diff --git a/apps/web/core/store/user/base-permissions.store.spec.ts b/apps/web/core/store/user/base-permissions.store.spec.ts
new file mode 100644
index 00000000000..c7b821f5eba
--- /dev/null
+++ b/apps/web/core/store/user/base-permissions.store.spec.ts
@@ -0,0 +1,323 @@
+/**
+ * Tests for BaseUserPermissionStore
+ *
+ * NOTE: This test suite assumes Jest is the test runner with ts-jest.
+ * If the repository uses Vitest, replace jest.fn/jest.spyOn with vi.fn/vi.spyOn
+ * and update imports accordingly.
+ */
+import { act } from "mobx";
+import { EUserPermissions, EUserPermissionsLevel } from "@plane/constants";
+import { EUserWorkspaceRoles, EUserProjectRoles, IUserProjectsRole, IWorkspaceMemberMe, TProjectMembership } from "@plane/types";
+
+// Under test: we import from the actual file path within the repo.
+// If the path differs, update the import accordingly.
+import { BaseUserPermissionStore } from "./base-permissions.store";
+
+// Mocks for external services that BaseUserPermissionStore uses via module-level singletons
+// - WorkspaceService (class)
+// - projectMemberService (default object)
+// - userService (default object)
+// - WORKSPACE_SIDEBAR_DYNAMIC_NAVIGATION_ITEMS_LINKS (constant list)
+jest.mock("@/plane-web/services/workspace.service", () => {
+  return {
+    WorkspaceService: jest.fn().mockImplementation(() => ({
+      workspaceMemberMe: jest.fn(),
+      getWorkspaceUserProjectsRole: jest.fn(),
+    })),
+  };
+});
+
+jest.mock("@/services/project/project-member.service", () => ({
+  __esModule: true,
+  default: {
+    projectMemberMe: jest.fn(),
+  },
+}));
+
+jest.mock("@/services/user.service", () => ({
+  __esModule: true,
+  default: {
+    leaveWorkspace: jest.fn(),
+    joinProject: jest.fn(),
+    leaveProject: jest.fn(),
+  },
+}));
+
+// We'll replace the WORKSPACE_SIDEBAR_DYNAMIC_NAVIGATION_ITEMS_LINKS with a deterministic stub for hasPageAccess tests.
+jest.mock("@plane/constants", () => {
+  const actual = jest.requireActual("@plane/constants");
+  return {
+    ...actual,
+    WORKSPACE_SIDEBAR_DYNAMIC_NAVIGATION_ITEMS_LINKS: [
+      { key: "settings", access: [actual.EUserPermissions.ADMIN] },
+      { key: "reports", access: [actual.EUserPermissions.MEMBER, actual.EUserPermissions.ADMIN] },
+    ],
+  };
+});
+
+import projectMemberService from "@/services/project/project-member.service";
+import userService from "@/services/user.service";
+import { WorkspaceService } from "@/plane-web/services/workspace.service";
+import { WORKSPACE_SIDEBAR_DYNAMIC_NAVIGATION_ITEMS_LINKS } from "@plane/constants";
+
+// Minimal mock RootStore that satisfies the fields used by BaseUserPermissionStore
+type AnyObj = Record<string, any>;
+const createMockStore = (workspaceSlug = "ws-1", projectId = "p-1") =>
+  ({
+    router: { workspaceSlug, projectId },
+    projectRoot: { project: { projectMap: {} as AnyObj } },
+  } as unknown as import("@/plane-web/store/root.store").RootStore);
+
+// Test implementation of abstract class to expose the protected getProjectRole via the abstract API
+class TestUserPermissionStore extends BaseUserPermissionStore {
+  // Delegate to the protected getProjectRole already implemented in the base class
+  getProjectRoleByWorkspaceSlugAndProjectId(workspaceSlug: string, projectId: string) {
+    // @ts-ignore accessing protected method within subclass
+    return this.getProjectRole(workspaceSlug, projectId);
+  }
+}
+
+describe("BaseUserPermissionStore - computed helpers", () => {
+  let store: TestUserPermissionStore;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    store = new TestUserPermissionStore(createMockStore());
+  });
+
+  test("workspaceInfoBySlug returns undefined for falsy or missing slug", () => {
+    expect(store.workspaceInfoBySlug("unknown")).toBeUndefined();
+    // @ts-expect-error intentional
+    expect(store.workspaceInfoBySlug("")).toBeUndefined();
+  });
+
+  test("workspaceInfoBySlug returns value when present", () => {
+    const wsMember: IWorkspaceMemberMe = { id: "u1", role: EUserWorkspaceRoles.MEMBER } as any;
+    store.workspaceUserInfo["ws-1"] = wsMember;
+    expect(store.workspaceInfoBySlug("ws-1")).toBe(wsMember);
+  });
+
+  test("getWorkspaceRoleByWorkspaceSlug returns role and handles undefined slug", () => {
+    expect(store.getWorkspaceRoleByWorkspaceSlug("ws-1")).toBeUndefined();
+    store.workspaceUserInfo["ws-1"] = { id: "u2", role: EUserWorkspaceRoles.ADMIN } as any;
+    expect(store.getWorkspaceRoleByWorkspaceSlug("ws-1")).toBe(EUserWorkspaceRoles.ADMIN);
+  });
+
+  test("getProjectRoleByWorkspaceSlugAndProjectId respects ADMIN workspace override", () => {
+    store.workspaceUserInfo["ws-1"] = { id: "u3", role: EUserWorkspaceRoles.ADMIN } as any;
+    store.workspaceProjectsPermissions["ws-1"] = { "p-1": EUserPermissions.MEMBER };
+    expect(store.getProjectRoleByWorkspaceSlugAndProjectId("ws-1", "p-1")).toBe(EUserPermissions.ADMIN);
+  });
+
+  test("getProjectRolesByWorkspaceSlug reduces only defined roles", () => {
+    store.workspaceUserInfo["ws-1"] = { id: "u4", role: EUserWorkspaceRoles.MEMBER } as any;
+    store.workspaceProjectsPermissions["ws-1"] = {
+      "p-1": EUserPermissions.MEMBER,
+      "p-2": EUserPermissions.GUEST,
+    } as IUserProjectsRole;
+    const roles = store.getProjectRolesByWorkspaceSlug("ws-1");
+    expect(roles).toEqual({
+      "p-1": EUserPermissions.MEMBER,
+      "p-2": EUserPermissions.GUEST,
+    });
+  });
+});
+
+describe("BaseUserPermissionStore - hasPageAccess", () => {
+  let store: TestUserPermissionStore;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    store = new TestUserPermissionStore(createMockStore());
+  });
+
+  test("returns false for missing inputs or unknown key", () => {
+    expect(store.hasPageAccess("", "settings")).toBe(false);
+    expect(store.hasPageAccess("ws-1", "unknown")).toBe(false);
+  });
+
+  test("grants access when workspace role is in allowed list", () => {
+    store.workspaceUserInfo["ws-1"] = { id: "u5", role: EUserPermissions.ADMIN as any } as any;
+    expect(WORKSPACE_SIDEBAR_DYNAMIC_NAVIGATION_ITEMS_LINKS.find(i => i.key==="settings")).toBeTruthy();
+    expect(store.hasPageAccess("ws-1", "settings")).toBe(true);
+  });
+
+  test("denies access when workspace role not permitted", () => {
+    store.workspaceUserInfo["ws-1"] = { id: "u6", role: EUserPermissions.GUEST as any } as any;
+    expect(store.hasPageAccess("ws-1", "settings")).toBe(false);
+  });
+});
+
+describe("BaseUserPermissionStore - allowPermissions", () => {
+  let store: TestUserPermissionStore;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    store = new TestUserPermissionStore(createMockStore("ws-X", "proj-Y"));
+  });
+
+  test("uses router defaults when workspaceSlug/projectId not provided", () => {
+    store.workspaceUserInfo["ws-X"] = { id: "u7", role: EUserPermissions.MEMBER as any } as any;
+    const allowed = store.allowPermissions([EUserPermissions.MEMBER], EUserPermissionsLevel.WORKSPACE);
+    expect(allowed).toBe(true);
+  });
+
+  test("parses string role into number for comparison", () => {
+    store.workspaceUserInfo["ws-X"] = { id: "u8", role: String(EUserPermissions.MEMBER) as any } as any;
+    const allowed = store.allowPermissions([EUserPermissions.MEMBER], EUserPermissionsLevel.WORKSPACE, "ws-X");
+    expect(allowed).toBe(true);
+  });
+
+  test("PROJECT level uses project role via abstract method", () => {
+    store.workspaceProjectsPermissions["ws-X"] = { "proj-Y": EUserPermissions.GUEST };
+    const allowed = store.allowPermissions([EUserPermissions.GUEST], EUserPermissionsLevel.PROJECT, "ws-X", "proj-Y");
