[WEB-4981] fix: analytics portal modal #7858

[WEB-4981] fix: analytics modal portal (#7852 )
[WEB-5001]fix: prop name for sub work permissions #7854
2025-09-26 14:23:04 +05:30 · 2025-09-25 20:26:44 +05:30 · 2025-09-25 17:51:13 +05:30 · 2025-09-25 15:56:33 +05:30 · 2025-09-24 17:45:43 +05:30 · 2025-09-24 17:45:18 +05:30
1142 changed files with 26845 additions and 11339 deletions
@@ -35,6 +35,10 @@ on:
      - preview
      - canary

+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
  TARGET_BRANCH: ${{ github.ref_name }}
  ARM64_BUILD: ${{ github.event.inputs.arm64 }}
@@ -268,15 +272,14 @@ jobs:
    if: ${{ needs.branch_build_setup.outputs.aio_build == 'true' }}
    name: Build-Push AIO Docker Image
    runs-on: ubuntu-22.04
-    needs: [
-        branch_build_setup,
-        branch_build_push_admin,
-        branch_build_push_web,
-        branch_build_push_space,
-        branch_build_push_live,
-        branch_build_push_api,
-        branch_build_push_proxy
-      ]
+    needs:
+      - branch_build_setup
+      - branch_build_push_admin
+      - branch_build_push_web
+      - branch_build_push_space
+      - branch_build_push_live
+      - branch_build_push_api
+      - branch_build_push_proxy
    steps:
      - name: Checkout Files
        uses: actions/checkout@v4
@@ -285,7 +288,7 @@ jobs:
        id: prepare_aio_assets
        run: |
          cd deployments/aio/community
-          
+
          if [ "${{ needs.branch_build_setup.outputs.build_type }}" == "Release" ]; then
            aio_version=${{ needs.branch_build_setup.outputs.release_version }}
          else
@@ -324,7 +327,14 @@ jobs:
  upload_build_assets:
    name: Upload Build Assets
    runs-on: ubuntu-22.04
-    needs: [branch_build_setup, branch_build_push_admin, branch_build_push_web, branch_build_push_space, branch_build_push_live, branch_build_push_api, branch_build_push_proxy]
+    needs:
+      - branch_build_setup
+      - branch_build_push_admin
+      - branch_build_push_web
+      - branch_build_push_space
+      - branch_build_push_live
+      - branch_build_push_api
+      - branch_build_push_proxy
    steps:
      - name: Checkout Files
        uses: actions/checkout@v4
@@ -397,4 +407,3 @@ jobs:
            ${{ github.workspace }}/deployments/cli/community/docker-compose.yml
            ${{ github.workspace }}/deployments/cli/community/variables.env
            ${{ github.workspace }}/deployments/swarm/community/swarm.sh
-
@@ -17,8 +17,6 @@ jobs:

      - name: Setup Node.js
        uses: actions/setup-node@v4
-        with:
-          node-version: '18'

      - name: Get PR Branch version
        run: echo "PR_VERSION=$(node -p "require('./package.json').version")" >> $GITHUB_ENV
@@ -3,11 +3,9 @@ name: "CodeQL"
 on:
  workflow_dispatch:
  push:
-    branches: ["preview", "master"]
+    branches: ["preview", "canary", "master"]
  pull_request:
-    branches: ["develop", "preview", "master"]
-  schedule:
-    - cron: "53 19 * * 5"
+    branches: ["preview", "canary", "master"]

 jobs:
  analyze:
@@ -3,11 +3,21 @@ name: Build and lint API
 on:
  workflow_dispatch:
  pull_request:
-    branches: ["preview"]
-    types: ["opened", "synchronize", "ready_for_review", "review_requested", "reopened"]
+    branches:
+      - "preview"
+    types:
+      - "opened"
+      - "synchronize"
+      - "ready_for_review"
+      - "review_requested"
+      - "reopened"
    paths:
      - "apps/api/**"

+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
  lint-api:
    name: Lint API
@@ -3,21 +3,18 @@ name: Build and lint web apps
 on:
  workflow_dispatch:
  pull_request:
-    branches: ["preview"]
+    branches:
+      - "preview"
    types:
-      [
-        "opened",
-        "synchronize",
-        "ready_for_review",
-        "review_requested",
-        "reopened",
-      ]
-    paths:
-      - "**.tsx?"
-      - "**.jsx?"
-      - "**.css"
-      - "**.json"
-      - "!apps/api/**"
+      - "opened"
+      - "synchronize"
+      - "ready_for_review"
+      - "review_requested"
+      - "reopened"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true

 jobs:
  build-and-lint:
@@ -27,16 +24,18 @@ jobs:
    if: |
      github.event.pull_request.draft == false &&
      github.event.pull_request.requested_reviewers != null
+    env:
+      TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha }}
+      TURBO_SCM_HEAD: ${{ github.sha }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
-          fetch-depth: 2
+          fetch-depth: 50
+          filter: blob:none

      - name: Set up Node.js
        uses: actions/setup-node@v4
-        with:
-          node-version-file: ".nvmrc"

      - name: Enable Corepack and pnpm
        run: corepack enable pnpm
@@ -44,11 +43,11 @@ jobs:
      - name: Install dependencies
        run: pnpm install --frozen-lockfile

-      - name: Lint web apps
-        run: pnpm run check:lint
+      - name: Lint Affected
+        run: pnpm turbo run check:lint --affected

-      - name: Check format
-        run: pnpm run check:format
+      - name: Check Affected format
+        run: pnpm turbo run check:format --affected

-      - name: Build apps
-        run: pnpm run build
+      - name: Build Affected
+        run: pnpm turbo run build --affected
@@ -97,3 +97,5 @@ dev-editor
 # Redis
 *.rdb
 *.rdb.gz
+
+storybook-static
@@ -14,13 +14,10 @@ strict-peer-dependencies=false
 # Turbo occasionally performs postinstall tasks for optimal performance
 # moved to pnpm-workspace.yaml: onlyBuiltDependencies (e.g., allow turbo)

-public-hoist-pattern[]=eslint
+public-hoist-pattern[]=*eslint*
 public-hoist-pattern[]=prettier
 public-hoist-pattern[]=typescript

-# Enforce Node version for consistent installs
-use-node-version=22.18.0
-
 # Reproducible installs across CI and dev
 prefer-frozen-lockfile=true

@@ -1 +0,0 @@
-lts/jod
@@ -0,0 +1,12 @@
+.next/*
+out/*
+public/*
+dist/*
+node_modules/*
+.turbo/*
+.env*
+.env
+.env.local
+.env.development
+.env.production
+.env.test
@@ -1,5 +1,4 @@
 module.exports = {
  root: true,
  extends: ["@plane/eslint-config/next.js"],
-  parser: "@typescript-eslint/parser",
 };
@@ -9,7 +9,7 @@ import { useInstance } from "@/hooks/store";
 // components
 import { InstanceEmailForm } from "./email-config-form";

-const InstanceEmailPage = observer(() => {
+const InstanceEmailPage: React.FC = observer(() => {
  // store
  const { fetchInstanceConfigurations, formattedConfig, disableEmail } = useInstance();

@@ -29,7 +29,7 @@ const InstanceEmailPage = observer(() => {
          message: "Email feature has been disabled",
          type: TOAST_TYPE.SUCCESS,
        });
-      } catch (error) {
+      } catch (_error) {
        setToast({
          title: "Error disabling email",
          message: "Failed to disable email feature. Please try again.",
@@ -7,7 +7,8 @@ import { ExternalLink, FileText, HelpCircle, MoveLeft } from "lucide-react";
 import { Transition } from "@headlessui/react";
 // plane internal packages
 import { WEB_BASE_URL } from "@plane/constants";
-import { DiscordIcon, GithubIcon, Tooltip } from "@plane/ui";
+import { DiscordIcon, GithubIcon } from "@plane/propel/icons";
+import { Tooltip } from "@plane/propel/tooltip";
 import { cn } from "@plane/utils";
 // hooks
 import { useTheme } from "@/hooks/store";
@@ -5,7 +5,8 @@ import Link from "next/link";
 import { usePathname } from "next/navigation";
 import { Image, BrainCog, Cog, Lock, Mail } from "lucide-react";
 // plane internal packages
-import { Tooltip, WorkspaceIcon } from "@plane/ui";
+import { WorkspaceIcon } from "@plane/propel/icons";
+import { Tooltip } from "@plane/propel/tooltip";
 import { cn } from "@plane/utils";
 // hooks
 import { useTheme } from "@/hooks/store";
@@ -1,7 +1,7 @@
 "use client";

 import Link from "next/link";
-import { PlaneLockup } from "@plane/ui";
+import { PlaneLockup } from "@plane/propel/icons";

 export const AuthHeader = () => (
  <div className="flex items-center justify-between gap-6 w-full flex-shrink-0 sticky top-0">
@@ -25,9 +25,8 @@ export const EmailCodesConfiguration: React.FC<Props> = observer((props) => {
    <ToggleSwitch
      value={Boolean(parseInt(enableMagicLogin))}
      onChange={() => {
-        Boolean(parseInt(enableMagicLogin)) === true
-          ? updateConfig("ENABLE_MAGIC_LINK_LOGIN", "0")
-          : updateConfig("ENABLE_MAGIC_LINK_LOGIN", "1");
+        const newEnableMagicLogin = Boolean(parseInt(enableMagicLogin)) === true ? "0" : "1";
+        updateConfig("ENABLE_MAGIC_LINK_LOGIN", newEnableMagicLogin);
      }}
      size="sm"
      disabled={disabled}
@@ -35,9 +35,8 @@ export const GithubConfiguration: React.FC<Props> = observer((props) => {
          <ToggleSwitch
            value={Boolean(parseInt(enableGithubConfig))}
            onChange={() => {
-              Boolean(parseInt(enableGithubConfig)) === true
-                ? updateConfig("IS_GITHUB_ENABLED", "0")
-                : updateConfig("IS_GITHUB_ENABLED", "1");
+              const newEnableGithubConfig = Boolean(parseInt(enableGithubConfig)) === true ? "0" : "1";
+              updateConfig("IS_GITHUB_ENABLED", newEnableGithubConfig);
            }}
            size="sm"
            disabled={disabled}
@@ -35,9 +35,8 @@ export const GitlabConfiguration: React.FC<Props> = observer((props) => {
          <ToggleSwitch
            value={Boolean(parseInt(enableGitlabConfig))}
            onChange={() => {
-              Boolean(parseInt(enableGitlabConfig)) === true
-                ? updateConfig("IS_GITLAB_ENABLED", "0")
-                : updateConfig("IS_GITLAB_ENABLED", "1");
+              const newEnableGitlabConfig = Boolean(parseInt(enableGitlabConfig)) === true ? "0" : "1";
+              updateConfig("IS_GITLAB_ENABLED", newEnableGitlabConfig);
            }}
            size="sm"
            disabled={disabled}
@@ -35,9 +35,8 @@ export const GoogleConfiguration: React.FC<Props> = observer((props) => {
          <ToggleSwitch
            value={Boolean(parseInt(enableGoogleConfig))}
            onChange={() => {
-              Boolean(parseInt(enableGoogleConfig)) === true
-                ? updateConfig("IS_GOOGLE_ENABLED", "0")
-                : updateConfig("IS_GOOGLE_ENABLED", "1");
+              const newEnableGoogleConfig = Boolean(parseInt(enableGoogleConfig)) === true ? "0" : "1";
+              updateConfig("IS_GOOGLE_ENABLED", newEnableGoogleConfig);
            }}
            size="sm"
            disabled={disabled}
@@ -25,9 +25,8 @@ export const PasswordLoginConfiguration: React.FC<Props> = observer((props) => {
    <ToggleSwitch
      value={Boolean(parseInt(enableEmailPassword))}
      onChange={() => {
-        Boolean(parseInt(enableEmailPassword)) === true
-          ? updateConfig("ENABLE_EMAIL_PASSWORD", "0")
-          : updateConfig("ENABLE_EMAIL_PASSWORD", "1");
+        const newEnableEmailPassword = Boolean(parseInt(enableEmailPassword)) === true ? "0" : "1";
+        updateConfig("ENABLE_EMAIL_PASSWORD", newEnableEmailPassword);
      }}
      size="sm"
      disabled={disabled}
@@ -1,7 +1,7 @@
 "use client";

 import Link from "next/link";
-import { Tooltip } from "@plane/ui";
+import { Tooltip } from "@plane/propel/tooltip";

 type Props = {
  label?: string;
@@ -2,7 +2,7 @@ import { observer } from "mobx-react";
 import { ExternalLink } from "lucide-react";
 // plane internal packages
 import { WEB_BASE_URL } from "@plane/constants";
-import { Tooltip } from "@plane/ui";
+import { Tooltip } from "@plane/propel/tooltip";
 import { getFileURL } from "@plane/utils";
 // hooks
 import { useWorkspace } from "@/hooks/store";
@@ -209,7 +209,7 @@ export class InstanceStore implements IInstanceStore {
        });
      });
      await this.instanceService.disableEmail();
-    } catch (error) {
+    } catch (_error) {
      console.error("Error disabling the email");
      this.instanceConfigurations = instanceConfigurations;
    }
@@ -1,7 +1,7 @@
 {
  "name": "admin",
  "description": "Admin UI for Plane",
-  "version": "0.28.0",
+  "version": "1.0.0",
  "license": "AGPL-3.0",
  "private": true,
  "scripts": {
@@ -26,30 +26,30 @@
    "@plane/ui": "workspace:*",
    "@plane/utils": "workspace:*",
    "autoprefixer": "10.4.14",
-    "axios": "1.11.0",
-    "lodash": "^4.17.21",
-    "lucide-react": "^0.469.0",
-    "mobx": "^6.12.0",
-    "mobx-react": "^9.1.1",
-    "next": "14.2.30",
+    "axios": "catalog:",
+    "lodash": "catalog:",
+    "lucide-react": "catalog:",
+    "mobx": "catalog:",
+    "mobx-react": "catalog:",
+    "next": "catalog:",
    "next-themes": "^0.2.1",
    "postcss": "^8.4.49",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
+    "react": "catalog:",
+    "react-dom": "catalog:",
    "react-hook-form": "7.51.5",
-    "sharp": "^0.33.5",
-    "swr": "^2.2.4",
-    "uuid": "^9.0.1"
+    "sharp": "catalog:",
+    "swr": "catalog:",
+    "uuid": "catalog:"
  },
  "devDependencies": {
    "@plane/eslint-config": "workspace:*",
    "@plane/tailwind-config": "workspace:*",
    "@plane/typescript-config": "workspace:*",
-    "@types/lodash": "^4.17.6",
+    "@types/lodash": "catalog:",
    "@types/node": "18.16.1",
-    "@types/react": "^18.3.11",
-    "@types/react-dom": "^18.2.18",
+    "@types/react": "catalog:",
+    "@types/react-dom": "catalog:",
    "@types/uuid": "^9.0.8",
-    "typescript": "5.8.3"
+    "typescript": "catalog:"
  }
 }
@@ -1,6 +1,6 @@
 {
  "name": "plane-api",
-  "version": "0.28.0",
+  "version": "1.0.0",
  "license": "AGPL-3.0",
  "private": true,
  "description": "API server powering Plane's backend"
@@ -91,6 +91,7 @@ class BaseSerializer(serializers.ModelSerializer):
                        "project_lead": UserLiteSerializer,
                        "state": StateLiteSerializer,
                        "created_by": UserLiteSerializer,
+                        "updated_by": UserLiteSerializer,
                        "issue": IssueSerializer,
                        "actor": UserLiteSerializer,
                        "owned_by": UserLiteSerializer,
@@ -24,7 +24,6 @@ from plane.db.models import (
 )
 from plane.utils.content_validator import (
    validate_html_content,
-    validate_json_content,
    validate_binary_data,
 )

@@ -89,20 +88,24 @@ class IssueSerializer(BaseSerializer):
            raise serializers.ValidationError("Invalid HTML passed")

        # Validate description content for security
-        if data.get("description"):
-            is_valid, error_msg = validate_json_content(data["description"])
-            if not is_valid:
-                raise serializers.ValidationError({"description": error_msg})
-
        if data.get("description_html"):
-            is_valid, error_msg = validate_html_content(data["description_html"])
+            is_valid, error_msg, sanitized_html = validate_html_content(
+                data["description_html"]
+            )
            if not is_valid:
-                raise serializers.ValidationError({"description_html": error_msg})
+                raise serializers.ValidationError(
+                    {"error": "html content is not valid"}
+                )
+            # Update the data with sanitized HTML if available
+            if sanitized_html is not None:
+                data["description_html"] = sanitized_html

        if data.get("description_binary"):
            is_valid, error_msg = validate_binary_data(data["description_binary"])
            if not is_valid:
-                raise serializers.ValidationError({"description_binary": error_msg})
+                raise serializers.ValidationError(
+                    {"description_binary": "Invalid binary data"}
+                )

        # Validate assignees are from project
        if data.get("assignees", []):
@@ -12,7 +12,6 @@ from plane.db.models import (

 from plane.utils.content_validator import (
    validate_html_content,
-    validate_json_content,
 )
 from .base import BaseSerializer

@@ -45,6 +44,10 @@ class ProjectCreateSerializer(BaseSerializer):
            "archive_in",
            "close_in",
            "timezone",
+            "logo_props",
+            "external_source",
+            "external_id",
+            "is_issue_type_enabled",
        ]

        read_only_fields = [
@@ -196,27 +199,18 @@ class ProjectSerializer(BaseSerializer):
            )

        # Validate description content for security
-        if "description" in data and data["description"]:
-            # For Project, description might be text field, not JSON
-            if isinstance(data["description"], dict):
-                is_valid, error_msg = validate_json_content(data["description"])
-                if not is_valid:
-                    raise serializers.ValidationError({"description": error_msg})
-
-        if "description_text" in data and data["description_text"]:
-            is_valid, error_msg = validate_json_content(data["description_text"])
-            if not is_valid:
-                raise serializers.ValidationError({"description_text": error_msg})
-
        if "description_html" in data and data["description_html"]:
            if isinstance(data["description_html"], dict):
-                is_valid, error_msg = validate_json_content(data["description_html"])
-            else:
-                is_valid, error_msg = validate_html_content(
+                is_valid, error_msg, sanitized_html = validate_html_content(
                    str(data["description_html"])
                )
+                # Update the data with sanitized HTML if available
+                if sanitized_html is not None:
+                    data["description_html"] = sanitized_html
            if not is_valid:
-                raise serializers.ValidationError({"description_html": error_msg})
+                raise serializers.ValidationError(
+                    {"error": "html content is not valid"}
+                )

        return data

@@ -4,7 +4,7 @@ from plane.api.views import ProjectMemberAPIEndpoint, WorkspaceMemberAPIEndpoint

 urlpatterns = [
    path(
-        "workspaces/<str:slug>/projects/<str:project_id>/members/",
+        "workspaces/<str:slug>/projects/<uuid:project_id>/members/",
        ProjectMemberAPIEndpoint.as_view(http_method_names=["get"]),
        name="project-members",
    ),
@@ -66,7 +66,7 @@ class IntakeIssueListCreateAPIEndpoint(BaseAPIView):
            workspace__slug=self.kwargs.get("slug"), pk=self.kwargs.get("project_id")
        )

-        if intake is None and not project.intake_view:
+        if intake is None or not project.intake_view:
            return IntakeIssue.objects.none()

        return (
@@ -230,7 +230,7 @@ class IntakeIssueDetailAPIEndpoint(BaseAPIView):
            workspace__slug=self.kwargs.get("slug"), pk=self.kwargs.get("project_id")
        )

-        if intake is None and not project.intake_view:
+        if intake is None or not project.intake_view:
            return IntakeIssue.objects.none()

        return (
@@ -13,3 +13,4 @@ from .project import (
    ProjectLitePermission,
 )
 from .base import allow_permission, ROLE
+from .page import ProjectPagePermission
@@ -39,13 +39,31 @@ def allow_permission(allowed_roles, level="PROJECT", creator=False, model=None):
                ).exists():
                    return view_func(instance, request, *args, **kwargs)
            else:
-                if ProjectMember.objects.filter(
+                is_user_has_allowed_role = ProjectMember.objects.filter(
                    member=request.user,
                    workspace__slug=kwargs["slug"],
                    project_id=kwargs["project_id"],
                    role__in=allowed_role_values,
                    is_active=True,
-                ).exists():
+                ).exists()
+
+                # Return if the user has the allowed role else if they are workspace admin and part of the project regardless of the role
+                if is_user_has_allowed_role:
+                    return view_func(instance, request, *args, **kwargs)
+                elif (
+                    ProjectMember.objects.filter(
+                        member=request.user,
+                        workspace__slug=kwargs["slug"],
+                        project_id=kwargs["project_id"],
+                        is_active=True,
+                    ).exists()
+                    and WorkspaceMember.objects.filter(
+                        member=request.user,
+                        workspace__slug=kwargs["slug"],
+                        role=ROLE.ADMIN.value,
+                        is_active=True,
+                    ).exists()
+                ):
                    return view_func(instance, request, *args, **kwargs)

            # Return permission denied if no conditions are met
@@ -0,0 +1,125 @@
+from plane.db.models import ProjectMember, Page
+from plane.app.permissions import ROLE
+
+
+from rest_framework.permissions import BasePermission, SAFE_METHODS
+
+
+# Permission Mappings for workspace members
+ADMIN = ROLE.ADMIN.value
+MEMBER = ROLE.MEMBER.value
+GUEST = ROLE.GUEST.value
+
+
+class ProjectPagePermission(BasePermission):
+    """
+    Custom permission to control access to pages within a workspace
+    based on user roles, page visibility (public/private), and feature flags.
+    """
+
+    def has_permission(self, request, view):
+        """
+        Check basic project-level permissions before checking object-level permissions.
+        """
+        if request.user.is_anonymous:
+            return False
+
+        user_id = request.user.id
+        slug = view.kwargs.get("slug")
+        page_id = view.kwargs.get("page_id")
+        project_id = view.kwargs.get("project_id")
+
+        # Hook for extended validation
+        extended_access, role = self._check_access_and_get_role(
+            request, slug, project_id
+        )
+        if extended_access is False:
+            return False
+
+        if page_id:
+            page = Page.objects.get(id=page_id, workspace__slug=slug)
+
+            # Allow access if the user is the owner of the page
+            if page.owned_by_id == user_id:
+                return True
+
+            # Handle private page access
+            if page.access == Page.PRIVATE_ACCESS:
+                return self._has_private_page_action_access(
+                    request, slug, page, project_id
+                )
+
+        # Handle public page access
+        return self._has_public_page_action_access(request, role)
+
+    def _check_project_member_access(self, request, slug, project_id):
+        """
+        Check if the user is a project member.
+        """
+        return (
+            ProjectMember.objects.filter(
+                member=request.user,
+                workspace__slug=slug,
+                is_active=True,
+                project_id=project_id,
+            )
+            .values_list("role", flat=True)
+            .first()
+        )
+
+    def _check_access_and_get_role(self, request, slug, project_id):
+        """
+        Hook for extended access checking
+        Returns: True (allow), False (deny), None (continue with normal flow)
+        """
+        role = self._check_project_member_access(request, slug, project_id)
+        if not role:
+            return False, None
+        return True, role
+
+    def _has_private_page_action_access(self, request, slug, page, project_id):
+        """
+        Check access to private pages. Override for feature flag logic.
+        """
+        # Base implementation: only owner can access private pages
+        return False
+
+    def _check_project_action_access(self, request, role):
+        method = request.method
+
+        # Only admins can create (POST) pages
+        if method == "POST":
+            if role in [ADMIN, MEMBER]:
+                return True
+            return False
+
+        # Safe methods (GET, HEAD, OPTIONS) allowed for all active roles
+        if method in SAFE_METHODS:
+            if role in [ADMIN, MEMBER, GUEST]:
+                return True
+            return False
+
+        # PUT/PATCH: Admins and members can update
+        if method in ["PUT", "PATCH"]:
+            if role in [ADMIN, MEMBER]:
+                return True
+            return False
+
+        # DELETE: Only admins can delete
+        if method == "DELETE":
+            if role in [ADMIN]:
+                return True
+            return False
+
+        # Deny by default
+        return False
+
+    def _has_public_page_action_access(self, request, role):
+        """
+        Check if the user has permission to access a public page
+        and can perform operations on the page.
+        """
+        project_member_exists = self._check_project_action_access(request, role)
+        if not project_member_exists:
+            return False
+        return True
@@ -3,11 +3,7 @@ from rest_framework.permissions import SAFE_METHODS, BasePermission

