chore: replaced listbox with our custom implementation

2025-08-18 19:47:21 +05:30
1898 changed files with 19538 additions and 34360 deletions
@@ -16,48 +16,3 @@ out/
 **/out/
 dist/
 **/dist/
-# Logs
-npm-debug.log*
-pnpm-debug.log*
-.pnpm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-
-# OS junk
-.DS_Store
-Thumbs.db
-
-# Editor settings
-.vscode
-.idea
-
-# Coverage and test output
-coverage/
-**/coverage/
-*.lcov
-.junit/
-test-results/
-
-# Caches and build artifacts
-.cache/
-**/.cache/
-storybook-static/
-*storybook.log
-*.tsbuildinfo
-
-# Local env and secrets
-.env.local
-.env.development.local
-.env.test.local
-.env.production.local
-.secrets
-tmp/
-temp/
-
-# Database/cache dumps
-*.rdb
-*.rdb.gz
-
-# Misc
-*.pem
-*.key
@@ -35,10 +35,6 @@ on:
      - preview
      - canary

-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 env:
  TARGET_BRANCH: ${{ github.ref_name }}
  ARM64_BUILD: ${{ github.event.inputs.arm64 }}
@@ -272,14 +268,15 @@ jobs:
    if: ${{ needs.branch_build_setup.outputs.aio_build == 'true' }}
    name: Build-Push AIO Docker Image
    runs-on: ubuntu-22.04
-    needs:
-      - branch_build_setup
-      - branch_build_push_admin
-      - branch_build_push_web
-      - branch_build_push_space
-      - branch_build_push_live
-      - branch_build_push_api
-      - branch_build_push_proxy
+    needs: [
+        branch_build_setup,
+        branch_build_push_admin,
+        branch_build_push_web,
+        branch_build_push_space,
+        branch_build_push_live,
+        branch_build_push_api,
+        branch_build_push_proxy
+      ]
    steps:
      - name: Checkout Files
        uses: actions/checkout@v4
@@ -288,7 +285,7 @@ jobs:
        id: prepare_aio_assets
        run: |
          cd deployments/aio/community
-
+          
          if [ "${{ needs.branch_build_setup.outputs.build_type }}" == "Release" ]; then
            aio_version=${{ needs.branch_build_setup.outputs.release_version }}
          else
@@ -327,14 +324,7 @@ jobs:
  upload_build_assets:
    name: Upload Build Assets
    runs-on: ubuntu-22.04
-    needs:
-      - branch_build_setup
-      - branch_build_push_admin
-      - branch_build_push_web
-      - branch_build_push_space
-      - branch_build_push_live
-      - branch_build_push_api
-      - branch_build_push_proxy
+    needs: [branch_build_setup, branch_build_push_admin, branch_build_push_web, branch_build_push_space, branch_build_push_live, branch_build_push_api, branch_build_push_proxy]
    steps:
      - name: Checkout Files
        uses: actions/checkout@v4
@@ -407,3 +397,4 @@ jobs:
            ${{ github.workspace }}/deployments/cli/community/docker-compose.yml
            ${{ github.workspace }}/deployments/cli/community/variables.env
            ${{ github.workspace }}/deployments/swarm/community/swarm.sh
+
@@ -17,6 +17,8 @@ jobs:

      - name: Setup Node.js
        uses: actions/setup-node@v4
+        with:
+          node-version: '18'

      - name: Get PR Branch version
        run: echo "PR_VERSION=$(node -p "require('./package.json').version")" >> $GITHUB_ENV
@@ -3,21 +3,11 @@ name: Build and lint API
 on:
  workflow_dispatch:
  pull_request:
-    branches:
-      - "preview"
-    types:
-      - "opened"
-      - "synchronize"
-      - "ready_for_review"
-      - "review_requested"
-      - "reopened"
+    branches: ["preview"]
+    types: ["opened", "synchronize", "ready_for_review", "review_requested", "reopened"]
    paths:
      - "apps/api/**"

-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
  lint-api:
    name: Lint API
@@ -3,18 +3,14 @@ name: Build and lint web apps
 on:
  workflow_dispatch:
  pull_request:
-    branches:
-      - "preview"
-    types:
-      - "opened"
-      - "synchronize"
-      - "ready_for_review"
-      - "review_requested"
-      - "reopened"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+    branches: ["preview"]
+    types: ["opened", "synchronize", "ready_for_review", "review_requested", "reopened"]
+    paths:
+      - "**.tsx?"
+      - "**.jsx?"
+      - "**.css"
+      - "**.json"
+      - "!apps/api/**"

 jobs:
  build-and-lint:
@@ -24,30 +20,24 @@ jobs:
    if: |
      github.event.pull_request.draft == false &&
      github.event.pull_request.requested_reviewers != null
-    env:
-      TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha }}
-      TURBO_SCM_HEAD: ${{ github.sha }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
-          fetch-depth: 50
-          filter: blob:none
+          fetch-depth: 2

      - name: Set up Node.js
        uses: actions/setup-node@v4
-
-      - name: Enable Corepack and pnpm
-        run: corepack enable pnpm
+        with:
+          node-version-file: ".nvmrc"

      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: yarn install --frozen-lockfile

-      - name: Lint Affected
-        run: pnpm turbo run check:lint --affected
+      - name: Build web apps
+        run: yarn run build
+
+      - name: Lint web apps
+        run: yarn run ci:lint

-      - name: Check Affected format
-        run: pnpm turbo run check:format --affected

-      - name: Build Affected
-        run: pnpm turbo run build --affected
@@ -24,13 +24,11 @@ out/
 .DS_Store
 *.pem
 .history
-tsconfig.tsbuildinfo

 # Debug
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
-pnpm-debug.log*
 .pnpm-debug.log*

 # Local env files
@@ -62,7 +60,6 @@ node_modules/
 assets/dist/
 npm-debug.log
 yarn-error.log
-pnpm-debug.log

 # Editor directories and files
 .idea
@@ -78,9 +75,10 @@ package-lock.json

 # lock files
 package-lock.json
+pnpm-lock.yaml
+pnpm-workspace.yaml

-
-
+.npmrc
 .secrets
 tmp/

@@ -97,5 +95,3 @@ dev-editor
 # Redis
 *.rdb
 *.rdb.gz
-
-storybook-static
@@ -1,34 +0,0 @@
-# Enforce pnpm workspace behavior and allow Turbo's lifecycle hooks if scripts are disabled
-# This repo uses pnpm with workspaces.
-
-# Prefer linking local workspace packages when available
-prefer-workspace-packages=true
-link-workspace-packages=true
-shared-workspace-lockfile=true
-
-# Make peer installs smoother across the monorepo
-auto-install-peers=true
-strict-peer-dependencies=false
-
-# If scripts are disabled (e.g., CI with --ignore-scripts), allowlisted packages can still run their hooks
-# Turbo occasionally performs postinstall tasks for optimal performance
-# moved to pnpm-workspace.yaml: onlyBuiltDependencies (e.g., allow turbo)
-
-public-hoist-pattern[]=*eslint*
-public-hoist-pattern[]=prettier
-public-hoist-pattern[]=typescript
-
-# Reproducible installs across CI and dev
-prefer-frozen-lockfile=true
-
-# Prefer resolving to highest versions in monorepo to reduce duplication
-resolution-mode=highest
-
-# Speed up native module builds by caching side effects
-side-effects-cache=true
-
-# Speed up local dev by reusing local store when possible
-prefer-offline=true
-
-# Ensure workspace protocol is used when adding internal deps
-save-workspace-protocol=true
@@ -0,0 +1 @@
+lts/jod
@@ -0,0 +1 @@
+nodeLinker: node-modules
@@ -73,7 +73,7 @@ docker compose -f docker-compose-local.yml up
 4. Start web apps:

 ```bash
-pnpm dev
+yarn dev
 ```

 5. Open your browser to http://localhost:3001/god-mode/ and register yourself as instance admin
@@ -1,12 +0,0 @@
-.next/*
-out/*
-public/*
-dist/*
-node_modules/*
-.turbo/*
-.env*
-.env
-.env.local
-.env.development
-.env.production
-.env.test
@@ -1,4 +1,5 @@
 module.exports = {
  root: true,
  extends: ["@plane/eslint-config/next.js"],
+  parser: "@typescript-eslint/parser",
 };
@@ -2,5 +2,5 @@
 .vercel
 .tubro
 out/
-dist/
-build/
+dis/
+build/
@@ -1,11 +1,5 @@
-# syntax=docker/dockerfile:1.7
 FROM node:22-alpine AS base

-# Setup pnpm package manager with corepack and configure global bin directory for caching
-ENV PNPM_HOME="/pnpm"
-ENV PATH="$PNPM_HOME:$PATH"
-RUN corepack enable
-
 # *****************************************************************************
 # STAGE 1: Build the project
 # *****************************************************************************
@@ -13,8 +7,7 @@ FROM base AS builder
 RUN apk add --no-cache libc6-compat
 WORKDIR /app

-ARG TURBO_VERSION=2.5.6
-RUN corepack enable pnpm && pnpm add -g turbo@${TURBO_VERSION}
+RUN yarn global add turbo
 COPY . .

 RUN turbo prune --scope=admin --docker
@@ -29,13 +22,11 @@ WORKDIR /app

 COPY .gitignore .gitignore
 COPY --from=builder /app/out/json/ .
-COPY --from=builder /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
-RUN corepack enable pnpm
-RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store pnpm fetch --store-dir=/pnpm/store
+COPY --from=builder /app/out/yarn.lock ./yarn.lock
+RUN yarn install --network-timeout 500000

 COPY --from=builder /app/out/full/ .
 COPY turbo.json turbo.json
-RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store pnpm install --offline --frozen-lockfile --store-dir=/pnpm/store

 ARG NEXT_PUBLIC_API_BASE_URL=""
 ENV NEXT_PUBLIC_API_BASE_URL=$NEXT_PUBLIC_API_BASE_URL
@@ -58,7 +49,7 @@ ENV NEXT_PUBLIC_WEB_BASE_URL=$NEXT_PUBLIC_WEB_BASE_URL
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV TURBO_TELEMETRY_DISABLED=1

-RUN pnpm turbo run build --filter=admin
+RUN yarn turbo run build --filter=admin

 # *****************************************************************************
 # STAGE 3: Copy the project and start it
@@ -100,4 +91,4 @@ ENV TURBO_TELEMETRY_DISABLED=1

 EXPOSE 3000

-CMD ["node", "apps/admin/server.js"]
+CMD ["node", "apps/admin/server.js"]
@@ -5,8 +5,8 @@ WORKDIR /app

 COPY . .

-RUN corepack enable pnpm && pnpm add -g turbo
-RUN pnpm install
+RUN yarn global add turbo
+RUN yarn install

 ENV NEXT_PUBLIC_ADMIN_BASE_PATH="/god-mode"

@@ -14,4 +14,4 @@ EXPOSE 3000

 VOLUME [ "/app/node_modules", "/app/admin/node_modules" ]

-CMD ["pnpm", "dev", "--filter=admin"]
+CMD ["yarn", "dev", "--filter=admin"]
@@ -9,7 +9,7 @@ import { useInstance } from "@/hooks/store";
 // components
 import { InstanceEmailForm } from "./email-config-form";

-const InstanceEmailPage: React.FC = observer(() => {
+const InstanceEmailPage = observer(() => {
  // store
  const { fetchInstanceConfigurations, formattedConfig, disableEmail } = useInstance();

@@ -29,7 +29,7 @@ const InstanceEmailPage: React.FC = observer(() => {
          message: "Email feature has been disabled",
          type: TOAST_TYPE.SUCCESS,
        });
-      } catch (_error) {
+      } catch (error) {
        setToast({
          title: "Error disabling email",
          message: "Failed to disable email feature. Please try again.",
@@ -7,8 +7,7 @@ import { ExternalLink, FileText, HelpCircle, MoveLeft } from "lucide-react";
 import { Transition } from "@headlessui/react";
 // plane internal packages
 import { WEB_BASE_URL } from "@plane/constants";
-import { DiscordIcon, GithubIcon } from "@plane/propel/icons";
-import { Tooltip } from "@plane/propel/tooltip";
+import { DiscordIcon, GithubIcon, Tooltip } from "@plane/ui";
 import { cn } from "@plane/utils";
 // hooks
 import { useTheme } from "@/hooks/store";
@@ -5,8 +5,7 @@ import Link from "next/link";
 import { usePathname } from "next/navigation";
 import { Image, BrainCog, Cog, Lock, Mail } from "lucide-react";
 // plane internal packages
-import { WorkspaceIcon } from "@plane/propel/icons";
-import { Tooltip } from "@plane/propel/tooltip";
+import { Tooltip, WorkspaceIcon } from "@plane/ui";
 import { cn } from "@plane/utils";
 // hooks
 import { useTheme } from "@/hooks/store";
@@ -1,7 +1,7 @@
 "use client";

 import Link from "next/link";
-import { PlaneLockup } from "@plane/propel/icons";
+import { PlaneLockup } from "@plane/ui";

 export const AuthHeader = () => (
  <div className="flex items-center justify-between gap-6 w-full flex-shrink-0 sticky top-0">
@@ -25,8 +25,9 @@ export const EmailCodesConfiguration: React.FC<Props> = observer((props) => {
    <ToggleSwitch
      value={Boolean(parseInt(enableMagicLogin))}
      onChange={() => {
-        const newEnableMagicLogin = Boolean(parseInt(enableMagicLogin)) === true ? "0" : "1";
-        updateConfig("ENABLE_MAGIC_LINK_LOGIN", newEnableMagicLogin);
+        Boolean(parseInt(enableMagicLogin)) === true
+          ? updateConfig("ENABLE_MAGIC_LINK_LOGIN", "0")
+          : updateConfig("ENABLE_MAGIC_LINK_LOGIN", "1");
      }}
      size="sm"
      disabled={disabled}
@@ -35,8 +35,9 @@ export const GithubConfiguration: React.FC<Props> = observer((props) => {
          <ToggleSwitch
            value={Boolean(parseInt(enableGithubConfig))}
            onChange={() => {
-              const newEnableGithubConfig = Boolean(parseInt(enableGithubConfig)) === true ? "0" : "1";
-              updateConfig("IS_GITHUB_ENABLED", newEnableGithubConfig);
+              Boolean(parseInt(enableGithubConfig)) === true
+                ? updateConfig("IS_GITHUB_ENABLED", "0")
+                : updateConfig("IS_GITHUB_ENABLED", "1");
            }}
            size="sm"
            disabled={disabled}
@@ -35,8 +35,9 @@ export const GitlabConfiguration: React.FC<Props> = observer((props) => {
          <ToggleSwitch
            value={Boolean(parseInt(enableGitlabConfig))}
            onChange={() => {
-              const newEnableGitlabConfig = Boolean(parseInt(enableGitlabConfig)) === true ? "0" : "1";
-              updateConfig("IS_GITLAB_ENABLED", newEnableGitlabConfig);
+              Boolean(parseInt(enableGitlabConfig)) === true
+                ? updateConfig("IS_GITLAB_ENABLED", "0")
+                : updateConfig("IS_GITLAB_ENABLED", "1");
            }}
            size="sm"
            disabled={disabled}
@@ -35,8 +35,9 @@ export const GoogleConfiguration: React.FC<Props> = observer((props) => {
          <ToggleSwitch
            value={Boolean(parseInt(enableGoogleConfig))}
            onChange={() => {
-              const newEnableGoogleConfig = Boolean(parseInt(enableGoogleConfig)) === true ? "0" : "1";
-              updateConfig("IS_GOOGLE_ENABLED", newEnableGoogleConfig);
+              Boolean(parseInt(enableGoogleConfig)) === true
+                ? updateConfig("IS_GOOGLE_ENABLED", "0")
+                : updateConfig("IS_GOOGLE_ENABLED", "1");
            }}
            size="sm"
            disabled={disabled}
@@ -25,8 +25,9 @@ export const PasswordLoginConfiguration: React.FC<Props> = observer((props) => {
    <ToggleSwitch
      value={Boolean(parseInt(enableEmailPassword))}
      onChange={() => {
-        const newEnableEmailPassword = Boolean(parseInt(enableEmailPassword)) === true ? "0" : "1";
-        updateConfig("ENABLE_EMAIL_PASSWORD", newEnableEmailPassword);
+        Boolean(parseInt(enableEmailPassword)) === true
+          ? updateConfig("ENABLE_EMAIL_PASSWORD", "0")
+          : updateConfig("ENABLE_EMAIL_PASSWORD", "1");
      }}
      size="sm"
      disabled={disabled}
@@ -1,7 +1,7 @@
 "use client";

 import Link from "next/link";
-import { Tooltip } from "@plane/propel/tooltip";
+import { Tooltip } from "@plane/ui";

 type Props = {
  label?: string;
@@ -2,7 +2,7 @@ import { observer } from "mobx-react";
 import { ExternalLink } from "lucide-react";
 // plane internal packages
 import { WEB_BASE_URL } from "@plane/constants";
-import { Tooltip } from "@plane/propel/tooltip";
+import { Tooltip } from "@plane/ui";
 import { getFileURL } from "@plane/utils";
 // hooks
 import { useWorkspace } from "@/hooks/store";
@@ -209,7 +209,7 @@ export class InstanceStore implements IInstanceStore {
        });
      });
      await this.instanceService.disableEmail();
-    } catch (_error) {
+    } catch (error) {
      console.error("Error disabling the email");
      this.instanceConfigurations = instanceConfigurations;
    }
@@ -1,7 +1,7 @@
 {
  "name": "admin",
  "description": "Admin UI for Plane",
-  "version": "1.0.0",
+  "version": "0.28.0",
  "license": "AGPL-3.0",
  "private": true,
  "scripts": {
@@ -18,38 +18,38 @@
  },
  "dependencies": {
    "@headlessui/react": "^1.7.19",
-    "@plane/constants": "workspace:*",
-    "@plane/hooks": "workspace:*",
-    "@plane/propel": "workspace:*",
-    "@plane/services": "workspace:*",
-    "@plane/types": "workspace:*",
-    "@plane/ui": "workspace:*",
-    "@plane/utils": "workspace:*",
+    "@plane/constants": "*",
+    "@plane/hooks": "*",
+    "@plane/propel": "*",
+    "@plane/services": "*",
+    "@plane/types": "*",
+    "@plane/ui": "*",
+    "@plane/utils": "*",
+    "@tailwindcss/typography": "^0.5.9",
+    "@types/lodash": "^4.17.0",
    "autoprefixer": "10.4.14",
-    "axios": "catalog:",
-    "lodash": "catalog:",
-    "lucide-react": "catalog:",
-    "mobx": "catalog:",
-    "mobx-react": "catalog:",
-    "next": "catalog:",
+    "axios": "1.11.0",
+    "lodash": "^4.17.21",
+    "lucide-react": "^0.469.0",
+    "mobx": "^6.12.0",
+    "mobx-react": "^9.1.1",
+    "next": "14.2.30",
    "next-themes": "^0.2.1",
    "postcss": "^8.4.49",
-    "react": "catalog:",
-    "react-dom": "catalog:",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
    "react-hook-form": "7.51.5",
-    "sharp": "catalog:",
-    "swr": "catalog:",
-    "uuid": "catalog:"
+    "swr": "^2.2.4",
+    "uuid": "^9.0.1"
  },
  "devDependencies": {
-    "@plane/eslint-config": "workspace:*",
-    "@plane/tailwind-config": "workspace:*",
-    "@plane/typescript-config": "workspace:*",
-    "@types/lodash": "catalog:",
+    "@plane/eslint-config": "*",
+    "@plane/tailwind-config": "*",
+    "@plane/typescript-config": "*",
    "@types/node": "18.16.1",
-    "@types/react": "catalog:",
-    "@types/react-dom": "catalog:",
+    "@types/react": "^18.3.11",
+    "@types/react-dom": "^18.2.18",
    "@types/uuid": "^9.0.8",
-    "typescript": "catalog:"
+    "typescript": "5.8.3"
  }
 }
@@ -1,6 +1,6 @@
 {
  "name": "plane-api",
-  "version": "1.0.0",
+  "version": "0.28.0",
  "license": "AGPL-3.0",
  "private": true,
  "description": "API server powering Plane's backend"
@@ -91,7 +91,6 @@ class BaseSerializer(serializers.ModelSerializer):
                        "project_lead": UserLiteSerializer,
                        "state": StateLiteSerializer,
                        "created_by": UserLiteSerializer,
-                        "updated_by": UserLiteSerializer,
                        "issue": IssueSerializer,
                        "actor": UserLiteSerializer,
                        "owned_by": UserLiteSerializer,
@@ -24,6 +24,7 @@ from plane.db.models import (
 )
 from plane.utils.content_validator import (
    validate_html_content,
+    validate_json_content,
    validate_binary_data,
 )

@@ -88,24 +89,20 @@ class IssueSerializer(BaseSerializer):
            raise serializers.ValidationError("Invalid HTML passed")

        # Validate description content for security
-        if data.get("description_html"):
-            is_valid, error_msg, sanitized_html = validate_html_content(
-                data["description_html"]
-            )
+        if data.get("description"):
+            is_valid, error_msg = validate_json_content(data["description"])
            if not is_valid:
-                raise serializers.ValidationError(
-                    {"error": "html content is not valid"}
-                )
-            # Update the data with sanitized HTML if available
-            if sanitized_html is not None:
-                data["description_html"] = sanitized_html
+                raise serializers.ValidationError({"description": error_msg})
+
+        if data.get("description_html"):
+            is_valid, error_msg = validate_html_content(data["description_html"])
+            if not is_valid:
+                raise serializers.ValidationError({"description_html": error_msg})

        if data.get("description_binary"):
            is_valid, error_msg = validate_binary_data(data["description_binary"])
            if not is_valid:
-                raise serializers.ValidationError(
-                    {"description_binary": "Invalid binary data"}
-                )
+                raise serializers.ValidationError({"description_binary": error_msg})

        # Validate assignees are from project
        if data.get("assignees", []):
@@ -12,6 +12,7 @@ from plane.db.models import (

 from plane.utils.content_validator import (
    validate_html_content,
+    validate_json_content,
 )
 from .base import BaseSerializer

@@ -44,10 +45,6 @@ class ProjectCreateSerializer(BaseSerializer):
            "archive_in",
            "close_in",
            "timezone",
-            "logo_props",
-            "external_source",
-            "external_id",
-            "is_issue_type_enabled",
        ]

        read_only_fields = [
@@ -199,18 +196,27 @@ class ProjectSerializer(BaseSerializer):
            )

