Skip to content

feat: edit state, help button, loader while login in - #4

Merged
vamsi merged 2 commits into
makeplane:stage-releasefrom
dakshesh14:main
Nov 24, 2022
Merged

feat: edit state, help button, loader while login in #4
vamsi merged 2 commits into
makeplane:stage-releasefrom
dakshesh14:main

Conversation

@dakshesh14

@dakshesh14 dakshesh14 commented Nov 24, 2022

Copy link
Copy Markdown
Contributor

feat:

  • edit states name & color from the project settings page
  • add a help button at the sidebar for the user to see all keyboard shortcuts
  • showing loader while login in using Google

fix:

  • authentication flow by not making API requests when the user doesn't have accessToken in the cookie and removing accessToken from the cookie if it's expired or invalid

@vercel

vercel Bot commented Nov 24, 2022

Copy link
Copy Markdown

@dakshesh14 is attempting to deploy a commit to the Caravel Team on Vercel.

A member of the Team first needs to authorize it.

@vamsi
vamsi merged commit 2d081d3 into makeplane:stage-release Nov 24, 2022
akushonkamen referenced this pull request in akushonkamen/plane Apr 6, 2026
Yalun Peng @claude Yalun Peng
[BRAND] Phase 3.2: Replace brand text in i18n translations (closes #4)
5daf9b5 
Replace all "Plane" brand name references with "Tracktor" in translation strings across all locale files, while preserving copyright headers and avoiding non-brand uses of "plane".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@patrickisgreat patrickisgreat mentioned this pull request Apr 27, 2026
Merged
9 tasks
ColeEdanza added a commit to ColeEdanza/plane that referenced this pull request May 26, 2026
@ColeEdanza @claude
feat(work-item): layout refresh — pill, inline props, description col…
00e7a0a 
…lapse, footer, sidebar groups

Five compound UI changes implementing the Plane.so blog redesign (items makeplane#2,
makeplane#3, makeplane#5, makeplane#6, makeplane#7; makeplane#1/makeplane#4/makeplane#8/makeplane#9/makeplane#10/makeplane#11 out of scope per Cole).

- Compact parent pill next to the work-item ID (new IssueParentPill in
  parent/pill.tsx); fat parent breadcrumb row above the title removed in
  both the full-screen page and all peek modes.
- Inline properties row under the title: Assignee, Priority, Start, Due as
  borderless pills with vertical dividers (border-strong), text-body-sm font,
  gap-x-5 spacing, hover background via transparent-with-text variant. State
  stays in the peek header from prior commit 03d84b1.
- DescriptionCollapse wrapper around the rich-text editor: clamps to ~200px
  via ResizeObserver, fade gradient when collapsed, auto-expands on focus,
  Show more / Show less toggle. Wraps both surfaces.
- IssueMetadataFooter at the bottom of main content: created-by, created,
  updated, and completed (when set) in a compact row with full-timestamp
  hover tooltips.
- Sidebar regrouped into three collapsible sections (Properties / Project
  structure / Custom properties). Assignee, Priority, Start, Due removed
  from the sidebar since they're inline now. Parent stays as the only way
  to *add* a parent when none is set.

Title bumped from text-20 to text-28 font-semibold leading-snug py-1; the
prior leading-tight clipped ascenders inside the auto-resize textarea.

Touches:
  apps/web/core/components/issues/issue-detail/main-content.tsx
  apps/web/core/components/issues/issue-detail/sidebar.tsx
  apps/web/core/components/issues/issue-detail/parent/index.ts
  apps/web/core/components/issues/peek-overview/issue-detail.tsx
  + 4 new files:
    parent/pill.tsx, inline-properties.tsx,
    description-collapse.tsx, metadata-footer.tsx

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
blitzy Bot pushed a commit to Blitzy-Sandbox/blitzy-makeplane that referenced this pull request Jun 2, 2026
@blitzyai
security(api): close PUT auth bypass + restore CSRF + add login rate …
d061338 
…limit

Resolves QA Checkpoint 8 Critical Issues #1-makeplane#6 reported as production
blockers. Documentation-AAP system boundaries are preserved
(no dependency changes, no .env changes, no refactoring).

