[WEB-8289] fix: scope draft-to-issue conversion to the draft owner

[mguptahub]

Summary

Fixes WEB-8289 (HIGH). WorkspaceDraftIssueViewSet.create_draft_to_issue resolved the draft with get_queryset().filter(pk=draft_id) — scoped only to the workspace, with no created_by check — while the decorator admits any workspace ADMIN/MEMBER.

Draft issues are private to their creator (the sibling list / retrieve / partial_update methods all filter created_by=request.user). So any workspace member could supply another user's draft_id and:

• convert that private draft into a real issue,
• reassign (steal) the draft's file assets to the new issue (FileAsset.objects.filter(draft_issue_id=draft_id).update(issue_id=...)), and
• delete the victim's draft (draft_issue.delete()).

Fix

Scope the lookup to the owner and 404 otherwise:

draft_issue = self.get_queryset().filter(pk=draft_id, created_by=request.user).first()
if not draft_issue:
    return Response({"error": "The required object does not exist."}, status=404)

This mirrors the exact pattern already used by retrieve / partial_update. The explicit null guard also removes a latent AttributeError on the subsequent .project_id access when no draft matches.

Tests

New contract suite plane/tests/contract/app/test_draft_to_issue_owner_scope_app.py (fail-before verified — the security test returns 201 without the fix):

• A non-owner member converting another user's draft → 404, and the draft + its file asset are left intact (not deleted, not reassigned).
• Positive control: the draft's owner can still convert their own draft (201, draft consumed, asset migrated to the new issue).

Verification

• ruff check: clean
• manage.py check (test settings): no issues
• pytest (new suite): 2/2 green; fail-before verified

Notes

• Dedupe: a second MED report shares this root cause and code path — should be closed as a duplicate of this on release. (Mapping on the ticket.)
• EE: EE does not override this endpoint, so this CE fix covers EE deployments too. A distinct, lower-severity owner-scope gap on the EE-only DraftIssuePropertyValueEndpoint (draft custom-field values, same-project) is being tracked as a separate follow-up, not part of this advisory.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Restricted “draft-to-issue” conversion so only the draft’s owner can convert it.
  • Unauthorized attempts now return 404 Not Found and do not alter the draft, its attached files, or create an issue.
  • Draft owners can still convert their drafts successfully, including transferring any attached files to the new issue.

• Tests

  • Added contract tests covering both unauthorized and authorized draft-to-issue conversion paths.

[makeplane]

Linked to Plane Work Item(s)

• (WEB-8289) [Security] Draft-to-issue conversion missing owner scope → cross-user BOLA (GHSA-vfqm-7rh7-84hq)

This comment was auto-generated by Plane

[coderabbitai]

Warning

Review limit reached

@mguptahub, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 45 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 98731dd6-2683-441b-a957-47d7e3e3383f

📥 Commits

Reviewing files that changed from the base of the PR and between 7448c69 and 9133fac.

📒 Files selected for processing (2)

• apps/api/plane/app/views/workspace/draft.py
• apps/api/plane/tests/contract/app/test_draft_to_issue_owner_scope_app.py

📝 Walkthrough

Walkthrough

Draft-to-issue conversion now restricts lookup to the draft creator and returns 404 for non-owners. Contract tests cover unauthorized access, successful owner conversion, issue creation, draft deletion, and file asset migration.

Changes

Draft conversion ownership

Layer / File(s)	Summary
Enforce draft creator ownership apps/api/plane/app/views/workspace/draft.py	Draft lookup now filters by both ID and creator, returning the standard 404 response when no scoped draft exists.
Validate conversion ownership behavior apps/api/plane/tests/contract/app/test_draft_to_issue_owner_scope_app.py	Contract fixtures and tests verify that non-owners cannot convert drafts while owners can convert them with the expected draft, issue, and asset state changes.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: dheeru0198

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the primary security fix: restricting draft-to-issue conversion to the draft owner.
Description check	✅ Passed	The description provides detailed context, the fix, test scenarios, verification results, and issue references; only the template checkboxes are not marked.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch web-8289/draft-to-issue-owner-scope

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR fixes a high-severity authorization bug in the draft-to-issue conversion endpoint by ensuring only the draft owner can convert their draft into an issue, preventing other workspace members from converting/deleting someone else’s private drafts and migrating their file assets.

Changes:

• Scope create_draft_to_issue draft lookup to created_by=request.user and return 404 when not found/owned.
• Add contract tests covering the negative (non-owner) and positive (owner) conversion paths, including file-asset migration/retention assertions.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
apps/api/plane/app/views/workspace/draft.py	Restricts draft-to-issue conversion to drafts owned by the requesting user and returns a 404 otherwise.
apps/api/plane/tests/contract/app/test_draft_to_issue_owner_scope_app.py	Adds contract regression tests validating owner scoping and ensuring file assets aren’t reassigned/deleted by non-owners.

[mguptahub]

Thanks @copilot — both addressed in 7448c69.

You're right: Project.objects.create(created_by=create_user) and FileAsset.objects.create(created_by=create_user) were silent no-ops because BaseModel.save() nulls created_by when there's no current request user under tests. Switched both to instantiate + save(created_by_id=create_user.id) — the same pattern already used for the draft — so the fixtures' ownership is real.

Note this didn't affect the test's correctness (the security assertions key off the draft's created_by, which was already set correctly, and the asset checks use draft_issue_id/issue_id), but the fixtures are now accurate. 2/2 tests still green.

[github-actions]

React Doctor found 4 issues in 4 files · 1 error & 3 warnings · score 82 / 100 (Needs work) · vs preview

Errors

• ❌ core/components/pages/editor/editor-body.tsx:194 Server and client render different branches no-hydration-branch-on-browser-global

3 warnings

core/components/issues/issue-layouts/spreadsheet/columns/label-column.tsx

• ⚠️ L14 Import from a barrel file no-barrel-import

core/components/issues/peek-overview/properties.tsx

• ⚠️ L42 Import from a barrel file no-barrel-import

core/components/issues/workspace-draft/draft-issue-properties.tsx

• ⚠️ L31 Import from a barrel file no-barrel-import

⚠️ Warning: .github/workflows/react-doctor.yml is configured incorrectly. See below to fix.

React Doctor compares against preview to report only the issues this pull request introduces. This run couldn't complete that comparison (usually a shallow CI checkout with no merge base), so it listed every issue in the changed files, including ones that already existed on preview.

Add fetch-depth: 0 to the actions/checkout step in .github/workflows/react-doctor.yml so the checkout includes the history React Doctor needs:

 jobs:
   react-doctor:
     steps:
       - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0

       - uses: millionco/react-doctor@v2

To silence this warning, set silence-missing-baseline-warning: true on the React Doctor action.

_{Reviewed by React Doctor for commit 9133fac. See inline comments for fixes.}

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.