        # Validate description content for security
+        if "description" in data and data["description"]:
+            # For Project, description might be text field, not JSON
+            if isinstance(data["description"], dict):
+                is_valid, error_msg = validate_json_content(data["description"])
+                if not is_valid:
+                    raise serializers.ValidationError({"description": error_msg})
+
+        if "description_text" in data and data["description_text"]:
+            is_valid, error_msg = validate_json_content(data["description_text"])
+            if not is_valid:
+                raise serializers.ValidationError({"description_text": error_msg})
+
        if "description_html" in data and data["description_html"]:
            if isinstance(data["description_html"], dict):
-                is_valid, error_msg, sanitized_html = validate_html_content(
+                is_valid, error_msg = validate_json_content(data["description_html"])
+            else:
+                is_valid, error_msg = validate_html_content(
                    str(data["description_html"])
                )
-                # Update the data with sanitized HTML if available
-                if sanitized_html is not None:
-                    data["description_html"] = sanitized_html
            if not is_valid:
-                raise serializers.ValidationError(
-                    {"error": "html content is not valid"}
-                )
+                raise serializers.ValidationError({"description_html": error_msg})

        return data

@@ -89,9 +89,7 @@ urlpatterns = [
    ),
    path(
        "workspaces/<str:slug>/projects/<uuid:project_id>/issues/<uuid:issue_id>/issue-attachments/<uuid:pk>/",
-        IssueAttachmentDetailAPIEndpoint.as_view(
-            http_method_names=["get", "patch", "delete"]
-        ),
+        IssueAttachmentDetailAPIEndpoint.as_view(http_method_names=["get", "delete"]),
        name="issue-attachment",
    ),
 ]
@@ -4,7 +4,7 @@ from plane.api.views import ProjectMemberAPIEndpoint, WorkspaceMemberAPIEndpoint

 urlpatterns = [
    path(
-        "workspaces/<str:slug>/projects/<uuid:project_id>/members/",
+        "workspaces/<str:slug>/projects/<str:project_id>/members/",
        ProjectMemberAPIEndpoint.as_view(http_method_names=["get"]),
        name="project-members",
    ),
@@ -75,7 +75,7 @@ from plane.bgtasks.storage_metadata_task import get_asset_object_metadata
 from .base import BaseAPIView
 from plane.utils.host import base_host
 from plane.bgtasks.webhook_task import model_activity
-from plane.app.permissions import ROLE
+
 from plane.utils.openapi import (
    work_item_docs,
    label_docs,
@@ -145,22 +145,6 @@ from plane.utils.openapi import (
 )
 from plane.bgtasks.work_item_link_task import crawl_work_item_link_title

-def user_has_issue_permission(
-    user_id, project_id, issue=None, allowed_roles=None, allow_creator=True
-):
-    if allow_creator and issue is not None and user_id == issue.created_by_id:
-        return True
-
-    qs = ProjectMember.objects.filter(
-        project_id=project_id,
-        member_id=user_id,
-        is_active=True,
-    )
-    if allowed_roles is not None:
-        qs = qs.filter(role__in=allowed_roles)
-
-    return qs.exists()
-

 class WorkspaceIssueAPIEndpoint(BaseAPIView):
    """
@@ -347,10 +331,6 @@ class IssueListCreateAPIEndpoint(BaseAPIView):
            )
        )

-        total_issue_queryset = Issue.issue_objects.filter(
-            project_id=project_id, workspace__slug=slug
-        )
-
        # Priority Ordering
        if order_by_param == "priority" or order_by_param == "-priority":
            priority_order = (
@@ -410,7 +390,6 @@ class IssueListCreateAPIEndpoint(BaseAPIView):
        return self.paginate(
            request=request,
            queryset=(issue_queryset),
-            total_count_queryset=total_issue_queryset,
            on_results=lambda issues: IssueSerializer(
                issues, many=True, fields=self.fields, expand=self.expand
            ).data,
@@ -1803,6 +1782,7 @@ class IssueAttachmentListCreateAPIEndpoint(BaseAPIView):

    serializer_class = IssueAttachmentSerializer
    model = FileAsset
+    permission_classes = [ProjectEntityPermission]
    use_read_replica = True

    @issue_attachment_docs(
@@ -1885,22 +1865,6 @@ class IssueAttachmentListCreateAPIEndpoint(BaseAPIView):
        Generate presigned URL for uploading file attachments to a work item.
        Validates file type and size before creating the attachment record.
        """
-        issue = Issue.objects.get(
-            pk=issue_id, workspace__slug=slug, project_id=project_id
-        )
-        # if the user is creator or admin,member then allow the upload
-        if not user_has_issue_permission(
-            request.user.id,
-            project_id=project_id,
-            issue=issue,
-            allowed_roles=[ROLE.ADMIN.value, ROLE.MEMBER.value],
-            allow_creator=True,
-        ):
-            return Response(
-                {"error": "You are not allowed to upload this attachment"},
-                status=status.HTTP_403_FORBIDDEN,
-            )
-
        name = request.data.get("name")
        type = request.data.get("type", False)
        size = request.data.get("size")
@@ -2025,6 +1989,7 @@ class IssueAttachmentDetailAPIEndpoint(BaseAPIView):
    """Issue Attachment Detail Endpoint"""

    serializer_class = IssueAttachmentSerializer
+    permission_classes = [ProjectEntityPermission]
    model = FileAsset
    use_read_replica = True

@@ -2047,22 +2012,6 @@ class IssueAttachmentDetailAPIEndpoint(BaseAPIView):
        Soft delete an attachment from a work item by marking it as deleted.
        Records deletion activity and triggers metadata cleanup.
        """
-        issue = Issue.objects.get(
-            pk=issue_id, workspace__slug=slug, project_id=project_id
-        )
-        # if the request user is creator or admin then delete the attachment
-        if not user_has_issue_permission(
-            request.user,
-            project_id=project_id,
-            issue=issue,
-            allowed_roles=[ROLE.ADMIN.value],
-            allow_creator=True,
-        ):
-            return Response(
-                {"error": "You are not allowed to delete this attachment"},
-                status=status.HTTP_403_FORBIDDEN,
-            )
-
        issue_attachment = FileAsset.objects.get(
            pk=pk, workspace__slug=slug, project_id=project_id
        )
@@ -2125,19 +2074,6 @@ class IssueAttachmentDetailAPIEndpoint(BaseAPIView):

        Retrieve details of a specific attachment.
        """
-        # if the user is part of the project then allow the download
-        if not user_has_issue_permission(
-            request.user,
-            project_id=project_id,
-            issue=None,
-            allowed_roles=None,
-            allow_creator=False,
-        ):
-            return Response(
-                {"error": "You are not allowed to download this attachment"},
-                status=status.HTTP_403_FORBIDDEN,
-            )
-
        # Get the asset
        asset = FileAsset.objects.get(
            id=pk, workspace__slug=slug, project_id=project_id
@@ -2192,23 +2128,6 @@ class IssueAttachmentDetailAPIEndpoint(BaseAPIView):
        Mark an attachment as uploaded after successful file transfer to storage.
        Triggers activity logging and metadata extraction.
        """
-
-        issue = Issue.objects.get(
-            pk=issue_id, workspace__slug=slug, project_id=project_id
-        )
-        # if the user is creator or admin then allow the upload
-        if not user_has_issue_permission(
-            request.user,
-            project_id=project_id,
-            issue=issue,
-            allowed_roles=[ROLE.ADMIN.value, ROLE.MEMBER.value],
-            allow_creator=True,
-        ):
-            return Response(
-                {"error": "You are not allowed to upload this attachment"},
-                status=status.HTTP_403_FORBIDDEN,
-            )
-
        issue_attachment = FileAsset.objects.get(
            pk=pk, workspace__slug=slug, project_id=project_id
        )
@@ -39,31 +39,13 @@ def allow_permission(allowed_roles, level="PROJECT", creator=False, model=None):
                ).exists():
                    return view_func(instance, request, *args, **kwargs)
            else:
-                is_user_has_allowed_role = ProjectMember.objects.filter(
+                if ProjectMember.objects.filter(
                    member=request.user,
                    workspace__slug=kwargs["slug"],
                    project_id=kwargs["project_id"],
                    role__in=allowed_role_values,
                    is_active=True,
-                ).exists()
-
-                # Return if the user has the allowed role else if they are workspace admin and part of the project regardless of the role
-                if is_user_has_allowed_role:
-                    return view_func(instance, request, *args, **kwargs)
-                elif (
-                    ProjectMember.objects.filter(
-                        member=request.user,
-                        workspace__slug=kwargs["slug"],
-                        project_id=kwargs["project_id"],
-                        is_active=True,
-                    ).exists()
-                    and WorkspaceMember.objects.filter(
-                        member=request.user,
-                        workspace__slug=kwargs["slug"],
-                        role=ROLE.ADMIN.value,
-                        is_active=True,
-                    ).exists()
-                ):
+                ).exists():
                    return view_func(instance, request, *args, **kwargs)

            # Return permission denied if no conditions are met
@@ -3,7 +3,11 @@ from rest_framework.permissions import SAFE_METHODS, BasePermission

 # Module import
 from plane.db.models import ProjectMember, WorkspaceMember
-from plane.db.models.project import ROLE
+
+# Permission Mappings
+Admin = 20
+Member = 15
+Guest = 5


 class ProjectBasePermission(BasePermission):
@@ -22,31 +26,18 @@ class ProjectBasePermission(BasePermission):
            return WorkspaceMember.objects.filter(
                workspace__slug=view.workspace_slug,
                member=request.user,
-                role__in=[ROLE.ADMIN.value, ROLE.MEMBER.value],
+                role__in=[Admin, Member],
                is_active=True,
            ).exists()

-        project_member_qs = ProjectMember.objects.filter(
+        ## Only Project Admins can update project attributes
+        return ProjectMember.objects.filter(
            workspace__slug=view.workspace_slug,
            member=request.user,
+            role=Admin,
            project_id=view.project_id,
            is_active=True,
-        )
-
-        ## Only project admins or workspace admin who is part of the project can access
-
-        if project_member_qs.filter(role=ROLE.ADMIN.value).exists():
-            return True
-        else:
-            return (
-                project_member_qs.exists()
-                and WorkspaceMember.objects.filter(
-                    member=request.user,
-                    workspace__slug=view.workspace_slug,
-                    role=ROLE.ADMIN.value,
-                    is_active=True,
-                ).exists()
-            )
+        ).exists()


 class ProjectMemberPermission(BasePermission):
@@ -64,7 +55,7 @@ class ProjectMemberPermission(BasePermission):
            return WorkspaceMember.objects.filter(
                workspace__slug=view.workspace_slug,
                member=request.user,
-                role__in=[ROLE.ADMIN.value, ROLE.MEMBER.value],
+                role__in=[Admin, Member],
                is_active=True,
            ).exists()

@@ -72,7 +63,7 @@ class ProjectMemberPermission(BasePermission):
        return ProjectMember.objects.filter(
            workspace__slug=view.workspace_slug,
            member=request.user,
-            role__in=[ROLE.ADMIN.value, ROLE.MEMBER.value],
+            role__in=[Admin, Member],
            project_id=view.project_id,
            is_active=True,
        ).exists()
@@ -106,7 +97,7 @@ class ProjectEntityPermission(BasePermission):
        return ProjectMember.objects.filter(
            workspace__slug=view.workspace_slug,
            member=request.user,
-            role__in=[ROLE.ADMIN.value, ROLE.MEMBER.value],
+            role__in=[Admin, Member],
            project_id=view.project_id,
            is_active=True,
        ).exists()
@@ -23,6 +23,7 @@ from plane.db.models import (
 )
 from plane.utils.content_validator import (
    validate_html_content,
+    validate_json_content,
    validate_binary_data,
 )
 from plane.app.permissions import ROLE
@@ -75,24 +76,20 @@ class DraftIssueCreateSerializer(BaseSerializer):
            raise serializers.ValidationError("Start date cannot exceed target date")

        # Validate description content for security
-        if "description_html" in attrs and attrs["description_html"]:
-            is_valid, error_msg, sanitized_html = validate_html_content(
-                attrs["description_html"]
-            )
+        if "description" in attrs and attrs["description"]:
+            is_valid, error_msg = validate_json_content(attrs["description"])
            if not is_valid:
-                raise serializers.ValidationError(
-                    {"error": "html content is not valid"}
-                )
-            # Update the attrs with sanitized HTML if available
-            if sanitized_html is not None:
-                attrs["description_html"] = sanitized_html
+                raise serializers.ValidationError({"description": error_msg})
+
+        if "description_html" in attrs and attrs["description_html"]:
+            is_valid, error_msg = validate_html_content(attrs["description_html"])
+            if not is_valid:
+                raise serializers.ValidationError({"description_html": error_msg})

        if "description_binary" in attrs and attrs["description_binary"]:
            is_valid, error_msg = validate_binary_data(attrs["description_binary"])
            if not is_valid:
-                raise serializers.ValidationError(
-                    {"description_binary": "Invalid binary data"}
-                )
+                raise serializers.ValidationError({"description_binary": error_msg})

        # Validate assignees are from project
        if attrs.get("assignee_ids", []):
@@ -43,6 +43,7 @@ from plane.db.models import (
 )
 from plane.utils.content_validator import (
    validate_html_content,
+    validate_json_content,
    validate_binary_data,
 )

@@ -127,24 +128,20 @@ class IssueCreateSerializer(BaseSerializer):
            raise serializers.ValidationError("Start date cannot exceed target date")

        # Validate description content for security
-        if "description_html" in attrs and attrs["description_html"]:
-            is_valid, error_msg, sanitized_html = validate_html_content(
-                attrs["description_html"]
-            )
+        if "description" in attrs and attrs["description"]:
+            is_valid, error_msg = validate_json_content(attrs["description"])
            if not is_valid:
-                raise serializers.ValidationError(
-                    {"error": "html content is not valid"}
-                )
-            # Update the attrs with sanitized HTML if available
-            if sanitized_html is not None:
-                attrs["description_html"] = sanitized_html
+                raise serializers.ValidationError({"description": error_msg})
+
+        if "description_html" in attrs and attrs["description_html"]:
+            is_valid, error_msg = validate_html_content(attrs["description_html"])
+            if not is_valid:
+                raise serializers.ValidationError({"description_html": error_msg})

        if "description_binary" in attrs and attrs["description_binary"]:
            is_valid, error_msg = validate_binary_data(attrs["description_binary"])
            if not is_valid:
-                raise serializers.ValidationError(
-                    {"description_binary": "Invalid binary data"}
-                )
+                raise serializers.ValidationError({"description_binary": error_msg})

        # Validate assignees are from project
        if attrs.get("assignee_ids", []):
@@ -667,33 +664,16 @@ class IssueReactionSerializer(BaseSerializer):


 class IssueReactionLiteSerializer(DynamicBaseSerializer):
-    display_name = serializers.CharField(source="actor.display_name", read_only=True)
-
    class Meta:
        model = IssueReaction
-        fields = ["id", "actor", "issue", "reaction", "display_name"]
+        fields = ["id", "actor", "issue", "reaction"]


 class CommentReactionSerializer(BaseSerializer):
-    display_name = serializers.CharField(source="actor.display_name", read_only=True)
-
    class Meta:
        model = CommentReaction
-        fields = [
-            "id",
-            "actor",
-            "comment",
-            "reaction",
-            "display_name",
-            "deleted_at",
-            "workspace",
-            "project",
-            "created_at",
-            "updated_at",
-            "created_by",
-            "updated_by",
-        ]
-        read_only_fields = ["workspace", "project", "comment", "actor", "deleted_at", "created_by", "updated_by"]
+        fields = "__all__"
+        read_only_fields = ["workspace", "project", "comment", "actor", "deleted_at"]


 class IssueVoteSerializer(BaseSerializer):
@@ -928,14 +908,9 @@ class IssueLiteSerializer(DynamicBaseSerializer):
 class IssueDetailSerializer(IssueSerializer):
    description_html = serializers.CharField()
    is_subscribed = serializers.BooleanField(read_only=True)
-    is_intake = serializers.BooleanField(read_only=True)

    class Meta(IssueSerializer.Meta):
-        fields = IssueSerializer.Meta.fields + [
-            "description_html",
-            "is_subscribed",
-            "is_intake",
-        ]
+        fields = IssueSerializer.Meta.fields + ["description_html", "is_subscribed"]
        read_only_fields = fields


@@ -7,6 +7,7 @@ from .base import BaseSerializer
 from plane.utils.content_validator import (
    validate_binary_data,
    validate_html_content,
+    validate_json_content,
 )
 from plane.db.models import (
    Page,
@@ -228,13 +229,23 @@ class PageBinaryUpdateSerializer(serializers.Serializer):
            return value

        # Use the validation function from utils
-        is_valid, error_message, sanitized_html = validate_html_content(value)
+        is_valid, error_message = validate_html_content(value)
        if not is_valid:
            raise serializers.ValidationError(error_message)

-        # Return sanitized HTML if available, otherwise return original
-        return sanitized_html if sanitized_html is not None else value
+        return value

+    def validate_description(self, value):
+        """Validate the JSON description"""
+        if not value:
+            return value
+
+        # Use the validation function from utils
+        is_valid, error_message = validate_json_content(value)
+        if not is_valid:
+            raise serializers.ValidationError(error_message)
+
+        return value

    def update(self, instance, validated_data):
        """Update the page instance with validated data"""
@@ -15,6 +15,7 @@ from plane.db.models import (
 )
 from plane.utils.content_validator import (
    validate_html_content,
+    validate_json_content,
    validate_binary_data,
 )

@@ -64,18 +65,27 @@ class ProjectSerializer(BaseSerializer):

    def validate(self, data):
        # Validate description content for security
-        if "description_html" in data and data["description_html"]:
-            is_valid, error_msg, sanitized_html = validate_html_content(
-                str(data["description_html"])
-            )
-            # Update the data with sanitized HTML if available
-            if sanitized_html is not None:
-                data["description_html"] = sanitized_html
+        if "description" in data and data["description"]:
+            # For Project, description might be text field, not JSON
+            if isinstance(data["description"], dict):
+                is_valid, error_msg = validate_json_content(data["description"])
+                if not is_valid:
+                    raise serializers.ValidationError({"description": error_msg})

+        if "description_text" in data and data["description_text"]:
+            is_valid, error_msg = validate_json_content(data["description_text"])
            if not is_valid:
-                raise serializers.ValidationError(
-                    {"error": "html content is not valid"}
+                raise serializers.ValidationError({"description_text": error_msg})
+
+        if "description_html" in data and data["description_html"]:
+            if isinstance(data["description_html"], dict):
+                is_valid, error_msg = validate_json_content(data["description_html"])
+            else:
+                is_valid, error_msg = validate_html_content(
+                    str(data["description_html"])
                )
+            if not is_valid:
+                raise serializers.ValidationError({"description_html": error_msg})

        return data

@@ -26,6 +26,7 @@ from plane.utils.constants import RESTRICTED_WORKSPACE_SLUGS
 from plane.utils.url import contains_url
 from plane.utils.content_validator import (
    validate_html_content,
+    validate_json_content,
    validate_binary_data,
 )

@@ -318,24 +319,20 @@ class StickySerializer(BaseSerializer):

    def validate(self, data):
        # Validate description content for security
-        if "description_html" in data and data["description_html"]:
-            is_valid, error_msg, sanitized_html = validate_html_content(
-                data["description_html"]
-            )
+        if "description" in data and data["description"]:
+            is_valid, error_msg = validate_json_content(data["description"])
            if not is_valid:
-                raise serializers.ValidationError(
-                    {"error": "html content is not valid"}
-                )
-            # Update the data with sanitized HTML if available
-            if sanitized_html is not None:
-                data["description_html"] = sanitized_html
+                raise serializers.ValidationError({"description": error_msg})
+
+        if "description_html" in data and data["description_html"]:
+            is_valid, error_msg = validate_html_content(data["description_html"])
+            if not is_valid:
+                raise serializers.ValidationError({"description_html": error_msg})

        if "description_binary" in data and data["description_binary"]:
            is_valid, error_msg = validate_binary_data(data["description_binary"])
            if not is_valid:
-                raise serializers.ValidationError(
-                    {"description_binary": "Invalid binary data"}
-                )
+                raise serializers.ValidationError({"description_binary": error_msg})

        return data

@@ -441,11 +441,7 @@ class WorkspaceFileAssetEndpoint(BaseAPIView):
        # Get the presigned URL
        storage = S3Storage(request=request)
        # Generate a presigned URL to share an S3 object
-        signed_url = storage.generate_presigned_url(
-            object_name=asset.asset.name,
-            disposition="attachment",
-            filename=asset.attributes.get("name"),
-        )
+        signed_url = storage.generate_presigned_url(object_name=asset.asset.name)
        # Redirect to the signed URL
        return HttpResponseRedirect(signed_url)

@@ -645,11 +641,7 @@ class ProjectAssetEndpoint(BaseAPIView):
        # Get the presigned URL
        storage = S3Storage(request=request)
        # Generate a presigned URL to share an S3 object
-        signed_url = storage.generate_presigned_url(
-            object_name=asset.asset.name,
-            disposition="attachment",
-            filename=asset.attributes.get("name"),
-        )
+        signed_url = storage.generate_presigned_url(object_name=asset.asset.name)
        # Redirect to the signed URL
        return HttpResponseRedirect(signed_url)

@@ -3,7 +3,7 @@ import json

 # Django imports
 from django.core.serializers.json import DjangoJSONEncoder
-from django.db.models import F, Func, OuterRef, Q, Prefetch, Exists, Subquery, Count
+from django.db.models import F, Func, OuterRef, Q, Prefetch, Exists, Subquery
 from django.utils import timezone
 from django.utils.decorators import method_decorator
 from django.views.decorators.gzip import gzip_page
@@ -69,31 +69,25 @@ class IssueArchiveViewSet(BaseViewSet):
                )
            )
            .annotate(
-                link_count=Subquery(
-                    IssueLink.objects.filter(issue=OuterRef("id"))
-                    .values("issue")
-                    .annotate(count=Count("id"))
-                    .values("count")
-                )
+                link_count=IssueLink.objects.filter(issue=OuterRef("id"))
+                .order_by()
+                .annotate(count=Func(F("id"), function="Count"))
+                .values("count")
            )
            .annotate(
-                attachment_count=Subquery(
-                    FileAsset.objects.filter(
-                        issue_id=OuterRef("id"),
-                        entity_type=FileAsset.EntityTypeContext.ISSUE_ATTACHMENT,
-                    )
-                    .values("issue_id")
-                    .annotate(count=Count("id"))
-                    .values("count")
+                attachment_count=FileAsset.objects.filter(
+                    issue_id=OuterRef("id"),
+                    entity_type=FileAsset.EntityTypeContext.ISSUE_ATTACHMENT,
                )
+                .order_by()
+                .annotate(count=Func(F("id"), function="Count"))
+                .values("count")
            )
            .annotate(
-                sub_issues_count=Subquery(
-                    Issue.issue_objects.filter(parent=OuterRef("id"))
-                    .values("parent")
-                    .annotate(count=Count("id"))
-                    .values("count")
-                )
+                sub_issues_count=Issue.issue_objects.filter(parent=OuterRef("id"))
+                .order_by()
+                .annotate(count=Func(F("id"), function="Count"))
+                .values("count")
            )
        )

@@ -107,19 +101,6 @@ class IssueArchiveViewSet(BaseViewSet):

        issue_queryset = self.get_queryset().filter(**filters)