 # Module import
 from plane.db.models import ProjectMember, WorkspaceMember
-
-# Permission Mappings
-Admin = 20
-Member = 15
-Guest = 5
+from plane.db.models.project import ROLE


 class ProjectBasePermission(BasePermission):
@@ -26,18 +22,31 @@ class ProjectBasePermission(BasePermission):
            return WorkspaceMember.objects.filter(
                workspace__slug=view.workspace_slug,
                member=request.user,
-                role__in=[Admin, Member],
+                role__in=[ROLE.ADMIN.value, ROLE.MEMBER.value],
                is_active=True,
            ).exists()

-        ## Only Project Admins can update project attributes
-        return ProjectMember.objects.filter(
+        project_member_qs = ProjectMember.objects.filter(
            workspace__slug=view.workspace_slug,
            member=request.user,
-            role=Admin,
            project_id=view.project_id,
            is_active=True,
-        ).exists()
+        )
+
+        ## Only project admins or workspace admin who is part of the project can access
+
+        if project_member_qs.filter(role=ROLE.ADMIN.value).exists():
+            return True
+        else:
+            return (
+                project_member_qs.exists()
+                and WorkspaceMember.objects.filter(
+                    member=request.user,
+                    workspace__slug=view.workspace_slug,
+                    role=ROLE.ADMIN.value,
+                    is_active=True,
+                ).exists()
+            )


 class ProjectMemberPermission(BasePermission):
@@ -55,7 +64,7 @@ class ProjectMemberPermission(BasePermission):
            return WorkspaceMember.objects.filter(
                workspace__slug=view.workspace_slug,
                member=request.user,
-                role__in=[Admin, Member],
+                role__in=[ROLE.ADMIN.value, ROLE.MEMBER.value],
                is_active=True,
            ).exists()

@@ -63,7 +72,7 @@ class ProjectMemberPermission(BasePermission):
        return ProjectMember.objects.filter(
            workspace__slug=view.workspace_slug,
            member=request.user,
-            role__in=[Admin, Member],
+            role__in=[ROLE.ADMIN.value, ROLE.MEMBER.value],
            project_id=view.project_id,
            is_active=True,
        ).exists()
@@ -97,7 +106,7 @@ class ProjectEntityPermission(BasePermission):
        return ProjectMember.objects.filter(
            workspace__slug=view.workspace_slug,
            member=request.user,
-            role__in=[Admin, Member],
+            role__in=[ROLE.ADMIN.value, ROLE.MEMBER.value],
            project_id=view.project_id,
            is_active=True,
        ).exists()
@@ -92,8 +92,6 @@ from .importer import ImporterSerializer

 from .page import (
    PageSerializer,
-    PageLogSerializer,
-    SubPageSerializer,
    PageDetailSerializer,
    PageVersionSerializer,
    PageBinaryUpdateSerializer,
@@ -23,7 +23,6 @@ from plane.db.models import (
 )
 from plane.utils.content_validator import (
    validate_html_content,
-    validate_json_content,
    validate_binary_data,
 )
 from plane.app.permissions import ROLE
@@ -76,20 +75,24 @@ class DraftIssueCreateSerializer(BaseSerializer):
            raise serializers.ValidationError("Start date cannot exceed target date")

        # Validate description content for security
-        if "description" in attrs and attrs["description"]:
-            is_valid, error_msg = validate_json_content(attrs["description"])
-            if not is_valid:
-                raise serializers.ValidationError({"description": error_msg})
-
        if "description_html" in attrs and attrs["description_html"]:
-            is_valid, error_msg = validate_html_content(attrs["description_html"])
+            is_valid, error_msg, sanitized_html = validate_html_content(
+                attrs["description_html"]
+            )
            if not is_valid:
-                raise serializers.ValidationError({"description_html": error_msg})
+                raise serializers.ValidationError(
+                    {"error": "html content is not valid"}
+                )
+            # Update the attrs with sanitized HTML if available
+            if sanitized_html is not None:
+                attrs["description_html"] = sanitized_html

        if "description_binary" in attrs and attrs["description_binary"]:
            is_valid, error_msg = validate_binary_data(attrs["description_binary"])
            if not is_valid:
-                raise serializers.ValidationError({"description_binary": error_msg})
+                raise serializers.ValidationError(
+                    {"description_binary": "Invalid binary data"}
+                )

        # Validate assignees are from project
        if attrs.get("assignee_ids", []):
@@ -43,7 +43,6 @@ from plane.db.models import (
 )
 from plane.utils.content_validator import (
    validate_html_content,
-    validate_json_content,
    validate_binary_data,
 )

@@ -128,20 +127,24 @@ class IssueCreateSerializer(BaseSerializer):
            raise serializers.ValidationError("Start date cannot exceed target date")

        # Validate description content for security
-        if "description" in attrs and attrs["description"]:
-            is_valid, error_msg = validate_json_content(attrs["description"])
-            if not is_valid:
-                raise serializers.ValidationError({"description": error_msg})
-
        if "description_html" in attrs and attrs["description_html"]:
-            is_valid, error_msg = validate_html_content(attrs["description_html"])
+            is_valid, error_msg, sanitized_html = validate_html_content(
+                attrs["description_html"]
+            )
            if not is_valid:
-                raise serializers.ValidationError({"description_html": error_msg})
+                raise serializers.ValidationError(
+                    {"error": "html content is not valid"}
+                )
+            # Update the attrs with sanitized HTML if available
+            if sanitized_html is not None:
+                attrs["description_html"] = sanitized_html

        if "description_binary" in attrs and attrs["description_binary"]:
            is_valid, error_msg = validate_binary_data(attrs["description_binary"])
            if not is_valid:
-                raise serializers.ValidationError({"description_binary": error_msg})
+                raise serializers.ValidationError(
+                    {"description_binary": "Invalid binary data"}
+                )

        # Validate assignees are from project
        if attrs.get("assignee_ids", []):
@@ -664,16 +667,33 @@ class IssueReactionSerializer(BaseSerializer):


 class IssueReactionLiteSerializer(DynamicBaseSerializer):
+    display_name = serializers.CharField(source="actor.display_name", read_only=True)
+
    class Meta:
        model = IssueReaction
-        fields = ["id", "actor", "issue", "reaction"]
+        fields = ["id", "actor", "issue", "reaction", "display_name"]


 class CommentReactionSerializer(BaseSerializer):
+    display_name = serializers.CharField(source="actor.display_name", read_only=True)
+
    class Meta:
        model = CommentReaction
-        fields = "__all__"
-        read_only_fields = ["workspace", "project", "comment", "actor", "deleted_at"]
+        fields = [
+            "id",
+            "actor",
+            "comment",
+            "reaction",
+            "display_name",
+            "deleted_at",
+            "workspace",
+            "project",
+            "created_at",
+            "updated_at",
+            "created_by",
+            "updated_by",
+        ]
+        read_only_fields = ["workspace", "project", "comment", "actor", "deleted_at", "created_by", "updated_by"]


 class IssueVoteSerializer(BaseSerializer):
@@ -908,9 +928,14 @@ class IssueLiteSerializer(DynamicBaseSerializer):
 class IssueDetailSerializer(IssueSerializer):
    description_html = serializers.CharField()
    is_subscribed = serializers.BooleanField(read_only=True)
+    is_intake = serializers.BooleanField(read_only=True)

    class Meta(IssueSerializer.Meta):
-        fields = IssueSerializer.Meta.fields + ["description_html", "is_subscribed"]
+        fields = IssueSerializer.Meta.fields + [
+            "description_html",
+            "is_subscribed",
+            "is_intake",
+        ]
        read_only_fields = fields


@@ -7,7 +7,6 @@ from .base import BaseSerializer
 from plane.utils.content_validator import (
    validate_binary_data,
    validate_html_content,
-    validate_json_content,
 )
 from plane.db.models import (
    Page,
@@ -131,32 +130,6 @@ class PageDetailSerializer(PageSerializer):
        fields = PageSerializer.Meta.fields + ["description_html"]


-class SubPageSerializer(BaseSerializer):
-    entity_details = serializers.SerializerMethodField()
-
-    class Meta:
-        model = PageLog
-        fields = "__all__"
-        read_only_fields = ["workspace", "page"]
-
-    def get_entity_details(self, obj):
-        entity_name = obj.entity_name
-        if entity_name == "forward_link" or entity_name == "back_link":
-            try:
-                page = Page.objects.get(pk=obj.entity_identifier)
-                return PageSerializer(page).data
-            except Page.DoesNotExist:
-                return None
-        return None
-
-
-class PageLogSerializer(BaseSerializer):
-    class Meta:
-        model = PageLog
-        fields = "__all__"
-        read_only_fields = ["workspace", "page"]
-
-
 class PageVersionSerializer(BaseSerializer):
    class Meta:
        model = PageVersion
@@ -229,23 +202,13 @@ class PageBinaryUpdateSerializer(serializers.Serializer):
            return value

        # Use the validation function from utils
-        is_valid, error_message = validate_html_content(value)
+        is_valid, error_message, sanitized_html = validate_html_content(value)
        if not is_valid:
            raise serializers.ValidationError(error_message)

-        return value
+        # Return sanitized HTML if available, otherwise return original
+        return sanitized_html if sanitized_html is not None else value

-    def validate_description(self, value):
-        """Validate the JSON description"""
-        if not value:
-            return value
-
-        # Use the validation function from utils
-        is_valid, error_message = validate_json_content(value)
-        if not is_valid:
-            raise serializers.ValidationError(error_message)
-
-        return value

    def update(self, instance, validated_data):
        """Update the page instance with validated data"""
@@ -15,8 +15,6 @@ from plane.db.models import (
 )
 from plane.utils.content_validator import (
    validate_html_content,
-    validate_json_content,
-    validate_binary_data,
 )


@@ -65,27 +63,18 @@ class ProjectSerializer(BaseSerializer):

    def validate(self, data):
        # Validate description content for security
-        if "description" in data and data["description"]:
-            # For Project, description might be text field, not JSON
-            if isinstance(data["description"], dict):
-                is_valid, error_msg = validate_json_content(data["description"])
-                if not is_valid:
-                    raise serializers.ValidationError({"description": error_msg})
-
-        if "description_text" in data and data["description_text"]:
-            is_valid, error_msg = validate_json_content(data["description_text"])
-            if not is_valid:
-                raise serializers.ValidationError({"description_text": error_msg})
-
        if "description_html" in data and data["description_html"]:
-            if isinstance(data["description_html"], dict):
-                is_valid, error_msg = validate_json_content(data["description_html"])
-            else:
-                is_valid, error_msg = validate_html_content(
-                    str(data["description_html"])
-                )
+            is_valid, error_msg, sanitized_html = validate_html_content(
+                str(data["description_html"])
+            )
+            # Update the data with sanitized HTML if available
+            if sanitized_html is not None:
+                data["description_html"] = sanitized_html
+
            if not is_valid:
-                raise serializers.ValidationError({"description_html": error_msg})
+                raise serializers.ValidationError(
+                    {"error": "html content is not valid"}
+                )

        return data

@@ -7,31 +7,16 @@ from plane.utils.url import contains_url

 from .base import BaseSerializer

-# Django import
-import re
-

 class UserSerializer(BaseSerializer):
    def validate_first_name(self, value):
        if contains_url(value):
            raise serializers.ValidationError("First name cannot contain a URL.")
-
-        if not re.match(r"^[a-zA-Z0-9_\- ]+$", value):
-            raise serializers.ValidationError(
-                "first name can only contain letters, numbers, hyphens (-), and underscores (_)"
-            )
-
        return value

    def validate_last_name(self, value):
        if contains_url(value):
            raise serializers.ValidationError("Last name cannot contain a URL.")
-
-        if not re.match(r"^[a-zA-Z0-9_\- ]+$", value) and not value == "":
-            raise serializers.ValidationError(
-                "last name can only contain letters, numbers, hyphens (-), and underscores (_)"
-            )
-
        return value

    class Meta:
@@ -26,7 +26,6 @@ from plane.utils.constants import RESTRICTED_WORKSPACE_SLUGS
 from plane.utils.url import contains_url
 from plane.utils.content_validator import (
    validate_html_content,
-    validate_json_content,
    validate_binary_data,
 )

@@ -319,20 +318,24 @@ class StickySerializer(BaseSerializer):

    def validate(self, data):
        # Validate description content for security
-        if "description" in data and data["description"]:
-            is_valid, error_msg = validate_json_content(data["description"])
-            if not is_valid:
-                raise serializers.ValidationError({"description": error_msg})
-
        if "description_html" in data and data["description_html"]:
-            is_valid, error_msg = validate_html_content(data["description_html"])
+            is_valid, error_msg, sanitized_html = validate_html_content(
+                data["description_html"]
+            )
            if not is_valid:
-                raise serializers.ValidationError({"description_html": error_msg})
+                raise serializers.ValidationError(
+                    {"error": "html content is not valid"}
+                )
+            # Update the data with sanitized HTML if available
+            if sanitized_html is not None:
+                data["description_html"] = sanitized_html

        if "description_binary" in data and data["description_binary"]:
            is_valid, error_msg = validate_binary_data(data["description_binary"])
            if not is_valid:
-                raise serializers.ValidationError({"description_binary": error_msg})
+                raise serializers.ValidationError(
+                    {"description_binary": "Invalid binary data"}
+                )

        return data

@@ -4,22 +4,24 @@ from django.urls import path
 from plane.app.views import (
    PageViewSet,
    PageFavoriteViewSet,
-    PageLogEndpoint,
-    SubPagesEndpoint,
    PagesDescriptionViewSet,
    PageVersionEndpoint,
    PageDuplicateEndpoint,
 )

-
 urlpatterns = [
+    path(
+        "workspaces/<str:slug>/projects/<uuid:project_id>/pages-summary/",
+        PageViewSet.as_view({"get": "summary"}),
+        name="project-pages-summary",
+    ),
    path(
        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/",
        PageViewSet.as_view({"get": "list", "post": "create"}),
        name="project-pages",
    ),
    path(
-        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:pk>/",
+        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:page_id>/",
        PageViewSet.as_view(
            {"get": "retrieve", "patch": "partial_update", "delete": "destroy"}
        ),
@@ -27,45 +29,30 @@ urlpatterns = [
    ),
    # favorite pages
    path(
-        "workspaces/<str:slug>/projects/<uuid:project_id>/favorite-pages/<uuid:pk>/",
+        "workspaces/<str:slug>/projects/<uuid:project_id>/favorite-pages/<uuid:page_id>/",
        PageFavoriteViewSet.as_view({"post": "create", "delete": "destroy"}),
        name="user-favorite-pages",
    ),
    # archived pages
    path(
-        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:pk>/archive/",
+        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:page_id>/archive/",
        PageViewSet.as_view({"post": "archive", "delete": "unarchive"}),
        name="project-page-archive-unarchive",
    ),
    # lock and unlock
    path(
-        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:pk>/lock/",
+        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:page_id>/lock/",
        PageViewSet.as_view({"post": "lock", "delete": "unlock"}),
        name="project-pages-lock-unlock",
    ),
    # private and public page
    path(
-        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:pk>/access/",
+        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:page_id>/access/",
        PageViewSet.as_view({"post": "access"}),
        name="project-pages-access",
    ),
    path(
-        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:pk>/transactions/",
-        PageLogEndpoint.as_view(),
-        name="page-transactions",
-    ),
-    path(
-        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:pk>/transactions/<uuid:transaction>/",
-        PageLogEndpoint.as_view(),
-        name="page-transactions",
-    ),
-    path(
-        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:pk>/sub-pages/",
-        SubPagesEndpoint.as_view(),
-        name="sub-page",
-    ),
-    path(
-        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:pk>/description/",
+        "workspaces/<str:slug>/projects/<uuid:project_id>/pages/<uuid:page_id>/description/",
        PagesDescriptionViewSet.as_view({"get": "retrieve", "patch": "partial_update"}),
        name="page-description",
    ),
@@ -165,8 +165,6 @@ from .api import ApiTokenEndpoint, ServiceApiTokenEndpoint
 from .page.base import (
    PageViewSet,
    PageFavoriteViewSet,
-    PageLogEndpoint,
-    SubPagesEndpoint,
    PagesDescriptionViewSet,
    PageDuplicateEndpoint,
 )
@@ -441,7 +441,11 @@ class WorkspaceFileAssetEndpoint(BaseAPIView):
        # Get the presigned URL
        storage = S3Storage(request=request)
        # Generate a presigned URL to share an S3 object
-        signed_url = storage.generate_presigned_url(object_name=asset.asset.name)
+        signed_url = storage.generate_presigned_url(
+            object_name=asset.asset.name,
+            disposition="attachment",
+            filename=asset.attributes.get("name"),
+        )
        # Redirect to the signed URL
        return HttpResponseRedirect(signed_url)

@@ -641,7 +645,11 @@ class ProjectAssetEndpoint(BaseAPIView):
        # Get the presigned URL
        storage = S3Storage(request=request)
        # Generate a presigned URL to share an S3 object
-        signed_url = storage.generate_presigned_url(object_name=asset.asset.name)
+        signed_url = storage.generate_presigned_url(
+            object_name=asset.asset.name,
+            disposition="attachment",
+            filename=asset.attributes.get("name"),
+        )
        # Redirect to the signed URL
        return HttpResponseRedirect(signed_url)

@@ -504,19 +504,6 @@ class CycleViewSet(BaseViewSet):
    @allow_permission([ROLE.ADMIN], creator=True, model=Cycle)
    def destroy(self, request, slug, project_id, pk):
        cycle = Cycle.objects.get(workspace__slug=slug, project_id=project_id, pk=pk)
-        if cycle.owned_by_id != request.user.id and not (
-            ProjectMember.objects.filter(
-                workspace__slug=slug,
-                member=request.user,
-                role=20,
-                project_id=project_id,
-                is_active=True,
-            ).exists()
-        ):
-            return Response(
-                {"error": "Only admin or owner can delete the cycle"},
-                status=status.HTTP_403_FORBIDDEN,
-            )

        cycle_issues = list(
            CycleIssue.objects.filter(cycle_id=self.kwargs.get("pk")).values_list(
@@ -1093,6 +1080,9 @@ class CycleUserPropertiesEndpoint(BaseAPIView):
        )

        cycle_properties.filters = request.data.get("filters", cycle_properties.filters)
+        cycle_properties.rich_filters = request.data.get(
+            "rich_filters", cycle_properties.rich_filters
+        )
        cycle_properties.display_filters = request.data.get(
            "display_filters", cycle_properties.display_filters
        )
@@ -1,4 +1,5 @@
 # Python imports
+import copy
 import json

 # Django imports
@@ -28,11 +29,15 @@ from plane.utils.order_queryset import order_issue_queryset
 from plane.utils.paginator import GroupedOffsetPaginator, SubGroupedOffsetPaginator
 from plane.app.permissions import allow_permission, ROLE
 from plane.utils.host import base_host
+from plane.utils.filters import ComplexFilterBackend
+from plane.utils.filters import IssueFilterSet


 class CycleIssueViewSet(BaseViewSet):
    serializer_class = CycleIssueSerializer
    model = CycleIssue
+    filter_backends = (ComplexFilterBackend,)
+    filterset_class = IssueFilterSet

    webhook_event = "cycle_issue"
    bulk = True
@@ -65,24 +70,9 @@ class CycleIssueViewSet(BaseViewSet):
            .distinct()
        )

