chore: api and webhook refactor (#2861)

* chore: bug fix

* dev: changes in api endpoints for invitations and inbox

* chore: improvements

* dev: update webhook send

* dev: webhook validation and fix webhook flow for app

* dev: error messages for deactivation

* chore: api fixes

* dev: update webhook and workspace leave

* chore: issue comment

* dev: default values for environment variables

* dev: make the user active if he was already part of project member

* chore: webhook cycle and module event

* dev: disable ssl for emails

* dev: webhooks restructuring

* dev: updated webhook configuration

* dev: webhooks

* dev: state get object

* dev: update workspace slug validation

* dev: remove deactivation flag if max retries exceeded

---------

Co-authored-by: NarayanBavisetti <narayan3119@gmail.com>

apiserver/plane/app/serializers/webhook.py

@@ -1,3 +1,9 @@
+# Python imports
+import urllib
+import socket
+import ipaddress
+from urllib.parse import urlparse
+
 # Third party imports
 from rest_framework import serializers
 
@@ -9,6 +15,42 @@ from plane.db.models.webhook import validate_domain, validate_schema
 class WebhookSerializer(DynamicBaseSerializer):
     url = serializers.URLField(validators=[validate_schema, validate_domain])
 
+    def validate(self, data):
+        url = data.get("url", None)
+
+        # Extract the hostname from the URL
+        hostname = urlparse(url).hostname
+        if not hostname:
+            raise serializers.ValidationError({"url": "Invalid URL: No hostname found."})
+
+        # Resolve the hostname to IP addresses
+        try:
+            ip_addresses = socket.getaddrinfo(hostname, None)
+        except socket.gaierror:
+            raise serializers.ValidationError({"url": "Hostname could not be resolved."})
+
+        if not ip_addresses:
+            raise serializers.ValidationError({"url": "No IP addresses found for the hostname."})
+
+        for addr in ip_addresses:
+            ip = ipaddress.ip_address(addr[4][0])
+            if ip.is_private or ip.is_loopback:
+                raise serializers.ValidationError({"url": "URL resolves to a blocked IP address."})
+
+        # Additional validation for multiple request domains and their subdomains
+        request = self.context.get('request')
+        disallowed_domains = ['plane.so',]  # Add your disallowed domains here
+        if request:
+            request_host = request.get_host().split(':')[0]  # Remove port if present
+            disallowed_domains.append(request_host)
+
+        # Check if hostname is a subdomain or exact match of any disallowed domain
+        if any(hostname == domain or hostname.endswith('.' + domain) for domain in disallowed_domains):
+            raise serializers.ValidationError({"url": "URL domain or its subdomain is not allowed."})
+
+        return data
+
+
     class Meta:
         model = Webhook
         fields = "__all__"

apiserver/plane/app/serializers/workspace.py

@@ -21,6 +21,22 @@ class WorkSpaceSerializer(BaseSerializer):
     total_members = serializers.IntegerField(read_only=True)
     total_issues = serializers.IntegerField(read_only=True)
 
+    def validated(self, data):
+        if data.get("slug") in [
+            "404",
+            "accounts",
+            "api",
+            "create-workspace",
+            "god-mode",
+            "installations",
+            "invitations",
+            "onboarding",
+            "profile",
+            "spaces",
+            "workspace-invitations",
+        ]:
+            raise serializers.ValidationError({"slug": "Slug is not valid"})
+
     class Meta:
         model = Workspace
         fields = "__all__"

apiserver/plane/app/urls/project.py

@@ -65,7 +65,7 @@ urlpatterns = [
         name="project-member-invite",
     ),
     path(
-        "users/me/invitations/projects/",
+        "users/me/workspaces/<str:slug>/projects/invitations/",
         UserProjectInvitationsViewset.as_view(
             {
                 "get": "list",
@@ -75,7 +75,7 @@ urlpatterns = [
         name="user-project-invitations",
     ),
     path(
-        "workspaces/<str:slug>/projects/join/",
+        "workspaces/<str:slug>/projects/<uuid:project_id>/join/<uuid:pk>/",
         ProjectJoinEndpoint.as_view(),
         name="project-join",
     ),

apiserver/plane/app/views/base.py

@@ -43,20 +43,25 @@ class TimezoneMixin:
 
 class WebhookMixin:
     webhook_event = None
+    bulk = False
 
     def finalize_response(self, request, response, *args, **kwargs):
         response = super().finalize_response(request, response, *args, **kwargs)
 