+    expect(allowed).toBe(true);
+  });
+
+  test("invokes onPermissionAllowed callback when permitted", () => {
+    store.workspaceUserInfo["ws-X"] = { id: "u9", role: EUserPermissions.ADMIN as any } as any;
+    const cb = jest.fn(() => true);
+    const res = store.allowPermissions([EUserPermissions.ADMIN], EUserPermissionsLevel.WORKSPACE, "ws-X", undefined, cb);
+    expect(cb).toHaveBeenCalledTimes(1);
+    expect(res).toBe(true);
+  });
+
+  test("returns false when role not allowed", () => {
+    store.workspaceUserInfo["ws-X"] = { id: "u10", role: EUserPermissions.GUEST as any } as any;
+    expect(store.allowPermissions([EUserPermissions.MEMBER], EUserPermissionsLevel.WORKSPACE, "ws-X")).toBe(false);
+  });
+});
+
+describe("BaseUserPermissionStore - actions", () => {
+  let store: TestUserPermissionStore;
+  let wsService: jest.Mocked<InstanceType<typeof WorkspaceService>>;
+
+  function getWorkspaceServiceMock() {
+    // The module-level instance was constructed from the mocked class; grab its prototype spies
+    // @ts-ignore - access the mock constructor
+    const Ctor = WorkspaceService as unknown as jest.Mock;
+    const instance = Ctor.mock.instances[0] as any;
+    return instance as jest.Mocked<InstanceType<typeof WorkspaceService>>;
+  }
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    // reset class mock to get fresh instance
+    (WorkspaceService as unknown as jest.Mock).mockClear();
+    store = new TestUserPermissionStore(createMockStore("acme", "prj1"));
+    wsService = getWorkspaceServiceMock();
+  });
+
+  test("fetchUserWorkspaceInfo stores response and toggles loader", async () => {
+    const member: IWorkspaceMemberMe = { id: "me", role: EUserWorkspaceRoles.MEMBER } as any;
+    wsService.workspaceMemberMe.mockResolvedValue(member);
+
+    const p = store.fetchUserWorkspaceInfo("acme");
+    // loader should be true during fetch
+    expect(store.loader).toBe(true);
+    const res = await p;
+
+    expect(res).toBe(member);
+    expect(store.workspaceUserInfo["acme"]).toEqual(member);
+    expect(store.loader).toBe(false);
+    expect(wsService.workspaceMemberMe).toHaveBeenCalledWith("acme");
+  });
+
+  test("fetchUserWorkspaceInfo error: sets loader false and rethrows", async () => {
+    const err = new Error("fail ws");
+    wsService.workspaceMemberMe.mockRejectedValue(err);
+    await expect(store.fetchUserWorkspaceInfo("acme")).rejects.toThrow("fail ws");
+    expect(store.loader).toBe(false);
+  });
+
+  test("leaveWorkspace succeeds and unsets related maps", async () => {
+    // seed data
+    store.workspaceUserInfo["acme"] = { id: "me", role: EUserWorkspaceRoles.MEMBER } as any;
+    store.projectUserInfo["acme"] = { prj1: { id: "mem", role: EUserProjectRoles.MEMBER } as any };
+    store.workspaceProjectsPermissions["acme"] = { prj1: EUserPermissions.MEMBER };
+    (userService.leaveWorkspace as jest.Mock).mockResolvedValue(undefined);
+
+    await store.leaveWorkspace("acme");
+
+    expect(store.workspaceUserInfo["acme"]).toBeUndefined();
+    expect(store.projectUserInfo["acme"]).toBeUndefined();
+    expect(store.workspaceProjectsPermissions["acme"]).toBeUndefined();
+    expect(userService.leaveWorkspace).toHaveBeenCalledWith("acme");
+  });
+
+  test("leaveWorkspace error bubbles", async () => {
+    (userService.leaveWorkspace as jest.Mock).mockRejectedValue(new Error("cannot leave"));
+    await expect(store.leaveWorkspace("acme")).rejects.toThrow("cannot leave");
+  });
+
+  test("fetchUserProjectInfo stores membership and permissions", async () => {
+    const membership: TProjectMembership = { id: "mem1", role: EUserPermissions.MEMBER } as any;
+    (projectMemberService.projectMemberMe as jest.Mock).mockResolvedValue(membership);
+
+    const res = await store.fetchUserProjectInfo("acme", "prj1");
+    expect(res).toBe(membership);
+    expect(store.projectUserInfo["acme"]["prj1"]).toEqual(membership);
+    expect(store.workspaceProjectsPermissions["acme"]["prj1"]).toBe(EUserPermissions.MEMBER);
+    expect(projectMemberService.projectMemberMe).toHaveBeenCalledWith("acme", "prj1");
+  });
+
+  test("fetchUserProjectInfo error bubbles", async () => {
+    (projectMemberService.projectMemberMe as jest.Mock).mockRejectedValue(new Error("p fail"));
+    await expect(store.fetchUserProjectInfo("acme", "prj1")).rejects.toThrow("p fail");
+  });
+
+  test("fetchUserProjectPermissions writes map", async () => {
+    const map: IUserProjectsRole = { prj1: EUserPermissions.MEMBER, prj2: EUserPermissions.GUEST };
+    wsService.getWorkspaceUserProjectsRole.mockResolvedValue(map);
+
+    const res = await store.fetchUserProjectPermissions("acme");
+    expect(res).toBe(map);
+    expect(store.workspaceProjectsPermissions["acme"]).toEqual(map);
+    expect(wsService.getWorkspaceUserProjectsRole).toHaveBeenCalledWith("acme");
+  });
+
+  test("fetchUserProjectPermissions error bubbles", async () => {
+    wsService.getWorkspaceUserProjectsRole.mockRejectedValue(new Error("perm fail"));
+    await expect(store.fetchUserProjectPermissions("acme")).rejects.toThrow("perm fail");
+  });
+
+  test("joinProject uses workspace role or defaults to MEMBER, then sets permission", async () => {
+    (userService.joinProject as jest.Mock).mockResolvedValue({ ok: true });
+    // case 1: has workspace role ADMIN -> set ADMIN on project
+    store.workspaceUserInfo["acme"] = { id: "me", role: EUserPermissions.ADMIN as any } as any;
+    await store.joinProject("acme", "prjA");
+    expect(store.workspaceProjectsPermissions["acme"]["prjA"]).toBe(EUserPermissions.ADMIN);
+
+    // case 2: no workspace role -> defaults to MEMBER
+    delete store.workspaceUserInfo["acme"];
+    await store.joinProject("acme", "prjB");
+    expect(store.workspaceProjectsPermissions["acme"]["prjB"]).toBe(EUserPermissions.MEMBER);
+    expect(userService.joinProject).toHaveBeenCalledWith("acme", ["prjB"]);
+  });
+
+  test("joinProject error bubbles", async () => {
+    (userService.joinProject as jest.Mock).mockRejectedValue(new Error("join fail"));
+    await expect(store.joinProject("acme", "x")).rejects.toThrow("join fail");
+  });
+
+  test("leaveProject unsets permissions, membership, and projectMap", async () => {
+    (userService.leaveProject as jest.Mock).mockResolvedValue(undefined);
+    // seed
+    store.workspaceProjectsPermissions["acme"] = { prj1: EUserPermissions.MEMBER };
+    store.projectUserInfo["acme"] = { prj1: { id: "mem", role: EUserPermissions.MEMBER } as any };
+    const rs: any = (store as any).store;
+    rs.projectRoot.project.projectMap["prj1"] = { id: "prj1" };
+
+    await store.leaveProject("acme", "prj1");
+
+    expect(store.workspaceProjectsPermissions["acme"]["prj1"]).toBeUndefined();
+    expect(store.projectUserInfo["acme"]["prj1"]).toBeUndefined();
+    expect(rs.projectRoot.project.projectMap["prj1"]).toBeUndefined();
+    expect(userService.leaveProject).toHaveBeenCalledWith("acme", "prj1");
+  });
+
+  test("leaveProject error bubbles", async () => {
+    (userService.leaveProject as jest.Mock).mockRejectedValue(new Error("leave fail"));
+    await expect(store.leaveProject("acme", "prjZ")).rejects.toThrow("leave fail");
+  });
+});
\ No newline at end of file
diff --git a/tests/api/plane/models/test_project_model.py b/tests/api/plane/models/test_project_model.py
new file mode 100644
index 00000000000..2ed6dc2c78e
--- /dev/null
+++ b/tests/api/plane/models/test_project_model.py
@@ -0,0 +1,267 @@
+"""
+Tests for Project and related models.
