base

plane-src/apps/api/plane/app/serializers/__init__.py

@@ -0,0 +1,135 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from .base import BaseSerializer
+from .user import (
+    UserSerializer,
+    UserLiteSerializer,
+    ChangePasswordSerializer,
+    ResetPasswordSerializer,
+    UserAdminLiteSerializer,
+    UserMeSerializer,
+    UserMeSettingsSerializer,
+    ProfileSerializer,
+    AccountSerializer,
+)
+from .workspace import (
+    WorkSpaceSerializer,
+    WorkSpaceMemberSerializer,
+    WorkSpaceMemberInviteSerializer,
+    WorkspaceLiteSerializer,
+    WorkspaceThemeSerializer,
+    WorkspaceMemberAdminSerializer,
+    WorkspaceMemberMeSerializer,
+    WorkspaceUserPropertiesSerializer,
+    WorkspaceUserLinkSerializer,
+    WorkspaceRecentVisitSerializer,
+    WorkspaceHomePreferenceSerializer,
+    StickySerializer,
+)
+from .project import (
+    ProjectSerializer,
+    ProjectListSerializer,
+    ProjectDetailSerializer,
+    ProjectMemberSerializer,
+    ProjectMemberInviteSerializer,
+    ProjectIdentifierSerializer,
+    ProjectLiteSerializer,
+    ProjectMemberLiteSerializer,
+    DeployBoardSerializer,
+    ProjectMemberAdminSerializer,
+    ProjectPublicMemberSerializer,
+    ProjectMemberRoleSerializer,
+    ProjectMemberPreferenceSerializer,
+)
+from .state import StateSerializer, StateLiteSerializer
+from .view import IssueViewSerializer, ViewIssueListSerializer
+from .cycle import (
+    CycleSerializer,
+    CycleIssueSerializer,
+    CycleWriteSerializer,
+    CycleUserPropertiesSerializer,
+)
+from .asset import FileAssetSerializer
+from .issue import (
+    IssueCreateSerializer,
+    IssueActivitySerializer,
+    IssueCommentSerializer,
+    ProjectUserPropertySerializer,
+    IssueAssigneeSerializer,
+    LabelSerializer,
+    IssueSerializer,
+    IssueFlatSerializer,
+    IssueStateSerializer,
+    IssueLinkSerializer,
+    IssueIntakeSerializer,
+    IssueLiteSerializer,
+    IssueAttachmentSerializer,
+    IssueSubscriberSerializer,
+    IssueReactionSerializer,
+    CommentReactionSerializer,
+    IssueVoteSerializer,
+    IssueRelationSerializer,
+    RelatedIssueSerializer,
+    IssuePublicSerializer,
+    IssueDetailSerializer,
+    IssueReactionLiteSerializer,
+    IssueAttachmentLiteSerializer,
+    IssueLinkLiteSerializer,
+    IssueVersionDetailSerializer,
+    IssueDescriptionVersionDetailSerializer,
+    IssueListDetailSerializer,
+)
+
+from .module import (
+    ModuleDetailSerializer,
+    ModuleWriteSerializer,
+    ModuleSerializer,
+    ModuleIssueSerializer,
+    ModuleLinkSerializer,
+    ModuleUserPropertiesSerializer,
+)
+
+from .api import APITokenSerializer, APITokenReadSerializer
+
+from .importer import ImporterSerializer
+
+from .page import (
+    PageSerializer,
+    PageDetailSerializer,
+    PageVersionSerializer,
+    PageBinaryUpdateSerializer,
+    PageVersionDetailSerializer,
+)
+
+from .estimate import (
+    EstimateSerializer,
+    EstimatePointSerializer,
+    EstimateReadSerializer,
+    WorkspaceEstimateSerializer,
+)
+
+from .intake import (
+    IntakeSerializer,
+    IntakeIssueSerializer,
+    IssueStateIntakeSerializer,
+    IntakeIssueLiteSerializer,
+    IntakeIssueDetailSerializer,
+)
+
+from .analytic import AnalyticViewSerializer
+
+from .notification import NotificationSerializer, UserNotificationPreferenceSerializer
+
+from .exporter import ExporterHistorySerializer
+
+from .webhook import WebhookSerializer, WebhookLogSerializer
+
+from .favorite import UserFavoriteSerializer
+
+from .draft import (
+    DraftIssueCreateSerializer,
+    DraftIssueSerializer,
+    DraftIssueDetailSerializer,
+)

plane-src/apps/api/plane/app/serializers/analytic.py

@@ -0,0 +1,31 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from .base import BaseSerializer
+from plane.db.models import AnalyticView
+from plane.utils.issue_filters import issue_filters
+
+
+class AnalyticViewSerializer(BaseSerializer):
+    class Meta:
+        model = AnalyticView
+        fields = "__all__"
+        read_only_fields = ["workspace", "query"]
+
+    def create(self, validated_data):
+        query_params = validated_data.get("query_dict", {})
+        if bool(query_params):
+            validated_data["query"] = issue_filters(query_params, "POST")
+        else:
+            validated_data["query"] = {}
+        return AnalyticView.objects.create(**validated_data)
+
+    def update(self, instance, validated_data):
+        query_params = validated_data.get("query_data", {})
+        if bool(query_params):
+            validated_data["query"] = issue_filters(query_params, "POST")
+        else:
+            validated_data["query"] = {}
+        validated_data["query"] = issue_filters(query_params, "PATCH")
+        return super().update(instance, validated_data)

