[SECUR-242] fix(api): scope bulk-asset associate by uploader, not project_id (regression from #9288)

[mguptahub]

Problem

Release-blocking regression in v1.4.0-rc1. Creating a project from the frontend fails at the "enable features" step:

POST /api/assets/v2/workspaces/<slug>/projects/<project_id>/<entity_id>/bulk/
→ 404 {"error": "The requested asset could not be found."}

Root cause

#9288 (WEB-7776, "scope FileAsset queries to prevent cross-project IDOR — Cluster F") added project_id=project_id to the lookup in ProjectBulkAssetEndpoint.post:

assets = FileAsset.objects.filter(id__in=asset_ids, workspace__slug=slug, project_id=project_id)

But this endpoint's job is to associate freshly-uploaded assets with a project/entity. A cover/feature asset uploaded during project creation still has project_id=NULL at this point — in fact this endpoint is what sets it (assets.update(project_id=project_id) for PROJECT_COVER). Requiring project_id to already match means the asset is never found → 404. master (v1.3.1) had no such filter, so the flow worked there.

Present in both preview and canary → ships in v1.4.0 unless patched.

Fix

Scope by created_by=request.user (ownership) instead of project_id=project_id (association state):

assets = FileAsset.objects.filter(id__in=asset_ids, workspace__slug=slug, created_by=request.user)

This still closes the IDOR #9288 targeted — a caller can only touch assets they uploaded, and @allow_permission([ADMIN, MEMBER, GUEST]) already scopes them to the target project — and it is stricter than the original master code (which had no ownership check at all), while allowing a not-yet-associated asset to be linked.

Testing

• ruff lint + format clean.
• Needs verification on redeploy: project creation → enable-features step should complete (204, not 404). ⚠️ Cherry-pick to canary for v1.4.0-rc2 (the RC is already deployed with the bug).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved bulk asset association security by restricting selectable assets to those uploaded by the requester within the target workspace.
  • Updated the bulk association behavior to support selecting assets that are either already linked to the project or not yet linked, when the requester has the required workspace access.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d2b4c408-9c12-4e37-a840-41fb4feb67f4

📥 Commits

Reviewing files that changed from the base of the PR and between e743cf4 and f5a5163.

📒 Files selected for processing (1)

• apps/api/plane/app/views/asset/v2.py

🚧 Files skipped from review as they are similar to previous changes (1)

• apps/api/plane/app/views/asset/v2.py

---

📝 Walkthrough

Walkthrough

The bulk asset association endpoint now selects requester-owned assets within the target workspace, including assets already associated with the target project and unassociated assets.

Changes

Bulk asset association

Layer / File(s)	Summary
Workspace-scoped asset lookup apps/api/plane/app/views/asset/v2.py	ProjectBulkAssetEndpoint.post uses Q filtering to select the requester’s workspace assets associated with the target project or no project association, with an explanatory IDOR-protection comment.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: dheeru0198

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly names the regression fix and the main behavior change in the bulk asset association flow.
Description check	✅ Passed	The description is detailed and covers the problem, root cause, fix, and testing, though it doesn't follow the template exactly.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/bulk-asset-associate-404

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[makeplane]

Linked to Plane Work Item(s)

• (SECUR-242) Regression: project-creation bulk-asset associate returns 404 (from #9288 IDOR scoping)

References

• (WEB-7776) fix(security): Asset IDOR — scope FileAsset queries to workspace + project (Cluster F)

This comment was auto-generated by Plane

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/api/plane/app/views/asset/v2.py`:
- Around line 711-718: Update the asset queryset in the association flow to
retain assets whose project_id is NULL or already matches the requested
project_id, while preserving the existing id, workspace, and created_by
constraints. Apply this boundary before the PROJECT_COVER and ISSUE_DESCRIPTION
branches use the assets.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2077629d-a091-49f6-977f-f90a0a42d7c6

📥 Commits

Reviewing files that changed from the base of the PR and between 49c4da6 and e743cf4.

📒 Files selected for processing (1)

• apps/api/plane/app/views/asset/v2.py

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[mguptahub]

Thanks @coderabbitai — valid, fixed in f5a5163. Scoping by created_by alone did let a caller move their own asset in from another project via the PROJECT_COVER/ISSUE_DESCRIPTION update branches.

Now bounded to unassociated or already-in-this-project assets, in addition to the uploader check:

assets = FileAsset.objects.filter(
    id__in=asset_ids,
    workspace__slug=slug,
    created_by=request.user,
).filter(Q(project_id=project_id) | Q(project_id__isnull=True))

• freshly-uploaded asset (project_id=NULL during project creation) → still links ✅ (fixes the 404)
• asset already in this project → re-linkable ✅
• asset belonging to a different project → rejected ✅ (no cross-project move)
• created_by + @allow_permission keep it to the caller's own uploads within a project they're a member of.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@mguptahub Thanks for the thorough fix. The created_by scope plus (project_id=project_id OR project_id IS NULL) closes the cross-project reassociation path while retaining both initial linking and idempotent re-linking. ✅

🐇✨

---

✏️ Learnings added

Learnt from: mguptahub
URL: https://github.com/makeplane/plane/pull/9495

Timestamp: 2026-07-29T06:25:43.122Z
Learning: In `apps/api/plane/app/views/asset/v2.py`, `ProjectBulkAssetEndpoint.post` must restrict bulk-linked `FileAsset` records to assets uploaded by `request.user` in the target workspace that are either unassociated (`project_id IS NULL`) or already associated with the target project (`project_id=project_id`). This preserves freshly uploaded assets during project creation and prevents cross-project asset moves, including through `PROJECT_COVER` and `ISSUE_DESCRIPTION` update branches.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

---

If you found this review helpful, would you consider giving us a shout-out on X?

Thank you for using CodeRabbit!