chore(repo): fix local docker dev

.github/workflows/build-branch.yml

@@ -139,7 +139,8 @@ jobs:
   branch_build_push_admin:
     name: Build-Push Admin Docker Image
     runs-on: ubuntu-22.04
-    needs: [branch_build_setup]
+    needs:
+      - branch_build_setup
     steps:
       - name: Admin Build and Push
         uses: makeplane/actions/build-push@v1.0.0
@@ -152,7 +153,9 @@ jobs:
           docker-image-owner: makeplane
           docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_admin }}
           build-context: .
-          dockerfile-path: ./apps/admin/Dockerfile.admin
+          dockerfile-path: ./Dockerfile.node
+          build-args: |
+            APP_SCOPE=admin
           buildx-driver: ${{ needs.branch_build_setup.outputs.gh_buildx_driver }}
           buildx-version: ${{ needs.branch_build_setup.outputs.gh_buildx_version }}
           buildx-platforms: ${{ needs.branch_build_setup.outputs.gh_buildx_platforms }}
@@ -161,7 +164,8 @@ jobs:
   branch_build_push_web:
     name: Build-Push Web Docker Image
     runs-on: ubuntu-22.04
-    needs: [branch_build_setup]
+    needs:
+      - branch_build_setup
     steps:
       - name: Web Build and Push
         uses: makeplane/actions/build-push@v1.0.0
@@ -174,7 +178,9 @@ jobs:
           docker-image-owner: makeplane
           docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_web }}
           build-context: .
-          dockerfile-path: ./apps/web/Dockerfile.web
+          dockerfile-path: ./Dockerfile.node
+          build-args: |
+            APP_SCOPE=web
           buildx-driver: ${{ needs.branch_build_setup.outputs.gh_buildx_driver }}
           buildx-version: ${{ needs.branch_build_setup.outputs.gh_buildx_version }}
           buildx-platforms: ${{ needs.branch_build_setup.outputs.gh_buildx_platforms }}
@@ -183,7 +189,8 @@ jobs:
   branch_build_push_space:
     name: Build-Push Space Docker Image
     runs-on: ubuntu-22.04
-    needs: [branch_build_setup]
+    needs:
+      - branch_build_setup
     steps:
       - name: Space Build and Push
         uses: makeplane/actions/build-push@v1.0.0
@@ -196,7 +203,9 @@ jobs:
           docker-image-owner: makeplane
           docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_space }}
           build-context: .
-          dockerfile-path: ./apps/space/Dockerfile.space
+          dockerfile-path: ./Dockerfile.node
+          build-args: |
+            APP_SCOPE=space
           buildx-driver: ${{ needs.branch_build_setup.outputs.gh_buildx_driver }}
           buildx-version: ${{ needs.branch_build_setup.outputs.gh_buildx_version }}
           buildx-platforms: ${{ needs.branch_build_setup.outputs.gh_buildx_platforms }}
@@ -205,7 +214,8 @@ jobs:
   branch_build_push_live:
     name: Build-Push Live Collaboration Docker Image
     runs-on: ubuntu-22.04
-    needs: [branch_build_setup]
+    needs:
+      - branch_build_setup
     steps:
       - name: Live Build and Push
         uses: makeplane/actions/build-push@v1.0.0
@@ -227,7 +237,8 @@ jobs:
   branch_build_push_api:
     name: Build-Push API Server Docker Image
     runs-on: ubuntu-22.04
-    needs: [branch_build_setup]
+    needs:
+      - branch_build_setup
     steps:
       - name: Backend Build and Push
         uses: makeplane/actions/build-push@v1.0.0
@@ -239,8 +250,8 @@ jobs:
           dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
           docker-image-owner: makeplane
           docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_backend }}
-          build-context: ./apps/api
-          dockerfile-path: ./apps/api/Dockerfile.api
+          build-context: .
+          dockerfile-path: ./Dockerfile.api
           buildx-driver: ${{ needs.branch_build_setup.outputs.gh_buildx_driver }}
           buildx-version: ${{ needs.branch_build_setup.outputs.gh_buildx_version }}
           buildx-platforms: ${{ needs.branch_build_setup.outputs.gh_buildx_platforms }}
@@ -249,7 +260,8 @@ jobs:
   branch_build_push_proxy:
     name: Build-Push Proxy Docker Image
     runs-on: ubuntu-22.04
-    needs: [branch_build_setup]
+    needs:
+      - branch_build_setup
     steps:
       - name: Proxy Build and Push
         uses: makeplane/actions/build-push@v1.0.0
@@ -368,15 +380,13 @@ jobs:
     name: Build Release
     runs-on: ubuntu-22.04
     needs:
-      [
-        branch_build_setup,
-        branch_build_push_admin,
-        branch_build_push_web,
-        branch_build_push_space,
-        branch_build_push_live,
-        branch_build_push_api,
-        branch_build_push_proxy,
-      ]
+      - branch_build_setup
+      - branch_build_push_admin
+      - branch_build_push_web
+      - branch_build_push_space
+      - branch_build_push_live
+      - branch_build_push_api
+      - branch_build_push_proxy
     env:
       REL_VERSION: ${{ needs.branch_build_setup.outputs.release_version }}
     steps:

.github/workflows/check-version.yml

@@ -17,6 +17,8 @@ jobs:
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
+        with:
+          node-version: '18'
 
       - name: Get PR Branch version
         run: echo "PR_VERSION=$(node -p "require('./package.json').version")" >> $GITHUB_ENV

.github/workflows/codeql.yml

@@ -3,9 +3,11 @@ name: "CodeQL"
 on:
   workflow_dispatch:
   push:
-    branches: ["preview", "canary", "master"]
+    branches: ["preview", "master"]
   pull_request:
-    branches: ["preview", "canary", "master"]
+    branches: ["develop", "preview", "master"]
+  schedule:
+    - cron: "53 19 * * 5"
 
 jobs:
   analyze:

.github/workflows/docker-smoke-aio.yml

@@ -0,0 +1,121 @@
+name: Docker AIO build and smoke test
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - "preview"
+    paths:
+      - "apps/web/**"
+      - "apps/space/**"
+      - "apps/admin/**"
+      - "apps/live/**"
+      - "packages/**"
+      - "turbo.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "Dockerfile.node"
+      - "Dockerfile.api"
+      - "Dockerfile.aio"
+      - "docker-bake.hcl"
+      - ".github/workflows/docker-smoke-aio.yml"
+  push:
+    branches:
+      - "preview"
+    paths:
+      - "apps/web/**"
+      - "apps/space/**"
+      - "apps/admin/**"
+      - "apps/live/**"
+      - "packages/**"
+      - "turbo.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "Dockerfile.node"
+      - "Dockerfile.api"
+      - "Dockerfile.aio"
+      - "docker-bake.hcl"
+      - ".github/workflows/docker-smoke-aio.yml"
+
+concurrency:
+  group: aio-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  determine-aio:
+    name: Determine if AIO needed
+    runs-on: ubuntu-latest
+    outputs:
+      aio_needed: ${{ steps.build-flag.outputs.aio_needed }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Detect changed paths
+        id: changes
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            web:
+              - 'apps/web/**'
+            space:
+              - 'apps/space/**'
+            admin:
+              - 'apps/admin/**'
+            live:
+              - 'apps/live/**'
+            common:
+              - 'packages/**'
+              - 'turbo.json'
+              - 'pnpm-lock.yaml'
+              - 'pnpm-workspace.yaml'
+              - 'Dockerfile.node'
+              - 'Dockerfile.api'
+              - 'Dockerfile.aio'
+              - 'docker-bake.hcl'
+              - '.github/workflows/docker-smoke-aio.yml'
+
+      - name: Compute AIO flag
+        id: build-flag
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const anyCommon = '${{ steps.changes.outputs.common }}' === 'true';
+            const changedWeb = '${{ steps.changes.outputs.web }}' === 'true';
+            const changedSpace = '${{ steps.changes.outputs.space }}' === 'true';
+            const changedAdmin = '${{ steps.changes.outputs.admin }}' === 'true';
+            const changedLive = '${{ steps.changes.outputs.live }}' === 'true';
+            const aioNeeded = anyCommon || changedWeb || changedSpace || changedAdmin || changedLive;
+            core.setOutput('aio_needed', String(aioNeeded));
+
+  aio_smoke:
+    name: Build and smoke test AIO
+    runs-on: ubuntu-latest
+    needs: determine-aio
+    if: ${{ needs.determine-aio.outputs.aio_needed == 'true' }}
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Show Docker version
+        run: |
+          docker version
+          docker info
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build AIO image with bake (load into local daemon)
+        run: |
+          docker buildx bake -f "./docker-bake.hcl" --load aio
+
+      - name: Run AIO smoke script
+        run: |
+          chmod +x "scripts/smoke-aio.sh"
+          "scripts/smoke-aio.sh"

.github/workflows/docker-smoke.yml

@@ -0,0 +1,171 @@
+name: Docker build and smoke test for apps
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - "preview"
+    paths:
+      - "apps/web/**"
+      - "apps/space/**"
+      - "apps/admin/**"
+      - "apps/live/**"
+      - "packages/**"
+      - "turbo.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "Dockerfile.node"
+      - "Dockerfile.api"
+      - "Dockerfile.aio"
+      - "docker-bake.hcl"
+
+      - ".github/workflows/docker-smoke.yml"
+  push:
+    branches:
+      - "preview"
+    paths:
+      - "apps/web/**"
+      - "apps/space/**"
+      - "apps/admin/**"
+      - "apps/live/**"
+      - "packages/**"
+      - "turbo.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "Dockerfile.node"
+      - "Dockerfile.api"
+      - "Dockerfile.aio"
+      - "docker-bake.hcl"
+
+      - ".github/workflows/docker-smoke.yml"
+
+jobs:
+  determine-matrix:
+    name: Determine matrix
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.build-matrix.outputs.matrix }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Detect changed paths
+        id: changes
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            web:
+              - 'apps/web/**'
+            space:
+              - 'apps/space/**'
+            admin:
+              - 'apps/admin/**'
+            live:
+              - 'apps/live/**'
+            common:
+              - 'packages/**'
+              - 'turbo.json'
+              - 'pnpm-lock.yaml'
+              - 'pnpm-workspace.yaml'
+              - 'Dockerfile.node'
+              - 'Dockerfile.api'
+              - 'Dockerfile.aio'
+              - 'docker-bake.hcl'
+              - '.github/workflows/docker-smoke.yml'
+
+      - name: Build matrix
+        id: build-matrix
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const include = [];
+            const anyCommon = '${{ steps.changes.outputs.common }}' === 'true';
+            const changed = {
+              web:   '${{ steps.changes.outputs.web }}'   === 'true',
+              space: '${{ steps.changes.outputs.space }}' === 'true',
+              admin: '${{ steps.changes.outputs.admin }}' === 'true',
+              live:  '${{ steps.changes.outputs.live }}'  === 'true',
+            };
+            const add = (name, bake_target, image, container, port, path, env_flags = "") =>
+              include.push({ name, bake_target, image, container, host_port: port, path, env_flags });
+
+            const buildAll = anyCommon || changed.web || changed.space || changed.admin || changed.live;
+            if (buildAll || changed.web)   add('web',   'web',   'plane-web:ci-smoke',   'plane-web-ci',   3001, '/');
+            if (buildAll || changed.space) add('space', 'space', 'plane-space:ci-smoke', 'plane-space-ci', 3002, '/spaces');
+            if (buildAll || changed.admin) add('admin', 'admin', 'plane-admin:ci-smoke', 'plane-admin-ci', 3003, '/god-mode');
+            if (buildAll || changed.live)  add('live',  'live',  'plane-live:ci-smoke',  'plane-live-ci',  3005, '/live/health', '-e NODE_ENV=production -e LIVE_BASE_PATH=/live');
+
+            if (include.length === 0) {
+              // Default to web to keep job non-empty
+              add('web', 'web', 'plane-web:ci-smoke', 'plane-web-ci', 3001, '/');
+            }
+            core.setOutput('matrix', JSON.stringify({ include }));
+
+  smoke:
+    name: Build and smoke test ${{ matrix.name }}
+    runs-on: ubuntu-latest
+    needs: determine-matrix
+    timeout-minutes: 25
+
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.determine-matrix.outputs.matrix) }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Prepare build environment
+        run: echo "Using docker build (no buildx bake)"
+
+      - name: Show Docker version
+        run: |
+          docker version
+          docker info
+
+      - name: Build image (${{ matrix.name }})
+        shell: bash
+        run: |
+          set -euo pipefail
+          name="${{ matrix.name }}"
+          tag="${{ matrix.image }}"
+          if [ "$name" = "live" ]; then
+            docker build -f "apps/live/Dockerfile.live" -t "$tag" "."
+          else
+            docker build -f "Dockerfile.node" --target runtime --build-arg APP_SCOPE="$name" -t "$tag" "."
+          fi
+
+      - name: Run container (${{ matrix.name }})
+        run: |
+          docker run -d --name ${{ matrix.container }} -p ${{ matrix.host_port }}:3000 ${{ matrix.env_flags }} ${{ matrix.image }}
+          docker ps -a
+
+      - name: Smoke test HTTP endpoint (${{ matrix.name }})
+        shell: bash
+        run: |
+          set -euo pipefail
+          URL="http://localhost:${{ matrix.host_port }}${{ matrix.path }}"
+          echo "Probing $URL ..."
+          for i in {1..60}; do
+            STATUS="$(curl -sS -o /dev/null -w "%{http_code}" -L "${URL}" || true)"
+            if [ "${STATUS}" = "200" ]; then
+              echo "Success: HTTP ${STATUS} from ${URL}"
+              exit 0
+            fi
+            echo "Attempt ${i}: HTTP ${STATUS} (waiting 2s)"
+            sleep 2
+          done
+          echo "Failed to get HTTP 200 from ${URL}"
+          echo "::group::Container logs (${{ matrix.container }})"
+          docker logs ${{ matrix.container }} || true
+          echo "::endgroup::"
+          exit 1
+
+      - name: Cleanup container (${{ matrix.name }})
+        if: always()
+        run: |
+          docker rm -f ${{ matrix.container }} || true

.github/workflows/pull-request-build-lint-web-apps.yml

@@ -36,6 +36,8 @@ jobs:
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
 
       - name: Enable Corepack and pnpm
         run: corepack enable pnpm

.npmrc

@@ -14,7 +14,7 @@ strict-peer-dependencies=false
 # Turbo occasionally performs postinstall tasks for optimal performance
 # moved to pnpm-workspace.yaml: onlyBuiltDependencies (e.g., allow turbo)
 
-public-hoist-pattern[]=*eslint*
+public-hoist-pattern[]=eslint
 public-hoist-pattern[]=prettier
 public-hoist-pattern[]=typescript
 

.nvmrc

@@ -0,0 +1 @@
+lts/jod

Dockerfile.aio

@@ -0,0 +1,120 @@
+# syntax=docker/dockerfile:1.7
+#
+# All-in-one assembler image that composes Plane runtime from per-app images
+# and the community supervisor/Caddy configuration.
+#
+# Build requirements:
+#  - Build and tag the per-app images first (or override args below):
+#      plane-web:latest, plane-space:latest, plane-admin:latest, plane-live:latest,
+#      plane-api:latest, plane-proxy:latest
+#
+# Example:
+#   docker build \
+#     -f plane/Dockerfile.aio \
+#     --build-arg WEB_IMG=plane-web:latest \
+#     --build-arg SPACE_IMG=plane-space:latest \
+#     --build-arg ADMIN_IMG=plane-admin:latest \
+#     --build-arg LIVE_IMG=plane-live:latest \
+#     --build-arg API_IMG=plane-api:latest \
+#     --build-arg PROXY_IMG=plane-proxy:latest \
+#     -t plane-aio:latest .
+#
+# Run:
+#   docker run --rm -it -p 80:80 plane-aio:latest
+#
+# Provide required env vars; see deployments/aio/community/README.md.
+
+# ------------------------------------------------------------------------------
+# Arguments to reference locally-built component images
+# ------------------------------------------------------------------------------
+# Build contexts are used for component images:
+#   --build-context web_ctx=target:web
+#   --build-context space_ctx=target:space
+#   --build-context admin_ctx=target:admin
+#   --build-context live_ctx=target:live
+#   --build-context api_ctx=target:api
+#   --build-context proxy_ctx=target:proxy
+ARG NODE_VERSION=22-alpine
+ARG PY_VERSION=3.12.10-alpine
+
+# ------------------------------------------------------------------------------
+# Source stages: pull artifacts from pre-built images
+# ------------------------------------------------------------------------------
+FROM node:${NODE_VERSION} AS node
+
+# ------------------------------------------------------------------------------
+# Final runner: Python as base (Supervisor + API deps live here)
+# ------------------------------------------------------------------------------
+FROM python:${PY_VERSION} AS runner
+
+WORKDIR /app
+
+# Base system libs for API/Caddy/Node runtime
+RUN apk add --no-cache \
+    libpq \
+    libxslt \
+    xmlsec \
+    nss-tools \
+    bash \
+    curl \
+    ca-certificates \
+    openssl
+
+# Install supervisor
+RUN pip install --no-cache-dir supervisor && mkdir -p /etc/supervisor/conf.d
+
+# Copy Node runtime into the AIO container for Next standalone apps
+COPY --from=node /usr/lib /usr/lib
+COPY --from=node /usr/local/lib /usr/local/lib
+COPY --from=node /usr/local/include /usr/local/include
+COPY --from=node /usr/local/bin /usr/local/bin
+
+# Copy Next.js standalone app artifacts (namespaced under /app/<app>)
+COPY --from=web_ctx   /app /app/web
+COPY --from=space_ctx /app /app/space
+COPY --from=admin_ctx /app /app/admin
+COPY --from=live_ctx  /app /app/live
+
+# Clean potential Next caches (optional)
+RUN rm -rf /app/web/apps/web/.next/cache || true \
+    && rm -rf /app/space/apps/space/.next/cache || true \
+    && rm -rf /app/admin/apps/admin/.next/cache || true
+
+# Copy Python backend code and installed packages/binaries
+COPY --from=api_ctx /code /app/backend
+# Match CPython version path (PY_VERSION=3.12.x-alpine)
+COPY --from=api_ctx /usr/local/lib/python3.12/site-packages/ /usr/local/lib/python3.12/site-packages/
+COPY --from=api_ctx /usr/local/bin/ /usr/local/bin/
+
+# Caddy binary from proxy image
+COPY --from=proxy_ctx /usr/bin/caddy /usr/bin/caddy
+
+# Community supervisor config and startup script
+COPY deployments/aio/community/start.sh /app/start.sh
+COPY deployments/aio/community/supervisor.conf /etc/supervisor/conf.d/supervisor.conf
+
+# Provide a default plane.env from variables template; start.sh will update it
+COPY deployments/aio/community/variables.env /app/plane.env
+
+# Prepare Caddy configuration:
+# - Start from the repository Caddyfile.ce
+# - Update upstreams to localhost-bound ports managed by supervisor
+RUN mkdir -p /app/proxy
+COPY apps/proxy/Caddyfile.ce /app/proxy/Caddyfile
+RUN set -eux; \
+    sed -i 's|web:3000|localhost:3001|g'    /app/proxy/Caddyfile; \
+    sed -i 's|space:3000|localhost:3002|g'  /app/proxy/Caddyfile; \
+    sed -i 's|admin:3000|localhost:3003|g'  /app/proxy/Caddyfile; \
+    sed -i 's|api:8000|localhost:3004|g'    /app/proxy/Caddyfile; \
+    sed -i 's|live:3000|localhost:3005|g'   /app/proxy/Caddyfile; \
+    sed -i '/plane-minio:9000/d'            /app/proxy/Caddyfile
+
+# Folders and permissions
+RUN mkdir -p /app/logs/access /app/logs/error /app/data \
+    && chmod +x /app/start.sh
+
+VOLUME ["/app/data", "/app/logs"]
+
+EXPOSE 80 443
+
+CMD ["/app/start.sh"]

Dockerfile.api

@@ -0,0 +1,151 @@
+# syntax=docker/dockerfile:1.7
+#
+# Unified multi-stage Dockerfile for the Python API
+# Targets:
+#   - dev:      local development with hot reload and full build toolchain
+#   - runtime:  production runtime using prebuilt wheels
+#
+# Example builds (from repo root):
+#   docker build -f plane/Dockerfile.api --target dev -t plane-api:dev .
+#   docker build -f plane/Dockerfile.api --target runtime -t plane-api:latest .
+
+ARG PY_VERSION=python:3.12.10-alpine
+
+# -----------------------------------------------------------------------------
+# base: common runtime base (no build toolchain)
+# -----------------------------------------------------------------------------
+FROM ${PY_VERSION} AS base
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    INSTANCE_CHANGELOG_URL=https://sites.plane.so/pages/691ef037bcfe416a902e48cb55f59891/
+
+# Runtime libraries required by the app
+RUN apk add --no-cache \
+    libpq \
+    libxslt \
+    xmlsec \
+    ca-certificates \
+    openssl
+
+WORKDIR /code
+
+# -----------------------------------------------------------------------------
+# builder: build Python wheels for all dependencies
+# -----------------------------------------------------------------------------
+FROM ${PY_VERSION} AS builder
+
+# Full build toolchain to compile deps to wheels
+RUN apk add --no-cache \
+    bash~=5.2 \
+    g++ \
+    gcc \
+    cargo \
+    git \
+    make \
+    postgresql-dev \
+    libc-dev \
+    linux-headers \
+    libffi-dev \
+    libxml2-dev \
+    libxslt-dev \
+    openssl-dev \
+    xmlsec-dev
+
+WORKDIR /w
+
+# Copy requirements (relative to repo root)
+COPY apps/api/requirements.txt /w/requirements.txt
+COPY apps/api/requirements /w/requirements
+
+# Build wheels into /wheels to reuse in runtime
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip wheel -r /w/requirements.txt --wheel-dir /wheels
+
+# -----------------------------------------------------------------------------
+# dev: local development image (bind mount source into /code)
+# -----------------------------------------------------------------------------
+FROM ${PY_VERSION} AS dev
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    INSTANCE_CHANGELOG_URL=https://sites.plane.so/pages/691ef037bcfe416a902e48cb55f59891/
+
+# Match prior dev environment: runtime + build deps + node
+RUN apk add --no-cache \
+    libpq \
+    libxslt \
+    xmlsec \
+    nodejs-current \
+    bash~=5.2 \
+    g++ \
+    gcc \
+    cargo \
+    git \
+    make \
+    postgresql-dev \
+    libc-dev \
+    linux-headers \
+    libffi-dev
+
+WORKDIR /code
+
+# Copy and install local dev requirements
+COPY apps/api/requirements.txt ./requirements.txt
+COPY apps/api/requirements ./requirements
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install -r requirements/local.txt --no-cache-dir
+
+# Bring in the API source
+COPY apps/api/ ./
+
+# Permissions similar to existing Dockerfiles
+RUN mkdir -p /code/plane/logs \
+ && chmod -R +x /code/bin \
+ && chmod -R 777 /code
+
+EXPOSE 8000
+CMD ["./bin/docker-entrypoint-api-local.sh"]
+
+# -----------------------------------------------------------------------------
+# runtime: production image using wheels from builder
+# -----------------------------------------------------------------------------
+FROM base AS runtime
+
+# Bash needed for entrypoint scripts
+RUN apk add --no-cache bash~=5.2
+
+WORKDIR /code
+
+# Install from wheels for reproducible, fast builds
+COPY --from=builder /wheels /wheels
+COPY apps/api/requirements.txt ./requirements.txt
+COPY apps/api/requirements ./requirements
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install --no-cache-dir --no-index --find-links=/wheels -r requirements.txt
+
+# Copy only what is required to run
+COPY apps/api/manage.py ./manage.py
+COPY apps/api/plane ./plane
+COPY apps/api/templates ./templates
+COPY apps/api/package.json ./package.json
+COPY apps/api/bin ./bin
+
+# Create unprivileged user and set secure permissions
+RUN addgroup -S plane && adduser -S -G plane -h /code -s /sbin/nologin plane \
+ && chmod +x ./bin/* \
+ && mkdir -p /code/plane/logs \
+ && chown -R plane:plane /code \
+ && chmod -R 755 /code \
+ && chmod 775 /code/plane/logs
+
+ENV GUNICORN_WORKERS=3 \
+    PORT=8000
+
+USER plane
+EXPOSE 8000
+
+# Default: API server; override command for worker/beat/migrator as needed
+CMD ["./bin/docker-entrypoint-api.sh"]