plane-src/apps/api/plane/app/serializers/api.py

@@ -0,0 +1,44 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from .base import BaseSerializer
+from plane.db.models import APIToken, APIActivityLog
+from rest_framework import serializers
+from django.utils import timezone
+
+
+class APITokenSerializer(BaseSerializer):
+    class Meta:
+        model = APIToken
+        fields = "__all__"
+        read_only_fields = [
+            "token",
+            "expired_at",
+            "created_at",
+            "updated_at",
+            "workspace",
+            "user",
+            "is_active",
+            "last_used",
+            "user_type",
+        ]
+
+
+class APITokenReadSerializer(BaseSerializer):
+    is_active = serializers.SerializerMethodField()
+
+    class Meta:
+        model = APIToken
+        exclude = ("token",)
+
+    def get_is_active(self, obj: APIToken) -> bool:
+        if obj.expired_at is None:
+            return True
+        return timezone.now() < obj.expired_at
+
+
+class APIActivityLogSerializer(BaseSerializer):
+    class Meta:
+        model = APIActivityLog
+        fields = "__all__"

plane-src/apps/api/plane/app/serializers/asset.py

@@ -0,0 +1,13 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from .base import BaseSerializer
+from plane.db.models import FileAsset
+
+
+class FileAssetSerializer(BaseSerializer):
+    class Meta:
+        model = FileAsset
+        fields = "__all__"
+        read_only_fields = ["created_by", "updated_by", "created_at", "updated_at"]

plane-src/apps/api/plane/app/serializers/base.py

@@ -0,0 +1,201 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from rest_framework import serializers
+
+
+class BaseSerializer(serializers.ModelSerializer):
+    id = serializers.PrimaryKeyRelatedField(read_only=True)
+
+
+class DynamicBaseSerializer(BaseSerializer):
+    def __init__(self, *args, **kwargs):
+        # If 'fields' is provided in the arguments, remove it and store it separately.
+        # This is done so as not to pass this custom argument up to the superclass.
+        fields = kwargs.pop("fields", [])
+        self.expand = kwargs.pop("expand", []) or []
+        fields = self.expand
+
+        # Call the initialization of the superclass.
+        super().__init__(*args, **kwargs)
+        # If 'fields' was provided, filter the fields of the serializer accordingly.
+        if fields is not None:
+            self.fields = self._filter_fields(fields)
+
+    def _filter_fields(self, fields):
+        """
+        Adjust the serializer's fields based on the provided 'fields' list.
+
+        :param fields: List or dictionary specifying which fields to include in the serializer.
+        :return: The updated fields for the serializer.
+        """
+        # Check each field_name in the provided fields.
+        for field_name in fields:
+            # If the field is a dictionary (indicating nested fields),
+            # loop through its keys and values.
+            if isinstance(field_name, dict):
+                for key, value in field_name.items():
+                    # If the value of this nested field is a list,
+                    # perform a recursive filter on it.
+                    if isinstance(value, list):
+                        self._filter_fields(self.fields[key], value)
+
+        # Create a list to store allowed fields.
+        allowed = []
+        for item in fields:
+            # If the item is a string, it directly represents a field's name.
+            if isinstance(item, str):
+                allowed.append(item)
+            # If the item is a dictionary, it represents a nested field.
+            # Add the key of this dictionary to the allowed list.
+            elif isinstance(item, dict):
+                allowed.append(list(item.keys())[0])
+
+        for field in allowed:
+            if field not in self.fields:
+                from . import (
+                    WorkspaceLiteSerializer,
+                    ProjectLiteSerializer,
+                    UserLiteSerializer,
+                    StateLiteSerializer,
+                    IssueSerializer,
+                    LabelSerializer,
+                    CycleIssueSerializer,
+                    IssueLiteSerializer,
+                    IssueRelationSerializer,
+                    IntakeIssueLiteSerializer,
+                    IssueReactionLiteSerializer,
+                    IssueLinkLiteSerializer,
+                    RelatedIssueSerializer,
+                )
+
+                # Expansion mapper
+                expansion = {
+                    "user": UserLiteSerializer,
+                    "workspace": WorkspaceLiteSerializer,
+                    "project": ProjectLiteSerializer,
+                    "default_assignee": UserLiteSerializer,
+                    "project_lead": UserLiteSerializer,
+                    "state": StateLiteSerializer,
+                    "created_by": UserLiteSerializer,
+                    "issue": IssueSerializer,
+                    "actor": UserLiteSerializer,
+                    "owned_by": UserLiteSerializer,
+                    "members": UserLiteSerializer,
+                    "assignees": UserLiteSerializer,
+                    "labels": LabelSerializer,
+                    "issue_cycle": CycleIssueSerializer,
+                    "parent": IssueLiteSerializer,
+                    "issue_relation": IssueRelationSerializer,
+                    "issue_intake": IntakeIssueLiteSerializer,
+                    "issue_related": RelatedIssueSerializer,
+                    "issue_reactions": IssueReactionLiteSerializer,
+                    "issue_link": IssueLinkLiteSerializer,
+                    "sub_issues": IssueLiteSerializer,
+                }
+
+            if field not in self.fields and field in expansion:
+                self.fields[field] = expansion[field](
+                    many=(
+                        True
+                        if field
+                        in [
+                            "members",
+                            "assignees",
+                            "labels",
+                            "issue_cycle",
+                            "issue_relation",
+                            "issue_intake",
+                            "issue_reactions",
+                            "issue_attachment",
+                            "issue_link",
+                            "sub_issues",
+                            "issue_related",
+                        ]
+                        else False
+                    )
+                )
+
+        return self.fields
+
+    def to_representation(self, instance):
+        response = super().to_representation(instance)
+
+        # Ensure 'expand' is iterable before processing
+        if self.expand:
+            for expand in self.expand:
+                if expand in self.fields:
+                    # Import all the expandable serializers
+                    from . import (
+                        WorkspaceLiteSerializer,
+                        ProjectLiteSerializer,
+                        UserLiteSerializer,
+                        StateLiteSerializer,
+                        IssueSerializer,
+                        LabelSerializer,
+                        CycleIssueSerializer,
+                        IssueRelationSerializer,
+                        IntakeIssueLiteSerializer,
+                        IssueLiteSerializer,
+                        IssueReactionLiteSerializer,
+                        IssueAttachmentLiteSerializer,
+                        IssueLinkLiteSerializer,
+                        RelatedIssueSerializer,
+                    )
+
+                    # Expansion mapper
+                    expansion = {
+                        "user": UserLiteSerializer,
+                        "workspace": WorkspaceLiteSerializer,
+                        "project": ProjectLiteSerializer,
+                        "default_assignee": UserLiteSerializer,
+                        "project_lead": UserLiteSerializer,
+                        "state": StateLiteSerializer,
+                        "created_by": UserLiteSerializer,
+                        "issue": IssueSerializer,
+                        "actor": UserLiteSerializer,
+                        "owned_by": UserLiteSerializer,
+                        "members": UserLiteSerializer,
+                        "assignees": UserLiteSerializer,
+                        "labels": LabelSerializer,
+                        "issue_cycle": CycleIssueSerializer,
+                        "parent": IssueLiteSerializer,
+                        "issue_relation": IssueRelationSerializer,
+                        "issue_intake": IntakeIssueLiteSerializer,
+                        "issue_related": RelatedIssueSerializer,
+                        "issue_reactions": IssueReactionLiteSerializer,
+                        "issue_attachment": IssueAttachmentLiteSerializer,
+                        "issue_link": IssueLinkLiteSerializer,
+                        "sub_issues": IssueLiteSerializer,
+                    }
+                    # Check if field in expansion then expand the field
+                    if expand in expansion:
+                        if isinstance(response.get(expand), list):
+                            exp_serializer = expansion[expand](getattr(instance, expand), many=True)
+                        else:
+                            exp_serializer = expansion[expand](getattr(instance, expand))
+                        response[expand] = exp_serializer.data
+                    else:
+                        # You might need to handle this case differently
+                        response[expand] = getattr(instance, f"{expand}_id", None)
+
+            # Check if issue_attachments is in fields or expand
+            if "issue_attachments" in self.fields or "issue_attachments" in self.expand:
+                # Import the model here to avoid circular imports
+                from plane.db.models import FileAsset
+
+                issue_id = getattr(instance, "id", None)
+
+                if issue_id:
+                    # Fetch related issue_attachments
+                    issue_attachments = FileAsset.objects.filter(
+                        issue_id=issue_id,
+                        entity_type=FileAsset.EntityTypeContext.ISSUE_ATTACHMENT,
+                    )
+                    # Serialize issue_attachments and add them to the response
+                    response["issue_attachments"] = IssueAttachmentLiteSerializer(issue_attachments, many=True).data
+                else:
+                    response["issue_attachments"] = []
+
+        return response