-        total_issue_queryset = Issue.objects.filter(
-            deleted_at__isnull=True,
-            archived_at__isnull=False,
-            project_id=project_id,
-            workspace__slug=slug,
-        ).filter(**filters)
-
-        total_issue_queryset = (
-            total_issue_queryset
-            if show_sub_issues == "true"
-            else total_issue_queryset.filter(parent__isnull=True)
-        )
-
        issue_queryset = (
            issue_queryset
            if show_sub_issues == "true"
@@ -155,7 +136,6 @@ class IssueArchiveViewSet(BaseViewSet):
                        request=request,
                        order_by=order_by_param,
                        queryset=issue_queryset,
-                        total_count_queryset=total_issue_queryset,
                        on_results=lambda issues: issue_on_results(
                            group_by=group_by, issues=issues, sub_group_by=sub_group_by
                        ),
@@ -190,7 +170,6 @@ class IssueArchiveViewSet(BaseViewSet):
                    request=request,
                    order_by=order_by_param,
                    queryset=issue_queryset,
-                    total_count_queryset=total_issue_queryset,
                    on_results=lambda issues: issue_on_results(
                        group_by=group_by, issues=issues, sub_group_by=sub_group_by
                    ),
@@ -217,7 +196,6 @@ class IssueArchiveViewSet(BaseViewSet):
                order_by=order_by_param,
                request=request,
                queryset=issue_queryset,
-                total_count_queryset=total_issue_queryset,
                on_results=lambda issues: issue_on_results(
                    group_by=group_by, issues=issues, sub_group_by=sub_group_by
                ),
@@ -51,7 +51,6 @@ from plane.db.models import (
    IssueRelation,
    IssueAssignee,
    IssueLabel,
-    IntakeIssue,
 )
 from plane.utils.grouper import (
    issue_group_values,
@@ -214,33 +213,27 @@ class IssueViewSet(BaseViewSet):
                )
            )
            .annotate(
-                link_count=Subquery(
-                    IssueLink.objects.filter(issue=OuterRef("id"))
-                    .values("issue")
-                    .annotate(count=Count("id"))
-                    .values("count")
-                )
+                link_count=IssueLink.objects.filter(issue=OuterRef("id"))
+                .order_by()
+                .annotate(count=Func(F("id"), function="Count"))
+                .values("count")
            )
            .annotate(
-                attachment_count=Subquery(
-                    FileAsset.objects.filter(
-                        issue_id=OuterRef("id"),
-                        entity_type=FileAsset.EntityTypeContext.ISSUE_ATTACHMENT,
-                    )
-                    .values("issue_id")
-                    .annotate(count=Count("id"))
-                    .values("count")
+                attachment_count=FileAsset.objects.filter(
+                    issue_id=OuterRef("id"),
+                    entity_type=FileAsset.EntityTypeContext.ISSUE_ATTACHMENT,
                )
+                .order_by()
+                .annotate(count=Func(F("id"), function="Count"))
+                .values("count")
            )
            .annotate(
-                sub_issues_count=Subquery(
-                    Issue.issue_objects.filter(parent=OuterRef("id"))
-                    .values("parent")
-                    .annotate(count=Count("id"))
-                    .values("count")
-                )
+                sub_issues_count=Issue.issue_objects.filter(parent=OuterRef("id"))
+                .order_by()
+                .annotate(count=Func(F("id"), function="Count"))
+                .values("count")
            )
-        )
+        ).distinct()

    @method_decorator(gzip_page)
    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
@@ -256,10 +249,6 @@ class IssueViewSet(BaseViewSet):
        issue_queryset = self.get_queryset().filter(**filters, **extra_filters)
        # Custom ordering for priority and state

-        total_issue_queryset = Issue.issue_objects.filter(
-            project_id=project_id, workspace__slug=slug
-        ).filter(**filters, **extra_filters)
-
        # Issue queryset
        issue_queryset, order_by_param = order_issue_queryset(
            issue_queryset=issue_queryset, order_by_param=order_by_param
@@ -292,7 +281,6 @@ class IssueViewSet(BaseViewSet):
            and not project.guest_view_all_features
        ):
            issue_queryset = issue_queryset.filter(created_by=request.user)
-            total_issue_queryset = total_issue_queryset.filter(created_by=request.user)

        if group_by:
            if sub_group_by:
@@ -308,7 +296,6 @@ class IssueViewSet(BaseViewSet):
                        request=request,
                        order_by=order_by_param,
                        queryset=issue_queryset,
-                        total_count_queryset=total_issue_queryset,
                        on_results=lambda issues: issue_on_results(
                            group_by=group_by, issues=issues, sub_group_by=sub_group_by
                        ),
@@ -342,7 +329,6 @@ class IssueViewSet(BaseViewSet):
                    request=request,
                    order_by=order_by_param,
                    queryset=issue_queryset,
-                    total_count_queryset=total_issue_queryset,
                    on_results=lambda issues: issue_on_results(
                        group_by=group_by, issues=issues, sub_group_by=sub_group_by
                    ),
@@ -368,7 +354,6 @@ class IssueViewSet(BaseViewSet):
                order_by=order_by_param,
                request=request,
                queryset=issue_queryset,
-                total_count_queryset=total_issue_queryset,
                on_results=lambda issues: issue_on_results(
                    group_by=group_by, issues=issues, sub_group_by=sub_group_by
                ),
@@ -1224,7 +1209,7 @@ class IssueDetailIdentifierEndpoint(BaseAPIView):

        # Fetch the issue
        issue = (
-            Issue.objects.filter(project_id=project.id)
+            Issue.issue_objects.filter(project_id=project.id)
            .filter(workspace__slug=slug)
            .select_related("workspace", "project", "state", "parent")
            .prefetch_related("assignees", "labels", "issue_module__module")
@@ -1316,16 +1301,6 @@ class IssueDetailIdentifierEndpoint(BaseAPIView):
                    )
                )
            )
-            .annotate(
-                is_intake=Exists(
-                    IntakeIssue.objects.filter(
-                        issue=OuterRef("id"),
-                        status__in=[-2, 0],
-                        workspace__slug=slug,
-                        project_id=project.id,
-                    )
-                )
-            )
        ).first()

        # Check if the issue exists
@@ -198,7 +198,6 @@ class PageViewSet(BaseViewSet):
    def retrieve(self, request, slug, project_id, pk=None):
        page = self.get_queryset().filter(pk=pk).first()
        project = Project.objects.get(pk=project_id)
-        track_visit = request.query_params.get("track_visit", "true").lower() == "true"

        """
        if the role is guest and guest_view_all_features is false and owned by is not
@@ -231,14 +230,13 @@ class PageViewSet(BaseViewSet):
            ).values_list("entity_identifier", flat=True)
            data = PageDetailSerializer(page).data
            data["issue_ids"] = issue_ids
-            if track_visit:
-                recent_visited_task.delay(
-                    slug=slug,
-                    entity_name="page",
-                    entity_identifier=pk,
-                    user_id=request.user.id,
-                    project_id=project_id,
-                )
+            recent_visited_task.delay(
+                slug=slug,
+                entity_name="page",
+                entity_identifier=pk,
+                user_id=request.user.id,
+                project_id=project_id,
+            )
            return Response(data, status=status.HTTP_200_OK)

    @allow_permission([ROLE.ADMIN], model=Page, creator=True)
@@ -5,12 +5,13 @@ from django.utils import timezone
 import json

 # Django imports
+from django.db import IntegrityError
 from django.db.models import Exists, F, OuterRef, Prefetch, Q, Subquery
 from django.core.serializers.json import DjangoJSONEncoder

 # Third Party imports
 from rest_framework.response import Response
-from rest_framework import status
+from rest_framework import serializers, status
 from rest_framework.permissions import AllowAny

 # Module imports
@@ -105,10 +106,7 @@ class ProjectViewSet(BaseViewSet):
        fields = [field for field in request.GET.get("fields", "").split(",") if field]
        projects = self.get_queryset().order_by("sort_order", "name")
        if WorkspaceMember.objects.filter(
-            member=request.user,
-            workspace__slug=slug,
-            is_active=True,
-            role=ROLE.GUEST.value,
+            member=request.user, workspace__slug=slug, is_active=True, role=5
        ).exists():
            projects = projects.filter(
                project_projectmember__member=self.request.user,
@@ -116,10 +114,7 @@ class ProjectViewSet(BaseViewSet):
            )

        if WorkspaceMember.objects.filter(
-            member=request.user,
-            workspace__slug=slug,
-            is_active=True,
-            role=ROLE.MEMBER.value,
+            member=request.user, workspace__slug=slug, is_active=True, role=15
        ).exists():
            projects = projects.filter(
                Q(
@@ -194,10 +189,7 @@ class ProjectViewSet(BaseViewSet):
        )

        if WorkspaceMember.objects.filter(
-            member=request.user,
-            workspace__slug=slug,
-            is_active=True,
-            role=ROLE.GUEST.value,
+            member=request.user, workspace__slug=slug, is_active=True, role=5
        ).exists():
            projects = projects.filter(
                project_projectmember__member=self.request.user,
@@ -205,10 +197,7 @@ class ProjectViewSet(BaseViewSet):
            )

        if WorkspaceMember.objects.filter(
-            member=request.user,
-            workspace__slug=slug,
-            is_active=True,
-            role=ROLE.MEMBER.value,
+            member=request.user, workspace__slug=slug, is_active=True, role=15
        ).exists():
            projects = projects.filter(
                Q(
@@ -261,9 +250,7 @@ class ProjectViewSet(BaseViewSet):

            # Add the user as Administrator to the project
            _ = ProjectMember.objects.create(
-                project_id=serializer.data["id"],
-                member=request.user,
-                role=ROLE.ADMIN.value,
+                project_id=serializer.data["id"], member=request.user, role=20
            )
            # Also create the issue property for the user
            _ = IssueUserProperty.objects.create(
@@ -276,7 +263,7 @@ class ProjectViewSet(BaseViewSet):
                ProjectMember.objects.create(
                    project_id=serializer.data["id"],
                    member_id=serializer.data["project_lead"],
-                    role=ROLE.ADMIN.value,
+                    role=20,
                )
                # Also create the issue property for the user
                IssueUserProperty.objects.create(
@@ -354,23 +341,13 @@ class ProjectViewSet(BaseViewSet):

    def partial_update(self, request, slug, pk=None):
        # try:
-        is_workspace_admin = WorkspaceMember.objects.filter(
-            member=request.user,
-            workspace__slug=slug,
-            is_active=True,
-            role=ROLE.ADMIN.value,
-        ).exists()
-
-        is_project_admin = ProjectMember.objects.filter(
+        if not ProjectMember.objects.filter(
            member=request.user,
            workspace__slug=slug,
            project_id=pk,
-            role=ROLE.ADMIN.value,
+            role=20,
            is_active=True,
-        ).exists()
-
-        # Return error for if the user is neither workspace admin nor project admin
-        if not is_project_admin and not is_workspace_admin:
+        ).exists():
            return Response(
                {"error": "You don't have the required permissions."},
                status=status.HTTP_403_FORBIDDEN,
@@ -425,16 +402,13 @@ class ProjectViewSet(BaseViewSet):
    def destroy(self, request, slug, pk):
        if (
            WorkspaceMember.objects.filter(
-                member=request.user,
-                workspace__slug=slug,
-                is_active=True,
-                role=ROLE.ADMIN.value,
+                member=request.user, workspace__slug=slug, is_active=True, role=20
            ).exists()
            or ProjectMember.objects.filter(
                member=request.user,
                workspace__slug=slug,
                project_id=pk,
-                role=ROLE.ADMIN.value,
+                role=20,
                is_active=True,
            ).exists()
        ):
@@ -59,10 +59,9 @@ class IssueSearchEndpoint(BaseAPIView):
        )

        related_issue_ids = [item for sublist in related_issue_ids for item in sublist]
-        related_issue_ids.append(issue_id)

        if issue:
-            issues = issues.exclude(pk__in=related_issue_ids)
+            issues = issues.filter(~Q(pk=issue_id), ~Q(pk__in=related_issue_ids))

        return issues

@@ -172,14 +172,12 @@ class WorkspaceDraftIssueViewSet(BaseViewSet):
                {"error": "Issue not found"}, status=status.HTTP_404_NOT_FOUND
            )

-        project_id = request.data.get("project_id", issue.project_id)
-
        serializer = DraftIssueCreateSerializer(
            issue,
            data=request.data,
            partial=True,
            context={
-                "project_id": project_id,
+                "project_id": request.data.get("project_id", None),
                "cycle_id": request.data.get("cycle_id", "not_provided"),
            },
        )
@@ -7,6 +7,7 @@ from plane.app.serializers import StateSerializer
 from plane.app.views.base import BaseAPIView
 from plane.db.models import State
 from plane.app.permissions import WorkspaceEntityPermission
+from plane.utils.cache import cache_response
 from collections import defaultdict


@@ -14,6 +15,7 @@ class WorkspaceStatesEndpoint(BaseAPIView):
    permission_classes = [WorkspaceEntityPermission]
    use_read_replica = True

+    @cache_response(60 * 60 * 2)
    def get(self, request, slug):
        states = State.objects.filter(
            workspace__slug=slug,
@@ -107,8 +107,7 @@ class MagicSignInEndpoint(View):
            # Login the user and record his device info
            user_login(request=request, user=user, is_app=True)
            if user.is_password_autoset and profile.is_onboarded:
-                # Redirect to the home page
-                path = "/"
+                path = "accounts/set-password"
            else:
                # Get the redirection path
                path = (
@@ -0,0 +1,15 @@
+from django.utils import timezone
+from datetime import timedelta
+from plane.db.models import APIActivityLog
+from celery import shared_task
+
+
+@shared_task
+def delete_api_logs():
+    # Get the logs older than 30 days to delete
+    logs_to_delete = APIActivityLog.objects.filter(
+        created_at__lte=timezone.now() - timedelta(days=30)
+    )
+
+    # Delete the logs
+    logs_to_delete._raw_delete(logs_to_delete.db)
@@ -1,423 +0,0 @@
-# Python imports
-from datetime import timedelta
-import logging
-from typing import List, Dict, Any, Callable, Optional
-import os
-
-# Django imports
-from django.utils import timezone
-from django.db.models import F, Window, Subquery
-from django.db.models.functions import RowNumber
-
-# Third party imports
-from celery import shared_task
-from pymongo.errors import BulkWriteError
-from pymongo.collection import Collection
-from pymongo.operations import InsertOne
-
-# Module imports
-from plane.db.models import (
-    EmailNotificationLog,
-    PageVersion,
-    APIActivityLog,
-    IssueDescriptionVersion,
-)
-from plane.settings.mongo import MongoConnection
-from plane.utils.exception_logger import log_exception
-
-
-logger = logging.getLogger("plane.worker")
-BATCH_SIZE = 1000
-
-
-def get_mongo_collection(collection_name: str) -> Optional[Collection]:
-    """Get MongoDB collection if available, otherwise return None."""
-    if not MongoConnection.is_configured():
-        logger.info("MongoDB not configured")
-        return None
-
-    try:
-        mongo_collection = MongoConnection.get_collection(collection_name)
-        logger.info(f"MongoDB collection '{collection_name}' connected successfully")
-        return mongo_collection
-    except Exception as e:
-        logger.error(f"Failed to get MongoDB collection: {str(e)}")
-        log_exception(e)
-        return None
-
-
-def flush_to_mongo_and_delete(
-    mongo_collection: Optional[Collection],
-    buffer: List[Dict[str, Any]],
-    ids_to_delete: List[int],
-    model,
-    mongo_available: bool,
-) -> None:
-    """
-    Inserts a batch of records into MongoDB and deletes the corresponding rows from PostgreSQL.
-    """
-    if not buffer:
-        logger.debug("No records to flush - buffer is empty")
-        return
-
-    logger.info(
-        f"Starting batch flush: {len(buffer)} records, {len(ids_to_delete)} IDs to delete"
-    )
-
-    mongo_archival_failed = False
-
-    # Try to insert into MongoDB if available
-    if mongo_collection is not None and mongo_available:
-        try:
-            mongo_collection.bulk_write([InsertOne(doc) for doc in buffer])
-        except BulkWriteError as bwe:
-            logger.error(f"MongoDB bulk write error: {str(bwe)}")
-            log_exception(bwe)
-            mongo_archival_failed = True
-
-    # If MongoDB is available and archival failed, log the error and return
-    if mongo_available and mongo_archival_failed:
-        logger.error(f"MongoDB archival failed for {len(buffer)} records")
-        return
-
-    # Delete from PostgreSQL - delete() returns (count, {model: count})
-    delete_result = model.all_objects.filter(id__in=ids_to_delete).delete()
-    deleted_count = (
-        delete_result[0] if delete_result and isinstance(delete_result, tuple) else 0
-    )
-    logger.info(f"Batch flush completed: {deleted_count} records deleted")
-
-
-def process_cleanup_task(
-    queryset_func: Callable,
-    transform_func: Callable[[Dict], Dict],
-    model,
-    task_name: str,
-    collection_name: str,
-):
-    """
-    Generic function to process cleanup tasks.
-
-    Args:
-        queryset_func: Function that returns the queryset to process
-        transform_func: Function to transform each record for MongoDB
-        model: Django model class
-        task_name: Name of the task for logging
-        collection_name: MongoDB collection name
-    """
-    logger.info(f"Starting {task_name} cleanup task")
-
-    # Get MongoDB collection
-    mongo_collection = get_mongo_collection(collection_name)
-    mongo_available = mongo_collection is not None
-
-    # Get queryset
-    queryset = queryset_func()
-
-    # Process records in batches
-    buffer: List[Dict[str, Any]] = []
-    ids_to_delete: List[int] = []
-    total_processed = 0
-    total_batches = 0
-
-    for record in queryset:
-        # Transform record for MongoDB
-        buffer.append(transform_func(record))
-        ids_to_delete.append(record["id"])
-
-        # Flush batch when it reaches BATCH_SIZE
-        if len(buffer) >= BATCH_SIZE:
-            total_batches += 1
-            flush_to_mongo_and_delete(
-                mongo_collection=mongo_collection,
-                buffer=buffer,
-                ids_to_delete=ids_to_delete,
-                model=model,
-                mongo_available=mongo_available,
-            )
-            total_processed += len(buffer)
-            buffer.clear()
-            ids_to_delete.clear()
-
-    # Process final batch if any records remain
-    if buffer:
-        total_batches += 1
-        flush_to_mongo_and_delete(
-            mongo_collection=mongo_collection,
-            buffer=buffer,
-            ids_to_delete=ids_to_delete,
-            model=model,
-            mongo_available=mongo_available,
-        )
-        total_processed += len(buffer)
-
-    logger.info(
-        f"{task_name} cleanup task completed",
-        extra={
-            "total_records_processed": total_processed,
-            "total_batches": total_batches,
-            "mongo_available": mongo_available,
-            "collection_name": collection_name,
-        },
-    )
-
-
-# Transform functions for each model
-def transform_api_log(record: Dict) -> Dict:
-    """Transform API activity log record."""
-    return {
-        "id": str(record["id"]),
-        "created_at": str(record["created_at"]) if record.get("created_at") else None,
-        "token_identifier": str(record["token_identifier"]),
-        "path": record["path"],
-        "method": record["method"],
-        "query_params": record.get("query_params"),
-        "headers": record.get("headers"),
-        "body": record.get("body"),
-        "response_code": record["response_code"],
-        "response_body": record["response_body"],
-        "ip_address": record["ip_address"],
-        "user_agent": record["user_agent"],
-        "created_by_id": str(record["created_by_id"]),
-    }
-
-
-def transform_email_log(record: Dict) -> Dict:
-    """Transform email notification log record."""
-    return {
-        "id": str(record["id"]),
-        "created_at": str(record["created_at"]) if record.get("created_at") else None,
-        "receiver_id": str(record["receiver_id"]),
-        "triggered_by_id": str(record["triggered_by_id"]),
-        "entity_identifier": str(record["entity_identifier"]),
-        "entity_name": record["entity_name"],
-        "data": record["data"],
-        "processed_at": (
-            str(record["processed_at"]) if record.get("processed_at") else None
-        ),
-        "sent_at": str(record["sent_at"]) if record.get("sent_at") else None,
-        "entity": record["entity"],
-        "old_value": str(record["old_value"]),
-        "new_value": str(record["new_value"]),
-        "created_by_id": str(record["created_by_id"]),
-    }
-
-
-def transform_page_version(record: Dict) -> Dict:
-    """Transform page version record."""
-    return {
-        "id": str(record["id"]),
-        "created_at": str(record["created_at"]) if record.get("created_at") else None,
-        "page_id": str(record["page_id"]),
-        "workspace_id": str(record["workspace_id"]),
-        "owned_by_id": str(record["owned_by_id"]),
-        "description_html": record["description_html"],
-        "description_binary": record["description_binary"],
-        "description_stripped": record["description_stripped"],
-        "description_json": record["description_json"],
-        "sub_pages_data": record["sub_pages_data"],
-        "created_by_id": str(record["created_by_id"]),
-        "updated_by_id": str(record["updated_by_id"]),
-        "deleted_at": str(record["deleted_at"]) if record.get("deleted_at") else None,
-        "last_saved_at": (
-            str(record["last_saved_at"]) if record.get("last_saved_at") else None
-        ),
-    }
-
-
-def transform_issue_description_version(record: Dict) -> Dict:
-    """Transform issue description version record."""
-    return {
-        "id": str(record["id"]),
-        "created_at": str(record["created_at"]) if record.get("created_at") else None,
-        "issue_id": str(record["issue_id"]),
-        "workspace_id": str(record["workspace_id"]),
-        "project_id": str(record["project_id"]),
-        "created_by_id": str(record["created_by_id"]),
-        "updated_by_id": str(record["updated_by_id"]),
-        "owned_by_id": str(record["owned_by_id"]),
-        "last_saved_at": (
-            str(record["last_saved_at"]) if record.get("last_saved_at") else None
-        ),
-        "description_binary": record["description_binary"],
-        "description_html": record["description_html"],
-        "description_stripped": record["description_stripped"],
-        "description_json": record["description_json"],
-        "deleted_at": str(record["deleted_at"]) if record.get("deleted_at") else None,
-    }
-
-
-# Queryset functions for each cleanup task
-def get_api_logs_queryset():
-    """Get API logs older than cutoff days."""
-    cutoff_days = int(os.environ.get("HARD_DELETE_AFTER_DAYS", 30))
-    cutoff_time = timezone.now() - timedelta(days=cutoff_days)
-    logger.info(f"API logs cutoff time: {cutoff_time}")
-
-    return (
-        APIActivityLog.all_objects.filter(created_at__lte=cutoff_time)
-        .values(
-            "id",
-            "created_at",
-            "token_identifier",
-            "path",
-            "method",
-            "query_params",
-            "headers",
-            "body",
-            "response_code",
-            "response_body",
-            "ip_address",
-            "user_agent",
-            "created_by_id",
-        )
-        .iterator(chunk_size=BATCH_SIZE)
-    )
-
-
-def get_email_logs_queryset():
-    """Get email logs older than cutoff days."""
-    cutoff_days = int(os.environ.get("HARD_DELETE_AFTER_DAYS", 30))
-    cutoff_time = timezone.now() - timedelta(days=cutoff_days)
-    logger.info(f"Email logs cutoff time: {cutoff_time}")
-
-    return (
-        EmailNotificationLog.all_objects.filter(sent_at__lte=cutoff_time)
-        .values(
-            "id",
-            "created_at",
-            "receiver_id",
-            "triggered_by_id",
-            "entity_identifier",
-            "entity_name",
-            "data",
-            "processed_at",
-            "sent_at",
-            "entity",
-            "old_value",
-            "new_value",
-            "created_by_id",
-        )
-        .iterator(chunk_size=BATCH_SIZE)
-    )
-
-
-def get_page_versions_queryset():
-    """Get page versions beyond the maximum allowed (20 per page)."""
-    subq = (
-        PageVersion.all_objects.annotate(
-            row_num=Window(
-                expression=RowNumber(),
-                partition_by=[F("page_id")],
-                order_by=F("created_at").desc(),
-            )
-        )
-        .filter(row_num__gt=20)
-        .values("id")
-    )
-
-    return (
-        PageVersion.all_objects.filter(id__in=Subquery(subq))
-        .values(
-            "id",
-            "created_at",
-            "page_id",
-            "workspace_id",
-            "owned_by_id",
-            "description_html",
-            "description_binary",
-            "description_stripped",
-            "description_json",
-            "sub_pages_data",
-            "created_by_id",
-            "updated_by_id",
-            "deleted_at",
-            "last_saved_at",
-        )
-        .iterator(chunk_size=BATCH_SIZE)
-    )
-
-
-def get_issue_description_versions_queryset():
-    """Get issue description versions beyond the maximum allowed (20 per issue)."""
-    subq = (
-        IssueDescriptionVersion.all_objects.annotate(
-            row_num=Window(
-                expression=RowNumber(),
-                partition_by=[F("issue_id")],
-                order_by=F("created_at").desc(),
-            )
-        )
-        .filter(row_num__gt=20)
-        .values("id")
-    )
-
-    return (
-        IssueDescriptionVersion.all_objects.filter(id__in=Subquery(subq))
-        .values(
-            "id",
-            "created_at",
-            "issue_id",
-            "workspace_id",
-            "project_id",
-            "created_by_id",
-            "updated_by_id",
-            "owned_by_id",
-            "last_saved_at",
-            "description_binary",
-            "description_html",
-            "description_stripped",
-            "description_json",
-            "deleted_at",
-        )
-        .iterator(chunk_size=BATCH_SIZE)
-    )
-
-
-# Celery tasks - now much simpler!
-@shared_task
-def delete_api_logs():
-    """Delete old API activity logs."""
-    process_cleanup_task(
-        queryset_func=get_api_logs_queryset,
-        transform_func=transform_api_log,
-        model=APIActivityLog,
-        task_name="API Activity Log",
-        collection_name="api_activity_logs",
-    )
-
-
-@shared_task
-def delete_email_notification_logs():
-    """Delete old email notification logs."""
-    process_cleanup_task(
-        queryset_func=get_email_logs_queryset,
-        transform_func=transform_email_log,
-        model=EmailNotificationLog,
-        task_name="Email Notification Log",
-        collection_name="email_notification_logs",
-    )
-
-
-@shared_task
-def delete_page_versions():
-    """Delete excess page versions."""
-    process_cleanup_task(
-        queryset_func=get_page_versions_queryset,
-        transform_func=transform_page_version,
-        model=PageVersion,
-        task_name="Page Version",
-        collection_name="page_versions",
-    )
-
-
-@shared_task
-def delete_issue_description_versions():
-    """Delete excess issue description versions."""
-    process_cleanup_task(
-        queryset_func=get_issue_description_versions_queryset,
-        transform_func=transform_issue_description_version,
-        model=IssueDescriptionVersion,
-        task_name="Issue Description Version",
-        collection_name="issue_description_versions",
-    )
@@ -30,8 +30,6 @@ def page_version(page_id, existing_instance, user_id):
                description_binary=page.description_binary,
                owned_by_id=user_id,
                last_saved_at=page.updated_at,
-                description_json=page.description,
-                description_stripped=page.description_stripped,
            )

