[WEB-2576] fix: inactive members as issue assignees#7415
[WEB-2576] fix: inactive members as issue assignees#7415sangeethailango wants to merge 4 commits intopreviewfrom
Conversation
WalkthroughFiltering logic for aggregating assignee IDs was tightened across multiple API viewsets and utility functions. Now, only active project members associated with the current project are included as assignees when annotating querysets. Additionally, project retrieval now ensures that only active members can be assigned as project leads or default assignees. Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant API_ViewSet
participant DB
Client->>API_ViewSet: Request issues/cycles/sub-issues/relations
API_ViewSet->>DB: Query with filters (project_id, is_active)
DB-->>API_ViewSet: Filtered results (only active project members as assignees)
API_ViewSet-->>Client: Response with assignee_ids (project-scoped, active)
sequenceDiagram
participant Client
participant ProjectViewSet
participant DB
Client->>ProjectViewSet: Request project details
ProjectViewSet->>DB: Fetch project with prefetch (project_projectmember)
ProjectViewSet->>DB: Query active ProjectMember IDs
alt Lead/Assignee not active
ProjectViewSet->>ProjectViewSet: Set project_lead/default_assignee to None
end
ProjectViewSet-->>Client: Return project details
Estimated code review effort🎯 2 (Simple) | ⏱️ ~15 minutes Suggested labels
Suggested reviewers
Poem
Note ⚡️ Unit Test Generation is now available in beta!Learn more here, or try it out under "Finishing Touches" below. 📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
sangeethailango
changed the title
|
Pull Request Linked with Plane Work Items Comment Automatically Generated by Plane |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
apps/api/plane/utils/grouper.py (1)
4-4: Note: Unused import detected.The
OuterRefimport appears to be unused in the visible code. Consider removing it if it's not needed elsewhere in the file.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
apps/api/plane/app/views/cycle/base.py(1 hunks)apps/api/plane/app/views/issue/base.py(3 hunks)apps/api/plane/app/views/issue/relation.py(1 hunks)apps/api/plane/app/views/issue/sub_issue.py(1 hunks)apps/api/plane/app/views/project/base.py(1 hunks)apps/api/plane/utils/grouper.py(3 hunks)
🧠 Learnings (1)
apps/api/plane/app/views/issue/base.py (1)
Learnt from: vamsikrishnamathala
PR: #7214
File: web/core/store/issue/helpers/base-issues.store.ts:117-117
Timestamp: 2025-06-16T07:23:39.497Z
Learning: In the updateIssueDates method of BaseIssuesStore (web/core/store/issue/helpers/base-issues.store.ts), the projectId parameter is intentionally made optional to support override implementations in subclasses. The base implementation requires projectId and includes an early return check, but making it optional allows derived classes to override the method with different parameter requirements.
🧰 Additional context used
🧠 Learnings (1)
apps/api/plane/app/views/issue/base.py (1)
Learnt from: vamsikrishnamathala
PR: #7214
File: web/core/store/issue/helpers/base-issues.store.ts:117-117
Timestamp: 2025-06-16T07:23:39.497Z
Learning: In the updateIssueDates method of BaseIssuesStore (web/core/store/issue/helpers/base-issues.store.ts), the projectId parameter is intentionally made optional to support override implementations in subclasses. The base implementation requires projectId and includes an early return check, but making it optional allows derived classes to override the method with different parameter requirements.
🔇 Additional comments (9)
apps/api/plane/app/views/issue/sub_issue.py (1)
86-86: LGTM: Project-scoped assignee filtering correctly implemented.The addition of the project ID filter ensures that assignees are properly scoped to the current project, preventing cross-project assignee leakage in sub-issue queries.
apps/api/plane/app/views/issue/relation.py (1)
152-152: LGTM: Consistent project-scoped filtering applied to issue relations.The project ID filter correctly restricts assignees to the current project context in issue relation queries, maintaining consistency with other issue views.
apps/api/plane/app/views/issue/base.py (3)
508-508: LGTM: Project scoping added to issue retrieve method.The project ID filter correctly ensures that assignees are limited to active members of the current project in issue retrieval.
918-918: LGTM: Project scoping added to paginated issue list.The project ID filter properly restricts assignees to the current project in the paginated issue listing functionality.
1258-1258: LGTM: Project scoping added to issue detail identifier endpoint.The use of
project.idis correct here sinceprojectis a Project instance. This ensures assignees are properly scoped to the current project when retrieving issues by identifier.apps/api/plane/utils/grouper.py (2)
26-26: LGTM: Project ID extraction for filtering logic.Extracting the project ID from the queryset is the correct approach to enable project-scoped filtering in the utility function.
47-50: LGTM: Comprehensive assignee filtering logic implemented.The updated filter conditions correctly ensure that:
- Assignee IDs are not null
- Issue assignee relationships are not soft-deleted
- Member projects are active
- Members belong to the current project
This provides robust filtering to prevent inactive members from being included as assignees.
apps/api/plane/app/views/project/base.py (1)
222-222: LGTM: Prefetching project members for efficiency.Adding prefetch_related for project members is a good optimization for the subsequent member validation logic.
apps/api/plane/app/views/cycle/base.py (1)
177-185: Excellent fix for filtering inactive members as assignees!The additional filtering conditions properly restrict assignees to only active project members associated with the current project. This ensures data integrity by preventing inactive members from being included in the assignee aggregation, which directly addresses the bug described in the PR objectives.
The implementation correctly combines:
- Project membership validation (
member_project__project_id)- Active status validation (
member_project__is_active=True)- Existing deletion status check (
issue_assignee__deleted_at__isnull=True)
| "assignees__id", | ||
| ~Q(assignees__id__isnull=True) & Q(issue_assignee__deleted_at__isnull=True), | ||
| ~Q(assignees__id__isnull=True) | ||
| & Q(issue_assignee__deleted_at__isnull=True) |
There was a problem hiding this comment.
@sangeethailango Why is this filter checking different field than the others?
There was a problem hiding this comment.
Pull Request Overview
This pull request fixes a bug related to inactive members being included as issue assignees. The changes ensure that only active project members are returned in assignee lists across various issue-related views and components.
- Enhanced filtering logic to include project membership validation for assignees
- Added project-specific filtering to prevent cross-project member assignments
- Updated project details to nullify inactive project leads and default assignees
Reviewed Changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| apps/api/plane/utils/grouper.py | Added project-specific active member filtering for issue assignee grouping |
| apps/api/plane/app/views/project/base.py | Modified project retrieval to nullify inactive project leads and default assignees |
| apps/api/plane/app/views/issue/sub_issue.py | Added project ID filtering for sub-issue assignees |
| apps/api/plane/app/views/issue/relation.py | Added project ID filtering for related issue assignees |
| apps/api/plane/app/views/issue/base.py | Added project ID filtering across multiple issue view methods |
| apps/api/plane/app/views/cycle/base.py | Enhanced cycle assignee filtering with project membership validation |
Comments suppressed due to low confidence (1)
apps/api/plane/app/views/project/base.py:229
- [nitpick] The variable name 'members_ids' should be 'member_ids' to be consistent with the source variable 'project_member_ids'.
members_ids = set(project_member_ids)
Description
Type of Change
Screenshots and Media (if applicable)
Test Scenarios
References
Summary by CodeRabbit
Bug Fixes
Performance