Dockerfile.node

@@ -0,0 +1,138 @@
+# syntax=docker/dockerfile:1.7
+#
+# Unified multi-stage Dockerfile for Next.js apps in this monorepo.
+# Supports:
+#  - target=dev     (hot-reload, expects bind-mounted repo)
+#  - target=runtime (production image using Next.js standalone output)
+#
+# Usage examples:
+#  - Build dev image for web:    docker build --target dev --build-arg APP_SCOPE=web -t plane-web:dev .
+#  - Run dev (with compose):     mount the repo into /repo and override command/ports as needed
+#  - Build prod image for web:   docker build --target runtime --build-arg APP_SCOPE=web -t plane-web:latest .
+#
+# APP_SCOPE must be one of: web, space, admin
+
+ARG NODE_VERSION=22-alpine
+ARG TURBO_VERSION=2.5.6
+
+# -----------------------------------------------------------------------------
+# Base: Node + pnpm (corepack)
+# -----------------------------------------------------------------------------
+FROM node:${NODE_VERSION} AS base
+
+ENV PNPM_HOME=/pnpm
+ENV PATH=$PNPM_HOME:$PATH
+RUN corepack enable && apk add --no-cache libc6-compat
+
+# -----------------------------------------------------------------------------
+# builder: prune workspace using turbo for the selected app scope
+# -----------------------------------------------------------------------------
+FROM base AS builder
+ARG APP_SCOPE
+WORKDIR /repo
+
+# Full context is required for turbo prune
+COPY . .
+RUN pnpm add -g turbo@${TURBO_VERSION}
+RUN turbo prune --scope=${APP_SCOPE} --docker
+
+# -----------------------------------------------------------------------------
+# installer: install deps (offline) and build the selected scope
+# -----------------------------------------------------------------------------
+FROM base AS installer
+WORKDIR /repo
+
+# Seed minimal files for reproducible installs and good caching
+COPY .gitignore .gitignore
+COPY --from=builder /repo/out/json/ .
+COPY --from=builder /repo/out/pnpm-lock.yaml ./pnpm-lock.yaml
+
+# Fetch dependencies into a cached store layer
+RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
+    pnpm fetch --store-dir=/pnpm/store
+
+# Bring in only the pruned workspace for fast installs/builds
+COPY --from=builder /repo/out/full/ .
+COPY turbo.json turbo.json
+
+# Offline, frozen lockfile install from cached store
+RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
+    pnpm install --offline --frozen-lockfile --store-dir=/pnpm/store
+
+# Build-time environment (safe to pass through; only NEXT_PUBLIC_* are embedded)
+# Keep parity with existing app Dockerfiles
+ARG NEXT_PUBLIC_API_BASE_URL=""
+ENV NEXT_PUBLIC_API_BASE_URL=$NEXT_PUBLIC_API_BASE_URL
+
+ARG NEXT_PUBLIC_ADMIN_BASE_URL=""
+ENV NEXT_PUBLIC_ADMIN_BASE_URL=$NEXT_PUBLIC_ADMIN_BASE_URL
+
+ARG NEXT_PUBLIC_ADMIN_BASE_PATH="/god-mode"
+ENV NEXT_PUBLIC_ADMIN_BASE_PATH=$NEXT_PUBLIC_ADMIN_BASE_PATH
+
+ARG NEXT_PUBLIC_SPACE_BASE_URL=""
+ENV NEXT_PUBLIC_SPACE_BASE_URL=$NEXT_PUBLIC_SPACE_BASE_URL
+
+ARG NEXT_PUBLIC_SPACE_BASE_PATH="/spaces"
+ENV NEXT_PUBLIC_SPACE_BASE_PATH=$NEXT_PUBLIC_SPACE_BASE_PATH
+
+ARG NEXT_PUBLIC_WEB_BASE_URL=""
+ENV NEXT_PUBLIC_WEB_BASE_URL=$NEXT_PUBLIC_WEB_BASE_URL
+
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV TURBO_TELEMETRY_DISABLED=1
+
+# Build only the selected scope
+ARG APP_SCOPE
+RUN pnpm turbo run build --filter=${APP_SCOPE}
+
+# -----------------------------------------------------------------------------
+# dev: for local development with hot reload (bind-mount the repo to /repo)
+# -----------------------------------------------------------------------------
+FROM base AS dev
+WORKDIR /repo
+
+# Helpful global tool for selective builds/dev
+RUN pnpm add -g turbo@${TURBO_VERSION}
+
+ENV NODE_ENV=development \
+    NEXT_TELEMETRY_DISABLED=1 \
+    TURBO_TELEMETRY_DISABLED=1
+
+# Select which app to run in dev (web|space|admin)
+ARG APP_SCOPE
+ENV APP_SCOPE=${APP_SCOPE}
+
+EXPOSE 3000
+# Expect the source to be bind-mounted; install deps and start dev server
+CMD ["sh", "-lc", "pnpm install && pnpm dev --filter=${APP_SCOPE}"]
+
+# -----------------------------------------------------------------------------
+# runtime: minimal Next.js standalone runner for the selected scope
+# -----------------------------------------------------------------------------
+FROM node:${NODE_VERSION} AS runtime
+WORKDIR /app
+
+ENV NODE_ENV=production \
+    NEXT_TELEMETRY_DISABLED=1 \
+    TURBO_TELEMETRY_DISABLED=1 \
+    HOSTNAME=0.0.0.0 \
+    PORT=3000
+
+# Drop privileges
+RUN addgroup -S -g 1001 nodejs \
+ && adduser -S -u 1001 -G nodejs -h /home/nextjs -D nextjs \
+ && mkdir -p /home/nextjs \
+ && chown -R nextjs:nodejs /home/nextjs
+USER nextjs
+
+# Copy only the built output for the selected scope
+ARG APP_SCOPE
+ENV APP_SCOPE=${APP_SCOPE}
+# Next.js standalone layout
+COPY --from=installer /repo/apps/${APP_SCOPE}/.next/standalone ./
+COPY --from=installer /repo/apps/${APP_SCOPE}/.next/static ./apps/${APP_SCOPE}/.next/static
+COPY --from=installer /repo/apps/${APP_SCOPE}/public ./apps/${APP_SCOPE}/public
+
+EXPOSE 3000
+CMD ["sh", "-lc", "set -e; : \"${APP_SCOPE:?APP_SCOPE env is required}\"; SERVER=\"apps/${APP_SCOPE}/server.js\"; if [ ! -f \"$SERVER\" ]; then echo \"Error: $SERVER not found.\"; ls -la \"apps/${APP_SCOPE}\" || true; echo \"Known apps:\"; ls -1 apps || true; exit 1; fi; exec node \"$SERVER\""]

apps/admin/.eslintignore

@@ -1,12 +0,0 @@
-.next/*
-out/*
-public/*
-dist/*
-node_modules/*
-.turbo/*
-.env*
-.env
-.env.local
-.env.development
-.env.production
-.env.test

apps/admin/.eslintrc.js

@@ -1,4 +1,5 @@
 module.exports = {
   root: true,
   extends: ["@plane/eslint-config/next.js"],
+  parser: "@typescript-eslint/parser",
 };

apps/admin/Dockerfile.admin

@@ -1,103 +0,0 @@
-# syntax=docker/dockerfile:1.7
-FROM node:22-alpine AS base
-
-# Setup pnpm package manager with corepack and configure global bin directory for caching
-ENV PNPM_HOME="/pnpm"
-ENV PATH="$PNPM_HOME:$PATH"
-RUN corepack enable
-
-# *****************************************************************************
-# STAGE 1: Build the project
-# *****************************************************************************
-FROM base AS builder
-RUN apk add --no-cache libc6-compat
-WORKDIR /app
-
-ARG TURBO_VERSION=2.5.6
-RUN corepack enable pnpm && pnpm add -g turbo@${TURBO_VERSION}
-COPY . .
-
-RUN turbo prune --scope=admin --docker
-
-# *****************************************************************************
-# STAGE 2: Install dependencies & build the project
-# *****************************************************************************
-FROM base AS installer
-
-RUN apk add --no-cache libc6-compat
-WORKDIR /app
-
-COPY .gitignore .gitignore
-COPY --from=builder /app/out/json/ .
-COPY --from=builder /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
-RUN corepack enable pnpm
-RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store pnpm fetch --store-dir=/pnpm/store
-
-COPY --from=builder /app/out/full/ .
-COPY turbo.json turbo.json
-RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store pnpm install --offline --frozen-lockfile --store-dir=/pnpm/store
-
-ARG NEXT_PUBLIC_API_BASE_URL=""
-ENV NEXT_PUBLIC_API_BASE_URL=$NEXT_PUBLIC_API_BASE_URL
-
-ARG NEXT_PUBLIC_ADMIN_BASE_URL=""
-ENV NEXT_PUBLIC_ADMIN_BASE_URL=$NEXT_PUBLIC_ADMIN_BASE_URL
-
-ARG NEXT_PUBLIC_ADMIN_BASE_PATH="/god-mode"
-ENV NEXT_PUBLIC_ADMIN_BASE_PATH=$NEXT_PUBLIC_ADMIN_BASE_PATH
-
-ARG NEXT_PUBLIC_SPACE_BASE_URL=""
-ENV NEXT_PUBLIC_SPACE_BASE_URL=$NEXT_PUBLIC_SPACE_BASE_URL
-
-ARG NEXT_PUBLIC_SPACE_BASE_PATH="/spaces"
-ENV NEXT_PUBLIC_SPACE_BASE_PATH=$NEXT_PUBLIC_SPACE_BASE_PATH
-
-ARG NEXT_PUBLIC_WEB_BASE_URL=""
-ENV NEXT_PUBLIC_WEB_BASE_URL=$NEXT_PUBLIC_WEB_BASE_URL
-
-ENV NEXT_TELEMETRY_DISABLED=1
-ENV TURBO_TELEMETRY_DISABLED=1
-
-RUN pnpm turbo run build --filter=admin
-
-# *****************************************************************************
-# STAGE 3: Copy the project and start it
-# *****************************************************************************
-FROM base AS runner
-WORKDIR /app
-
-# Don't run production as root
-RUN addgroup --system --gid 1001 nodejs
-RUN adduser --system --uid 1001 nextjs
-USER nextjs
-
-# Automatically leverage output traces to reduce image size
-# https://nextjs.org/docs/advanced-features/output-file-tracing
-COPY --from=installer /app/apps/admin/.next/standalone ./
-COPY --from=installer /app/apps/admin/.next/static ./apps/admin/.next/static
-COPY --from=installer /app/apps/admin/public ./apps/admin/public
-
-ARG NEXT_PUBLIC_API_BASE_URL=""
-ENV NEXT_PUBLIC_API_BASE_URL=$NEXT_PUBLIC_API_BASE_URL
-
-ARG NEXT_PUBLIC_ADMIN_BASE_URL=""
-ENV NEXT_PUBLIC_ADMIN_BASE_URL=$NEXT_PUBLIC_ADMIN_BASE_URL
-
-ARG NEXT_PUBLIC_ADMIN_BASE_PATH="/god-mode"
-ENV NEXT_PUBLIC_ADMIN_BASE_PATH=$NEXT_PUBLIC_ADMIN_BASE_PATH
-
-ARG NEXT_PUBLIC_SPACE_BASE_URL=""
-ENV NEXT_PUBLIC_SPACE_BASE_URL=$NEXT_PUBLIC_SPACE_BASE_URL
-
-ARG NEXT_PUBLIC_SPACE_BASE_PATH="/spaces"
-ENV NEXT_PUBLIC_SPACE_BASE_PATH=$NEXT_PUBLIC_SPACE_BASE_PATH
-
-ARG NEXT_PUBLIC_WEB_BASE_URL=""
-ENV NEXT_PUBLIC_WEB_BASE_URL=$NEXT_PUBLIC_WEB_BASE_URL
-
-ENV NEXT_TELEMETRY_DISABLED=1
-ENV TURBO_TELEMETRY_DISABLED=1
-
-EXPOSE 3000
-
-CMD ["node", "apps/admin/server.js"]

apps/admin/Dockerfile.dev

@@ -1,17 +0,0 @@
-FROM node:22-alpine
-RUN apk add --no-cache libc6-compat
-# Set working directory
-WORKDIR /app
-
-COPY . .
-
-RUN corepack enable pnpm && pnpm add -g turbo
-RUN pnpm install
-
-ENV NEXT_PUBLIC_ADMIN_BASE_PATH="/god-mode"
-
-EXPOSE 3000
-
-VOLUME [ "/app/node_modules", "/app/admin/node_modules" ]
-
-CMD ["pnpm", "dev", "--filter=admin"]

apps/admin/app/(all)/(dashboard)/email/page.tsx

@@ -9,7 +9,7 @@ import { useInstance } from "@/hooks/store";
 // components
 import { InstanceEmailForm } from "./email-config-form";
 
-const InstanceEmailPage: React.FC = observer(() => {
+const InstanceEmailPage = observer(() => {
   // store
   const { fetchInstanceConfigurations, formattedConfig, disableEmail } = useInstance();
 
@@ -29,7 +29,7 @@ const InstanceEmailPage: React.FC = observer(() => {
           message: "Email feature has been disabled",
           type: TOAST_TYPE.SUCCESS,
         });
-      } catch (_error) {
+      } catch (error) {
         setToast({
           title: "Error disabling email",
           message: "Failed to disable email feature. Please try again.",

apps/admin/app/(all)/(dashboard)/sidebar-help-section.tsx

@@ -7,8 +7,7 @@ import { ExternalLink, FileText, HelpCircle, MoveLeft } from "lucide-react";
 import { Transition } from "@headlessui/react";
 // plane internal packages
 import { WEB_BASE_URL } from "@plane/constants";
-import { DiscordIcon, GithubIcon } from "@plane/propel/icons";
-import { Tooltip } from "@plane/propel/tooltip";
+import { DiscordIcon, GithubIcon, Tooltip } from "@plane/ui";
 import { cn } from "@plane/utils";
 // hooks
 import { useTheme } from "@/hooks/store";

apps/admin/app/(all)/(dashboard)/sidebar-menu.tsx

@@ -5,8 +5,7 @@ import Link from "next/link";
 import { usePathname } from "next/navigation";
 import { Image, BrainCog, Cog, Lock, Mail } from "lucide-react";
 // plane internal packages
-import { WorkspaceIcon } from "@plane/propel/icons";
-import { Tooltip } from "@plane/propel/tooltip";
+import { Tooltip, WorkspaceIcon } from "@plane/ui";
 import { cn } from "@plane/utils";
 // hooks
 import { useTheme } from "@/hooks/store";

apps/admin/app/(all)/(home)/auth-header.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import Link from "next/link";
-import { PlaneLockup } from "@plane/propel/icons";
+import { PlaneLockup } from "@plane/ui";
 
 export const AuthHeader = () => (
   <div className="flex items-center justify-between gap-6 w-full flex-shrink-0 sticky top-0">

apps/admin/core/components/authentication/email-config-switch.tsx

@@ -25,8 +25,9 @@ export const EmailCodesConfiguration: React.FC<Props> = observer((props) => {
     <ToggleSwitch
       value={Boolean(parseInt(enableMagicLogin))}
       onChange={() => {
-        const newEnableMagicLogin = Boolean(parseInt(enableMagicLogin)) === true ? "0" : "1";
-        updateConfig("ENABLE_MAGIC_LINK_LOGIN", newEnableMagicLogin);
+        Boolean(parseInt(enableMagicLogin)) === true
+          ? updateConfig("ENABLE_MAGIC_LINK_LOGIN", "0")
+          : updateConfig("ENABLE_MAGIC_LINK_LOGIN", "1");
       }}
       size="sm"
       disabled={disabled}

apps/admin/core/components/authentication/github-config.tsx

@@ -35,8 +35,9 @@ export const GithubConfiguration: React.FC<Props> = observer((props) => {
           <ToggleSwitch
             value={Boolean(parseInt(enableGithubConfig))}
             onChange={() => {
-              const newEnableGithubConfig = Boolean(parseInt(enableGithubConfig)) === true ? "0" : "1";
-              updateConfig("IS_GITHUB_ENABLED", newEnableGithubConfig);
+              Boolean(parseInt(enableGithubConfig)) === true
+                ? updateConfig("IS_GITHUB_ENABLED", "0")
+                : updateConfig("IS_GITHUB_ENABLED", "1");
             }}
             size="sm"
             disabled={disabled}

apps/admin/core/components/authentication/gitlab-config.tsx

@@ -35,8 +35,9 @@ export const GitlabConfiguration: React.FC<Props> = observer((props) => {
           <ToggleSwitch
             value={Boolean(parseInt(enableGitlabConfig))}
             onChange={() => {
-              const newEnableGitlabConfig = Boolean(parseInt(enableGitlabConfig)) === true ? "0" : "1";
-              updateConfig("IS_GITLAB_ENABLED", newEnableGitlabConfig);
+              Boolean(parseInt(enableGitlabConfig)) === true
+                ? updateConfig("IS_GITLAB_ENABLED", "0")
+                : updateConfig("IS_GITLAB_ENABLED", "1");
             }}
             size="sm"
             disabled={disabled}

apps/admin/core/components/authentication/google-config.tsx

@@ -35,8 +35,9 @@ export const GoogleConfiguration: React.FC<Props> = observer((props) => {
           <ToggleSwitch
             value={Boolean(parseInt(enableGoogleConfig))}
             onChange={() => {
-              const newEnableGoogleConfig = Boolean(parseInt(enableGoogleConfig)) === true ? "0" : "1";
-              updateConfig("IS_GOOGLE_ENABLED", newEnableGoogleConfig);
+              Boolean(parseInt(enableGoogleConfig)) === true
+                ? updateConfig("IS_GOOGLE_ENABLED", "0")
+                : updateConfig("IS_GOOGLE_ENABLED", "1");
             }}
             size="sm"
             disabled={disabled}

apps/admin/core/components/authentication/password-config-switch.tsx

@@ -25,8 +25,9 @@ export const PasswordLoginConfiguration: React.FC<Props> = observer((props) => {
     <ToggleSwitch
       value={Boolean(parseInt(enableEmailPassword))}
       onChange={() => {
-        const newEnableEmailPassword = Boolean(parseInt(enableEmailPassword)) === true ? "0" : "1";
-        updateConfig("ENABLE_EMAIL_PASSWORD", newEnableEmailPassword);
+        Boolean(parseInt(enableEmailPassword)) === true
+          ? updateConfig("ENABLE_EMAIL_PASSWORD", "0")
+          : updateConfig("ENABLE_EMAIL_PASSWORD", "1");
       }}
       size="sm"
       disabled={disabled}

apps/admin/core/components/common/breadcrumb-link.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import Link from "next/link";
-import { Tooltip } from "@plane/propel/tooltip";
+import { Tooltip } from "@plane/ui";
 
 type Props = {
   label?: string;

apps/admin/core/components/workspace/list-item.tsx

@@ -2,7 +2,7 @@ import { observer } from "mobx-react";
 import { ExternalLink } from "lucide-react";
 // plane internal packages
 import { WEB_BASE_URL } from "@plane/constants";
-import { Tooltip } from "@plane/propel/tooltip";
+import { Tooltip } from "@plane/ui";
 import { getFileURL } from "@plane/utils";
 // hooks
 import { useWorkspace } from "@/hooks/store";

apps/admin/core/store/instance.store.ts

@@ -209,7 +209,7 @@ export class InstanceStore implements IInstanceStore {
         });
       });
       await this.instanceService.disableEmail();
-    } catch (_error) {
+    } catch (error) {
       console.error("Error disabling the email");
       this.instanceConfigurations = instanceConfigurations;
     }

apps/admin/package.json

@@ -1,7 +1,7 @@
 {
   "name": "admin",
   "description": "Admin UI for Plane",
-  "version": "1.0.0",
+  "version": "0.28.0",
   "license": "AGPL-3.0",
   "private": true,
   "scripts": {
@@ -26,30 +26,30 @@
     "@plane/ui": "workspace:*",
     "@plane/utils": "workspace:*",
     "autoprefixer": "10.4.14",
-    "axios": "catalog:",
-    "lodash": "catalog:",
-    "lucide-react": "catalog:",
-    "mobx": "catalog:",
-    "mobx-react": "catalog:",
-    "next": "catalog:",
+    "axios": "1.11.0",
+    "lodash": "^4.17.21",
+    "lucide-react": "^0.469.0",
+    "mobx": "^6.12.0",
+    "mobx-react": "^9.1.1",
+    "next": "14.2.30",
     "next-themes": "^0.2.1",
     "postcss": "^8.4.49",
-    "react": "catalog:",
-    "react-dom": "catalog:",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
     "react-hook-form": "7.51.5",
-    "sharp": "catalog:",
-    "swr": "catalog:",
-    "uuid": "catalog:"
+    "sharp": "^0.33.5",
+    "swr": "^2.2.4",
+    "uuid": "^9.0.1"
   },
   "devDependencies": {
     "@plane/eslint-config": "workspace:*",
     "@plane/tailwind-config": "workspace:*",
     "@plane/typescript-config": "workspace:*",
-    "@types/lodash": "catalog:",
+    "@types/lodash": "^4.17.6",
     "@types/node": "18.16.1",
-    "@types/react": "catalog:",
-    "@types/react-dom": "catalog:",
+    "@types/react": "^18.3.11",
+    "@types/react-dom": "^18.2.18",
     "@types/uuid": "^9.0.8",
-    "typescript": "catalog:"
+    "typescript": "5.8.3"
   }
 }

apps/api/Dockerfile.api

@@ -1,58 +0,0 @@
-FROM python:3.12.10-alpine
-
-# set environment variables
-ENV PYTHONDONTWRITEBYTECODE=1
-ENV PYTHONUNBUFFERED=1
-ENV PIP_DISABLE_PIP_VERSION_CHECK=1 
-ENV INSTANCE_CHANGELOG_URL=https://sites.plane.so/pages/691ef037bcfe416a902e48cb55f59891/
-
-# Update system packages for security
-RUN apk update && apk upgrade
-
-WORKDIR /code
-
-RUN apk add --no-cache --upgrade \
-    "libpq" \
-    "libxslt" \
-    "xmlsec" \
-    "ca-certificates" \
-    "openssl"
-
-COPY requirements.txt ./
-COPY requirements ./requirements
-RUN apk add --no-cache libffi-dev
-RUN apk add --no-cache --virtual .build-deps \
-    "bash~=5.2" \
-    "g++" \
-    "gcc" \
-    "cargo" \
-    "git" \
-    "make" \
-    "postgresql-dev" \
-    "libc-dev" \
-    "linux-headers" \
-    && \
-    pip install -r requirements.txt --compile --no-cache-dir \
-    && \
-    apk del .build-deps \
-    && \
-    rm -rf /var/cache/apk/*
-
-
-# Add in Django deps and generate Django's static files
-COPY manage.py manage.py
-COPY plane plane/
-COPY templates templates/
-COPY package.json package.json
-
-RUN apk --no-cache add "bash~=5.2"
-COPY ./bin ./bin/
-
-RUN mkdir -p /code/plane/logs
-RUN chmod +x ./bin/*
-RUN chmod -R 777 /code
-
-# Expose container port and run entry point script
-EXPOSE 8000
-
-CMD ["./bin/docker-entrypoint-api.sh"]

apps/api/Dockerfile.dev

@@ -1,46 +0,0 @@
-FROM python:3.12.5-alpine AS backend
-
-# set environment variables
-ENV PYTHONDONTWRITEBYTECODE 1
-ENV PYTHONUNBUFFERED 1
-ENV PIP_DISABLE_PIP_VERSION_CHECK=1 
-ENV INSTANCE_CHANGELOG_URL https://sites.plane.so/pages/691ef037bcfe416a902e48cb55f59891/
-
-RUN apk --no-cache add \
-    "bash~=5.2" \
-    "libpq" \
-    "libxslt" \
-    "nodejs-current" \
-    "xmlsec" \
-    "libffi-dev" \
-    "bash~=5.2" \
-    "g++" \
-    "gcc" \
-    "cargo" \
-    "git" \
-    "make" \
-    "postgresql-dev" \
-    "libc-dev" \
-    "linux-headers"
-
-WORKDIR /code
-
-COPY requirements.txt ./requirements.txt
-ADD requirements ./requirements
-
-# Install the local development settings
-RUN pip install -r requirements/local.txt --compile --no-cache-dir
-
-
-COPY . .
-
-RUN mkdir -p /code/plane/logs
-RUN chmod -R +x /code/bin
-RUN chmod -R 777 /code
-
-
-# Expose container port and run entry point script
-EXPOSE 8000
-
-CMD [ "./bin/docker-entrypoint-api-local.sh" ]
-

apps/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plane-api",
-  "version": "1.0.0",
+  "version": "0.28.0",
   "license": "AGPL-3.0",
   "private": true,
   "description": "API server powering Plane's backend"

apps/api/plane/api/serializers/base.py

@@ -91,7 +91,6 @@ class BaseSerializer(serializers.ModelSerializer):
                         "project_lead": UserLiteSerializer,
                         "state": StateLiteSerializer,
                         "created_by": UserLiteSerializer,
-                        "updated_by": UserLiteSerializer,
                         "issue": IssueSerializer,
                         "actor": UserLiteSerializer,
                         "owned_by": UserLiteSerializer,

apps/api/plane/app/permissions/__init__.py

@@ -13,4 +13,3 @@ from .project import (
     ProjectLitePermission,
 )
 from .base import allow_permission, ROLE
-from .page import ProjectPagePermission

apps/api/plane/app/permissions/base.py

@@ -39,31 +39,13 @@ def allow_permission(allowed_roles, level="PROJECT", creator=False, model=None):
                 ).exists():
                     return view_func(instance, request, *args, **kwargs)
             else:
-                is_user_has_allowed_role = ProjectMember.objects.filter(
+                if ProjectMember.objects.filter(
                     member=request.user,
                     workspace__slug=kwargs["slug"],
                     project_id=kwargs["project_id"],
                     role__in=allowed_role_values,
                     is_active=True,
-                ).exists()
-
-                # Return if the user has the allowed role else if they are workspace admin and part of the project regardless of the role
-                if is_user_has_allowed_role:
-                    return view_func(instance, request, *args, **kwargs)
-                elif (
-                    ProjectMember.objects.filter(
-                        member=request.user,
-                        workspace__slug=kwargs["slug"],
-                        project_id=kwargs["project_id"],
-                        is_active=True,
-                    ).exists()
-                    and WorkspaceMember.objects.filter(
-                        member=request.user,
-                        workspace__slug=kwargs["slug"],
-                        role=ROLE.ADMIN.value,
-                        is_active=True,
-                    ).exists()
-                ):
+                ).exists():
                     return view_func(instance, request, *args, **kwargs)
 