plane-src/apps/api/plane/app/serializers/cycle.py

@@ -0,0 +1,106 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Third party imports
+from rest_framework import serializers
+
+# Module imports
+from .base import BaseSerializer
+from .issue import IssueStateSerializer
+from plane.db.models import Cycle, CycleIssue, CycleUserProperties
+from plane.utils.timezone_converter import convert_to_utc
+
+
+class CycleWriteSerializer(BaseSerializer):
+    def validate(self, data):
+        if (
+            data.get("start_date", None) is not None
+            and data.get("end_date", None) is not None
+            and data.get("start_date", None) > data.get("end_date", None)
+        ):
+            raise serializers.ValidationError("Start date cannot exceed end date")
+        if data.get("start_date", None) is not None and data.get("end_date", None) is not None:
+            project_id = (
+                self.initial_data.get("project_id", None)
+                or (self.instance and self.instance.project_id)
+                or self.context.get("project_id", None)
+            )
+            data["start_date"] = convert_to_utc(
+                date=str(data.get("start_date").date()),
+                project_id=project_id,
+                is_start_date=True,
+            )
+            data["end_date"] = convert_to_utc(
+                date=str(data.get("end_date", None).date()),
+                project_id=project_id,
+            )
+        return data
+
+    class Meta:
+        model = Cycle
+        fields = "__all__"
+        read_only_fields = ["workspace", "project", "owned_by", "archived_at"]
+
+
+class CycleSerializer(BaseSerializer):
+    # favorite
+    is_favorite = serializers.BooleanField(read_only=True)
+    total_issues = serializers.IntegerField(read_only=True)
+    # state group wise distribution
+    cancelled_issues = serializers.IntegerField(read_only=True)
+    completed_issues = serializers.IntegerField(read_only=True)
+    started_issues = serializers.IntegerField(read_only=True)
+    unstarted_issues = serializers.IntegerField(read_only=True)
+    backlog_issues = serializers.IntegerField(read_only=True)
+
+    # active | draft | upcoming | completed
+    status = serializers.CharField(read_only=True)
+
+    class Meta:
+        model = Cycle
+        fields = [
+            # necessary fields
+            "id",
+            "workspace_id",
+            "project_id",
+            # model fields
+            "name",
+            "description",
+            "start_date",
+            "end_date",
+            "owned_by_id",
+            "view_props",
+            "sort_order",
+            "external_source",
+            "external_id",
+            "progress_snapshot",
+            "logo_props",
+            # meta fields
+            "is_favorite",
+            "total_issues",
+            "cancelled_issues",
+            "completed_issues",
+            "started_issues",
+            "unstarted_issues",
+            "backlog_issues",
+            "status",
+        ]
+        read_only_fields = fields
+
+
+class CycleIssueSerializer(BaseSerializer):
+    issue_detail = IssueStateSerializer(read_only=True, source="issue")
+    sub_issues_count = serializers.IntegerField(read_only=True)
+
+    class Meta:
+        model = CycleIssue
+        fields = "__all__"
+        read_only_fields = ["workspace", "project", "cycle"]
+
+
+class CycleUserPropertiesSerializer(BaseSerializer):
+    class Meta:
+        model = CycleUserProperties
+        fields = "__all__"
+        read_only_fields = ["workspace", "project", "cycle", "user"]