-    @method_decorator(gzip_page)
-    @allow_permission([ROLE.ADMIN, ROLE.MEMBER])
-    def list(self, request, slug, project_id, cycle_id):
-        order_by_param = request.GET.get("order_by", "created_at")
-        filters = issue_filters(request.query_params, "GET")
-        issue_queryset = (
-            Issue.issue_objects.filter(
-                issue_cycle__cycle_id=cycle_id, issue_cycle__deleted_at__isnull=True
-            )
-            .filter(project_id=project_id)
-            .filter(workspace__slug=slug)
-            .filter(**filters)
-            .select_related("workspace", "project", "state", "parent")
-            .prefetch_related(
-                "assignees", "labels", "issue_module__module", "issue_cycle__cycle"
-            )
-            .filter(**filters)
-            .annotate(
+    def apply_annotations(self, issues):
+        return (
+            issues.annotate(
                cycle_id=Subquery(
                    CycleIssue.objects.filter(
                        issue=OuterRef("id"), deleted_at__isnull=True
@@ -110,11 +100,36 @@ class CycleIssueViewSet(BaseViewSet):
                .annotate(count=Func(F("id"), function="Count"))
                .values("count")
            )
+            .prefetch_related(
+                "assignees", "labels", "issue_module__module", "issue_cycle__cycle"
+            )
        )
+
+    @method_decorator(gzip_page)
+    @allow_permission([ROLE.ADMIN, ROLE.MEMBER])
+    def list(self, request, slug, project_id, cycle_id):
        filters = issue_filters(request.query_params, "GET")
+        issue_queryset = (
+            Issue.issue_objects.filter(
+                issue_cycle__cycle_id=cycle_id, issue_cycle__deleted_at__isnull=True
+            )
+            .filter(project_id=project_id)
+            .filter(workspace__slug=slug)
+        )
+
+        # Apply filtering from filterset
+        issue_queryset = self.filter_queryset(issue_queryset)
+
+        # Apply legacy filters
+        issue_queryset = issue_queryset.filter(**filters)
+
+        # Total count queryset
+        total_issue_queryset = copy.deepcopy(issue_queryset)
+
+        # Applying annotations to the issue queryset
+        issue_queryset = self.apply_annotations(issue_queryset)

        order_by_param = request.GET.get("order_by", "-created_at")
-        issue_queryset = issue_queryset.filter(**filters)
        # Issue queryset
        issue_queryset, order_by_param = order_issue_queryset(
            issue_queryset=issue_queryset, order_by_param=order_by_param
@@ -145,6 +160,7 @@ class CycleIssueViewSet(BaseViewSet):
                        request=request,
                        order_by=order_by_param,
                        queryset=issue_queryset,
+                        total_count_queryset=total_issue_queryset,
                        on_results=lambda issues: issue_on_results(
                            group_by=group_by, issues=issues, sub_group_by=sub_group_by
                        ),
@@ -179,6 +195,7 @@ class CycleIssueViewSet(BaseViewSet):
                    request=request,
                    order_by=order_by_param,
                    queryset=issue_queryset,
+                    total_count_queryset=total_issue_queryset,
                    on_results=lambda issues: issue_on_results(
                        group_by=group_by, issues=issues, sub_group_by=sub_group_by
                    ),
@@ -205,6 +222,7 @@ class CycleIssueViewSet(BaseViewSet):
                order_by=order_by_param,
                request=request,
                queryset=issue_queryset,
+                total_count_queryset=total_issue_queryset,
                on_results=lambda issues: issue_on_results(
                    group_by=group_by, issues=issues, sub_group_by=sub_group_by
                ),
@@ -28,6 +28,7 @@ from plane.db.models import (
    ProjectMember,
    CycleIssue,
    IssueDescriptionVersion,
+    WorkspaceMember,
 )
 from plane.app.serializers import (
    IssueCreateSerializer,
@@ -348,17 +349,32 @@ class IntakeIssueViewSet(BaseViewSet):
            project_id=project_id,
            intake_id=intake_id,
        )
-        # Get the project member
-        project_member = ProjectMember.objects.get(
+
+        project_member = ProjectMember.objects.filter(
            workspace__slug=slug,
            project_id=project_id,
            member=request.user,
            is_active=True,
-        )
+        ).first()
+
+        is_workspace_admin = WorkspaceMember.objects.filter(
+            workspace__slug=slug,
+            is_active=True,
+            member=request.user,
+            role=ROLE.ADMIN.value,
+        ).exists()
+
+        if not project_member and not is_workspace_admin:
+            return Response(
+                {"error": "Only admin or creator can update the intake work items"},
+                status=status.HTTP_403_FORBIDDEN,
+            )
+
        # Only project members admins and created_by users can access this endpoint
-        if project_member.role <= 5 and str(intake_issue.created_by_id) != str(
-            request.user.id
-        ):
+        if (
+            (project_member and project_member.role <= ROLE.GUEST.value)
+            and not is_workspace_admin
+        ) and str(intake_issue.created_by_id) != str(request.user.id):
            return Response(
                {"error": "You cannot edit intake issues"},
                status=status.HTTP_400_BAD_REQUEST,
@@ -391,8 +407,8 @@ class IntakeIssueViewSet(BaseViewSet):
                    Value([], output_field=ArrayField(UUIDField())),
                ),
            ).get(pk=intake_issue.issue_id, workspace__slug=slug, project_id=project_id)
-            # Only allow guests to edit name and description
-            if project_member.role <= 5:
+
+            if project_member and project_member.role <= ROLE.GUEST.value:
                issue_data = {
                    "name": issue_data.get("name", issue.name),
                    "description_html": issue_data.get(
@@ -400,6 +416,7 @@ class IntakeIssueViewSet(BaseViewSet):
                    ),
                    "description": issue_data.get("description", issue.description),
                }
+
            current_instance = json.dumps(
                IssueDetailSerializer(issue).data, cls=DjangoJSONEncoder
            )
@@ -436,8 +453,10 @@ class IntakeIssueViewSet(BaseViewSet):
                    issue_serializer.errors, status=status.HTTP_400_BAD_REQUEST
                )

-        # Only project admins and members can edit intake issue attributes
-        if project_member.role > 15:
+        # Only project admins can edit intake issue attributes
+        if (
+            project_member and project_member.role > ROLE.MEMBER.value
+        ) or is_workspace_admin:
            serializer = IntakeIssueSerializer(
                intake_issue, data=request.data, partial=True
            )
@@ -1,4 +1,5 @@
 # Python imports
+import copy
 import json

 # Django imports
@@ -41,27 +42,20 @@ from plane.utils.host import base_host

 # Module imports
 from .. import BaseViewSet, BaseAPIView
+from plane.utils.filters import ComplexFilterBackend
+from plane.utils.filters import IssueFilterSet


 class IssueArchiveViewSet(BaseViewSet):
    serializer_class = IssueFlatSerializer
    model = Issue

-    def get_queryset(self):
+    filter_backends = (ComplexFilterBackend,)
+    filterset_class = IssueFilterSet
+
+    def apply_annotations(self, issues):
        return (
-            Issue.objects.annotate(
-                sub_issues_count=Issue.objects.filter(parent=OuterRef("id"))
-                .order_by()
-                .annotate(count=Func(F("id"), function="Count"))
-                .values("count")
-            )
-            .filter(deleted_at__isnull=True)
-            .filter(archived_at__isnull=False)
-            .filter(project_id=self.kwargs.get("project_id"))
-            .filter(workspace__slug=self.kwargs.get("slug"))
-            .select_related("workspace", "project", "state", "parent")
-            .prefetch_related("assignees", "labels", "issue_module__module")
-            .annotate(
+            issues.annotate(
                cycle_id=Subquery(
                    CycleIssue.objects.filter(
                        issue=OuterRef("id"), deleted_at__isnull=True
@@ -95,6 +89,15 @@ class IssueArchiveViewSet(BaseViewSet):
                    .values("count")
                )
            )
+            .prefetch_related("assignees", "labels", "issue_module__module")
+        )
+
+    def get_queryset(self):
+        return (
+            Issue.objects.filter(Q(type__isnull=True) | Q(type__is_epic=False))
+            .filter(archived_at__isnull=False)
+            .filter(project_id=self.kwargs.get("project_id"))
+            .filter(workspace__slug=self.kwargs.get("slug"))
        )

    @method_decorator(gzip_page)
@@ -105,26 +108,25 @@ class IssueArchiveViewSet(BaseViewSet):

        order_by_param = request.GET.get("order_by", "-created_at")

-        issue_queryset = self.get_queryset().filter(**filters)
-
-        total_issue_queryset = Issue.objects.filter(
-            deleted_at__isnull=True,
-            archived_at__isnull=False,
-            project_id=project_id,
-            workspace__slug=slug,
-        ).filter(**filters)
-
-        total_issue_queryset = (
-            total_issue_queryset
-            if show_sub_issues == "true"
-            else total_issue_queryset.filter(parent__isnull=True)
-        )
+        issue_queryset = self.get_queryset()

        issue_queryset = (
            issue_queryset
            if show_sub_issues == "true"
            else issue_queryset.filter(parent__isnull=True)
        )
+        # Apply filtering from filterset
+        issue_queryset = self.filter_queryset(issue_queryset)
+
+        # Apply legacy filters
+        issue_queryset = issue_queryset.filter(**filters)
+
+        # Total count queryset
+        total_issue_queryset = copy.deepcopy(issue_queryset)
+
+        # Applying annotations to the issue queryset
+        issue_queryset = self.apply_annotations(issue_queryset)
+
        # Issue queryset
        issue_queryset, order_by_param = order_issue_queryset(
            issue_queryset=issue_queryset, order_by_param=order_by_param
@@ -1,4 +1,5 @@
 # Python imports
+import copy
 import json

 # Django imports
@@ -6,16 +7,16 @@ from django.contrib.postgres.aggregates import ArrayAgg
 from django.contrib.postgres.fields import ArrayField
 from django.core.serializers.json import DjangoJSONEncoder
 from django.db.models import (
+    Count,
    Exists,
    F,
    Func,
    OuterRef,
    Prefetch,
    Q,
+    Subquery,
    UUIDField,
    Value,
-    Subquery,
-    Count,
 )
 from django.db.models.functions import Coalesce
 from django.utils import timezone
@@ -27,49 +28,55 @@ from rest_framework import status
 from rest_framework.response import Response

 # Module imports
-from plane.app.permissions import allow_permission, ROLE
+from plane.app.permissions import ROLE, allow_permission
 from plane.app.serializers import (
    IssueCreateSerializer,
    IssueDetailSerializer,
-    IssueUserPropertySerializer,
-    IssueSerializer,
    IssueListDetailSerializer,
+    IssueSerializer,
+    IssueUserPropertySerializer,
 )
 from plane.bgtasks.issue_activities_task import issue_activity
+from plane.bgtasks.issue_description_version_task import issue_description_version_task
+from plane.bgtasks.recent_visited_task import recent_visited_task
+from plane.bgtasks.webhook_task import model_activity
 from plane.db.models import (
-    Issue,
-    FileAsset,
-    IssueLink,
-    IssueUserProperty,
-    IssueReaction,
-    IssueSubscriber,
-    Project,
-    ProjectMember,
    CycleIssue,
-    UserRecentVisit,
-    ModuleIssue,
-    IssueRelation,
+    FileAsset,
+    IntakeIssue,
+    Issue,
    IssueAssignee,
    IssueLabel,
+    IssueLink,
+    IssueReaction,
+    IssueRelation,
+    IssueSubscriber,
+    IssueUserProperty,
+    ModuleIssue,
+    Project,
+    ProjectMember,
+    UserRecentVisit,
 )
+from plane.utils.filters import ComplexFilterBackend, IssueFilterSet
+from plane.utils.global_paginator import paginate
 from plane.utils.grouper import (
    issue_group_values,
    issue_on_results,
    issue_queryset_grouper,
 )
+from plane.utils.host import base_host
 from plane.utils.issue_filters import issue_filters
 from plane.utils.order_queryset import order_issue_queryset
 from plane.utils.paginator import GroupedOffsetPaginator, SubGroupedOffsetPaginator
-from .. import BaseAPIView, BaseViewSet
 from plane.utils.timezone_converter import user_timezone_converter
-from plane.bgtasks.recent_visited_task import recent_visited_task
-from plane.utils.global_paginator import paginate
-from plane.bgtasks.webhook_task import model_activity
-from plane.bgtasks.issue_description_version_task import issue_description_version_task
-from plane.utils.host import base_host
+
+from .. import BaseAPIView, BaseViewSet


 class IssueListEndpoint(BaseAPIView):
+    filter_backends = (ComplexFilterBackend,)
+    filterset_class = IssueFilterSet
+
    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
    def get(self, request, slug, project_id):
        issue_ids = request.GET.get("issues", False)
@@ -81,14 +88,27 @@ class IssueListEndpoint(BaseAPIView):

        issue_ids = [issue_id for issue_id in issue_ids.split(",") if issue_id != ""]

-        queryset = (
-            Issue.issue_objects.filter(
-                workspace__slug=slug, project_id=project_id, pk__in=issue_ids
-            )
-            .filter(workspace__slug=self.kwargs.get("slug"))
-            .select_related("workspace", "project", "state", "parent")
-            .prefetch_related("assignees", "labels", "issue_module__module")
-            .annotate(
+        # Base queryset with basic filters
+        queryset = Issue.issue_objects.filter(
+            workspace__slug=slug, project_id=project_id, pk__in=issue_ids
+        )
+
+        # Apply filtering from filterset
+        queryset = self.filter_queryset(queryset)
+
+        # Apply legacy filters
+        filters = issue_filters(request.query_params, "GET")
+        issue_queryset = queryset.filter(**filters)
+
+        # Add select_related, prefetch_related if fields or expand is not None
+        if self.fields or self.expand:
+            issue_queryset = issue_queryset.select_related(
+                "workspace", "project", "state", "parent"
+            ).prefetch_related("assignees", "labels", "issue_module__module")
+
+        # Add annotations
+        issue_queryset = (
+            issue_queryset.annotate(
                cycle_id=Subquery(
                    CycleIssue.objects.filter(
                        issue=OuterRef("id"), deleted_at__isnull=True
@@ -116,12 +136,10 @@ class IssueListEndpoint(BaseAPIView):
                .annotate(count=Func(F("id"), function="Count"))
                .values("count")
            )
-        ).distinct()
-
-        filters = issue_filters(request.query_params, "GET")
+            .distinct()
+        )

        order_by_param = request.GET.get("order_by", "-created_at")
-        issue_queryset = queryset.filter(**filters)
        # Issue queryset
        issue_queryset, _ = order_issue_queryset(
            issue_queryset=issue_queryset, order_by_param=order_by_param
@@ -185,6 +203,12 @@ class IssueListEndpoint(BaseAPIView):


 class IssueViewSet(BaseViewSet):
+    model = Issue
+    webhook_event = "issue"
+    search_fields = ["name"]
+    filter_backends = (ComplexFilterBackend,)
+    filterset_class = IssueFilterSet
+
    def get_serializer_class(self):
        return (
            IssueCreateSerializer
@@ -192,20 +216,17 @@ class IssueViewSet(BaseViewSet):
            else IssueSerializer
        )

-    model = Issue
-    webhook_event = "issue"
-
-    search_fields = ["name"]
-
-    filterset_fields = ["state__name", "assignees__id", "workspace__id"]
-
    def get_queryset(self):
-        return (
-            Issue.issue_objects.filter(project_id=self.kwargs.get("project_id"))
-            .filter(workspace__slug=self.kwargs.get("slug"))
-            .select_related("workspace", "project", "state", "parent")
-            .prefetch_related("assignees", "labels", "issue_module__module")
-            .annotate(
+        issues = Issue.issue_objects.filter(
+            project_id=self.kwargs.get("project_id"),
+            workspace__slug=self.kwargs.get("slug"),
+        ).distinct()
+
+        return issues
+
+    def apply_annotations(self, issues):
+        issues = (
+            issues.annotate(
                cycle_id=Subquery(
                    CycleIssue.objects.filter(
                        issue=OuterRef("id"), deleted_at__isnull=True
@@ -241,6 +262,8 @@ class IssueViewSet(BaseViewSet):
            )
        )

+        return issues
+
    @method_decorator(gzip_page)
    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
    def list(self, request, slug, project_id):
@@ -249,15 +272,24 @@ class IssueViewSet(BaseViewSet):
            extra_filters = {"updated_at__gt": request.GET.get("updated_at__gt")}

        project = Project.objects.get(pk=project_id, workspace__slug=slug)
-        filters = issue_filters(request.query_params, "GET")
+        query_params = request.query_params.copy()
+
+        filters = issue_filters(query_params, "GET")
        order_by_param = request.GET.get("order_by", "-created_at")

-        issue_queryset = self.get_queryset().filter(**filters, **extra_filters)
-        # Custom ordering for priority and state
+        issue_queryset = self.get_queryset()

-        total_issue_queryset = Issue.issue_objects.filter(
-            project_id=project_id, workspace__slug=slug
-        ).filter(**filters, **extra_filters)
+        # Apply rich filters
+        issue_queryset = self.filter_queryset(issue_queryset)
+
+        # Apply legacy filters
+        issue_queryset = issue_queryset.filter(**filters, **extra_filters)
+
+        # Keeping a copy of the queryset before applying annotations
+        filtered_issue_queryset = copy.deepcopy(issue_queryset)
+
+        # Applying annotations to the issue queryset
+        issue_queryset = self.apply_annotations(issue_queryset)

        # Issue queryset
        issue_queryset, order_by_param = order_issue_queryset(
@@ -291,14 +323,16 @@ class IssueViewSet(BaseViewSet):
            and not project.guest_view_all_features
        ):
            issue_queryset = issue_queryset.filter(created_by=request.user)
-            total_issue_queryset = total_issue_queryset.filter(created_by=request.user)
+            filtered_issue_queryset = filtered_issue_queryset.filter(
+                created_by=request.user
+            )

        if group_by:
            if sub_group_by:
                if group_by == sub_group_by:
                    return Response(
                        {
-                            "error": "Group by and sub group by cannot have same parameters"
+                            "error": "Group by and sub group by cannot have same parameters"  # noqa: E501
                        },
                        status=status.HTTP_400_BAD_REQUEST,
                    )
@@ -307,7 +341,7 @@ class IssueViewSet(BaseViewSet):
                        request=request,
                        order_by=order_by_param,
                        queryset=issue_queryset,
-                        total_count_queryset=total_issue_queryset,
+                        total_count_queryset=filtered_issue_queryset,
                        on_results=lambda issues: issue_on_results(
                            group_by=group_by, issues=issues, sub_group_by=sub_group_by
                        ),
@@ -317,12 +351,14 @@ class IssueViewSet(BaseViewSet):
                            slug=slug,
                            project_id=project_id,
                            filters=filters,
+                            queryset=filtered_issue_queryset,
                        ),
                        sub_group_by_fields=issue_group_values(
                            field=sub_group_by,
                            slug=slug,
                            project_id=project_id,
                            filters=filters,
+                            queryset=filtered_issue_queryset,
                        ),
                        group_by_field_name=group_by,
                        sub_group_by_field_name=sub_group_by,
@@ -341,7 +377,7 @@ class IssueViewSet(BaseViewSet):
                    request=request,
                    order_by=order_by_param,
                    queryset=issue_queryset,
-                    total_count_queryset=total_issue_queryset,
+                    total_count_queryset=filtered_issue_queryset,
                    on_results=lambda issues: issue_on_results(
                        group_by=group_by, issues=issues, sub_group_by=sub_group_by
                    ),
@@ -351,6 +387,7 @@ class IssueViewSet(BaseViewSet):
                        slug=slug,
                        project_id=project_id,
                        filters=filters,
+                        queryset=filtered_issue_queryset,
                    ),
                    group_by_field_name=group_by,
                    count_filter=Q(
@@ -367,7 +404,7 @@ class IssueViewSet(BaseViewSet):
                order_by=order_by_param,
                request=request,
                queryset=issue_queryset,
-                total_count_queryset=total_issue_queryset,
+                total_count_queryset=filtered_issue_queryset,
                on_results=lambda issues: issue_on_results(
                    group_by=group_by, issues=issues, sub_group_by=sub_group_by
                ),
@@ -401,9 +438,11 @@ class IssueViewSet(BaseViewSet):
                notification=True,
                origin=base_host(request=request, is_app=True),
            )
+            queryset = self.get_queryset()
+            queryset = self.apply_annotations(queryset)
            issue = (
                issue_queryset_grouper(
-                    queryset=self.get_queryset().filter(pk=serializer.data["id"]),
+                    queryset=queryset.filter(pk=serializer.data["id"]),
                    group_by=None,
                    sub_group_by=None,
                )
@@ -608,9 +647,10 @@ class IssueViewSet(BaseViewSet):
        allowed_roles=[ROLE.ADMIN, ROLE.MEMBER], creator=True, model=Issue
    )
    def partial_update(self, request, slug, project_id, pk=None):
+        queryset = self.get_queryset()
+        queryset = self.apply_annotations(queryset)
        issue = (
-            self.get_queryset()
-            .annotate(
+            queryset.annotate(
                label_ids=Coalesce(
                    ArrayAgg(
                        "labels__id",
@@ -729,6 +769,9 @@ class IssueUserDisplayPropertyEndpoint(BaseAPIView):
            user=request.user, project_id=project_id
        )

+        issue_property.rich_filters = request.data.get(
+            "rich_filters", issue_property.rich_filters
+        )
        issue_property.filters = request.data.get("filters", issue_property.filters)
        issue_property.display_filters = request.data.get(
            "display_filters", issue_property.display_filters
@@ -968,6 +1011,59 @@ class IssuePaginatedViewSet(BaseViewSet):


 class IssueDetailEndpoint(BaseAPIView):
+    filter_backends = (ComplexFilterBackend,)
+    filterset_class = IssueFilterSet
+
+    def apply_annotations(self, issues):
+        return (
+            issues.annotate(
+                cycle_id=Subquery(
+                    CycleIssue.objects.filter(
+                        issue=OuterRef("id"), deleted_at__isnull=True
+                    ).values("cycle_id")[:1]
+                )
+            )
+            .annotate(
+                link_count=IssueLink.objects.filter(issue=OuterRef("id"))
+                .order_by()
+                .annotate(count=Func(F("id"), function="Count"))
+                .values("count")
+            )
+            .annotate(
+                attachment_count=FileAsset.objects.filter(
+                    issue_id=OuterRef("id"),
+                    entity_type=FileAsset.EntityTypeContext.ISSUE_ATTACHMENT,
+                )
+                .order_by()
+                .annotate(count=Func(F("id"), function="Count"))
+                .values("count")
+            )
+            .annotate(
+                sub_issues_count=Issue.issue_objects.filter(parent=OuterRef("id"))
+                .order_by()
+                .annotate(count=Func(F("id"), function="Count"))
+                .values("count")
+            )
+            .prefetch_related(
+                Prefetch(
+                    "issue_assignee",
+                    queryset=IssueAssignee.objects.all(),
+                )
+            )
+            .prefetch_related(
+                Prefetch(
+                    "label_issue",
+                    queryset=IssueLabel.objects.all(),
+                )
+            )
+            .prefetch_related(
+                Prefetch(
+                    "issue_module",
+                    queryset=ModuleIssue.objects.all(),
+                )
+            )
+        )
+
    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
    def get(self, request, slug, project_id):
        filters = issue_filters(request.query_params, "GET")
@@ -1001,56 +1097,9 @@ class IssueDetailEndpoint(BaseAPIView):
            .values("id")
        )
        # Main issue query
-        issue = (
-            Issue.issue_objects.filter(workspace__slug=slug, project_id=project_id)
-            .filter(Exists(permission_subquery))
-            .prefetch_related(
-                Prefetch(
-                    "issue_assignee",
-                    queryset=IssueAssignee.objects.all(),
-                )
-            )
-            .prefetch_related(
-                Prefetch(
-                    "label_issue",
-                    queryset=IssueLabel.objects.all(),
-                )
-            )
-            .prefetch_related(
-                Prefetch(
-                    "issue_module",
-                    queryset=ModuleIssue.objects.all(),
-                )
-            )
-            .annotate(
-                cycle_id=Subquery(
-                    CycleIssue.objects.filter(
-                        issue=OuterRef("id"), deleted_at__isnull=True
-                    ).values("cycle_id")[:1]
-                )
-            )
-            .annotate(
-                link_count=IssueLink.objects.filter(issue=OuterRef("id"))
-                .order_by()
-                .annotate(count=Func(F("id"), function="Count"))
-                .values("count")
-            )
-            .annotate(
-                attachment_count=FileAsset.objects.filter(
-                    issue_id=OuterRef("id"),
-                    entity_type=FileAsset.EntityTypeContext.ISSUE_ATTACHMENT,
-                )
-                .order_by()
-                .annotate(count=Func(F("id"), function="Count"))
-                .values("count")
-            )
-            .annotate(
-                sub_issues_count=Issue.issue_objects.filter(parent=OuterRef("id"))
-                .order_by()
-                .annotate(count=Func(F("id"), function="Count"))
-                .values("count")
-            )
-        )
+        issue = Issue.issue_objects.filter(
+            workspace__slug=slug, project_id=project_id
+        ).filter(Exists(permission_subquery))

        # Add additional prefetch based on expand parameter
        if self.expand:
@@ -1069,8 +1118,20 @@ class IssueDetailEndpoint(BaseAPIView):
                    )
                )