+
+Testing framework: Django's unittest (django.test.TestCase).
+These tests avoid external dependencies, validate public interfaces, and cover happy paths, edge cases, and failure conditions.
+"""
+
+import uuid
+from datetime import datetime, timedelta, timezone
+
+from django.test import TestCase
+from django.db import IntegrityError, transaction
+from django.contrib.auth import get_user_model
+
+
+# ---- Helper factory-style creators (minimal, no external factory deps) ----
+
+def create_workspace(name="Acme"):
+    # Prefer Workspace; fall back to WorkSpace to handle naming variants.
+    try:
+        from plane.db.models import Workspace
+        return Workspace.objects.create(name=name, slug=f"{name.lower()}-ws")
+    except Exception:
+        from plane.db.models import WorkSpace
+        return WorkSpace.objects.create(name=name, slug=f"{name.lower()}-ws")
+
+
+def create_user(email_suffix="user@example.com"):
+    User = get_user_model()
+    unique_email = f"{uuid.uuid4().hex[:8]}-{email_suffix}"
+    # Some custom user models require username; include when present.
+    field_names = {f.name for f in User._meta.get_fields() if hasattr(f, "name")}
+    kwargs = {}
+    if "username" in field_names:
+        kwargs["username"] = unique_email
+    # Some models may require full_name/name; provide best-effort defaults if present.
+    for possible in ("full_name", "name"):
+        if possible in field_names:
+            kwargs[possible] = unique_email.split("@")[0]
+            break
+    return User.objects.create(email=unique_email, **kwargs)
+
+
+def create_state(workspace):
+    from plane.db.models import State
+    field_names = {f.name for f in State._meta.fields}
+    kwargs = {
+        "name": "Backlog",
+        "color": "#999999",
+        "workspace": workspace,
+    }
+    if "group" in field_names:
+        kwargs["group"] = "backlog"
+    return State.objects.create(**kwargs)
+
+
+def create_file_asset(workspace, asset_url="https://cdn.example.com/cover.png"):
+    from plane.db.models import FileAsset
+    field_names = {f.name for f in FileAsset._meta.fields}
+    defaults = {}
+    if "asset_url" in field_names:
+        defaults["asset_url"] = asset_url
+    if "workspace" in field_names:
+        defaults["workspace"] = workspace
+    if "name" in field_names:
+        defaults["name"] = "cover.png"
+    return FileAsset.objects.create(**defaults)
+
+
+def create_project(workspace, **overrides):
+    from plane.db.models import Project
+    base = dict(
+        name=overrides.pop("name", "Platform"),
+        description=overrides.pop("description", ""),
+        identifier=overrides.pop("identifier", "plat"),
+        workspace=workspace,
+    )
+    base.update(overrides)
+    return Project.objects.create(**base)
+
+
+def soft_delete(instance):
+    # Soft delete if model provides deleted_at (BaseModel typically does)
+    if hasattr(instance, "deleted_at"):
+        instance.deleted_at = datetime.now(timezone.utc) - timedelta(minutes=1)
+        instance.save(update_fields=["deleted_at"])
+    return instance
+
+
+# ---- Tests ----
+
+class ProjectModelTests(TestCase):
+    def test_identifier_is_stripped_and_uppercased_on_save(self):
+        from plane.db.models import Project
+        ws = create_workspace()
+        proj = Project(name="X", identifier="  xy-1  ", workspace=ws)
+        proj.save()
+        proj.refresh_from_db()
+        self.assertEqual(proj.identifier, "XY-1")
+
+    def test_cover_image_url_prefers_asset_over_text(self):
+        ws = create_workspace()
+        proj = create_project(ws, cover_image="https://example.com/fallback.png")
+        # No asset yet -> returns text cover_image
+        self.assertEqual(proj.cover_image_url, "https://example.com/fallback.png")
+
+        asset = create_file_asset(ws, asset_url="https://cdn.example.com/asset.png")
+        proj.cover_image_asset = asset
+        proj.save()
+        self.assertEqual(proj.cover_image_url, "https://cdn.example.com/asset.png")
+
+    def test_cover_image_url_none_when_no_asset_and_no_text(self):
+        ws = create_workspace()
+        proj = create_project(ws)
+        self.assertIsNone(proj.cover_image_url)
+
+    def test___str___includes_name_and_workspace(self):
+        ws = create_workspace(name="Team One")
+        proj = create_project(ws, name="Roadmap")
+        s = str(proj)
+        self.assertIn("Roadmap", s)
+        self.assertIn("Team One", s)
+
+    def test_unique_identifier_per_workspace_when_not_deleted(self):
+        ws = create_workspace(name="A")
+        create_project(ws, identifier="AAA")
+        with self.assertRaises(IntegrityError):
+            with transaction.atomic():
+                create_project(ws, identifier="AAA")
+
+    def test_unique_identifier_allows_soft_deleted(self):
+        ws = create_workspace(name="A2")
+        p1 = create_project(ws, identifier="A2X")
+        soft_delete(p1)
+        # After soft delete, duplicate identifier should be permitted
+        p2 = create_project(ws, identifier="A2X")
+        self.assertNotEqual(p1.pk, p2.pk)
+
+    def test_unique_name_per_workspace_when_not_deleted(self):
+        ws = create_workspace(name="B")
+        create_project(ws, name="Website")
+        with self.assertRaises(IntegrityError):
+            with transaction.atomic():
+                create_project(ws, name="Website")
+
+    def test_timezone_default_and_choices_contains_utc(self):
+        from plane.db.models import Project
+        ws = create_workspace()
+        proj = create_project(ws)
+        self.assertEqual(proj.timezone, "UTC")
+        field = Project._meta.get_field("timezone")
+        choices = [c[0] for c in field.choices]
+        self.assertIn("UTC", choices)
+
+    def test_logo_props_default_is_dict(self):
+        ws = create_workspace()
+        user = create_user()
+        state = create_state(ws)
+        proj = create_project(ws, default_state=state, project_lead=user)
+        self.assertIsInstance(proj.logo_props, dict)
+
+
+class ProjectBaseModelBehaviorTests(TestCase):
+    def test_workspace_is_copied_from_project_on_save(self):
+        # Use concrete subclass ProjectMember
+        from plane.db.models import ProjectMember
+        ws = create_workspace("WSX")
+        user = create_user()
+        proj = create_project(ws, name="Alpha", identifier="ALP")
+        member = ProjectMember(project=proj, member=user)
+        # Before save, workspace may be None (set on save)
+        self.assertTrue(member.workspace_id is None or member.workspace_id == ws.id)