plane-src/apps/api/plane/app/serializers/draft.py

@@ -0,0 +1,342 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Django imports
+from django.utils import timezone
+
+# Third Party imports
+from rest_framework import serializers
+
+# Module imports
+from .base import BaseSerializer
+from plane.db.models import (
+    User,
+    Issue,
+    Label,
+    State,
+    DraftIssue,
+    DraftIssueAssignee,
+    DraftIssueLabel,
+    DraftIssueCycle,
+    DraftIssueModule,
+    ProjectMember,
+    EstimatePoint,
+)
+from plane.utils.content_validator import (
+    validate_html_content,
+    validate_binary_data,
+)
+from plane.app.permissions import ROLE
+
+
+class DraftIssueCreateSerializer(BaseSerializer):
+    # ids
+    state_id = serializers.PrimaryKeyRelatedField(
+        source="state", queryset=State.objects.all(), required=False, allow_null=True
+    )
+    parent_id = serializers.PrimaryKeyRelatedField(
+        source="parent", queryset=Issue.objects.all(), required=False, allow_null=True
+    )
+    label_ids = serializers.ListField(
+        child=serializers.PrimaryKeyRelatedField(queryset=Label.objects.all()),
+        write_only=True,
+        required=False,
+    )
+    assignee_ids = serializers.ListField(
+        child=serializers.PrimaryKeyRelatedField(queryset=User.objects.all()),
+        write_only=True,
+        required=False,
+    )
+
+    class Meta:
+        model = DraftIssue
+        fields = "__all__"
+        read_only_fields = [
+            "workspace",
+            "created_by",
+            "updated_by",
+            "created_at",
+            "updated_at",
+        ]
+
+    def to_representation(self, instance):
+        data = super().to_representation(instance)
+        assignee_ids = self.initial_data.get("assignee_ids")
+        data["assignee_ids"] = assignee_ids if assignee_ids else []
+        label_ids = self.initial_data.get("label_ids")
+        data["label_ids"] = label_ids if label_ids else []
+        return data
+
+    def validate(self, attrs):
+        if (
+            attrs.get("start_date", None) is not None
+            and attrs.get("target_date", None) is not None
+            and attrs.get("start_date", None) > attrs.get("target_date", None)
+        ):
+            raise serializers.ValidationError("Start date cannot exceed target date")
+
+        # Validate description content for security
+        if "description_html" in attrs and attrs["description_html"]:
+            is_valid, error_msg, sanitized_html = validate_html_content(attrs["description_html"])
+            if not is_valid:
+                raise serializers.ValidationError({"error": "html content is not valid"})
+            # Update the attrs with sanitized HTML if available
+            if sanitized_html is not None:
+                attrs["description_html"] = sanitized_html
+
+        if "description_binary" in attrs and attrs["description_binary"]:
+            is_valid, error_msg = validate_binary_data(attrs["description_binary"])
+            if not is_valid:
+                raise serializers.ValidationError({"description_binary": "Invalid binary data"})
+
+        # Validate assignees are from project
+        if attrs.get("assignee_ids", []):
+            attrs["assignee_ids"] = ProjectMember.objects.filter(
+                project_id=self.context["project_id"],
+                role__gte=ROLE.MEMBER.value,
+                is_active=True,
+                member_id__in=attrs["assignee_ids"],
+            ).values_list("member_id", flat=True)
+
+        # Validate labels are from project
+        if attrs.get("label_ids"):
+            label_ids = [label.id for label in attrs["label_ids"]]
+            attrs["label_ids"] = list(
+                Label.objects.filter(project_id=self.context.get("project_id"), id__in=label_ids).values_list(
+                    "id", flat=True
+                )
+            )
+
+        # # Check state is from the project only else raise validation error
+        if (
+            attrs.get("state")
+            and not State.objects.filter(
+                project_id=self.context.get("project_id"),
+                pk=attrs.get("state").id,
+            ).exists()
+        ):
+            raise serializers.ValidationError("State is not valid please pass a valid state_id")
+
+        # # Check parent issue is from workspace as it can be cross workspace
+        if (
+            attrs.get("parent")
+            and not Issue.objects.filter(
+                project_id=self.context.get("project_id"),
+                pk=attrs.get("parent").id,
+            ).exists()
+        ):
+            raise serializers.ValidationError("Parent is not valid issue_id please pass a valid issue_id")
+
+        if (
+            attrs.get("estimate_point")
+            and not EstimatePoint.objects.filter(
+                project_id=self.context.get("project_id"),
+                pk=attrs.get("estimate_point").id,
+            ).exists()
+        ):
+            raise serializers.ValidationError("Estimate point is not valid please pass a valid estimate_point_id")
+
+        return attrs
+
+    def create(self, validated_data):
+        assignees = validated_data.pop("assignee_ids", None)
+        labels = validated_data.pop("label_ids", None)
+        modules = validated_data.pop("module_ids", None)
+        cycle_id = self.initial_data.get("cycle_id", None)
+        modules = self.initial_data.get("module_ids", None)
+
+        workspace_id = self.context["workspace_id"]
+        project_id = self.context["project_id"]
+
+        # Create Issue
+        issue = DraftIssue.objects.create(**validated_data, workspace_id=workspace_id, project_id=project_id)
+
+        # Issue Audit Users
+        created_by_id = issue.created_by_id
+        updated_by_id = issue.updated_by_id
+
+        if assignees is not None and len(assignees):
+            DraftIssueAssignee.objects.bulk_create(
+                [
+                    DraftIssueAssignee(
+                        assignee_id=assignee_id,
+                        draft_issue=issue,
+                        workspace_id=workspace_id,
+                        project_id=project_id,
+                        created_by_id=created_by_id,