            # If page versions are greater than 20 delete the oldest one
@@ -50,21 +50,9 @@ app.conf.beat_schedule = {
        "schedule": crontab(hour=2, minute=0),  # UTC 02:00
    },
    "check-every-day-to-delete-api-logs": {
-        "task": "plane.bgtasks.cleanup_task.delete_api_logs",
+        "task": "plane.bgtasks.api_logs_task.delete_api_logs",
        "schedule": crontab(hour=2, minute=30),  # UTC 02:30
    },
-    "check-every-day-to-delete-email-notification-logs": {
-        "task": "plane.bgtasks.cleanup_task.delete_email_notification_logs",
-        "schedule": crontab(hour=3, minute=0),  # UTC 03:00
-    },
-    "check-every-day-to-delete-page-versions": {
-        "task": "plane.bgtasks.cleanup_task.delete_page_versions",
-        "schedule": crontab(hour=3, minute=30),  # UTC 03:30
-    },
-    "check-every-day-to-delete-issue-description-versions": {
-        "task": "plane.bgtasks.cleanup_task.delete_issue_description_versions",
-        "schedule": crontab(hour=4, minute=0),  # UTC 04:00
-    },
 }


@@ -1,182 +0,0 @@
-# Generated by Django 4.2.21 on 2025-08-19 11:52
-
-from django.conf import settings
-from django.db import migrations, models
-import django.db.models.deletion
-import uuid
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("db", "0100_profile_has_marketing_email_consent_and_more"),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="Description",
-            fields=[
-                (
-                    "created_at",
-                    models.DateTimeField(auto_now_add=True, verbose_name="Created At"),
-                ),
-                (
-                    "updated_at",
-                    models.DateTimeField(
-                        auto_now=True, verbose_name="Last Modified At"
-                    ),
-                ),
-                (
-                    "deleted_at",
-                    models.DateTimeField(
-                        blank=True, null=True, verbose_name="Deleted At"
-                    ),
-                ),
-                (
-                    "id",
-                    models.UUIDField(
-                        db_index=True,
-                        default=uuid.uuid4,
-                        editable=False,
-                        primary_key=True,
-                        serialize=False,
-                        unique=True,
-                    ),
-                ),
-                ("description_json", models.JSONField(blank=True, default=dict)),
-                ("description_html", models.TextField(blank=True, default="<p></p>")),
-                ("description_binary", models.BinaryField(null=True)),
-                ("description_stripped", models.TextField(blank=True, null=True)),
-                (
-                    "created_by",
-                    models.ForeignKey(
-                        null=True,
-                        on_delete=django.db.models.deletion.SET_NULL,
-                        related_name="%(class)s_created_by",
-                        to=settings.AUTH_USER_MODEL,
-                        verbose_name="Created By",
-                    ),
-                ),
-                (
-                    "project",
-                    models.ForeignKey(
-                        null=True,
-                        on_delete=django.db.models.deletion.CASCADE,
-                        related_name="project_%(class)s",
-                        to="db.project",
-                    ),
-                ),
-                (
-                    "updated_by",
-                    models.ForeignKey(
-                        null=True,
-                        on_delete=django.db.models.deletion.SET_NULL,
-                        related_name="%(class)s_updated_by",
-                        to=settings.AUTH_USER_MODEL,
-                        verbose_name="Last Modified By",
-                    ),
-                ),
-                (
-                    "workspace",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        related_name="workspace_%(class)s",
-                        to="db.workspace",
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "Description",
-                "verbose_name_plural": "Descriptions",
-                "db_table": "descriptions",
-                "ordering": ("-created_at",),
-            },
-        ),
-        migrations.CreateModel(
-            name="DescriptionVersion",
-            fields=[
-                (
-                    "created_at",
-                    models.DateTimeField(auto_now_add=True, verbose_name="Created At"),
-                ),
-                (
-                    "updated_at",
-                    models.DateTimeField(
-                        auto_now=True, verbose_name="Last Modified At"
-                    ),
-                ),
-                (
-                    "deleted_at",
-                    models.DateTimeField(
-                        blank=True, null=True, verbose_name="Deleted At"
-                    ),
-                ),
-                (
-                    "id",
-                    models.UUIDField(
-                        db_index=True,
-                        default=uuid.uuid4,
-                        editable=False,
-                        primary_key=True,
-                        serialize=False,
-                        unique=True,
-                    ),
-                ),
-                ("description_json", models.JSONField(blank=True, default=dict)),
-                ("description_html", models.TextField(blank=True, default="<p></p>")),
-                ("description_binary", models.BinaryField(null=True)),
-                ("description_stripped", models.TextField(blank=True, null=True)),
-                (
-                    "created_by",
-                    models.ForeignKey(
-                        null=True,
-                        on_delete=django.db.models.deletion.SET_NULL,
-                        related_name="%(class)s_created_by",
-                        to=settings.AUTH_USER_MODEL,
-                        verbose_name="Created By",
-                    ),
-                ),
-                (
-                    "description",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        related_name="versions",
-                        to="db.description",
-                    ),
-                ),
-                (
-                    "project",
-                    models.ForeignKey(
-                        null=True,
-                        on_delete=django.db.models.deletion.CASCADE,
-                        related_name="project_%(class)s",
-                        to="db.project",
-                    ),
-                ),
-                (
-                    "updated_by",
-                    models.ForeignKey(
-                        null=True,
-                        on_delete=django.db.models.deletion.SET_NULL,
-                        related_name="%(class)s_updated_by",
-                        to=settings.AUTH_USER_MODEL,
-                        verbose_name="Last Modified By",
-                    ),
-                ),
-                (
-                    "workspace",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        related_name="workspace_%(class)s",
-                        to="db.workspace",
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "Description Version",
-                "verbose_name_plural": "Description Versions",
-                "db_table": "description_versions",
-                "ordering": ("-created_at",),
-            },
-        ),
-    ]
@@ -1,30 +0,0 @@
-# Generated by Django 4.2.22 on 2025-08-29 11:31
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("db", "0101_description_descriptionversion"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="page",
-            name="sort_order",
-            field=models.FloatField(default=65535),
-        ),
-        migrations.AddField(
-            model_name="pagelog",
-            name="entity_type",
-            field=models.CharField(
-                blank=True, max_length=30, null=True, verbose_name="Entity Type"
-            ),
-        ),
-        migrations.AlterField(
-            model_name="pagelog",
-            name="entity_identifier",
-            field=models.UUIDField(blank=True, null=True),
-        ),
-    ]
@@ -1,75 +0,0 @@
-# Generated by Django 4.2.22 on 2025-09-01 14:33
-
-from django.db import migrations, models
-from django.contrib.postgres.operations import AddIndexConcurrently
-
-
-class Migration(migrations.Migration):
-    atomic = False
-
-    dependencies = [
-        ('db', '0102_page_sort_order_pagelog_entity_type_and_more'),
-    ]
-
-    operations = [
-        AddIndexConcurrently(
-            model_name='fileasset',
-            index=models.Index(fields=['entity_type'], name='asset_entity_type_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='fileasset',
-            index=models.Index(fields=['entity_identifier'], name='asset_entity_identifier_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='fileasset',
-            index=models.Index(fields=['entity_type', 'entity_identifier'], name='asset_entity_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='notification',
-            index=models.Index(fields=['entity_identifier'], name='notif_entity_identifier_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='notification',
-            index=models.Index(fields=['entity_name'], name='notif_entity_name_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='notification',
-            index=models.Index(fields=['read_at'], name='notif_read_at_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='notification',
-            index=models.Index(fields=['receiver', 'read_at'], name='notif_entity_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='pagelog',
-            index=models.Index(fields=['entity_type'], name='pagelog_entity_type_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='pagelog',
-            index=models.Index(fields=['entity_identifier'], name='pagelog_entity_id_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='pagelog',
-            index=models.Index(fields=['entity_name'], name='pagelog_entity_name_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='pagelog',
-            index=models.Index(fields=['entity_type', 'entity_identifier'], name='pagelog_type_id_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='pagelog',
-            index=models.Index(fields=['entity_name', 'entity_identifier'], name='pagelog_name_id_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='userfavorite',
-            index=models.Index(fields=['entity_type'], name='fav_entity_type_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='userfavorite',
-            index=models.Index(fields=['entity_identifier'], name='fav_entity_identifier_idx'),
-        ),
-        AddIndexConcurrently(
-            model_name='userfavorite',
-            index=models.Index(fields=['entity_type', 'entity_identifier'], name='fav_entity_idx'),
-        ),
-    ]
@@ -1,43 +0,0 @@
-# Generated by Django 4.2.22 on 2025-09-03 05:18
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('db', '0103_fileasset_asset_entity_type_idx_and_more'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='cycleuserproperties',
-            name='rich_filters',
-            field=models.JSONField(default=dict),
-        ),
-        migrations.AddField(
-            model_name='exporterhistory',
-            name='rich_filters',
-            field=models.JSONField(blank=True, default=dict, null=True),
-        ),
-        migrations.AddField(
-            model_name='issueuserproperty',
-            name='rich_filters',
-            field=models.JSONField(default=dict),
-        ),
-        migrations.AddField(
-            model_name='issueview',
-            name='rich_filters',
-            field=models.JSONField(default=dict),
-        ),
-        migrations.AddField(
-            model_name='moduleuserproperties',
-            name='rich_filters',
-            field=models.JSONField(default=dict),
-        ),
-        migrations.AddField(
-            model_name='workspaceuserproperties',
-            name='rich_filters',
-            field=models.JSONField(default=dict),
-        ),
-    ]
@@ -83,5 +83,3 @@ from .label import Label
 from .device import Device, DeviceSession

 from .sticky import Sticky
-
-from .description import Description, DescriptionVersion
@@ -76,15 +76,6 @@ class FileAsset(BaseModel):
        verbose_name_plural = "File Assets"
        db_table = "file_assets"
        ordering = ("-created_at",)
-        indexes = [
-            models.Index(fields=["entity_type"], name="asset_entity_type_idx"),
-            models.Index(
-                fields=["entity_identifier"], name="asset_entity_identifier_idx"
-            ),
-            models.Index(
-                fields=["entity_type", "entity_identifier"], name="asset_entity_idx"
-            ),
-        ]

    def __str__(self):
        return str(self.asset)
@@ -139,7 +139,6 @@ class CycleUserProperties(ProjectBaseModel):
    filters = models.JSONField(default=get_default_filters)
    display_filters = models.JSONField(default=get_default_display_filters)
    display_properties = models.JSONField(default=get_default_display_properties)
-    rich_filters = models.JSONField(default=dict)

    class Meta:
        unique_together = ["cycle", "user", "deleted_at"]
@@ -1,56 +0,0 @@
-from django.db import models
-from django.utils.html import strip_tags
-from .workspace import WorkspaceBaseModel
-
-
-class Description(WorkspaceBaseModel):
-
-
-    description_json = models.JSONField(default=dict, blank=True)
-    description_html = models.TextField(blank=True, default="<p></p>")
-    description_binary = models.BinaryField(null=True)
-    description_stripped = models.TextField(blank=True, null=True)
-
-    class Meta:
-        verbose_name = "Description"
-        verbose_name_plural = "Descriptions"
-        db_table = "descriptions"
-        ordering = ("-created_at",)
-
-    def save(self, *args, **kwargs):
-        # Strip the html tags using html parser
-        self.description_stripped = (
-            None
-            if (self.description_html == "" or self.description_html is None)
-            else strip_tags(self.description_html)
-        )
-        super(Description, self).save(*args, **kwargs)
-
-
-class DescriptionVersion(WorkspaceBaseModel):
-    """
-    DescriptionVersion is a model used to store historical versions of a Description.
-    """
-
-    description = models.ForeignKey(
-        "db.Description", on_delete=models.CASCADE, related_name="versions"
-    )
-    description_json = models.JSONField(default=dict, blank=True)
-    description_html = models.TextField(blank=True, default="<p></p>")
-    description_binary = models.BinaryField(null=True)
-    description_stripped = models.TextField(blank=True, null=True)
-
-    class Meta:
-        verbose_name = "Description Version"
-        verbose_name_plural = "Description Versions"
-        db_table = "description_versions"
-        ordering = ("-created_at",)
-
-    def save(self, *args, **kwargs):
-        # Strip the html tags using html parser
-        self.description_stripped = (
-            None
-            if (self.description_html == "" or self.description_html is None)
-            else strip_tags(self.description_html)
-        )
-        super(DescriptionVersion, self).save(*args, **kwargs)
@@ -56,7 +56,6 @@ class ExporterHistory(BaseModel):
        related_name="workspace_exporters",
    )
    filters = models.JSONField(blank=True, null=True)
-    rich_filters = models.JSONField(default=dict, blank=True, null=True)

    class Meta:
        verbose_name = "Exporter"
@@ -41,15 +41,6 @@ class UserFavorite(WorkspaceBaseModel):
        verbose_name_plural = "User Favorites"
        db_table = "user_favorites"
        ordering = ("-created_at",)
-        indexes = [
-            models.Index(fields=["entity_type"], name="fav_entity_type_idx"),
-            models.Index(
-                fields=["entity_identifier"], name="fav_entity_identifier_idx"
-            ),
-            models.Index(
-                fields=["entity_type", "entity_identifier"], name="fav_entity_idx"
-            ),
-        ]

    def save(self, *args, **kwargs):
        if self._state.adding:
@@ -509,7 +509,6 @@ class IssueUserProperty(ProjectBaseModel):
    filters = models.JSONField(default=get_default_filters)
    display_filters = models.JSONField(default=get_default_display_filters)
    display_properties = models.JSONField(default=get_default_display_properties)
-    rich_filters = models.JSONField(default=dict)

    class Meta:
        verbose_name = "Issue User Property"
@@ -207,7 +207,6 @@ class ModuleUserProperties(ProjectBaseModel):
    filters = models.JSONField(default=get_default_filters)
    display_filters = models.JSONField(default=get_default_display_filters)
    display_properties = models.JSONField(default=get_default_display_properties)
-    rich_filters = models.JSONField(default=dict)

    class Meta:
        unique_together = ["module", "user", "deleted_at"]
@@ -39,14 +39,6 @@ class Notification(BaseModel):
        verbose_name_plural = "Notifications"
        db_table = "notifications"
        ordering = ("-created_at",)
-        indexes = [
-            models.Index(
-                fields=["entity_identifier"], name="notif_entity_identifier_idx"
-            ),
-            models.Index(fields=["entity_name"], name="notif_entity_name_idx"),
-            models.Index(fields=["read_at"], name="notif_read_at_idx"),
-            models.Index(fields=["receiver", "read_at"], name="notif_entity_idx"),
-        ]

    def __str__(self):
        """Return name of the notifications"""
@@ -57,7 +57,6 @@ class Page(BaseModel):
    )
    moved_to_page = models.UUIDField(null=True, blank=True)
    moved_to_project = models.UUIDField(null=True, blank=True)
-    sort_order = models.FloatField(default=65535)

    external_id = models.CharField(max_length=255, null=True, blank=True)
    external_source = models.CharField(max_length=255, null=True, blank=True)
@@ -99,11 +98,8 @@ class PageLog(BaseModel):
    )
    transaction = models.UUIDField(default=uuid.uuid4)
    page = models.ForeignKey(Page, related_name="page_log", on_delete=models.CASCADE)
-    entity_identifier = models.UUIDField(null=True, blank=True)
+    entity_identifier = models.UUIDField(null=True)
    entity_name = models.CharField(max_length=30, verbose_name="Transaction Type")
-    entity_type = models.CharField(
-        max_length=30, verbose_name="Entity Type", null=True, blank=True
-    )
    workspace = models.ForeignKey(
        "db.Workspace", on_delete=models.CASCADE, related_name="workspace_page_log"
    )
@@ -114,17 +110,6 @@ class PageLog(BaseModel):
        verbose_name_plural = "Page Logs"
        db_table = "page_logs"
        ordering = ("-created_at",)
-        indexes = [
-            models.Index(fields=["entity_type"], name="pagelog_entity_type_idx"),
-            models.Index(fields=["entity_identifier"], name="pagelog_entity_id_idx"),
-            models.Index(fields=["entity_name"], name="pagelog_entity_name_idx"),
-            models.Index(
-                fields=["entity_type", "entity_identifier"], name="pagelog_type_id_idx"
-            ),
-            models.Index(
-                fields=["entity_name", "entity_identifier"], name="pagelog_name_id_idx"
-            ),
-        ]

    def __str__(self):
        return f"{self.page.name} {self.entity_name}"
@@ -18,12 +18,6 @@ from .base import BaseModel
 ROLE_CHOICES = ((20, "Admin"), (15, "Member"), (5, "Guest"))


-class ROLE(Enum):
-    ADMIN = 20
-    MEMBER = 15
-    GUEST = 5
-
-
 class ProjectNetwork(Enum):
    SECRET = 0
    PUBLIC = 2
@@ -58,7 +58,6 @@ class IssueView(WorkspaceBaseModel):
    filters = models.JSONField(default=dict)
    display_filters = models.JSONField(default=get_default_display_filters)
    display_properties = models.JSONField(default=get_default_display_properties)
-    rich_filters = models.JSONField(default=dict)
    access = models.PositiveSmallIntegerField(
        default=1, choices=((0, "Private"), (1, "Public"))
    )
@@ -332,7 +332,6 @@ class WorkspaceUserProperties(BaseModel):
    filters = models.JSONField(default=get_default_filters)
    display_filters = models.JSONField(default=get_default_display_filters)
    display_properties = models.JSONField(default=get_default_display_properties)
-    rich_filters = models.JSONField(default=dict)

    class Meta:
        unique_together = ["workspace", "user", "deleted_at"]
@@ -2,12 +2,11 @@
 import json
 import secrets
 import os
-import requests

 # Django imports
 from django.core.management.base import BaseCommand, CommandError
 from django.utils import timezone
-
+from django.conf import settings

 # Module imports
 from plane.license.models import Instance, InstanceEdition
@@ -21,38 +20,21 @@ class Command(BaseCommand):
        # Positional argument
        parser.add_argument("machine_signature", type=str, help="Machine signature")

-    def check_for_current_version(self):
-        if os.environ.get("APP_VERSION", False):
-            return os.environ.get("APP_VERSION")
+    def read_package_json(self):
+        with open("package.json", "r") as file:
+            # Load JSON content from the file
+            data = json.load(file)

-        try:
-            with open("package.json", "r") as file:
-                data = json.load(file)
-                return data.get("version", "v0.1.0")
-        except Exception:
-            self.stdout.write("Error checking for current version")
-            return "v0.1.0"
-
-    def check_for_latest_version(self, fallback_version):
-        try:
-            response = requests.get(
-                "https://api.github.com/repos/makeplane/plane/releases/latest",
-                timeout=10,
-            )
-            response.raise_for_status()
-            data = response.json()
-            return data.get("tag_name", fallback_version)
-        except Exception:
-            self.stdout.write("Error checking for latest version")
-            return fallback_version
+        payload = {
+            "instance_key": settings.INSTANCE_KEY,
+            "version": data.get("version", 0.1),
+        }
+        return payload

    def handle(self, *args, **options):
        # Check if the instance is registered
        instance = Instance.objects.first()

-        current_version = self.check_for_current_version()
-        latest_version = self.check_for_latest_version(current_version)
-
        # If instance is None then register this instance
        if instance is None:
            machine_signature = options.get("machine_signature", "machine-signature")
@@ -60,11 +42,13 @@ class Command(BaseCommand):
            if not machine_signature:
                raise CommandError("Machine signature is required")

+            payload = self.read_package_json()
+
            instance = Instance.objects.create(
                instance_name="Plane Community Edition",
                instance_id=secrets.token_hex(12),
-                current_version=current_version,
-                latest_version=latest_version,
+                current_version=payload.get("version"),
+                latest_version=payload.get("version"),
                last_checked_at=timezone.now(),
                is_test=os.environ.get("IS_TEST", "0") == "1",
                edition=InstanceEdition.PLANE_COMMUNITY.value,
@@ -73,11 +57,11 @@ class Command(BaseCommand):
            self.stdout.write(self.style.SUCCESS("Instance registered"))
        else:
            self.stdout.write(self.style.SUCCESS("Instance already registered"))
-
+            payload = self.read_package_json()
            # Update the instance details
            instance.last_checked_at = timezone.now()
-            instance.current_version = current_version
-            instance.latest_version = latest_version
+            instance.current_version = payload.get("version")
+            instance.latest_version = payload.get("version")
            instance.is_test = os.environ.get("IS_TEST", "0") == "1"
            instance.edition = InstanceEdition.PLANE_COMMUNITY.value
            instance.save()
@@ -284,7 +284,7 @@ CELERY_IMPORTS = (
    "plane.bgtasks.exporter_expired_task",
    "plane.bgtasks.file_asset_task",
    "plane.bgtasks.email_notification_task",
-    "plane.bgtasks.cleanup_task",
+    "plane.bgtasks.api_logs_task",
    "plane.license.bgtasks.tracer",
    # management tasks
    "plane.bgtasks.dummy_data_task",
@@ -304,10 +304,16 @@ GITHUB_ACCESS_TOKEN = os.environ.get("GITHUB_ACCESS_TOKEN", False)
 ANALYTICS_SECRET_KEY = os.environ.get("ANALYTICS_SECRET_KEY", False)
 ANALYTICS_BASE_API = os.environ.get("ANALYTICS_BASE_API", False)