+        # Check for the case should webhook be sent
         if (
             self.webhook_event
             and self.request.method in ["POST", "PATCH", "DELETE"]
             and response.status_code in [200, 201, 204]
         ):
+            # Push the object to delay
             send_webhook.delay(
                 event=self.webhook_event,
-                event_data=json.dumps(response.data, cls=DjangoJSONEncoder),
+                payload=response.data,
+                kw=self.kwargs,
                 action=self.request.method,
                 slug=self.workspace_slug,
+                bulk=self.bulk,
             )
 
         return response

apiserver/plane/app/views/config.py

@@ -58,6 +58,7 @@ class ConfigurationEndpoint(BaseAPIView):
         ) and get_configuration_value(
             instance_configuration, "ENABLE_MAGIC_LINK_LOGIN", "0"
         ) == "1"
+
         data["email_password_login"] = (
             get_configuration_value(
                 instance_configuration, "ENABLE_EMAIL_PASSWORD", "0"

apiserver/plane/app/views/cycle.py

@@ -502,7 +502,10 @@ class CycleViewSet(WebhookMixin, BaseViewSet):
 class CycleIssueViewSet(WebhookMixin, BaseViewSet):
     serializer_class = CycleIssueSerializer
     model = CycleIssue
-    webhook_event = "cycle"
+
+    webhook_event = "cycle_issue"
+    bulk = True
+
     permission_classes = [
         ProjectEntityPermission,
     ]
@@ -688,7 +691,6 @@ class CycleIssueViewSet(WebhookMixin, BaseViewSet):
             pk=pk, workspace__slug=slug, project_id=project_id, cycle_id=cycle_id
         )
         issue_id = cycle_issue.issue_id
-        cycle_issue.delete()
         issue_activity.delay(
             type="cycle.activity.deleted",
             requested_data=json.dumps(
@@ -698,11 +700,12 @@ class CycleIssueViewSet(WebhookMixin, BaseViewSet):
                 }
             ),
             actor_id=str(self.request.user.id),
-            issue_id=str(self.kwargs.get("pk", None)),
+            issue_id=str(cycle_issue.issue_id),
             project_id=str(self.kwargs.get("project_id", None)),
             current_instance=None,
             epoch=int(timezone.now().timestamp()),
         )
+        cycle_issue.delete()
         return Response(status=status.HTTP_204_NO_CONTENT)
 
 

apiserver/plane/app/views/external.py

@@ -1,6 +1,6 @@
 # Python imports
 import requests
-
+import os
 # Third party imports
 from openai import OpenAI
 from rest_framework.response import Response
@@ -27,8 +27,8 @@ class GPTIntegrationEndpoint(BaseAPIView):
 
         # Get the configuration value
         instance_configuration = InstanceConfiguration.objects.values("key", "value")
-        api_key = get_configuration_value(instance_configuration, "OPENAI_API_KEY")
-        gpt_engine = get_configuration_value(instance_configuration, "GPT_ENGINE")
+        api_key = get_configuration_value(instance_configuration, "OPENAI_API_KEY", os.environ.get("OPENAI_API_KEY"))
+        gpt_engine = get_configuration_value(instance_configuration, "GPT_ENGINE", os.environ.get("GPT_ENGINE", "gpt-3.5-turbo"))
 