+                        updated_by_id=updated_by_id,
+                    )
+                    for assignee_id in assignees
+                ],
+                batch_size=10,
+            )
+
+        if labels is not None and len(labels):
+            DraftIssueLabel.objects.bulk_create(
+                [
+                    DraftIssueLabel(
+                        label_id=label_id,
+                        draft_issue=issue,
+                        project_id=project_id,
+                        workspace_id=workspace_id,
+                        created_by_id=created_by_id,
+                        updated_by_id=updated_by_id,
+                    )
+                    for label_id in labels
+                ],
+                batch_size=10,
+            )
+
+        if cycle_id is not None:
+            DraftIssueCycle.objects.create(
+                cycle_id=cycle_id,
+                draft_issue=issue,
+                project_id=project_id,
+                workspace_id=workspace_id,
+                created_by_id=created_by_id,
+                updated_by_id=updated_by_id,
+            )
+
+        if modules is not None and len(modules):
+            DraftIssueModule.objects.bulk_create(
+                [
+                    DraftIssueModule(
+                        module_id=module_id,
+                        draft_issue=issue,
+                        project_id=project_id,
+                        workspace_id=workspace_id,
+                        created_by_id=created_by_id,
+                        updated_by_id=updated_by_id,
+                    )
+                    for module_id in modules
+                ],
+                batch_size=10,
+            )
+
+        return issue
+
+    def update(self, instance, validated_data):
+        assignees = validated_data.pop("assignee_ids", None)
+        labels = validated_data.pop("label_ids", None)
+        cycle_id = self.context.get("cycle_id", None)
+        modules = self.initial_data.get("module_ids", None)
+
+        # Related models
+        workspace_id = instance.workspace_id
+        project_id = instance.project_id
+
+        created_by_id = instance.created_by_id
+        updated_by_id = instance.updated_by_id
+
+        if assignees is not None:
+            DraftIssueAssignee.objects.filter(draft_issue=instance).delete()
+            DraftIssueAssignee.objects.bulk_create(
+                [
+                    DraftIssueAssignee(
+                        assignee_id=assignee_id,
+                        draft_issue=instance,
+                        workspace_id=workspace_id,
+                        project_id=project_id,
+                        created_by_id=created_by_id,
+                        updated_by_id=updated_by_id,
+                    )
+                    for assignee_id in assignees
+                ],
+                batch_size=10,
+            )
+
+        if labels is not None:
+            DraftIssueLabel.objects.filter(draft_issue=instance).delete()
+            DraftIssueLabel.objects.bulk_create(
+                [
+                    DraftIssueLabel(
+                        label_id=label,
+                        draft_issue=instance,
+                        workspace_id=workspace_id,
+                        project_id=project_id,
+                        created_by_id=created_by_id,
+                        updated_by_id=updated_by_id,
+                    )
+                    for label in labels
+                ],
+                batch_size=10,
+            )
+
+        if cycle_id != "not_provided":
+            DraftIssueCycle.objects.filter(draft_issue=instance).delete()
+            if cycle_id:
+                DraftIssueCycle.objects.create(
+                    cycle_id=cycle_id,
+                    draft_issue=instance,
+                    workspace_id=workspace_id,
+                    project_id=project_id,
+                    created_by_id=created_by_id,
+                    updated_by_id=updated_by_id,
+                )
+
+        if modules is not None:
+            DraftIssueModule.objects.filter(draft_issue=instance).delete()
+            DraftIssueModule.objects.bulk_create(
+                [
+                    DraftIssueModule(
+                        module_id=module_id,
+                        draft_issue=instance,
+                        workspace_id=workspace_id,
+                        project_id=project_id,
+                        created_by_id=created_by_id,
+                        updated_by_id=updated_by_id,
+                    )
+                    for module_id in modules
+                ],
+                batch_size=10,
+            )
+
+        # Time updation occurs even when other related models are updated
+        instance.updated_at = timezone.now()
+        return super().update(instance, validated_data)
+
+
+class DraftIssueSerializer(BaseSerializer):
+    # ids
+    cycle_id = serializers.PrimaryKeyRelatedField(read_only=True)
+    module_ids = serializers.ListField(child=serializers.UUIDField(), required=False)
+
+    # Many to many
+    label_ids = serializers.ListField(child=serializers.UUIDField(), required=False)
+    assignee_ids = serializers.ListField(child=serializers.UUIDField(), required=False)
+
+    class Meta:
+        model = DraftIssue
+        fields = [
+            "id",
+            "name",
+            "state_id",
+            "sort_order",
+            "completed_at",
+            "estimate_point",
+            "priority",
+            "start_date",
+            "target_date",
+            "project_id",
+            "parent_id",
+            "cycle_id",
+            "module_ids",
+            "label_ids",
+            "assignee_ids",
+            "created_at",
+            "updated_at",
+            "created_by",
+            "updated_by",
+            "type_id",
+            "description_html",
+        ]
+        read_only_fields = fields
+
+
+class DraftIssueDetailSerializer(DraftIssueSerializer):
+    description_html = serializers.CharField()
+
+    class Meta(DraftIssueSerializer.Meta):
+        fields = DraftIssueSerializer.Meta.fields + ["description_html"]
+        read_only_fields = fields