+
 # Posthog settings
 POSTHOG_API_KEY = os.environ.get("POSTHOG_API_KEY", False)
 POSTHOG_HOST = os.environ.get("POSTHOG_HOST", False)

+# instance key
+INSTANCE_KEY = os.environ.get(
+    "INSTANCE_KEY", "ae6517d563dfc13d8270bd45cf17b08f70b37d989128a9dab46ff687603333c3"
+)
+
 # Skip environment variable configuration
 SKIP_ENV_VAR = os.environ.get("SKIP_ENV_VAR", "1") == "1"

@@ -465,7 +471,3 @@ if ENABLE_DRF_SPECTACULAR:
    REST_FRAMEWORK["DEFAULT_SCHEMA_CLASS"] = "drf_spectacular.openapi.AutoSchema"
    INSTALLED_APPS.append("drf_spectacular")
    from .openapi import SPECTACULAR_SETTINGS  # noqa: F401
-
-# MongoDB Settings
-MONGO_DB_URL = os.environ.get("MONGO_DB_URL", False)
-MONGO_DB_DATABASE = os.environ.get("MONGO_DB_DATABASE", False)
@@ -73,10 +73,5 @@ LOGGING = {
            "handlers": ["console"],
            "propagate": False,
        },
-        "plane.mongo": {
-            "level": "INFO",
-            "handlers": ["console"],
-            "propagate": False,
-        },
    },
 }
@@ -1,124 +0,0 @@
-# Django imports
-from django.conf import settings
-import logging
-
-# Third party imports
-from pymongo import MongoClient
-from pymongo.database import Database
-from pymongo.collection import Collection
-from typing import Optional, TypeVar, Type
-
-
-T = TypeVar("T", bound="MongoConnection")
-
-# Set up logger
-logger = logging.getLogger("plane.mongo")
-
-
-class MongoConnection:
-    """
-    A singleton class that manages MongoDB connections.
-
-    This class ensures only one MongoDB connection is maintained throughout the application.
-    It provides methods to access the MongoDB client, database, and collections.
-
-    Attributes:
-        _instance (Optional[MongoConnection]): The singleton instance of this class
-        _client (Optional[MongoClient]): The MongoDB client instance
-        _db (Optional[Database]): The MongoDB database instance
-    """
-
-    _instance: Optional["MongoConnection"] = None
-    _client: Optional[MongoClient] = None
-    _db: Optional[Database] = None
-
-    def __new__(cls: Type[T]) -> T:
-        """
-        Creates a new instance of MongoConnection if one doesn't exist.
-
-        Returns:
-            MongoConnection: The singleton instance
-        """
-        if cls._instance is None:
-            cls._instance = super(MongoConnection, cls).__new__(cls)
-            try:
-                mongo_url = getattr(settings, "MONGO_DB_URL", None)
-                mongo_db_database = getattr(settings, "MONGO_DB_DATABASE", None)
-
-                if not mongo_url or not mongo_db_database:
-                    logger.warning(
-                        "MongoDB connection parameters not configured. MongoDB functionality will be disabled."
-                    )
-                    return cls._instance
-
-                cls._client = MongoClient(mongo_url)
-                cls._db = cls._client[mongo_db_database]
-
-                # Test the connection
-                cls._client.server_info()
-                logger.info("MongoDB connection established successfully")
-            except Exception as e:
-                logger.warning(
-                    f"Failed to initialize MongoDB connection: {str(e)}. MongoDB functionality will be disabled."
-                )
-        return cls._instance
-
-    @classmethod
-    def get_client(cls) -> Optional[MongoClient]:
-        """
-        Returns the MongoDB client instance.
-
-        Returns:
-            Optional[MongoClient]: The MongoDB client instance or None if not configured
-        """
-        if cls._client is None:
-            cls._instance = cls()
-        return cls._client
-
-    @classmethod
-    def get_db(cls) -> Optional[Database]:
-        """
-        Returns the MongoDB database instance.
-
-        Returns:
-            Optional[Database]: The MongoDB database instance or None if not configured
-        """
-        if cls._db is None:
-            cls._instance = cls()
-        return cls._db
-
-    @classmethod
-    def get_collection(cls, collection_name: str) -> Optional[Collection]:
-        """
-        Returns a MongoDB collection by name.
-
-        Args:
-            collection_name (str): The name of the collection to retrieve
-
-        Returns:
-            Optional[Collection]: The MongoDB collection instance or None if not configured
-        """
-        try:
-            db = cls.get_db()
-            if db is None:
-                logger.warning(
-                    f"Cannot access collection '{collection_name}': MongoDB not configured"
-                )
-                return None
-            return db[collection_name]
-        except Exception as e:
-            logger.warning(f"Failed to access collection '{collection_name}': {str(e)}")
-            return None
-
-    @classmethod
-    def is_configured(cls) -> bool:
-        """
-        Check if MongoDB is properly configured and connected.
-
-        Returns:
-            bool: True if MongoDB is configured and connected, False otherwise
-        """
-
-        if cls._client is None:
-            cls._instance = cls()
-        return cls._client is not None and cls._db is not None
@@ -83,10 +83,5 @@ LOGGING = {
            "handlers": ["console"],
            "propagate": False,
        },
-        "plane.mongo": {
-            "level": "INFO",
-            "handlers": ["console"],
-            "propagate": False,
-        },
    },
 }
@@ -30,6 +30,7 @@ from plane.db.models import (
 )
 from plane.utils.content_validator import (
    validate_html_content,
+    validate_json_content,
    validate_binary_data,
 )

@@ -289,22 +290,20 @@ class IssueCreateSerializer(BaseSerializer):
            raise serializers.ValidationError("Start date cannot exceed target date")

        # Validate description content for security
-        if "description_html" in data and data["description_html"]:
-            is_valid, error_msg, sanitized_html = validate_html_content(
-                data["description_html"]
-            )
+        if "description" in data and data["description"]:
+            is_valid, error_msg = validate_json_content(data["description"])
            if not is_valid:
-                raise serializers.ValidationError(
-                    {"error": "html content is not valid"}
-                )
-            # Update the data with sanitized HTML if available
-            if sanitized_html is not None:
-                data["description_html"] = sanitized_html
+                raise serializers.ValidationError({"description": error_msg})
+
+        if "description_html" in data and data["description_html"]:
+            is_valid, error_msg = validate_html_content(data["description_html"])
+            if not is_valid:
+                raise serializers.ValidationError({"description_html": error_msg})

        if "description_binary" in data and data["description_binary"]:
            is_valid, error_msg = validate_binary_data(data["description_binary"])
            if not is_valid:
-                raise serializers.ValidationError({"description_binary": "Invalid binary data"})
+                raise serializers.ValidationError({"description_binary": error_msg})