+        # Apply filtering from filterset
+        issue = self.filter_queryset(issue)
+
+        # Apply legacy filters
        issue = issue.filter(**filters)
+
+        # Total count queryset
+        total_issue_queryset = copy.deepcopy(issue)
+
+        # Applying annotations to the issue queryset
+        issue = self.apply_annotations(issue)
+
        order_by_param = request.GET.get("order_by", "-created_at")
+
        # Issue queryset
        issue, order_by_param = order_issue_queryset(
            issue_queryset=issue, order_by_param=order_by_param
@@ -1078,7 +1139,8 @@ class IssueDetailEndpoint(BaseAPIView):
        return self.paginate(
            request=request,
            order_by=order_by_param,
-            queryset=(issue),
+            queryset=issue,
+            total_count_queryset=total_issue_queryset,
            on_results=lambda issue: IssueListDetailSerializer(
                issue, many=True, fields=self.fields, expand=self.expand
            ).data,
@@ -1223,7 +1285,7 @@ class IssueDetailIdentifierEndpoint(BaseAPIView):

        # Fetch the issue
        issue = (
-            Issue.issue_objects.filter(project_id=project.id)
+            Issue.objects.filter(project_id=project.id)
            .filter(workspace__slug=slug)
            .select_related("workspace", "project", "state", "parent")
            .prefetch_related("assignees", "labels", "issue_module__module")
@@ -1315,6 +1377,16 @@ class IssueDetailIdentifierEndpoint(BaseAPIView):
                    )
                )
            )
+            .annotate(
+                is_intake=Exists(
+                    IntakeIssue.objects.filter(
+                        issue=OuterRef("id"),
+                        status__in=[-2, 0],
+                        workspace__slug=slug,
+                        project_id=project.id,
+                    )
+                )
+            )
        ).first()

        # Check if the issue exists
@@ -232,9 +232,6 @@ class ModuleViewSet(BaseViewSet):
            .filter(project_id=self.kwargs.get("project_id"))
            .filter(workspace__slug=self.kwargs.get("slug"))
            .annotate(is_favorite=Exists(favorite_subquery))
-            .select_related("project")
-            .select_related("workspace")
-            .select_related("lead")
            .prefetch_related("members")
            .prefetch_related(
                Prefetch(
@@ -315,7 +312,10 @@ class ModuleViewSet(BaseViewSet):
                    ArrayAgg(
                        "members__id",
                        distinct=True,
-                        filter=~Q(members__id__isnull=True),
+                        filter=Q(
+                            members__id__isnull=False,
+                            modulemember__deleted_at__isnull=True,
+                        ),
                    ),
                    Value([], output_field=ArrayField(UUIDField())),
                )
@@ -904,6 +904,9 @@ class ModuleUserPropertiesEndpoint(BaseAPIView):
        module_properties.filters = request.data.get(
            "filters", module_properties.filters
        )
+        module_properties.rich_filters = request.data.get(
+            "rich_filters", module_properties.rich_filters
+        )
        module_properties.display_filters = request.data.get(
            "display_filters", module_properties.display_filters
        )
@@ -1,4 +1,5 @@
 # Python imports
+import copy
 import json

 from django.db.models import F, Func, OuterRef, Q, Subquery
@@ -31,8 +32,8 @@ from plane.utils.grouper import (
 from plane.utils.issue_filters import issue_filters
 from plane.utils.order_queryset import order_issue_queryset
 from plane.utils.paginator import GroupedOffsetPaginator, SubGroupedOffsetPaginator
-
-# Module imports
+from plane.utils.filters import ComplexFilterBackend
+from plane.utils.filters import IssueFilterSet
 from .. import BaseViewSet
 from plane.utils.host import base_host

@@ -42,20 +43,12 @@ class ModuleIssueViewSet(BaseViewSet):
    model = ModuleIssue
    webhook_event = "module_issue"
    bulk = True
+    filter_backends = (ComplexFilterBackend,)
+    filterset_class = IssueFilterSet

-    filterset_fields = ["issue__labels__id", "issue__assignees__id"]
-
-    def get_queryset(self):
+    def apply_annotations(self, issues):
        return (
-            Issue.issue_objects.filter(
-                project_id=self.kwargs.get("project_id"),
-                workspace__slug=self.kwargs.get("slug"),
-                issue_module__module_id=self.kwargs.get("module_id"),
-                issue_module__deleted_at__isnull=True,
-            )
-            .select_related("workspace", "project", "state", "parent")
-            .prefetch_related("assignees", "labels", "issue_module__module")
-            .annotate(
+            issues.annotate(
                cycle_id=Subquery(
                    CycleIssue.objects.filter(
                        issue=OuterRef("id"), deleted_at__isnull=True
@@ -83,13 +76,37 @@ class ModuleIssueViewSet(BaseViewSet):
                .annotate(count=Func(F("id"), function="Count"))
                .values("count")
            )
+            .prefetch_related("assignees", "labels", "issue_module__module")
+        )
+
+    def get_queryset(self):
+        return (
+            Issue.issue_objects.filter(
+                project_id=self.kwargs.get("project_id"),
+                workspace__slug=self.kwargs.get("slug"),
+                issue_module__module_id=self.kwargs.get("module_id"),
+                issue_module__deleted_at__isnull=True,
+            )
        ).distinct()

    @method_decorator(gzip_page)
    @allow_permission([ROLE.ADMIN, ROLE.MEMBER])
    def list(self, request, slug, project_id, module_id):
        filters = issue_filters(request.query_params, "GET")
-        issue_queryset = self.get_queryset().filter(**filters)
+        issue_queryset = self.get_queryset()
+
+        # Apply filtering from filterset
+        issue_queryset = self.filter_queryset(issue_queryset)
+
+        # Apply legacy filters
+        issue_queryset = issue_queryset.filter(**filters)
+
+        # Total count queryset
+        total_issue_queryset = copy.deepcopy(issue_queryset)
+
+        # Apply annotations to the issue queryset
+        issue_queryset = self.apply_annotations(issue_queryset)
+
        order_by_param = request.GET.get("order_by", "created_at")

        # Issue queryset
@@ -122,6 +139,7 @@ class ModuleIssueViewSet(BaseViewSet):
                        request=request,
                        order_by=order_by_param,
                        queryset=issue_queryset,
+                        total_count_queryset=total_issue_queryset,
                        on_results=lambda issues: issue_on_results(
                            group_by=group_by, issues=issues, sub_group_by=sub_group_by
                        ),
@@ -131,12 +149,14 @@ class ModuleIssueViewSet(BaseViewSet):
                            slug=slug,
                            project_id=project_id,
                            filters=filters,
+                            queryset=total_issue_queryset,
                        ),
                        sub_group_by_fields=issue_group_values(
                            field=sub_group_by,
                            slug=slug,
                            project_id=project_id,
                            filters=filters,
+                            queryset=total_issue_queryset,
                        ),
                        group_by_field_name=group_by,
                        sub_group_by_field_name=sub_group_by,
@@ -156,6 +176,7 @@ class ModuleIssueViewSet(BaseViewSet):
                    request=request,
                    order_by=order_by_param,
                    queryset=issue_queryset,
+                    total_count_queryset=total_issue_queryset,
                    on_results=lambda issues: issue_on_results(
                        group_by=group_by, issues=issues, sub_group_by=sub_group_by
                    ),
@@ -165,6 +186,7 @@ class ModuleIssueViewSet(BaseViewSet):
                        slug=slug,
                        project_id=project_id,
                        filters=filters,
+                        queryset=total_issue_queryset,
                    ),
                    group_by_field_name=group_by,
                    count_filter=Q(
@@ -182,6 +204,7 @@ class ModuleIssueViewSet(BaseViewSet):
                order_by=order_by_param,
                request=request,
                queryset=issue_queryset,
+                total_count_queryset=total_issue_queryset,
                on_results=lambda issues: issue_on_results(
                    group_by=group_by, issues=issues, sub_group_by=sub_group_by
                ),
@@ -282,9 +305,11 @@ class ModuleIssueViewSet(BaseViewSet):
                project_id=str(project_id),
                current_instance=json.dumps(
                    {
-                        "module_name": module_issue.first().module.name
-                        if (module_issue.first() and module_issue.first().module)
-                        else None
+                        "module_name": (
+                            module_issue.first().module.name
+                            if (module_issue.first() and module_issue.first().module)
+                            else None
+                        )
                    }
                ),
                epoch=int(timezone.now().timestamp()),
@@ -6,9 +6,17 @@ from django.core.serializers.json import DjangoJSONEncoder

 # Django imports
 from django.db import connection
-from django.db.models import Exists, OuterRef, Q, Value, UUIDField
-from django.utils.decorators import method_decorator
-from django.views.decorators.gzip import gzip_page
+from django.db.models import (
+    Exists,
+    OuterRef,
+    Q,
+    Value,
+    UUIDField,
+    Count,
+    Case,
+    When,
+    IntegerField,
+)
 from django.http import StreamingHttpResponse
 from django.contrib.postgres.aggregates import ArrayAgg
 from django.contrib.postgres.fields import ArrayField
@@ -21,9 +29,7 @@ from rest_framework.response import Response
 # Module imports
 from plane.app.permissions import allow_permission, ROLE
 from plane.app.serializers import (
-    PageLogSerializer,
    PageSerializer,
-    SubPageSerializer,
    PageDetailSerializer,
    PageBinaryUpdateSerializer,
 )
@@ -37,11 +43,14 @@ from plane.db.models import (
    UserRecentVisit,
 )
 from plane.utils.error_codes import ERROR_CODES
+
+# Local imports
 from ..base import BaseAPIView, BaseViewSet
 from plane.bgtasks.page_transaction_task import page_transaction
 from plane.bgtasks.page_version_task import page_version
 from plane.bgtasks.recent_visited_task import recent_visited_task
 from plane.bgtasks.copy_s3_object import copy_s3_objects_of_description_and_assets
+from plane.app.permissions import ProjectPagePermission


 def unarchive_archive_page_and_descendants(page_id, archived_at):
@@ -63,6 +72,7 @@ def unarchive_archive_page_and_descendants(page_id, archived_at):
 class PageViewSet(BaseViewSet):
    serializer_class = PageSerializer
    model = Page
+    permission_classes = [ProjectPagePermission]
    search_fields = ["name"]

    def get_queryset(self):
@@ -117,7 +127,6 @@ class PageViewSet(BaseViewSet):
            .distinct()
        )

-    @allow_permission([ROLE.ADMIN, ROLE.MEMBER])
    def create(self, request, slug, project_id):
        serializer = PageSerializer(
            data=request.data,
@@ -139,11 +148,10 @@ class PageViewSet(BaseViewSet):
            return Response(serializer.data, status=status.HTTP_201_CREATED)
        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

-    @allow_permission([ROLE.ADMIN, ROLE.MEMBER])
-    def partial_update(self, request, slug, project_id, pk):
+    def partial_update(self, request, slug, project_id, page_id):
        try:
            page = Page.objects.get(
-                pk=pk, workspace__slug=slug, projects__id=project_id
+                pk=page_id, workspace__slug=slug, projects__id=project_id
            )

            if page.is_locked:
@@ -181,7 +189,7 @@ class PageViewSet(BaseViewSet):
                            {"description_html": page_description},
                            cls=DjangoJSONEncoder,
                        ),
-                        page_id=pk,
+                        page_id=page_id,
                    )

                return Response(serializer.data, status=status.HTTP_200_OK)
@@ -194,10 +202,10 @@ class PageViewSet(BaseViewSet):
                status=status.HTTP_400_BAD_REQUEST,
            )

-    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
-    def retrieve(self, request, slug, project_id, pk=None):
-        page = self.get_queryset().filter(pk=pk).first()
+    def retrieve(self, request, slug, project_id, page_id=None):
+        page = self.get_queryset().filter(pk=page_id).first()
        project = Project.objects.get(pk=project_id)
+        track_visit = request.query_params.get("track_visit", "true").lower() == "true"

        """
        if the role is guest and guest_view_all_features is false and owned by is not
@@ -226,33 +234,32 @@ class PageViewSet(BaseViewSet):
            )
        else:
            issue_ids = PageLog.objects.filter(
-                page_id=pk, entity_name="issue"
+                page_id=page_id, entity_name="issue"
            ).values_list("entity_identifier", flat=True)
            data = PageDetailSerializer(page).data
            data["issue_ids"] = issue_ids
-            recent_visited_task.delay(
-                slug=slug,
-                entity_name="page",
-                entity_identifier=pk,
-                user_id=request.user.id,
-                project_id=project_id,
-            )
+            if track_visit:
+                recent_visited_task.delay(
+                    slug=slug,
+                    entity_name="page",
+                    entity_identifier=page_id,
+                    user_id=request.user.id,
+                    project_id=project_id,
+                )
            return Response(data, status=status.HTTP_200_OK)

-    @allow_permission([ROLE.ADMIN], model=Page, creator=True)
-    def lock(self, request, slug, project_id, pk):
+    def lock(self, request, slug, project_id, page_id):
        page = Page.objects.filter(
-            pk=pk, workspace__slug=slug, projects__id=project_id
+            pk=page_id, workspace__slug=slug, projects__id=project_id
        ).first()

        page.is_locked = True
        page.save()
        return Response(status=status.HTTP_204_NO_CONTENT)

-    @allow_permission([ROLE.ADMIN], model=Page, creator=True)
-    def unlock(self, request, slug, project_id, pk):
+    def unlock(self, request, slug, project_id, page_id):
        page = Page.objects.filter(
-            pk=pk, workspace__slug=slug, projects__id=project_id
+            pk=page_id, workspace__slug=slug, projects__id=project_id
        ).first()

        page.is_locked = False
@@ -260,11 +267,10 @@ class PageViewSet(BaseViewSet):

        return Response(status=status.HTTP_204_NO_CONTENT)

-    @allow_permission([ROLE.ADMIN], model=Page, creator=True)
-    def access(self, request, slug, project_id, pk):
+    def access(self, request, slug, project_id, page_id):
        access = request.data.get("access", 0)
        page = Page.objects.filter(
-            pk=pk, workspace__slug=slug, projects__id=project_id
+            pk=page_id, workspace__slug=slug, projects__id=project_id
        ).first()

        # Only update access if the page owner is the requesting user
@@ -283,7 +289,6 @@ class PageViewSet(BaseViewSet):
        page.save()
        return Response(status=status.HTTP_204_NO_CONTENT)

-    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
    def list(self, request, slug, project_id):
        queryset = self.get_queryset()
        project = Project.objects.get(pk=project_id)
@@ -301,9 +306,10 @@ class PageViewSet(BaseViewSet):
        pages = PageSerializer(queryset, many=True).data
        return Response(pages, status=status.HTTP_200_OK)

-    @allow_permission([ROLE.ADMIN], model=Page, creator=True)
-    def archive(self, request, slug, project_id, pk):
-        page = Page.objects.get(pk=pk, workspace__slug=slug, projects__id=project_id)
+    def archive(self, request, slug, project_id, page_id):
+        page = Page.objects.get(
+            pk=page_id, workspace__slug=slug, projects__id=project_id
+        )

        # only the owner or admin can archive the page
        if (
@@ -319,18 +325,19 @@ class PageViewSet(BaseViewSet):

        UserFavorite.objects.filter(
            entity_type="page",
-            entity_identifier=pk,
+            entity_identifier=page_id,
            project_id=project_id,
            workspace__slug=slug,
        ).delete()

-        unarchive_archive_page_and_descendants(pk, datetime.now())
+        unarchive_archive_page_and_descendants(page_id, datetime.now())

        return Response({"archived_at": str(datetime.now())}, status=status.HTTP_200_OK)

-    @allow_permission([ROLE.ADMIN], model=Page, creator=True)
-    def unarchive(self, request, slug, project_id, pk):
-        page = Page.objects.get(pk=pk, workspace__slug=slug, projects__id=project_id)
+    def unarchive(self, request, slug, project_id, page_id):
+        page = Page.objects.get(
+            pk=page_id, workspace__slug=slug, projects__id=project_id
+        )

        # only the owner or admin can un archive the page
        if (
@@ -344,18 +351,19 @@ class PageViewSet(BaseViewSet):
                status=status.HTTP_400_BAD_REQUEST,
            )

-        # if parent page is archived then the page will be un archived breaking the hierarchy
+        # if parent archived then page will be un archived breaking hierarchy
        if page.parent_id and page.parent.archived_at:
            page.parent = None
            page.save(update_fields=["parent"])

-        unarchive_archive_page_and_descendants(pk, None)
+        unarchive_archive_page_and_descendants(page_id, None)

        return Response(status=status.HTTP_204_NO_CONTENT)

-    @allow_permission([ROLE.ADMIN], model=Page, creator=True)
-    def destroy(self, request, slug, project_id, pk):
-        page = Page.objects.get(pk=pk, workspace__slug=slug, projects__id=project_id)
+    def destroy(self, request, slug, project_id, page_id):
+        page = Page.objects.get(
+            pk=page_id, workspace__slug=slug, projects__id=project_id
+        )

        if page.archived_at is None:
            return Response(
@@ -379,7 +387,7 @@ class PageViewSet(BaseViewSet):

        # remove parent from all the children
        _ = Page.objects.filter(
-            parent_id=pk, projects__id=project_id, workspace__slug=slug
+            parent_id=page_id, projects__id=project_id, workspace__slug=slug
        ).update(parent=None)

        page.delete()
@@ -387,105 +395,109 @@ class PageViewSet(BaseViewSet):
        UserFavorite.objects.filter(
            project=project_id,
            workspace__slug=slug,
-            entity_identifier=pk,
+            entity_identifier=page_id,
            entity_type="page",
        ).delete()
        # Delete the page from recent visit
        UserRecentVisit.objects.filter(
            project_id=project_id,
            workspace__slug=slug,
-            entity_identifier=pk,
+            entity_identifier=page_id,
            entity_name="page",
        ).delete(soft=False)
        return Response(status=status.HTTP_204_NO_CONTENT)

+    def summary(self, request, slug, project_id):
+        queryset = (
+            Page.objects.filter(workspace__slug=slug)
+            .filter(
+                projects__project_projectmember__member=self.request.user,
+                projects__project_projectmember__is_active=True,
+                projects__archived_at__isnull=True,
+            )
+            .filter(parent__isnull=True)
+            .filter(Q(owned_by=request.user) | Q(access=0))
+            .annotate(
+                project=Exists(
+                    ProjectPage.objects.filter(
+                        page_id=OuterRef("id"), project_id=self.kwargs.get("project_id")
+                    )
+                )
+            )
+            .filter(project=True)
+            .distinct()
+        )
+
+        project = Project.objects.get(pk=project_id)
+        if (
+            ProjectMember.objects.filter(
+                workspace__slug=slug,
+                project_id=project_id,
+                member=request.user,
+                role=ROLE.GUEST.value,
+                is_active=True,
+            ).exists()
+            and not project.guest_view_all_features
+        ):
+            queryset = queryset.filter(owned_by=request.user)
+
+        stats = queryset.aggregate(
+            public_pages=Count(
+                Case(
+                    When(access=Page.PUBLIC_ACCESS, archived_at__isnull=True, then=1),
+                    output_field=IntegerField(),
+                )
+            ),
+            private_pages=Count(
+                Case(
+                    When(access=Page.PRIVATE_ACCESS, archived_at__isnull=True, then=1),
+                    output_field=IntegerField(),
+                )
+            ),
+            archived_pages=Count(
+                Case(
+                    When(archived_at__isnull=False, then=1), output_field=IntegerField()
+                )
+            ),
+        )
+
+        return Response(stats, status=status.HTTP_200_OK)
+

 class PageFavoriteViewSet(BaseViewSet):
    model = UserFavorite

    @allow_permission([ROLE.ADMIN, ROLE.MEMBER])
-    def create(self, request, slug, project_id, pk):
+    def create(self, request, slug, project_id, page_id):
        _ = UserFavorite.objects.create(
            project_id=project_id,
-            entity_identifier=pk,
+            entity_identifier=page_id,
            entity_type="page",
            user=request.user,
        )
        return Response(status=status.HTTP_204_NO_CONTENT)

    @allow_permission([ROLE.ADMIN, ROLE.MEMBER])
-    def destroy(self, request, slug, project_id, pk):
+    def destroy(self, request, slug, project_id, page_id):
        page_favorite = UserFavorite.objects.get(
            project=project_id,
            user=request.user,
            workspace__slug=slug,
-            entity_identifier=pk,
+            entity_identifier=page_id,
            entity_type="page",
        )
        page_favorite.delete(soft=False)
        return Response(status=status.HTTP_204_NO_CONTENT)


-class PageLogEndpoint(BaseAPIView):
-    serializer_class = PageLogSerializer
-    model = PageLog
-
-    def post(self, request, slug, project_id, page_id):
-        serializer = PageLogSerializer(data=request.data)
-        if serializer.is_valid():
-            serializer.save(project_id=project_id, page_id=page_id)
-            return Response(serializer.data, status=status.HTTP_201_CREATED)
-        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
-
-    def patch(self, request, slug, project_id, page_id, transaction):
-        page_transaction = PageLog.objects.get(
-            workspace__slug=slug,
-            project_id=project_id,
-            page_id=page_id,
-            transaction=transaction,
-        )
-        serializer = PageLogSerializer(
-            page_transaction, data=request.data, partial=True
-        )
-        if serializer.is_valid():
-            serializer.save()
-            return Response(serializer.data, status=status.HTTP_200_OK)
-        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
-
-    def delete(self, request, slug, project_id, page_id, transaction):
-        transaction = PageLog.objects.get(
-            workspace__slug=slug,
-            project_id=project_id,
-            page_id=page_id,
-            transaction=transaction,
-        )
-        # Delete the transaction object
-        transaction.delete()
-        return Response(status=status.HTTP_204_NO_CONTENT)
-
-
-class SubPagesEndpoint(BaseAPIView):
-    @method_decorator(gzip_page)
-    def get(self, request, slug, project_id, page_id):
-        pages = (
-            PageLog.objects.filter(
-                page_id=page_id,
-                workspace__slug=slug,
-                entity_name__in=["forward_link", "back_link"],
-            )
-            .select_related("project")
-            .select_related("workspace")
-        )
-        return Response(
-            SubPageSerializer(pages, many=True).data, status=status.HTTP_200_OK
-        )
-
-
 class PagesDescriptionViewSet(BaseViewSet):
-    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
-    def retrieve(self, request, slug, project_id, pk):
+    permission_classes = [ProjectPagePermission]
+
+    def retrieve(self, request, slug, project_id, page_id):
        page = (
-            Page.objects.filter(pk=pk, workspace__slug=slug, projects__id=project_id)
+            Page.objects.filter(
+                pk=page_id, workspace__slug=slug, projects__id=project_id
+            )
            .filter(Q(owned_by=self.request.user) | Q(access=0))
            .first()
        )
@@ -505,10 +517,11 @@ class PagesDescriptionViewSet(BaseViewSet):
        response["Content-Disposition"] = 'attachment; filename="page_description.bin"'
        return response

-    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
-    def partial_update(self, request, slug, project_id, pk):
+    def partial_update(self, request, slug, project_id, page_id):
        page = (
-            Page.objects.filter(pk=pk, workspace__slug=slug, projects__id=project_id)
+            Page.objects.filter(
+                pk=page_id, workspace__slug=slug, projects__id=project_id
+            )
            .filter(Q(owned_by=self.request.user) | Q(access=0))
            .first()
        )
@@ -545,7 +558,7 @@ class PagesDescriptionViewSet(BaseViewSet):
            # Capture the page transaction
            if request.data.get("description_html"):
                page_transaction.delay(
-                    new_value=request.data, old_value=existing_instance, page_id=pk
+                    new_value=request.data, old_value=existing_instance, page_id=page_id
                )