plane-src/apps/api/plane/app/serializers/estimate.py

@@ -0,0 +1,50 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Module imports
+from .base import BaseSerializer
+
+from plane.db.models import Estimate, EstimatePoint
+
+from rest_framework import serializers
+
+
+class EstimateSerializer(BaseSerializer):
+    class Meta:
+        model = Estimate
+        fields = "__all__"
+        read_only_fields = ["workspace", "project"]
+
+
+class EstimatePointSerializer(BaseSerializer):
+    def validate(self, data):
+        if not data:
+            raise serializers.ValidationError("Estimate points are required")
+        value = data.get("value")
+        if value and len(value) > 20:
+            raise serializers.ValidationError("Value can't be more than 20 characters")
+        return data
+
+    class Meta:
+        model = EstimatePoint
+        fields = "__all__"
+        read_only_fields = ["estimate", "workspace", "project"]
+
+
+class EstimateReadSerializer(BaseSerializer):
+    points = EstimatePointSerializer(read_only=True, many=True)
+
+    class Meta:
+        model = Estimate
+        fields = "__all__"
+        read_only_fields = ["points", "name", "description"]
+
+
+class WorkspaceEstimateSerializer(BaseSerializer):
+    points = EstimatePointSerializer(read_only=True, many=True)
+
+    class Meta:
+        model = Estimate
+        fields = "__all__"
+        read_only_fields = ["points", "name", "description"]

plane-src/apps/api/plane/app/serializers/exporter.py

@@ -0,0 +1,30 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Module imports
+from .base import BaseSerializer
+from plane.db.models import ExporterHistory
+from .user import UserLiteSerializer
+
+
+class ExporterHistorySerializer(BaseSerializer):
+    initiated_by_detail = UserLiteSerializer(source="initiated_by", read_only=True)
+
+    class Meta:
+        model = ExporterHistory
+        fields = [
+            "id",
+            "created_at",
+            "updated_at",
+            "project",
+            "provider",
+            "status",
+            "url",
+            "initiated_by",
+            "initiated_by_detail",
+            "token",
+            "created_by",
+            "updated_by",
+        ]
+        read_only_fields = fields

plane-src/apps/api/plane/app/serializers/favorite.py

@@ -0,0 +1,89 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from rest_framework import serializers
+
+from plane.db.models import UserFavorite, Cycle, Module, Issue, IssueView, Page, Project
+
+
+class ProjectFavoriteLiteSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = Project
+        fields = ["id", "name", "logo_props"]
+
+
+class PageFavoriteLiteSerializer(serializers.ModelSerializer):
+    project_id = serializers.SerializerMethodField()
+
+    class Meta:
+        model = Page
+        fields = ["id", "name", "logo_props", "project_id"]
+
+    def get_project_id(self, obj):
+        project = obj.projects.first()  # This gets the first project related to the Page
+        return project.id if project else None
+
+
+class CycleFavoriteLiteSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = Cycle
+        fields = ["id", "name", "logo_props", "project_id"]
+
+
+class ModuleFavoriteLiteSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = Module
+        fields = ["id", "name", "logo_props", "project_id"]
+
+
+class ViewFavoriteSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = IssueView
+        fields = ["id", "name", "logo_props", "project_id"]
+
+
+def get_entity_model_and_serializer(entity_type):
+    entity_map = {
+        "cycle": (Cycle, CycleFavoriteLiteSerializer),
+        "issue": (Issue, None),
+        "module": (Module, ModuleFavoriteLiteSerializer),
+        "view": (IssueView, ViewFavoriteSerializer),
+        "page": (Page, PageFavoriteLiteSerializer),
+        "project": (Project, ProjectFavoriteLiteSerializer),
+        "folder": (None, None),
+    }
+    return entity_map.get(entity_type, (None, None))
+
+
+class UserFavoriteSerializer(serializers.ModelSerializer):
+    entity_data = serializers.SerializerMethodField()
+
+    class Meta:
+        model = UserFavorite
+        fields = [
+            "id",
+            "entity_type",
+            "entity_identifier",
+            "entity_data",
+            "name",
+            "is_folder",
+            "sequence",
+            "parent",
+            "workspace_id",
+            "project_id",
+        ]
+        read_only_fields = ["workspace", "created_by", "updated_by"]
+
+    def get_entity_data(self, obj):
+        entity_type = obj.entity_type
+        entity_identifier = obj.entity_identifier
+
+        entity_model, entity_serializer = get_entity_model_and_serializer(entity_type)
+        if entity_model and entity_serializer:
+            try:
+                entity = entity_model.objects.get(pk=entity_identifier)
+                return entity_serializer(entity).data
+            except entity_model.DoesNotExist:
+                return None
+        return None

