# Copyright (c) 2023-present Plane Software, Inc. and contributors # SPDX-License-Identifier: AGPL-3.0-only # See the LICENSE file for details. # Python imports import json # Django imports from django.utils import timezone from django.db.models import OuterRef, Func, F, Q, Value, UUIDField, Subquery, Count, IntegerField from django.utils.decorators import method_decorator from django.views.decorators.gzip import gzip_page from django.contrib.postgres.aggregates import ArrayAgg from django.contrib.postgres.fields import ArrayField from django.db.models.functions import Coalesce # Third Party imports from rest_framework.response import Response from rest_framework import status # Module imports from .. import BaseAPIView from plane.app.serializers import IssueSerializer from plane.app.permissions import ProjectEntityPermission from plane.db.models import Issue, IssueLink, FileAsset, CycleIssue, IssueLabel, IssueAssignee, ModuleIssue from plane.bgtasks.issue_activities_task import issue_activity from plane.utils.timezone_converter import user_timezone_converter from collections import defaultdict from plane.utils.host import base_host from plane.utils.order_queryset import order_issue_queryset class SubIssuesEndpoint(BaseAPIView): permission_classes = [ProjectEntityPermission] @method_decorator(gzip_page) def get(self, request, slug, project_id, issue_id): # SECURITY: scope the parent lookup to the URL project. ProjectEntityPermission # only checks that the caller belongs to `project_id`, not that `issue_id` lives # in it, so an unscoped filter leaks sub-issue metadata across projects in the # same workspace. sub_issues = ( Issue.issue_objects.filter( parent_id=issue_id, workspace__slug=slug, project_id=project_id ) .annotate( cycle_id=Subquery( CycleIssue.objects.filter(issue=OuterRef("id"), deleted_at__isnull=True).values("cycle_id")[:1] ) ) .annotate( link_count=Coalesce( Subquery( IssueLink.objects.filter(issue=OuterRef("id")) .order_by() .values("issue") .annotate(count=Count("id")) .values("count"), output_field=IntegerField(), ), 0, ) ) .annotate( attachment_count=Coalesce( Subquery( FileAsset.objects.filter( issue_id=OuterRef("id"), entity_type=FileAsset.EntityTypeContext.ISSUE_ATTACHMENT, ) .order_by() .values("issue_id") .annotate(count=Count("id")) .values("count"), output_field=IntegerField(), ), 0, ) ) .annotate( sub_issues_count=Coalesce( Subquery( Issue.issue_objects.filter(parent=OuterRef("id")) .order_by() .values("parent") .annotate(count=Count("id")) .values("count"), output_field=IntegerField(), ), 0, ) ) .annotate( label_ids=Coalesce( Subquery( IssueLabel.objects.filter(issue_id=OuterRef("id"), deleted_at__isnull=True) .order_by() .values("issue_id") .annotate(arr=ArrayAgg("label_id", distinct=True)) .values("arr"), output_field=ArrayField(UUIDField()), ), Value([], output_field=ArrayField(UUIDField())), ), assignee_ids=Coalesce( Subquery( IssueAssignee.objects.filter( issue_id=OuterRef("id"), assignee__member_project__is_active=True, deleted_at__isnull=True, ) .order_by() .values("issue_id") .annotate(arr=ArrayAgg("assignee_id", distinct=True)) .values("arr"), output_field=ArrayField(UUIDField()), ), Value([], output_field=ArrayField(UUIDField())), ), module_ids=Coalesce( Subquery( ModuleIssue.objects.filter( issue_id=OuterRef("id"), module__archived_at__isnull=True, deleted_at__isnull=True, ) .order_by() .values("issue_id") .annotate(arr=ArrayAgg("module_id", distinct=True)) .values("arr"), output_field=ArrayField(UUIDField()), ), Value([], output_field=ArrayField(UUIDField())), ), ) .annotate(state_group=F("state__group")) ) # Ordering order_by_param = request.GET.get("order_by", "-created_at") group_by = request.GET.get("group_by", False) if