+        member.save()
+        self.assertEqual(member.workspace_id, ws.id)
+
+
+class ProjectMemberTests(TestCase):
+    def test_sort_order_decreases_relative_to_existing_members_for_same_user(self):
+        from plane.db.models import ProjectMember
+        ws = create_workspace("WSY")
+        user = create_user()
+        proj1 = create_project(ws, name="P1", identifier="P1")
+        proj2 = create_project(ws, name="P2", identifier="P2")
+
+        m1 = ProjectMember.objects.create(project=proj1, member=user)  # default 65535
+        m2 = ProjectMember.objects.create(project=proj2, member=user)  # expect 65535-10000
+
+        m1.refresh_from_db()
+        m2.refresh_from_db()
+        self.assertEqual(m1.sort_order, 65535)
+        self.assertEqual(m2.sort_order, 55535)
+
+    def test_unique_project_member_pair_enforced_when_not_deleted(self):
+        from plane.db.models import ProjectMember
+        ws = create_workspace("WSZ")
+        user = create_user()
+        proj = create_project(ws, name="P", identifier="PP")
+        ProjectMember.objects.create(project=proj, member=user)
+        with self.assertRaises(IntegrityError):
+            with transaction.atomic():
+                ProjectMember.objects.create(project=proj, member=user)
+
+    def test_unique_project_member_allows_soft_deleted(self):
+        from plane.db.models import ProjectMember
+        ws = create_workspace("WSQ")
+        user = create_user()
+        proj = create_project(ws, name="PA", identifier="PA")
+        m = ProjectMember.objects.create(project=proj, member=user)
+        soft_delete(m)
+        # Should succeed after soft delete
+        ProjectMember.objects.create(project=proj, member=user)
+
+
+class ProjectIdentifierModelTests(TestCase):
+    def test_unique_name_per_workspace_when_not_deleted(self):
+        from plane.db.models import ProjectIdentifier
+        ws = create_workspace("U1")
+        proj = create_project(ws, name="T", identifier="TU")
+        ProjectIdentifier.objects.create(workspace=ws, project=proj, name="TU")
+        with self.assertRaises(IntegrityError):
+            with transaction.atomic():
+                ProjectIdentifier.objects.create(workspace=ws, project=proj, name="TU")
+
+    def test_unique_name_allows_soft_deleted(self):
+        from plane.db.models import ProjectIdentifier
+        ws = create_workspace("U2")
+        proj = create_project(ws, name="T2", identifier="T2")
+        pi = ProjectIdentifier.objects.create(workspace=ws, project=proj, name="T2")
+        soft_delete(pi)
+        # Should not raise
+        ProjectIdentifier.objects.create(workspace=ws, project=proj, name="T2")
+
+
+class ProjectDeployBoardTests(TestCase):
+    def test_anchor_autogenerates_is_unique_and_str_contains_anchor_and_project(self):
+        from plane.db.models import ProjectDeployBoard
+        ws = create_workspace("DB1")
+        proj = create_project(ws, name="DB P", identifier="DBP")
+        board1 = ProjectDeployBoard.objects.create(project=proj)
+        board2 = ProjectDeployBoard.objects.create(project=proj)
+        self.assertTrue(board1.anchor and board2.anchor)
+        self.assertNotEqual(board1.anchor, board2.anchor)
+        s = str(board1)
+        self.assertIn(board1.anchor, s)
+        self.assertIn(proj.name, s)
+
+
+class ProjectPublicMemberTests(TestCase):
+    def test_unique_project_public_member_pair_enforced(self):
+        from plane.db.models import ProjectPublicMember
+        ws = create_workspace("PUB")
+        user = create_user()
+        proj = create_project(ws, name="Open", identifier="OPEN")
+        ProjectPublicMember.objects.create(project=proj, member=user)
+        with self.assertRaises(IntegrityError):
+            with transaction.atomic():
+                ProjectPublicMember.objects.create(project=proj, member=user)
+
+    def test_unique_project_public_member_allows_soft_deleted(self):
+        from plane.db.models import ProjectPublicMember
+        ws = create_workspace("PUB2")
+        user = create_user(email_suffix="pub2@example.com")
+        proj = create_project(ws, name="Open2", identifier="OPN2")
+        ppm = ProjectPublicMember.objects.create(project=proj, member=user)
+        soft_delete(ppm)
+        # Should succeed after soft delete
+        ProjectPublicMember.objects.create(project=proj, member=user)
\ No newline at end of file
diff --git a/tests/api/plane/permissions/test_base_permissions.py b/tests/api/plane/permissions/test_base_permissions.py
new file mode 100644
index 00000000000..033bf2c69f1
--- /dev/null
+++ b/tests/api/plane/permissions/test_base_permissions.py
@@ -0,0 +1,216 @@
+import types
+from unittest.mock import MagicMock, patch
+import pytest
+from rest_framework.test import APIRequestFactory
+from rest_framework.response import Response
+from rest_framework import status
+
+# Import the system under test
+# Try common locations; if the project structure differs, update this import accordingly.
+try:
+    from plane.api.plane.permissions.base_permissions import allow_permission, ROLE
+except Exception:
+    try:
+        from plane.api.permissions.base_permissions import allow_permission, ROLE
+    except Exception:
+        # Fallback to a flat module path used in some layouts
+        from plane.permissions.base_permissions import allow_permission, ROLE
+
+
+class DummyUser:
+    def __init__(self, user_id="user-1"):
+        self.id = user_id
+        self.is_authenticated = True
+
+@pytest.fixture()
+def api_rf():
+    return APIRequestFactory()
+
+@pytest.fixture()
+def ok_view():
+    # A simple view func to be decorated. It must accept (instance, request, *args, **kwargs)
+    def view(instance, request, *args, **kwargs):
+        return Response({"ok": True, "kwargs": kwargs}, status=status.HTTP_200_OK)
+    return view
+
+def make_request(api_rf, user=None):
+    req = api_rf.get("/dummy/")
+    req.user = user or DummyUser()
+    return req
+
+def _fake_qs_exists(result: bool):
+    """Build a fake queryset: objects.filter(...).exists() -> result"""
+    qs = MagicMock()
+    qs.exists.return_value = result
+    manager = MagicMock()
+    manager.filter.return_value = qs
+    return manager
+
+def _decorate(view, *, allowed_roles, level="PROJECT", creator=False, model=None):
+    return allow_permission(allowed_roles, level=level, creator=creator, model=model)(view)
+
+def _call(decorated, request, **kwargs):
+    # instance can be None for function-based, kwargs include slug, project_id, pk, etc.