            # Update the page using serializer
@@ -563,7 +576,8 @@ class PagesDescriptionViewSet(BaseViewSet):


 class PageDuplicateEndpoint(BaseAPIView):
-    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
+    permission_classes = [ProjectPagePermission]
+
    def post(self, request, slug, project_id, page_id):
        page = Page.objects.filter(
            pk=page_id, workspace__slug=slug, projects__id=project_id
@@ -7,10 +7,12 @@ from plane.db.models import PageVersion
 from ..base import BaseAPIView
 from plane.app.serializers import PageVersionSerializer, PageVersionDetailSerializer
 from plane.app.permissions import allow_permission, ROLE
-
+from plane.app.permissions import ProjectPagePermission

 class PageVersionEndpoint(BaseAPIView):
-    @allow_permission(allowed_roles=[ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
+
+    permission_classes = [ProjectPagePermission]
+
    def get(self, request, slug, project_id, page_id, pk=None):
        # Check if pk is provided
        if pk:
@@ -5,13 +5,12 @@ from django.utils import timezone
 import json

 # Django imports
-from django.db import IntegrityError
 from django.db.models import Exists, F, OuterRef, Prefetch, Q, Subquery
 from django.core.serializers.json import DjangoJSONEncoder

 # Third Party imports
 from rest_framework.response import Response
-from rest_framework import serializers, status
+from rest_framework import status
 from rest_framework.permissions import AllowAny

 # Module imports
@@ -106,7 +105,10 @@ class ProjectViewSet(BaseViewSet):
        fields = [field for field in request.GET.get("fields", "").split(",") if field]
        projects = self.get_queryset().order_by("sort_order", "name")
        if WorkspaceMember.objects.filter(
-            member=request.user, workspace__slug=slug, is_active=True, role=5
+            member=request.user,
+            workspace__slug=slug,
+            is_active=True,
+            role=ROLE.GUEST.value,
        ).exists():
            projects = projects.filter(
                project_projectmember__member=self.request.user,
@@ -114,7 +116,10 @@ class ProjectViewSet(BaseViewSet):
            )

        if WorkspaceMember.objects.filter(
-            member=request.user, workspace__slug=slug, is_active=True, role=15
+            member=request.user,
+            workspace__slug=slug,
+            is_active=True,
+            role=ROLE.MEMBER.value,
        ).exists():
            projects = projects.filter(
                Q(
@@ -189,7 +194,10 @@ class ProjectViewSet(BaseViewSet):
        )

        if WorkspaceMember.objects.filter(
-            member=request.user, workspace__slug=slug, is_active=True, role=5
+            member=request.user,
+            workspace__slug=slug,
+            is_active=True,
+            role=ROLE.GUEST.value,
        ).exists():
            projects = projects.filter(
                project_projectmember__member=self.request.user,
@@ -197,7 +205,10 @@ class ProjectViewSet(BaseViewSet):
            )

        if WorkspaceMember.objects.filter(
-            member=request.user, workspace__slug=slug, is_active=True, role=15
+            member=request.user,
+            workspace__slug=slug,
+            is_active=True,
+            role=ROLE.MEMBER.value,
        ).exists():
            projects = projects.filter(
                Q(
@@ -250,7 +261,9 @@ class ProjectViewSet(BaseViewSet):

            # Add the user as Administrator to the project
            _ = ProjectMember.objects.create(
-                project_id=serializer.data["id"], member=request.user, role=20
+                project_id=serializer.data["id"],
+                member=request.user,
+                role=ROLE.ADMIN.value,
            )
            # Also create the issue property for the user
            _ = IssueUserProperty.objects.create(
@@ -263,7 +276,7 @@ class ProjectViewSet(BaseViewSet):
                ProjectMember.objects.create(
                    project_id=serializer.data["id"],
                    member_id=serializer.data["project_lead"],
-                    role=20,
+                    role=ROLE.ADMIN.value,
                )
                # Also create the issue property for the user
                IssueUserProperty.objects.create(
@@ -341,13 +354,23 @@ class ProjectViewSet(BaseViewSet):

    def partial_update(self, request, slug, pk=None):
        # try:
-        if not ProjectMember.objects.filter(
+        is_workspace_admin = WorkspaceMember.objects.filter(
+            member=request.user,
+            workspace__slug=slug,
+            is_active=True,
+            role=ROLE.ADMIN.value,
+        ).exists()
+
+        is_project_admin = ProjectMember.objects.filter(
            member=request.user,
            workspace__slug=slug,
            project_id=pk,
-            role=20,
+            role=ROLE.ADMIN.value,
            is_active=True,
-        ).exists():
+        ).exists()
+
+        # Return error for if the user is neither workspace admin nor project admin
+        if not is_project_admin and not is_workspace_admin:
            return Response(
                {"error": "You don't have the required permissions."},
                status=status.HTTP_403_FORBIDDEN,
@@ -402,13 +425,16 @@ class ProjectViewSet(BaseViewSet):
    def destroy(self, request, slug, pk):
        if (
            WorkspaceMember.objects.filter(
-                member=request.user, workspace__slug=slug, is_active=True, role=20
+                member=request.user,
+                workspace__slug=slug,
+                is_active=True,
+                role=ROLE.ADMIN.value,
            ).exists()
            or ProjectMember.objects.filter(
                member=request.user,
                workspace__slug=slug,
                project_id=pk,
-                role=20,
+                role=ROLE.ADMIN.value,
                is_active=True,
            ).exists()
        ):
@@ -59,9 +59,10 @@ class IssueSearchEndpoint(BaseAPIView):
        )

        related_issue_ids = [item for sublist in related_issue_ids for item in sublist]
+        related_issue_ids.append(issue_id)

        if issue:
-            issues = issues.filter(~Q(pk=issue_id), ~Q(pk__in=related_issue_ids))
+            issues = issues.exclude(pk__in=related_issue_ids)

        return issues

@@ -1,3 +1,5 @@
+import copy
+
 # Django imports
 from django.db.models import (
    Exists,
@@ -39,6 +41,8 @@ from plane.utils.order_queryset import order_issue_queryset
 from plane.bgtasks.recent_visited_task import recent_visited_task
 from .. import BaseViewSet
 from plane.db.models import UserFavorite
+from plane.utils.filters import ComplexFilterBackend
+from plane.utils.filters import IssueFilterSet


 class WorkspaceViewViewSet(BaseViewSet):
@@ -56,7 +60,6 @@ class WorkspaceViewViewSet(BaseViewSet):
            .filter(workspace__slug=self.kwargs.get("slug"))
            .filter(project__isnull=True)
            .filter(Q(owned_by=self.request.user) | Q(access=1))
-            .select_related("workspace")
            .order_by(self.request.GET.get("order_by", "-created_at"))
            .distinct()
        )
@@ -145,6 +148,9 @@ class WorkspaceViewViewSet(BaseViewSet):


 class WorkspaceViewIssuesViewSet(BaseViewSet):
+    filter_backends = (ComplexFilterBackend,)
+    filterset_class = IssueFilterSet
+
    def _get_project_permission_filters(self):
        """
        Get common project permission filters for guest users and role-based access control.
@@ -167,35 +173,9 @@ class WorkspaceViewIssuesViewSet(BaseViewSet):
            project__project_projectmember__is_active=True,
        )

-    def get_queryset(self):
+    def apply_annotations(self, issues):
        return (
-            Issue.issue_objects.annotate(
-                sub_issues_count=Issue.issue_objects.filter(parent=OuterRef("id"))
-                .order_by()
-                .annotate(count=Func(F("id"), function="Count"))
-                .values("count")
-            )
-            .filter(workspace__slug=self.kwargs.get("slug"))
-            .select_related("state")
-            .prefetch_related(
-                Prefetch(
-                    "issue_assignee",
-                    queryset=IssueAssignee.objects.all(),
-                )
-            )
-            .prefetch_related(
-                Prefetch(
-                    "label_issue",
-                    queryset=IssueLabel.objects.all(),
-                )
-            )
-            .prefetch_related(
-                Prefetch(
-                    "issue_module",
-                    queryset=ModuleIssue.objects.all(),
-                )
-            )
-            .annotate(
+            issues.annotate(
                cycle_id=Subquery(
                    CycleIssue.objects.filter(
                        issue=OuterRef("id"), deleted_at__isnull=True
@@ -223,32 +203,57 @@ class WorkspaceViewIssuesViewSet(BaseViewSet):
                .annotate(count=Func(F("id"), function="Count"))
                .values("count")
            )
+            .prefetch_related(
+                Prefetch(
+                    "issue_assignee",
+                    queryset=IssueAssignee.objects.all(),
+                )
+            )
+            .prefetch_related(
+                Prefetch(
+                    "label_issue",
+                    queryset=IssueLabel.objects.all(),
+                )
+            )
+            .prefetch_related(
+                Prefetch(
+                    "issue_module",
+                    queryset=ModuleIssue.objects.all(),
+                )
+            )
        )

+    def get_queryset(self):
+        return Issue.issue_objects.filter(workspace__slug=self.kwargs.get("slug"))
+
    @method_decorator(gzip_page)
    @allow_permission(
        allowed_roles=[ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST], level="WORKSPACE"
    )
    def list(self, request, slug):
-        filters = issue_filters(request.query_params, "GET")
+        issue_queryset = self.get_queryset()
+
+        # Apply filtering from filterset
+        issue_queryset = self.filter_queryset(issue_queryset)
+
        order_by_param = request.GET.get("order_by", "-created_at")

-        issue_queryset = self.get_queryset().filter(**filters)
+        # Apply legacy filters
+        filters = issue_filters(request.query_params, "GET")
+        issue_queryset = issue_queryset.filter(**filters)

        # Get common project permission filters
        permission_filters = self._get_project_permission_filters()
-
-        # Base query for the counts
-        total_issue_count = (
-            Issue.issue_objects.filter(**filters)
-            .filter(workspace__slug=slug)
-            .filter(permission_filters)
-            .only("id")
-        )
-
        # Apply project permission filters to the issue queryset
        issue_queryset = issue_queryset.filter(permission_filters)

+        # Base query for the counts
+        total_issue_count_queryset = copy.deepcopy(issue_queryset)
+        total_issue_count_queryset = total_issue_count_queryset.only("id")
+
+        # Apply annotations to the issue queryset
+        issue_queryset = self.apply_annotations(issue_queryset)
+
        # Issue queryset
        issue_queryset, order_by_param = order_issue_queryset(
            issue_queryset=issue_queryset, order_by_param=order_by_param
@@ -260,7 +265,7 @@ class WorkspaceViewIssuesViewSet(BaseViewSet):
            request=request,
            queryset=issue_queryset,
            on_results=lambda issues: ViewIssueListSerializer(issues, many=True).data,
-            total_count_queryset=total_issue_count,
+            total_count_queryset=total_issue_count_queryset,
        )


@@ -172,12 +172,14 @@ class WorkspaceDraftIssueViewSet(BaseViewSet):
                {"error": "Issue not found"}, status=status.HTTP_404_NOT_FOUND
            )

+        project_id = request.data.get("project_id", issue.project_id)
+
        serializer = DraftIssueCreateSerializer(
            issue,
            data=request.data,
            partial=True,
            context={
-                "project_id": request.data.get("project_id", None),
+                "project_id": project_id,
                "cycle_id": request.data.get("cycle_id", "not_provided"),
            },
        )
@@ -7,7 +7,6 @@ from plane.app.serializers import StateSerializer
 from plane.app.views.base import BaseAPIView
 from plane.db.models import State
 from plane.app.permissions import WorkspaceEntityPermission
-from plane.utils.cache import cache_response
 from collections import defaultdict


@@ -15,7 +14,6 @@ class WorkspaceStatesEndpoint(BaseAPIView):
    permission_classes = [WorkspaceEntityPermission]
    use_read_replica = True

-    @cache_response(60 * 60 * 2)
    def get(self, request, slug):
        states = State.objects.filter(
            workspace__slug=slug,
@@ -1,4 +1,5 @@
 # Python imports
+import copy
 from datetime import date

 from dateutil.relativedelta import relativedelta
@@ -56,6 +57,8 @@ from plane.utils.grouper import (
 from plane.utils.issue_filters import issue_filters
 from plane.utils.order_queryset import order_issue_queryset
 from plane.utils.paginator import GroupedOffsetPaginator, SubGroupedOffsetPaginator
+from plane.utils.filters import ComplexFilterBackend
+from plane.utils.filters import IssueFilterSet


 class UserLastProjectWithWorkspaceEndpoint(BaseAPIView):
@@ -91,23 +94,12 @@ class UserLastProjectWithWorkspaceEndpoint(BaseAPIView):
 class WorkspaceUserProfileIssuesEndpoint(BaseAPIView):
    permission_classes = [WorkspaceViewerPermission]

-    def get(self, request, slug, user_id):
-        filters = issue_filters(request.query_params, "GET")
+    filter_backends = (ComplexFilterBackend,)
+    filterset_class = IssueFilterSet

-        order_by_param = request.GET.get("order_by", "-created_at")
-        issue_queryset = (
-            Issue.issue_objects.filter(
-                Q(assignees__in=[user_id])
-                | Q(created_by_id=user_id)
-                | Q(issue_subscribers__subscriber_id=user_id),
-                workspace__slug=slug,
-                project__project_projectmember__member=request.user,
-                project__project_projectmember__is_active=True,
-            )
-            .filter(**filters)
-            .select_related("workspace", "project", "state", "parent")
-            .prefetch_related("assignees", "labels", "issue_module__module")
-            .annotate(
+    def apply_annotations(self, issues):
+        return (
+            issues.annotate(
                cycle_id=Subquery(
                    CycleIssue.objects.filter(
                        issue=OuterRef("id"), deleted_at__isnull=True
@@ -135,8 +127,36 @@ class WorkspaceUserProfileIssuesEndpoint(BaseAPIView):
                .annotate(count=Func(F("id"), function="Count"))
                .values("count")
            )
-            .order_by("created_at")
-        ).distinct()
+            .prefetch_related("assignees", "labels", "issue_module__module")
+        )
+
+    def get(self, request, slug, user_id):
+        filters = issue_filters(request.query_params, "GET")
+
+        order_by_param = request.GET.get("order_by", "-created_at")
+        issue_queryset = Issue.issue_objects.filter(
+            id__in=Issue.issue_objects.filter(
+                Q(assignees__in=[user_id])
+                | Q(created_by_id=user_id)
+                | Q(issue_subscribers__subscriber_id=user_id),
+                workspace__slug=slug,
+            ).values_list("id", flat=True),
+            workspace__slug=slug,
+            project__project_projectmember__member=request.user,
+            project__project_projectmember__is_active=True,
+        )
+
+        # Apply filtering from filterset
+        issue_queryset = self.filter_queryset(issue_queryset)
+
+        # Apply legacy filters
+        issue_queryset = issue_queryset.filter(**filters)
+
+        # Total count queryset
+        total_issue_queryset = copy.deepcopy(issue_queryset)
+
+        # Apply annotations to the issue queryset
+        issue_queryset = self.apply_annotations(issue_queryset)

        # Issue queryset
        issue_queryset, order_by_param = order_issue_queryset(
@@ -157,7 +177,7 @@ class WorkspaceUserProfileIssuesEndpoint(BaseAPIView):
                if group_by == sub_group_by:
                    return Response(
                        {
-                            "error": "Group by and sub group by cannot have same parameters"
+                            "error": "Group by and sub group by cannot have same parameters"  # noqa: E501
                        },
                        status=status.HTTP_400_BAD_REQUEST,
                    )
@@ -166,15 +186,22 @@ class WorkspaceUserProfileIssuesEndpoint(BaseAPIView):
                        request=request,
                        order_by=order_by_param,
                        queryset=issue_queryset,
+                        total_count_queryset=total_issue_queryset,
                        on_results=lambda issues: issue_on_results(
                            group_by=group_by, issues=issues, sub_group_by=sub_group_by
                        ),
                        paginator_cls=SubGroupedOffsetPaginator,
                        group_by_fields=issue_group_values(
-                            field=group_by, slug=slug, filters=filters
+                            field=group_by,
+                            slug=slug,
+                            filters=filters,
+                            queryset=total_issue_queryset,
                        ),
                        sub_group_by_fields=issue_group_values(
-                            field=sub_group_by, slug=slug, filters=filters
+                            field=sub_group_by,
+                            slug=slug,
+                            filters=filters,
+                            queryset=total_issue_queryset,
                        ),
                        group_by_field_name=group_by,
                        sub_group_by_field_name=sub_group_by,
@@ -193,12 +220,16 @@ class WorkspaceUserProfileIssuesEndpoint(BaseAPIView):
                    request=request,
                    order_by=order_by_param,
                    queryset=issue_queryset,
+                    total_count_queryset=total_issue_queryset,
                    on_results=lambda issues: issue_on_results(
                        group_by=group_by, issues=issues, sub_group_by=sub_group_by
                    ),
                    paginator_cls=GroupedOffsetPaginator,
                    group_by_fields=issue_group_values(
-                        field=group_by, slug=slug, filters=filters
+                        field=group_by,
+                        slug=slug,
+                        filters=filters,
+                        queryset=total_issue_queryset,
                    ),
                    group_by_field_name=group_by,
                    count_filter=Q(
@@ -215,6 +246,7 @@ class WorkspaceUserProfileIssuesEndpoint(BaseAPIView):
                order_by=order_by_param,
                request=request,
                queryset=issue_queryset,
+                total_count_queryset=total_issue_queryset,
                on_results=lambda issues: issue_on_results(
                    group_by=group_by, issues=issues, sub_group_by=sub_group_by
                ),
@@ -232,6 +264,9 @@ class WorkspaceUserPropertiesEndpoint(BaseAPIView):
        workspace_properties.filters = request.data.get(
            "filters", workspace_properties.filters
        )
+        workspace_properties.rich_filters = request.data.get(
+            "rich_filters", workspace_properties.rich_filters
+        )
        workspace_properties.display_filters = request.data.get(
            "display_filters", workspace_properties.display_filters
        )
@@ -1,6 +1,3 @@
-# Python imports
-from urllib.parse import urlencode, urljoin
-
 # Django imports
 from django.core.exceptions import ValidationError
 from django.core.validators import validate_email
@@ -19,7 +16,7 @@ from plane.authentication.adapter.error import (
    AuthenticationException,
    AUTHENTICATION_ERROR_CODES,
 )
-from plane.utils.path_validator import validate_next_path
+from plane.utils.path_validator import get_safe_redirect_url


 class SignInAuthEndpoint(View):
@@ -34,11 +31,11 @@ class SignInAuthEndpoint(View):
                error_message="INSTANCE_NOT_CONFIGURED",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
            # Base URL join
-            url = urljoin(
-                base_host(request=request, is_app=True), "sign-in?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
            )
            return HttpResponseRedirect(url)

@@ -58,10 +55,10 @@ class SignInAuthEndpoint(View):
            )
            params = exc.get_error_dict()
            # Next path
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "sign-in?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
            )
            return HttpResponseRedirect(url)

@@ -76,10 +73,10 @@ class SignInAuthEndpoint(View):
                payload={"email": str(email)},
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "sign-in?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
            )
            return HttpResponseRedirect(url)

@@ -92,10 +89,10 @@ class SignInAuthEndpoint(View):
                payload={"email": str(email)},
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "sign-in?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
            )
            return HttpResponseRedirect(url)

@@ -112,19 +109,23 @@ class SignInAuthEndpoint(View):
            user_login(request=request, user=user, is_app=True)
            # Get the redirection path
            if next_path:
-                path = str(validate_next_path(next_path))
+                path = next_path
            else:
                path = get_redirection_path(user=user)

-            # redirect to referer path
-            url = urljoin(base_host(request=request, is_app=True), path)
+            # Get the safe redirect URL
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=path,
+                params={},
+            )
            return HttpResponseRedirect(url)
        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "sign-in?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
            )
            return HttpResponseRedirect(url)

@@ -141,10 +142,10 @@ class SignUpAuthEndpoint(View):
                error_message="INSTANCE_NOT_CONFIGURED",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
            )
            return HttpResponseRedirect(url)

@@ -161,10 +162,10 @@ class SignUpAuthEndpoint(View):
                payload={"email": str(email)},
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
            )
            return HttpResponseRedirect(url)
        # Validate the email
@@ -179,10 +180,10 @@ class SignUpAuthEndpoint(View):
                payload={"email": str(email)},
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
            )
            return HttpResponseRedirect(url)

@@ -197,10 +198,10 @@ class SignUpAuthEndpoint(View):
                payload={"email": str(email)},
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
            )
            return HttpResponseRedirect(url)

@@ -217,17 +218,21 @@ class SignUpAuthEndpoint(View):
            user_login(request=request, user=user, is_app=True)
            # Get the redirection path
            if next_path:
-                path = str(validate_next_path(next_path))
+                path = next_path
            else:
                path = get_redirection_path(user=user)
-            # redirect to referer path
-            url = urljoin(base_host(request=request, is_app=True), path)
+
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=path,
+                params={},
+            )
            return HttpResponseRedirect(url)
        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
            )
            return HttpResponseRedirect(url)
@@ -1,5 +1,5 @@
+# Python imports
 import uuid
-from urllib.parse import urlencode, urljoin

 # Django import
 from django.http import HttpResponseRedirect
@@ -16,8 +16,7 @@ from plane.authentication.adapter.error import (
    AuthenticationException,
    AUTHENTICATION_ERROR_CODES,
 )
-from plane.utils.path_validator import validate_next_path
-
+from plane.utils.path_validator import get_safe_redirect_url

 class GitHubOauthInitiateEndpoint(View):
    def get(self, request):
@@ -35,10 +34,10 @@ class GitHubOauthInitiateEndpoint(View):
                error_message="INSTANCE_NOT_CONFIGURED",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params
            )
            return HttpResponseRedirect(url)
        try:
@@ -49,10 +48,10 @@ class GitHubOauthInitiateEndpoint(View):
            return HttpResponseRedirect(auth_url)
        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params
            )
            return HttpResponseRedirect(url)

@@ -61,7 +60,6 @@ class GitHubCallbackEndpoint(View):
    def get(self, request):
        code = request.GET.get("code")
        state = request.GET.get("state")
-        base_host = request.session.get("host")
        next_path = request.session.get("next_path")

        if state != request.session.get("state", ""):
@@ -70,9 +68,11 @@ class GitHubCallbackEndpoint(View):
                error_message="GITHUB_OAUTH_PROVIDER_ERROR",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(base_host, "?" + urlencode(params))
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        if not code:
@@ -81,9 +81,11 @@ class GitHubCallbackEndpoint(View):
                error_message="GITHUB_OAUTH_PROVIDER_ERROR",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(base_host, "?" + urlencode(params))
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        try:
@@ -93,17 +95,23 @@ class GitHubCallbackEndpoint(View):
            user = provider.authenticate()
            # Login the user and record his device info
            user_login(request=request, user=user, is_app=True)
-            # Get the redirection path
            if next_path:
-                path = str(validate_next_path(next_path))
+                path = next_path
            else:
                path = get_redirection_path(user=user)
-            # redirect to referer path
-            url = urljoin(base_host, path)
+
+            # Get the safe redirect URL
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=path,
+                params={}
+            )
            return HttpResponseRedirect(url)
        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(base_host, "?" + urlencode(params))
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)
@@ -1,5 +1,5 @@
+# Python imports
 import uuid
-from urllib.parse import urlencode, urljoin