         # Check the keys
         if not api_key or not gpt_engine:
@@ -47,10 +47,6 @@ class GPTIntegrationEndpoint(BaseAPIView):
 
         final_text = task + "\n" + prompt
 
-        instance_configuration = InstanceConfiguration.objects.values("key", "value")
-        
-        gpt_engine = get_configuration_value(instance_configuration, "GPT_ENGINE")
-
         client = OpenAI(
             api_key=api_key,
         )
@@ -85,14 +81,22 @@ class ReleaseNotesEndpoint(BaseAPIView):
 class UnsplashEndpoint(BaseAPIView):
 
     def get(self, request):
+        instance_configuration = InstanceConfiguration.objects.values("key", "value")
+        unsplash_access_key = get_configuration_value(instance_configuration, "UNSPLASH_ACCESS_KEY", os.environ.get("UNSPLASH_ACCESS_KEY"))
+
+        # Check unsplash access key
+        if not unsplash_access_key:
+            return Response([], status=status.HTTP_200_OK)
+
+        # Query parameters
         query = request.GET.get("query", False)
         page = request.GET.get("page", 1)
         per_page = request.GET.get("per_page", 20)
 
         url = (
-            f"https://api.unsplash.com/search/photos/?client_id={settings.UNSPLASH_ACCESS_KEY}&query={query}&page=${page}&per_page={per_page}"
+            f"https://api.unsplash.com/search/photos/?client_id={unsplash_access_key}&query={query}&page=${page}&per_page={per_page}"
             if query
-            else f"https://api.unsplash.com/photos/?client_id={settings.UNSPLASH_ACCESS_KEY}&page={page}&per_page={per_page}"
+            else f"https://api.unsplash.com/photos/?client_id={unsplash_access_key}&page={page}&per_page={per_page}"
         )
 
         headers = {

apiserver/plane/app/views/issue.py

@@ -596,7 +596,7 @@ class IssueActivityEndpoint(BaseAPIView):
 class IssueCommentViewSet(WebhookMixin, BaseViewSet):
     serializer_class = IssueCommentSerializer
     model = IssueComment
-    webhook_event = "issue-comment"
+    webhook_event = "issue_comment"
     permission_classes = [
         ProjectLitePermission,
     ]

apiserver/plane/app/views/module.py

@@ -283,9 +283,12 @@ class ModuleViewSet(WebhookMixin, BaseViewSet):
         return Response(status=status.HTTP_204_NO_CONTENT)
 
 
-class ModuleIssueViewSet(BaseViewSet):
+class ModuleIssueViewSet(WebhookMixin, BaseViewSet):
     serializer_class = ModuleIssueSerializer
     model = ModuleIssue
+    webhook_event = "module_issue"
+    bulk = True
+
 
     filterset_fields = [
         "issue__labels__id",
@@ -461,7 +464,6 @@ class ModuleIssueViewSet(BaseViewSet):
         module_issue = ModuleIssue.objects.get(
             workspace__slug=slug, project_id=project_id, module_id=module_id, pk=pk
         )
-        module_issue.delete()
         issue_activity.delay(
             type="module.activity.deleted",
             requested_data=json.dumps(
@@ -471,11 +473,12 @@ class ModuleIssueViewSet(BaseViewSet):
                 }
             ),
             actor_id=str(request.user.id),
-            issue_id=str(pk),
+            issue_id=str(module_issue.issue_id),
             project_id=str(project_id),
             current_instance=None,
             epoch=int(timezone.now().timestamp()),
         )
+        module_issue.delete()
         return Response(status=status.HTTP_204_NO_CONTENT)
 
 

apiserver/plane/app/views/project.py

@@ -388,7 +388,7 @@ class ProjectInvitationsViewset(BaseViewSet):
                 {"error": "You cannot invite a user with higher role"},
                 status=status.HTTP_400_BAD_REQUEST,
             )
-        
+
         workspace = Workspace.objects.get(slug=slug)
 
         project_invitations = []
@@ -424,7 +424,7 @@ class ProjectInvitationsViewset(BaseViewSet):
         project_invitations = ProjectMemberInvite.objects.bulk_create(
             project_invitations, batch_size=10, ignore_conflicts=True
         )
-        current_site = request.META.get('HTTP_ORIGIN')
+        current_site = request.META.get("HTTP_ORIGIN")
 