        return data

@@ -1,205 +0,0 @@
-# Testing library/framework: pytest + pytest-django + factory_boy
-import pytest
-import pytz
-from django.core.exceptions import ValidationError
-from django.db import IntegrityError
-from django.utils import timezone
-
-# Prefer existing FactoryBoy factories defined in the repo
-from plane.tests.factories import WorkspaceFactory, UserFactory, ProjectFactory
-
-# Import models and helpers under test
-from plane.db.models.project import (
-    Project,
-    ProjectMember,
-    ProjectMemberInvite,
-    ProjectIdentifier,
-    ProjectDeployBoard,
-    ProjectPublicMember,
-    ROLE,
-    ROLE_CHOICES,
-    ProjectNetwork,
-    get_default_props,
-    get_default_preferences,
-    get_default_views,
-)
-
-# FileAsset is optional in some environments; guard import
-try:
-    from plane.db.models.asset import FileAsset
-except Exception:
-    FileAsset = None
-
-
-@pytest.mark.django_db
-class TestProjectModel:
-    def test_identifier_is_stripped_and_uppercased_on_save(self):
-        ws = WorkspaceFactory()
-        proj = Project.objects.create(
-            name="Alpha",
-            identifier="  al-1 ",
-            workspace=ws,
-        )
-        proj.refresh_from_db()
-        assert proj.identifier == "AL-1"
-
-    def test_cover_image_url_resolution_and_precedence(self):
-        ws = WorkspaceFactory()
-        proj = ProjectFactory(workspace=ws)
-
-        # No cover data
-        proj.cover_image = None
-        proj.cover_image_asset = None
-        assert proj.cover_image_url is None
-
-        # Text cover image
-        proj.cover_image = "https://cdn.example.com/cover.jpg"
-        assert proj.cover_image_url == "https://cdn.example.com/cover.jpg"
-
-        # FileAsset should take precedence when present
-        if FileAsset:
-            asset = FileAsset.objects.create(asset_url="https://assets.example.com/a.png")
-            proj.cover_image_asset = asset
-            assert proj.cover_image_url == "https://assets.example.com/a.png"
-
-    def test___str___format(self):
-        ws = WorkspaceFactory(name="Team Rocket")
-        proj = ProjectFactory(name="Gamma", identifier="GMM", workspace=ws)
-        assert str(proj) == "Gamma <Team Rocket>"
-
-    def test_timezone_default_and_choices_include_utc(self):
-        ws = WorkspaceFactory()
-        proj = ProjectFactory(workspace=ws, timezone="UTC")
-        assert proj.timezone == "UTC"
-        assert ("UTC", "UTC") in Project.TIMEZONE_CHOICES
-        assert "UTC" in pytz.common_timezones
-
-    def test_archive_close_in_validators_bounds(self):
-        ws = WorkspaceFactory()
-        proj = Project(name="Delta", identifier="DLT", workspace=ws, archive_in=0, close_in=12)
-        # Valid
-        proj.full_clean()
-
-        # Invalid negative
-        proj.archive_in = -1
-        with pytest.raises(ValidationError):
-            proj.full_clean()
-
-        # Invalid > 12
-        proj.archive_in = 0
-        proj.close_in = 13
-        with pytest.raises(ValidationError):
-            proj.full_clean()
-
-    def test_unique_identifier_and_name_per_workspace_with_soft_delete(self):
-        ws = WorkspaceFactory()
-        p1 = Project.objects.create(name="Echo", identifier="ECH", workspace=ws)
-
-        # Duplicates while not soft-deleted -> IntegrityError
-        with pytest.raises(IntegrityError):
-            Project.objects.create(name="Echo", identifier="ECH2", workspace=ws)
-        with pytest.raises(IntegrityError):
-            Project.objects.create(name="Foxtrot", identifier="ECH", workspace=ws)
-
-        # Soft-delete first, then allow duplicates for the constrained fields
-        p1.deleted_at = timezone.now()
-        p1.save(update_fields=["deleted_at"])
-
-        Project.objects.create(name="Echo", identifier="ECHX", workspace=ws)
-        Project.objects.create(name="Zulu", identifier="ECH", workspace=ws)
-
-    def test_network_choices_and_enum(self):
-        assert Project.NETWORK_CHOICES == ((0, "Secret"), (2, "Public"))
-        assert ProjectNetwork.choices() == [(0, "Secret"), (2, "Public")]
-
-
-@pytest.mark.django_db
-class TestProjectBaseAndMembers:
-    def test_projectbasemodel_sets_workspace_on_save_for_invite(self):
-        ws = WorkspaceFactory()
-        proj = ProjectFactory(workspace=ws)
-        inv = ProjectMemberInvite.objects.create(project=proj, email="invitee@example.com", token="tok")
-        inv.refresh_from_db()
-        assert inv.workspace_id == proj.workspace_id
-        assert str(inv) == f"{proj.name} invitee@example.com {inv.accepted}"
-
-    def test_projectmember_sort_order_initialization(self):
-        ws = WorkspaceFactory()
-        user = UserFactory()
-        proj_a = ProjectFactory(workspace=ws)
-        proj_b = ProjectFactory(workspace=ws)
-
-        # First membership => default 65535
-        m1 = ProjectMember.objects.create(project=proj_a, member=user)
-        assert pytest.approx(m1.sort_order) == 65535
-
-        # Second membership for same user in same workspace => smallest - 10000
-        m2 = ProjectMember.objects.create(project=proj_b, member=user)
-        assert m2.sort_order == m1.sort_order - 10000
-
-    def test_projectmember_defaults_role_props_and_str(self):
-        ws = WorkspaceFactory()
-        user = UserFactory()
-        proj = ProjectFactory(workspace=ws)
-
-        member = ProjectMember.objects.create(project=proj, member=user)
-
-        # Role defaults
-        assert member.role == ROLE.GUEST.value == 5
-        assert ROLE_CHOICES == ((20, "Admin"), (15, "Member"), (5, "Guest"))
-
-        # Default props/preferences
-        assert member.view_props == get_default_props()
-        assert member.default_props == get_default_props()
-        assert member.preferences == get_default_preferences()
-
-        assert str(member) == f"{user.email} <{proj.name}>"
-
-
-@pytest.mark.django_db
-class TestProjectIdentifierAndDeployBoard:
-    def test_project_identifier_unique_with_soft_delete(self):
-        ws = WorkspaceFactory()
-        proj = ProjectFactory(workspace=ws, identifier="MU", name="Mu")
-        pid1 = ProjectIdentifier.objects.create(project=proj, workspace=ws, name="MU")
-
-        with pytest.raises(IntegrityError):
-            ProjectIdentifier.objects.create(project=proj, workspace=ws, name="MU")
-
-        pid1.deleted_at = timezone.now()
-        pid1.save(update_fields=["deleted_at"])
-
-        # Now allowed after soft-delete
-        ProjectIdentifier.objects.create(project=proj, workspace=ws, name="MU")
-
-    def test_deploy_board_defaults_and_str(self):
-        ws = WorkspaceFactory()
-        proj = ProjectFactory(workspace=ws)
-        board = ProjectDeployBoard.objects.create(project=proj)
-
-        assert isinstance(board.anchor, str) and len(board.anchor) >= 32
-        assert board.views == get_default_views()
-        assert str(board) == f"{board.anchor} <{proj.name}>"
-
-    def test_get_default_views_contents(self):
-        assert get_default_views() == {
-            "list": True,
-            "kanban": True,
-            "calendar": True,
-            "gantt": True,
-            "spreadsheet": True,
-        }
-
-
-@pytest.mark.django_db
-class TestProjectPublicMember:
-    def test_unique_constraint_on_public_member(self):
-        ws = WorkspaceFactory()
-        user = UserFactory()
-        proj = ProjectFactory(workspace=ws)
-
-        pm1 = ProjectPublicMember.objects.create(project=proj, member=user)
-        assert pm1.pk is not None
-
-        with pytest.raises(IntegrityError):
-            ProjectPublicMember.objects.create(project=proj, member=user)
@@ -1,213 +0,0 @@
-import builtins
-from types import SimpleNamespace
-from unittest.mock import patch, MagicMock
-
-import pytest
-from rest_framework.response import Response
-from rest_framework import status
-
-# Import the decorator and ROLE enum from the provided module
-from apps.api.plane.tests.test_permissions_base import allow_permission, ROLE
-
-# Helper: minimal request/user and dummy view
-class DummyUser(SimpleNamespace):
-    pass
-
-class DummyRequest(SimpleNamespace):
-    pass
-
-def dummy_view(instance, request, *args, **kwargs):
-    return Response({"ok": True}, status=status.HTTP_200_OK)
-
-@pytest.fixture
-def user():
-    return DummyUser(id=1, username="u1")
-
-@pytest.fixture
-def request(user):
-    return DummyRequest(user=user)
-
-@pytest.fixture
-def view_instance():
-    # For function-based views 'instance' is unused; for method-decorated views could be 'self'
-    return object()
-
-def _wrap_and_call(deco, request, view_instance=None, **kwargs):
-    wrapped = deco(dummy_view)
-    return wrapped(view_instance or object(), request, **kwargs)
-
-def make_exists_mock(result: bool):
-    # Returns a mock for model.objects.filter(...).exists() chain
-    exists_mock = MagicMock(return_value=result)
-    filter_mock = MagicMock(return_value=SimpleNamespace(exists=exists_mock))
-    objects_mock = SimpleNamespace(filter=filter_mock)
-    return objects_mock, filter_mock, exists_mock
-
-# --- Tests ---
-
-def test_allows_when_creator_matches_model_pk_and_created_by(request, view_instance):
-    # If creator=True and model is supplied, creator match should short-circuit and allow regardless of roles
-    class DummyModel:
-        pass
-
-    objects_mock, filter_mock, exists_mock = make_exists_mock(True)
-    with patch.object(DummyModel, "objects", objects_mock):
-        deco = allow_permission(allowed_roles=[ROLE.GUEST], level="PROJECT", creator=True, model=DummyModel)
-        resp = _wrap_and_call(deco, request, view_instance, pk=123, slug="ws", project_id=456)
-
-    filter_mock.assert_called_once()
-    # Ensure query filters by id and created_by
-    assert filter_mock.call_args.kwargs.get("id") == 123
-    assert filter_mock.call_args.kwargs.get("created_by") is request.user
-    exists_mock.assert_called_once()
-    assert isinstance(resp, Response) and resp.status_code == 200 and resp.data == {"ok": True}
-
-@pytest.mark.parametrize(
-    "allowed_roles_input",
-    [
-        [ROLE.ADMIN, ROLE.MEMBER],   # enum members
-        [20, 15],                    # numeric roles
-        [ROLE.ADMIN.value, ROLE.MEMBER.value],  # explicit ints
-    ],
-)
-def test_workspace_level_allows_when_workspace_member_has_allowed_role(request, view_instance, allowed_roles_input):
-    # WorkspaceMember.exists() -> True should allow
-    WM_objects, WM_filter, WM_exists = make_exists_mock(True)
-    with patch("apps.api.plane.tests.test_permissions_base.WorkspaceMember") as WM, \
-         patch("apps.api.plane.tests.test_permissions_base.ProjectMember") as PM:
-        WM.objects = WM_objects
-        # ProjectMember shouldn't be called at WORKSPACE level when allowed
-        PM.objects = SimpleNamespace(filter=MagicMock())
-
-        deco = allow_permission(allowed_roles=allowed_roles_input, level="WORKSPACE")
-        resp = _wrap_and_call(deco, request, view_instance, slug="acme", project_id=999, pk=1)
-
-    WM_filter.assert_called_once()
-    assert WM_exists.called
-    assert resp.status_code == 200
-
-def test_workspace_level_denies_when_no_allowed_role_or_inactive(request, view_instance):
-    # WorkspaceMember.exists() -> False should deny (no project fallback at WORKSPACE level)
-    WM_objects, WM_filter, WM_exists = make_exists_mock(False)
-    with patch("apps.api.plane.tests.test_permissions_base.WorkspaceMember") as WM:
-        WM.objects = WM_objects
-        deco = allow_permission(allowed_roles=[ROLE.ADMIN], level="WORKSPACE")
-        resp = _wrap_and_call(deco, request, view_instance, slug="acme", project_id=1, pk=1)
-
-    assert resp.status_code == status.HTTP_403_FORBIDDEN
-    assert resp.data == {"error": "You don't have the required permissions."}
-
-def test_project_level_allows_when_project_member_has_allowed_role(request, view_instance):
-    PM_objects, PM_filter, PM_exists = make_exists_mock(True)
-    with patch("apps.api.plane.tests.test_permissions_base.ProjectMember") as PM, \
-         patch("apps.api.plane.tests.test_permissions_base.WorkspaceMember") as WM:
-        PM.objects = PM_objects
-        WM.objects = SimpleNamespace(filter=MagicMock())  # not used
-        deco = allow_permission(allowed_roles=[ROLE.MEMBER], level="PROJECT")
-        resp = _wrap_and_call(deco, request, view_instance, slug="acme", project_id=42, pk=7)
-
-    PM_filter.assert_called_once()
-    assert PM_exists.called
-    assert resp.status_code == 200
-
-def test_project_level_allows_when_workspace_admin_even_if_project_role_not_allowed(request, view_instance):
-    # First project role check -> False
-    PM_allowed_objects, PM_allowed_filter, PM_allowed_exists = make_exists_mock(False)
-    # Then project membership check (any role) -> True
-    PM_member_objects, PM_member_filter, PM_member_exists = make_exists_mock(True)
-    # Workspace admin check -> True
-    WM_admin_objects, WM_admin_filter, WM_admin_exists = make_exists_mock(True)
-
-    def pm_filter_side_effect(*args, **kwargs):
-        # For role__in present, use allowed False; otherwise for membership True
-        if "role__in" in kwargs:
-            return PM_allowed_objects.filter(**kwargs)
-        return PM_member_objects.filter(**kwargs)
-
-    with patch("apps.api.plane.tests.test_permissions_base.ProjectMember") as PM, \
-         patch("apps.api.plane.tests.test_permissions_base.WorkspaceMember") as WM:
-        PM.objects = SimpleNamespace(filter=MagicMock(side_effect=pm_filter_side_effect))
-        WM.objects = WM_admin_objects
-
-        deco = allow_permission(allowed_roles=[ROLE.GUEST], level="PROJECT")
-        resp = _wrap_and_call(deco, request, view_instance, slug="acme", project_id=123, pk=9)
-
-    # Confirm both the membership and admin checks participated
-    assert resp.status_code == 200
-    assert WM_admin_filter.called
-    assert PM_allowed_filter.called or PM.objects.filter.called
-
-def test_project_level_denies_when_not_allowed_role_not_member_or_not_workspace_admin(request, view_instance):
-    # All checks -> False
-    PM_allowed_objects, PM_allowed_filter, PM_allowed_exists = make_exists_mock(False)
-    PM_member_objects, PM_member_filter, PM_member_exists = make_exists_mock(False)
-    WM_admin_objects, WM_admin_filter, WM_admin_exists = make_exists_mock(False)
-
-    def pm_filter_side_effect(*args, **kwargs):
-        if "role__in" in kwargs:
-            return PM_allowed_objects.filter(**kwargs)
-        return PM_member_objects.filter(**kwargs)
-
-    with patch("apps.api.plane.tests.test_permissions_base.ProjectMember") as PM, \
-         patch("apps.api.plane.tests.test_permissions_base.WorkspaceMember") as WM:
-        PM.objects = SimpleNamespace(filter=MagicMock(side_effect=pm_filter_side_effect))
-        WM.objects = WM_admin_objects
-
-        deco = allow_permission(allowed_roles=[ROLE.ADMIN], level="PROJECT")
-        resp = _wrap_and_call(deco, request, view_instance, slug="acme", project_id=99, pk=3)
-
-    assert resp.status_code == status.HTTP_403_FORBIDDEN
-    assert resp.data == {"error": "You don't have the required permissions."}
-
-def test_roles_accepts_mixed_enum_and_int_inputs(request, view_instance):
-    # Ensure conversion to values works: mix enum and ints
-    PM_objects, PM_filter, PM_exists = make_exists_mock(True)
-    with patch("apps.api.plane.tests.test_permissions_base.ProjectMember") as PM, \
-         patch("apps.api.plane.tests.test_permissions_base.WorkspaceMember") as WM:
-        PM.objects = PM_objects
-        WM.objects = SimpleNamespace(filter=MagicMock())
-        deco = allow_permission(allowed_roles=[ROLE.MEMBER, 5], level="PROJECT")
-        resp = _wrap_and_call(deco, request, view_instance, slug="acme", project_id=1, pk=1)
-
-    assert resp.status_code == 200
-    # Verify role__in passed as ints
-    passed_roles = PM_filter.call_args.kwargs.get("role__in")
-    assert isinstance(passed_roles, list)
-    assert all(isinstance(r, int) for r in passed_roles)
-
-def test_creator_flag_without_model_does_not_error_and_falls_back_to_role_checks(request, view_instance):
-    # creator=True but no model should not crash; proceed to role checks which we set to allow
-    PM_objects, PM_filter, PM_exists = make_exists_mock(True)
-    with patch("apps.api.plane.tests.test_permissions_base.ProjectMember") as PM, \
-         patch("apps.api.plane.tests.test_permissions_base.WorkspaceMember") as WM:
-        PM.objects = PM_objects
-        WM.objects = SimpleNamespace(filter=MagicMock())
-        deco = allow_permission(allowed_roles=[ROLE.ADMIN], level="PROJECT", creator=True, model=None)
-        resp = _wrap_and_call(deco, request, view_instance, slug="acme", project_id=11, pk=22)
-
-    assert resp.status_code == 200
-
-def test_missing_kwargs_results_in_403_in_project_level(request, view_instance):
-    # If required kwargs like slug or project_id are missing, filter will get KeyError before queries;
-    # The decorator accesses kwargs[...] so simulate missing and expect KeyError -> treat as failure handled by pytest
-    PM_objects, PM_filter, PM_exists = make_exists_mock(False)
-    with patch("apps.api.plane.tests.test_permissions_base.ProjectMember") as PM, \
-         patch("apps.api.plane.tests.test_permissions_base.WorkspaceMember") as WM:
-        PM.objects = PM_objects
-        WM.objects = SimpleNamespace(filter=MagicMock())
-
-        deco = allow_permission(allowed_roles=[ROLE.ADMIN], level="PROJECT")
-        with pytest.raises(KeyError):
-            _ = _wrap_and_call(deco, request, view_instance, pk=1)  # slug/project_id missing
-
-def test_inactive_members_are_not_considered(request, view_instance):
-    # Ensure is_active=True is part of filters; we validate by inspecting call kwargs
-    PM_objects, PM_filter, PM_exists = make_exists_mock(True)
-    with patch("apps.api.plane.tests.test_permissions_base.ProjectMember") as PM, \
-         patch("apps.api.plane.tests.test_permissions_base.WorkspaceMember") as WM:
-        PM.objects = PM_objects
-        WM.objects = SimpleNamespace(filter=MagicMock())
-        deco = allow_permission(allowed_roles=[ROLE.MEMBER], level="PROJECT")
-        _ = _wrap_and_call(deco, request, view_instance, slug="acme", project_id=1, pk=1)
-
-    assert PM_filter.call_args.kwargs.get("is_active") is True
@@ -1,278 +0,0 @@
-import types
-from unittest.mock import MagicMock, patch
-
-import pytest
-
-# Subject under test: permission classes defined in the provided file
-from apps.api.plane.tests import test_permissions_project as perms
-
-
-def _req(user_is_anonymous: bool, method: str = "GET"):
-    return types.SimpleNamespace(
-        user=types.SimpleNamespace(is_anonymous=user_is_anonymous),
-        method=method,
-    )
-
-
-def _view(workspace_slug="ws-1", project_id=1, project_identifier=None):
-    v = types.SimpleNamespace(
-        workspace_slug=workspace_slug,
-        project_id=project_id,
-    )
-    if project_identifier is not None:
-        v.project_identifier = project_identifier
-    return v
-
-
-def _qs_with_exists(result: bool):
-    qs = MagicMock()
-    qs.exists.return_value = result
-    # Any nested filter(...) should return the same qs unless overridden in a test
-    qs.filter.return_value = qs
-    return qs
-
-
-@pytest.mark.parametrize("method", ["GET", "HEAD", "OPTIONS"])
-def test_project_base_permission_safe_methods_allowed_for_active_workspace_member(method):
-    request = _req(False, method)
-    view = _view()
-
-    with patch.object(perms.WorkspaceMember.objects, "filter") as wm_filter:
-        wm_filter.return_value = _qs_with_exists(True)
-
-        assert perms.ProjectBasePermission().has_permission(request, view) is True
-
-        wm_filter.assert_called_with(
-            workspace__slug=view.workspace_slug,
-            member=request.user,
-            is_active=True,
-        )
-
-
-@pytest.mark.parametrize("method", ["GET", "HEAD", "OPTIONS"])
-def test_project_base_permission_safe_methods_denied_for_non_member(method):
-    request = _req(False, method)
-    view = _view()
-
-    with patch.object(perms.WorkspaceMember.objects, "filter") as wm_filter:
-        wm_filter.return_value = _qs_with_exists(False)
-
-        assert perms.ProjectBasePermission().has_permission(request, view) is False
-
-
-def test_project_base_permission_post_requires_workspace_admin_or_member():
-    request = _req(False, "POST")
-    view = _view()
-
-    with patch.object(perms.WorkspaceMember.objects, "filter") as wm_filter:
-        qs = _qs_with_exists(True)
-        wm_filter.return_value = qs
-
-        assert perms.ProjectBasePermission().has_permission(request, view) is True
-
-        # Validate role__in and other filters passed
-        called_kwargs = wm_filter.call_args.kwargs
-        assert called_kwargs["workspace__slug"] == view.workspace_slug
-        assert called_kwargs["member"] == request.user
-        assert called_kwargs["is_active"] is True
-        assert "role__in" in called_kwargs
-        assert isinstance(called_kwargs["role__in"], (list, tuple))
-        assert len(called_kwargs["role__in"]) == 2  # [ROLE.ADMIN.value, ROLE.MEMBER.value]
-
-
-def test_project_base_permission_post_denied_when_not_in_workspace():
-    request = _req(False, "POST")
-    view = _view()
-
-    with patch.object(perms.WorkspaceMember.objects, "filter") as wm_filter:
-        wm_filter.return_value = _qs_with_exists(False)
-
-        assert perms.ProjectBasePermission().has_permission(request, view) is False
-
-
-@pytest.mark.parametrize("method", ["PUT", "PATCH", "DELETE"])
-def test_project_base_permission_non_safe_granted_if_project_admin(method):
-    request = _req(False, method)
-    view = _view()
-
-    with patch.object(perms.ProjectMember.objects, "filter") as pm_filter:
-        base_qs = _qs_with_exists(False)
-        admin_qs = _qs_with_exists(True)  # admin exists
-        base_qs.filter.return_value = admin_qs
-        pm_filter.return_value = base_qs
-
-        assert perms.ProjectBasePermission().has_permission(request, view) is True
-
-        # Ensure admin role filter applied
-        admin_call = base_qs.filter.call_args
-        assert admin_call.kwargs == {"role": perms.ROLE.ADMIN.value}
-
-
-@pytest.mark.parametrize("method", ["PUT", "PATCH", "DELETE"])
-def test_project_base_permission_non_safe_granted_if_project_member_and_workspace_admin(method):
-    request = _req(False, method)
-    view = _view()
-
-    with patch.object(perms.ProjectMember.objects, "filter") as pm_filter, \
-         patch.object(perms.WorkspaceMember.objects, "filter") as wm_filter:
-
-        base_qs = _qs_with_exists(True)   # user is a project member
-        admin_qs = _qs_with_exists(False) # not a project admin
-        base_qs.filter.return_value = admin_qs
-        pm_filter.return_value = base_qs
-
-        wm_filter.return_value = _qs_with_exists(True)  # workspace admin
-
-        assert perms.ProjectBasePermission().has_permission(request, view) is True
-
-        # Validate workspace admin filter call includes role=ROLE.ADMIN.value
-        called_kwargs = wm_filter.call_args.kwargs
-        assert called_kwargs["workspace__slug"] == view.workspace_slug
-        assert called_kwargs["member"] == request.user
-        assert called_kwargs["role"] == perms.ROLE.ADMIN.value
-        assert called_kwargs["is_active"] is True
-
-
-@pytest.mark.parametrize("method", ["PUT", "PATCH", "DELETE"])
-def test_project_base_permission_non_safe_denied_if_not_admin_and_not_workspace_admin(method):
-    request = _req(False, method)
-    view = _view()
-
-    with patch.object(perms.ProjectMember.objects, "filter") as pm_filter, \
-         patch.object(perms.WorkspaceMember.objects, "filter") as wm_filter:
-
-        base_qs = _qs_with_exists(False)  # not a project member (or inactive)
-        admin_qs = _qs_with_exists(False)
-        base_qs.filter.return_value = admin_qs
-        pm_filter.return_value = base_qs
-
-        wm_filter.return_value = _qs_with_exists(False)
-
-        assert perms.ProjectBasePermission().has_permission(request, view) is False
-
-
-def test_project_base_permission_denies_anonymous_for_all_methods():
-    for method in ["GET", "POST", "PATCH"]:
-        assert perms.ProjectBasePermission().has_permission(_req(True, method), _view()) is False
-
-
-# ---- ProjectMemberPermission tests ----
-
-@pytest.mark.parametrize("method", ["GET", "HEAD", "OPTIONS"])
-def test_project_member_permission_safe_methods_require_project_membership(method):
-    request = _req(False, method)
-    view = _view()
-
-    with patch.object(perms.ProjectMember.objects, "filter") as pm_filter:
-        pm_filter.return_value = _qs_with_exists(True)
-        assert perms.ProjectMemberPermission().has_permission(request, view) is True
-
-        pm_filter.return_value = _qs_with_exists(False)
-        assert perms.ProjectMemberPermission().has_permission(request, view) is False
-
-
-def test_project_member_permission_post_requires_workspace_admin_or_member():
-    request = _req(False, "POST")
-    view = _view()
-
-    with patch.object(perms.WorkspaceMember.objects, "filter") as wm_filter:
-        wm_filter.return_value = _qs_with_exists(True)
-        assert perms.ProjectMemberPermission().has_permission(request, view) is True
-
-        called_kwargs = wm_filter.call_args.kwargs
-        assert "role__in" in called_kwargs
-        assert len(called_kwargs["role__in"]) == 2
-
-
-@pytest.mark.parametrize("is_active", [True, False])
-def test_project_member_permission_write_requires_admin_or_member_and_active(is_active):
-    request = _req(False, "PATCH")
-    view = _view()
-
-    with patch.object(perms.ProjectMember.objects, "filter") as pm_filter:
-        qs = _qs_with_exists(is_active)
-        pm_filter.return_value = qs
-
-        result = perms.ProjectMemberPermission().has_permission(request, view)
-        assert result is is_active
-
-        # Validate role__in and scoping filters
-        called_kwargs = pm_filter.call_args.kwargs
-        assert called_kwargs["workspace__slug"] == view.workspace_slug
-        assert called_kwargs["member"] == request.user
-        assert called_kwargs["project_id"] == view.project_id
-        assert "role__in" in called_kwargs
-        assert called_kwargs["is_active"] is True
-
-
-def test_project_member_permission_denies_anonymous():
-    assert perms.ProjectMemberPermission().has_permission(_req(True, "GET"), _view()) is False
-
-
-# ---- ProjectEntityPermission tests ----
-
-def test_project_entity_permission_safe_with_project_identifier_scopes_by_identifier():
-    request = _req(False, "GET")
-    view = _view(project_identifier="PRJ-123")
-
-    with patch.object(perms.ProjectMember.objects, "filter") as pm_filter:
-        pm_filter.return_value = _qs_with_exists(True)
-        assert perms.ProjectEntityPermission().has_permission(request, view) is True
-
-        # Ensure identifier used (not project_id)
-        called_kwargs = pm_filter.call_args.kwargs
-        assert called_kwargs["project__identifier"] == "PRJ-123"
-        assert "project_id" not in called_kwargs
-
-
-def test_project_entity_permission_safe_without_identifier_scopes_by_project_id():
-    request = _req(False, "GET")
-    view = _view(project_identifier=None)
-
-    with patch.object(perms.ProjectMember.objects, "filter") as pm_filter:
-        pm_filter.return_value = _qs_with_exists(True)
-        assert perms.ProjectEntityPermission().has_permission(request, view) is True
-
-        called_kwargs = pm_filter.call_args.kwargs
-        assert called_kwargs["project_id"] == view.project_id
-
-
-@pytest.mark.parametrize("method", ["POST", "PUT", "PATCH", "DELETE"])
-def test_project_entity_permission_write_requires_admin_or_member(method):
-    request = _req(False, method)
-    view = _view()
-
-    with patch.object(perms.ProjectMember.objects, "filter") as pm_filter:
-        pm_filter.return_value = _qs_with_exists(True)
-        assert perms.ProjectEntityPermission().has_permission(request, view) is True
-
-        called_kwargs = pm_filter.call_args.kwargs
-        assert "role__in" in called_kwargs
-        assert len(called_kwargs["role__in"]) == 2
-        assert called_kwargs["is_active"] is True
-
-
-def test_project_entity_permission_denies_anonymous():
-    assert perms.ProjectEntityPermission().has_permission(_req(True, "GET"), _view()) is False
-
-
-# ---- ProjectLitePermission tests ----
-
-def test_project_lite_permission_denies_anonymous():
-    assert perms.ProjectLitePermission().has_permission(_req(True, "GET"), _view()) is False
-
-
-@pytest.mark.parametrize("exists", [True, False])
-def test_project_lite_permission_requires_project_membership(exists):
-    request = _req(False, "GET")
-    view = _view()
-
-    with patch.object(perms.ProjectMember.objects, "filter") as pm_filter:
-        pm_filter.return_value = _qs_with_exists(exists)
-        assert perms.ProjectLitePermission().has_permission(request, view) is exists
-
-        called_kwargs = pm_filter.call_args.kwargs
-        assert called_kwargs["workspace__slug"] == view.workspace_slug
-        assert called_kwargs["member"] == request.user
-        assert called_kwargs["project_id"] == view.project_id
-        assert called_kwargs["is_active"] is True
@@ -1,475 +0,0 @@
-import json
-from unittest import mock
-
-import pytest
-from django.urls import reverse
-from django.utils import timezone
-from rest_framework import status
-from rest_framework.test import APIClient, APIRequestFactory, force_authenticate
-
-# NOTE: Import paths may need adjustment based on the repo's layout.
-# We bias for action by importing via common app paths; adapt as needed if tests fail.
-from plane.app.models import (
-    Project,
-    Workspace,
-    WorkspaceMember,
-    ProjectMember,
-    DeployBoard,
-    UserFavorite,
-    Intake,
-    State,
-    ProjectIdentifier,
-    User,
-)
-from plane.app.views import (
-    ProjectViewSet,
-    ProjectArchiveUnarchiveEndpoint,
-    ProjectIdentifierEndpoint,
-    ProjectUserViewsEndpoint,
-    ProjectFavoritesViewSet,
-    ProjectPublicCoverImagesEndpoint,
-    DeployBoardViewSet,
-)
-from plane.app.permissions import ROLE
-
-
-@pytest.mark.django_db
-class TestProjectViewSetListDetail:
-    def setup_method(self):
-        self.factory = APIRequestFactory()
-        self.client = APIClient()
-        # Users
-        self.owner = User.objects.create_user(email="owner@example.com", password="x")
-        self.member = User.objects.create_user(email="member@example.com", password="x")
-        self.guest = User.objects.create_user(email="guest@example.com", password="x")
-        # Workspace and memberships
-        self.ws = Workspace.objects.create(name="Acme", slug="acme")
-        WorkspaceMember.objects.create(
-            workspace=self.ws, member=self.owner, role=ROLE.ADMIN.value, is_active=True
-        )
-        WorkspaceMember.objects.create(
-            workspace=self.ws, member=self.member, role=ROLE.MEMBER.value, is_active=True
-        )
-        WorkspaceMember.objects.create(
-            workspace=self.ws, member=self.guest, role=ROLE.GUEST.value, is_active=True
-        )
-        # Projects
-        self.p1 = Project.objects.create(name="P1", identifier="P1", workspace=self.ws)
-        self.p2 = Project.objects.create(name="P2", identifier="P2", workspace=self.ws, network=2)
-        self.p3 = Project.objects.create(name="P3", identifier="P3", workspace=self.ws, archived_at=None)
-        # Project memberships
-        ProjectMember.objects.create(project=self.p1, workspace=self.ws, member=self.owner, role=ROLE.ADMIN.value, is_active=True)
-        ProjectMember.objects.create(project=self.p1, workspace=self.ws, member=self.member, role=ROLE.MEMBER.value, is_active=True)
-        ProjectMember.objects.create(project=self.p2, workspace=self.ws, member=self.owner, role=ROLE.ADMIN.value, is_active=True)
-        ProjectMember.objects.create(project=self.p3, workspace=self.ws, member=self.owner, role=ROLE.ADMIN.value, is_active=True)
-        # Favorites and DeployBoard anchor annotations coverage
-        UserFavorite.objects.create(user=self.owner, entity_type="project", entity_identifier=self.p1.id, project=self.p1, workspace=self.ws)
-        DeployBoard.objects.create(entity_name="project", entity_identifier=self.p1.id, project=self.p1, workspace=self.ws, anchor="p1-anchor")
-
-    def _view(self, action: str):
-        return ProjectViewSet.as_view({ "get": action })
-
-    def test_list_detail_admin_sees_all_sorted(self):
-        request = self.factory.get(f"/workspaces/{self.ws.slug}/projects/list-detail")
-        force_authenticate(request, user=self.owner)
-        response = self._view("list_detail")(request, slug=self.ws.slug)
-        assert response.status_code == status.HTTP_200_OK
-        # Should include at least p1, p2, p3
-        ids = [p["id"] for p in response.data]
-        assert self.p1.id in ids and self.p2.id in ids and self.p3.id in ids
-
-    def test_list_detail_guest_only_memberships(self):
-        request = self.factory.get(f"/workspaces/{self.ws.slug}/projects/list-detail")
-        force_authenticate(request, user=self.guest)
-        response = self._view("list_detail")(request, slug=self.ws.slug)
-        assert response.status_code == status.HTTP_200_OK
-        # guest not a member of any project -> sees none
-        assert response.data == []
-
-        # Add guest to p1, ensure visibility
-        ProjectMember.objects.create(project=self.p1, workspace=self.ws, member=self.guest, role=ROLE.GUEST.value, is_active=True)
-        request = self.factory.get(f"/workspaces/{self.ws.slug}/projects/list-detail")
-        force_authenticate(request, user=self.guest)
-        response = self._view("list_detail")(request, slug=self.ws.slug)
-        ids = [p["id"] for p in response.data]
-        assert self.p1.id in ids
-        assert self.p2.id not in ids  # guest not member of p2
-
-    def test_list_detail_member_sees_memberships_plus_network_2(self):
-        request = self.factory.get(f"/workspaces/{self.ws.slug}/projects/list-detail")
-        force_authenticate(request, user=self.member)
-        response = self._view("list_detail")(request, slug=self.ws.slug)
-        assert response.status_code == status.HTTP_200_OK
-        ids = [p["id"] for p in response.data]
-        # Member of p1, should also see p2 because network=2
-        assert self.p1.id in ids and self.p2.id in ids
-
-    def test_list_detail_fields_filtering(self):
-        request = self.factory.get(f"/workspaces/{self.ws.slug}/projects/list-detail?fields=id,name")
-        force_authenticate(request, user=self.owner)
-        response = self._view("list_detail")(request, slug=self.ws.slug)
-        assert response.status_code == status.HTTP_200_OK
-        assert set(response.data[0].keys()).issubset({"id","name"})
-
-    def test_list_detail_cursor_pagination_path(self, monkeypatch):
-        # Force paginate branch by providing per_page and cursor
-        request = self.factory.get(f"/workspaces/{self.ws.slug}/projects/list-detail?per_page=2&cursor=abc&order_by=-created_at")
-        force_authenticate(request, user=self.owner)
-        # Mock paginate to ensure it is invoked
-        with mock.patch.object(ProjectViewSet, "paginate", return_value=mock.sentinel.PAGED) as m:
-            response = self._view("list_detail")(request, slug=self.ws.slug)
-            assert response == mock.sentinel.PAGED
-            assert m.called
-
-
-@pytest.mark.django_db
-class TestProjectViewSetList:
-    def setup_method(self):
-        self.factory = APIRequestFactory()
-        self.ws = Workspace.objects.create(name="Acme", slug="acme")
-        self.admin = User.objects.create_user(email="admin@example.com", password="x")
-        WorkspaceMember.objects.create(workspace=self.ws, member=self.admin, role=ROLE.ADMIN.value, is_active=True)
-        self.p1 = Project.objects.create(name="P1", identifier="P1", workspace=self.ws)
-        self.p2 = Project.objects.create(name="P2", identifier="P2", workspace=self.ws, network=2)
-        ProjectMember.objects.create(project=self.p1, workspace=self.ws, member=self.admin, role=ROLE.ADMIN.value, is_active=True)
-
-    def _view(self, action):
-        return ProjectViewSet.as_view({ "get": action })
-
-    def test_list_values_shape_and_inbox_view(self):
-        request = self.factory.get(f"/workspaces/{self.ws.slug}/projects")
-        force_authenticate(request, user=self.admin)
-        response = self._view("list")(request, slug=self.ws.slug)
-        assert response.status_code == status.HTTP_200_OK
-        assert isinstance(response.data, list)
-        item = response.data[0]
-        # Expect selected fields only
-        expected_subset = {"id","name","identifier","sort_order","member_role","inbox_view","network","created_at","updated_at"}
-        assert expected_subset.issubset(set(item.keys()))
-
-    def test_list_member_filtering_includes_network_two(self):
-        member = User.objects.create_user(email="member@example.com", password="x")
-        WorkspaceMember.objects.create(workspace=self.ws, member=member, role=ROLE.MEMBER.value, is_active=True)
-        ProjectMember.objects.create(project=self.p1, workspace=self.ws, member=member, role=ROLE.MEMBER.value, is_active=True)
-
-        request = self.factory.get(f"/workspaces/{self.ws.slug}/projects")
-        force_authenticate(request, user=member)
-        response = self._view("list")(request, slug=self.ws.slug)
-        ids = [p["id"] for p in response.data]
-        assert self.p1.id in ids
-        assert self.p2.id in ids  # network=2 visible to members
-
-
-@pytest.mark.django_db
-class TestProjectViewSetRetrieveCreateUpdateDestroy:
-    def setup_method(self):
-        self.factory = APIRequestFactory()
-        self.ws = Workspace.objects.create(name="Acme", slug="acme")
-        self.admin = User.objects.create_user(email="admin@example.com", password="x")
-        self.member = User.objects.create_user(email="user@example.com", password="x")
-        WorkspaceMember.objects.create(workspace=self.ws, member=self.admin, role=ROLE.ADMIN.value, is_active=True)
-        WorkspaceMember.objects.create(workspace=self.ws, member=self.member, role=ROLE.MEMBER.value, is_active=True)
-        self.project = Project.objects.create(name="Proj", identifier="PROJ", workspace=self.ws)
-        ProjectMember.objects.create(project=self.project, workspace=self.ws, member=self.admin, role=ROLE.ADMIN.value, is_active=True)
-
-    def _view(self, method_name, http_method="get"):
-        return ProjectViewSet.as_view({ http_method: method_name })
-
-    @mock.patch("plane.app.views.recent_visited_task.delay")
-    def test_retrieve_happy_path_and_404(self, mock_task):
-        # make member of project
-        ProjectMember.objects.create(project=self.project, workspace=self.ws, member=self.member, role=ROLE.MEMBER.value, is_active=True)
-        # OK
-        req = self.factory.get("/")
-        force_authenticate(req, user=self.member)
-        resp = self._view("retrieve")(req, slug=self.ws.slug, pk=str(self.project.id))
-        assert resp.status_code == status.HTTP_200_OK
-        mock_task.assert_called_once()
-        # 404 when not a member
-        outsider = User.objects.create_user(email="out@example.com", password="x")
-        WorkspaceMember.objects.create(workspace=self.ws, member=outsider, role=ROLE.MEMBER.value, is_active=True)
-        req = self.factory.get("/")
-        force_authenticate(req, user=outsider)
-        resp = self._view("retrieve")(req, slug=self.ws.slug, pk=str(self.project.id))
-        assert resp.status_code == status.HTTP_404_NOT_FOUND
-
-    @mock.patch("plane.app.views.model_activity.delay")
-    def test_create_creates_default_states_and_members(self, mock_activity):
-        req = self.factory.post("/", data={"name": "NewProj", "identifier": "NP"}, format="json")
-        force_authenticate(req, user=self.admin)
-        resp = self._view("create", http_method="post")(req, slug=self.ws.slug)
-        assert resp.status_code == status.HTTP_201_CREATED
-        created_id = resp.data["id"]
-        # Defaults: states created
-        assert State.objects.filter(project_id=created_id, workspace=self.ws).count() >= 5
-        # Memberships: admin added
-        assert ProjectMember.objects.filter(project_id=created_id, member=self.admin, role=ROLE.ADMIN.value).exists()
-        mock_activity.assert_called_once()
-
-    @mock.patch("plane.app.views.model_activity.delay")
-    def test_partial_update_requires_permission_and_handles_archived(self, mock_activity):
-        # Non-admin project member should be forbidden
-        non_admin = self.member
-        ProjectMember.objects.create(project=self.project, workspace=self.ws, member=non_admin, role=ROLE.MEMBER.value, is_active=True)
-        req = self.factory.patch("/", data={"name": "X"}, format="json")
-        force_authenticate(req, user=non_admin)
-        resp = self._view("partial_update", http_method="patch")(req, slug=self.ws.slug, pk=str(self.project.id))
-        assert resp.status_code == status.HTTP_403_FORBIDDEN
-
-        # Archive project then attempt update -> 400
-        self.project.archived_at = timezone.now()
-        self.project.save()
-        req = self.factory.patch("/", data={"name": "Y"}, format="json")
-        force_authenticate(req, user=self.admin)
-        resp = self._view("partial_update", http_method="patch")(req, slug=self.ws.slug, pk=str(self.project.id))
-        assert resp.status_code == status.HTTP_400_BAD_REQUEST
-
-        # Unarchive and enable inbox_view -> ensure Intake default created
-        self.project.archived_at = None
-        self.project.save()
-        req = self.factory.patch("/", data={"inbox_view": True}, format="json")
-        force_authenticate(req, user=self.admin)
-        resp = self._view("partial_update", http_method="patch")(req, slug=self.ws.slug, pk=str(self.project.id))
-        assert resp.status_code == status.HTTP_200_OK
-        assert Intake.objects.filter(project=self.project, is_default=True).exists()
-        assert mock_activity.called
-
-    @mock.patch("plane.app.views.webhook_activity.delay")
-    def test_destroy_deletes_related_and_respects_permission(self, mock_webhook):
-        # Non-admin cannot delete
-        req = self.factory.delete("/")
-        force_authenticate(req, user=self.member)
-        resp = self._view("destroy", http_method="delete")(req, slug=self.ws.slug, pk=str(self.project.id))
-        assert resp.status_code == status.HTTP_403_FORBIDDEN
-
-        # Admin delete removes deploy board and favorites
-        DeployBoard.objects.create(entity_name="project", entity_identifier=self.project.id, project=self.project, workspace=self.ws)
-        UserFavorite.objects.create(user=self.admin, entity_type="project", entity_identifier=self.project.id, project=self.project, workspace=self.ws)
-        req = self.factory.delete("/")
-        force_authenticate(req, user=self.admin)
-        resp = self._view("destroy", http_method="delete")(req, slug=self.ws.slug, pk=str(self.project.id))
-        assert resp.status_code == status.HTTP_204_NO_CONTENT
-        assert not DeployBoard.objects.filter(project_id=self.project.id, workspace=self.ws).exists()
-        assert not UserFavorite.objects.filter(project_id=self.project.id, workspace=self.ws).exists()
-        mock_webhook.assert_called_once()
-
-
-@pytest.mark.django_db
-class TestProjectArchiveUnarchiveEndpoint:
-    def setup_method(self):
-        self.factory = APIRequestFactory()
-        self.ws = Workspace.objects.create(name="Acme", slug="acme")
-        self.admin = User.objects.create_user(email="admin@example.com", password="x")
-        WorkspaceMember.objects.create(workspace=self.ws, member=self.admin, role=ROLE.ADMIN.value, is_active=True)
-        self.project = Project.objects.create(name="Proj", identifier="PROJ", workspace=self.ws)
-
-    def test_archive_sets_archived_at_and_removes_favorites(self):
-        fav = UserFavorite.objects.create(user=self.admin, entity_type="project", entity_identifier=self.project.id, project=self.project, workspace=self.ws)
-        view = ProjectArchiveUnarchiveEndpoint.as_view({"post": "post"})
-        req = self.factory.post("/")
-        force_authenticate(req, user=self.admin)
-        resp = view(req, slug=self.ws.slug, project_id=str(self.project.id))
-        assert resp.status_code == status.HTTP_200_OK
-        self.project.refresh_from_db()
-        assert self.project.archived_at is not None
-        assert not UserFavorite.objects.filter(pk=fav.pk).exists()
-
-    def test_unarchive_clears_archived_at(self):
-        self.project.archived_at = timezone.now()
-        self.project.save()
-        view = ProjectArchiveUnarchiveEndpoint.as_view({"delete": "delete"})
-        req = self.factory.delete("/")
-        force_authenticate(req, user=self.admin)
-        resp = view(req, slug=self.ws.slug, project_id=str(self.project.id))
-        assert resp.status_code == status.HTTP_204_NO_CONTENT
-        self.project.refresh_from_db()
-        assert self.project.archived_at is None
-
-
-@pytest.mark.django_db
-class TestProjectIdentifierEndpoint:
-    def setup_method(self):
-        self.factory = APIRequestFactory()
-        self.ws = Workspace.objects.create(name="Acme", slug="acme")
-        self.admin = User.objects.create_user(email="admin@example.com", password="x")
-        WorkspaceMember.objects.create(workspace=self.ws, member=self.admin, role=ROLE.ADMIN.value, is_active=True)
-
-    def test_get_requires_name(self):
-        view = ProjectIdentifierEndpoint.as_view({"get": "get"})
-        req = self.factory.get("/", data={"name": ""})
-        force_authenticate(req, user=self.admin)
-        resp = view(req, slug=self.ws.slug)
-        assert resp.status_code == status.HTTP_400_BAD_REQUEST
-
-    def test_get_returns_existing_identifiers(self):
-        ProjectIdentifier.objects.create(name="API", workspace=self.ws)
-        view = ProjectIdentifierEndpoint.as_view({"get": "get"})
-        req = self.factory.get("/", data={"name": "api"})
-        force_authenticate(req, user=self.admin)
-        resp = view(req, slug=self.ws.slug)
-        assert resp.status_code == status.HTTP_200_OK
-        assert resp.data["exists"] >= 1
-        assert any(i["name"] == "API" for i in resp.data["identifiers"])
-
-    def test_delete_validation_and_success(self):
-        view = ProjectIdentifierEndpoint.as_view({"delete": "delete"})
-        # Missing name
-        req = self.factory.delete("/", data={"name": ""}, format="json")
-        force_authenticate(req, user=self.admin)
-        resp = view(req, slug=self.ws.slug)
-        assert resp.status_code == status.HTTP_400_BAD_REQUEST
-
-        # Cannot delete if used by a project
-        proj = Project.objects.create(name="Proj", identifier="USED", workspace=self.ws)
-        req = self.factory.delete("/", data={"name": "used"}, format="json")
-        force_authenticate(req, user=self.admin)
-        resp = view(req, slug=self.ws.slug)
-        assert resp.status_code == status.HTTP_400_BAD_REQUEST
-
-        # Can delete free identifier
-        ProjectIdentifier.objects.create(name="FREE", workspace=self.ws)
-        req = self.factory.delete("/", data={"name": "free"}, format="json")
-        force_authenticate(req, user=self.admin)
-        resp = view(req, slug=self.ws.slug)
-        assert resp.status_code == status.HTTP_204_NO_CONTENT
-        assert not ProjectIdentifier.objects.filter(name="FREE", workspace=self.ws).exists()
-
-
-@pytest.mark.django_db
-class TestProjectUserViewsEndpoint:
-    def setup_method(self):
-        self.factory = APIRequestFactory()
-        self.ws = Workspace.objects.create(name="Acme", slug="acme")
-        self.user = User.objects.create_user(email="u@example.com", password="x")
-        self.project = Project.objects.create(name="Proj", identifier="PROJ", workspace=self.ws)
-
-    def test_post_forbidden_if_not_project_member(self):
-        view = ProjectUserViewsEndpoint.as_view({"post": "post"})
-        req = self.factory.post("/", data={"view_props": {"x": 1}}, format="json")
-        force_authenticate(req, user=self.user)
-        resp = view(req, slug=self.ws.slug, project_id=str(self.project.id))
-        assert resp.status_code == status.HTTP_403_FORBIDDEN
-
-    def test_post_updates_member_props(self):
-        # Make user a member
-        ProjectMember.objects.create(project=self.project, workspace=self.ws, member=self.user, role=ROLE.MEMBER.value, is_active=True, view_props={"a": 1}, default_props={"b": 2}, preferences={"c": 3}, sort_order=5)
-        view = ProjectUserViewsEndpoint.as_view({"post": "post"})
-        payload = {
-            "view_props": {"a": 9},
-            "default_props": {"b": 8},
-            "preferences": {"c": 7},
-            "sort_order": 42,
-        }
-        req = self.factory.post("/", data=payload, format="json")
-        force_authenticate(req, user=self.user)
-        resp = view(req, slug=self.ws.slug, project_id=str(self.project.id))
-        assert resp.status_code == status.HTTP_204_NO_CONTENT
-        pm = ProjectMember.objects.get(project=self.project, member=self.user)
-        assert pm.view_props == payload["view_props"]
-        assert pm.default_props == payload["default_props"]
-        assert pm.preferences == payload["preferences"]
-        assert pm.sort_order == 42
-
-
-@pytest.mark.django_db
-class TestProjectFavoritesViewSet:
-    def setup_method(self):
-        self.factory = APIRequestFactory()
-        self.ws = Workspace.objects.create(name="Acme", slug="acme")
-        self.user = User.objects.create_user(email="u@example.com", password="x")
-        WorkspaceMember.objects.create(workspace=self.ws, member=self.user, role=ROLE.MEMBER.value, is_active=True)
-        self.project = Project.objects.create(name="Proj", identifier="PROJ", workspace=self.ws)
-
-    def _view(self, method, http="post"):
-        return ProjectFavoritesViewSet.as_view({ http: method })
-
-    def test_create_and_destroy_favorite(self):
-        # Create
-        req = self.factory.post("/", data={"project": self.project.id}, format="json")
-        force_authenticate(req, user=self.user)
-        resp = self._view("create", "post")(req, slug=self.ws.slug)
-        assert resp.status_code == status.HTTP_204_NO_CONTENT
-        fav = UserFavorite.objects.get(user=self.user, project=self.project, entity_type="project")
-
-        # Destroy
-        req = self.factory.delete("/")
-        force_authenticate(req, user=self.user)
-        resp = self._view("destroy", "delete")(req, slug=self.ws.slug, project_id=str(self.project.id))
-        assert resp.status_code == status.HTTP_204_NO_CONTENT
-        assert not UserFavorite.objects.filter(pk=fav.pk).exists()
-
-
-@pytest.mark.django_db
-class TestProjectPublicCoverImagesEndpoint:
-    @mock.patch("plane.app.views.boto3.client")
-    def test_get_lists_public_images_and_handles_errors(self, mock_client):
-        # Mock S3 response
-        s3 = mock_client.return_value
-        s3.list_objects_v2.return_value = {
-            "Contents": [
-                {"Key": "static/project-cover/img1.png"},
-                {"Key": "static/project-cover/nested/"},
-                {"Key": "static/project-cover/img2.jpg"},
-            ]
-        }
-        req = APIRequestFactory().get("/public/project-covers")
-        resp = ProjectPublicCoverImagesEndpoint.as_view()(req)
-        assert resp.status_code == status.HTTP_200_OK
-        # Only files, ignore folders
-        assert len(resp.data) == 2
-        assert all(k.endswith(("img1.png","img2.jpg")) for k in resp.data[0:2] or [])
-
-        # Error path returns empty list
-        s3.list_objects_v2.side_effect = Exception("boom")
-        req = APIRequestFactory().get("/public/project-covers")
-        resp = ProjectPublicCoverImagesEndpoint.as_view()(req)
-        assert resp.status_code == status.HTTP_200_OK
-        assert resp.data == []
-
-
-@pytest.mark.django_db
-class TestDeployBoardViewSet:
-    def setup_method(self):
-        self.factory = APIRequestFactory()
-        self.client = APIClient()
-        self.ws = Workspace.objects.create(name="Acme", slug="acme")
-        self.user = User.objects.create_user(email="u@example.com", password="x")
-        WorkspaceMember.objects.create(workspace=self.ws, member=self.user, role=ROLE.MEMBER.value, is_active=True)
-        self.project = Project.objects.create(name="Proj", identifier="PROJ", workspace=self.ws)
-        ProjectMember.objects.create(project=self.project, workspace=self.ws, member=self.user, role=ROLE.MEMBER.value, is_active=True)
-
-    def _view(self, method, http="get"):
-        return DeployBoardViewSet.as_view({ http: method })
-
-    def test_list_returns_existing_board(self):
-        db = DeployBoard.objects.create(entity_name="project", entity_identifier=self.project.id, project=self.project, workspace=self.ws, view_props={"list": True})
-        req = self.factory.get("/")
-        force_authenticate(req, user=self.user)
-        resp = self._view("list", "get")(req, slug=self.ws.slug, project_id=str(self.project.id))
-        assert resp.status_code == status.HTTP_200_OK
-        assert resp.data["id"] == str(db.id) or resp.data["id"] == db.id
-
-    def test_create_upserts_and_sets_flags(self):
-        payload = {
-            "is_comments_enabled": True,
-            "is_reactions_enabled": True,
-            "is_votes_enabled": True,
-            "intake": {"enabled": True},
-            "views": {"list": True, "kanban": False, "calendar": True, "gantt": False, "spreadsheet": True},
-        }
-        req = self.factory.post("/", data=payload, format="json")
-        force_authenticate(req, user=self.user)
-        resp = self._view("create", "post")(req, slug=self.ws.slug, project_id=str(self.project.id))
-        assert resp.status_code == status.HTTP_200_OK
-
-        db = DeployBoard.objects.get(entity_name="project", entity_identifier=self.project.id)
-        assert db.is_comments_enabled is True
-        assert db.is_reactions_enabled is True
-        assert db.is_votes_enabled is True
-        assert db.view_props == payload["views"]
-        assert db.intake == payload["intake"]
-
-
-# Testing framework note:
-# These tests are written for pytest with pytest-django and Django REST Framework's testing utilities (APIRequestFactory/APIClient).
-# They follow repository conventions by mocking external dependencies (boto3, celery tasks) and exercising public interfaces of view classes.
@@ -1,14 +1,36 @@
 # Python imports
 import base64
-import nh3
-from plane.utils.exception_logger import log_exception
-from bs4 import BeautifulSoup
-from collections import defaultdict
+import json
+import re