             # Return permission denied if no conditions are met

apps/api/plane/app/permissions/page.py

@@ -1,125 +0,0 @@
-from plane.db.models import ProjectMember, Page
-from plane.app.permissions import ROLE
-
-
-from rest_framework.permissions import BasePermission, SAFE_METHODS
-
-
-# Permission Mappings for workspace members
-ADMIN = ROLE.ADMIN.value
-MEMBER = ROLE.MEMBER.value
-GUEST = ROLE.GUEST.value
-
-
-class ProjectPagePermission(BasePermission):
-    """
-    Custom permission to control access to pages within a workspace
-    based on user roles, page visibility (public/private), and feature flags.
-    """
-
-    def has_permission(self, request, view):
-        """
-        Check basic project-level permissions before checking object-level permissions.
-        """
-        if request.user.is_anonymous:
-            return False
-
-        user_id = request.user.id
-        slug = view.kwargs.get("slug")
-        page_id = view.kwargs.get("page_id")
-        project_id = view.kwargs.get("project_id")
-
-        # Hook for extended validation
-        extended_access, role = self._check_access_and_get_role(
-            request, slug, project_id
-        )
-        if extended_access is False:
-            return False
-
-        if page_id:
-            page = Page.objects.get(id=page_id, workspace__slug=slug)
-
-            # Allow access if the user is the owner of the page
-            if page.owned_by_id == user_id:
-                return True
-
-            # Handle private page access
-            if page.access == Page.PRIVATE_ACCESS:
-                return self._has_private_page_action_access(
-                    request, slug, page, project_id
-                )
-
-        # Handle public page access
-        return self._has_public_page_action_access(request, role)
-
-    def _check_project_member_access(self, request, slug, project_id):
-        """
-        Check if the user is a project member.
-        """
-        return (
-            ProjectMember.objects.filter(
-                member=request.user,
-                workspace__slug=slug,
-                is_active=True,
-                project_id=project_id,
-            )
-            .values_list("role", flat=True)
-            .first()
-        )
-
-    def _check_access_and_get_role(self, request, slug, project_id):
-        """
-        Hook for extended access checking
-        Returns: True (allow), False (deny), None (continue with normal flow)
-        """
-        role = self._check_project_member_access(request, slug, project_id)
-        if not role:
-            return False, None
-        return True, role
-
-    def _has_private_page_action_access(self, request, slug, page, project_id):
-        """
-        Check access to private pages. Override for feature flag logic.
-        """
-        # Base implementation: only owner can access private pages
-        return False
-
-    def _check_project_action_access(self, request, role):
-        method = request.method
-
-        # Only admins can create (POST) pages
-        if method == "POST":
-            if role in [ADMIN, MEMBER]:
-                return True
-            return False
-
-        # Safe methods (GET, HEAD, OPTIONS) allowed for all active roles
-        if method in SAFE_METHODS:
-            if role in [ADMIN, MEMBER, GUEST]:
-                return True
-            return False
-
-        # PUT/PATCH: Admins and members can update
-        if method in ["PUT", "PATCH"]:
-            if role in [ADMIN, MEMBER]:
-                return True
-            return False
-
-        # DELETE: Only admins can delete
-        if method == "DELETE":
-            if role in [ADMIN]:
-                return True
-            return False
-
-        # Deny by default
-        return False
-
-    def _has_public_page_action_access(self, request, role):
-        """
-        Check if the user has permission to access a public page
-        and can perform operations on the page.
-        """
-        project_member_exists = self._check_project_action_access(request, role)
-        if not project_member_exists:
-            return False
-        return True

apps/api/plane/app/permissions/project.py

@@ -3,7 +3,11 @@ from rest_framework.permissions import SAFE_METHODS, BasePermission
 
 # Module import
 from plane.db.models import ProjectMember, WorkspaceMember
-from plane.db.models.project import ROLE
+
+# Permission Mappings
+Admin = 20
+Member = 15
+Guest = 5
 
 
 class ProjectBasePermission(BasePermission):
@@ -22,31 +26,18 @@ class ProjectBasePermission(BasePermission):
             return WorkspaceMember.objects.filter(
                 workspace__slug=view.workspace_slug,
                 member=request.user,
-                role__in=[ROLE.ADMIN.value, ROLE.MEMBER.value],
+                role__in=[Admin, Member],
                 is_active=True,
             ).exists()
 
-        project_member_qs = ProjectMember.objects.filter(
+        ## Only Project Admins can update project attributes
+        return ProjectMember.objects.filter(
             workspace__slug=view.workspace_slug,
             member=request.user,
+            role=Admin,
             project_id=view.project_id,
             is_active=True,
-        )
-
-        ## Only project admins or workspace admin who is part of the project can access
-
-        if project_member_qs.filter(role=ROLE.ADMIN.value).exists():
-            return True
-        else:
-            return (
-                project_member_qs.exists()
-                and WorkspaceMember.objects.filter(
-                    member=request.user,
-                    workspace__slug=view.workspace_slug,
-                    role=ROLE.ADMIN.value,
-                    is_active=True,
-                ).exists()
-            )
+        ).exists()
 
 
 class ProjectMemberPermission(BasePermission):
@@ -64,7 +55,7 @@ class ProjectMemberPermission(BasePermission):
             return WorkspaceMember.objects.filter(
                 workspace__slug=view.workspace_slug,
                 member=request.user,
-                role__in=[ROLE.ADMIN.value, ROLE.MEMBER.value],
+                role__in=[Admin, Member],
                 is_active=True,
             ).exists()
 
@@ -72,7 +63,7 @@ class ProjectMemberPermission(BasePermission):
         return ProjectMember.objects.filter(
             workspace__slug=view.workspace_slug,
             member=request.user,
-            role__in=[ROLE.ADMIN.value, ROLE.MEMBER.value],
+            role__in=[Admin, Member],
             project_id=view.project_id,
             is_active=True,
         ).exists()
@@ -106,7 +97,7 @@ class ProjectEntityPermission(BasePermission):
         return ProjectMember.objects.filter(
             workspace__slug=view.workspace_slug,
             member=request.user,
-            role__in=[ROLE.ADMIN.value, ROLE.MEMBER.value],
+            role__in=[Admin, Member],
             project_id=view.project_id,
             is_active=True,
         ).exists()

apps/api/plane/app/serializers/__init__.py

@@ -92,6 +92,8 @@ from .importer import ImporterSerializer
 
 from .page import (
     PageSerializer,
+    PageLogSerializer,
+    SubPageSerializer,
     PageDetailSerializer,
     PageVersionSerializer,
     PageBinaryUpdateSerializer,

apps/api/plane/app/serializers/issue.py

@@ -667,33 +667,16 @@ class IssueReactionSerializer(BaseSerializer):
 
 
 class IssueReactionLiteSerializer(DynamicBaseSerializer):
-    display_name = serializers.CharField(source="actor.display_name", read_only=True)
-
     class Meta:
         model = IssueReaction
-        fields = ["id", "actor", "issue", "reaction", "display_name"]
+        fields = ["id", "actor", "issue", "reaction"]
 
 
 class CommentReactionSerializer(BaseSerializer):
-    display_name = serializers.CharField(source="actor.display_name", read_only=True)
-
     class Meta:
         model = CommentReaction
-        fields = [
-            "id",
-            "actor",
-            "comment",
-            "reaction",
-            "display_name",
-            "deleted_at",
-            "workspace",
-            "project",
-            "created_at",
-            "updated_at",
-            "created_by",
-            "updated_by",
-        ]
-        read_only_fields = ["workspace", "project", "comment", "actor", "deleted_at", "created_by", "updated_by"]
+        fields = "__all__"
+        read_only_fields = ["workspace", "project", "comment", "actor", "deleted_at"]
 
 
 class IssueVoteSerializer(BaseSerializer):

apps/api/plane/app/serializers/page.py

@@ -130,6 +130,32 @@ class PageDetailSerializer(PageSerializer):
         fields = PageSerializer.Meta.fields + ["description_html"]
 
 
+class SubPageSerializer(BaseSerializer):
+    entity_details = serializers.SerializerMethodField()
+
+    class Meta:
+        model = PageLog
+        fields = "__all__"
+        read_only_fields = ["workspace", "page"]
+
+    def get_entity_details(self, obj):
+        entity_name = obj.entity_name
+        if entity_name == "forward_link" or entity_name == "back_link":
+            try:
+                page = Page.objects.get(pk=obj.entity_identifier)
+                return PageSerializer(page).data
+            except Page.DoesNotExist:
+                return None
+        return None
+
+
+class PageLogSerializer(BaseSerializer):
+    class Meta:
+        model = PageLog
+        fields = "__all__"
+        read_only_fields = ["workspace", "page"]
+
+
 class PageVersionSerializer(BaseSerializer):
     class Meta:
         model = PageVersion

apps/api/plane/app/serializers/project.py

@@ -15,6 +15,7 @@ from plane.db.models import (
 )
 from plane.utils.content_validator import (
     validate_html_content,
+    validate_binary_data,
 )
 
 

apps/api/plane/app/urls/page.py

@@ -4,11 +4,14 @@ from django.urls import path
 from plane.app.views import (
     PageViewSet,
     PageFavoriteViewSet,
+    PageLogEndpoint,
+    SubPagesEndpoint,
     PagesDescriptionViewSet,
     PageVersionEndpoint,
     PageDuplicateEndpoint,
 )
 
+
 urlpatterns = [
     path(
         "workspaces/<str:slug>/projects/<uuid:project_id>/pages/",
@@ -16,7 +19,7 @@ urlpatterns = [
         name="project-pages",
     ),
     path(
-        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:page_id>/",
+        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:pk>/",
         PageViewSet.as_view(
             {"get": "retrieve", "patch": "partial_update", "delete": "destroy"}
         ),
@@ -24,30 +27,45 @@ urlpatterns = [
     ),
     # favorite pages
     path(
-        "workspaces/<str:slug>/projects/<uuid:project_id>/favorite-pages/<uuid:page_id>/",
+        "workspaces/<str:slug>/projects/<uuid:project_id>/favorite-pages/<uuid:pk>/",
         PageFavoriteViewSet.as_view({"post": "create", "delete": "destroy"}),
         name="user-favorite-pages",
     ),
     # archived pages
     path(
-        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:page_id>/archive/",
+        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:pk>/archive/",
         PageViewSet.as_view({"post": "archive", "delete": "unarchive"}),
         name="project-page-archive-unarchive",
     ),
     # lock and unlock
     path(
-        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:page_id>/lock/",
+        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:pk>/lock/",
         PageViewSet.as_view({"post": "lock", "delete": "unlock"}),
         name="project-pages-lock-unlock",
     ),
     # private and public page
     path(
-        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:page_id>/access/",
+        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:pk>/access/",
         PageViewSet.as_view({"post": "access"}),
         name="project-pages-access",
     ),
     path(
-        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:page_id>/description/",
+        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:pk>/transactions/",
+        PageLogEndpoint.as_view(),
+        name="page-transactions",
+    ),
+    path(
+        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:pk>/transactions/<uuid:transaction>/",
+        PageLogEndpoint.as_view(),
+        name="page-transactions",
+    ),
+    path(
+        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:pk>/sub-pages/",
+        SubPagesEndpoint.as_view(),
+        name="sub-page",
+    ),
+    path(
+        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:pk>/description/",
         PagesDescriptionViewSet.as_view({"get": "retrieve", "patch": "partial_update"}),
         name="page-description",
     ),

apps/api/plane/app/views/__init__.py

@@ -165,6 +165,8 @@ from .api import ApiTokenEndpoint, ServiceApiTokenEndpoint
 from .page.base import (
     PageViewSet,
     PageFavoriteViewSet,
+    PageLogEndpoint,
+    SubPagesEndpoint,
     PagesDescriptionViewSet,
     PageDuplicateEndpoint,
 )

apps/api/plane/app/views/asset/v2.py

@@ -441,11 +441,7 @@ class WorkspaceFileAssetEndpoint(BaseAPIView):
         # Get the presigned URL
         storage = S3Storage(request=request)
         # Generate a presigned URL to share an S3 object
-        signed_url = storage.generate_presigned_url(
-            object_name=asset.asset.name,
-            disposition="attachment",
-            filename=asset.attributes.get("name"),
-        )
+        signed_url = storage.generate_presigned_url(object_name=asset.asset.name)
         # Redirect to the signed URL
         return HttpResponseRedirect(signed_url)
 
@@ -645,11 +641,7 @@ class ProjectAssetEndpoint(BaseAPIView):
         # Get the presigned URL
         storage = S3Storage(request=request)
         # Generate a presigned URL to share an S3 object
-        signed_url = storage.generate_presigned_url(
-            object_name=asset.asset.name,
-            disposition="attachment",
-            filename=asset.attributes.get("name"),
-        )
+        signed_url = storage.generate_presigned_url(object_name=asset.asset.name)
         # Redirect to the signed URL
         return HttpResponseRedirect(signed_url)
 

apps/api/plane/app/views/cycle/base.py

@@ -504,6 +504,19 @@ class CycleViewSet(BaseViewSet):
     @allow_permission([ROLE.ADMIN], creator=True, model=Cycle)
     def destroy(self, request, slug, project_id, pk):
         cycle = Cycle.objects.get(workspace__slug=slug, project_id=project_id, pk=pk)
+        if cycle.owned_by_id != request.user.id and not (
+            ProjectMember.objects.filter(
+                workspace__slug=slug,
+                member=request.user,
+                role=20,
+                project_id=project_id,
+                is_active=True,
+            ).exists()
+        ):
+            return Response(
+                {"error": "Only admin or owner can delete the cycle"},
+                status=status.HTTP_403_FORBIDDEN,
+            )
 
         cycle_issues = list(
             CycleIssue.objects.filter(cycle_id=self.kwargs.get("pk")).values_list(
@@ -1080,9 +1093,6 @@ class CycleUserPropertiesEndpoint(BaseAPIView):
         )
 
         cycle_properties.filters = request.data.get("filters", cycle_properties.filters)
-        cycle_properties.rich_filters = request.data.get(
-            "rich_filters", cycle_properties.rich_filters
-        )
         cycle_properties.display_filters = request.data.get(
             "display_filters", cycle_properties.display_filters
         )

apps/api/plane/app/views/cycle/issue.py

@@ -1,5 +1,4 @@
 # Python imports
-import copy
 import json
 
 # Django imports
@@ -29,15 +28,11 @@ from plane.utils.order_queryset import order_issue_queryset
 from plane.utils.paginator import GroupedOffsetPaginator, SubGroupedOffsetPaginator
 from plane.app.permissions import allow_permission, ROLE
 from plane.utils.host import base_host
-from plane.utils.filters import ComplexFilterBackend
-from plane.utils.filters import IssueFilterSet
 
 
 class CycleIssueViewSet(BaseViewSet):
     serializer_class = CycleIssueSerializer
     model = CycleIssue
-    filter_backends = (ComplexFilterBackend,)
-    filterset_class = IssueFilterSet
 
     webhook_event = "cycle_issue"
     bulk = True
@@ -70,9 +65,24 @@ class CycleIssueViewSet(BaseViewSet):
             .distinct()
         )
 
-    def apply_annotations(self, issues):
-        return (
-            issues.annotate(
+    @method_decorator(gzip_page)
+    @allow_permission([ROLE.ADMIN, ROLE.MEMBER])
+    def list(self, request, slug, project_id, cycle_id):
+        order_by_param = request.GET.get("order_by", "created_at")
+        filters = issue_filters(request.query_params, "GET")
+        issue_queryset = (
+            Issue.issue_objects.filter(
+                issue_cycle__cycle_id=cycle_id, issue_cycle__deleted_at__isnull=True
+            )
+            .filter(project_id=project_id)
+            .filter(workspace__slug=slug)
+            .filter(**filters)
+            .select_related("workspace", "project", "state", "parent")
+            .prefetch_related(
+                "assignees", "labels", "issue_module__module", "issue_cycle__cycle"
+            )
+            .filter(**filters)
+            .annotate(
                 cycle_id=Subquery(
                     CycleIssue.objects.filter(
                         issue=OuterRef("id"), deleted_at__isnull=True
@@ -100,36 +110,11 @@ class CycleIssueViewSet(BaseViewSet):
                 .annotate(count=Func(F("id"), function="Count"))
                 .values("count")
             )
-            .prefetch_related(
-                "assignees", "labels", "issue_module__module", "issue_cycle__cycle"
-            )
         )
-
-    @method_decorator(gzip_page)
-    @allow_permission([ROLE.ADMIN, ROLE.MEMBER])
-    def list(self, request, slug, project_id, cycle_id):
         filters = issue_filters(request.query_params, "GET")
-        issue_queryset = (
-            Issue.issue_objects.filter(
-                issue_cycle__cycle_id=cycle_id, issue_cycle__deleted_at__isnull=True
-            )
-            .filter(project_id=project_id)
-            .filter(workspace__slug=slug)
-        )
-
-        # Apply filtering from filterset
-        issue_queryset = self.filter_queryset(issue_queryset)
-
-        # Apply legacy filters
-        issue_queryset = issue_queryset.filter(**filters)
-
-        # Total count queryset
-        total_issue_queryset = copy.deepcopy(issue_queryset)
-
-        # Applying annotations to the issue queryset
-        issue_queryset = self.apply_annotations(issue_queryset)
 
         order_by_param = request.GET.get("order_by", "-created_at")
+        issue_queryset = issue_queryset.filter(**filters)
         # Issue queryset
         issue_queryset, order_by_param = order_issue_queryset(
             issue_queryset=issue_queryset, order_by_param=order_by_param
@@ -160,7 +145,6 @@ class CycleIssueViewSet(BaseViewSet):
                         request=request,
                         order_by=order_by_param,
                         queryset=issue_queryset,
-                        total_count_queryset=total_issue_queryset,
                         on_results=lambda issues: issue_on_results(
                             group_by=group_by, issues=issues, sub_group_by=sub_group_by
                         ),
@@ -195,7 +179,6 @@ class CycleIssueViewSet(BaseViewSet):
                     request=request,
                     order_by=order_by_param,
                     queryset=issue_queryset,
-                    total_count_queryset=total_issue_queryset,
                     on_results=lambda issues: issue_on_results(
                         group_by=group_by, issues=issues, sub_group_by=sub_group_by
                     ),
@@ -222,7 +205,6 @@ class CycleIssueViewSet(BaseViewSet):
                 order_by=order_by_param,
                 request=request,
                 queryset=issue_queryset,
-                total_count_queryset=total_issue_queryset,
                 on_results=lambda issues: issue_on_results(
                     group_by=group_by, issues=issues, sub_group_by=sub_group_by
                 ),

apps/api/plane/app/views/intake/base.py

@@ -28,7 +28,6 @@ from plane.db.models import (
     ProjectMember,
     CycleIssue,
     IssueDescriptionVersion,
-    WorkspaceMember,
 )
 from plane.app.serializers import (
     IssueCreateSerializer,
@@ -349,32 +348,17 @@ class IntakeIssueViewSet(BaseViewSet):
             project_id=project_id,
             intake_id=intake_id,
         )
-
-        project_member = ProjectMember.objects.filter(
+        # Get the project member
+        project_member = ProjectMember.objects.get(
             workspace__slug=slug,
             project_id=project_id,
             member=request.user,
             is_active=True,
-        ).first()
-
-        is_workspace_admin = WorkspaceMember.objects.filter(
-            workspace__slug=slug,
-            is_active=True,
-            member=request.user,
-            role=ROLE.ADMIN.value,
-        ).exists()
-
-        if not project_member and not is_workspace_admin:
-            return Response(
-                {"error": "Only admin or creator can update the intake work items"},
-                status=status.HTTP_403_FORBIDDEN,
-            )
-
+        )
         # Only project members admins and created_by users can access this endpoint
-        if (
-            (project_member and project_member.role <= ROLE.GUEST.value)
-            and not is_workspace_admin
-        ) and str(intake_issue.created_by_id) != str(request.user.id):
+        if project_member.role <= 5 and str(intake_issue.created_by_id) != str(
+            request.user.id
+        ):
             return Response(
                 {"error": "You cannot edit intake issues"},
                 status=status.HTTP_400_BAD_REQUEST,
@@ -407,8 +391,8 @@ class IntakeIssueViewSet(BaseViewSet):
                     Value([], output_field=ArrayField(UUIDField())),
                 ),
             ).get(pk=intake_issue.issue_id, workspace__slug=slug, project_id=project_id)
-
-            if project_member and project_member.role <= ROLE.GUEST.value:
+            # Only allow guests to edit name and description
+            if project_member.role <= 5:
                 issue_data = {
                     "name": issue_data.get("name", issue.name),
                     "description_html": issue_data.get(
@@ -416,7 +400,6 @@ class IntakeIssueViewSet(BaseViewSet):
                     ),
                     "description": issue_data.get("description", issue.description),
                 }
-
             current_instance = json.dumps(
                 IssueDetailSerializer(issue).data, cls=DjangoJSONEncoder
             )
@@ -453,10 +436,8 @@ class IntakeIssueViewSet(BaseViewSet):
                     issue_serializer.errors, status=status.HTTP_400_BAD_REQUEST
                 )
 
-        # Only project admins can edit intake issue attributes
-        if (
-            project_member and project_member.role > ROLE.MEMBER.value
-        ) or is_workspace_admin:
+        # Only project admins and members can edit intake issue attributes
+        if project_member.role > 15:
             serializer = IntakeIssueSerializer(
                 intake_issue, data=request.data, partial=True
             )

apps/api/plane/app/views/issue/archive.py

@@ -1,5 +1,4 @@
 # Python imports
-import copy
 import json
 
 # Django imports
@@ -42,20 +41,27 @@ from plane.utils.host import base_host
 
 # Module imports
 from .. import BaseViewSet, BaseAPIView
-from plane.utils.filters import ComplexFilterBackend
-from plane.utils.filters import IssueFilterSet
 
 
 class IssueArchiveViewSet(BaseViewSet):
     serializer_class = IssueFlatSerializer
     model = Issue
 
-    filter_backends = (ComplexFilterBackend,)
-    filterset_class = IssueFilterSet
-
-    def apply_annotations(self, issues):
+    def get_queryset(self):
         return (
-            issues.annotate(
+            Issue.objects.annotate(
+                sub_issues_count=Issue.objects.filter(parent=OuterRef("id"))
+                .order_by()
+                .annotate(count=Func(F("id"), function="Count"))
+                .values("count")
+            )
+            .filter(deleted_at__isnull=True)
+            .filter(archived_at__isnull=False)
+            .filter(project_id=self.kwargs.get("project_id"))
+            .filter(workspace__slug=self.kwargs.get("slug"))
+            .select_related("workspace", "project", "state", "parent")
+            .prefetch_related("assignees", "labels", "issue_module__module")
+            .annotate(
                 cycle_id=Subquery(
                     CycleIssue.objects.filter(
                         issue=OuterRef("id"), deleted_at__isnull=True
@@ -89,15 +95,6 @@ class IssueArchiveViewSet(BaseViewSet):
                     .values("count")
                 )
             )
-            .prefetch_related("assignees", "labels", "issue_module__module")
-        )
-
-    def get_queryset(self):
-        return (
-            Issue.objects.filter(Q(type__isnull=True) | Q(type__is_epic=False))
-            .filter(archived_at__isnull=False)
-            .filter(project_id=self.kwargs.get("project_id"))
-            .filter(workspace__slug=self.kwargs.get("slug"))
         )
 
     @method_decorator(gzip_page)
@@ -108,25 +105,26 @@ class IssueArchiveViewSet(BaseViewSet):
 
         order_by_param = request.GET.get("order_by", "-created_at")
 
-        issue_queryset = self.get_queryset()
+        issue_queryset = self.get_queryset().filter(**filters)
+
+        total_issue_queryset = Issue.objects.filter(
+            deleted_at__isnull=True,
+            archived_at__isnull=False,
+            project_id=project_id,
+            workspace__slug=slug,
+        ).filter(**filters)
+
+        total_issue_queryset = (
+            total_issue_queryset
+            if show_sub_issues == "true"
+            else total_issue_queryset.filter(parent__isnull=True)
+        )
 
         issue_queryset = (
             issue_queryset
             if show_sub_issues == "true"
             else issue_queryset.filter(parent__isnull=True)
         )
-        # Apply filtering from filterset
-        issue_queryset = self.filter_queryset(issue_queryset)
-
-        # Apply legacy filters
-        issue_queryset = issue_queryset.filter(**filters)
-
-        # Total count queryset
-        total_issue_queryset = copy.deepcopy(issue_queryset)
-
-        # Applying annotations to the issue queryset
-        issue_queryset = self.apply_annotations(issue_queryset)
-
         # Issue queryset
         issue_queryset, order_by_param = order_issue_queryset(
             issue_queryset=issue_queryset, order_by_param=order_by_param

apps/api/plane/app/views/issue/base.py

@@ -1,5 +1,4 @@
 # Python imports
-import copy
 import json
 
 # Django imports
@@ -7,16 +6,16 @@ from django.contrib.postgres.aggregates import ArrayAgg
 from django.contrib.postgres.fields import ArrayField
 from django.core.serializers.json import DjangoJSONEncoder
 from django.db.models import (
-    Count,
     Exists,
     F,
     Func,
     OuterRef,
     Prefetch,
     Q,
-    Subquery,
     UUIDField,
     Value,
+    Subquery,
+    Count,
 )
 from django.db.models.functions import Coalesce
 from django.utils import timezone
@@ -28,55 +27,50 @@ from rest_framework import status
 from rest_framework.response import Response
 