order_by_param: sub_issues, order_by_param = order_issue_queryset(sub_issues, order_by_param) sub_issues = list( sub_issues.values( "id", "name", "state_id", "sort_order", "completed_at", "estimate_point", "priority", "start_date", "target_date", "sequence_id", "project_id", "parent_id", "cycle_id", "module_ids", "label_ids", "assignee_ids", "sub_issues_count", "created_at", "updated_at", "created_by", "updated_by", "attachment_count", "link_count", "is_draft", "archived_at", "state_group", ) ) # create's a dict with state group name with their respective issue id's result = defaultdict(list) for sub_issue in sub_issues: result[sub_issue["state_group"]].append(str(sub_issue["id"])) datetime_fields = ["created_at", "updated_at"] sub_issues = user_timezone_converter(sub_issues, datetime_fields, request.user.user_timezone) # Grouping if group_by: result_dict = defaultdict(list) for issue in sub_issues: if group_by == "assignees__ids": if issue["assignee_ids"]: assignee_ids = issue["assignee_ids"] for assignee_id in assignee_ids: result_dict[str(assignee_id)].append(issue) elif issue["assignee_ids"] == []: result_dict["None"].append(issue) elif group_by: result_dict[str(issue[group_by])].append(issue) return Response( {"sub_issues": result_dict, "state_distribution": result}, status=status.HTTP_200_OK, ) return Response( {"sub_issues": sub_issues, "state_distribution": result}, status=status.HTTP_200_OK, ) # Assign multiple sub issues def post(self, request, slug, project_id, issue_id): # SECURITY: bind the parent issue to the URL workspace + project. A bare # pk lookup let any project member re-parent issues under a parent in a # different project/workspace. parent_issue = Issue.issue_objects.filter( pk=issue_id, workspace__slug=slug, project_id=project_id ).first() if parent_issue is None: return Response( {"error": "Parent issue not found"}, status=status.HTTP_404_NOT_FOUND, ) sub_issue_ids = request.data.get("sub_issue_ids", []) if not len(sub_issue_ids): return Response( {"error": "Sub Issue IDs are required"}, status=status.HTTP_400_BAD_REQUEST, ) # Scope to workspace + project to prevent cross-project/cross-tenant IDOR sub_issues = Issue.issue_objects.filter( id__in=sub_issue_ids, workspace__slug=slug, project_id=project_id ) for sub_issue in sub_issues: sub_issue.parent = parent_issue _ = Issue.objects.bulk_update(sub_issues, ["parent"], batch_size=10) # Only the issues that were actually re-parented — i.e. the project-scoped # `sub_issues`, not the raw caller-supplied ids. Otherwise a cross-project id # (excluded from the update above) would still fire issue_activity, whose task # does an unscoped Issue.objects.get and bumps updated_at on a foreign issue. scoped_sub_issue_ids = [str(sub_issue.id) for sub_issue in sub_issues] updated_sub_issues = Issue.issue_objects.filter( id__in=scoped_sub_issue_ids, workspace__slug=slug, project_id=project_id ).annotate(state_group=F("state__group")) # Track the issue _ = [ issue_activity.delay( type="issue.activity.updated", requested_data=json.dumps({"parent": str(issue_id)}), actor_id=str(request.user.id), issue_id=sub_issue_id, project_id=str(project_id), current_instance=json.dumps({"parent": sub_issue_id}), epoch=int(timezone.now().timestamp()), notification=True, origin=base_host(request=request, is_app=True), ) for sub_issue_id in scoped_sub_issue_ids ] # create's a dict with state group name with their respective issue id's result = defaultdict(list) for sub_issue in updated_sub_issues: result[sub_issue.state_group].append(str(sub_issue.id)) serializer = IssueSerializer(updated_sub_issues, many=True) return Response( {"sub_issues": serializer.data, "state_distribution": result}, status=status.HTTP_200_OK, )