 # Maximum allowed size for binary data (10MB)
 MAX_SIZE = 10 * 1024 * 1024

+# Maximum recursion depth to prevent stack overflow
+MAX_RECURSION_DEPTH = 20
+
+# Dangerous text patterns that could indicate XSS or script injection
+DANGEROUS_TEXT_PATTERNS = [
+    r"<script[^>]*>.*?</script>",
+    r"javascript\s*:",
+    r"data\s*:\s*text/html",
+    r"eval\s*\(",
+    r"document\s*\.",
+    r"window\s*\.",
+    r"location\s*\.",
+]
+
+# Dangerous attribute patterns for HTML attributes
+DANGEROUS_ATTR_PATTERNS = [
+    r"javascript\s*:",
+    r"data\s*:\s*text/html",
+    r"eval\s*\(",
+    r"alert\s*\(",
+    r"document\s*\.",
+    r"window\s*\.",
+]
+
 # Suspicious patterns for binary data content
 SUSPICIOUS_BINARY_PATTERNS = [
    "<html",
@@ -19,11 +41,74 @@ SUSPICIOUS_BINARY_PATTERNS = [
    "<iframe",
 ]

+# Malicious HTML patterns for content validation
+MALICIOUS_HTML_PATTERNS = [
+    # Script tags with any content
+    r"<script[^>]*>",
+    r"</script>",
+    # JavaScript URLs in various attributes
+    r'(?:href|src|action)\s*=\s*["\']?\s*javascript:',
+    # Data URLs with text/html (potential XSS)
+    r'(?:href|src|action)\s*=\s*["\']?\s*data:text/html',
+    # Dangerous event handlers with JavaScript-like content
+    r'on(?:load|error|click|focus|blur|change|submit|reset|select|resize|scroll|unload|beforeunload|hashchange|popstate|storage|message|offline|online)\s*=\s*["\']?[^"\']*(?:javascript|alert|eval|document\.|window\.|location\.|history\.)[^"\']*["\']?',
+    # Object and embed tags that could load external content
+    r"<(?:object|embed)[^>]*(?:data|src)\s*=",
+    # Base tag that could change relative URL resolution
+    r"<base[^>]*href\s*=",
+    # Dangerous iframe sources
+    r'<iframe[^>]*src\s*=\s*["\']?(?:javascript:|data:text/html)',
+    # Meta refresh redirects
+    r'<meta[^>]*http-equiv\s*=\s*["\']?refresh["\']?',
+    # Link tags - simplified patterns
+    r'<link[^>]*rel\s*=\s*["\']?stylesheet["\']?',
+    r'<link[^>]*href\s*=\s*["\']?https?://',
+    r'<link[^>]*href\s*=\s*["\']?//',
+    r'<link[^>]*href\s*=\s*["\']?(?:data:|javascript:)',
+    # Style tags with external imports
+    r"<style[^>]*>.*?@import.*?(?:https?://|//)",
+    # Link tags with dangerous rel types
+    r'<link[^>]*rel\s*=\s*["\']?(?:import|preload|prefetch|dns-prefetch|preconnect)["\']?',
+    # Forms with action attributes
+    r"<form[^>]*action\s*=",
+]
+
+# Dangerous JavaScript patterns for event handlers
+DANGEROUS_JS_PATTERNS = [
+    r"alert\s*\(",
+    r"eval\s*\(",
+    r"document\s*\.",
+    r"window\s*\.",
+    r"location\s*\.",
+    r"fetch\s*\(",
+    r"XMLHttpRequest",
+    r"innerHTML\s*=",
+    r"outerHTML\s*=",
+    r"document\.write",
+    r"script\s*>",
+]
+
+# HTML self-closing tags that don't need closing tags
+SELF_CLOSING_TAGS = {
+    "img",
+    "br",
+    "hr",
+    "input",
+    "meta",
+    "link",
+    "area",
+    "base",
+    "col",
+    "embed",
+    "source",
+    "track",
+    "wbr",
+}
+

 def validate_binary_data(data):
    """
-    Validate that binary data appears to be a valid document format
-    and doesn't contain malicious content.
+    Validate that binary data appears to be valid document format and doesn't contain malicious content.

    Args:
        data (bytes or str): The binary data to validate, or base64-encoded string
@@ -64,180 +149,209 @@ def validate_binary_data(data):
    return True, None


-# Combine custom components and editor-specific nodes into a single set of tags
-CUSTOM_TAGS = {
-    # editor node/tag names
-    "mention-component",
-    "label",
-    "input",
-    "image-component",
-}
-ALLOWED_TAGS = nh3.ALLOWED_TAGS | CUSTOM_TAGS
-
-# Merge nh3 defaults with all attributes used across our custom components
-ATTRIBUTES = {
-    "*": {
-        "class",
-        "id",
-        "title",
-        "role",
-        "aria-label",
-        "aria-hidden",
-        "style",
-        "start",
-        "type",
-        # common editor data-* attributes seen in stored HTML
-        # (wildcards like data-* are NOT supported by nh3; we add known keys
-        # here and dynamically include all data-* seen in the input below)
-        "data-tight",
-        "data-node-type",
-        "data-type",
-        "data-checked",
-        "data-background-color",
-        "data-text-color",
-        "data-name",
-        # callout attributes
-        "data-icon-name",
-        "data-icon-color",
-        "data-background",
-        "data-emoji-unicode",
-        "data-emoji-url",
-        "data-logo-in-use",
-        "data-block-type",
-    },
-    "a": {"href", "target"},
-    # editor node/tag attributes
-    "image-component": {
-        "id",
-        "width",
-        "height",
-        "aspectRatio",
-        "aspectratio",
-        "src",
-        "alignment",
-    },
-    "img": {
-        "width",
-        "height",
-        "aspectRatio",
-        "aspectratio",
-        "alignment",
-        "src",
-        "alt",
-        "title",
-    },
-    "mention-component": {"id", "entity_identifier", "entity_name"},
-    "th": {
-        "colspan",
-        "rowspan",
-        "colwidth",
-        "background",
-        "hideContent",
-        "hidecontent",
-        "style",
-    },
-    "td": {
-        "colspan",
-        "rowspan",
-        "colwidth",
-        "background",
-        "textColor",
-        "textcolor",
-        "hideContent",
-        "hidecontent",
-        "style",
-    },
-    "tr": {"background", "textColor", "textcolor", "style"},
-    "pre": {"language"},
-    "code": {"language", "spellcheck"},
-    "input": {"type", "checked"},
-}
-
-SAFE_PROTOCOLS = {"http", "https", "mailto", "tel"}
-
-
-def _compute_html_sanitization_diff(before_html: str, after_html: str):
+def validate_html_content(html_content):
    """
-    Compute a coarse diff between original and sanitized HTML.
+    Validate that HTML content is safe and doesn't contain malicious patterns.