 # Module imports
-from plane.app.permissions import ROLE, allow_permission
+from plane.app.permissions import allow_permission, ROLE
 from plane.app.serializers import (
     IssueCreateSerializer,
     IssueDetailSerializer,
-    IssueListDetailSerializer,
-    IssueSerializer,
     IssueUserPropertySerializer,
+    IssueSerializer,
+    IssueListDetailSerializer,
 )
 from plane.bgtasks.issue_activities_task import issue_activity
-from plane.bgtasks.issue_description_version_task import issue_description_version_task
-from plane.bgtasks.recent_visited_task import recent_visited_task
-from plane.bgtasks.webhook_task import model_activity
 from plane.db.models import (
-    CycleIssue,
-    FileAsset,
-    IntakeIssue,
     Issue,
-    IssueAssignee,
-    IssueLabel,
+    FileAsset,
     IssueLink,
-    IssueReaction,
-    IssueRelation,
-    IssueSubscriber,
     IssueUserProperty,
-    ModuleIssue,
+    IssueReaction,
+    IssueSubscriber,
     Project,
     ProjectMember,
+    CycleIssue,
     UserRecentVisit,
+    ModuleIssue,
+    IssueRelation,
+    IssueAssignee,
+    IssueLabel,
+    IntakeIssue,
 )
-from plane.utils.filters import ComplexFilterBackend, IssueFilterSet
-from plane.utils.global_paginator import paginate
 from plane.utils.grouper import (
     issue_group_values,
     issue_on_results,
     issue_queryset_grouper,
 )
-from plane.utils.host import base_host
 from plane.utils.issue_filters import issue_filters
 from plane.utils.order_queryset import order_issue_queryset
 from plane.utils.paginator import GroupedOffsetPaginator, SubGroupedOffsetPaginator
-from plane.utils.timezone_converter import user_timezone_converter
-
 from .. import BaseAPIView, BaseViewSet
+from plane.utils.timezone_converter import user_timezone_converter
+from plane.bgtasks.recent_visited_task import recent_visited_task
+from plane.utils.global_paginator import paginate
+from plane.bgtasks.webhook_task import model_activity
+from plane.bgtasks.issue_description_version_task import issue_description_version_task
+from plane.utils.host import base_host
 
 
 class IssueListEndpoint(BaseAPIView):
-    filter_backends = (ComplexFilterBackend,)
-    filterset_class = IssueFilterSet
-
     @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
     def get(self, request, slug, project_id):
         issue_ids = request.GET.get("issues", False)
@@ -88,27 +82,14 @@ class IssueListEndpoint(BaseAPIView):
 
         issue_ids = [issue_id for issue_id in issue_ids.split(",") if issue_id != ""]
 
-        # Base queryset with basic filters
-        queryset = Issue.issue_objects.filter(
-            workspace__slug=slug, project_id=project_id, pk__in=issue_ids
-        )
-
-        # Apply filtering from filterset
-        queryset = self.filter_queryset(queryset)
-
-        # Apply legacy filters
-        filters = issue_filters(request.query_params, "GET")
-        issue_queryset = queryset.filter(**filters)
-
-        # Add select_related, prefetch_related if fields or expand is not None
-        if self.fields or self.expand:
-            issue_queryset = issue_queryset.select_related(
-                "workspace", "project", "state", "parent"
-            ).prefetch_related("assignees", "labels", "issue_module__module")
-
-        # Add annotations
-        issue_queryset = (
-            issue_queryset.annotate(
+        queryset = (
+            Issue.issue_objects.filter(
+                workspace__slug=slug, project_id=project_id, pk__in=issue_ids
+            )
+            .filter(workspace__slug=self.kwargs.get("slug"))
+            .select_related("workspace", "project", "state", "parent")
+            .prefetch_related("assignees", "labels", "issue_module__module")
+            .annotate(
                 cycle_id=Subquery(
                     CycleIssue.objects.filter(
                         issue=OuterRef("id"), deleted_at__isnull=True
@@ -136,10 +117,12 @@ class IssueListEndpoint(BaseAPIView):
                 .annotate(count=Func(F("id"), function="Count"))
                 .values("count")
             )
-            .distinct()
-        )
+        ).distinct()
+
+        filters = issue_filters(request.query_params, "GET")
 
         order_by_param = request.GET.get("order_by", "-created_at")
+        issue_queryset = queryset.filter(**filters)
         # Issue queryset
         issue_queryset, _ = order_issue_queryset(
             issue_queryset=issue_queryset, order_by_param=order_by_param
@@ -203,12 +186,6 @@ class IssueListEndpoint(BaseAPIView):
 
 
 class IssueViewSet(BaseViewSet):
-    model = Issue
-    webhook_event = "issue"
-    search_fields = ["name"]
-    filter_backends = (ComplexFilterBackend,)
-    filterset_class = IssueFilterSet
-
     def get_serializer_class(self):
         return (
             IssueCreateSerializer
@@ -216,17 +193,20 @@ class IssueViewSet(BaseViewSet):
             else IssueSerializer
         )
 
+    model = Issue
+    webhook_event = "issue"
+
+    search_fields = ["name"]
+
+    filterset_fields = ["state__name", "assignees__id", "workspace__id"]
+
     def get_queryset(self):
-        issues = Issue.issue_objects.filter(
-            project_id=self.kwargs.get("project_id"),
-            workspace__slug=self.kwargs.get("slug"),
-        ).distinct()
-
-        return issues
-
-    def apply_annotations(self, issues):
-        issues = (
-            issues.annotate(
+        return (
+            Issue.issue_objects.filter(project_id=self.kwargs.get("project_id"))
+            .filter(workspace__slug=self.kwargs.get("slug"))
+            .select_related("workspace", "project", "state", "parent")
+            .prefetch_related("assignees", "labels", "issue_module__module")
+            .annotate(
                 cycle_id=Subquery(
                     CycleIssue.objects.filter(
                         issue=OuterRef("id"), deleted_at__isnull=True
@@ -262,8 +242,6 @@ class IssueViewSet(BaseViewSet):
             )
         )
 
-        return issues
-
     @method_decorator(gzip_page)
     @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
     def list(self, request, slug, project_id):
@@ -272,24 +250,15 @@ class IssueViewSet(BaseViewSet):
             extra_filters = {"updated_at__gt": request.GET.get("updated_at__gt")}
 
         project = Project.objects.get(pk=project_id, workspace__slug=slug)
-        query_params = request.query_params.copy()
-
-        filters = issue_filters(query_params, "GET")
+        filters = issue_filters(request.query_params, "GET")
         order_by_param = request.GET.get("order_by", "-created_at")
 
-        issue_queryset = self.get_queryset()
+        issue_queryset = self.get_queryset().filter(**filters, **extra_filters)
+        # Custom ordering for priority and state
 
-        # Apply rich filters
-        issue_queryset = self.filter_queryset(issue_queryset)
-
-        # Apply legacy filters
-        issue_queryset = issue_queryset.filter(**filters, **extra_filters)
-
-        # Keeping a copy of the queryset before applying annotations
-        filtered_issue_queryset = copy.deepcopy(issue_queryset)
-
-        # Applying annotations to the issue queryset
-        issue_queryset = self.apply_annotations(issue_queryset)
+        total_issue_queryset = Issue.issue_objects.filter(
+            project_id=project_id, workspace__slug=slug
+        ).filter(**filters, **extra_filters)
 
         # Issue queryset
         issue_queryset, order_by_param = order_issue_queryset(
@@ -323,16 +292,14 @@ class IssueViewSet(BaseViewSet):
             and not project.guest_view_all_features
         ):
             issue_queryset = issue_queryset.filter(created_by=request.user)
-            filtered_issue_queryset = filtered_issue_queryset.filter(
-                created_by=request.user
-            )
+            total_issue_queryset = total_issue_queryset.filter(created_by=request.user)
 
         if group_by:
             if sub_group_by:
                 if group_by == sub_group_by:
                     return Response(
                         {
-                            "error": "Group by and sub group by cannot have same parameters"  # noqa: E501
+                            "error": "Group by and sub group by cannot have same parameters"
                         },
                         status=status.HTTP_400_BAD_REQUEST,
                     )
@@ -341,7 +308,7 @@ class IssueViewSet(BaseViewSet):
                         request=request,
                         order_by=order_by_param,
                         queryset=issue_queryset,
-                        total_count_queryset=filtered_issue_queryset,
+                        total_count_queryset=total_issue_queryset,
                         on_results=lambda issues: issue_on_results(
                             group_by=group_by, issues=issues, sub_group_by=sub_group_by
                         ),
@@ -351,14 +318,12 @@ class IssueViewSet(BaseViewSet):
                             slug=slug,
                             project_id=project_id,
                             filters=filters,
-                            queryset=filtered_issue_queryset,
                         ),
                         sub_group_by_fields=issue_group_values(
                             field=sub_group_by,
                             slug=slug,
                             project_id=project_id,
                             filters=filters,
-                            queryset=filtered_issue_queryset,
                         ),
                         group_by_field_name=group_by,
                         sub_group_by_field_name=sub_group_by,
@@ -377,7 +342,7 @@ class IssueViewSet(BaseViewSet):
                     request=request,
                     order_by=order_by_param,
                     queryset=issue_queryset,
-                    total_count_queryset=filtered_issue_queryset,
+                    total_count_queryset=total_issue_queryset,
                     on_results=lambda issues: issue_on_results(
                         group_by=group_by, issues=issues, sub_group_by=sub_group_by
                     ),
@@ -387,7 +352,6 @@ class IssueViewSet(BaseViewSet):
                         slug=slug,
                         project_id=project_id,
                         filters=filters,
-                        queryset=filtered_issue_queryset,
                     ),
                     group_by_field_name=group_by,
                     count_filter=Q(
@@ -404,7 +368,7 @@ class IssueViewSet(BaseViewSet):
                 order_by=order_by_param,
                 request=request,
                 queryset=issue_queryset,
-                total_count_queryset=filtered_issue_queryset,
+                total_count_queryset=total_issue_queryset,
                 on_results=lambda issues: issue_on_results(
                     group_by=group_by, issues=issues, sub_group_by=sub_group_by
                 ),
@@ -438,11 +402,9 @@ class IssueViewSet(BaseViewSet):
                 notification=True,
                 origin=base_host(request=request, is_app=True),
             )
-            queryset = self.get_queryset()
-            queryset = self.apply_annotations(queryset)
             issue = (
                 issue_queryset_grouper(
-                    queryset=queryset.filter(pk=serializer.data["id"]),
+                    queryset=self.get_queryset().filter(pk=serializer.data["id"]),
                     group_by=None,
                     sub_group_by=None,
                 )
@@ -647,10 +609,9 @@ class IssueViewSet(BaseViewSet):
         allowed_roles=[ROLE.ADMIN, ROLE.MEMBER], creator=True, model=Issue
     )
     def partial_update(self, request, slug, project_id, pk=None):
-        queryset = self.get_queryset()
-        queryset = self.apply_annotations(queryset)
         issue = (
-            queryset.annotate(
+            self.get_queryset()
+            .annotate(
                 label_ids=Coalesce(
                     ArrayAgg(
                         "labels__id",
@@ -769,9 +730,6 @@ class IssueUserDisplayPropertyEndpoint(BaseAPIView):
             user=request.user, project_id=project_id
         )
 
-        issue_property.rich_filters = request.data.get(
-            "rich_filters", issue_property.rich_filters
-        )
         issue_property.filters = request.data.get("filters", issue_property.filters)
         issue_property.display_filters = request.data.get(
             "display_filters", issue_property.display_filters
@@ -1011,59 +969,6 @@ class IssuePaginatedViewSet(BaseViewSet):
 
 
 class IssueDetailEndpoint(BaseAPIView):
-    filter_backends = (ComplexFilterBackend,)
-    filterset_class = IssueFilterSet
-
-    def apply_annotations(self, issues):
-        return (
-            issues.annotate(
-                cycle_id=Subquery(
-                    CycleIssue.objects.filter(
-                        issue=OuterRef("id"), deleted_at__isnull=True
-                    ).values("cycle_id")[:1]
-                )
-            )
-            .annotate(
-                link_count=IssueLink.objects.filter(issue=OuterRef("id"))
-                .order_by()
-                .annotate(count=Func(F("id"), function="Count"))
-                .values("count")
-            )
-            .annotate(
-                attachment_count=FileAsset.objects.filter(
-                    issue_id=OuterRef("id"),
-                    entity_type=FileAsset.EntityTypeContext.ISSUE_ATTACHMENT,
-                )
-                .order_by()
-                .annotate(count=Func(F("id"), function="Count"))
-                .values("count")
-            )
-            .annotate(
-                sub_issues_count=Issue.issue_objects.filter(parent=OuterRef("id"))
-                .order_by()
-                .annotate(count=Func(F("id"), function="Count"))
-                .values("count")
-            )
-            .prefetch_related(
-                Prefetch(
-                    "issue_assignee",
-                    queryset=IssueAssignee.objects.all(),
-                )
-            )
-            .prefetch_related(
-                Prefetch(
-                    "label_issue",
-                    queryset=IssueLabel.objects.all(),
-                )
-            )
-            .prefetch_related(
-                Prefetch(
-                    "issue_module",
-                    queryset=ModuleIssue.objects.all(),
-                )
-            )
-        )
-
     @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
     def get(self, request, slug, project_id):
         filters = issue_filters(request.query_params, "GET")
@@ -1097,9 +1002,56 @@ class IssueDetailEndpoint(BaseAPIView):
             .values("id")
         )
         # Main issue query
-        issue = Issue.issue_objects.filter(
-            workspace__slug=slug, project_id=project_id
-        ).filter(Exists(permission_subquery))
+        issue = (
+            Issue.issue_objects.filter(workspace__slug=slug, project_id=project_id)
+            .filter(Exists(permission_subquery))
+            .prefetch_related(
+                Prefetch(
+                    "issue_assignee",
+                    queryset=IssueAssignee.objects.all(),
+                )
+            )
+            .prefetch_related(
+                Prefetch(
+                    "label_issue",
+                    queryset=IssueLabel.objects.all(),
+                )
+            )
+            .prefetch_related(
+                Prefetch(
+                    "issue_module",
+                    queryset=ModuleIssue.objects.all(),
+                )
+            )
+            .annotate(
+                cycle_id=Subquery(
+                    CycleIssue.objects.filter(
+                        issue=OuterRef("id"), deleted_at__isnull=True
+                    ).values("cycle_id")[:1]
+                )
+            )
+            .annotate(
+                link_count=IssueLink.objects.filter(issue=OuterRef("id"))
+                .order_by()
+                .annotate(count=Func(F("id"), function="Count"))
+                .values("count")
+            )
+            .annotate(
+                attachment_count=FileAsset.objects.filter(
+                    issue_id=OuterRef("id"),
+                    entity_type=FileAsset.EntityTypeContext.ISSUE_ATTACHMENT,
+                )
+                .order_by()
+                .annotate(count=Func(F("id"), function="Count"))
+                .values("count")
+            )
+            .annotate(
+                sub_issues_count=Issue.issue_objects.filter(parent=OuterRef("id"))
+                .order_by()
+                .annotate(count=Func(F("id"), function="Count"))
+                .values("count")
+            )
+        )
 
         # Add additional prefetch based on expand parameter
         if self.expand:
@@ -1118,20 +1070,8 @@ class IssueDetailEndpoint(BaseAPIView):
                     )
                 )
 
-        # Apply filtering from filterset
-        issue = self.filter_queryset(issue)
-
-        # Apply legacy filters
         issue = issue.filter(**filters)
-
-        # Total count queryset
-        total_issue_queryset = copy.deepcopy(issue)
-
-        # Applying annotations to the issue queryset
-        issue = self.apply_annotations(issue)
-
         order_by_param = request.GET.get("order_by", "-created_at")
-
         # Issue queryset
         issue, order_by_param = order_issue_queryset(
             issue_queryset=issue, order_by_param=order_by_param
@@ -1139,8 +1079,7 @@ class IssueDetailEndpoint(BaseAPIView):
         return self.paginate(
             request=request,
             order_by=order_by_param,
-            queryset=issue,
-            total_count_queryset=total_issue_queryset,
+            queryset=(issue),
             on_results=lambda issue: IssueListDetailSerializer(
                 issue, many=True, fields=self.fields, expand=self.expand
             ).data,

apps/api/plane/app/views/module/base.py

@@ -232,6 +232,9 @@ class ModuleViewSet(BaseViewSet):
             .filter(project_id=self.kwargs.get("project_id"))
             .filter(workspace__slug=self.kwargs.get("slug"))
             .annotate(is_favorite=Exists(favorite_subquery))
+            .select_related("project")
+            .select_related("workspace")
+            .select_related("lead")
             .prefetch_related("members")
             .prefetch_related(
                 Prefetch(
@@ -312,10 +315,7 @@ class ModuleViewSet(BaseViewSet):
                     ArrayAgg(
                         "members__id",
                         distinct=True,
-                        filter=Q(
-                            members__id__isnull=False,
-                            modulemember__deleted_at__isnull=True,
-                        ),
+                        filter=~Q(members__id__isnull=True),
                     ),
                     Value([], output_field=ArrayField(UUIDField())),
                 )
@@ -904,9 +904,6 @@ class ModuleUserPropertiesEndpoint(BaseAPIView):
         module_properties.filters = request.data.get(
             "filters", module_properties.filters
         )
-        module_properties.rich_filters = request.data.get(
-            "rich_filters", module_properties.rich_filters
-        )
         module_properties.display_filters = request.data.get(
             "display_filters", module_properties.display_filters
         )

apps/api/plane/app/views/module/issue.py

@@ -1,5 +1,4 @@
 # Python imports
-import copy
 import json
 
 from django.db.models import F, Func, OuterRef, Q, Subquery
@@ -32,8 +31,8 @@ from plane.utils.grouper import (
 from plane.utils.issue_filters import issue_filters
 from plane.utils.order_queryset import order_issue_queryset
 from plane.utils.paginator import GroupedOffsetPaginator, SubGroupedOffsetPaginator
-from plane.utils.filters import ComplexFilterBackend
-from plane.utils.filters import IssueFilterSet
+
+# Module imports
 from .. import BaseViewSet
 from plane.utils.host import base_host
 
@@ -43,12 +42,20 @@ class ModuleIssueViewSet(BaseViewSet):
     model = ModuleIssue
     webhook_event = "module_issue"
     bulk = True
-    filter_backends = (ComplexFilterBackend,)
-    filterset_class = IssueFilterSet
 
-    def apply_annotations(self, issues):
+    filterset_fields = ["issue__labels__id", "issue__assignees__id"]
+
+    def get_queryset(self):
         return (
-            issues.annotate(
+            Issue.issue_objects.filter(
+                project_id=self.kwargs.get("project_id"),
+                workspace__slug=self.kwargs.get("slug"),
+                issue_module__module_id=self.kwargs.get("module_id"),
+                issue_module__deleted_at__isnull=True,
+            )
+            .select_related("workspace", "project", "state", "parent")
+            .prefetch_related("assignees", "labels", "issue_module__module")
+            .annotate(
                 cycle_id=Subquery(
                     CycleIssue.objects.filter(
                         issue=OuterRef("id"), deleted_at__isnull=True
@@ -76,37 +83,13 @@ class ModuleIssueViewSet(BaseViewSet):
                 .annotate(count=Func(F("id"), function="Count"))
                 .values("count")
             )
-            .prefetch_related("assignees", "labels", "issue_module__module")
-        )
-
-    def get_queryset(self):
-        return (
-            Issue.issue_objects.filter(
-                project_id=self.kwargs.get("project_id"),
-                workspace__slug=self.kwargs.get("slug"),
-                issue_module__module_id=self.kwargs.get("module_id"),
-                issue_module__deleted_at__isnull=True,
-            )
         ).distinct()
 
     @method_decorator(gzip_page)
     @allow_permission([ROLE.ADMIN, ROLE.MEMBER])
     def list(self, request, slug, project_id, module_id):
         filters = issue_filters(request.query_params, "GET")
-        issue_queryset = self.get_queryset()
-
-        # Apply filtering from filterset
-        issue_queryset = self.filter_queryset(issue_queryset)
-
-        # Apply legacy filters
-        issue_queryset = issue_queryset.filter(**filters)
-
-        # Total count queryset
-        total_issue_queryset = copy.deepcopy(issue_queryset)
-
-        # Apply annotations to the issue queryset
-        issue_queryset = self.apply_annotations(issue_queryset)
-
+        issue_queryset = self.get_queryset().filter(**filters)
         order_by_param = request.GET.get("order_by", "created_at")
 
         # Issue queryset
@@ -139,7 +122,6 @@ class ModuleIssueViewSet(BaseViewSet):
                         request=request,
                         order_by=order_by_param,
                         queryset=issue_queryset,
-                        total_count_queryset=total_issue_queryset,
                         on_results=lambda issues: issue_on_results(
                             group_by=group_by, issues=issues, sub_group_by=sub_group_by
                         ),
@@ -149,14 +131,12 @@ class ModuleIssueViewSet(BaseViewSet):
                             slug=slug,
                             project_id=project_id,
                             filters=filters,
-                            queryset=total_issue_queryset,
                         ),
                         sub_group_by_fields=issue_group_values(
                             field=sub_group_by,
                             slug=slug,
                             project_id=project_id,
                             filters=filters,
-                            queryset=total_issue_queryset,
                         ),
                         group_by_field_name=group_by,
                         sub_group_by_field_name=sub_group_by,
@@ -176,7 +156,6 @@ class ModuleIssueViewSet(BaseViewSet):
                     request=request,
                     order_by=order_by_param,
                     queryset=issue_queryset,
-                    total_count_queryset=total_issue_queryset,
                     on_results=lambda issues: issue_on_results(
                         group_by=group_by, issues=issues, sub_group_by=sub_group_by
                     ),
@@ -186,7 +165,6 @@ class ModuleIssueViewSet(BaseViewSet):
                         slug=slug,
                         project_id=project_id,
                         filters=filters,
-                        queryset=total_issue_queryset,
                     ),
                     group_by_field_name=group_by,
                     count_filter=Q(
@@ -204,7 +182,6 @@ class ModuleIssueViewSet(BaseViewSet):
                 order_by=order_by_param,
                 request=request,
                 queryset=issue_queryset,
-                total_count_queryset=total_issue_queryset,
                 on_results=lambda issues: issue_on_results(
                     group_by=group_by, issues=issues, sub_group_by=sub_group_by
                 ),
@@ -305,11 +282,9 @@ class ModuleIssueViewSet(BaseViewSet):
                 project_id=str(project_id),
                 current_instance=json.dumps(
                     {
-                        "module_name": (
-                            module_issue.first().module.name
-                            if (module_issue.first() and module_issue.first().module)
-                            else None
-                        )
+                        "module_name": module_issue.first().module.name
+                        if (module_issue.first() and module_issue.first().module)
+                        else None
                     }
                 ),
                 epoch=int(timezone.now().timestamp()),

apps/api/plane/app/views/page/base.py

@@ -7,6 +7,8 @@ from django.core.serializers.json import DjangoJSONEncoder
 # Django imports
 from django.db import connection
 from django.db.models import Exists, OuterRef, Q, Value, UUIDField
+from django.utils.decorators import method_decorator
+from django.views.decorators.gzip import gzip_page
 from django.http import StreamingHttpResponse
 from django.contrib.postgres.aggregates import ArrayAgg
 from django.contrib.postgres.fields import ArrayField
@@ -19,7 +21,9 @@ from rest_framework.response import Response
 # Module imports
 from plane.app.permissions import allow_permission, ROLE
 from plane.app.serializers import (
+    PageLogSerializer,
     PageSerializer,
+    SubPageSerializer,
     PageDetailSerializer,
     PageBinaryUpdateSerializer,
 )
@@ -33,14 +37,12 @@ from plane.db.models import (
     UserRecentVisit,
 )
 from plane.utils.error_codes import ERROR_CODES
-
-# Local imports
 from ..base import BaseAPIView, BaseViewSet
 from plane.bgtasks.page_transaction_task import page_transaction
 from plane.bgtasks.page_version_task import page_version
 from plane.bgtasks.recent_visited_task import recent_visited_task
 from plane.bgtasks.copy_s3_object import copy_s3_objects_of_description_and_assets
-from plane.app.permissions import ProjectPagePermission
+
 
 def unarchive_archive_page_and_descendants(page_id, archived_at):
     # Your SQL query
@@ -61,7 +63,6 @@ def unarchive_archive_page_and_descendants(page_id, archived_at):
 class PageViewSet(BaseViewSet):
     serializer_class = PageSerializer
     model = Page
-    permission_classes = [ProjectPagePermission]
     search_fields = ["name"]
 
     def get_queryset(self):
@@ -116,6 +117,7 @@ class PageViewSet(BaseViewSet):
             .distinct()
         )
 
+    @allow_permission([ROLE.ADMIN, ROLE.MEMBER])
     def create(self, request, slug, project_id):
         serializer = PageSerializer(
             data=request.data,
@@ -137,10 +139,11 @@ class PageViewSet(BaseViewSet):
             return Response(serializer.data, status=status.HTTP_201_CREATED)
         return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
 
-    def partial_update(self, request, slug, project_id, page_id):
+    @allow_permission([ROLE.ADMIN, ROLE.MEMBER])
+    def partial_update(self, request, slug, project_id, pk):
         try:
             page = Page.objects.get(
-                pk=page_id, workspace__slug=slug, projects__id=project_id
+                pk=pk, workspace__slug=slug, projects__id=project_id
             )
 
             if page.is_locked:
@@ -178,21 +181,23 @@ class PageViewSet(BaseViewSet):
                             {"description_html": page_description},
                             cls=DjangoJSONEncoder,
                         ),
-                        page_id=page_id,
+                        page_id=pk,
                     )
 
                 return Response(serializer.data, status=status.HTTP_200_OK)
             return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
         except Page.DoesNotExist:
             return Response(
-                {"error": "Access cannot be updated since this page is owned by someone else"},
+                {
+                    "error": "Access cannot be updated since this page is owned by someone else"
+                },
                 status=status.HTTP_400_BAD_REQUEST,
             )
 