+    return decorated(None, request, **kwargs)
+
+# ------------------------
+# Creator shortcut tests
+# ------------------------
+
+def test_allows_creator_when_flag_true_and_object_exists(api_rf, ok_view, monkeypatch):
+    # model.objects.filter(id=pk, created_by=user).exists() -> True, should bypass role checks
+    class FakeModel: pass
+    FakeModel.objects = _fake_qs_exists(True)
+
+    # Ensure role checks fail to prove creator bypass works:
+    with patch("plane.db.models.WorkspaceMember") as WM, patch("plane.db.models.ProjectMember") as PM:
+        WM.objects = _fake_qs_exists(False)
+        PM.objects = _fake_qs_exists(False)
+
+        decorated = _decorate(ok_view, allowed_roles=[ROLE.MEMBER], creator=True, model=FakeModel)
+        resp = _call(decorated, make_request(api_rf), slug="w1", project_id="p1", pk="obj-1")
+
+    assert resp.status_code == 200
+    assert resp.data["ok"] is True
+
+def test_creator_flag_true_but_not_creator_falls_back_to_role_checks_denied(api_rf, ok_view, monkeypatch):
+    class FakeModel: pass
+    FakeModel.objects = _fake_qs_exists(False)
+
+    with patch("plane.db.models.WorkspaceMember") as WM, patch("plane.db.models.ProjectMember") as PM:
+        # No allowed roles found either -> deny
+        WM.objects = _fake_qs_exists(False)
+        PM.objects = _fake_qs_exists(False)
+
+        decorated = _decorate(ok_view, allowed_roles=[ROLE.MEMBER], creator=True, model=FakeModel)
+        resp = _call(decorated, make_request(api_rf), slug="w1", project_id="p1", pk="obj-2")
+
+    assert resp.status_code == status.HTTP_403_FORBIDDEN
+    assert "required permissions" in resp.data.get("error", "").lower()
+
+# ------------------------
+# WORKSPACE level tests
+# ------------------------
+
+def test_workspace_level_allows_when_workspace_member_has_allowed_role(api_rf, ok_view):
+    with patch("plane.db.models.WorkspaceMember") as WM, patch("plane.db.models.ProjectMember") as PM:
+        # Workspace allowed role exists -> allow
+        WM.objects = _fake_qs_exists(True)
+        PM.objects = _fake_qs_exists(False)  # Should not be consulted for WORKSPACE level
+
+        decorated = _decorate(ok_view, allowed_roles=[ROLE.ADMIN, ROLE.MEMBER], level="WORKSPACE")
+        resp = _call(decorated, make_request(api_rf), slug="acme", project_id="proj-1")
+
+    assert resp.status_code == 200
+    assert resp.data["ok"] is True
+
+def test_workspace_level_denies_when_no_membership_or_role(api_rf, ok_view):
+    with patch("plane.db.models.WorkspaceMember") as WM, patch("plane.db.models.ProjectMember") as PM:
+        WM.objects = _fake_qs_exists(False)
+        PM.objects = _fake_qs_exists(False)
+
+        decorated = _decorate(ok_view, allowed_roles=[ROLE.MEMBER], level="WORKSPACE")
+        resp = _call(decorated, make_request(api_rf), slug="acme", project_id="proj-1")
+
+    assert resp.status_code == status.HTTP_403_FORBIDDEN
+
+# ------------------------
+# PROJECT level tests
+# ------------------------
+
+def test_project_level_allows_when_user_has_allowed_project_role(api_rf, ok_view):
+    with patch("plane.db.models.WorkspaceMember") as WM, patch("plane.db.models.ProjectMember") as PM:
+        # Direct allowed role at project -> allow
+        PM.objects = _fake_qs_exists(True)
+        WM.objects = _fake_qs_exists(False)
+
+        decorated = _decorate(ok_view, allowed_roles=[ROLE.MEMBER], level="PROJECT")
+        resp = _call(decorated, make_request(api_rf), slug="w1", project_id="p1")
+
+    assert resp.status_code == 200
+    assert resp.data["ok"] is True
+
+def test_project_level_allows_when_workspace_admin_and_project_member(api_rf, ok_view):
+    with patch("plane.db.models.WorkspaceMember") as WM, patch("plane.db.models.ProjectMember") as PM:
+        # Not in allowed roles:
+        PM.objects = _fake_qs_exists(False)
+        # But is workspace ADMIN and also part of the project -> allow
+        def _wm_filter(*args, **kwargs):
+            qs = MagicMock()
+            qs.exists.return_value = True  # Simulate ADMIN existence
+            return qs
+        WM.objects = MagicMock()
+        WM.objects.filter.side_effect = _wm_filter
+
+        # Simulate being part of the project (regardless of role)
+        def _pm_filter(*args, **kwargs):
+            # First call checks allowed roles -> should be False
+            # Second check is "part of the project regardless of the role" -> True
+            qs1 = MagicMock()
+            qs2 = MagicMock()
+            qs1.exists.return_value = False
+            qs2.exists.return_value = True
+            # Return different QS based on role__in kw presence
+            return qs1 if "role__in" in kwargs else qs2
+
+        PM.objects.filter.side_effect = _pm_filter
+
+        decorated = _decorate(ok_view, allowed_roles=[ROLE.GUEST], level="PROJECT")
+        resp = _call(decorated, make_request(api_rf), slug="w1", project_id="p1")
+
+    assert resp.status_code == 200
+    assert resp.data["ok"] is True
+
+def test_project_level_denies_when_not_allowed_not_admin_or_not_in_project(api_rf, ok_view):
+    with patch("plane.db.models.WorkspaceMember") as WM, patch("plane.db.models.ProjectMember") as PM:
+        PM.objects = _fake_qs_exists(False)
+        WM.objects = _fake_qs_exists(False)
+
+        decorated = _decorate(ok_view, allowed_roles=[ROLE.ADMIN], level="PROJECT")
+        resp = _call(decorated, make_request(api_rf), slug="w1", project_id="p1")
+
+    assert resp.status_code == status.HTTP_403_FORBIDDEN
+
+# ------------------------
+# Allowed roles conversion tests
+# ------------------------
+
+def test_allowed_roles_accepts_enum_and_ints(api_rf, ok_view):
+    # Provide a mix of enum and raw numeric role values
+    with patch("plane.db.models.WorkspaceMember") as WM, patch("plane.db.models.ProjectMember") as PM:
+        # First branch: allowed role at project satisfied
+        PM.objects = _fake_qs_exists(True)
+        WM.objects = _fake_qs_exists(False)
+
+        decorated = _decorate(ok_view, allowed_roles=[ROLE.MEMBER, ROLE.GUEST.value, 999], level="PROJECT")
+        resp = _call(decorated, make_request(api_rf), slug="w1", project_id="p1")
+
+    assert resp.status_code == 200
+
+# ------------------------
+# Robustness / unexpected input tests
+# ------------------------
+
+def test_missing_kwargs_results_in_denial_with_403(api_rf, ok_view):
+    # Missing slug/project_id should cause filters to be incomplete and mocks return False -> deny
+    with patch("plane.db.models.WorkspaceMember") as WM, patch("plane.db.models.ProjectMember") as PM:
+        PM.objects = _fake_qs_exists(False)
+        WM.objects = _fake_qs_exists(False)
+
+        decorated = _decorate(ok_view, allowed_roles=[ROLE.MEMBER], level="PROJECT")
+        # Supply only slug, skip project_id
+        resp = _call(decorated, make_request(api_rf), slug="only-slug")
+
+    assert resp.status_code == status.HTTP_403_FORBIDDEN
+
+def test_view_response_is_preserved_on_success(api_rf, ok_view):
+    with patch("plane.db.models.WorkspaceMember") as WM, patch("plane.db.models.ProjectMember") as PM:
+        PM.objects = _fake_qs_exists(True)
+        WM.objects = _fake_qs_exists(False)
+
+        decorated = _decorate(ok_view, allowed_roles=[ROLE.MEMBER])
+        resp = _call(decorated, make_request(api_rf), slug="w", project_id="p")
+
+    assert isinstance(resp, Response)
+    assert resp.status_code == 200
+    assert resp.data["ok"] is True
diff --git a/tests/api/plane/permissions/test_project_permissions.py b/tests/api/plane/permissions/test_project_permissions.py
new file mode 100644
index 00000000000..19fe740cb43
--- /dev/null
+++ b/tests/api/plane/permissions/test_project_permissions.py
@@ -0,0 +1,192 @@
+"""
+Tests for Project permission classes.
+
+Detected test stack: pytest (with pytest-django if available) + unittest.mock.
+We unit-test has_permission by mocking ORM lookups to avoid DB I/O.
+"""
+
+from types import SimpleNamespace
+from unittest.mock import MagicMock, patch
+import pytest
+
+# Helpers to build mock QuerySet with .exists() and chained .filter().exists()
+class QS:
+    def __init__(self, exists=False, admin_exists=False):
+        # exists => result of qs.exists()
+        # admin_exists => result of qs.filter(role=ADMIN).exists()
+        self._exists = exists
+        self._admin_exists = admin_exists
+
+    def exists(self):
+        return self._exists
+
+    def filter(self, *args, **kwargs):
+        # When specifically looking for ADMIN, return qs whose exists() reflects admin_exists
+        if "role" in kwargs:
+            return QS(exists=self._admin_exists, admin_exists=self._admin_exists)
+        return self
+
+def make_request(user_is_anonymous=False, method="GET"):
+    user = SimpleNamespace(is_anonymous=user_is_anonymous)
+    return SimpleNamespace(user=user, method=method)
+
+def make_view(workspace_slug="ws-1", project_id=111, project_identifier=None):
+    ns = SimpleNamespace(workspace_slug=workspace_slug, project_id=project_id)
+    if project_identifier is not None:
+        ns.project_identifier = project_identifier
+    return ns
+
+# Import under test
+from rest_framework.permissions import SAFE_METHODS  # sanity
+# Attempt both common module paths; adjust if project structure differs.