-    Returns a dict with:
-    - removed_tags: mapping[tag] -> removed_count
-    - removed_attributes: mapping[tag] -> sorted list of attribute names removed
-    """
-    try:
+    Args:
+        html_content (str): The HTML content to validate

-        def collect(soup):
-            tag_counts = defaultdict(int)
-            attrs_by_tag = defaultdict(set)
-            for el in soup.find_all(True):
-                tag_name = (el.name or "").lower()
-                if not tag_name:
-                    continue
-                tag_counts[tag_name] += 1
-                for attr_name in list(el.attrs.keys()):
-                    if isinstance(attr_name, str) and attr_name:
-                        attrs_by_tag[tag_name].add(attr_name.lower())
-            return tag_counts, attrs_by_tag
-
-        soup_before = BeautifulSoup(before_html or "", "html.parser")
-        soup_after = BeautifulSoup(after_html or "", "html.parser")
-
-        counts_before, attrs_before = collect(soup_before)
-        counts_after, attrs_after = collect(soup_after)
-
-        removed_tags = {}
-        for tag, cnt_before in counts_before.items():
-            cnt_after = counts_after.get(tag, 0)
-            if cnt_after < cnt_before:
-                removed = cnt_before - cnt_after
-                removed_tags[tag] = removed
-
-        removed_attributes = {}
-        for tag, before_set in attrs_before.items():
-            after_set = attrs_after.get(tag, set())
-            removed = before_set - after_set
-            if removed:
-                removed_attributes[tag] = sorted(list(removed))
-
-        return {"removed_tags": removed_tags, "removed_attributes": removed_attributes}
-    except Exception:
-        # Best-effort only; if diffing fails we don't block the request
-        return {"removed_tags": {}, "removed_attributes": {}}
-
-
-def validate_html_content(html_content: str):
-    """
-    Sanitize HTML content using nh3.
-    Returns a tuple: (is_valid, error_message, clean_html)
+    Returns:
+        tuple: (is_valid: bool, error_message: str or None)
    """
    if not html_content:
-        return True, None, None
+        return True, None  # Empty is OK

    # Size check - 10MB limit (consistent with binary validation)
    if len(html_content.encode("utf-8")) > MAX_SIZE:
-        return False, "HTML content exceeds maximum size limit (10MB)", None
+        return False, "HTML content exceeds maximum size limit (10MB)"
+
+    # Check for specific malicious patterns (simplified and more reliable)
+    for pattern in MALICIOUS_HTML_PATTERNS:
+        if re.search(pattern, html_content, re.IGNORECASE | re.DOTALL):
+            return (
+                False,
+                f"HTML content contains potentially malicious patterns: {pattern}",
+            )
+
+    # Additional check for inline event handlers that contain suspicious content
+    # This is more permissive - only blocks if the event handler contains actual dangerous code
+    event_handler_pattern = r'on\w+\s*=\s*["\']([^"\']*)["\']'
+    event_matches = re.findall(event_handler_pattern, html_content, re.IGNORECASE)
+
+    for handler_content in event_matches:
+        for js_pattern in DANGEROUS_JS_PATTERNS:
+            if re.search(js_pattern, handler_content, re.IGNORECASE):
+                return (
+                    False,
+                    f"HTML content contains dangerous JavaScript in event handler: {handler_content[:100]}",
+                )
+
+    # Basic HTML structure validation - check for common malformed tags
+    try:
+        # Count opening and closing tags for basic structure validation
+        opening_tags = re.findall(r"<(\w+)[^>]*>", html_content)
+        closing_tags = re.findall(r"</(\w+)>", html_content)
+
+        # Filter out self-closing tags from opening tags
+        opening_tags_filtered = [
+            tag for tag in opening_tags if tag.lower() not in SELF_CLOSING_TAGS
+        ]
+
+        # Basic check - if we have significantly more opening than closing tags, it might be malformed
+        if len(opening_tags_filtered) > len(closing_tags) + 10:  # Allow some tolerance
+            return False, "HTML content appears to be malformed (unmatched tags)"
+
+    except Exception:
+        # If HTML parsing fails, we'll allow it
+        pass
+
+    return True, None
+
+
+def validate_json_content(json_content):
+    """
+    Validate that JSON content is safe and doesn't contain malicious patterns.
+
+    Args:
+        json_content (dict): The JSON content to validate
+
+    Returns:
+        tuple: (is_valid: bool, error_message: str or None)
+    """
+    if not json_content:
+        return True, None  # Empty is OK

    try:
-        clean_html = nh3.clean(
-            html_content,
-            tags=ALLOWED_TAGS,
-            attributes=ATTRIBUTES,
-            url_schemes=SAFE_PROTOCOLS,
-        )
-        # Report removals to logger (Sentry) if anything was stripped
-        diff = _compute_html_sanitization_diff(html_content, clean_html)
-        if diff.get("removed_tags") or diff.get("removed_attributes"):
-            try:
-                import json
+        # Size check - 10MB limit (consistent with other validations)
+        json_str = json.dumps(json_content)
+        if len(json_str.encode("utf-8")) > MAX_SIZE:
+            return False, "JSON content exceeds maximum size limit (10MB)"

-                summary = json.dumps(diff)
-            except Exception:
-                summary = str(diff)
-            log_exception(
-                f"HTML sanitization removals: {summary}",
-                warning=True,
-            )
-        return True, None, clean_html
+        # Basic structure validation for page description JSON
+        if isinstance(json_content, dict):
+            # Check for expected page description structure
+            # This is based on ProseMirror/Tiptap JSON structure
+            if "type" in json_content and json_content.get("type") == "doc":
+                # Valid document structure
+                if "content" in json_content and isinstance(
+                    json_content["content"], list
+                ):
+                    # Recursively check content for suspicious patterns
+                    is_valid, error_msg = _validate_json_content_array(
+                        json_content["content"]
+                    )
+                    if not is_valid:
+                        return False, error_msg
+            elif "type" not in json_content and "content" not in json_content:
+                # Allow other JSON structures but validate for suspicious content
+                is_valid, error_msg = _validate_json_content_recursive(json_content)
+                if not is_valid:
+                    return False, error_msg
+        else:
+            return False, "JSON description must be a valid object"
+
+    except (TypeError, ValueError) as e:
+        return False, "Invalid JSON structure"
    except Exception as e:
-        log_exception(e)
-        return False, "Failed to sanitize HTML", None
+        return False, "Failed to validate JSON content"
+
+    return True, None
+
+
+def _validate_json_content_array(content, depth=0):
+    """
+    Validate JSON content array for suspicious patterns.
+
+    Args:
+        content (list): Array of content nodes to validate
+        depth (int): Current recursion depth (default: 0)
+
+    Returns:
+        tuple: (is_valid: bool, error_message: str or None)
+    """
+    # Check recursion depth to prevent stack overflow
+    if depth > MAX_RECURSION_DEPTH:
+        return False, f"Maximum recursion depth ({MAX_RECURSION_DEPTH}) exceeded"
+
+    if not isinstance(content, list):
+        return True, None
+
+    for node in content:
+        if isinstance(node, dict):
+            # Check text content for suspicious patterns (more targeted)
+            if node.get("type") == "text" and "text" in node:
+                text_content = node["text"]
+                for pattern in DANGEROUS_TEXT_PATTERNS:
+                    if re.search(pattern, text_content, re.IGNORECASE):
+                        return (
+                            False,
+                            "JSON content contains suspicious script patterns in text",
+                        )
+
+            # Check attributes for suspicious content (more targeted)
+            if "attrs" in node and isinstance(node["attrs"], dict):
+                for attr_name, attr_value in node["attrs"].items():
+                    if isinstance(attr_value, str):
+                        # Only check specific attributes that could be dangerous
+                        if attr_name.lower() in [
+                            "href",
+                            "src",
+                            "action",
+                            "onclick",
+                            "onload",
+                            "onerror",
+                        ]:
+                            for pattern in DANGEROUS_ATTR_PATTERNS:
+                                if re.search(pattern, attr_value, re.IGNORECASE):
+                                    return (
+                                        False,
+                                        f"JSON content contains dangerous pattern in {attr_name} attribute",
+                                    )
+
+            # Recursively check nested content
+            if "content" in node and isinstance(node["content"], list):
+                is_valid, error_msg = _validate_json_content_array(
+                    node["content"], depth + 1
+                )
+                if not is_valid:
+                    return False, error_msg
+
+    return True, None
+
+
+def _validate_json_content_recursive(obj, depth=0):
+    """
+    Recursively validate JSON object for suspicious content.
+
+    Args:
+        obj: JSON object (dict, list, or primitive) to validate
+        depth (int): Current recursion depth (default: 0)
+
+    Returns:
+        tuple: (is_valid: bool, error_message: str or None)
+    """
+    # Check recursion depth to prevent stack overflow
+    if depth > MAX_RECURSION_DEPTH:
+        return False, f"Maximum recursion depth ({MAX_RECURSION_DEPTH}) exceeded"
+    if isinstance(obj, dict):
+        for key, value in obj.items():
+            if isinstance(value, str):
+                # Check for dangerous patterns using module constants
+                for pattern in DANGEROUS_TEXT_PATTERNS:
+                    if re.search(pattern, value, re.IGNORECASE):
+                        return (
+                            False,
+                            "JSON content contains suspicious script patterns",
+                        )
+            elif isinstance(value, (dict, list)):
+                is_valid, error_msg = _validate_json_content_recursive(value, depth + 1)
+                if not is_valid:
+                    return False, error_msg
+    elif isinstance(obj, list):
+        for item in obj:
+            is_valid, error_msg = _validate_json_content_recursive(item, depth + 1)
+            if not is_valid:
+                return False, error_msg
+
+    return True, None
@@ -1,7 +1,7 @@
 # Django imports
 from django.contrib.postgres.aggregates import ArrayAgg
 from django.contrib.postgres.fields import ArrayField
-from django.db.models import Q, UUIDField, Value, QuerySet, OuterRef, Subquery
+from django.db.models import Q, UUIDField, Value, QuerySet
 from django.db.models.functions import Coalesce

 # Module imports
@@ -14,9 +14,6 @@ from plane.db.models import (
    ProjectMember,
    State,
    WorkspaceMember,
-    IssueAssignee,
-    ModuleIssue,
-    IssueLabel,
 )
 from typing import Optional, Dict, Tuple, Any, Union, List

@@ -42,52 +39,33 @@ def issue_queryset_grouper(
        if group_key in GROUP_FILTER_MAPPER:
            queryset = queryset.filter(GROUP_FILTER_MAPPER[group_key])

-    issue_assignee_subquery = Subquery(
-        IssueAssignee.objects.filter(
-            issue_id=OuterRef("pk"),
-            deleted_at__isnull=True,
-        )
-        .values("issue_id")
-        .annotate(arr=ArrayAgg("assignee_id", distinct=True))
-        .values("arr")
-    )
-
-    issue_module_subquery = Subquery(
-        ModuleIssue.objects.filter(
-            issue_id=OuterRef("pk"),
-            deleted_at__isnull=True,
-            module__archived_at__isnull=True,
-        )
-        .values("issue_id")
-        .annotate(arr=ArrayAgg("module_id", distinct=True))
-        .values("arr")
-    )
-
-    issue_label_subquery = Subquery(
-        IssueLabel.objects.filter(issue_id=OuterRef("pk"), deleted_at__isnull=True)
-        .values("issue_id")
-        .annotate(arr=ArrayAgg("label_id", distinct=True))
-        .values("arr")
-    )
-
    annotations_map: Dict[str, Tuple[str, Q]] = {
-        "assignee_ids": Coalesce(
-            issue_assignee_subquery, Value([], output_field=ArrayField(UUIDField()))
+        "assignee_ids": (
+            "assignees__id",
+            ~Q(assignees__id__isnull=True) & Q(issue_assignee__deleted_at__isnull=True),
        ),
-        "label_ids": Coalesce(
-            issue_label_subquery, Value([], output_field=ArrayField(UUIDField()))
+        "label_ids": (
+            "labels__id",
+            ~Q(labels__id__isnull=True) & Q(label_issue__deleted_at__isnull=True),
        ),
-        "module_ids": Coalesce(
-            issue_module_subquery, Value([], output_field=ArrayField(UUIDField()))
+        "module_ids": (
+            "issue_module__module_id",
+            (
+                ~Q(issue_module__module_id__isnull=True)
+                & Q(issue_module__module__archived_at__isnull=True)
+                & Q(issue_module__deleted_at__isnull=True)
+            ),
        ),
    }

-    default_annotations: Dict[str, Any] = {}
-
-    for key, expression in annotations_map.items():
-        if FIELD_MAPPER.get(key) in {group_by, sub_group_by}:
-            continue
-        default_annotations[key] = expression
+    default_annotations: Dict[str, Any] = {
+        key: Coalesce(
+            ArrayAgg(field, distinct=True, filter=condition),
+            Value([], output_field=ArrayField(UUIDField())),
+        )
+        for key, (field, condition) in annotations_map.items()
+        if FIELD_MAPPER.get(key) != group_by or FIELD_MAPPER.get(key) != sub_group_by
+    }

    return queryset.annotate(**default_annotations)

@@ -476,8 +476,6 @@ def filter_subscribed_issues(params, issue_filter, method, prefix=""):
            issue_filter[f"{prefix}issue_subscribers__subscriber_id__in"] = params.get(
                "subscriber"
            )
-    issue_filter[f"{prefix}issue_subscribers__deleted_at__isnull"] = True
-
    return issue_filter


@@ -160,7 +160,7 @@ class OffsetPaginator:
        total_count = (
            self.total_count_queryset.count()
            if self.total_count_queryset
-            else queryset.count()
+            else results.count()
        )

        # Check if there are more results available after the current page
@@ -3,20 +3,18 @@ from urllib.parse import urlparse


 def validate_next_path(next_path: str) -> str:
-    """Validates that next_path is a safe relative path for redirection."""
-    # Browsers interpret backslashes as forward slashes. Remove all backslashes.
-    next_path = next_path.replace("\\", "")
+    """Validates that next_path is a valid path and extracts only the path component."""
    parsed_url = urlparse(next_path)

-    # Block absolute URLs or anything with scheme/netloc
+    # Ensure next_path is not an absolute URL
    if parsed_url.scheme or parsed_url.netloc:
        next_path = parsed_url.path  # Extract only the path component

-    # Must start with a forward slash and not be empty
-    if not next_path or not next_path.startswith("/"):
+    # Ensure it starts with a forward slash (indicating a valid relative path)
+    if not next_path.startswith("/"):
        return ""

-    # Prevent path traversal
+    # Ensure it does not contain dangerous path traversal sequences
    if ".." in next_path:
        return ""

@@ -1,7 +1,7 @@
 # base requirements

 # django
-Django==4.2.24
+Django==4.2.22
 # rest framework
 djangorestframework==3.15.2
 # postgres
@@ -9,8 +9,6 @@ psycopg==3.1.18
 psycopg-binary==3.1.18
 psycopg-c==3.1.18
 dj-database-url==2.1.0
-# mongo
-pymongo==4.6.3
 # redis
 redis==5.0.4
 django-redis==5.4.0
@@ -68,6 +66,4 @@ opentelemetry-sdk==1.28.1
 opentelemetry-instrumentation-django==0.49b1
 opentelemetry-exporter-otlp==1.28.1
 # OpenAPI Specification
-drf-spectacular==0.28.0
-# html sanitizer
-nh3==0.2.18
+drf-spectacular==0.28.0
@@ -1,4 +0,0 @@
-module.exports = {
-  root: true,
-  extends: ["@plane/eslint-config/server.js"],
-};
@@ -0,0 +1,5 @@
+{
+  "root": true,
+  "extends": ["@plane/eslint-config/server.js"],
+  "parser": "@typescript-eslint/parser"
+}
@@ -4,12 +4,12 @@ RUN apk add --no-cache libc6-compat
 WORKDIR /app

 COPY . .
-RUN corepack enable pnpm && pnpm add -g turbo
-RUN pnpm install
+RUN yarn global add turbo
+RUN yarn install
 EXPOSE 3003

 ENV TURBO_TELEMETRY_DISABLED=1

 VOLUME [ "/app/node_modules", "/app/live/node_modules"]

-CMD ["pnpm","dev", "--filter=live"]
+CMD ["yarn","dev", "--filter=live"]
@@ -1,11 +1,5 @@
-# syntax=docker/dockerfile:1.7
 FROM node:22-alpine AS base

-# Setup pnpm package manager with corepack and configure global bin directory for caching
-ENV PNPM_HOME="/pnpm"
-ENV PATH="$PNPM_HOME:$PATH"
-RUN corepack enable
-
 # *****************************************************************************
 # STAGE 1: Prune the project
 # *****************************************************************************
@@ -15,10 +9,9 @@ RUN apk update
 RUN apk add --no-cache libc6-compat
 # Set working directory
 WORKDIR /app
-ARG TURBO_VERSION=2.5.6
-RUN corepack enable pnpm && pnpm add -g turbo@${TURBO_VERSION}
+RUN yarn global add turbo
 COPY . .
-RUN turbo prune --scope=live --docker
+RUN turbo prune live --docker

 # *****************************************************************************
 # STAGE 2: Install dependencies & build the project
@@ -32,18 +25,16 @@ WORKDIR /app
 # First install dependencies (as they change less often)
 COPY .gitignore .gitignore
 COPY --from=builder /app/out/json/ .
-COPY --from=builder /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
-RUN corepack enable pnpm
-RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store pnpm fetch --store-dir=/pnpm/store
+COPY --from=builder /app/out/yarn.lock ./yarn.lock
+RUN yarn install

 # Build the project and its dependencies
 COPY --from=builder /app/out/full/ .
 COPY turbo.json turbo.json
-RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store pnpm install --offline --frozen-lockfile --store-dir=/pnpm/store

 ENV TURBO_TELEMETRY_DISABLED=1

-RUN pnpm turbo run build --filter=live
+RUN yarn turbo build --filter=live

 # *****************************************************************************
 # STAGE 3: Run the project
@@ -53,12 +44,11 @@ FROM base AS runner
 WORKDIR /app

 COPY --from=installer /app/packages ./packages
-COPY --from=installer /app/apps/live/dist ./apps/live/dist
-COPY --from=installer /app/apps/live/node_modules ./apps/live/node_modules
+COPY --from=installer /app/apps/live/dist ./live
 COPY --from=installer /app/node_modules ./node_modules

 ENV TURBO_TELEMETRY_DISABLED=1

 EXPOSE 3000

-CMD ["node", "apps/live/dist/server.js"]
+CMD ["node", "live/server.js"]
@@ -1,14 +1,14 @@
 {
  "name": "live",
-  "version": "1.0.0",
+  "version": "0.28.0",
  "license": "AGPL-3.0",
  "description": "A realtime collaborative server powers Plane's rich text editor",
  "main": "./src/server.ts",
  "private": true,
  "type": "module",
  "scripts": {
-    "build": "tsdown",
-    "dev": "tsdown --watch",
+    "dev": "tsup --watch --onSuccess 'node --env-file=.env dist/server.js'",
+    "build": "tsc --noEmit && tsup",
    "start": "node --env-file=.env dist/server.js",
    "check:lint": "eslint . --max-warnings 10",
    "check:types": "tsc --noEmit",
@@ -24,11 +24,11 @@
    "@hocuspocus/extension-logger": "^2.15.0",
    "@hocuspocus/extension-redis": "^2.15.0",
    "@hocuspocus/server": "^2.15.0",
-    "@plane/editor": "workspace:*",
-    "@plane/types": "workspace:*",
+    "@plane/editor": "*",
+    "@plane/types": "*",
    "@tiptap/core": "^2.22.3",
    "@tiptap/html": "^2.22.3",
-    "axios": "catalog:",
+    "axios": "1.11.0",
    "compression": "1.8.1",
    "cors": "^2.8.5",
    "dotenv": "^16.4.5",
@@ -36,30 +36,30 @@
    "express-ws": "^5.0.2",
    "helmet": "^7.1.0",
    "ioredis": "^5.4.1",
-    "lodash": "catalog:",
+    "lodash": "^4.17.21",
    "morgan": "1.10.1",
    "pino-http": "^10.3.0",
    "pino-pretty": "^11.2.2",
-    "uuid": "catalog:",
+    "uuid": "^10.0.0",
    "y-prosemirror": "^1.2.15",
    "y-protocols": "^1.0.6",
    "yjs": "^13.6.20"
  },
  "devDependencies": {
-    "@plane/eslint-config": "workspace:*",
-    "@plane/typescript-config": "workspace:*",
+    "@plane/eslint-config": "*",
+    "@plane/typescript-config": "*",
    "@types/compression": "1.8.1",
    "@types/cors": "^2.8.17",
+    "@types/dotenv": "^8.2.0",
    "@types/express": "^4.17.23",
    "@types/express-ws": "^3.0.5",
    "@types/node": "^20.14.9",
    "@types/pino-http": "^5.8.4",
-    "@types/uuid": "^9.0.1",
    "concurrently": "^9.0.1",
    "nodemon": "^3.1.7",
    "ts-node": "^10.9.2",
-    "tsdown": "catalog:",
-    "typescript": "catalog:",
+    "tsup": "8.4.0",
+    "typescript": "5.8.3",
    "ws": "^8.18.3"
  }
 }
@@ -1,17 +1,20 @@
+// Third-party libraries
+import { Redis } from "ioredis";
+// Hocuspocus extensions and core
 import { Database } from "@hocuspocus/extension-database";
+import { Extension } from "@hocuspocus/server";
 import { Logger } from "@hocuspocus/extension-logger";
 import { Redis as HocusPocusRedis } from "@hocuspocus/extension-redis";
-import { Extension } from "@hocuspocus/server";
-import { Redis } from "ioredis";
 // core helpers and utilities
 import { manualLogger } from "@/core/helpers/logger.js";
+import { getRedisUrl } from "@/core/lib/utils/redis-url.js";
 // core libraries
 import { fetchPageDescriptionBinary, updatePageDescription } from "@/core/lib/page.js";
-import { getRedisUrl } from "@/core/lib/utils/redis-url.js";
-import { type HocusPocusServerContext, type TDocumentTypes } from "@/core/types/common.js";
 // plane live libraries
 import { fetchDocument } from "@/plane-live/lib/fetch-document.js";
 import { updateDocument } from "@/plane-live/lib/update-document.js";
+// types
+import { type HocusPocusServerContext, type TDocumentTypes } from "@/core/types/common.js";

 export const getExtensions: () => Promise<Extension[]> = async () => {
  const extensions: Extension[] = [
@@ -1,4 +1,5 @@
 import { pinoHttp } from "pino-http";
+import { Logger } from "pino";

 const transport = {
  target: "pino-pretty",
@@ -36,4 +37,4 @@ export const logger = pinoHttp({
  },
 });

-export const manualLogger: typeof logger.logger = logger.logger;
+export const manualLogger: Logger = logger.logger;
@@ -1,12 +1,12 @@
 import { Server } from "@hocuspocus/server";
 import { v4 as uuidv4 } from "uuid";
-// editor types
-import { TUserDetails } from "@plane/editor";
-import { DocumentCollaborativeEvents, TDocumentEventsServer } from "@plane/editor/lib";
-// extensions
-import { getExtensions } from "@/core/extensions/index.js";
 // lib
 import { handleAuthentication } from "@/core/lib/authentication.js";
+// extensions
+import { getExtensions } from "@/core/extensions/index.js";
+import { DocumentCollaborativeEvents, TDocumentEventsServer } from "@plane/editor/lib";
+// editor types
+import { TUserDetails } from "@plane/editor";
 // types
 import { type HocusPocusServerContext } from "@/core/types/common.js";

@@ -1,7 +1,7 @@
-// core helpers
-import { manualLogger } from "@/core/helpers/logger.js";
 // services
 import { UserService } from "@/core/services/user.service.js";
+// core helpers
+import { manualLogger } from "@/core/helpers/logger.js";

 const userService = new UserService();

@@ -14,7 +14,6 @@ export abstract class APIService {
    this.axiosInstance = axios.create({
      baseURL,
      withCredentials: true,
-      timeout: 20000,
    });
  }

@@ -1,13 +1,13 @@
 import compression from "compression";
 import cors from "cors";
-import express, { Request, Response } from "express";
 import expressWs from "express-ws";
+import express, { Request, Response } from "express";
 import helmet from "helmet";
 // hocuspocus server
+import { getHocusPocusServer } from "@/core/hocuspocus-server.js";
 // helpers
 import { convertHTMLDocumentToAllFormats } from "@/core/helpers/convert-document.js";
 import { logger, manualLogger } from "@/core/helpers/logger.js";
-import { getHocusPocusServer } from "@/core/hocuspocus-server.js";
 // types
 import { TConvertDocumentRequestBody } from "@/core/types/common.js";

@@ -21,6 +21,6 @@
    "emitDecoratorMetadata": true,
    "sourceRoot": "/"
  },
-  "include": ["src/**/*.ts", "tsdown.config.ts"],
+  "include": ["src/**/*.ts", "tsup.config.ts"],
  "exclude": ["./dist", "./build", "./node_modules"]
 }
--- a/Show More
+++ b/Show More