METHODS:
+            return ProjectMember.objects.filter(
+                workspace__slug=view.workspace_slug,
+                member=request.user,
+                project_id=view.project_id,
+                is_active=True,
+            ).exists()
+
+        ## Only project members or admins can create and edit the project attributes
+        return ProjectMember.objects.filter(
+            workspace__slug=view.workspace_slug,
+            member=request.user,
+            role__in=[ROLE.ADMIN.value, ROLE.MEMBER.value],
+            project_id=view.project_id,
+            is_active=True,
+        ).exists()
+
+
+class ProjectAdminPermission(BasePermission):
+    def has_permission(self, request, view):
+        if request.user.is_anonymous:
+            return False
+
+        return ProjectMember.objects.filter(
+            workspace__slug=view.workspace_slug,
+            member=request.user,
+            role=ROLE.ADMIN.value,
+            project_id=view.project_id,
+            is_active=True,
+        ).exists()
+
+
+class ProjectLitePermission(BasePermission):
+    def has_permission(self, request, view):
+        if request.user.is_anonymous:
+            return False
+
+        return ProjectMember.objects.filter(
+            workspace__slug=view.workspace_slug,
+            member=request.user,
+            project_id=view.project_id,
+            is_active=True,
+        ).exists()

apps/api/plane/utils/permissions/workspace.py

@@ -0,0 +1,110 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Third Party imports
+from rest_framework.permissions import BasePermission, SAFE_METHODS
+
+# Module imports
+from plane.db.models import WorkspaceMember
+
+
+# Permission Mappings
+Admin = 20
+Member = 15
+Guest = 5
+
+
+# TODO: Move the below logic to python match - python v3.10
+class WorkSpaceBasePermission(BasePermission):
+    def has_permission(self, request, view):
+        # allow anyone to create a workspace
+        if request.user.is_anonymous:
+            return False
+
+        if request.method == "POST":
+            return True
+
+        ## Safe Methods
+        if request.method in SAFE_METHODS:
+            return True
+
+        # allow only admins and owners to update the workspace settings
+        if request.method in ["PUT", "PATCH"]:
+            return WorkspaceMember.objects.filter(
+                member=request.user,
+                workspace__slug=view.workspace_slug,
+                role__in=[Admin, Member],
+                is_active=True,
+            ).exists()
+
+        # allow only owner to delete the workspace
+        if request.method == "DELETE":
+            return WorkspaceMember.objects.filter(
+                member=request.user,
+                workspace__slug=view.workspace_slug,
+                role=Admin,
+                is_active=True,
+            ).exists()
+
+
+class WorkspaceOwnerPermission(BasePermission):
+    def has_permission(self, request, view):
+        if request.user.is_anonymous:
+            return False
+
+        return WorkspaceMember.objects.filter(
+            workspace__slug=view.workspace_slug, member=request.user, role=Admin, is_active=True
+        ).exists()
+
+
+class WorkSpaceAdminPermission(BasePermission):
+    def has_permission(self, request, view):
+        if request.user.is_anonymous:
+            return False
+
+        return WorkspaceMember.objects.filter(
+            member=request.user,
+            workspace__slug=view.workspace_slug,
+            role__in=[Admin, Member],
+            is_active=True,
+        ).exists()
+
+
+class WorkspaceEntityPermission(BasePermission):
+    def has_permission(self, request, view):
+        if request.user.is_anonymous:
+            return False
+
+        ## Safe Methods -> Handle the filtering logic in queryset
+        if request.method in SAFE_METHODS:
+            return WorkspaceMember.objects.filter(
+                workspace__slug=view.workspace_slug, member=request.user, is_active=True
+            ).exists()
+
+        return WorkspaceMember.objects.filter(
+            member=request.user,
+            workspace__slug=view.workspace_slug,
+            role__in=[Admin, Member],
+            is_active=True,
+        ).exists()
+
+
+class WorkspaceViewerPermission(BasePermission):
+    def has_permission(self, request, view):
+        if request.user.is_anonymous:
+            return False
+
+        return WorkspaceMember.objects.filter(
+            member=request.user, workspace__slug=view.workspace_slug, is_active=True
+        ).exists()
+
+
+class WorkspaceUserPermission(BasePermission):
+    def has_permission(self, request, view):
+        if request.user.is_anonymous:
+            return False
+
+        return WorkspaceMember.objects.filter(
+            member=request.user, workspace__slug=view.workspace_slug, is_active=True
+        ).exists()