-    def retrieve(self, request, slug, project_id, page_id=None):
-        page = self.get_queryset().filter(pk=page_id).first()
+    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
+    def retrieve(self, request, slug, project_id, pk=None):
+        page = self.get_queryset().filter(pk=pk).first()
         project = Project.objects.get(pk=project_id)
-        track_visit = request.query_params.get("track_visit", "true").lower() == "true"
 
         """
         if the role is guest and guest_view_all_features is false and owned by is not
@@ -221,32 +226,33 @@ class PageViewSet(BaseViewSet):
             )
         else:
             issue_ids = PageLog.objects.filter(
-                page_id=page_id, entity_name="issue"
+                page_id=pk, entity_name="issue"
             ).values_list("entity_identifier", flat=True)
             data = PageDetailSerializer(page).data
             data["issue_ids"] = issue_ids
-            if track_visit:
-                recent_visited_task.delay(
-                    slug=slug,
-                    entity_name="page",
-                    entity_identifier=page_id,
-                    user_id=request.user.id,
-                    project_id=project_id,
-                )
+            recent_visited_task.delay(
+                slug=slug,
+                entity_name="page",
+                entity_identifier=pk,
+                user_id=request.user.id,
+                project_id=project_id,
+            )
             return Response(data, status=status.HTTP_200_OK)
 
-    def lock(self, request, slug, project_id, page_id):
+    @allow_permission([ROLE.ADMIN], model=Page, creator=True)
+    def lock(self, request, slug, project_id, pk):
         page = Page.objects.filter(
-            pk=page_id, workspace__slug=slug, projects__id=project_id
+            pk=pk, workspace__slug=slug, projects__id=project_id
         ).first()
 
         page.is_locked = True
         page.save()
         return Response(status=status.HTTP_204_NO_CONTENT)
 
-    def unlock(self, request, slug, project_id, page_id):
+    @allow_permission([ROLE.ADMIN], model=Page, creator=True)
+    def unlock(self, request, slug, project_id, pk):
         page = Page.objects.filter(
-            pk=page_id, workspace__slug=slug, projects__id=project_id
+            pk=pk, workspace__slug=slug, projects__id=project_id
         ).first()
 
         page.is_locked = False
@@ -254,10 +260,11 @@ class PageViewSet(BaseViewSet):
 
         return Response(status=status.HTTP_204_NO_CONTENT)
 
-    def access(self, request, slug, project_id, page_id):
+    @allow_permission([ROLE.ADMIN], model=Page, creator=True)
+    def access(self, request, slug, project_id, pk):
         access = request.data.get("access", 0)
         page = Page.objects.filter(
-            pk=page_id, workspace__slug=slug, projects__id=project_id
+            pk=pk, workspace__slug=slug, projects__id=project_id
         ).first()
 
         # Only update access if the page owner is the requesting user
@@ -266,7 +273,9 @@ class PageViewSet(BaseViewSet):
             and page.owned_by_id != request.user.id
         ):
             return Response(
-                {"error": "Access cannot be updated since this page is owned by someone else"},
+                {
+                    "error": "Access cannot be updated since this page is owned by someone else"
+                },
                 status=status.HTTP_400_BAD_REQUEST,
             )
 
@@ -274,6 +283,7 @@ class PageViewSet(BaseViewSet):
         page.save()
         return Response(status=status.HTTP_204_NO_CONTENT)
 
+    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
     def list(self, request, slug, project_id):
         queryset = self.get_queryset()
         project = Project.objects.get(pk=project_id)
@@ -291,10 +301,9 @@ class PageViewSet(BaseViewSet):
         pages = PageSerializer(queryset, many=True).data
         return Response(pages, status=status.HTTP_200_OK)
 
-    def archive(self, request, slug, project_id, page_id):
-        page = Page.objects.get(
-            pk=page_id, workspace__slug=slug, projects__id=project_id
-        )
+    @allow_permission([ROLE.ADMIN], model=Page, creator=True)
+    def archive(self, request, slug, project_id, pk):
+        page = Page.objects.get(pk=pk, workspace__slug=slug, projects__id=project_id)
 
         # only the owner or admin can archive the page
         if (
@@ -310,19 +319,18 @@ class PageViewSet(BaseViewSet):
 
         UserFavorite.objects.filter(
             entity_type="page",
-            entity_identifier=page_id,
+            entity_identifier=pk,
             project_id=project_id,
             workspace__slug=slug,
         ).delete()
 
-        unarchive_archive_page_and_descendants(page_id, datetime.now())
+        unarchive_archive_page_and_descendants(pk, datetime.now())
 
         return Response({"archived_at": str(datetime.now())}, status=status.HTTP_200_OK)
 
-    def unarchive(self, request, slug, project_id, page_id):
-        page = Page.objects.get(
-            pk=page_id, workspace__slug=slug, projects__id=project_id
-        )
+    @allow_permission([ROLE.ADMIN], model=Page, creator=True)
+    def unarchive(self, request, slug, project_id, pk):
+        page = Page.objects.get(pk=pk, workspace__slug=slug, projects__id=project_id)
 
         # only the owner or admin can un archive the page
         if (
@@ -336,19 +344,18 @@ class PageViewSet(BaseViewSet):
                 status=status.HTTP_400_BAD_REQUEST,
             )
 
-        # if parent archived then page will be un archived breaking hierarchy
+        # if parent page is archived then the page will be un archived breaking the hierarchy
         if page.parent_id and page.parent.archived_at:
             page.parent = None
             page.save(update_fields=["parent"])
 
-        unarchive_archive_page_and_descendants(page_id, None)
+        unarchive_archive_page_and_descendants(pk, None)
 
         return Response(status=status.HTTP_204_NO_CONTENT)
 
-    def destroy(self, request, slug, project_id, page_id):
-        page = Page.objects.get(
-            pk=page_id, workspace__slug=slug, projects__id=project_id
-        )
+    @allow_permission([ROLE.ADMIN], model=Page, creator=True)
+    def destroy(self, request, slug, project_id, pk):
+        page = Page.objects.get(pk=pk, workspace__slug=slug, projects__id=project_id)
 
         if page.archived_at is None:
             return Response(
@@ -372,7 +379,7 @@ class PageViewSet(BaseViewSet):
 
         # remove parent from all the children
         _ = Page.objects.filter(
-            parent_id=page_id, projects__id=project_id, workspace__slug=slug
+            parent_id=pk, projects__id=project_id, workspace__slug=slug
         ).update(parent=None)
 
         page.delete()
@@ -380,14 +387,14 @@ class PageViewSet(BaseViewSet):
         UserFavorite.objects.filter(
             project=project_id,
             workspace__slug=slug,
-            entity_identifier=page_id,
+            entity_identifier=pk,
             entity_type="page",
         ).delete()
         # Delete the page from recent visit
         UserRecentVisit.objects.filter(
             project_id=project_id,
             workspace__slug=slug,
-            entity_identifier=page_id,
+            entity_identifier=pk,
             entity_name="page",
         ).delete(soft=False)
         return Response(status=status.HTTP_204_NO_CONTENT)
@@ -397,36 +404,88 @@ class PageFavoriteViewSet(BaseViewSet):
     model = UserFavorite
 
     @allow_permission([ROLE.ADMIN, ROLE.MEMBER])
-    def create(self, request, slug, project_id, page_id):
+    def create(self, request, slug, project_id, pk):
         _ = UserFavorite.objects.create(
             project_id=project_id,
-            entity_identifier=page_id,
+            entity_identifier=pk,
             entity_type="page",
             user=request.user,
         )
         return Response(status=status.HTTP_204_NO_CONTENT)
 
     @allow_permission([ROLE.ADMIN, ROLE.MEMBER])
-    def destroy(self, request, slug, project_id, page_id):
+    def destroy(self, request, slug, project_id, pk):
         page_favorite = UserFavorite.objects.get(
             project=project_id,
             user=request.user,
             workspace__slug=slug,
-            entity_identifier=page_id,
+            entity_identifier=pk,
             entity_type="page",
         )
         page_favorite.delete(soft=False)
         return Response(status=status.HTTP_204_NO_CONTENT)
 
 
-class PagesDescriptionViewSet(BaseViewSet):
-    permission_classes = [ProjectPagePermission]
+class PageLogEndpoint(BaseAPIView):
+    serializer_class = PageLogSerializer
+    model = PageLog
 
-    def retrieve(self, request, slug, project_id, page_id):
-        page = (
-            Page.objects.filter(
-                pk=page_id, workspace__slug=slug, projects__id=project_id
+    def post(self, request, slug, project_id, page_id):
+        serializer = PageLogSerializer(data=request.data)
+        if serializer.is_valid():
+            serializer.save(project_id=project_id, page_id=page_id)
+            return Response(serializer.data, status=status.HTTP_201_CREATED)
+        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
+
+    def patch(self, request, slug, project_id, page_id, transaction):
+        page_transaction = PageLog.objects.get(
+            workspace__slug=slug,
+            project_id=project_id,
+            page_id=page_id,
+            transaction=transaction,
+        )
+        serializer = PageLogSerializer(
+            page_transaction, data=request.data, partial=True
+        )
+        if serializer.is_valid():
+            serializer.save()
+            return Response(serializer.data, status=status.HTTP_200_OK)
+        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
+
+    def delete(self, request, slug, project_id, page_id, transaction):
+        transaction = PageLog.objects.get(
+            workspace__slug=slug,
+            project_id=project_id,
+            page_id=page_id,
+            transaction=transaction,
+        )
+        # Delete the transaction object
+        transaction.delete()
+        return Response(status=status.HTTP_204_NO_CONTENT)
+
+
+class SubPagesEndpoint(BaseAPIView):
+    @method_decorator(gzip_page)
+    def get(self, request, slug, project_id, page_id):
+        pages = (
+            PageLog.objects.filter(
+                page_id=page_id,
+                workspace__slug=slug,
+                entity_name__in=["forward_link", "back_link"],
             )
+            .select_related("project")
+            .select_related("workspace")
+        )
+        return Response(
+            SubPageSerializer(pages, many=True).data, status=status.HTTP_200_OK
+        )
+
+
+class PagesDescriptionViewSet(BaseViewSet):
+    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
+    def retrieve(self, request, slug, project_id, pk):
+        page = (
+            Page.objects.filter(pk=pk, workspace__slug=slug, projects__id=project_id)
             .filter(Q(owned_by=self.request.user) | Q(access=0))
             .first()
         )
@@ -446,11 +505,10 @@ class PagesDescriptionViewSet(BaseViewSet):
         response["Content-Disposition"] = 'attachment; filename="page_description.bin"'
         return response
 
-    def partial_update(self, request, slug, project_id, page_id):
+    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
+    def partial_update(self, request, slug, project_id, pk):
         page = (
-            Page.objects.filter(
-                pk=page_id, workspace__slug=slug, projects__id=project_id
-            )
+            Page.objects.filter(pk=pk, workspace__slug=slug, projects__id=project_id)
             .filter(Q(owned_by=self.request.user) | Q(access=0))
             .first()
         )
@@ -487,7 +545,7 @@ class PagesDescriptionViewSet(BaseViewSet):
             # Capture the page transaction
             if request.data.get("description_html"):
                 page_transaction.delay(
-                    new_value=request.data, old_value=existing_instance, page_id=page_id
+                    new_value=request.data, old_value=existing_instance, page_id=pk
                 )
 
             # Update the page using serializer
@@ -505,7 +563,7 @@ class PagesDescriptionViewSet(BaseViewSet):
 
 
 class PageDuplicateEndpoint(BaseAPIView):
-    permission_classes = [ProjectPagePermission]
+    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
     def post(self, request, slug, project_id, page_id):
         page = Page.objects.filter(
             pk=page_id, workspace__slug=slug, projects__id=project_id

apps/api/plane/app/views/page/version.py

@@ -7,12 +7,10 @@ from plane.db.models import PageVersion
 from ..base import BaseAPIView
 from plane.app.serializers import PageVersionSerializer, PageVersionDetailSerializer
 from plane.app.permissions import allow_permission, ROLE
-from plane.app.permissions import ProjectPagePermission
+
 
 class PageVersionEndpoint(BaseAPIView):
-
-    permission_classes = [ProjectPagePermission]
-
+    @allow_permission(allowed_roles=[ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
     def get(self, request, slug, project_id, page_id, pk=None):
         # Check if pk is provided
         if pk:

apps/api/plane/app/views/project/base.py

@@ -5,12 +5,13 @@ from django.utils import timezone
 import json
 
 # Django imports
+from django.db import IntegrityError
 from django.db.models import Exists, F, OuterRef, Prefetch, Q, Subquery
 from django.core.serializers.json import DjangoJSONEncoder
 
 # Third Party imports
 from rest_framework.response import Response
-from rest_framework import status
+from rest_framework import serializers, status
 from rest_framework.permissions import AllowAny
 
 # Module imports
@@ -105,10 +106,7 @@ class ProjectViewSet(BaseViewSet):
         fields = [field for field in request.GET.get("fields", "").split(",") if field]
         projects = self.get_queryset().order_by("sort_order", "name")
         if WorkspaceMember.objects.filter(
-            member=request.user,
-            workspace__slug=slug,
-            is_active=True,
-            role=ROLE.GUEST.value,
+            member=request.user, workspace__slug=slug, is_active=True, role=5
         ).exists():
             projects = projects.filter(
                 project_projectmember__member=self.request.user,
@@ -116,10 +114,7 @@ class ProjectViewSet(BaseViewSet):
             )
 
         if WorkspaceMember.objects.filter(
-            member=request.user,
-            workspace__slug=slug,
-            is_active=True,
-            role=ROLE.MEMBER.value,
+            member=request.user, workspace__slug=slug, is_active=True, role=15
         ).exists():
             projects = projects.filter(
                 Q(
@@ -194,10 +189,7 @@ class ProjectViewSet(BaseViewSet):
         )
 
         if WorkspaceMember.objects.filter(
-            member=request.user,
-            workspace__slug=slug,
-            is_active=True,
-            role=ROLE.GUEST.value,
+            member=request.user, workspace__slug=slug, is_active=True, role=5
         ).exists():
             projects = projects.filter(
                 project_projectmember__member=self.request.user,
@@ -205,10 +197,7 @@ class ProjectViewSet(BaseViewSet):
             )
 
         if WorkspaceMember.objects.filter(
-            member=request.user,
-            workspace__slug=slug,
-            is_active=True,
-            role=ROLE.MEMBER.value,
+            member=request.user, workspace__slug=slug, is_active=True, role=15
         ).exists():
             projects = projects.filter(
                 Q(
@@ -261,9 +250,7 @@ class ProjectViewSet(BaseViewSet):
 
             # Add the user as Administrator to the project
             _ = ProjectMember.objects.create(
-                project_id=serializer.data["id"],
-                member=request.user,
-                role=ROLE.ADMIN.value,
+                project_id=serializer.data["id"], member=request.user, role=20
             )
             # Also create the issue property for the user
             _ = IssueUserProperty.objects.create(
@@ -276,7 +263,7 @@ class ProjectViewSet(BaseViewSet):
                 ProjectMember.objects.create(
                     project_id=serializer.data["id"],
                     member_id=serializer.data["project_lead"],
-                    role=ROLE.ADMIN.value,
+                    role=20,
                 )
                 # Also create the issue property for the user
                 IssueUserProperty.objects.create(
@@ -354,23 +341,13 @@ class ProjectViewSet(BaseViewSet):
 
     def partial_update(self, request, slug, pk=None):
         # try:
-        is_workspace_admin = WorkspaceMember.objects.filter(
-            member=request.user,
-            workspace__slug=slug,
-            is_active=True,
-            role=ROLE.ADMIN.value,
-        ).exists()
-
-        is_project_admin = ProjectMember.objects.filter(
+        if not ProjectMember.objects.filter(
             member=request.user,
             workspace__slug=slug,
             project_id=pk,
-            role=ROLE.ADMIN.value,
+            role=20,
             is_active=True,
-        ).exists()
-
-        # Return error for if the user is neither workspace admin nor project admin
-        if not is_project_admin and not is_workspace_admin:
+        ).exists():
             return Response(
                 {"error": "You don't have the required permissions."},
                 status=status.HTTP_403_FORBIDDEN,
@@ -425,16 +402,13 @@ class ProjectViewSet(BaseViewSet):
     def destroy(self, request, slug, pk):
         if (
             WorkspaceMember.objects.filter(
-                member=request.user,
-                workspace__slug=slug,
-                is_active=True,
-                role=ROLE.ADMIN.value,
+                member=request.user, workspace__slug=slug, is_active=True, role=20
             ).exists()
             or ProjectMember.objects.filter(
                 member=request.user,
                 workspace__slug=slug,
                 project_id=pk,
-                role=ROLE.ADMIN.value,
+                role=20,
                 is_active=True,
             ).exists()
         ):

apps/api/plane/app/views/view/base.py

@@ -1,5 +1,3 @@
-import copy
-
 # Django imports
 from django.db.models import (
     Exists,
@@ -41,8 +39,6 @@ from plane.utils.order_queryset import order_issue_queryset
 from plane.bgtasks.recent_visited_task import recent_visited_task
 from .. import BaseViewSet
 from plane.db.models import UserFavorite
-from plane.utils.filters import ComplexFilterBackend
-from plane.utils.filters import IssueFilterSet
 
 
 class WorkspaceViewViewSet(BaseViewSet):
@@ -60,6 +56,7 @@ class WorkspaceViewViewSet(BaseViewSet):
             .filter(workspace__slug=self.kwargs.get("slug"))
             .filter(project__isnull=True)
             .filter(Q(owned_by=self.request.user) | Q(access=1))
+            .select_related("workspace")
             .order_by(self.request.GET.get("order_by", "-created_at"))
             .distinct()
         )
@@ -148,9 +145,6 @@ class WorkspaceViewViewSet(BaseViewSet):
 
 
 class WorkspaceViewIssuesViewSet(BaseViewSet):
-    filter_backends = (ComplexFilterBackend,)
-    filterset_class = IssueFilterSet
-
     def _get_project_permission_filters(self):
         """
         Get common project permission filters for guest users and role-based access control.
@@ -173,9 +167,35 @@ class WorkspaceViewIssuesViewSet(BaseViewSet):
             project__project_projectmember__is_active=True,
         )
 
-    def apply_annotations(self, issues):
+    def get_queryset(self):
         return (
-            issues.annotate(
+            Issue.issue_objects.annotate(
+                sub_issues_count=Issue.issue_objects.filter(parent=OuterRef("id"))
+                .order_by()
+                .annotate(count=Func(F("id"), function="Count"))
+                .values("count")
+            )
+            .filter(workspace__slug=self.kwargs.get("slug"))
+            .select_related("state")
+            .prefetch_related(
+                Prefetch(
+                    "issue_assignee",
+                    queryset=IssueAssignee.objects.all(),
+                )
+            )
+            .prefetch_related(
+                Prefetch(
+                    "label_issue",
+                    queryset=IssueLabel.objects.all(),
+                )
+            )
+            .prefetch_related(
+                Prefetch(
+                    "issue_module",
+                    queryset=ModuleIssue.objects.all(),
+                )
+            )
+            .annotate(
                 cycle_id=Subquery(
                     CycleIssue.objects.filter(
                         issue=OuterRef("id"), deleted_at__isnull=True
@@ -203,56 +223,31 @@ class WorkspaceViewIssuesViewSet(BaseViewSet):
                 .annotate(count=Func(F("id"), function="Count"))
                 .values("count")
             )
-            .prefetch_related(
-                Prefetch(
-                    "issue_assignee",
-                    queryset=IssueAssignee.objects.all(),
-                )
-            )
-            .prefetch_related(
-                Prefetch(
-                    "label_issue",
-                    queryset=IssueLabel.objects.all(),
-                )
-            )
-            .prefetch_related(
-                Prefetch(
-                    "issue_module",
-                    queryset=ModuleIssue.objects.all(),
-                )
-            )
         )
 
-    def get_queryset(self):
-        return Issue.issue_objects.filter(workspace__slug=self.kwargs.get("slug"))
-
     @method_decorator(gzip_page)
     @allow_permission(
         allowed_roles=[ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST], level="WORKSPACE"
     )
     def list(self, request, slug):
-        issue_queryset = self.get_queryset()
-
-        # Apply filtering from filterset
-        issue_queryset = self.filter_queryset(issue_queryset)
-
+        filters = issue_filters(request.query_params, "GET")
         order_by_param = request.GET.get("order_by", "-created_at")
 
-        # Apply legacy filters
-        filters = issue_filters(request.query_params, "GET")
-        issue_queryset = issue_queryset.filter(**filters)
+        issue_queryset = self.get_queryset().filter(**filters)
 
         # Get common project permission filters
         permission_filters = self._get_project_permission_filters()
-        # Apply project permission filters to the issue queryset
-        issue_queryset = issue_queryset.filter(permission_filters)
 
         # Base query for the counts
-        total_issue_count_queryset = copy.deepcopy(issue_queryset)
-        total_issue_count_queryset = total_issue_count_queryset.only("id")
+        total_issue_count = (
+            Issue.issue_objects.filter(**filters)
+            .filter(workspace__slug=slug)
+            .filter(permission_filters)
+            .only("id")
+        )
 
-        # Apply annotations to the issue queryset
-        issue_queryset = self.apply_annotations(issue_queryset)
+        # Apply project permission filters to the issue queryset
+        issue_queryset = issue_queryset.filter(permission_filters)
 
         # Issue queryset
         issue_queryset, order_by_param = order_issue_queryset(
@@ -265,7 +260,7 @@ class WorkspaceViewIssuesViewSet(BaseViewSet):
             request=request,
             queryset=issue_queryset,
             on_results=lambda issues: ViewIssueListSerializer(issues, many=True).data,
-            total_count_queryset=total_issue_count_queryset,
+            total_count_queryset=total_issue_count,
         )
 
 

apps/api/plane/app/views/workspace/draft.py

@@ -172,14 +172,12 @@ class WorkspaceDraftIssueViewSet(BaseViewSet):
                 {"error": "Issue not found"}, status=status.HTTP_404_NOT_FOUND
             )
 
-        project_id = request.data.get("project_id", issue.project_id)
-
         serializer = DraftIssueCreateSerializer(
             issue,
             data=request.data,
             partial=True,
             context={
-                "project_id": project_id,
+                "project_id": request.data.get("project_id", None),
                 "cycle_id": request.data.get("cycle_id", "not_provided"),
             },
         )

apps/api/plane/app/views/workspace/state.py

@@ -7,6 +7,7 @@ from plane.app.serializers import StateSerializer
 from plane.app.views.base import BaseAPIView
 from plane.db.models import State
 from plane.app.permissions import WorkspaceEntityPermission
+from plane.utils.cache import cache_response
 from collections import defaultdict
 
 
@@ -14,6 +15,7 @@ class WorkspaceStatesEndpoint(BaseAPIView):
     permission_classes = [WorkspaceEntityPermission]
     use_read_replica = True
 
+    @cache_response(60 * 60 * 2)
     def get(self, request, slug):
         states = State.objects.filter(
             workspace__slug=slug,

apps/api/plane/app/views/workspace/user.py

@@ -1,5 +1,4 @@
 # Python imports
-import copy
 from datetime import date
 
 from dateutil.relativedelta import relativedelta
@@ -57,8 +56,6 @@ from plane.utils.grouper import (
 from plane.utils.issue_filters import issue_filters
 from plane.utils.order_queryset import order_issue_queryset
 from plane.utils.paginator import GroupedOffsetPaginator, SubGroupedOffsetPaginator
-from plane.utils.filters import ComplexFilterBackend
-from plane.utils.filters import IssueFilterSet
 
 
 class UserLastProjectWithWorkspaceEndpoint(BaseAPIView):
@@ -94,12 +91,23 @@ class UserLastProjectWithWorkspaceEndpoint(BaseAPIView):
 class WorkspaceUserProfileIssuesEndpoint(BaseAPIView):
     permission_classes = [WorkspaceViewerPermission]
 
-    filter_backends = (ComplexFilterBackend,)
-    filterset_class = IssueFilterSet
+    def get(self, request, slug, user_id):
+        filters = issue_filters(request.query_params, "GET")
 