Issue #1-makeplane#4 — Cross-workspace PUT bypass on 4 ViewSets:
ProjectViewSet/IssueViewSet/ModuleViewSet/WorkspaceViewViewSet all
inherited DRF UpdateModelMixin.update() unprotected because their
url routers register {'put': 'update'} but only partial_update
carried the @allow_permission gate (or, for ProjectViewSet, the
inline workspace-admin check). Adding an explicit update() override
that delegates to partial_update — with the matching @allow_permission
decorator — forces PUT and PATCH to share one authoritative
authorization path. Also defensively added the same override to
IssueViewViewSet so the queryset-filter defense-in-depth cannot
silently regress in future refactors. (OWASP A01:2021 Broken Access
Control.)

Files:
 - apps/api/plane/app/views/project/base.py
 - apps/api/plane/app/views/issue/base.py
 - apps/api/plane/app/views/module/base.py
 - apps/api/plane/app/views/view/base.py

Issue makeplane#5 — CSRF disabled on all DRF endpoints:
BaseSessionAuthentication.enforce_csrf was overridden to a no-op,
suppressing DRF's CSRF check on every session-authenticated REST
endpoint. The override is removed so DRF's default CSRF enforcement
(which requires X-CSRFToken on every unsafe HTTP method) is restored;
the docstring now documents this contract and explicitly warns
future maintainers not to re-introduce the no-op. Browser SPAs
already call /auth/get-csrf-token/ before mutating requests, so
no client-side change is needed. (OWASP A01:2021.)

Files:
 - apps/api/plane/authentication/session.py

Issue makeplane#6 — No rate limiting on /auth/sign-in/ (brute-force open):
SignInAuthEndpoint and SignUpAuthEndpoint subclass django.views.View
(not DRF APIView), so DRF throttle classes never applied even though
AuthenticationThrottle exists for the EmailCheck/MagicLink/Forgot
endpoints. Added a per-IP sliding-window rate limit (30/min) backed
by Django's default cache (django-redis) implemented as
_is_authentication_rate_limited(); applied at the top of both POST
handlers BEFORE any DB lookup so brute-force traffic cannot drive
password-hash work or leak user-existence timing. The same check is
applied to the space-tenant sign-in/sign-up endpoints (which share
the cache key prefix so a single IP cannot bypass by ping-ponging
between surfaces). Returns the standard 302 redirect carrying
error_code=5900&error_message=RATE_LIMIT_EXCEEDED so the SPA-side
error handler renders the same message as DRF endpoints.

Files:
 - apps/api/plane/authentication/views/app/email.py
 - apps/api/plane/authentication/views/space/email.py

Validation:
 - pydocstyle --convention=pep257 on apps/api/plane/ (excl
   migrations/tests) — ZERO errors (AAP validation gate 1)
 - All 7 modified files compile cleanly (python -m py_compile)
 - Live re-verification on a running API server confirmed:
     * Cross-workspace PUT on each of 4 ViewSets → 403 (was 200)
     * POST without/invalid CSRF token → 403 (was 201)
     * Cross-origin POST → 403 (Origin check fires too)
     * 31st bad login attempt → RATE_LIMIT_EXCEEDED (was unbounded)
 - Regression tests: User A's own PUT/PATCH/POST/DELETE all still
   succeed with valid CSRF; safe GET methods unaffected; pre-existing
   PATCH/DELETE/POST/GET cross-workspace 403s preserved.