+try:
+    from plane.api.permissions.project import (
+        ProjectBasePermission,
+        ProjectMemberPermission,
+        ProjectEntityPermission,
+        ProjectLitePermission,
+    )
+except Exception:
+    from plane.permissions.project import (  # fallback
+        ProjectBasePermission,
+        ProjectMemberPermission,
+        ProjectEntityPermission,
+        ProjectLitePermission,
+    )
+
+@pytest.mark.parametrize("perm_cls", [
+    ProjectBasePermission,
+    ProjectMemberPermission,
+    ProjectEntityPermission,
+    ProjectLitePermission,
+])
+def test_anonymous_user_denied(perm_cls):
+    perm = perm_cls()
+    req = make_request(user_is_anonymous=True, method="GET")
+    view = make_view()
+    assert perm.has_permission(req, view) is False
+
+class TestProjectBasePermission:
+    @patch("plane.db.models.WorkspaceMember")
+    def test_safe_methods_require_active_workspace_membership(self, WM):
+        # WorkspaceMember.objects.filter(...).exists() -> True yields allowed
+        WM.objects.filter.return_value = QS(exists=True)
+        perm = ProjectBasePermission()
+        req = make_request(method="GET")
+        assert "GET" in SAFE_METHODS
+        assert perm.has_permission(req, make_view()) is True
+
+        # Not a member -> denied
+        WM.objects.filter.return_value = QS(exists=False)
+        assert perm.has_permission(req, make_view()) is False
+
+    @patch("plane.db.models.WorkspaceMember")
+    def test_post_requires_workspace_admin_or_member(self, WM):
+        # Model filter for role__in returns .exists()
+        WM.objects.filter.return_value = QS(exists=True)
+        perm = ProjectBasePermission()
+        req = make_request(method="POST")
+        assert perm.has_permission(req, make_view()) is True
+
+        WM.objects.filter.return_value = QS(exists=False)
+        assert perm.has_permission(req, make_view()) is False
+
+    @patch("plane.db.models.WorkspaceMember")
+    @patch("plane.db.models.ProjectMember")
+    def test_non_safe_non_post_admin_project_member_allowed(self, PM, WM):
+        # project_member_qs.filter(role=ADMIN).exists() -> True
+        PM.objects.filter.return_value = QS(exists=True, admin_exists=True)
+        perm = ProjectBasePermission()
+        req = make_request(method="PATCH")
+        assert perm.has_permission(req, make_view()) is True
+        # Ensure WorkspaceMember not consulted in admin short-circuit
+        WM.objects.filter.assert_not_called()
+
+    @patch("plane.db.models.WorkspaceMember")
+    @patch("plane.db.models.ProjectMember")
+    def test_non_safe_non_post_member_plus_workspace_admin_allowed(self, PM, WM):
+        # Not a project admin, but is a project member AND workspace admin
+        PM.objects.filter.return_value = QS(exists=True, admin_exists=False)
+        WM.objects.filter.return_value = QS(exists=True)  # workspace admin exists
+        perm = ProjectBasePermission()
+        req = make_request(method="PUT")
+        assert perm.has_permission(req, make_view()) is True
+
+    @patch("plane.db.models.WorkspaceMember")
+    @patch("plane.db.models.ProjectMember")
+    def test_non_safe_non_post_member_without_workspace_admin_denied(self, PM, WM):
+        PM.objects.filter.return_value = QS(exists=True, admin_exists=False)
+        WM.objects.filter.return_value = QS(exists=False)  # not workspace admin
+        perm = ProjectBasePermission()
+        req = make_request(method="DELETE")
+        assert perm.has_permission(req, make_view()) is False
+
+    @patch("plane.db.models.WorkspaceMember")
+    @patch("plane.db.models.ProjectMember")
+    def test_non_safe_non_post_non_member_denied(self, PM, WM):
+        PM.objects.filter.return_value = QS(exists=False, admin_exists=False)
+        WM.objects.filter.return_value = QS(exists=True)  # irrelevant
+        perm = ProjectBasePermission()
+        req = make_request(method="PATCH")
+        assert perm.has_permission(req, make_view()) is False
+
+class TestProjectMemberPermission:
+    @patch("plane.db.models.ProjectMember")
+    def test_safe_methods_require_project_membership(self, PM):
+        PM.objects.filter.return_value = QS(exists=True)
+        perm = ProjectMemberPermission()
+        assert perm.has_permission(make_request(method="GET"), make_view()) is True
+        PM.objects.filter.return_value = QS(exists=False)
+        assert perm.has_permission(make_request(method="GET"), make_view()) is False
+
+    @patch("plane.db.models.WorkspaceMember")
+    def test_post_requires_workspace_admin_or_member(self, WM):
+        WM.objects.filter.return_value = QS(exists=True)
+        perm = ProjectMemberPermission()
+        assert perm.has_permission(make_request(method="POST"), make_view()) is True
+        WM.objects.filter.return_value = QS(exists=False)
+        assert perm.has_permission(make_request(method="POST"), make_view()) is False
+
+    @patch("plane.db.models.ProjectMember")
+    def test_update_requires_project_admin_or_member(self, PM):
+        PM.objects.filter.return_value = QS(exists=True)
+        perm = ProjectMemberPermission()
+        assert perm.has_permission(make_request(method="PATCH"), make_view()) is True
+        PM.objects.filter.return_value = QS(exists=False)
+        assert perm.has_permission(make_request(method="PATCH"), make_view()) is False
+
+class TestProjectEntityPermission:
+    @patch("plane.db.models.ProjectMember")
+    def test_safe_with_project_identifier_checks_membership_by_identifier(self, PM):
+        PM.objects.filter.return_value = QS(exists=True)
+        perm = ProjectEntityPermission()
+        view = make_view(project_identifier="PROJ-1")
+        assert perm.has_permission(make_request(method="GET"), view) is True
+        PM.objects.filter.return_value = QS(exists=False)
+        assert perm.has_permission(make_request(method="GET"), view) is False
+
+    @patch("plane.db.models.ProjectMember")
+    def test_safe_without_identifier_checks_by_project_id(self, PM):
+        PM.objects.filter.return_value = QS(exists=True)
+        perm = ProjectEntityPermission()
+        view = make_view(project_identifier=None)
+        assert perm.has_permission(make_request(method="GET"), view) is True
+        PM.objects.filter.return_value = QS(exists=False)
+        assert perm.has_permission(make_request(method="GET"), view) is False
+
+    @patch("plane.db.models.ProjectMember")
+    def test_mutating_requires_member_or_admin(self, PM):
+        PM.objects.filter.return_value = QS(exists=True)
+        perm = ProjectEntityPermission()
+        assert perm.has_permission(make_request(method="POST"), make_view()) is True
+        PM.objects.filter.return_value = QS(exists=False)
+        assert perm.has_permission(make_request(method="POST"), make_view()) is False
+
+class TestProjectLitePermission:
+    @patch("plane.db.models.ProjectMember")
+    def test_requires_active_project_membership(self, PM):
+        PM.objects.filter.return_value = QS(exists=True)
+        perm = ProjectLitePermission()
+        assert perm.has_permission(make_request(method="HEAD"), make_view()) is True
+        PM.objects.filter.return_value = QS(exists=False)
+        assert perm.has_permission(make_request(method="HEAD"), make_view()) is False
\ No newline at end of file
diff --git a/tests/api/plane/views/project/test_base_view.py b/tests/api/plane/views/project/test_base_view.py
new file mode 100644
index 00000000000..958fd7a6322
--- /dev/null
+++ b/tests/api/plane/views/project/test_base_view.py
@@ -0,0 +1,383 @@
+# Tests for Project-related views
+# Framework: pytest + pytest-django
+import json
+import pytest
+from django.urls import reverse
+from django.utils import timezone
+
+from django.contrib.auth import get_user_model
+
+from rest_framework.test import APIClient
+
+# If factories or baker are available in the repository, the following imports can be swapped accordingly:
+# from tests.factories import (UserFactory, WorkspaceFactory, ProjectFactory, WorkspaceMemberFactory, ProjectMemberFactory, DeployBoardFactory, UserFavoriteFactory, ProjectIdentifierFactory, IntakeFactory, StateFactory, IssueUserPropertyFactory)
+# from model_bakery import baker
+
+User = get_user_model()
+
+@pytest.fixture
+def api_client(db):
+    return APIClient()
+
+# Helper builders without relying on external factory libs to keep tests self-contained.
+# If repo has factories/model_bakery, replace these builders with those utilities to reduce verbosity.