plane-src/apps/api/plane/app/serializers/importer.py

@@ -0,0 +1,20 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Module imports
+from .base import BaseSerializer
+from .user import UserLiteSerializer
+from .project import ProjectLiteSerializer
+from .workspace import WorkspaceLiteSerializer
+from plane.db.models import Importer
+
+
+class ImporterSerializer(BaseSerializer):
+    initiated_by_detail = UserLiteSerializer(source="initiated_by", read_only=True)
+    project_detail = ProjectLiteSerializer(source="project", read_only=True)
+    workspace_detail = WorkspaceLiteSerializer(source="workspace", read_only=True)
+
+    class Meta:
+        model = Importer
+        fields = "__all__"

plane-src/apps/api/plane/app/serializers/intake.py

@@ -0,0 +1,137 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Third party frameworks
+from rest_framework import serializers
+
+# Module imports
+from .base import BaseSerializer
+from .issue import IssueIntakeSerializer, LabelLiteSerializer, IssueDetailSerializer
+from .project import ProjectLiteSerializer
+from .state import StateLiteSerializer
+from .user import UserLiteSerializer
+from plane.db.models import Intake, IntakeIssue, Issue, StateGroup, State
+
+
+class IntakeSerializer(BaseSerializer):
+    project_detail = ProjectLiteSerializer(source="project", read_only=True)
+    pending_issue_count = serializers.IntegerField(read_only=True)
+
+    class Meta:
+        model = Intake
+        fields = "__all__"
+        read_only_fields = ["project", "workspace"]
+
+
+class IntakeIssueSerializer(BaseSerializer):
+    issue = IssueIntakeSerializer(read_only=True)
+
+    class Meta:
+        model = IntakeIssue
+        fields = [
+            "id",
+            "status",
+            "duplicate_to",
+            "snoozed_till",
+            "source",
+            "issue",
+            "created_by",
+        ]
+        read_only_fields = ["project", "workspace"]
+
+    def validate(self, attrs):
+        """
+        Validate that if status is being changed to accepted (1),
+        the project has a default state to transition to.
+        """
+
+        # Check if status is being updated to accepted
+        if attrs.get("status") == 1:
+            intake_issue = self.instance
+            issue = intake_issue.issue
+
+            # Check if issue is in TRIAGE state
+            if issue.state and issue.state.group == StateGroup.TRIAGE.value:
+                # Verify default state exists before allowing the update
+                default_state = State.objects.filter(
+                    workspace=intake_issue.workspace, project=intake_issue.project, default=True
+                ).first()
+
+                if not default_state:
+                    raise serializers.ValidationError(
+                        {"status": "Cannot accept intake issue: No default state found for the project"}
+                    )
+
+        return attrs
+
+    def update(self, instance, validated_data):
+        # Update the intake issue
+        instance = super().update(instance, validated_data)
+
+        # If status is accepted (1), transition the issue state from TRIAGE to default
+        if validated_data.get("status") == 1:
+            issue = instance.issue
+            if issue.state and issue.state.group == StateGroup.TRIAGE.value:
+                # Get the default project state
+                default_state = State.objects.filter(
+                    workspace=instance.workspace, project=instance.project, default=True
+                ).first()
+                if default_state:
+                    issue.state = default_state
+                    issue.save()
+
+        return instance
+
+    def to_representation(self, instance):
+        # Pass the annotated fields to the Issue instance if they exist
+        if hasattr(instance, "label_ids"):
+            instance.issue.label_ids = instance.label_ids
+        return super().to_representation(instance)
+
+
+class IntakeIssueDetailSerializer(BaseSerializer):
+    issue = IssueDetailSerializer(read_only=True)
+    duplicate_issue_detail = IssueIntakeSerializer(read_only=True, source="duplicate_to")
+
+    class Meta:
+        model = IntakeIssue
+        fields = [
+            "id",
+            "status",
+            "duplicate_to",
+            "snoozed_till",
+            "duplicate_issue_detail",
+            "source",
+            "issue",
+        ]
+        read_only_fields = ["project", "workspace"]
+
+    def to_representation(self, instance):
+        # Pass the annotated fields to the Issue instance if they exist
+        if hasattr(instance, "assignee_ids"):
+            instance.issue.assignee_ids = instance.assignee_ids
+        if hasattr(instance, "label_ids"):
+            instance.issue.label_ids = instance.label_ids
+
+        return super().to_representation(instance)
+
+
+class IntakeIssueLiteSerializer(BaseSerializer):
+    class Meta:
+        model = IntakeIssue
+        fields = ["id", "status", "duplicate_to", "snoozed_till", "source"]
+        read_only_fields = fields
+
+
+class IssueStateIntakeSerializer(BaseSerializer):
+    state_detail = StateLiteSerializer(read_only=True, source="state")
+    project_detail = ProjectLiteSerializer(read_only=True, source="project")
+    label_details = LabelLiteSerializer(read_only=True, source="labels", many=True)
+    assignee_details = UserLiteSerializer(read_only=True, source="assignees", many=True)
+    sub_issues_count = serializers.IntegerField(read_only=True)
+    issue_intake = IntakeIssueLiteSerializer(read_only=True, many=True)
+
+    class Meta:
+        model = Issue
+        fields = "__all__"