-    def apply_annotations(self, issues):
-        return (
-            issues.annotate(
+        order_by_param = request.GET.get("order_by", "-created_at")
+        issue_queryset = (
+            Issue.issue_objects.filter(
+                Q(assignees__in=[user_id])
+                | Q(created_by_id=user_id)
+                | Q(issue_subscribers__subscriber_id=user_id),
+                workspace__slug=slug,
+                project__project_projectmember__member=request.user,
+                project__project_projectmember__is_active=True,
+            )
+            .filter(**filters)
+            .select_related("workspace", "project", "state", "parent")
+            .prefetch_related("assignees", "labels", "issue_module__module")
+            .annotate(
                 cycle_id=Subquery(
                     CycleIssue.objects.filter(
                         issue=OuterRef("id"), deleted_at__isnull=True
@@ -127,36 +135,8 @@ class WorkspaceUserProfileIssuesEndpoint(BaseAPIView):
                 .annotate(count=Func(F("id"), function="Count"))
                 .values("count")
             )
-            .prefetch_related("assignees", "labels", "issue_module__module")
-        )
-
-    def get(self, request, slug, user_id):
-        filters = issue_filters(request.query_params, "GET")
-
-        order_by_param = request.GET.get("order_by", "-created_at")
-        issue_queryset = Issue.issue_objects.filter(
-            id__in=Issue.issue_objects.filter(
-                Q(assignees__in=[user_id])
-                | Q(created_by_id=user_id)
-                | Q(issue_subscribers__subscriber_id=user_id),
-                workspace__slug=slug,
-            ).values_list("id", flat=True),
-            workspace__slug=slug,
-            project__project_projectmember__member=request.user,
-            project__project_projectmember__is_active=True,
-        )
-
-        # Apply filtering from filterset
-        issue_queryset = self.filter_queryset(issue_queryset)
-
-        # Apply legacy filters
-        issue_queryset = issue_queryset.filter(**filters)
-
-        # Total count queryset
-        total_issue_queryset = copy.deepcopy(issue_queryset)
-
-        # Apply annotations to the issue queryset
-        issue_queryset = self.apply_annotations(issue_queryset)
+            .order_by("created_at")
+        ).distinct()
 
         # Issue queryset
         issue_queryset, order_by_param = order_issue_queryset(
@@ -177,7 +157,7 @@ class WorkspaceUserProfileIssuesEndpoint(BaseAPIView):
                 if group_by == sub_group_by:
                     return Response(
                         {
-                            "error": "Group by and sub group by cannot have same parameters"  # noqa: E501
+                            "error": "Group by and sub group by cannot have same parameters"
                         },
                         status=status.HTTP_400_BAD_REQUEST,
                     )
@@ -186,22 +166,15 @@ class WorkspaceUserProfileIssuesEndpoint(BaseAPIView):
                         request=request,
                         order_by=order_by_param,
                         queryset=issue_queryset,
-                        total_count_queryset=total_issue_queryset,
                         on_results=lambda issues: issue_on_results(
                             group_by=group_by, issues=issues, sub_group_by=sub_group_by
                         ),
                         paginator_cls=SubGroupedOffsetPaginator,
                         group_by_fields=issue_group_values(
-                            field=group_by,
-                            slug=slug,
-                            filters=filters,
-                            queryset=total_issue_queryset,
+                            field=group_by, slug=slug, filters=filters
                         ),
                         sub_group_by_fields=issue_group_values(
-                            field=sub_group_by,
-                            slug=slug,
-                            filters=filters,
-                            queryset=total_issue_queryset,
+                            field=sub_group_by, slug=slug, filters=filters
                         ),
                         group_by_field_name=group_by,
                         sub_group_by_field_name=sub_group_by,
@@ -220,16 +193,12 @@ class WorkspaceUserProfileIssuesEndpoint(BaseAPIView):
                     request=request,
                     order_by=order_by_param,
                     queryset=issue_queryset,
-                    total_count_queryset=total_issue_queryset,
                     on_results=lambda issues: issue_on_results(
                         group_by=group_by, issues=issues, sub_group_by=sub_group_by
                     ),
                     paginator_cls=GroupedOffsetPaginator,
                     group_by_fields=issue_group_values(
-                        field=group_by,
-                        slug=slug,
-                        filters=filters,
-                        queryset=total_issue_queryset,
+                        field=group_by, slug=slug, filters=filters
                     ),
                     group_by_field_name=group_by,
                     count_filter=Q(
@@ -246,7 +215,6 @@ class WorkspaceUserProfileIssuesEndpoint(BaseAPIView):
                 order_by=order_by_param,
                 request=request,
                 queryset=issue_queryset,
-                total_count_queryset=total_issue_queryset,
                 on_results=lambda issues: issue_on_results(
                     group_by=group_by, issues=issues, sub_group_by=sub_group_by
                 ),
@@ -264,9 +232,6 @@ class WorkspaceUserPropertiesEndpoint(BaseAPIView):
         workspace_properties.filters = request.data.get(
             "filters", workspace_properties.filters
         )
-        workspace_properties.rich_filters = request.data.get(
-            "rich_filters", workspace_properties.rich_filters
-        )
         workspace_properties.display_filters = request.data.get(
             "display_filters", workspace_properties.display_filters
         )

apps/api/plane/authentication/views/app/email.py

@@ -1,3 +1,6 @@
+# Python imports
+from urllib.parse import urlencode, urljoin
+
 # Django imports
 from django.core.exceptions import ValidationError
 from django.core.validators import validate_email
@@ -16,7 +19,7 @@ from plane.authentication.adapter.error import (
     AuthenticationException,
     AUTHENTICATION_ERROR_CODES,
 )
-from plane.utils.path_validator import get_safe_redirect_url
+from plane.utils.path_validator import validate_next_path
 
 
 class SignInAuthEndpoint(View):
@@ -31,11 +34,11 @@ class SignInAuthEndpoint(View):
                 error_message="INSTANCE_NOT_CONFIGURED",
             )
             params = exc.get_error_dict()
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
             # Base URL join
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params,
+            url = urljoin(
+                base_host(request=request, is_app=True), "sign-in?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
 
@@ -55,10 +58,10 @@ class SignInAuthEndpoint(View):
             )
             params = exc.get_error_dict()
             # Next path
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params,
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "sign-in?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
 
@@ -73,10 +76,10 @@ class SignInAuthEndpoint(View):
                 payload={"email": str(email)},
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params,
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "sign-in?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
 
@@ -89,10 +92,10 @@ class SignInAuthEndpoint(View):
                 payload={"email": str(email)},
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params,
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "sign-in?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
 
@@ -109,23 +112,19 @@ class SignInAuthEndpoint(View):
             user_login(request=request, user=user, is_app=True)
             # Get the redirection path
             if next_path:
-                path = next_path
+                path = str(validate_next_path(next_path))
             else:
                 path = get_redirection_path(user=user)
 
-            # Get the safe redirect URL
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=path,
-                params={},
-            )
+            # redirect to referer path
+            url = urljoin(base_host(request=request, is_app=True), path)
             return HttpResponseRedirect(url)
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params,
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "sign-in?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
 
@@ -142,10 +141,10 @@ class SignUpAuthEndpoint(View):
                 error_message="INSTANCE_NOT_CONFIGURED",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params,
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
 
@@ -162,10 +161,10 @@ class SignUpAuthEndpoint(View):
                 payload={"email": str(email)},
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params,
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
         # Validate the email
@@ -180,10 +179,10 @@ class SignUpAuthEndpoint(View):
                 payload={"email": str(email)},
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params,
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
 
@@ -198,10 +197,10 @@ class SignUpAuthEndpoint(View):
                 payload={"email": str(email)},
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params,
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
 
@@ -218,21 +217,17 @@ class SignUpAuthEndpoint(View):
             user_login(request=request, user=user, is_app=True)
             # Get the redirection path
             if next_path:
-                path = next_path
+                path = str(validate_next_path(next_path))
             else:
                 path = get_redirection_path(user=user)
-
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=path,
-                params={},
-            )
+            # redirect to referer path
+            url = urljoin(base_host(request=request, is_app=True), path)
             return HttpResponseRedirect(url)
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params,
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "?" + urlencode(params)
             )
             return HttpResponseRedirect(url)

apps/api/plane/authentication/views/app/github.py

@@ -1,5 +1,5 @@
-# Python imports
 import uuid
+from urllib.parse import urlencode, urljoin
 
 # Django import
 from django.http import HttpResponseRedirect
@@ -16,7 +16,8 @@ from plane.authentication.adapter.error import (
     AuthenticationException,
     AUTHENTICATION_ERROR_CODES,
 )
-from plane.utils.path_validator import get_safe_redirect_url
+from plane.utils.path_validator import validate_next_path
+
 
 class GitHubOauthInitiateEndpoint(View):
     def get(self, request):
@@ -34,10 +35,10 @@ class GitHubOauthInitiateEndpoint(View):
                 error_message="INSTANCE_NOT_CONFIGURED",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
         try:
@@ -48,10 +49,10 @@ class GitHubOauthInitiateEndpoint(View):
             return HttpResponseRedirect(auth_url)
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
 
@@ -60,6 +61,7 @@ class GitHubCallbackEndpoint(View):
     def get(self, request):
         code = request.GET.get("code")
         state = request.GET.get("state")
+        base_host = request.session.get("host")
         next_path = request.session.get("next_path")
 
         if state != request.session.get("state", ""):
@@ -68,11 +70,9 @@ class GitHubCallbackEndpoint(View):
                 error_message="GITHUB_OAUTH_PROVIDER_ERROR",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(base_host, "?" + urlencode(params))
             return HttpResponseRedirect(url)
 
         if not code:
@@ -81,11 +81,9 @@ class GitHubCallbackEndpoint(View):
                 error_message="GITHUB_OAUTH_PROVIDER_ERROR",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(base_host, "?" + urlencode(params))
             return HttpResponseRedirect(url)
 
         try:
@@ -95,23 +93,17 @@ class GitHubCallbackEndpoint(View):
             user = provider.authenticate()
             # Login the user and record his device info
             user_login(request=request, user=user, is_app=True)
+            # Get the redirection path
             if next_path:
-                path = next_path
+                path = str(validate_next_path(next_path))
             else:
                 path = get_redirection_path(user=user)
-
-            # Get the safe redirect URL
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=path,
-                params={}
-            )
+            # redirect to referer path
+            url = urljoin(base_host, path)
             return HttpResponseRedirect(url)
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(base_host, "?" + urlencode(params))
             return HttpResponseRedirect(url)

apps/api/plane/authentication/views/app/gitlab.py

@@ -1,5 +1,5 @@
-# Python imports
 import uuid
+from urllib.parse import urlencode, urljoin
 
 # Django import
 from django.http import HttpResponseRedirect
@@ -16,7 +16,7 @@ from plane.authentication.adapter.error import (
     AuthenticationException,
     AUTHENTICATION_ERROR_CODES,
 )
-from plane.utils.path_validator import get_safe_redirect_url
+from plane.utils.path_validator import validate_next_path
 
 
 class GitLabOauthInitiateEndpoint(View):
@@ -25,7 +25,7 @@ class GitLabOauthInitiateEndpoint(View):
         request.session["host"] = base_host(request=request, is_app=True)
         next_path = request.GET.get("next_path")
         if next_path:
-            request.session["next_path"] = str(next_path)
+            request.session["next_path"] = str(validate_next_path(next_path))
 
         # Check instance configuration
         instance = Instance.objects.first()
@@ -35,10 +35,10 @@ class GitLabOauthInitiateEndpoint(View):
                 error_message="INSTANCE_NOT_CONFIGURED",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
         try:
@@ -49,10 +49,10 @@ class GitLabOauthInitiateEndpoint(View):
             return HttpResponseRedirect(auth_url)
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
 
@@ -61,6 +61,7 @@ class GitLabCallbackEndpoint(View):
     def get(self, request):
         code = request.GET.get("code")
         state = request.GET.get("state")
+        base_host = request.session.get("host")
         next_path = request.session.get("next_path")
 
         if state != request.session.get("state", ""):
@@ -69,11 +70,9 @@ class GitLabCallbackEndpoint(View):
                 error_message="GITLAB_OAUTH_PROVIDER_ERROR",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(next_path)
+            url = urljoin(base_host, "?" + urlencode(params))
             return HttpResponseRedirect(url)
 
         if not code:
@@ -82,11 +81,9 @@ class GitLabCallbackEndpoint(View):
                 error_message="GITLAB_OAUTH_PROVIDER_ERROR",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(base_host, "?" + urlencode(params))
             return HttpResponseRedirect(url)
 
         try:
@@ -97,23 +94,16 @@ class GitLabCallbackEndpoint(View):
             # Login the user and record his device info
             user_login(request=request, user=user, is_app=True)
             # Get the redirection path
-
             if next_path:
-                path = next_path
+                path = str(validate_next_path(next_path))
             else:
                 path = get_redirection_path(user=user)
             # redirect to referer path
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=path,
-                params={}
-            )
+            url = urljoin(base_host, path)
             return HttpResponseRedirect(url)
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(base_host, "?" + urlencode(params))
             return HttpResponseRedirect(url)

apps/api/plane/authentication/views/app/google.py

@@ -1,5 +1,6 @@
 # Python imports
 import uuid
+from urllib.parse import urlencode, urljoin
 
 # Django import
 from django.http import HttpResponseRedirect
@@ -17,7 +18,7 @@ from plane.authentication.adapter.error import (
     AuthenticationException,
     AUTHENTICATION_ERROR_CODES,
 )
-from plane.utils.path_validator import get_safe_redirect_url
+from plane.utils.path_validator import validate_next_path
 
 
 class GoogleOauthInitiateEndpoint(View):
@@ -35,10 +36,10 @@ class GoogleOauthInitiateEndpoint(View):
                 error_message="INSTANCE_NOT_CONFIGURED",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
 
@@ -50,10 +51,10 @@ class GoogleOauthInitiateEndpoint(View):
             return HttpResponseRedirect(auth_url)
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
 
@@ -62,6 +63,7 @@ class GoogleCallbackEndpoint(View):
     def get(self, request):
         code = request.GET.get("code")
         state = request.GET.get("state")
+        base_host = request.session.get("host")
         next_path = request.session.get("next_path")
 
         if state != request.session.get("state", ""):
@@ -70,11 +72,9 @@ class GoogleCallbackEndpoint(View):
                 error_message="GOOGLE_OAUTH_PROVIDER_ERROR",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(base_host, "?" + urlencode(params))
             return HttpResponseRedirect(url)
         if not code:
             exc = AuthenticationException(
@@ -82,11 +82,9 @@ class GoogleCallbackEndpoint(View):
                 error_message="GOOGLE_OAUTH_PROVIDER_ERROR",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(base_host, "?" + urlencode(params))
             return HttpResponseRedirect(url)
         try:
             provider = GoogleOAuthProvider(
@@ -96,21 +94,15 @@ class GoogleCallbackEndpoint(View):
             # Login the user and record his device info
             user_login(request=request, user=user, is_app=True)
             # Get the redirection path
-            if next_path:
-                path = next_path
-            else:
-                path = get_redirection_path(user=user)
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=path,
-                params={}
+            path = get_redirection_path(user=user)
+            # redirect to referer path
+            url = urljoin(
+                base_host, str(validate_next_path(next_path)) if next_path else path
             )
             return HttpResponseRedirect(url)
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(base_host, "?" + urlencode(params))
             return HttpResponseRedirect(url)

apps/api/plane/authentication/views/app/magic.py

@@ -1,3 +1,6 @@
+# Python imports
+from urllib.parse import urlencode, urljoin
+
 # Django imports
 from django.core.validators import validate_email
 from django.http import HttpResponseRedirect
@@ -23,7 +26,7 @@ from plane.authentication.adapter.error import (
     AUTHENTICATION_ERROR_CODES,
 )
 from plane.authentication.rate_limit import AuthenticationThrottle
-from plane.utils.path_validator import get_safe_redirect_url
+from plane.utils.path_validator import validate_next_path
 
 
 class MagicGenerateEndpoint(APIView):
@@ -69,10 +72,10 @@ class MagicSignInEndpoint(View):
                 error_message="MAGIC_SIGN_IN_EMAIL_CODE_REQUIRED",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params,
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "sign-in?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
 
@@ -85,10 +88,10 @@ class MagicSignInEndpoint(View):
                 error_message="USER_DOES_NOT_EXIST",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params,
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "sign-in?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
 
@@ -104,8 +107,7 @@ class MagicSignInEndpoint(View):
             # Login the user and record his device info
             user_login(request=request, user=user, is_app=True)
             if user.is_password_autoset and profile.is_onboarded:
-                # Redirect to the home page
-                path = "/"
+                path = "accounts/set-password"
             else:
                 # Get the redirection path
                 path = (
@@ -114,19 +116,15 @@ class MagicSignInEndpoint(View):
                     else str(get_redirection_path(user=user))
                 )
             # redirect to referer path
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=path,
-                params={},
-            )
+            url = urljoin(base_host(request=request, is_app=True), path)
             return HttpResponseRedirect(url)
 
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params,
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "sign-in?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
 
@@ -146,10 +144,10 @@ class MagicSignUpEndpoint(View):
                 error_message="MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params,
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
         # Existing user
@@ -160,10 +158,10 @@ class MagicSignUpEndpoint(View):
                 error_message="USER_ALREADY_EXIST",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params,
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "?" + urlencode(params)
             )
             return HttpResponseRedirect(url)
 
@@ -179,22 +177,18 @@ class MagicSignUpEndpoint(View):
             user_login(request=request, user=user, is_app=True)
             # Get the redirection path
             if next_path:
-                path = next_path
+                path = str(validate_next_path(next_path))
             else:
                 path = get_redirection_path(user=user)
             # redirect to referer path
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=path,
-                params={},
-            )
+            url = urljoin(base_host(request=request, is_app=True), path)
             return HttpResponseRedirect(url)
 
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_app=True),
-                next_path=next_path,
-                params=params,
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = urljoin(
+                base_host(request=request, is_app=True), "?" + urlencode(params)
             )
             return HttpResponseRedirect(url)

apps/api/plane/authentication/views/space/email.py

@@ -1,9 +1,11 @@
+# Python imports
+from urllib.parse import urlencode
+
 # Django imports
 from django.core.exceptions import ValidationError
 from django.core.validators import validate_email
 from django.http import HttpResponseRedirect
 from django.views import View
-from django.utils.http import url_has_allowed_host_and_scheme
 
 # Module imports
 from plane.authentication.provider.credentials.email import EmailProvider
@@ -15,7 +17,7 @@ from plane.authentication.adapter.error import (
     AUTHENTICATION_ERROR_CODES,
     AuthenticationException,
 )
-from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts
+from plane.utils.path_validator import validate_next_path
 
 
 class SignInAuthSpaceEndpoint(View):
@@ -30,11 +32,9 @@ class SignInAuthSpaceEndpoint(View):
                 error_message="INSTANCE_NOT_CONFIGURED",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         # set the referer as session to redirect after login
@@ -51,11 +51,9 @@ class SignInAuthSpaceEndpoint(View):
                 payload={"email": str(email)},
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         # Validate email
@@ -69,11 +67,9 @@ class SignInAuthSpaceEndpoint(View):
                 payload={"email": str(email)},
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         # Existing User
@@ -86,11 +82,9 @@ class SignInAuthSpaceEndpoint(View):
                 payload={"email": str(email)},
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         try:
@@ -100,20 +94,14 @@ class SignInAuthSpaceEndpoint(View):
             user = provider.authenticate()
             # Login the user and record his device info
             user_login(request=request, user=user, is_space=True)
-            # redirect to referer path
-            next_path = validate_next_path(next_path=next_path)
-            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
-            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
-                return HttpResponseRedirect(url)
-            else:
-                return HttpResponseRedirect(base_host(request=request, is_space=True))
+            # redirect to next path
+            url = f"{base_host(request=request, is_space=True)}{str(next_path) if next_path else ''}"
+            return HttpResponseRedirect(url)
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
 
@@ -129,11 +117,9 @@ class SignUpAuthSpaceEndpoint(View):
                 error_message="INSTANCE_NOT_CONFIGURED",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         email = request.POST.get("email", False)
@@ -149,11 +135,9 @@ class SignUpAuthSpaceEndpoint(View):
                 payload={"email": str(email)},
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
         # Validate the email
         email = email.strip().lower()
@@ -167,11 +151,9 @@ class SignUpAuthSpaceEndpoint(View):
                 payload={"email": str(email)},
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         # Existing User
@@ -184,11 +166,9 @@ class SignUpAuthSpaceEndpoint(View):
                 payload={"email": str(email)},
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         try:
@@ -199,17 +179,11 @@ class SignUpAuthSpaceEndpoint(View):
             # Login the user and record his device info
             user_login(request=request, user=user, is_space=True)
             # redirect to referer path
-            next_path = validate_next_path(next_path=next_path)
-            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
-            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
-                return HttpResponseRedirect(url)
-            else:
-                return HttpResponseRedirect(base_host(request=request, is_space=True))
+            url = f"{base_host(request=request, is_space=True)}{str(next_path) if next_path else ''}"
+            return HttpResponseRedirect(url)
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)

apps/api/plane/authentication/views/space/github.py

@@ -1,10 +1,10 @@
 # Python imports
 import uuid
+from urllib.parse import urlencode
 
 # Django import
 from django.http import HttpResponseRedirect
 from django.views import View
-from django.utils.http import url_has_allowed_host_and_scheme
 
 # Module imports
 from plane.authentication.provider.oauth.github import GitHubOAuthProvider
@@ -15,7 +15,7 @@ from plane.authentication.adapter.error import (
     AUTHENTICATION_ERROR_CODES,
     AuthenticationException,
 )
-from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts
+from plane.utils.path_validator import validate_next_path
 
 
 class GitHubOauthInitiateSpaceEndpoint(View):
@@ -23,6 +23,9 @@ class GitHubOauthInitiateSpaceEndpoint(View):
         # Get host and next path
         request.session["host"] = base_host(request=request, is_space=True)
         next_path = request.GET.get("next_path")
+        if next_path:
+            request.session["next_path"] = str(next_path)
+
         # Check instance configuration
         instance = Instance.objects.first()
         if instance is None or not instance.is_setup_done:
@@ -31,11 +34,9 @@ class GitHubOauthInitiateSpaceEndpoint(View):
                 error_message="INSTANCE_NOT_CONFIGURED",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         try:
@@ -46,11 +47,9 @@ class GitHubOauthInitiateSpaceEndpoint(View):
             return HttpResponseRedirect(auth_url)
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(next_path)
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
 
@@ -67,11 +66,9 @@ class GitHubCallbackSpaceEndpoint(View):
                 error_message="GITHUB_OAUTH_PROVIDER_ERROR",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         if not code:
@@ -80,11 +77,9 @@ class GitHubCallbackSpaceEndpoint(View):
                 error_message="GITHUB_OAUTH_PROVIDER_ERROR",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         try:
@@ -94,18 +89,11 @@ class GitHubCallbackSpaceEndpoint(View):
             user_login(request=request, user=user, is_space=True)
             # Process workspace and project invitations
             # redirect to referer path
-            next_path = validate_next_path(next_path=next_path)
-            
-            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
-            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
-                return HttpResponseRedirect(url)
-            else:
-                return HttpResponseRedirect(base_host(request=request, is_space=True))
+            url = f"{base_host(request=request, is_space=True)}{str(next_path) if next_path else ''}"
+            return HttpResponseRedirect(url)
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)

apps/api/plane/authentication/views/space/gitlab.py

@@ -1,10 +1,10 @@
 # Python imports
 import uuid
+from urllib.parse import urlencode
 
 # Django import
 from django.http import HttpResponseRedirect
 from django.views import View
-from django.utils.http import url_has_allowed_host_and_scheme
 
 # Module imports
 from plane.authentication.provider.oauth.gitlab import GitLabOAuthProvider
@@ -15,8 +15,7 @@ from plane.authentication.adapter.error import (
     AUTHENTICATION_ERROR_CODES,
     AuthenticationException,
 )
-from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts
-
+from plane.utils.path_validator import validate_next_path
 
 
 class GitLabOauthInitiateSpaceEndpoint(View):
@@ -24,6 +23,8 @@ class GitLabOauthInitiateSpaceEndpoint(View):
         # Get host and next path
         request.session["host"] = base_host(request=request, is_space=True)
         next_path = request.GET.get("next_path")
+        if next_path:
+            request.session["next_path"] = str(next_path)
 
         # Check instance configuration
         instance = Instance.objects.first()
@@ -33,11 +34,9 @@ class GitLabOauthInitiateSpaceEndpoint(View):
                 error_message="INSTANCE_NOT_CONFIGURED",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         try:
@@ -48,11 +47,9 @@ class GitLabOauthInitiateSpaceEndpoint(View):
             return HttpResponseRedirect(auth_url)
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(next_path)
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
 
@@ -69,11 +66,9 @@ class GitLabCallbackSpaceEndpoint(View):
                 error_message="GITLAB_OAUTH_PROVIDER_ERROR",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         if not code:
@@ -82,11 +77,9 @@ class GitLabCallbackSpaceEndpoint(View):
                 error_message="GITLAB_OAUTH_PROVIDER_ERROR",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         try:
@@ -96,18 +89,11 @@ class GitLabCallbackSpaceEndpoint(View):
             user_login(request=request, user=user, is_space=True)
             # Process workspace and project invitations
             # redirect to referer path
-            next_path = validate_next_path(next_path=next_path)
-
-            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
-            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
-                return HttpResponseRedirect(url)
-            else:
-                return HttpResponseRedirect(base_host(request=request, is_space=True))
+            url = f"{base_host(request=request, is_space=True)}{str(next_path) if next_path else ''}"
+            return HttpResponseRedirect(url)
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)

apps/api/plane/authentication/views/space/google.py

@@ -1,10 +1,10 @@
 # Python imports
 import uuid
+from urllib.parse import urlencode
 
 # Django import
 from django.http import HttpResponseRedirect
 from django.views import View
-from django.utils.http import url_has_allowed_host_and_scheme
 
 # Module imports
 from plane.authentication.provider.oauth.google import GoogleOAuthProvider
@@ -15,13 +15,15 @@ from plane.authentication.adapter.error import (
     AuthenticationException,
     AUTHENTICATION_ERROR_CODES,
 )
-from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts
+from plane.utils.path_validator import validate_next_path
 
 
 class GoogleOauthInitiateSpaceEndpoint(View):
     def get(self, request):
         request.session["host"] = base_host(request=request, is_space=True)
         next_path = request.GET.get("next_path")
+        if next_path:
+            request.session["next_path"] = str(next_path)
 