 # Django import
 from django.http import HttpResponseRedirect
@@ -16,7 +16,7 @@ from plane.authentication.adapter.error import (
    AuthenticationException,
    AUTHENTICATION_ERROR_CODES,
 )
-from plane.utils.path_validator import validate_next_path
+from plane.utils.path_validator import get_safe_redirect_url


 class GitLabOauthInitiateEndpoint(View):
@@ -25,7 +25,7 @@ class GitLabOauthInitiateEndpoint(View):
        request.session["host"] = base_host(request=request, is_app=True)
        next_path = request.GET.get("next_path")
        if next_path:
-            request.session["next_path"] = str(validate_next_path(next_path))
+            request.session["next_path"] = str(next_path)

        # Check instance configuration
        instance = Instance.objects.first()
@@ -35,10 +35,10 @@ class GitLabOauthInitiateEndpoint(View):
                error_message="INSTANCE_NOT_CONFIGURED",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params
            )
            return HttpResponseRedirect(url)
        try:
@@ -49,10 +49,10 @@ class GitLabOauthInitiateEndpoint(View):
            return HttpResponseRedirect(auth_url)
        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params
            )
            return HttpResponseRedirect(url)

@@ -61,7 +61,6 @@ class GitLabCallbackEndpoint(View):
    def get(self, request):
        code = request.GET.get("code")
        state = request.GET.get("state")
-        base_host = request.session.get("host")
        next_path = request.session.get("next_path")

        if state != request.session.get("state", ""):
@@ -70,9 +69,11 @@ class GitLabCallbackEndpoint(View):
                error_message="GITLAB_OAUTH_PROVIDER_ERROR",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(next_path)
-            url = urljoin(base_host, "?" + urlencode(params))
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        if not code:
@@ -81,9 +82,11 @@ class GitLabCallbackEndpoint(View):
                error_message="GITLAB_OAUTH_PROVIDER_ERROR",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(base_host, "?" + urlencode(params))
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        try:
@@ -94,16 +97,23 @@ class GitLabCallbackEndpoint(View):
            # Login the user and record his device info
            user_login(request=request, user=user, is_app=True)
            # Get the redirection path
+
            if next_path:
-                path = str(validate_next_path(next_path))
+                path = next_path
            else:
                path = get_redirection_path(user=user)
            # redirect to referer path
-            url = urljoin(base_host, path)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=path,
+                params={}
+            )
            return HttpResponseRedirect(url)
        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(base_host, "?" + urlencode(params))
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)
@@ -1,6 +1,5 @@
 # Python imports
 import uuid
-from urllib.parse import urlencode, urljoin

 # Django import
 from django.http import HttpResponseRedirect
@@ -18,7 +17,7 @@ from plane.authentication.adapter.error import (
    AuthenticationException,
    AUTHENTICATION_ERROR_CODES,
 )
-from plane.utils.path_validator import validate_next_path
+from plane.utils.path_validator import get_safe_redirect_url


 class GoogleOauthInitiateEndpoint(View):
@@ -36,10 +35,10 @@ class GoogleOauthInitiateEndpoint(View):
                error_message="INSTANCE_NOT_CONFIGURED",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params
            )
            return HttpResponseRedirect(url)

@@ -51,10 +50,10 @@ class GoogleOauthInitiateEndpoint(View):
            return HttpResponseRedirect(auth_url)
        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params
            )
            return HttpResponseRedirect(url)

@@ -63,7 +62,6 @@ class GoogleCallbackEndpoint(View):
    def get(self, request):
        code = request.GET.get("code")
        state = request.GET.get("state")
-        base_host = request.session.get("host")
        next_path = request.session.get("next_path")

        if state != request.session.get("state", ""):
@@ -72,9 +70,11 @@ class GoogleCallbackEndpoint(View):
                error_message="GOOGLE_OAUTH_PROVIDER_ERROR",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(base_host, "?" + urlencode(params))
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)
        if not code:
            exc = AuthenticationException(
@@ -82,9 +82,11 @@ class GoogleCallbackEndpoint(View):
                error_message="GOOGLE_OAUTH_PROVIDER_ERROR",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(base_host, "?" + urlencode(params))
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)
        try:
            provider = GoogleOAuthProvider(
@@ -94,15 +96,21 @@ class GoogleCallbackEndpoint(View):
            # Login the user and record his device info
            user_login(request=request, user=user, is_app=True)
            # Get the redirection path
-            path = get_redirection_path(user=user)
-            # redirect to referer path
-            url = urljoin(
-                base_host, str(validate_next_path(next_path)) if next_path else path
+            if next_path:
+                path = next_path
+            else:
+                path = get_redirection_path(user=user)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=path,
+                params={}
            )
            return HttpResponseRedirect(url)
        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(base_host, "?" + urlencode(params))
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)
@@ -1,6 +1,3 @@
-# Python imports
-from urllib.parse import urlencode, urljoin
-
 # Django imports
 from django.core.validators import validate_email
 from django.http import HttpResponseRedirect
@@ -26,7 +23,7 @@ from plane.authentication.adapter.error import (
    AUTHENTICATION_ERROR_CODES,
 )
 from plane.authentication.rate_limit import AuthenticationThrottle
-from plane.utils.path_validator import validate_next_path
+from plane.utils.path_validator import get_safe_redirect_url


 class MagicGenerateEndpoint(APIView):
@@ -72,10 +69,10 @@ class MagicSignInEndpoint(View):
                error_message="MAGIC_SIGN_IN_EMAIL_CODE_REQUIRED",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "sign-in?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
            )
            return HttpResponseRedirect(url)

@@ -88,10 +85,10 @@ class MagicSignInEndpoint(View):
                error_message="USER_DOES_NOT_EXIST",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "sign-in?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
            )
            return HttpResponseRedirect(url)

@@ -107,7 +104,8 @@ class MagicSignInEndpoint(View):
            # Login the user and record his device info
            user_login(request=request, user=user, is_app=True)
            if user.is_password_autoset and profile.is_onboarded:
-                path = "accounts/set-password"
+                # Redirect to the home page
+                path = "/"
            else:
                # Get the redirection path
                path = (
@@ -116,15 +114,19 @@ class MagicSignInEndpoint(View):
                    else str(get_redirection_path(user=user))
                )
            # redirect to referer path
-            url = urljoin(base_host(request=request, is_app=True), path)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=path,
+                params={},
+            )
            return HttpResponseRedirect(url)

        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "sign-in?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
            )
            return HttpResponseRedirect(url)

@@ -144,10 +146,10 @@ class MagicSignUpEndpoint(View):
                error_message="MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
            )
            return HttpResponseRedirect(url)
        # Existing user
@@ -158,10 +160,10 @@ class MagicSignUpEndpoint(View):
                error_message="USER_ALREADY_EXIST",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
            )
            return HttpResponseRedirect(url)

@@ -177,18 +179,22 @@ class MagicSignUpEndpoint(View):
            user_login(request=request, user=user, is_app=True)
            # Get the redirection path
            if next_path:
-                path = str(validate_next_path(next_path))
+                path = next_path
            else:
                path = get_redirection_path(user=user)
            # redirect to referer path
-            url = urljoin(base_host(request=request, is_app=True), path)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=path,
+                params={},
+            )
            return HttpResponseRedirect(url)

        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = urljoin(
-                base_host(request=request, is_app=True), "?" + urlencode(params)
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_app=True),
+                next_path=next_path,
+                params=params,
            )
            return HttpResponseRedirect(url)
@@ -1,11 +1,9 @@
-# Python imports
-from urllib.parse import urlencode
-
 # Django imports
 from django.core.exceptions import ValidationError
 from django.core.validators import validate_email
 from django.http import HttpResponseRedirect
 from django.views import View
+from django.utils.http import url_has_allowed_host_and_scheme

 # Module imports
 from plane.authentication.provider.credentials.email import EmailProvider
@@ -17,7 +15,7 @@ from plane.authentication.adapter.error import (
    AUTHENTICATION_ERROR_CODES,
    AuthenticationException,
 )
-from plane.utils.path_validator import validate_next_path
+from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts


 class SignInAuthSpaceEndpoint(View):
@@ -32,9 +30,11 @@ class SignInAuthSpaceEndpoint(View):
                error_message="INSTANCE_NOT_CONFIGURED",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        # set the referer as session to redirect after login
@@ -51,9 +51,11 @@ class SignInAuthSpaceEndpoint(View):
                payload={"email": str(email)},
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        # Validate email
@@ -67,9 +69,11 @@ class SignInAuthSpaceEndpoint(View):
                payload={"email": str(email)},
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        # Existing User
@@ -82,9 +86,11 @@ class SignInAuthSpaceEndpoint(View):
                payload={"email": str(email)},
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        try:
@@ -94,14 +100,20 @@ class SignInAuthSpaceEndpoint(View):
            user = provider.authenticate()
            # Login the user and record his device info
            user_login(request=request, user=user, is_space=True)
-            # redirect to next path
-            url = f"{base_host(request=request, is_space=True)}{str(next_path) if next_path else ''}"
-            return HttpResponseRedirect(url)
+            # redirect to referer path
+            next_path = validate_next_path(next_path=next_path)
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)


@@ -117,9 +129,11 @@ class SignUpAuthSpaceEndpoint(View):
                error_message="INSTANCE_NOT_CONFIGURED",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        email = request.POST.get("email", False)
@@ -135,9 +149,11 @@ class SignUpAuthSpaceEndpoint(View):
                payload={"email": str(email)},
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)
        # Validate the email
        email = email.strip().lower()
@@ -151,9 +167,11 @@ class SignUpAuthSpaceEndpoint(View):
                payload={"email": str(email)},
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        # Existing User
@@ -166,9 +184,11 @@ class SignUpAuthSpaceEndpoint(View):
                payload={"email": str(email)},
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        try:
@@ -179,11 +199,17 @@ class SignUpAuthSpaceEndpoint(View):
            # Login the user and record his device info
            user_login(request=request, user=user, is_space=True)
            # redirect to referer path
-            url = f"{base_host(request=request, is_space=True)}{str(next_path) if next_path else ''}"
-            return HttpResponseRedirect(url)
+            next_path = validate_next_path(next_path=next_path)
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)
@@ -1,10 +1,10 @@
 # Python imports
 import uuid
-from urllib.parse import urlencode

 # Django import
 from django.http import HttpResponseRedirect
 from django.views import View
+from django.utils.http import url_has_allowed_host_and_scheme

 # Module imports
 from plane.authentication.provider.oauth.github import GitHubOAuthProvider
@@ -15,7 +15,7 @@ from plane.authentication.adapter.error import (
    AUTHENTICATION_ERROR_CODES,
    AuthenticationException,
 )
-from plane.utils.path_validator import validate_next_path
+from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts


 class GitHubOauthInitiateSpaceEndpoint(View):
@@ -23,9 +23,6 @@ class GitHubOauthInitiateSpaceEndpoint(View):
        # Get host and next path
        request.session["host"] = base_host(request=request, is_space=True)
        next_path = request.GET.get("next_path")
-        if next_path:
-            request.session["next_path"] = str(next_path)
-
        # Check instance configuration
        instance = Instance.objects.first()
        if instance is None or not instance.is_setup_done:
@@ -34,9 +31,11 @@ class GitHubOauthInitiateSpaceEndpoint(View):
                error_message="INSTANCE_NOT_CONFIGURED",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        try:
@@ -47,9 +46,11 @@ class GitHubOauthInitiateSpaceEndpoint(View):
            return HttpResponseRedirect(auth_url)
        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(next_path)
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)


@@ -66,9 +67,11 @@ class GitHubCallbackSpaceEndpoint(View):
                error_message="GITHUB_OAUTH_PROVIDER_ERROR",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        if not code:
@@ -77,9 +80,11 @@ class GitHubCallbackSpaceEndpoint(View):
                error_message="GITHUB_OAUTH_PROVIDER_ERROR",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        try:
@@ -89,11 +94,18 @@ class GitHubCallbackSpaceEndpoint(View):
            user_login(request=request, user=user, is_space=True)
            # Process workspace and project invitations
            # redirect to referer path
-            url = f"{base_host(request=request, is_space=True)}{str(next_path) if next_path else ''}"
-            return HttpResponseRedirect(url)
+            next_path = validate_next_path(next_path=next_path)
+            
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)
@@ -1,10 +1,10 @@
 # Python imports
 import uuid
-from urllib.parse import urlencode

 # Django import
 from django.http import HttpResponseRedirect
 from django.views import View
+from django.utils.http import url_has_allowed_host_and_scheme

 # Module imports
 from plane.authentication.provider.oauth.gitlab import GitLabOAuthProvider
@@ -15,7 +15,8 @@ from plane.authentication.adapter.error import (
    AUTHENTICATION_ERROR_CODES,
    AuthenticationException,
 )
-from plane.utils.path_validator import validate_next_path
+from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts
+


 class GitLabOauthInitiateSpaceEndpoint(View):
@@ -23,8 +24,6 @@ class GitLabOauthInitiateSpaceEndpoint(View):
        # Get host and next path
        request.session["host"] = base_host(request=request, is_space=True)
        next_path = request.GET.get("next_path")
-        if next_path:
-            request.session["next_path"] = str(next_path)

        # Check instance configuration
        instance = Instance.objects.first()
@@ -34,9 +33,11 @@ class GitLabOauthInitiateSpaceEndpoint(View):
                error_message="INSTANCE_NOT_CONFIGURED",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        try:
@@ -47,9 +48,11 @@ class GitLabOauthInitiateSpaceEndpoint(View):
            return HttpResponseRedirect(auth_url)
        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(next_path)
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)


@@ -66,9 +69,11 @@ class GitLabCallbackSpaceEndpoint(View):
                error_message="GITLAB_OAUTH_PROVIDER_ERROR",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        if not code:
@@ -77,9 +82,11 @@ class GitLabCallbackSpaceEndpoint(View):
                error_message="GITLAB_OAUTH_PROVIDER_ERROR",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        try:
@@ -89,11 +96,18 @@ class GitLabCallbackSpaceEndpoint(View):
            user_login(request=request, user=user, is_space=True)
            # Process workspace and project invitations
            # redirect to referer path
-            url = f"{base_host(request=request, is_space=True)}{str(next_path) if next_path else ''}"
-            return HttpResponseRedirect(url)
+            next_path = validate_next_path(next_path=next_path)
+
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)
@@ -1,10 +1,10 @@
 # Python imports
 import uuid
-from urllib.parse import urlencode

 # Django import
 from django.http import HttpResponseRedirect
 from django.views import View
+from django.utils.http import url_has_allowed_host_and_scheme

 # Module imports
 from plane.authentication.provider.oauth.google import GoogleOAuthProvider
@@ -15,15 +15,13 @@ from plane.authentication.adapter.error import (
    AuthenticationException,
    AUTHENTICATION_ERROR_CODES,
 )
-from plane.utils.path_validator import validate_next_path
+from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts


 class GoogleOauthInitiateSpaceEndpoint(View):
    def get(self, request):
        request.session["host"] = base_host(request=request, is_space=True)
        next_path = request.GET.get("next_path")
-        if next_path:
-            request.session["next_path"] = str(next_path)

        # Check instance configuration
        instance = Instance.objects.first()
@@ -33,9 +31,11 @@ class GoogleOauthInitiateSpaceEndpoint(View):
                error_message="INSTANCE_NOT_CONFIGURED",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)

        try:
@@ -46,9 +46,11 @@ class GoogleOauthInitiateSpaceEndpoint(View):
            return HttpResponseRedirect(auth_url)
        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)


@@ -65,9 +67,11 @@ class GoogleCallbackSpaceEndpoint(View):
                error_message="GOOGLE_OAUTH_PROVIDER_ERROR",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)
        if not code:
            exc = AuthenticationException(
@@ -75,9 +79,11 @@ class GoogleCallbackSpaceEndpoint(View):
                error_message="GOOGLE_OAUTH_PROVIDER_ERROR",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)
        try:
            provider = GoogleOAuthProvider(request=request, code=code)
@@ -85,11 +91,18 @@ class GoogleCallbackSpaceEndpoint(View):
            # Login the user and record his device info
            user_login(request=request, user=user, is_space=True)
            # redirect to referer path
-            url = f"{base_host(request=request, is_space=True)}{str(next_path) if next_path else ''}"
-            return HttpResponseRedirect(url)
+            next_path = validate_next_path(next_path=next_path)
+
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))
        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params
+            )
            return HttpResponseRedirect(url)
@@ -1,10 +1,8 @@
-# Python imports
-from urllib.parse import urlencode
-
 # Django imports
 from django.core.validators import validate_email
 from django.http import HttpResponseRedirect
 from django.views import View
+from django.utils.http import url_has_allowed_host_and_scheme

 # Third party imports
 from rest_framework import status
@@ -23,7 +21,7 @@ from plane.authentication.adapter.error import (
    AuthenticationException,
    AUTHENTICATION_ERROR_CODES,
 )
-from plane.utils.path_validator import validate_next_path
+from plane.utils.path_validator import get_safe_redirect_url, validate_next_path, get_allowed_hosts


 class MagicGenerateSpaceEndpoint(APIView):
@@ -66,9 +64,11 @@ class MagicSignInSpaceEndpoint(View):
                error_message="MAGIC_SIGN_IN_EMAIL_CODE_REQUIRED",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
            return HttpResponseRedirect(url)

        existing_user = User.objects.filter(email=email).first()
@@ -79,9 +79,11 @@ class MagicSignInSpaceEndpoint(View):
                error_message="USER_DOES_NOT_EXIST",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
            return HttpResponseRedirect(url)

        # Active User
@@ -93,15 +95,20 @@ class MagicSignInSpaceEndpoint(View):
            # Login the user and record his device info
            user_login(request=request, user=user, is_space=True)
            # redirect to referer path
-            path = str(next_path) if next_path else ""
-            url = f"{base_host(request=request, is_space=True)}{path}"
-            return HttpResponseRedirect(url)
+            next_path = validate_next_path(next_path=next_path)
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))

        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(next_path)
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
            return HttpResponseRedirect(url)


@@ -120,9 +127,11 @@ class MagicSignUpSpaceEndpoint(View):
                error_message="MAGIC_SIGN_UP_EMAIL_CODE_REQUIRED",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
            return HttpResponseRedirect(url)
        # Existing User
        existing_user = User.objects.filter(email=email).first()
@@ -133,9 +142,11 @@ class MagicSignUpSpaceEndpoint(View):
                error_message="USER_ALREADY_EXIST",
            )
            params = exc.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
            return HttpResponseRedirect(url)

        try:
@@ -146,12 +157,18 @@ class MagicSignUpSpaceEndpoint(View):
            # Login the user and record his device info
            user_login(request=request, user=user, is_space=True)
            # redirect to referer path
-            url = f"{base_host(request=request, is_space=True)}{str(next_path) if next_path else ''}"
-            return HttpResponseRedirect(url)
+            next_path = validate_next_path(next_path=next_path)
+            url = f"{base_host(request=request, is_space=True).rstrip('/')}{next_path}"
+            if url_has_allowed_host_and_scheme(url, allowed_hosts=get_allowed_hosts()):
+                return HttpResponseRedirect(url)
+            else:
+                return HttpResponseRedirect(base_host(request=request, is_space=True))

        except AuthenticationException as e:
            params = e.get_error_dict()
-            if next_path:
-                params["next_path"] = str(validate_next_path(next_path))
-            url = f"{base_host(request=request, is_space=True)}?{urlencode(params)}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path,
+                params=params,
+            )
            return HttpResponseRedirect(url)
@@ -7,7 +7,7 @@ from django.utils import timezone
 # Module imports
 from plane.authentication.utils.host import base_host, user_ip
 from plane.db.models import User
-from plane.utils.path_validator import validate_next_path
+from plane.utils.path_validator import get_safe_redirect_url