         # Send invitations
         for invitation in project_invitations:
@@ -469,6 +469,13 @@ class UserProjectInvitationsViewset(BaseViewSet):
         workspace_role = workspace_member.role
         workspace = workspace_member.workspace
 
+        # If the user was already part of workspace
+        _ = ProjectMember.objects.filter(
+            workspace__slug=slug,
+            project_id__in=project_ids,
+            member=request.user,
+        ).update(is_active=True)
+
         ProjectMember.objects.bulk_create(
             [
                 ProjectMember(
@@ -1040,4 +1047,4 @@ class ProjectDeployBoardViewSet(BaseViewSet):
         project_deploy_board.save()
 
         serializer = ProjectDeployBoardSerializer(project_deploy_board)
-        return Response(serializer.data, status=status.HTTP_200_OK)
+        return Response(serializer.data, status=status.HTTP_200_OK)

apiserver/plane/app/views/user.py

@@ -48,7 +48,7 @@ class UserEndpoint(BaseViewSet):
         if WorkspaceMember.objects.filter(member=request.user, is_active=True).exists():
             return Response(
                 {
-                    "error": "User cannot deactivate account as user is active in some workspaces"
+                    "error": "You cannot deactivate account as you are a member in some workspaces."
                 },
                 status=status.HTTP_400_BAD_REQUEST,
             )

apiserver/plane/app/views/webhook.py

@@ -20,9 +20,10 @@ class WebhookEndpoint(BaseAPIView):
 
     def post(self, request, slug):
         workspace = Workspace.objects.get(slug=slug)
-
         try:
-            serializer = WebhookSerializer(data=request.data)
+            serializer = WebhookSerializer(
+                data=request.data, context={"request": request}
+            )
             if serializer.is_valid():
                 serializer.save(workspace_id=workspace.id)
                 return Response(serializer.data, status=status.HTTP_201_CREATED)
@@ -79,6 +80,7 @@ class WebhookEndpoint(BaseAPIView):
         serializer = WebhookSerializer(
             webhook,
             data=request.data,
+            context={request: request},
             partial=True,
             fields=(
                 "id",

apiserver/plane/app/views/workspace.py

@@ -590,7 +590,7 @@ class WorkSpaceMemberViewSet(BaseViewSet):
                 member_with_role=Count(
                     "project_projectmember",
                     filter=Q(
-                        project_projectmember__member_id=request.user.id,
+                        project_projectmember__member_id=workspace_member.id,
                         project_projectmember__role=20,
                     ),
                 ),
@@ -600,7 +600,7 @@ class WorkSpaceMemberViewSet(BaseViewSet):
         ):
             return Response(
                 {
-                    "error": "User is part of some projects where they are the only admin you should leave that project first"
+                    "error": "User is a part of some projects where they are the only admin, they should either leave that project or promote another user to admin."
                 },
                 status=status.HTTP_400_BAD_REQUEST,
             )
@@ -635,7 +635,7 @@ class WorkSpaceMemberViewSet(BaseViewSet):
         ):
             return Response(
                 {
-                    "error": "You cannot leave the workspace as your the only admin of the workspace you will have to either delete the workspace or create an another admin"
+                    "error": "You cannot leave the workspace as you are the only admin of the workspace you will have to either delete the workspace or promote another user to admin."
                 },
                 status=status.HTTP_400_BAD_REQUEST,
             )
@@ -656,7 +656,7 @@ class WorkSpaceMemberViewSet(BaseViewSet):
         ):
             return Response(
                 {
-                    "error": "User is part of some projects where they are the only admin you should leave that project first"
+                    "error": "You are a part of some projects where you are the only admin, you should either leave the project or promote another user to admin."
                 },
                 status=status.HTTP_400_BAD_REQUEST,
             )