         # Check instance configuration
         instance = Instance.objects.first()
@@ -31,11 +33,9 @@ class GoogleOauthInitiateSpaceEndpoint(View):
                 error_message="INSTANCE_NOT_CONFIGURED",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         try:
@@ -46,11 +46,9 @@ class GoogleOauthInitiateSpaceEndpoint(View):
             return HttpResponseRedirect(auth_url)
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
 
@@ -67,11 +65,9 @@ class GoogleCallbackSpaceEndpoint(View):
                 error_message="GOOGLE_OAUTH_PROVIDER_ERROR",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
         if not code:
             exc = AuthenticationException(
@@ -79,11 +75,9 @@ class GoogleCallbackSpaceEndpoint(View):
                 error_message="GOOGLE_OAUTH_PROVIDER_ERROR",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
         try:
             provider = GoogleOAuthProvider(request=request, code=code)
@@ -91,18 +85,11 @@ class GoogleCallbackSpaceEndpoint(View):
             # Login the user and record his device info
             user_login(request=request, user=user, is_space=True)
             # redirect to referer path
-            next_path = validate_next_path(next_path=next_path)
-
-            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
-            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
-                return HttpResponseRedirect(url)
-            else:
-                return HttpResponseRedirect(base_host(request=request, is_space=True))
+            url = f"{base_host(request=request, is_space=True)}{str(next_path) if next_path else ''}"
+            return HttpResponseRedirect(url)
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)

apps/api/plane/authentication/views/space/magic.py

@@ -1,8 +1,10 @@
+# Python imports
+from urllib.parse import urlencode
+
 # Django imports
 from django.core.validators import validate_email
 from django.http import HttpResponseRedirect
 from django.views import View
-from django.utils.http import url_has_allowed_host_and_scheme
 
 # Third party imports
 from rest_framework import status
@@ -21,7 +23,7 @@ from plane.authentication.adapter.error import (
     AuthenticationException,
     AUTHENTICATION_ERROR_CODES,
 )
-from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts
+from plane.utils.path_validator import validate_next_path
 
 
 class MagicGenerateSpaceEndpoint(APIView):
@@ -64,11 +66,9 @@ class MagicSignInSpaceEndpoint(View):
                 error_message="MAGIC_SIGN_IN_EMAIL_CODE_REQUIRED",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params,
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         existing_user = User.objects.filter(email=email).first()
@@ -79,11 +79,9 @@ class MagicSignInSpaceEndpoint(View):
                 error_message="USER_DOES_NOT_EXIST",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params,
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         # Active User
@@ -95,20 +93,15 @@ class MagicSignInSpaceEndpoint(View):
             # Login the user and record his device info
             user_login(request=request, user=user, is_space=True)
             # redirect to referer path
-            next_path = validate_next_path(next_path=next_path)
-            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
-            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
-                return HttpResponseRedirect(url)
-            else:
-                return HttpResponseRedirect(base_host(request=request, is_space=True))
+            path = str(next_path) if next_path else ""
+            url = f"{base_host(request=request, is_space=True)}{path}"
+            return HttpResponseRedirect(url)
 
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params,
-            )
+            if next_path:
+                params["next_path"] = str(next_path)
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
 
@@ -127,11 +120,9 @@ class MagicSignUpSpaceEndpoint(View):
                 error_message="MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params,
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
         # Existing User
         existing_user = User.objects.filter(email=email).first()
@@ -142,11 +133,9 @@ class MagicSignUpSpaceEndpoint(View):
                 error_message="USER_ALREADY_EXIST",
             )
             params = exc.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params,
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)
 
         try:
@@ -157,18 +146,12 @@ class MagicSignUpSpaceEndpoint(View):
             # Login the user and record his device info
             user_login(request=request, user=user, is_space=True)
             # redirect to referer path
-            next_path = validate_next_path(next_path=next_path)
-            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
-            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
-                return HttpResponseRedirect(url)
-            else:
-                return HttpResponseRedirect(base_host(request=request, is_space=True))
+            url = f"{base_host(request=request, is_space=True)}{str(next_path) if next_path else ''}"
+            return HttpResponseRedirect(url)
 
         except AuthenticationException as e:
             params = e.get_error_dict()
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path,
-                params=params,
-            )
+            if next_path:
+                params["next_path"] = str(validate_next_path(next_path))
+            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
             return HttpResponseRedirect(url)

apps/api/plane/authentication/views/space/signout.py

@@ -7,7 +7,7 @@ from django.utils import timezone
 # Module imports
 from plane.authentication.utils.host import base_host, user_ip
 from plane.db.models import User
-from plane.utils.path_validator import get_safe_redirect_url
+from plane.utils.path_validator import validate_next_path
 
 
 class SignOutAuthSpaceEndpoint(View):
@@ -22,14 +22,8 @@ class SignOutAuthSpaceEndpoint(View):
             user.save()
             # Log the user out
             logout(request)
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path
-            )
+            url = f"{base_host(request=request, is_space=True)}{str(validate_next_path(next_path)) if next_path else ''}"
             return HttpResponseRedirect(url)
         except Exception:
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_space=True),
-                next_path=next_path
-            )
+            url = f"{base_host(request=request, is_space=True)}{str(validate_next_path(next_path)) if next_path else ''}"
             return HttpResponseRedirect(url)

apps/api/plane/bgtasks/cleanup_task.py

@@ -21,14 +21,13 @@ from plane.db.models import (
     PageVersion,
     APIActivityLog,
     IssueDescriptionVersion,
-    WebhookLog,
 )
 from plane.settings.mongo import MongoConnection
 from plane.utils.exception_logger import log_exception
 
 
 logger = logging.getLogger("plane.worker")
-BATCH_SIZE = 500
+BATCH_SIZE = 1000
 
 
 def get_mongo_collection(collection_name: str) -> Optional[Collection]:
@@ -68,7 +67,7 @@ def flush_to_mongo_and_delete(
     mongo_archival_failed = False
 
     # Try to insert into MongoDB if available
-    if mongo_collection is not None and mongo_available:
+    if mongo_collection and mongo_available:
         try:
             mongo_collection.bulk_write([InsertOne(doc) for doc in buffer])
         except BulkWriteError as bwe:
@@ -167,9 +166,9 @@ def process_cleanup_task(
 def transform_api_log(record: Dict) -> Dict:
     """Transform API activity log record."""
     return {
-        "id": str(record["id"]),
+        "id": record["id"],
         "created_at": str(record["created_at"]) if record.get("created_at") else None,
-        "token_identifier": str(record["token_identifier"]),
+        "token_identifier": record["token_identifier"],
         "path": record["path"],
         "method": record["method"],
         "query_params": record.get("query_params"),
@@ -179,18 +178,18 @@ def transform_api_log(record: Dict) -> Dict:
         "response_body": record["response_body"],
         "ip_address": record["ip_address"],
         "user_agent": record["user_agent"],
-        "created_by_id": str(record["created_by_id"]),
+        "created_by_id": record["created_by_id"],
     }
 
 
 def transform_email_log(record: Dict) -> Dict:
     """Transform email notification log record."""
     return {
-        "id": str(record["id"]),
+        "id": record["id"],
         "created_at": str(record["created_at"]) if record.get("created_at") else None,
-        "receiver_id": str(record["receiver_id"]),
-        "triggered_by_id": str(record["triggered_by_id"]),
-        "entity_identifier": str(record["entity_identifier"]),
+        "receiver_id": record["receiver_id"],
+        "triggered_by_id": record["triggered_by_id"],
+        "entity_identifier": record["entity_identifier"],
         "entity_name": record["entity_name"],
         "data": record["data"],
         "processed_at": (
@@ -198,27 +197,27 @@ def transform_email_log(record: Dict) -> Dict:
         ),
         "sent_at": str(record["sent_at"]) if record.get("sent_at") else None,
         "entity": record["entity"],
-        "old_value": str(record["old_value"]),
-        "new_value": str(record["new_value"]),
-        "created_by_id": str(record["created_by_id"]),
+        "old_value": record["old_value"],
+        "new_value": record["new_value"],
+        "created_by_id": record["created_by_id"],
     }
 
 
 def transform_page_version(record: Dict) -> Dict:
     """Transform page version record."""
     return {
-        "id": str(record["id"]),
+        "id": record["id"],
         "created_at": str(record["created_at"]) if record.get("created_at") else None,
-        "page_id": str(record["page_id"]),
-        "workspace_id": str(record["workspace_id"]),
-        "owned_by_id": str(record["owned_by_id"]),
+        "page_id": record["page_id"],
+        "workspace_id": record["workspace_id"],
+        "owned_by_id": record["owned_by_id"],
         "description_html": record["description_html"],
         "description_binary": record["description_binary"],
         "description_stripped": record["description_stripped"],
         "description_json": record["description_json"],
         "sub_pages_data": record["sub_pages_data"],
-        "created_by_id": str(record["created_by_id"]),
-        "updated_by_id": str(record["updated_by_id"]),
+        "created_by_id": record["created_by_id"],
+        "updated_by_id": record["updated_by_id"],
         "deleted_at": str(record["deleted_at"]) if record.get("deleted_at") else None,
         "last_saved_at": (
             str(record["last_saved_at"]) if record.get("last_saved_at") else None
@@ -229,14 +228,14 @@ def transform_page_version(record: Dict) -> Dict:
 def transform_issue_description_version(record: Dict) -> Dict:
     """Transform issue description version record."""
     return {
-        "id": str(record["id"]),
+        "id": record["id"],
         "created_at": str(record["created_at"]) if record.get("created_at") else None,
-        "issue_id": str(record["issue_id"]),
-        "workspace_id": str(record["workspace_id"]),
-        "project_id": str(record["project_id"]),
-        "created_by_id": str(record["created_by_id"]),
-        "updated_by_id": str(record["updated_by_id"]),
-        "owned_by_id": str(record["owned_by_id"]),
+        "issue_id": record["issue_id"],
+        "workspace_id": record["workspace_id"],
+        "project_id": record["project_id"],
+        "created_by_id": record["created_by_id"],
+        "updated_by_id": record["updated_by_id"],
+        "owned_by_id": record["owned_by_id"],
         "last_saved_at": (
             str(record["last_saved_at"]) if record.get("last_saved_at") else None
         ),
@@ -248,27 +247,6 @@ def transform_issue_description_version(record: Dict) -> Dict:
     }
 
 
-def transform_webhook_log(record: Dict):
-    """Transfer webhook logs to a new destination."""
-    return {
-        "id": str(record["id"]),
-        "created_at": str(record["created_at"]) if record.get("created_at") else None,
-        "workspace_id": str(record["workspace_id"]),
-        "webhook": str(record["webhook"]),
-        # Request
-        "event_type": str(record["event_type"]),
-        "request_method": str(record["request_method"]),
-        "request_headers": str(record["request_headers"]),
-        "request_body": str(record["request_body"]),
-        # Response
-        "response_status": str(record["response_status"]),
-        "response_body": str(record["response_body"]),
-        "response_headers": str(record["response_headers"]),
-        # retry count
-        "retry_count": str(record["retry_count"]),
-    }
-
-
 # Queryset functions for each cleanup task
 def get_api_logs_queryset():
     """Get API logs older than cutoff days."""
@@ -396,34 +374,7 @@ def get_issue_description_versions_queryset():
     )
 
 
-def get_webhook_logs_queryset():
-    """Get email logs older than cutoff days."""
-    cutoff_days = int(os.environ.get("HARD_DELETE_AFTER_DAYS", 30))
-    cutoff_time = timezone.now() - timedelta(days=cutoff_days)
-    logger.info(f"Webhook logs cutoff time: {cutoff_time}")
-
-    return (
-        WebhookLog.all_objects.filter(created_at__lte=cutoff_time)
-        .values(
-            "id",
-            "created_at",
-            "workspace_id",
-            "webhook",
-            "event_type",
-            # Request
-            "request_method",
-            "request_headers",
-            "request_body",
-            # Response
-            "response_status",
-            "response_body",
-            "response_headers",
-            "retry_count",
-        )
-        .iterator(chunk_size=BATCH_SIZE)
-    )
-
-
+# Celery tasks - now much simpler!
 @shared_task
 def delete_api_logs():
     """Delete old API activity logs."""
@@ -470,15 +421,3 @@ def delete_issue_description_versions():
         task_name="Issue Description Version",
         collection_name="issue_description_versions",
     )
-
-
-@shared_task
-def delete_webhook_logs():
-    """Delete old webhook logs"""
-    process_cleanup_task(
-        queryset_func=get_webhook_logs_queryset,
-        transform_func=transform_webhook_log,
-        model=WebhookLog,
-        task_name="Webhook Log",
-        collection_name="webhook_logs",
-    )

apps/api/plane/bgtasks/issue_activities_task.py

@@ -34,14 +34,6 @@ from plane.utils.issue_relation_mapper import get_inverse_relation
 from plane.utils.uuid import is_valid_uuid
 
 
-def extract_ids(data: dict | None, primary_key: str, fallback_key: str) -> set[str]:
-    if not data:
-        return set()
-    if primary_key in data:
-        return {str(x) for x in data.get(primary_key, [])}
-    return {str(x) for x in data.get(fallback_key, [])}
-
-
 # Track Changes in name
 def track_name(
     requested_data,
@@ -124,32 +116,18 @@ def track_parent(
     issue_activities,
     epoch,
 ):
-    current_parent_id = current_instance.get("parent_id") or current_instance.get(
-        "parent"
-    )
-    requested_parent_id = requested_data.get("parent_id") or requested_data.get(
-        "parent"
-    )
-
-    # Validate UUIDs before database queries
-    if current_parent_id is not None and not is_valid_uuid(current_parent_id):
-        return
-    if requested_parent_id is not None and not is_valid_uuid(requested_parent_id):
-        return
-
-    if current_parent_id != requested_parent_id:
+    if current_instance.get("parent_id") != requested_data.get("parent_id"):
         old_parent = (
-            Issue.objects.filter(pk=current_parent_id).first()
-            if current_parent_id is not None
+            Issue.objects.filter(pk=current_instance.get("parent_id")).first()
+            if current_instance.get("parent_id") is not None
             else None
         )
         new_parent = (
-            Issue.objects.filter(pk=requested_parent_id).first()
-            if requested_parent_id is not None
+            Issue.objects.filter(pk=requested_data.get("parent_id")).first()
+            if requested_data.get("parent_id") is not None
             else None
         )
 
-
         issue_activities.append(
             IssueActivity(
                 issue_id=issue_id,
@@ -215,31 +193,23 @@ def track_state(
     issue_activities,
     epoch,
 ):
-    current_state_id = current_instance.get("state_id") or current_instance.get("state")
-    requested_state_id = requested_data.get("state_id") or requested_data.get("state")
-
-    if current_state_id is not None and not is_valid_uuid(current_state_id):
-        current_state_id = None
-    if requested_state_id is not None and not is_valid_uuid(requested_state_id):
-        requested_state_id = None
-
-    if current_state_id != requested_state_id:
-        new_state = State.objects.filter(pk=requested_state_id, project_id=project_id).first()
-        old_state = State.objects.filter(pk=current_state_id, project_id=project_id).first()
+    if current_instance.get("state_id") != requested_data.get("state_id"):
+        new_state = State.objects.get(pk=requested_data.get("state_id", None))
+        old_state = State.objects.get(pk=current_instance.get("state_id", None))
 
         issue_activities.append(
             IssueActivity(
                 issue_id=issue_id,
                 actor_id=actor_id,
                 verb="updated",
-                old_value=old_state.name if old_state else None,
-                new_value=new_state.name if new_state else None,
+                old_value=old_state.name,
+                new_value=new_state.name,
                 field="state",
                 project_id=project_id,
                 workspace_id=workspace_id,
                 comment="updated the state to",
-                old_identifier=old_state.id if old_state else None,
-                new_identifier=new_state.id if new_state else None,
+                old_identifier=old_state.id,
+                new_identifier=new_state.id,
                 epoch=epoch,
             )
         )
@@ -328,10 +298,8 @@ def track_labels(
     issue_activities,
     epoch,
 ):
-
-    # Labels
-    requested_labels = extract_ids(requested_data, "label_ids", "labels")
-    current_labels = extract_ids(current_instance, "label_ids", "labels")
+    requested_labels = set([str(lab) for lab in requested_data.get("label_ids", [])])
+    current_labels = set([str(lab) for lab in current_instance.get("label_ids", [])])
 
     added_labels = requested_labels - current_labels
     dropped_labels = current_labels - requested_labels
@@ -396,9 +364,16 @@ def track_assignees(
     issue_activities,
     epoch,
 ):
-    # Assignees
-    requested_assignees = extract_ids(requested_data, "assignee_ids", "assignees")
-    current_assignees = extract_ids(current_instance, "assignee_ids", "assignees")
+    requested_assignees = (
+        set([str(asg) for asg in requested_data.get("assignee_ids", [])])
+        if requested_data is not None
+        else set()
+    )
+    current_assignees = (
+        set([str(asg) for asg in current_instance.get("assignee_ids", [])])
+        if current_instance is not None
+        else set()
+    )
 
     added_assignees = requested_assignees - current_assignees
     dropped_assginees = current_assignees - requested_assignees
@@ -656,11 +631,6 @@ def update_issue_activity(
         "estimate_point": track_estimate_points,
         "archived_at": track_archive_at,
         "closed_to": track_closed_to,
-        # External endpoint keys
-        "parent": track_parent,
-        "state": track_state,
-        "assignees": track_assignees,
-        "labels": track_labels,
     }
 
     requested_data = json.loads(requested_data) if requested_data is not None else None

apps/api/plane/bgtasks/page_version_task.py

@@ -30,8 +30,6 @@ def page_version(page_id, existing_instance, user_id):
                 description_binary=page.description_binary,
                 owned_by_id=user_id,
                 last_saved_at=page.updated_at,
-                description_json=page.description,
-                description_stripped=page.description_stripped,
             )
 
             # If page versions are greater than 20 delete the oldest one

apps/api/plane/bgtasks/workspace_seed_task.py

@@ -92,10 +92,6 @@ def create_project_and_member(workspace: Workspace) -> Dict[int, uuid.UUID]:
             name=workspace.name,  # Use workspace name
             identifier=project_identifier,
             created_by_id=workspace.created_by_id,
-            # Enable all views in seed data
-            cycle_view=True,
-            module_view=True,
-            issue_views_view=True,
         )
 
         # Create project members

apps/api/plane/celery.py

@@ -55,23 +55,15 @@ app.conf.beat_schedule = {
     },
     "check-every-day-to-delete-email-notification-logs": {
         "task": "plane.bgtasks.cleanup_task.delete_email_notification_logs",
-        "schedule": crontab(hour=2, minute=45),  # UTC 02:45
+        "schedule": crontab(hour=3, minute=0),  # UTC 03:00
     },
     "check-every-day-to-delete-page-versions": {
         "task": "plane.bgtasks.cleanup_task.delete_page_versions",
-        "schedule": crontab(hour=3, minute=0),  # UTC 03:00
+        "schedule": crontab(hour=3, minute=30),  # UTC 03:30
     },
     "check-every-day-to-delete-issue-description-versions": {
         "task": "plane.bgtasks.cleanup_task.delete_issue_description_versions",
-        "schedule": crontab(hour=3, minute=15),  # UTC 03:15
-    },
-    "check-every-day-to-delete-webhook-logs": {
-        "task": "plane.bgtasks.cleanup_task.delete_webhook_logs",
-        "schedule": crontab(hour=3, minute=30),  # UTC 03:30
-    },
-    "check-every-day-to-delete-exporter-history": {
-        "task": "plane.bgtasks.exporter_expired_task.delete_old_s3_link",
-        "schedule": crontab(hour=3, minute=45),  # UTC 03:45
+        "schedule": crontab(hour=4, minute=0),  # UTC 04:00
     },
 }
 

apps/api/plane/db/migrations/0102_page_sort_order_pagelog_entity_type_and_more.py

@@ -1,30 +0,0 @@
-# Generated by Django 4.2.22 on 2025-08-29 11:31
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("db", "0101_description_descriptionversion"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="page",
-            name="sort_order",
-            field=models.FloatField(default=65535),
-        ),
-        migrations.AddField(
-            model_name="pagelog",
-            name="entity_type",
-            field=models.CharField(
-                blank=True, max_length=30, null=True, verbose_name="Entity Type"
-            ),
-        ),
-        migrations.AlterField(
-            model_name="pagelog",
-            name="entity_identifier",
-            field=models.UUIDField(blank=True, null=True),
-        ),
-    ]

apps/api/plane/db/migrations/0103_fileasset_asset_entity_type_idx_and_more.py

@@ -1,75 +0,0 @@
-# Generated by Django 4.2.22 on 2025-09-01 14:33
-
-from django.db import migrations, models
-from django.contrib.postgres.operations import AddIndexConcurrently
-
-
-class Migration(migrations.Migration):
-    atomic = False
-
-    dependencies = [
-        ('db', '0102_page_sort_order_pagelog_entity_type_and_more'),
-    ]
-
-    operations = [
-        AddIndexConcurrently(
-            model_name='fileasset',
-            index=models.Index(fields=['entity_type'], name='asset_entity_type_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='fileasset',
-            index=models.Index(fields=['entity_identifier'], name='asset_entity_identifier_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='fileasset',
-            index=models.Index(fields=['entity_type', 'entity_identifier'], name='asset_entity_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='notification',
-            index=models.Index(fields=['entity_identifier'], name='notif_entity_identifier_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='notification',
-            index=models.Index(fields=['entity_name'], name='notif_entity_name_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='notification',
-            index=models.Index(fields=['read_at'], name='notif_read_at_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='notification',
-            index=models.Index(fields=['receiver', 'read_at'], name='notif_entity_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='pagelog',
-            index=models.Index(fields=['entity_type'], name='pagelog_entity_type_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='pagelog',
-            index=models.Index(fields=['entity_identifier'], name='pagelog_entity_id_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='pagelog',
-            index=models.Index(fields=['entity_name'], name='pagelog_entity_name_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='pagelog',
-            index=models.Index(fields=['entity_type', 'entity_identifier'], name='pagelog_type_id_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='pagelog',
-            index=models.Index(fields=['entity_name', 'entity_identifier'], name='pagelog_name_id_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='userfavorite',
-            index=models.Index(fields=['entity_type'], name='fav_entity_type_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='userfavorite',
-            index=models.Index(fields=['entity_identifier'], name='fav_entity_identifier_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='userfavorite',
-            index=models.Index(fields=['entity_type', 'entity_identifier'], name='fav_entity_idx'),
-        ),
-    ]

apps/api/plane/db/migrations/0104_cycleuserproperties_rich_filters_and_more.py

@@ -1,43 +0,0 @@
-# Generated by Django 4.2.22 on 2025-09-03 05:18
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('db', '0103_fileasset_asset_entity_type_idx_and_more'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='cycleuserproperties',
-            name='rich_filters',
-            field=models.JSONField(default=dict),
-        ),
-        migrations.AddField(
-            model_name='exporterhistory',
-            name='rich_filters',
-            field=models.JSONField(blank=True, default=dict, null=True),
-        ),
-        migrations.AddField(
-            model_name='issueuserproperty',
-            name='rich_filters',
-            field=models.JSONField(default=dict),
-        ),
-        migrations.AddField(
-            model_name='issueview',
-            name='rich_filters',
-            field=models.JSONField(default=dict),
-        ),
-        migrations.AddField(
-            model_name='moduleuserproperties',
-            name='rich_filters',
-            field=models.JSONField(default=dict),
-        ),
-        migrations.AddField(
-            model_name='workspaceuserproperties',
-            name='rich_filters',
-            field=models.JSONField(default=dict),
-        ),
-    ]

apps/api/plane/db/migrations/0105_alter_project_cycle_view_and_more.py

@@ -1,33 +0,0 @@
-# Generated by Django 4.2.22 on 2025-09-10 09:54
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("db", "0104_cycleuserproperties_rich_filters_and_more"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="project",
-            name="cycle_view",
-            field=models.BooleanField(default=False),
-        ),
-        migrations.AlterField(
-            model_name="project",
-            name="issue_views_view",
-            field=models.BooleanField(default=False),
-        ),
-        migrations.AlterField(
-            model_name="project",
-            name="module_view",
-            field=models.BooleanField(default=False),
-        ),
-        migrations.AlterField(
-            model_name="session",
-            name="user_id",
-            field=models.CharField(db_index=True, max_length=50, null=True),
-        ),
-    ]