+from django.contrib.auth import get_user_model
+from django.db import transaction
+from django.utils.crypto import get_random_string
+
+from django.apps import apps
+
+Project = apps.get_model('plane', 'Project') if apps.is_installed('plane') else apps.get_model(*[m.label, 'Project'] for m in apps.get_app_configs() if hasattr(m.models_module, 'project'))
+Workspace = apps.get_model('plane', 'Workspace') if apps.is_installed('plane') else None
+WorkspaceMember = apps.get_model('plane', 'WorkspaceMember') if apps.is_installed('plane') else None
+ProjectMember = apps.get_model('plane', 'ProjectMember') if apps.is_installed('plane') else None
+UserFavorite = apps.get_model('plane', 'UserFavorite') if apps.is_installed('plane') else None
+DeployBoard = apps.get_model('plane', 'DeployBoard') if apps.is_installed('plane') else None
+ProjectIdentifier = apps.get_model('plane', 'ProjectIdentifier') if apps.is_installed('plane') else None
+Intake = apps.get_model('plane', 'Intake') if apps.is_installed('plane') else None
+IssueUserProperty = apps.get_model('plane', 'IssueUserProperty') if apps.is_installed('plane') else None
+State = apps.get_model('plane', 'State') if apps.is_installed('plane') else None
+
+# In absence of explicit ROLE enum in tests, define fallbacks matching common values used by code.
+class RoleEnum:
+    ADMIN = getattr(getattr(apps.get_app_config('plane'), 'ROLE', object()), 'ADMIN', 20) if apps.ready else 20
+    MEMBER = getattr(getattr(apps.get_app_config('plane'), 'ROLE', object()), 'MEMBER', 10) if apps.ready else 10
+    GUEST = getattr(getattr(apps.get_app_config('plane'), 'ROLE', object()), 'GUEST', 5) if apps.ready else 5
+
+def _mk_user(email=None):
+    User = get_user_model()
+    return User.objects.create_user(
+        username=f"u_{get_random_string(8)}",
+        email=email or f"{get_random_string(6)}@example.com",
+        password="pass1234",
+    )
+
+def _mk_workspace(slug=None, owner=None):
+    if Workspace is None:
+        pytest.skip("Workspace model not available")
+    return Workspace.objects.create(
+        name=f"WS {get_random_string(5)}",
+        slug=slug or f"ws-{get_random_string(6)}",
+        owner=owner or _mk_user(),
+    )
+
+def _mk_project(workspace, name=None, identifier=None, lead=None):
+    return Project.objects.create(
+        name=name or f"Project {get_random_string(5)}",
+        identifier=(identifier or get_random_string(3)).upper(),
+        workspace=workspace,
+        project_lead=lead,
+    )
+
+def _mk_workspace_member(user, workspace, role):
+    if WorkspaceMember is None:
+        pytest.skip("WorkspaceMember model not available")
+    return WorkspaceMember.objects.create(member=user, workspace=workspace, role=role, is_active=True)
+
+def _mk_project_member(user, project, role):
+    if ProjectMember is None:
+        pytest.skip("ProjectMember model not available")
+    return ProjectMember.objects.create(member=user, project=project, role=role, is_active=True)
+
+def _mk_deploy_board(project, workspace, anchor="alpha"):
+    if DeployBoard is None:
+        pytest.skip("DeployBoard model not available")
+    return DeployBoard.objects.create(
+        entity_name="project",
+        entity_identifier=project.id,
+        project=project,
+        workspace=workspace,
+        anchor=anchor,
+    )
+
+def _favorite(user, project, workspace):
+    if UserFavorite is None:
+        pytest.skip("UserFavorite model not available")
+    return UserFavorite.objects.create(
+        user=user, entity_type="project", entity_identifier=project.id, project=project, workspace=workspace
+    )
+
+def _identifier(name, workspace, project=None):
+    if ProjectIdentifier is None:
+        pytest.skip("ProjectIdentifier model not available")
+    return ProjectIdentifier.objects.create(name=name, workspace=workspace, project=project)
+
+@pytest.mark.django_db
+def test_project_list_detail_guest_sees_only_memberships(api_client):
+    user = _mk_user()
+    ws = _mk_workspace(owner=user)
+    _mk_workspace_member(user, ws, role=RoleEnum.GUEST)
+    p1 = _mk_project(ws, name="A")
+    p2 = _mk_project(ws, name="B")
+    _mk_project_member(user, p1, role=RoleEnum.MEMBER)
+    # user is not member of p2
+
+    api_client.force_authenticate(user=user)
+    url = f"/api/workspaces/{ws.slug}/projects/list-detail/"  # replace with reverse if routes available
+    res = api_client.get(url)
+    assert res.status_code in (200, 403, 404), "Endpoint existence and permission should be well-defined"
+    if res.status_code == 200:
+        names = [proj.get("name") for proj in res.json()]
+        assert "A" in names
+        assert "B" not in names
+
+@pytest.mark.django_db
+def test_project_list_member_sees_memberships_or_network(api_client):
+    user = _mk_user()
+    ws = _mk_workspace()
+    _mk_workspace_member(user, ws, role=RoleEnum.MEMBER)
+    p1 = _mk_project(ws, name="M1")
+    p2 = _mk_project(ws, name="M2")
+    _mk_project_member(user, p1, role=RoleEnum.MEMBER)
+
+    api_client.force_authenticate(user=user)
+    url = f"/api/workspaces/{ws.slug}/projects/"
+    res = api_client.get(url)
+    assert res.status_code in (200, 403)
+    if res.status_code == 200:
+        payload = res.json()
+        # list() returns values() projection; ensure contains expected keys
+        assert isinstance(payload, list)
+        first = payload[0] if payload else {}
+        assert "id" in first and "name" in first and "identifier" in first
+
+@pytest.mark.django_db
+def test_project_retrieve_only_active_member_and_not_archived(api_client):
+    user = _mk_user()
+    ws = _mk_workspace()
+    _mk_workspace_member(user, ws, role=RoleEnum.MEMBER)
+    p = _mk_project(ws)
+    _mk_project_member(user, p, role=RoleEnum.MEMBER)
+
+    api_client.force_authenticate(user=user)
+    url = f"/api/workspaces/{ws.slug}/projects/{p.id}/"
+    res = api_client.get(url)
+    assert res.status_code in (200, 404)
+    if res.status_code == 200:
+        body = res.json()
+        assert body.get("id") == p.id
+
+@pytest.mark.django_db
+def test_project_create_adds_members_and_default_states(api_client):
+    user = _mk_user()
+    ws = _mk_workspace(owner=user)
+    _mk_workspace_member(user, ws, role=RoleEnum.ADMIN)
+
+    api_client.force_authenticate(user=user)
+    url = f"/api/workspaces/{ws.slug}/projects/"
+    payload = {"name": "Created Project", "identifier": "CXP"}
+    res = api_client.post(url, data=payload, format="json")
+    assert res.status_code in (201, 400, 403)
+    if res.status_code == 201:
+        data = res.json()
+        # creator should be project admin member; default states should exist
+        assert data.get("name") == "Created Project"
+
+@pytest.mark.django_db
+def test_partial_update_requires_admin(api_client):
+    admin = _mk_user()
+    member = _mk_user()
+    ws = _mk_workspace(owner=admin)
+    _mk_workspace_member(admin, ws, role=RoleEnum.ADMIN)
+    _mk_workspace_member(member, ws, role=RoleEnum.MEMBER)
+    p = _mk_project(ws, name="Before")
+    _mk_project_member(member, p, role=RoleEnum.MEMBER)
+
+    # Member (non-admin) should be forbidden
+    api_client.force_authenticate(user=member)
+    url = f"/api/workspaces/{ws.slug}/projects/{p.id}/"
+    res = api_client.patch(url, data={"name": "After"}, format="json")
+    assert res.status_code in (403, 200)
+    # Admin allowed
+    api_client.force_authenticate(user=admin)
+    res2 = api_client.patch(url, data={"name": "After2", "inbox_view": True}, format="json")