 class SignOutAuthSpaceEndpoint(View):
@@ -22,8 +22,14 @@ class SignOutAuthSpaceEndpoint(View):
            user.save()
            # Log the user out
            logout(request)
-            url = f"{base_host(request=request, is_space=True)}{str(validate_next_path(next_path)) if next_path else ''}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path
+            )
            return HttpResponseRedirect(url)
        except Exception:
-            url = f"{base_host(request=request, is_space=True)}{str(validate_next_path(next_path)) if next_path else ''}"
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_space=True),
+                next_path=next_path
+            )
            return HttpResponseRedirect(url)
@@ -1,15 +0,0 @@
-from django.utils import timezone
-from datetime import timedelta
-from plane.db.models import APIActivityLog
-from celery import shared_task
-
-
-@shared_task
-def delete_api_logs():
-    # Get the logs older than 30 days to delete
-    logs_to_delete = APIActivityLog.objects.filter(
-        created_at__lte=timezone.now() - timedelta(days=30)
-    )
-
-    # Delete the logs
-    logs_to_delete._raw_delete(logs_to_delete.db)
@@ -0,0 +1,484 @@
+# Python imports
+from datetime import timedelta
+import logging
+from typing import List, Dict, Any, Callable, Optional
+import os
+
+# Django imports
+from django.utils import timezone
+from django.db.models import F, Window, Subquery
+from django.db.models.functions import RowNumber
+
+# Third party imports
+from celery import shared_task
+from pymongo.errors import BulkWriteError
+from pymongo.collection import Collection
+from pymongo.operations import InsertOne
+
+# Module imports
+from plane.db.models import (
+    EmailNotificationLog,
+    PageVersion,
+    APIActivityLog,
+    IssueDescriptionVersion,
+    WebhookLog,
+)
+from plane.settings.mongo import MongoConnection
+from plane.utils.exception_logger import log_exception
+
+
+logger = logging.getLogger("plane.worker")
+BATCH_SIZE = 500
+
+
+def get_mongo_collection(collection_name: str) -> Optional[Collection]:
+    """Get MongoDB collection if available, otherwise return None."""
+    if not MongoConnection.is_configured():
+        logger.info("MongoDB not configured")
+        return None
+
+    try:
+        mongo_collection = MongoConnection.get_collection(collection_name)
+        logger.info(f"MongoDB collection '{collection_name}' connected successfully")
+        return mongo_collection
+    except Exception as e:
+        logger.error(f"Failed to get MongoDB collection: {str(e)}")
+        log_exception(e)
+        return None
+
+
+def flush_to_mongo_and_delete(
+    mongo_collection: Optional[Collection],
+    buffer: List[Dict[str, Any]],
+    ids_to_delete: List[int],
+    model,
+    mongo_available: bool,
+) -> None:
+    """
+    Inserts a batch of records into MongoDB and deletes the corresponding rows from PostgreSQL.
+    """
+    if not buffer:
+        logger.debug("No records to flush - buffer is empty")
+        return
+
+    logger.info(
+        f"Starting batch flush: {len(buffer)} records, {len(ids_to_delete)} IDs to delete"
+    )
+
+    mongo_archival_failed = False
+
+    # Try to insert into MongoDB if available
+    if mongo_collection is not None and mongo_available:
+        try:
+            mongo_collection.bulk_write([InsertOne(doc) for doc in buffer])
+        except BulkWriteError as bwe:
+            logger.error(f"MongoDB bulk write error: {str(bwe)}")
+            log_exception(bwe)
+            mongo_archival_failed = True
+
+    # If MongoDB is available and archival failed, log the error and return
+    if mongo_available and mongo_archival_failed:
+        logger.error(f"MongoDB archival failed for {len(buffer)} records")
+        return
+
+    # Delete from PostgreSQL - delete() returns (count, {model: count})
+    delete_result = model.all_objects.filter(id__in=ids_to_delete).delete()
+    deleted_count = (
+        delete_result[0] if delete_result and isinstance(delete_result, tuple) else 0
+    )
+    logger.info(f"Batch flush completed: {deleted_count} records deleted")
+
+
+def process_cleanup_task(
+    queryset_func: Callable,
+    transform_func: Callable[[Dict], Dict],
+    model,
+    task_name: str,
+    collection_name: str,
+):
+    """
+    Generic function to process cleanup tasks.
+
+    Args:
+        queryset_func: Function that returns the queryset to process
+        transform_func: Function to transform each record for MongoDB
+        model: Django model class
+        task_name: Name of the task for logging
+        collection_name: MongoDB collection name
+    """
+    logger.info(f"Starting {task_name} cleanup task")
+
+    # Get MongoDB collection
+    mongo_collection = get_mongo_collection(collection_name)
+    mongo_available = mongo_collection is not None
+
+    # Get queryset
+    queryset = queryset_func()
+
+    # Process records in batches
+    buffer: List[Dict[str, Any]] = []
+    ids_to_delete: List[int] = []
+    total_processed = 0
+    total_batches = 0
+
+    for record in queryset:
+        # Transform record for MongoDB
+        buffer.append(transform_func(record))
+        ids_to_delete.append(record["id"])
+
+        # Flush batch when it reaches BATCH_SIZE
+        if len(buffer) >= BATCH_SIZE:
+            total_batches += 1
+            flush_to_mongo_and_delete(
+                mongo_collection=mongo_collection,
+                buffer=buffer,
+                ids_to_delete=ids_to_delete,
+                model=model,
+                mongo_available=mongo_available,
+            )
+            total_processed += len(buffer)
+            buffer.clear()
+            ids_to_delete.clear()
+
+    # Process final batch if any records remain
+    if buffer:
+        total_batches += 1
+        flush_to_mongo_and_delete(
+            mongo_collection=mongo_collection,
+            buffer=buffer,
+            ids_to_delete=ids_to_delete,
+            model=model,
+            mongo_available=mongo_available,
+        )
+        total_processed += len(buffer)
+
+    logger.info(
+        f"{task_name} cleanup task completed",
+        extra={
+            "total_records_processed": total_processed,
+            "total_batches": total_batches,
+            "mongo_available": mongo_available,
+            "collection_name": collection_name,
+        },
+    )
+
+
+# Transform functions for each model
+def transform_api_log(record: Dict) -> Dict:
+    """Transform API activity log record."""
+    return {
+        "id": str(record["id"]),
+        "created_at": str(record["created_at"]) if record.get("created_at") else None,
+        "token_identifier": str(record["token_identifier"]),
+        "path": record["path"],
+        "method": record["method"],
+        "query_params": record.get("query_params"),
+        "headers": record.get("headers"),
+        "body": record.get("body"),
+        "response_code": record["response_code"],
+        "response_body": record["response_body"],
+        "ip_address": record["ip_address"],
+        "user_agent": record["user_agent"],
+        "created_by_id": str(record["created_by_id"]),
+    }
+
+
+def transform_email_log(record: Dict) -> Dict:
+    """Transform email notification log record."""
+    return {
+        "id": str(record["id"]),
+        "created_at": str(record["created_at"]) if record.get("created_at") else None,
+        "receiver_id": str(record["receiver_id"]),
+        "triggered_by_id": str(record["triggered_by_id"]),
+        "entity_identifier": str(record["entity_identifier"]),
+        "entity_name": record["entity_name"],
+        "data": record["data"],
+        "processed_at": (
+            str(record["processed_at"]) if record.get("processed_at") else None
+        ),
+        "sent_at": str(record["sent_at"]) if record.get("sent_at") else None,
+        "entity": record["entity"],
+        "old_value": str(record["old_value"]),
+        "new_value": str(record["new_value"]),
+        "created_by_id": str(record["created_by_id"]),
+    }
+
+
+def transform_page_version(record: Dict) -> Dict:
+    """Transform page version record."""
+    return {
+        "id": str(record["id"]),
+        "created_at": str(record["created_at"]) if record.get("created_at") else None,
+        "page_id": str(record["page_id"]),
+        "workspace_id": str(record["workspace_id"]),
+        "owned_by_id": str(record["owned_by_id"]),
+        "description_html": record["description_html"],
+        "description_binary": record["description_binary"],
+        "description_stripped": record["description_stripped"],
+        "description_json": record["description_json"],
+        "sub_pages_data": record["sub_pages_data"],
+        "created_by_id": str(record["created_by_id"]),
+        "updated_by_id": str(record["updated_by_id"]),
+        "deleted_at": str(record["deleted_at"]) if record.get("deleted_at") else None,
+        "last_saved_at": (
+            str(record["last_saved_at"]) if record.get("last_saved_at") else None
+        ),
+    }
+
+
+def transform_issue_description_version(record: Dict) -> Dict:
+    """Transform issue description version record."""
+    return {
+        "id": str(record["id"]),
+        "created_at": str(record["created_at"]) if record.get("created_at") else None,
+        "issue_id": str(record["issue_id"]),
+        "workspace_id": str(record["workspace_id"]),
+        "project_id": str(record["project_id"]),
+        "created_by_id": str(record["created_by_id"]),
+        "updated_by_id": str(record["updated_by_id"]),
+        "owned_by_id": str(record["owned_by_id"]),
+        "last_saved_at": (
+            str(record["last_saved_at"]) if record.get("last_saved_at") else None
+        ),
+        "description_binary": record["description_binary"],
+        "description_html": record["description_html"],
+        "description_stripped": record["description_stripped"],
+        "description_json": record["description_json"],
+        "deleted_at": str(record["deleted_at"]) if record.get("deleted_at") else None,
+    }
+
+
+def transform_webhook_log(record: Dict):
+    """Transfer webhook logs to a new destination."""
+    return {
+        "id": str(record["id"]),
+        "created_at": str(record["created_at"]) if record.get("created_at") else None,
+        "workspace_id": str(record["workspace_id"]),
+        "webhook": str(record["webhook"]),
+        # Request
+        "event_type": str(record["event_type"]),
+        "request_method": str(record["request_method"]),
+        "request_headers": str(record["request_headers"]),
+        "request_body": str(record["request_body"]),
+        # Response
+        "response_status": str(record["response_status"]),
+        "response_body": str(record["response_body"]),
+        "response_headers": str(record["response_headers"]),
+        # retry count
+        "retry_count": str(record["retry_count"]),
+    }
+
+
+# Queryset functions for each cleanup task
+def get_api_logs_queryset():
+    """Get API logs older than cutoff days."""
+    cutoff_days = int(os.environ.get("HARD_DELETE_AFTER_DAYS", 30))
+    cutoff_time = timezone.now() - timedelta(days=cutoff_days)
+    logger.info(f"API logs cutoff time: {cutoff_time}")
+
+    return (
+        APIActivityLog.all_objects.filter(created_at__lte=cutoff_time)
+        .values(
+            "id",
+            "created_at",
+            "token_identifier",
+            "path",
+            "method",
+            "query_params",
+            "headers",
+            "body",
+            "response_code",
+            "response_body",
+            "ip_address",
+            "user_agent",
+            "created_by_id",
+        )
+        .iterator(chunk_size=BATCH_SIZE)
+    )
+
+
+def get_email_logs_queryset():
+    """Get email logs older than cutoff days."""
+    cutoff_days = int(os.environ.get("HARD_DELETE_AFTER_DAYS", 30))
+    cutoff_time = timezone.now() - timedelta(days=cutoff_days)
+    logger.info(f"Email logs cutoff time: {cutoff_time}")
+
+    return (
+        EmailNotificationLog.all_objects.filter(sent_at__lte=cutoff_time)
+        .values(
+            "id",
+            "created_at",
+            "receiver_id",
+            "triggered_by_id",
+            "entity_identifier",
+            "entity_name",
+            "data",
+            "processed_at",
+            "sent_at",
+            "entity",
+            "old_value",
+            "new_value",
+            "created_by_id",
+        )
+        .iterator(chunk_size=BATCH_SIZE)
+    )
+
+
+def get_page_versions_queryset():
+    """Get page versions beyond the maximum allowed (20 per page)."""
+    subq = (
+        PageVersion.all_objects.annotate(
+            row_num=Window(
+                expression=RowNumber(),
+                partition_by=[F("page_id")],
+                order_by=F("created_at").desc(),
+            )
+        )
+        .filter(row_num__gt=20)
+        .values("id")
+    )
+
+    return (
+        PageVersion.all_objects.filter(id__in=Subquery(subq))
+        .values(
+            "id",
+            "created_at",
+            "page_id",
+            "workspace_id",
+            "owned_by_id",
+            "description_html",
+            "description_binary",
+            "description_stripped",
+            "description_json",
+            "sub_pages_data",
+            "created_by_id",
+            "updated_by_id",
+            "deleted_at",
+            "last_saved_at",
+        )
+        .iterator(chunk_size=BATCH_SIZE)
+    )
+
+
+def get_issue_description_versions_queryset():
+    """Get issue description versions beyond the maximum allowed (20 per issue)."""
+    subq = (
+        IssueDescriptionVersion.all_objects.annotate(
+            row_num=Window(
+                expression=RowNumber(),
+                partition_by=[F("issue_id")],
+                order_by=F("created_at").desc(),
+            )
+        )
+        .filter(row_num__gt=20)
+        .values("id")
+    )
+
+    return (
+        IssueDescriptionVersion.all_objects.filter(id__in=Subquery(subq))
+        .values(
+            "id",
+            "created_at",
+            "issue_id",
+            "workspace_id",
+            "project_id",
+            "created_by_id",
+            "updated_by_id",
+            "owned_by_id",
+            "last_saved_at",
+            "description_binary",
+            "description_html",
+            "description_stripped",
+            "description_json",
+            "deleted_at",
+        )
+        .iterator(chunk_size=BATCH_SIZE)
+    )
+
+
+def get_webhook_logs_queryset():
+    """Get email logs older than cutoff days."""
+    cutoff_days = int(os.environ.get("HARD_DELETE_AFTER_DAYS", 30))
+    cutoff_time = timezone.now() - timedelta(days=cutoff_days)
+    logger.info(f"Webhook logs cutoff time: {cutoff_time}")
+
+    return (
+        WebhookLog.all_objects.filter(created_at__lte=cutoff_time)
+        .values(
+            "id",
+            "created_at",
+            "workspace_id",
+            "webhook",
+            "event_type",
+            # Request
+            "request_method",
+            "request_headers",
+            "request_body",
+            # Response
+            "response_status",
+            "response_body",
+            "response_headers",
+            "retry_count",
+        )
+        .iterator(chunk_size=BATCH_SIZE)
+    )
+
+
+@shared_task
+def delete_api_logs():
+    """Delete old API activity logs."""
+    process_cleanup_task(
+        queryset_func=get_api_logs_queryset,
+        transform_func=transform_api_log,
+        model=APIActivityLog,
+        task_name="API Activity Log",
+        collection_name="api_activity_logs",
+    )
+
+
+@shared_task
+def delete_email_notification_logs():
+    """Delete old email notification logs."""
+    process_cleanup_task(
+        queryset_func=get_email_logs_queryset,
+        transform_func=transform_email_log,
+        model=EmailNotificationLog,
+        task_name="Email Notification Log",
+        collection_name="email_notification_logs",
+    )
+
+
+@shared_task
+def delete_page_versions():
+    """Delete excess page versions."""
+    process_cleanup_task(
+        queryset_func=get_page_versions_queryset,
+        transform_func=transform_page_version,
+        model=PageVersion,
+        task_name="Page Version",
+        collection_name="page_versions",
+    )
+
+
+@shared_task
+def delete_issue_description_versions():
+    """Delete excess issue description versions."""
+    process_cleanup_task(
+        queryset_func=get_issue_description_versions_queryset,
+        transform_func=transform_issue_description_version,
+        model=IssueDescriptionVersion,
+        task_name="Issue Description Version",
+        collection_name="issue_description_versions",
+    )
+
+
+@shared_task
+def delete_webhook_logs():
+    """Delete old webhook logs"""
+    process_cleanup_task(
+        queryset_func=get_webhook_logs_queryset,
+        transform_func=transform_webhook_log,
+        model=WebhookLog,
+        task_name="Webhook Log",
+        collection_name="webhook_logs",
+    )
@@ -34,6 +34,14 @@ from plane.utils.issue_relation_mapper import get_inverse_relation
 from plane.utils.uuid import is_valid_uuid


+def extract_ids(data: dict | None, primary_key: str, fallback_key: str) -> set[str]:
+    if not data:
+        return set()
+    if primary_key in data:
+        return {str(x) for x in data.get(primary_key, [])}
+    return {str(x) for x in data.get(fallback_key, [])}
+
+
 # Track Changes in name
 def track_name(
    requested_data,
@@ -116,18 +124,32 @@ def track_parent(
    issue_activities,
    epoch,
 ):
-    if current_instance.get("parent_id") != requested_data.get("parent_id"):
+    current_parent_id = current_instance.get("parent_id") or current_instance.get(
+        "parent"
+    )
+    requested_parent_id = requested_data.get("parent_id") or requested_data.get(
+        "parent"
+    )
+
+    # Validate UUIDs before database queries
+    if current_parent_id is not None and not is_valid_uuid(current_parent_id):
+        return
+    if requested_parent_id is not None and not is_valid_uuid(requested_parent_id):
+        return
+
+    if current_parent_id != requested_parent_id:
        old_parent = (
-            Issue.objects.filter(pk=current_instance.get("parent_id")).first()
-            if current_instance.get("parent_id") is not None
+            Issue.objects.filter(pk=current_parent_id).first()
+            if current_parent_id is not None
            else None
        )
        new_parent = (
-            Issue.objects.filter(pk=requested_data.get("parent_id")).first()
-            if requested_data.get("parent_id") is not None
+            Issue.objects.filter(pk=requested_parent_id).first()
+            if requested_parent_id is not None
            else None
        )

+
        issue_activities.append(
            IssueActivity(
                issue_id=issue_id,
@@ -193,23 +215,31 @@ def track_state(
    issue_activities,
    epoch,
 ):
-    if current_instance.get("state_id") != requested_data.get("state_id"):
-        new_state = State.objects.get(pk=requested_data.get("state_id", None))
-        old_state = State.objects.get(pk=current_instance.get("state_id", None))
+    current_state_id = current_instance.get("state_id") or current_instance.get("state")
+    requested_state_id = requested_data.get("state_id") or requested_data.get("state")
+
+    if current_state_id is not None and not is_valid_uuid(current_state_id):
+        current_state_id = None
+    if requested_state_id is not None and not is_valid_uuid(requested_state_id):
+        requested_state_id = None
+
+    if current_state_id != requested_state_id:
+        new_state = State.objects.filter(pk=requested_state_id, project_id=project_id).first()
+        old_state = State.objects.filter(pk=current_state_id, project_id=project_id).first()

        issue_activities.append(
            IssueActivity(
                issue_id=issue_id,
                actor_id=actor_id,
                verb="updated",
-                old_value=old_state.name,
-                new_value=new_state.name,
+                old_value=old_state.name if old_state else None,
+                new_value=new_state.name if new_state else None,
                field="state",
                project_id=project_id,
                workspace_id=workspace_id,
                comment="updated the state to",
-                old_identifier=old_state.id,
-                new_identifier=new_state.id,
+                old_identifier=old_state.id if old_state else None,
+                new_identifier=new_state.id if new_state else None,
                epoch=epoch,
            )
        )
@@ -298,8 +328,10 @@ def track_labels(
    issue_activities,
    epoch,
 ):
-    requested_labels = set([str(lab) for lab in requested_data.get("label_ids", [])])
-    current_labels = set([str(lab) for lab in current_instance.get("label_ids", [])])
+
+    # Labels
+    requested_labels = extract_ids(requested_data, "label_ids", "labels")
+    current_labels = extract_ids(current_instance, "label_ids", "labels")

    added_labels = requested_labels - current_labels
    dropped_labels = current_labels - requested_labels
@@ -364,16 +396,9 @@ def track_assignees(
    issue_activities,
    epoch,
 ):
-    requested_assignees = (
-        set([str(asg) for asg in requested_data.get("assignee_ids", [])])
-        if requested_data is not None
-        else set()
-    )
-    current_assignees = (
-        set([str(asg) for asg in current_instance.get("assignee_ids", [])])
-        if current_instance is not None
-        else set()
-    )
+    # Assignees
+    requested_assignees = extract_ids(requested_data, "assignee_ids", "assignees")
+    current_assignees = extract_ids(current_instance, "assignee_ids", "assignees")

    added_assignees = requested_assignees - current_assignees
    dropped_assginees = current_assignees - requested_assignees
@@ -631,6 +656,11 @@ def update_issue_activity(
        "estimate_point": track_estimate_points,
        "archived_at": track_archive_at,
        "closed_to": track_closed_to,
+        # External endpoint keys
+        "parent": track_parent,
+        "state": track_state,
+        "assignees": track_assignees,
+        "labels": track_labels,
    }

    requested_data = json.loads(requested_data) if requested_data is not None else None
@@ -30,6 +30,8 @@ def page_version(page_id, existing_instance, user_id):
                description_binary=page.description_binary,
                owned_by_id=user_id,
                last_saved_at=page.updated_at,
+                description_json=page.description,
+                description_stripped=page.description_stripped,
            )

            # If page versions are greater than 20 delete the oldest one
@@ -92,6 +92,10 @@ def create_project_and_member(workspace: Workspace) -> Dict[int, uuid.UUID]:
            name=workspace.name,  # Use workspace name
            identifier=project_identifier,
            created_by_id=workspace.created_by_id,
+            # Enable all views in seed data
+            cycle_view=True,
+            module_view=True,
+            issue_views_view=True,
        )

        # Create project members
@@ -50,9 +50,29 @@ app.conf.beat_schedule = {
        "schedule": crontab(hour=2, minute=0),  # UTC 02:00
    },
    "check-every-day-to-delete-api-logs": {
-        "task": "plane.bgtasks.api_logs_task.delete_api_logs",
+        "task": "plane.bgtasks.cleanup_task.delete_api_logs",
        "schedule": crontab(hour=2, minute=30),  # UTC 02:30
    },
+    "check-every-day-to-delete-email-notification-logs": {
+        "task": "plane.bgtasks.cleanup_task.delete_email_notification_logs",
+        "schedule": crontab(hour=2, minute=45),  # UTC 02:45
+    },
+    "check-every-day-to-delete-page-versions": {
+        "task": "plane.bgtasks.cleanup_task.delete_page_versions",
+        "schedule": crontab(hour=3, minute=0),  # UTC 03:00
+    },
+    "check-every-day-to-delete-issue-description-versions": {
+        "task": "plane.bgtasks.cleanup_task.delete_issue_description_versions",
+        "schedule": crontab(hour=3, minute=15),  # UTC 03:15
+    },
+    "check-every-day-to-delete-webhook-logs": {
+        "task": "plane.bgtasks.cleanup_task.delete_webhook_logs",
+        "schedule": crontab(hour=3, minute=30),  # UTC 03:30
+    },
+    "check-every-day-to-delete-exporter-history": {
+        "task": "plane.bgtasks.exporter_expired_task.delete_old_s3_link",
+        "schedule": crontab(hour=3, minute=45),  # UTC 03:45
+    },
 }