apps/api/plane/db/migrations/0106_auto_20250912_0845.py

@@ -1,152 +0,0 @@
-# Generated by Django 4.2.22 on 2025-09-12 08:45
-import uuid
-import django
-from django.conf import settings
-from django.db import migrations, models
-
-
-def set_page_sort_order(apps, schema_editor):
-    Page = apps.get_model("db", "Page")
-
-    batch_size = 3000
-    sort_order = 100
-
-    # Get page IDs ordered by name using the historical model
-    # This should include all pages regardless of soft-delete status
-    page_ids = list(Page.objects.all().order_by("name").values_list("id", flat=True))
-
-    updated_pages = []
-    for page_id in page_ids:
-        # Create page instance with minimal data
-        updated_pages.append(Page(id=page_id, sort_order=sort_order))
-        sort_order += 100
-
-        # Bulk update when batch is full
-        if len(updated_pages) >= batch_size:
-            Page.objects.bulk_update(
-                updated_pages, ["sort_order"], batch_size=batch_size
-            )
-            updated_pages = []
-
-    # Update remaining pages
-    if updated_pages:
-        Page.objects.bulk_update(updated_pages, ["sort_order"], batch_size=batch_size)
-
-
-def reverse_set_page_sort_order(apps, schema_editor):
-    Page = apps.get_model("db", "Page")
-    Page.objects.update(sort_order=Page.DEFAULT_SORT_ORDER)
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("db", "0105_alter_project_cycle_view_and_more"),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="ProjectWebhook",
-            fields=[
-                (
-                    "created_at",
-                    models.DateTimeField(auto_now_add=True, verbose_name="Created At"),
-                ),
-                (
-                    "updated_at",
-                    models.DateTimeField(
-                        auto_now=True, verbose_name="Last Modified At"
-                    ),
-                ),
-                (
-                    "deleted_at",
-                    models.DateTimeField(
-                        blank=True, null=True, verbose_name="Deleted At"
-                    ),
-                ),
-                (
-                    "id",
-                    models.UUIDField(
-                        db_index=True,
-                        default=uuid.uuid4,
-                        editable=False,
-                        primary_key=True,
-                        serialize=False,
-                        unique=True,
-                    ),
-                ),
-                (
-                    "created_by",
-                    models.ForeignKey(
-                        null=True,
-                        on_delete=django.db.models.deletion.SET_NULL,
-                        related_name="%(class)s_created_by",
-                        to=settings.AUTH_USER_MODEL,
-                        verbose_name="Created By",
-                    ),
-                ),
-                (
-                    "project",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        related_name="project_%(class)s",
-                        to="db.project",
-                    ),
-                ),
-                (
-                    "updated_by",
-                    models.ForeignKey(
-                        null=True,
-                        on_delete=django.db.models.deletion.SET_NULL,
-                        related_name="%(class)s_updated_by",
-                        to=settings.AUTH_USER_MODEL,
-                        verbose_name="Last Modified By",
-                    ),
-                ),
-                (
-                    "webhook",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        related_name="project_webhooks",
-                        to="db.webhook",
-                    ),
-                ),
-                (
-                    "workspace",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        related_name="workspace_%(class)s",
-                        to="db.workspace",
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "Project Webhook",
-                "verbose_name_plural": "Project Webhooks",
-                "db_table": "project_webhooks",
-                "ordering": ("-created_at",),
-            },
-        ),
-        migrations.AddConstraint(
-            model_name="projectwebhook",
-            constraint=models.UniqueConstraint(
-                condition=models.Q(("deleted_at__isnull", True)),
-                fields=("project", "webhook"),
-                name="project_webhook_unique_project_webhook_when_deleted_at_null",
-            ),
-        ),
-        migrations.AlterUniqueTogether(
-            name="projectwebhook",
-            unique_together={("project", "webhook", "deleted_at")},
-        ),
-        migrations.AlterField(
-            model_name="issuerelation",
-            name="relation_type",
-            field=models.CharField(
-                default="blocked_by", max_length=20, verbose_name="Issue Relation Type"
-            ),
-        ),
-        migrations.RunPython(
-            set_page_sort_order, reverse_code=reverse_set_page_sort_order
-        ),
-    ]

apps/api/plane/db/migrations/0107_migrate_filters_to_rich_filters.py

@@ -1,74 +0,0 @@
-from django.db import migrations
-
-from plane.utils.filters import LegacyToRichFiltersConverter
-from plane.utils.filters.filter_migrations import (
-    migrate_models_filters_to_rich_filters,
-    clear_models_rich_filters,
-)
-
-
-# Define all models that need migration in one place
-MODEL_NAMES = [
-    "IssueView",
-    "WorkspaceUserProperties",
-    "ModuleUserProperties", 
-    "IssueUserProperty",
-    "CycleUserProperties",
-]
-
-
-def migrate_filters_to_rich_filters(apps, schema_editor):
-    """
-    Migrate legacy filters to rich_filters format for all models that have both fields.
-    """
-    # Get the model classes from model names
-    models_to_migrate = {}
-    
-    for model_name in MODEL_NAMES:
-        try:
-            model_class = apps.get_model("db", model_name)
-            models_to_migrate[model_name] = model_class
-        except Exception as e:
-            # Log error but continue with other models
-            import logging
-            logger = logging.getLogger(__name__)
-            logger.error(f"Failed to get model {model_name}: {str(e)}")
-    
-    converter = LegacyToRichFiltersConverter()
-    # Migrate all models
-    migrate_models_filters_to_rich_filters(models_to_migrate, converter)
-
-
-def reverse_migrate_rich_filters_to_filters(apps, schema_editor):
-    """
-    Reverse migration to clear rich_filters field for all models.
-    """
-    # Get the model classes from model names
-    models_to_clear = {}
-    
-    for model_name in MODEL_NAMES:
-        try:
-            model_class = apps.get_model("db", model_name)
-            models_to_clear[model_name] = model_class
-        except Exception as e:
-            # Log error but continue with other models
-            import logging
-            logger = logging.getLogger(__name__)
-            logger.error(f"Failed to get model {model_name}: {str(e)}")
-    
-    # Clear rich_filters for all models
-    clear_models_rich_filters(models_to_clear)
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('db', '0106_auto_20250912_0845'),
-    ]
-
-    operations = [
-        migrations.RunPython(
-            migrate_filters_to_rich_filters,
-            reverse_code=reverse_migrate_rich_filters_to_filters,
-        ),
-    ]

apps/api/plane/db/models/asset.py

@@ -76,15 +76,6 @@ class FileAsset(BaseModel):
         verbose_name_plural = "File Assets"
         db_table = "file_assets"
         ordering = ("-created_at",)
-        indexes = [
-            models.Index(fields=["entity_type"], name="asset_entity_type_idx"),
-            models.Index(
-                fields=["entity_identifier"], name="asset_entity_identifier_idx"
-            ),
-            models.Index(
-                fields=["entity_type", "entity_identifier"], name="asset_entity_idx"
-            ),
-        ]
 
     def __str__(self):
         return str(self.asset)

apps/api/plane/db/models/cycle.py

@@ -139,7 +139,6 @@ class CycleUserProperties(ProjectBaseModel):
     filters = models.JSONField(default=get_default_filters)
     display_filters = models.JSONField(default=get_default_display_filters)
     display_properties = models.JSONField(default=get_default_display_properties)
-    rich_filters = models.JSONField(default=dict)
 
     class Meta:
         unique_together = ["cycle", "user", "deleted_at"]

apps/api/plane/db/models/exporter.py

@@ -56,7 +56,6 @@ class ExporterHistory(BaseModel):
         related_name="workspace_exporters",
     )
     filters = models.JSONField(blank=True, null=True)
-    rich_filters = models.JSONField(default=dict, blank=True, null=True)
 
     class Meta:
         verbose_name = "Exporter"

apps/api/plane/db/models/favorite.py

@@ -41,15 +41,6 @@ class UserFavorite(WorkspaceBaseModel):
         verbose_name_plural = "User Favorites"
         db_table = "user_favorites"
         ordering = ("-created_at",)
-        indexes = [
-            models.Index(fields=["entity_type"], name="fav_entity_type_idx"),
-            models.Index(
-                fields=["entity_identifier"], name="fav_entity_identifier_idx"
-            ),
-            models.Index(
-                fields=["entity_type", "entity_identifier"], name="fav_entity_idx"
-            ),
-        ]
 
     def save(self, *args, **kwargs):
         if self._state.adding:

apps/api/plane/db/models/issue.py

@@ -284,7 +284,6 @@ class IssueRelationChoices(models.TextChoices):
     BLOCKED_BY = "blocked_by", "Blocked By"
     START_BEFORE = "start_before", "Start Before"
     FINISH_BEFORE = "finish_before", "Finish Before"
-    IMPLEMENTED_BY = "implemented_by", "Implemented By"
 
 
 class IssueRelation(ProjectBaseModel):
@@ -296,6 +295,7 @@ class IssueRelation(ProjectBaseModel):
     )
     relation_type = models.CharField(
         max_length=20,
+        choices=IssueRelationChoices.choices,
         verbose_name="Issue Relation Type",
         default=IssueRelationChoices.BLOCKED_BY,
     )
@@ -509,7 +509,6 @@ class IssueUserProperty(ProjectBaseModel):
     filters = models.JSONField(default=get_default_filters)
     display_filters = models.JSONField(default=get_default_display_filters)
     display_properties = models.JSONField(default=get_default_display_properties)
-    rich_filters = models.JSONField(default=dict)
 
     class Meta:
         verbose_name = "Issue User Property"

apps/api/plane/db/models/module.py

@@ -207,7 +207,6 @@ class ModuleUserProperties(ProjectBaseModel):
     filters = models.JSONField(default=get_default_filters)
     display_filters = models.JSONField(default=get_default_display_filters)
     display_properties = models.JSONField(default=get_default_display_properties)
-    rich_filters = models.JSONField(default=dict)
 
     class Meta:
         unique_together = ["module", "user", "deleted_at"]

apps/api/plane/db/models/notification.py

@@ -39,14 +39,6 @@ class Notification(BaseModel):
         verbose_name_plural = "Notifications"
         db_table = "notifications"
         ordering = ("-created_at",)
-        indexes = [
-            models.Index(
-                fields=["entity_identifier"], name="notif_entity_identifier_idx"
-            ),
-            models.Index(fields=["entity_name"], name="notif_entity_name_idx"),
-            models.Index(fields=["read_at"], name="notif_read_at_idx"),
-            models.Index(fields=["receiver", "read_at"], name="notif_entity_idx"),
-        ]
 
     def __str__(self):
         """Return name of the notifications"""

apps/api/plane/db/models/page.py

@@ -19,7 +19,6 @@ def get_view_props():
 class Page(BaseModel):
     PRIVATE_ACCESS = 1
     PUBLIC_ACCESS = 0
-    DEFAULT_SORT_ORDER = 65535
 
     ACCESS_CHOICES = ((PRIVATE_ACCESS, "Private"), (PUBLIC_ACCESS, "Public"))
 
@@ -58,7 +57,6 @@ class Page(BaseModel):
     )
     moved_to_page = models.UUIDField(null=True, blank=True)
     moved_to_project = models.UUIDField(null=True, blank=True)
-    sort_order = models.FloatField(default=DEFAULT_SORT_ORDER)
 
     external_id = models.CharField(max_length=255, null=True, blank=True)
     external_source = models.CharField(max_length=255, null=True, blank=True)
@@ -100,11 +98,8 @@ class PageLog(BaseModel):
     )
     transaction = models.UUIDField(default=uuid.uuid4)
     page = models.ForeignKey(Page, related_name="page_log", on_delete=models.CASCADE)
-    entity_identifier = models.UUIDField(null=True, blank=True)
+    entity_identifier = models.UUIDField(null=True)
     entity_name = models.CharField(max_length=30, verbose_name="Transaction Type")
-    entity_type = models.CharField(
-        max_length=30, verbose_name="Entity Type", null=True, blank=True
-    )
     workspace = models.ForeignKey(
         "db.Workspace", on_delete=models.CASCADE, related_name="workspace_page_log"
     )
@@ -115,17 +110,6 @@ class PageLog(BaseModel):
         verbose_name_plural = "Page Logs"
         db_table = "page_logs"
         ordering = ("-created_at",)
-        indexes = [
-            models.Index(fields=["entity_type"], name="pagelog_entity_type_idx"),
-            models.Index(fields=["entity_identifier"], name="pagelog_entity_id_idx"),
-            models.Index(fields=["entity_name"], name="pagelog_entity_name_idx"),
-            models.Index(
-                fields=["entity_type", "entity_identifier"], name="pagelog_type_id_idx"
-            ),
-            models.Index(
-                fields=["entity_name", "entity_identifier"], name="pagelog_name_id_idx"
-            ),
-        ]
 
     def __str__(self):
         return f"{self.page.name} {self.entity_name}"

apps/api/plane/db/models/project.py

@@ -18,12 +18,6 @@ from .base import BaseModel
 ROLE_CHOICES = ((20, "Admin"), (15, "Member"), (5, "Guest"))
 
 
-class ROLE(Enum):
-    ADMIN = 20
-    MEMBER = 15
-    GUEST = 5
-
-
 class ProjectNetwork(Enum):
     SECRET = 0
     PUBLIC = 2
@@ -95,9 +89,9 @@ class Project(BaseModel):
     )
     emoji = models.CharField(max_length=255, null=True, blank=True)
     icon_prop = models.JSONField(null=True)
-    module_view = models.BooleanField(default=False)
-    cycle_view = models.BooleanField(default=False)
-    issue_views_view = models.BooleanField(default=False)
+    module_view = models.BooleanField(default=True)
+    cycle_view = models.BooleanField(default=True)
+    issue_views_view = models.BooleanField(default=True)
     page_view = models.BooleanField(default=True)
     intake_view = models.BooleanField(default=False)
     is_time_tracking_enabled = models.BooleanField(default=False)

apps/api/plane/db/models/session.py

@@ -13,7 +13,7 @@ VALID_KEY_CHARS = string.ascii_lowercase + string.digits
 class Session(AbstractBaseSession):
     device_info = models.JSONField(null=True, blank=True, default=None)
     session_key = models.CharField(max_length=128, primary_key=True)
-    user_id = models.CharField(null=True, max_length=50, db_index=True)
+    user_id = models.CharField(null=True, max_length=50)
 
     @classmethod
     def get_session_store_class(cls):

apps/api/plane/db/models/view.py

@@ -58,7 +58,6 @@ class IssueView(WorkspaceBaseModel):
     filters = models.JSONField(default=dict)
     display_filters = models.JSONField(default=get_default_display_filters)
     display_properties = models.JSONField(default=get_default_display_properties)
-    rich_filters = models.JSONField(default=dict)
     access = models.PositiveSmallIntegerField(
         default=1, choices=((0, "Private"), (1, "Public"))
     )

apps/api/plane/db/models/webhook.py

@@ -7,7 +7,7 @@ from django.db import models
 from django.core.exceptions import ValidationError
 
 # Module imports
-from plane.db.models import BaseModel, ProjectBaseModel
+from plane.db.models import BaseModel
 
 
 def generate_token():
@@ -90,24 +90,3 @@ class WebhookLog(BaseModel):
 
     def __str__(self):
         return f"{self.event_type} {str(self.webhook)}"
-
-
-
-class ProjectWebhook(ProjectBaseModel):
-    webhook = models.ForeignKey(
-        "db.Webhook", on_delete=models.CASCADE, related_name="project_webhooks"
-    )
-
-    class Meta:
-        unique_together = ["project", "webhook", "deleted_at"]
-        constraints = [
-            models.UniqueConstraint(
-                fields=["project", "webhook"],
-                condition=models.Q(deleted_at__isnull=True),
-                name="project_webhook_unique_project_webhook_when_deleted_at_null",
-            )
-        ]
-        verbose_name = "Project Webhook"
-        verbose_name_plural = "Project Webhooks"
-        db_table = "project_webhooks"
-        ordering = ("-created_at",)

apps/api/plane/db/models/workspace.py

@@ -332,7 +332,6 @@ class WorkspaceUserProperties(BaseModel):
     filters = models.JSONField(default=get_default_filters)
     display_filters = models.JSONField(default=get_default_display_filters)
     display_properties = models.JSONField(default=get_default_display_properties)
-    rich_filters = models.JSONField(default=dict)
 
     class Meta:
         unique_together = ["workspace", "user", "deleted_at"]

apps/api/plane/license/api/views/admin.py

@@ -34,7 +34,6 @@ from plane.authentication.adapter.error import (
     AuthenticationException,
 )
 from plane.utils.ip_address import get_client_ip
-from plane.utils.path_validator import get_safe_redirect_url
 
 
 class InstanceAdminEndpoint(BaseAPIView):
@@ -393,14 +392,7 @@ class InstanceAdminSignOutEndpoint(View):
             user.save()
             # Log the user out
             logout(request)
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_admin=True),
-                next_path=""
-            )
+            url = urljoin(base_host(request=request, is_admin=True))
             return HttpResponseRedirect(url)
         except Exception:
-            url = get_safe_redirect_url(
-                base_url=base_host(request=request, is_admin=True),
-                next_path=""
-            )
-            return HttpResponseRedirect(url)
+            return HttpResponseRedirect(base_host(request=request, is_admin=True))

apps/api/plane/license/migrations/0006_instance_is_current_version_deprecated.py

@@ -1,18 +0,0 @@
-# Generated by Django 4.2.22 on 2025-09-11 08:40
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("license", "0005_rename_product_instance_edition_and_more"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="instance",
-            name="is_current_version_deprecated",
-            field=models.BooleanField(default=False),
-        ),
-    ]

apps/api/plane/license/models/instance.py

@@ -38,8 +38,6 @@ class Instance(BaseModel):
     is_signup_screen_visited = models.BooleanField(default=False)
     is_verified = models.BooleanField(default=False)
     is_test = models.BooleanField(default=False)
-    # field for validating if the current version is deprecated
-    is_current_version_deprecated = models.BooleanField(default=False)
 
     class Meta:
         verbose_name = "Instance"

apps/api/plane/settings/common.py

@@ -465,7 +465,3 @@ if ENABLE_DRF_SPECTACULAR:
     REST_FRAMEWORK["DEFAULT_SCHEMA_CLASS"] = "drf_spectacular.openapi.AutoSchema"
     INSTALLED_APPS.append("drf_spectacular")
     from .openapi import SPECTACULAR_SETTINGS  # noqa: F401
-
-# MongoDB Settings
-MONGO_DB_URL = os.environ.get("MONGO_DB_URL", False)
-MONGO_DB_DATABASE = os.environ.get("MONGO_DB_DATABASE", False)

apps/api/plane/settings/mongo.py

@@ -118,7 +118,4 @@ class MongoConnection:
         Returns:
             bool: True if MongoDB is configured and connected, False otherwise
         """
-
-        if cls._client is None:
-            cls._instance = cls()
         return cls._client is not None and cls._db is not None

apps/api/plane/space/utils/grouper.py

@@ -184,7 +184,6 @@ def issue_group_values(
     slug: str,
     project_id: Optional[str] = None,
     filters: Dict[str, Any] = {},
-    queryset: Optional[QuerySet] = None,
 ) -> List[Union[str, Any]]:
     if field == "state_id":
         queryset = State.objects.filter(
@@ -239,20 +238,35 @@ def issue_group_values(
     if field == "state__group":
         return ["backlog", "unstarted", "started", "completed", "cancelled"]
     if field == "target_date":
-        queryset = queryset.values_list("target_date", flat=True).distinct()
+        queryset = (
+            Issue.issue_objects.filter(workspace__slug=slug)
+            .filter(**filters)
+            .values_list("target_date", flat=True)
+            .distinct()
+        )
         if project_id:
             return list(queryset.filter(project_id=project_id))
         else:
             return list(queryset)
     if field == "start_date":
-        queryset = queryset.values_list("start_date", flat=True).distinct()
+        queryset = (
+            Issue.issue_objects.filter(workspace__slug=slug)
+            .filter(**filters)
+            .values_list("start_date", flat=True)
+            .distinct()
+        )
         if project_id:
             return list(queryset.filter(project_id=project_id))
         else:
             return list(queryset)
 
     if field == "created_by":
-        queryset = queryset.values_list("created_by", flat=True).distinct()
+        queryset = (
+            Issue.issue_objects.filter(workspace__slug=slug)
+            .filter(**filters)
+            .values_list("created_by", flat=True)
+            .distinct()
+        )
         if project_id:
             return list(queryset.filter(project_id=project_id))
         else:

apps/api/plane/utils/content_validator.py

@@ -2,9 +2,6 @@
 import base64
 import nh3
 from plane.utils.exception_logger import log_exception
-from bs4 import BeautifulSoup
-from collections import defaultdict
-
 
 # Maximum allowed size for binary data (10MB)
 MAX_SIZE = 10 * 1024 * 1024
@@ -22,8 +19,7 @@ SUSPICIOUS_BINARY_PATTERNS = [
 
 def validate_binary_data(data):
     """
-    Validate that binary data appears to be a valid document format
-    and doesn't contain malicious content.
+    Validate that binary data appears to be valid document format and doesn't contain malicious content.
 
     Args:
         data (bytes or str): The binary data to validate, or base64-encoded string
@@ -64,147 +60,6 @@ def validate_binary_data(data):
     return True, None
 
 
-# Combine custom components and editor-specific nodes into a single set of tags
-CUSTOM_TAGS = {
-    # editor node/tag names
-    "mention-component",
-    "label",
-    "input",
-    "image-component",
-}
-ALLOWED_TAGS = nh3.ALLOWED_TAGS | CUSTOM_TAGS
-
-# Merge nh3 defaults with all attributes used across our custom components
-ATTRIBUTES = {
-    "*": {
-        "class",
-        "id",
-        "title",
-        "role",
-        "aria-label",
-        "aria-hidden",
-        "style",
-        "start",
-        "type",
-        # common editor data-* attributes seen in stored HTML
-        # (wildcards like data-* are NOT supported by nh3; we add known keys
-        # here and dynamically include all data-* seen in the input below)
-        "data-tight",
-        "data-node-type",
-        "data-type",
-        "data-checked",
-        "data-background-color",
-        "data-text-color",
-        "data-name",
-        # callout attributes
-        "data-icon-name",
-        "data-icon-color",
-        "data-background",
-        "data-emoji-unicode",
-        "data-emoji-url",
-        "data-logo-in-use",
-        "data-block-type",
-    },
-    "a": {"href", "target"},
-    # editor node/tag attributes
-    "image-component": {
-        "id",
-        "width",
-        "height",
-        "aspectRatio",
-        "aspectratio",
-        "src",
-        "alignment",
-    },
-    "img": {
-        "width",
-        "height",
-        "aspectRatio",
-        "aspectratio",
-        "alignment",
-        "src",
-        "alt",
-        "title",
-    },
-    "mention-component": {"id", "entity_identifier", "entity_name"},
-    "th": {
-        "colspan",
-        "rowspan",
-        "colwidth",
-        "background",
-        "hideContent",
-        "hidecontent",
-        "style",
-    },
-    "td": {
-        "colspan",
-        "rowspan",
-        "colwidth",
-        "background",
-        "textColor",
-        "textcolor",
-        "hideContent",
-        "hidecontent",
-        "style",
-    },
-    "tr": {"background", "textColor", "textcolor", "style"},
-    "pre": {"language"},
-    "code": {"language", "spellcheck"},
-    "input": {"type", "checked"},
-}
-
-SAFE_PROTOCOLS = {"http", "https", "mailto", "tel"}
-
-
-def _compute_html_sanitization_diff(before_html: str, after_html: str):
-    """
-    Compute a coarse diff between original and sanitized HTML.
-
-    Returns a dict with:
-    - removed_tags: mapping[tag] -> removed_count
-    - removed_attributes: mapping[tag] -> sorted list of attribute names removed
-    """
-    try:
-
-        def collect(soup):
-            tag_counts = defaultdict(int)
-            attrs_by_tag = defaultdict(set)
-            for el in soup.find_all(True):
-                tag_name = (el.name or "").lower()
-                if not tag_name:
-                    continue
-                tag_counts[tag_name] += 1
-                for attr_name in list(el.attrs.keys()):
-                    if isinstance(attr_name, str) and attr_name:
-                        attrs_by_tag[tag_name].add(attr_name.lower())
-            return tag_counts, attrs_by_tag
-
-        soup_before = BeautifulSoup(before_html or "", "html.parser")
-        soup_after = BeautifulSoup(after_html or "", "html.parser")
-
-        counts_before, attrs_before = collect(soup_before)
-        counts_after, attrs_after = collect(soup_after)
-
-        removed_tags = {}
-        for tag, cnt_before in counts_before.items():
-            cnt_after = counts_after.get(tag, 0)
-            if cnt_after < cnt_before:
-                removed = cnt_before - cnt_after
-                removed_tags[tag] = removed
-
-        removed_attributes = {}
-        for tag, before_set in attrs_before.items():
-            after_set = attrs_after.get(tag, set())
-            removed = before_set - after_set
-            if removed:
-                removed_attributes[tag] = sorted(list(removed))
-
-        return {"removed_tags": removed_tags, "removed_attributes": removed_attributes}
-    except Exception:
-        # Best-effort only; if diffing fails we don't block the request
-        return {"removed_tags": {}, "removed_attributes": {}}
-
-
 def validate_html_content(html_content: str):
     """
     Sanitize HTML content using nh3.
@@ -218,25 +73,7 @@ def validate_html_content(html_content: str):
         return False, "HTML content exceeds maximum size limit (10MB)", None
 
     try:
-        clean_html = nh3.clean(
-            html_content,
-            tags=ALLOWED_TAGS,
-            attributes=ATTRIBUTES,
-            url_schemes=SAFE_PROTOCOLS,
-        )
-        # Report removals to logger (Sentry) if anything was stripped
-        diff = _compute_html_sanitization_diff(html_content, clean_html)
-        if diff.get("removed_tags") or diff.get("removed_attributes"):
-            try:
-                import json
-
-                summary = json.dumps(diff)
-            except Exception:
-                summary = str(diff)
-            log_exception(
-                f"HTML sanitization removals: {summary}",
-                warning=True,
-            )
+        clean_html = nh3.clean(html_content)
         return True, None, clean_html
     except Exception as e:
         log_exception(e)

apps/api/plane/utils/filters/__init__.py

@@ -1,10 +0,0 @@
-# Filters module for handling complex filtering operations
-
-# Import all utilities from base modules
-from .filter_backend import ComplexFilterBackend
-from .converters import LegacyToRichFiltersConverter
-from .filterset import IssueFilterSet
-
-
-# Public API exports
-__all__ = ["ComplexFilterBackend", "LegacyToRichFiltersConverter", "IssueFilterSet"]