+    assert res2.status_code in (200, 400)
+
+@pytest.mark.django_db
+def test_destroy_deletes_favorites_and_deploy_board(api_client):
+    admin = _mk_user()
+    ws = _mk_workspace(owner=admin)
+    _mk_workspace_member(admin, ws, role=RoleEnum.ADMIN)
+    p = _mk_project(ws)
+    _mk_deploy_board(p, ws)
+    _favorite(admin, p, ws)
+
+    api_client.force_authenticate(user=admin)
+    url = f"/api/workspaces/{ws.slug}/projects/{p.id}/"
+    res = api_client.delete(url)
+    assert res.status_code in (204, 403)
+    if res.status_code == 204 and UserFavorite and DeployBoard:
+        assert not UserFavorite.objects.filter(project_id=p.id, workspace=ws).exists()
+        assert not DeployBoard.objects.filter(project_id=p.id, workspace=ws).exists()
+
+@pytest.mark.django_db
+def test_archive_unarchive_project_and_clear_favorites(api_client):
+    admin = _mk_user()
+    ws = _mk_workspace(owner=admin)
+    _mk_workspace_member(admin, ws, role=RoleEnum.ADMIN)
+    p = _mk_project(ws)
+    _favorite(admin, p, ws)
+
+    api_client.force_authenticate(user=admin)
+    archive_url = f"/api/workspaces/{ws.slug}/projects/{p.id}/archive/"
+    res = api_client.post(archive_url)
+    assert res.status_code in (200, 403)
+    if res.status_code == 200:
+        p.refresh_from_db()
+        assert p.archived_at is not None
+        assert not UserFavorite.objects.filter(project=p).exists()
+        unarchive_url = f"/api/workspaces/{ws.slug}/projects/{p.id}/archive/"
+        res2 = api_client.delete(unarchive_url)
+        assert res2.status_code in (204, 403)
+        if res2.status_code == 204:
+            p.refresh_from_db()
+            assert p.archived_at is None
+
+@pytest.mark.django_db
+def test_identifier_get_requires_name_and_lists_existing(api_client):
+    admin = _mk_user()
+    ws = _mk_workspace(owner=admin)
+    _mk_workspace_member(admin, ws, role=RoleEnum.MEMBER)
+    # Create two identifiers
+    _identifier("ABC", ws)
+    _identifier("XYZ", ws)
+    api_client.force_authenticate(user=admin)
+
+    url = f"/api/workspaces/{ws.slug}/projects/identifiers/?name=abc"
+    res = api_client.get(url)
+    assert res.status_code in (200, 400, 403)
+    if res.status_code == 200:
+        data = res.json()
+        assert "exists" in data and "identifiers" in data
+        assert data["exists"] >= 1
+
+    # Missing name
+    res2 = api_client.get(f"/api/workspaces/{ws.slug}/projects/identifiers/")
+    assert res2.status_code in (400, 403)
+
+@pytest.mark.django_db
+def test_identifier_delete_errors_when_project_exists(api_client):
+    admin = _mk_user()
+    ws = _mk_workspace(owner=admin)
+    _mk_workspace_member(admin, ws, role=RoleEnum.MEMBER)
+    p = _mk_project(ws, identifier="QQQ")
+    _identifier("QQQ", ws, project=p)
+
+    api_client.force_authenticate(user=admin)
+    url = f"/api/workspaces/{ws.slug}/projects/identifiers/"
+    # Cannot delete identifier that's bound to existing project
+    res = api_client.delete(url, data={"name": "QQQ"}, format="json")
+    assert res.status_code in (400, 403)
+    # Upper/lower and trimming validated by view:
+    res2 = api_client.delete(url, data={"name": "  qqq  "}, format="json")
+    assert res2.status_code in (400, 403)
+
+@pytest.mark.django_db
+def test_project_user_views_endpoint_updates_member_prefs(api_client):
+    user = _mk_user()
+    ws = _mk_workspace(owner=user)
+    _mk_workspace_member(user, ws, role=RoleEnum.MEMBER)
+    p = _mk_project(ws)
+    pm = _mk_project_member(user, p, role=RoleEnum.MEMBER)
+
+    api_client.force_authenticate(user=user)
+    url = f"/api/workspaces/{ws.slug}/projects/{p.id}/user-views/"
+    payload = {
+        "view_props": {"a": 1},
+        "default_props": {"b": 2},
+        "preferences": {"c": 3},
+        "sort_order": 7,
+    }
+    res = api_client.post(url, data=payload, format="json")
+    assert res.status_code in (204, 403)
+    if res.status_code == 204:
+        pm.refresh_from_db()
+        assert pm.view_props == {"a": 1}
+        assert pm.default_props == {"b": 2}
+        assert pm.preferences == {"c": 3}
+        assert pm.sort_order == 7
+
+@pytest.mark.django_db
+def test_project_user_views_endpoint_forbidden_if_not_project_member(api_client):
+    user = _mk_user()
+    ws = _mk_workspace(owner=user)
+    _mk_workspace_member(user, ws, role=RoleEnum.MEMBER)
+    p = _mk_project(ws)
+
+    api_client.force_authenticate(user=user)
+    url = f"/api/workspaces/{ws.slug}/projects/{p.id}/user-views/"
+    res = api_client.post(url, data={"view_props": {}}, format="json")
+    assert res.status_code in (403, 404)
+
+@pytest.mark.django_db
+def test_project_favorites_create_and_destroy(api_client):
+    user = _mk_user()
+    ws = _mk_workspace(owner=user)
+    _mk_workspace_member(user, ws, role=RoleEnum.MEMBER)
+    p = _mk_project(ws)
+
+    api_client.force_authenticate(user=user)
+    create_url = f"/api/workspaces/{ws.slug}/projects/{p.id}/favorites/"
+    res = api_client.post(create_url, data={"project": p.id}, format="json")
+    assert res.status_code in (204, 403)
+    if res.status_code == 204:
+        assert UserFavorite.objects.filter(user=user, project=p).exists()
+        del_url = f"/api/workspaces/{ws.slug}/projects/{p.id}/favorites/"
+        res2 = api_client.delete(del_url)
+        assert res2.status_code in (204, 403)
+        if res2.status_code == 204:
+            assert not UserFavorite.objects.filter(user=user, project=p).exists()
+
+@pytest.mark.django_db
+def test_public_cover_images_endpoint_handles_s3_errors(api_client, monkeypatch):
+    # This endpoint is public (AllowAny) and cached; we ensure error path returns []
+    class FakeS3:
+        def list_objects_v2(self, **kwargs):
+            raise Exception("S3 failure")
+
+    import builtins
+    import types
+
+    # Monkeypatch boto3.client to return FakeS3
+    import boto3
+    def fake_client(*args, **kwargs):
+        return FakeS3()
+    monkeypatch.setattr(boto3, "client", fake_client)
+
+    url = "/api/public/project-cover-images/"
+    res = api_client.get(url)
+    # Should be OK 200 with empty list on exception path
+    assert res.status_code == 200
+    assert res.json() == []
+
+@pytest.mark.django_db
+def test_deploy_board_create_and_list(api_client):
+    user = _mk_user()
+    ws = _mk_workspace(owner=user)
+    _mk_workspace_member(user, ws, role=RoleEnum.MEMBER)
+    p = _mk_project(ws)
+    _mk_project_member(user, p, role=RoleEnum.MEMBER)
+
+    api_client.force_authenticate(user=user)
+    create_url = f"/api/workspaces/{ws.slug}/projects/{p.id}/deploy-board/"
+    payload = {
+        "is_comments_enabled": True,
+        "is_reactions_enabled": True,
+        "is_votes_enabled": True,
+        "views": {"list": True, "kanban": True, "calendar": False, "gantt": False, "spreadsheet": True},
+    }
+    res = api_client.post(create_url, data=payload, format="json")
+    assert res.status_code in (200, 403)
+    if res.status_code == 200:
+        data = res.json()
+        assert data.get("is_comments_enabled") is True
+        assert data.get("is_reactions_enabled") is True
+        assert data.get("is_votes_enabled") is True
+
+        # List should return the same board
+        list_url = f"/api/workspaces/{ws.slug}/projects/{p.id}/deploy-board/"
+        res2 = api_client.get(list_url)
+        assert res2.status_code in (200, 403)
+        if res2.status_code == 200:
+            data2 = res2.json()
+            assert data2.get("project") == data.get("project")
\ No newline at end of file