@@ -0,0 +1,30 @@
+# Generated by Django 4.2.22 on 2025-08-29 11:31
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("db", "0101_description_descriptionversion"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="page",
+            name="sort_order",
+            field=models.FloatField(default=65535),
+        ),
+        migrations.AddField(
+            model_name="pagelog",
+            name="entity_type",
+            field=models.CharField(
+                blank=True, max_length=30, null=True, verbose_name="Entity Type"
+            ),
+        ),
+        migrations.AlterField(
+            model_name="pagelog",
+            name="entity_identifier",
+            field=models.UUIDField(blank=True, null=True),
+        ),
+    ]
@@ -0,0 +1,75 @@
+# Generated by Django 4.2.22 on 2025-09-01 14:33
+
+from django.db import migrations, models
+from django.contrib.postgres.operations import AddIndexConcurrently
+
+
+class Migration(migrations.Migration):
+    atomic = False
+
+    dependencies = [
+        ('db', '0102_page_sort_order_pagelog_entity_type_and_more'),
+    ]
+
+    operations = [
+        AddIndexConcurrently(
+            model_name='fileasset',
+            index=models.Index(fields=['entity_type'], name='asset_entity_type_idx'),
+        ),
+        AddIndexConcurrently(
+            model_name='fileasset',
+            index=models.Index(fields=['entity_identifier'], name='asset_entity_identifier_idx'),
+        ),
+        AddIndexConcurrently(
+            model_name='fileasset',
+            index=models.Index(fields=['entity_type', 'entity_identifier'], name='asset_entity_idx'),
+        ),
+        AddIndexConcurrently(
+            model_name='notification',
+            index=models.Index(fields=['entity_identifier'], name='notif_entity_identifier_idx'),
+        ),
+        AddIndexConcurrently(
+            model_name='notification',
+            index=models.Index(fields=['entity_name'], name='notif_entity_name_idx'),
+        ),
+        AddIndexConcurrently(
+            model_name='notification',
+            index=models.Index(fields=['read_at'], name='notif_read_at_idx'),
+        ),
+        AddIndexConcurrently(
+            model_name='notification',
+            index=models.Index(fields=['receiver', 'read_at'], name='notif_entity_idx'),
+        ),
+        AddIndexConcurrently(
+            model_name='pagelog',
+            index=models.Index(fields=['entity_type'], name='pagelog_entity_type_idx'),
+        ),
+        AddIndexConcurrently(
+            model_name='pagelog',
+            index=models.Index(fields=['entity_identifier'], name='pagelog_entity_id_idx'),
+        ),
+        AddIndexConcurrently(
+            model_name='pagelog',
+            index=models.Index(fields=['entity_name'], name='pagelog_entity_name_idx'),
+        ),
+        AddIndexConcurrently(
+            model_name='pagelog',
+            index=models.Index(fields=['entity_type', 'entity_identifier'], name='pagelog_type_id_idx'),
+        ),
+        AddIndexConcurrently(
+            model_name='pagelog',
+            index=models.Index(fields=['entity_name', 'entity_identifier'], name='pagelog_name_id_idx'),
+        ),
+        AddIndexConcurrently(
+            model_name='userfavorite',
+            index=models.Index(fields=['entity_type'], name='fav_entity_type_idx'),
+        ),
+        AddIndexConcurrently(
+            model_name='userfavorite',
+            index=models.Index(fields=['entity_identifier'], name='fav_entity_identifier_idx'),
+        ),
+        AddIndexConcurrently(
+            model_name='userfavorite',
+            index=models.Index(fields=['entity_type', 'entity_identifier'], name='fav_entity_idx'),
+        ),
+    ]
@@ -0,0 +1,43 @@
+# Generated by Django 4.2.22 on 2025-09-03 05:18
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('db', '0103_fileasset_asset_entity_type_idx_and_more'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='cycleuserproperties',
+            name='rich_filters',
+            field=models.JSONField(default=dict),
+        ),
+        migrations.AddField(
+            model_name='exporterhistory',
+            name='rich_filters',
+            field=models.JSONField(blank=True, default=dict, null=True),
+        ),
+        migrations.AddField(
+            model_name='issueuserproperty',
+            name='rich_filters',
+            field=models.JSONField(default=dict),
+        ),
+        migrations.AddField(
+            model_name='issueview',
+            name='rich_filters',
+            field=models.JSONField(default=dict),
+        ),
+        migrations.AddField(
+            model_name='moduleuserproperties',
+            name='rich_filters',
+            field=models.JSONField(default=dict),
+        ),
+        migrations.AddField(
+            model_name='workspaceuserproperties',
+            name='rich_filters',
+            field=models.JSONField(default=dict),
+        ),
+    ]
@@ -0,0 +1,33 @@
+# Generated by Django 4.2.22 on 2025-09-10 09:54
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("db", "0104_cycleuserproperties_rich_filters_and_more"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="project",
+            name="cycle_view",
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AlterField(
+            model_name="project",
+            name="issue_views_view",
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AlterField(
+            model_name="project",
+            name="module_view",
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AlterField(
+            model_name="session",
+            name="user_id",
+            field=models.CharField(db_index=True, max_length=50, null=True),
+        ),
+    ]
@@ -0,0 +1,152 @@
+# Generated by Django 4.2.22 on 2025-09-12 08:45
+import uuid
+import django
+from django.conf import settings
+from django.db import migrations, models
+
+
+def set_page_sort_order(apps, schema_editor):
+    Page = apps.get_model("db", "Page")
+
+    batch_size = 3000
+    sort_order = 100
+
+    # Get page IDs ordered by name using the historical model
+    # This should include all pages regardless of soft-delete status
+    page_ids = list(Page.objects.all().order_by("name").values_list("id", flat=True))
+
+    updated_pages = []
+    for page_id in page_ids:
+        # Create page instance with minimal data
+        updated_pages.append(Page(id=page_id, sort_order=sort_order))
+        sort_order += 100
+
+        # Bulk update when batch is full
+        if len(updated_pages) >= batch_size:
+            Page.objects.bulk_update(
+                updated_pages, ["sort_order"], batch_size=batch_size
+            )
+            updated_pages = []
+
+    # Update remaining pages
+    if updated_pages:
+        Page.objects.bulk_update(updated_pages, ["sort_order"], batch_size=batch_size)
+
+
+def reverse_set_page_sort_order(apps, schema_editor):
+    Page = apps.get_model("db", "Page")
+    Page.objects.update(sort_order=Page.DEFAULT_SORT_ORDER)
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("db", "0105_alter_project_cycle_view_and_more"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="ProjectWebhook",
+            fields=[
+                (
+                    "created_at",
+                    models.DateTimeField(auto_now_add=True, verbose_name="Created At"),
+                ),
+                (
+                    "updated_at",
+                    models.DateTimeField(
+                        auto_now=True, verbose_name="Last Modified At"
+                    ),
+                ),
+                (
+                    "deleted_at",
+                    models.DateTimeField(
+                        blank=True, null=True, verbose_name="Deleted At"
+                    ),
+                ),
+                (
+                    "id",
+                    models.UUIDField(
+                        db_index=True,
+                        default=uuid.uuid4,
+                        editable=False,
+                        primary_key=True,
+                        serialize=False,
+                        unique=True,
+                    ),
+                ),
+                (
+                    "created_by",
+                    models.ForeignKey(
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        related_name="%(class)s_created_by",
+                        to=settings.AUTH_USER_MODEL,
+                        verbose_name="Created By",
+                    ),
+                ),
+                (
+                    "project",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="project_%(class)s",
+                        to="db.project",
+                    ),
+                ),
+                (
+                    "updated_by",
+                    models.ForeignKey(
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        related_name="%(class)s_updated_by",
+                        to=settings.AUTH_USER_MODEL,
+                        verbose_name="Last Modified By",
+                    ),
+                ),
+                (
+                    "webhook",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="project_webhooks",
+                        to="db.webhook",
+                    ),
+                ),
+                (
+                    "workspace",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="workspace_%(class)s",
+                        to="db.workspace",
+                    ),
+                ),
+            ],
+            options={
+                "verbose_name": "Project Webhook",
+                "verbose_name_plural": "Project Webhooks",
+                "db_table": "project_webhooks",
+                "ordering": ("-created_at",),
+            },
+        ),
+        migrations.AddConstraint(
+            model_name="projectwebhook",
+            constraint=models.UniqueConstraint(
+                condition=models.Q(("deleted_at__isnull", True)),
+                fields=("project", "webhook"),
+                name="project_webhook_unique_project_webhook_when_deleted_at_null",
+            ),
+        ),
+        migrations.AlterUniqueTogether(
+            name="projectwebhook",
+            unique_together={("project", "webhook", "deleted_at")},
+        ),
+        migrations.AlterField(
+            model_name="issuerelation",
+            name="relation_type",
+            field=models.CharField(
+                default="blocked_by", max_length=20, verbose_name="Issue Relation Type"
+            ),
+        ),
+        migrations.RunPython(
+            set_page_sort_order, reverse_code=reverse_set_page_sort_order
+        ),
+    ]
@@ -0,0 +1,74 @@
+from django.db import migrations
+
+from plane.utils.filters import LegacyToRichFiltersConverter
+from plane.utils.filters.filter_migrations import (
+    migrate_models_filters_to_rich_filters,
+    clear_models_rich_filters,
+)
+
+
+# Define all models that need migration in one place
+MODEL_NAMES = [
+    "IssueView",
+    "WorkspaceUserProperties",
+    "ModuleUserProperties", 
+    "IssueUserProperty",
+    "CycleUserProperties",
+]
+
+
+def migrate_filters_to_rich_filters(apps, schema_editor):
+    """
+    Migrate legacy filters to rich_filters format for all models that have both fields.
+    """
+    # Get the model classes from model names
+    models_to_migrate = {}
+    
+    for model_name in MODEL_NAMES:
+        try:
+            model_class = apps.get_model("db", model_name)
+            models_to_migrate[model_name] = model_class
+        except Exception as e:
+            # Log error but continue with other models
+            import logging
+            logger = logging.getLogger(__name__)
+            logger.error(f"Failed to get model {model_name}: {str(e)}")
+    
+    converter = LegacyToRichFiltersConverter()
+    # Migrate all models
+    migrate_models_filters_to_rich_filters(models_to_migrate, converter)
+
+
+def reverse_migrate_rich_filters_to_filters(apps, schema_editor):
+    """
+    Reverse migration to clear rich_filters field for all models.
+    """
+    # Get the model classes from model names
+    models_to_clear = {}
+    
+    for model_name in MODEL_NAMES:
+        try:
+            model_class = apps.get_model("db", model_name)
+            models_to_clear[model_name] = model_class
+        except Exception as e:
+            # Log error but continue with other models
+            import logging
+            logger = logging.getLogger(__name__)
+            logger.error(f"Failed to get model {model_name}: {str(e)}")
+    
+    # Clear rich_filters for all models
+    clear_models_rich_filters(models_to_clear)
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('db', '0106_auto_20250912_0845'),
+    ]
+
+    operations = [
+        migrations.RunPython(
+            migrate_filters_to_rich_filters,
+            reverse_code=reverse_migrate_rich_filters_to_filters,
+        ),
+    ]
@@ -76,6 +76,15 @@ class FileAsset(BaseModel):
        verbose_name_plural = "File Assets"
        db_table = "file_assets"
        ordering = ("-created_at",)
+        indexes = [
+            models.Index(fields=["entity_type"], name="asset_entity_type_idx"),
+            models.Index(
+                fields=["entity_identifier"], name="asset_entity_identifier_idx"
+            ),
+            models.Index(
+                fields=["entity_type", "entity_identifier"], name="asset_entity_idx"
+            ),
+        ]

    def __str__(self):
        return str(self.asset)
@@ -139,6 +139,7 @@ class CycleUserProperties(ProjectBaseModel):
    filters = models.JSONField(default=get_default_filters)
    display_filters = models.JSONField(default=get_default_display_filters)
    display_properties = models.JSONField(default=get_default_display_properties)
+    rich_filters = models.JSONField(default=dict)

    class Meta:
        unique_together = ["cycle", "user", "deleted_at"]
@@ -56,6 +56,7 @@ class ExporterHistory(BaseModel):
        related_name="workspace_exporters",
    )
    filters = models.JSONField(blank=True, null=True)
+    rich_filters = models.JSONField(default=dict, blank=True, null=True)

    class Meta:
        verbose_name = "Exporter"
@@ -41,6 +41,15 @@ class UserFavorite(WorkspaceBaseModel):
        verbose_name_plural = "User Favorites"
        db_table = "user_favorites"
        ordering = ("-created_at",)
+        indexes = [
+            models.Index(fields=["entity_type"], name="fav_entity_type_idx"),
+            models.Index(
+                fields=["entity_identifier"], name="fav_entity_identifier_idx"
+            ),
+            models.Index(
+                fields=["entity_type", "entity_identifier"], name="fav_entity_idx"
+            ),
+        ]

    def save(self, *args, **kwargs):
        if self._state.adding:
@@ -284,6 +284,7 @@ class IssueRelationChoices(models.TextChoices):
    BLOCKED_BY = "blocked_by", "Blocked By"
    START_BEFORE = "start_before", "Start Before"
    FINISH_BEFORE = "finish_before", "Finish Before"
+    IMPLEMENTED_BY = "implemented_by", "Implemented By"


 class IssueRelation(ProjectBaseModel):
@@ -295,7 +296,6 @@ class IssueRelation(ProjectBaseModel):
    )
    relation_type = models.CharField(
        max_length=20,
-        choices=IssueRelationChoices.choices,
        verbose_name="Issue Relation Type",
        default=IssueRelationChoices.BLOCKED_BY,
    )
@@ -509,6 +509,7 @@ class IssueUserProperty(ProjectBaseModel):
    filters = models.JSONField(default=get_default_filters)
    display_filters = models.JSONField(default=get_default_display_filters)
    display_properties = models.JSONField(default=get_default_display_properties)
+    rich_filters = models.JSONField(default=dict)

    class Meta:
        verbose_name = "Issue User Property"
@@ -207,6 +207,7 @@ class ModuleUserProperties(ProjectBaseModel):
    filters = models.JSONField(default=get_default_filters)
    display_filters = models.JSONField(default=get_default_display_filters)
    display_properties = models.JSONField(default=get_default_display_properties)
+    rich_filters = models.JSONField(default=dict)

    class Meta:
        unique_together = ["module", "user", "deleted_at"]
@@ -39,6 +39,14 @@ class Notification(BaseModel):
        verbose_name_plural = "Notifications"
        db_table = "notifications"
        ordering = ("-created_at",)
+        indexes = [
+            models.Index(
+                fields=["entity_identifier"], name="notif_entity_identifier_idx"
+            ),
+            models.Index(fields=["entity_name"], name="notif_entity_name_idx"),
+            models.Index(fields=["read_at"], name="notif_read_at_idx"),
+            models.Index(fields=["receiver", "read_at"], name="notif_entity_idx"),
+        ]

    def __str__(self):
        """Return name of the notifications"""
@@ -19,6 +19,7 @@ def get_view_props():
 class Page(BaseModel):
    PRIVATE_ACCESS = 1
    PUBLIC_ACCESS = 0
+    DEFAULT_SORT_ORDER = 65535

    ACCESS_CHOICES = ((PRIVATE_ACCESS, "Private"), (PUBLIC_ACCESS, "Public"))

@@ -57,6 +58,7 @@ class Page(BaseModel):
    )
    moved_to_page = models.UUIDField(null=True, blank=True)
    moved_to_project = models.UUIDField(null=True, blank=True)
+    sort_order = models.FloatField(default=DEFAULT_SORT_ORDER)

    external_id = models.CharField(max_length=255, null=True, blank=True)
    external_source = models.CharField(max_length=255, null=True, blank=True)
@@ -98,8 +100,11 @@ class PageLog(BaseModel):
    )
    transaction = models.UUIDField(default=uuid.uuid4)
    page = models.ForeignKey(Page, related_name="page_log", on_delete=models.CASCADE)
-    entity_identifier = models.UUIDField(null=True)
+    entity_identifier = models.UUIDField(null=True, blank=True)
    entity_name = models.CharField(max_length=30, verbose_name="Transaction Type")
+    entity_type = models.CharField(
+        max_length=30, verbose_name="Entity Type", null=True, blank=True
+    )
    workspace = models.ForeignKey(
        "db.Workspace", on_delete=models.CASCADE, related_name="workspace_page_log"
    )
@@ -110,6 +115,17 @@ class PageLog(BaseModel):
        verbose_name_plural = "Page Logs"
        db_table = "page_logs"
        ordering = ("-created_at",)
+        indexes = [
+            models.Index(fields=["entity_type"], name="pagelog_entity_type_idx"),
+            models.Index(fields=["entity_identifier"], name="pagelog_entity_id_idx"),
+            models.Index(fields=["entity_name"], name="pagelog_entity_name_idx"),
+            models.Index(
+                fields=["entity_type", "entity_identifier"], name="pagelog_type_id_idx"
+            ),
+            models.Index(
+                fields=["entity_name", "entity_identifier"], name="pagelog_name_id_idx"
+            ),
+        ]

    def __str__(self):
        return f"{self.page.name} {self.entity_name}"
@@ -18,6 +18,12 @@ from .base import BaseModel
 ROLE_CHOICES = ((20, "Admin"), (15, "Member"), (5, "Guest"))


+class ROLE(Enum):
+    ADMIN = 20
+    MEMBER = 15
+    GUEST = 5
+
+
 class ProjectNetwork(Enum):
    SECRET = 0
    PUBLIC = 2
@@ -89,9 +95,9 @@ class Project(BaseModel):
    )
    emoji = models.CharField(max_length=255, null=True, blank=True)
    icon_prop = models.JSONField(null=True)
-    module_view = models.BooleanField(default=True)
-    cycle_view = models.BooleanField(default=True)
-    issue_views_view = models.BooleanField(default=True)
+    module_view = models.BooleanField(default=False)
+    cycle_view = models.BooleanField(default=False)
+    issue_views_view = models.BooleanField(default=False)
    page_view = models.BooleanField(default=True)
    intake_view = models.BooleanField(default=False)
    is_time_tracking_enabled = models.BooleanField(default=False)
@@ -13,7 +13,7 @@ VALID_KEY_CHARS = string.ascii_lowercase + string.digits
 class Session(AbstractBaseSession):
    device_info = models.JSONField(null=True, blank=True, default=None)
    session_key = models.CharField(max_length=128, primary_key=True)
-    user_id = models.CharField(null=True, max_length=50)
+    user_id = models.CharField(null=True, max_length=50, db_index=True)

    @classmethod
    def get_session_store_class(cls):
@@ -58,6 +58,7 @@ class IssueView(WorkspaceBaseModel):
    filters = models.JSONField(default=dict)
    display_filters = models.JSONField(default=get_default_display_filters)
    display_properties = models.JSONField(default=get_default_display_properties)
+    rich_filters = models.JSONField(default=dict)
    access = models.PositiveSmallIntegerField(
        default=1, choices=((0, "Private"), (1, "Public"))
    )
@@ -7,7 +7,7 @@ from django.db import models
 from django.core.exceptions import ValidationError

 # Module imports
-from plane.db.models import BaseModel
+from plane.db.models import BaseModel, ProjectBaseModel


 def generate_token():
@@ -90,3 +90,24 @@ class WebhookLog(BaseModel):

    def __str__(self):
        return f"{self.event_type} {str(self.webhook)}"
+
+
+
+class ProjectWebhook(ProjectBaseModel):
+    webhook = models.ForeignKey(
+        "db.Webhook", on_delete=models.CASCADE, related_name="project_webhooks"
+    )
+
+    class Meta:
+        unique_together = ["project", "webhook", "deleted_at"]
+        constraints = [
+            models.UniqueConstraint(
+                fields=["project", "webhook"],
+                condition=models.Q(deleted_at__isnull=True),
+                name="project_webhook_unique_project_webhook_when_deleted_at_null",
+            )
+        ]
+        verbose_name = "Project Webhook"
+        verbose_name_plural = "Project Webhooks"
+        db_table = "project_webhooks"
+        ordering = ("-created_at",)
@@ -332,6 +332,7 @@ class WorkspaceUserProperties(BaseModel):
    filters = models.JSONField(default=get_default_filters)
    display_filters = models.JSONField(default=get_default_display_filters)
    display_properties = models.JSONField(default=get_default_display_properties)
+    rich_filters = models.JSONField(default=dict)

    class Meta:
        unique_together = ["workspace", "user", "deleted_at"]
@@ -34,6 +34,7 @@ from plane.authentication.adapter.error import (
    AuthenticationException,
 )
 from plane.utils.ip_address import get_client_ip
+from plane.utils.path_validator import get_safe_redirect_url


 class InstanceAdminEndpoint(BaseAPIView):
@@ -392,7 +393,14 @@ class InstanceAdminSignOutEndpoint(View):
            user.save()
            # Log the user out
            logout(request)
-            url = urljoin(base_host(request=request, is_admin=True))
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_admin=True),
+                next_path=""
+            )
            return HttpResponseRedirect(url)
        except Exception:
-            return HttpResponseRedirect(base_host(request=request, is_admin=True))
+            url = get_safe_redirect_url(
+                base_url=base_host(request=request, is_admin=True),
+                next_path=""
+            )
+            return HttpResponseRedirect(url)
@@ -0,0 +1,18 @@
+# Generated by Django 4.2.22 on 2025-09-11 08:40
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("license", "0005_rename_product_instance_edition_and_more"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="instance",
+            name="is_current_version_deprecated",
+            field=models.BooleanField(default=False),
+        ),
+    ]
@@ -38,6 +38,8 @@ class Instance(BaseModel):
    is_signup_screen_visited = models.BooleanField(default=False)
    is_verified = models.BooleanField(default=False)
    is_test = models.BooleanField(default=False)
+    # field for validating if the current version is deprecated
+    is_current_version_deprecated = models.BooleanField(default=False)

    class Meta:
        verbose_name = "Instance"
@@ -284,7 +284,7 @@ CELERY_IMPORTS = (
    "plane.bgtasks.exporter_expired_task",
    "plane.bgtasks.file_asset_task",
    "plane.bgtasks.email_notification_task",
-    "plane.bgtasks.api_logs_task",
+    "plane.bgtasks.cleanup_task",
    "plane.license.bgtasks.tracer",
    # management tasks
    "plane.bgtasks.dummy_data_task",
@@ -465,3 +465,7 @@ if ENABLE_DRF_SPECTACULAR:
    REST_FRAMEWORK["DEFAULT_SCHEMA_CLASS"] = "drf_spectacular.openapi.AutoSchema"
    INSTALLED_APPS.append("drf_spectacular")
    from .openapi import SPECTACULAR_SETTINGS  # noqa: F401
+
+# MongoDB Settings
+MONGO_DB_URL = os.environ.get("MONGO_DB_URL", False)
+MONGO_DB_DATABASE = os.environ.get("MONGO_DB_DATABASE", False)
@@ -73,5 +73,10 @@ LOGGING = {
            "handlers": ["console"],
            "propagate": False,
        },
+        "plane.mongo": {
+            "level": "INFO",
+            "handlers": ["console"],
+            "propagate": False,
+        },
    },
 }
@@ -0,0 +1,124 @@
+# Django imports
+from django.conf import settings
+import logging
+
+# Third party imports
+from pymongo import MongoClient
+from pymongo.database import Database
+from pymongo.collection import Collection
+from typing import Optional, TypeVar, Type
+
+
+T = TypeVar("T", bound="MongoConnection")
+
+# Set up logger
+logger = logging.getLogger("plane.mongo")
+
+
+class MongoConnection:
+    """
+    A singleton class that manages MongoDB connections.
+
+    This class ensures only one MongoDB connection is maintained throughout the application.
+    It provides methods to access the MongoDB client, database, and collections.
+
+    Attributes:
+        _instance (Optional[MongoConnection]): The singleton instance of this class
+        _client (Optional[MongoClient]): The MongoDB client instance
+        _db (Optional[Database]): The MongoDB database instance
+    """
+
+    _instance: Optional["MongoConnection"] = None
+    _client: Optional[MongoClient] = None
+    _db: Optional[Database] = None
+
+    def __new__(cls: Type[T]) -> T:
+        """
+        Creates a new instance of MongoConnection if one doesn't exist.
+
+        Returns:
+            MongoConnection: The singleton instance
+        """
+        if cls._instance is None:
+            cls._instance = super(MongoConnection, cls).__new__(cls)
+            try:
+                mongo_url = getattr(settings, "MONGO_DB_URL", None)
+                mongo_db_database = getattr(settings, "MONGO_DB_DATABASE", None)
+
+                if not mongo_url or not mongo_db_database:
+                    logger.warning(
+                        "MongoDB connection parameters not configured. MongoDB functionality will be disabled."
+                    )
+                    return cls._instance
+
+                cls._client = MongoClient(mongo_url)
+                cls._db = cls._client[mongo_db_database]
+
+                # Test the connection
+                cls._client.server_info()
+                logger.info("MongoDB connection established successfully")
+            except Exception as e:
+                logger.warning(
+                    f"Failed to initialize MongoDB connection: {str(e)}. MongoDB functionality will be disabled."
+                )
+        return cls._instance
+
+    @classmethod
+    def get_client(cls) -> Optional[MongoClient]:
+        """
+        Returns the MongoDB client instance.
+
+        Returns:
+            Optional[MongoClient]: The MongoDB client instance or None if not configured
+        """
+        if cls._client is None:
+            cls._instance = cls()
+        return cls._client
+
+    @classmethod
+    def get_db(cls) -> Optional[Database]:
+        """
+        Returns the MongoDB database instance.
+
+        Returns:
+            Optional[Database]: The MongoDB database instance or None if not configured
+        """
+        if cls._db is None:
+            cls._instance = cls()
+        return cls._db
+
+    @classmethod
+    def get_collection(cls, collection_name: str) -> Optional[Collection]:
+        """
+        Returns a MongoDB collection by name.
+
+        Args:
+            collection_name (str): The name of the collection to retrieve
+
+        Returns:
+            Optional[Collection]: The MongoDB collection instance or None if not configured
+        """
+        try:
+            db = cls.get_db()
+            if db is None:
+                logger.warning(
+                    f"Cannot access collection '{collection_name}': MongoDB not configured"
+                )
+                return None
+            return db[collection_name]
+        except Exception as e:
+            logger.warning(f"Failed to access collection '{collection_name}': {str(e)}")
+            return None
+
+    @classmethod
+    def is_configured(cls) -> bool:
+        """
+        Check if MongoDB is properly configured and connected.
+
+        Returns:
+            bool: True if MongoDB is configured and connected, False otherwise
+        """
+
+        if cls._client is None:
+            cls._instance = cls()
+        return cls._client is not None and cls._db is not None
--- a/Show More
+++ b/Show More