Evidence summary in blitzy/qa-fix-evidence/SUMMARY.md;
out-of-scope findings (Django EOL, npm CVEs, pip CVEs, header
hygiene at proxy layer) in blitzy/qa-fix-evidence/OUT_OF_SCOPE_FINDINGS.md.
blitzy Bot pushed a commit to Blitzy-Sandbox/blitzy-makeplane that referenced this pull request Jun 2, 2026
@blitzyai
fix(live,api): resolve QA Checkpoint 9 real-time collaboration runtim…
b98e020 
…e issues

Targeted, behavior-only source fixes for 8 runtime findings from QA Checkpoint 9
(real-time collaboration + integration E2E). No new dependencies, no .env
changes, no refactoring -- consistent with the branch's established remediation
pattern (cf. d061338, which resolved Checkpoint 8 with behavioral fixes while
preserving the documentation-AAP system boundaries).

apps/live (Directive 4 surface):
- #1 CSRF persistence (CRITICAL): ProjectPageService now extracts the session
  `csrftoken` cookie from the forwarded WS-handshake Cookie header and echoes it
  as the `X-CSRFToken` header, so service-to-service PATCHes (page description,
  title, HTML->binary backfill) pass apps/api's restored DRF CSRF enforcement
  instead of failing 403. Cascades to resolve makeplane#6 and the Info-3 doc-bloat.
- #2 + makeplane#5 unhandled-rejection crashes (CRITICAL): subscribe the `hocuspocus:admin`
  channel on a DEDICATED duplicated ioredis connection so the base
  @hocuspocus/extension-redis `messageBuffer` Yjs decoder never receives admin
  JSON (the lib0 "Unexpected end of array" / "Invalid typed array length"
  rejections). Added a defensive try/catch around force-close teardown in
  database.ts as defense-in-depth.
- makeplane#6 HTML->binary backfill silent crash (CRITICAL): resolved downstream of #1
  (the 403 was the trigger); backfill now persists and the process stays alive.
- makeplane#3 WS 1006 / makeplane#4 process crash (CRITICAL): no source change required -- makeplane#3 is a
  dev-only HMR/upgrade-timing artifact that self-recovers; makeplane#4's crash root causes
  are eliminated by #1/#2/makeplane#5/makeplane#6 and the existing non-exiting global handlers.

apps/api (Directive 1 surface):
- makeplane#7 webhook 5xx not retried (CRITICAL): raise requests.RequestException on a
  >=500 response so Celery's autoretry_for drives the backoff/retry and the
  retry-exhaustion branch deactivates the webhook (tech spec 4.5). 4xx remain
  permanent (logged, not retried).
- makeplane#8 notification print() swallow (MAJOR): replace the bare `print(e)` with
  `logger.exception(...)` via a `plane.worker` logger so failures surface with a
  full traceback; the task stays fire-and-forget (no re-raise).

Deferred:
- makeplane#9 MinIO dev endpoint (MINOR): the only fix requires editing apps/api/.env,
  which is forbidden by the AAP system boundary ("No .env files modified");
  dev-only, not a production bug per QA's own assessment.

Verification: all 8 actionable findings runtime-verified against the full
Docker stack (apps/api + Celery + apps/live + apps/web). Static gates green --
pydocstyle --convention=pep257 (apps/api/plane) zero errors; `turbo run
check:types` 18/18 successful; oxlint/oxfmt clean on the 3 TS files; ruff clean
on the 2 Python files.
manhhn01 pushed a commit to manhhn01/planex that referenced this pull request Jul 20, 2026
@eyriehq-bot @mguptahub @manhhn01
fix: install.sh respects APP_RELEASE from downloaded variables.env (m…
040aebd 
…akeplane#4)

Co-authored-by: Manish Gupta <manish@plane.so>
(cherry picked from commit 4b91dff)
hooptech-KL added a commit to hooptech-KL/plane that referenced this pull request Jul 23, 2026
@hooptech-KL
feat(api): duplicate inline videos on entity copy (makeplane#5) + orp…
daca116 
…han description-asset GC command (makeplane#4)
DoctorFogarty pushed a commit to DoctorFogarty/plane that referenced this pull request Aug 7, 2026
@vamsi
Merge pull request makeplane#4 from dakshesh14/main
40494eb 
feat: edit state, help button, loader while login in
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@venplane venplane venplane approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@dakshesh14 @venplane @vamsi