plane-src/apps/api/plane/app/serializers/module.py

@@ -0,0 +1,280 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Third Party imports
+from rest_framework import serializers
+
+# Module imports
+from .base import BaseSerializer, DynamicBaseSerializer
+from .project import ProjectLiteSerializer
+
+# Django imports
+from django.core.validators import URLValidator
+from django.core.exceptions import ValidationError
+
+from plane.db.models import (
+    User,
+    Module,
+    ModuleMember,
+    ModuleIssue,
+    ModuleLink,
+    ModuleUserProperties,
+)
+
+
+class ModuleWriteSerializer(BaseSerializer):
+    lead_id = serializers.PrimaryKeyRelatedField(
+        source="lead", queryset=User.objects.all(), required=False, allow_null=True
+    )
+    member_ids = serializers.ListField(
+        child=serializers.PrimaryKeyRelatedField(queryset=User.objects.all()),
+        write_only=True,
+        required=False,
+    )
+
+    class Meta:
+        model = Module
+        fields = "__all__"
+        read_only_fields = [
+            "workspace",
+            "project",
+            "created_by",
+            "updated_by",
+            "created_at",
+            "updated_at",
+            "archived_at",
+            "deleted_at",
+        ]
+
+    def to_representation(self, instance):
+        data = super().to_representation(instance)
+        data["member_ids"] = [str(member.id) for member in instance.members.all()]
+        return data
+
+    def validate(self, data):
+        if (
+            data.get("start_date", None) is not None
+            and data.get("target_date", None) is not None
+            and data.get("start_date", None) > data.get("target_date", None)
+        ):
+            raise serializers.ValidationError("Start date cannot exceed target date")
+        return data
+
+    def create(self, validated_data):
+        members = validated_data.pop("member_ids", None)
+        project = self.context["project"]
+
+        module_name = validated_data.get("name")
+        if module_name:
+            # Lookup for the module name in the module table for that project
+            if Module.objects.filter(name=module_name, project=project).exists():
+                raise serializers.ValidationError({"error": "Module with this name already exists"})
+
+        module = Module.objects.create(**validated_data, project=project)
+        if members is not None:
+            ModuleMember.objects.bulk_create(
+                [
+                    ModuleMember(
+                        module=module,
+                        member=member,
+                        project=project,
+                        workspace=project.workspace,
+                        created_by=module.created_by,
+                        updated_by=module.updated_by,
+                    )
+                    for member in members
+                ],
+                batch_size=10,
+                ignore_conflicts=True,
+            )
+
+        return module
+
+    def update(self, instance, validated_data):
+        members = validated_data.pop("member_ids", None)
+        module_name = validated_data.get("name")
+        if module_name:
+            # Lookup for the module name in the module table for that project
+            if Module.objects.filter(name=module_name, project=instance.project).exclude(id=instance.id).exists():
+                raise serializers.ValidationError({"error": "Module with this name already exists"})
+
+        if members is not None:
+            ModuleMember.objects.filter(module=instance).delete()
+            ModuleMember.objects.bulk_create(
+                [
+                    ModuleMember(
+                        module=instance,
+                        member=member,
+                        project=instance.project,
+                        workspace=instance.project.workspace,
+                        created_by=instance.created_by,
+                        updated_by=instance.updated_by,
+                    )
+                    for member in members
+                ],
+                batch_size=10,
+                ignore_conflicts=True,
+            )
+
+        return super().update(instance, validated_data)
+
+
+class ModuleFlatSerializer(BaseSerializer):
+    class Meta:
+        model = Module
+        fields = "__all__"
+        read_only_fields = [
+            "workspace",
+            "project",
+            "created_by",
+            "updated_by",
+            "created_at",
+            "updated_at",
+        ]
+
+
+class ModuleIssueSerializer(BaseSerializer):
+    module_detail = ModuleFlatSerializer(read_only=True, source="module")
+    issue_detail = ProjectLiteSerializer(read_only=True, source="issue")
+    sub_issues_count = serializers.IntegerField(read_only=True)
+
+    class Meta:
+        model = ModuleIssue
+        fields = "__all__"
+        read_only_fields = [
+            "workspace",
+            "project",
+            "created_by",
+            "updated_by",
+            "created_at",
+            "updated_at",
+            "module",
+        ]
+
+
+class ModuleLinkSerializer(BaseSerializer):
+    class Meta:
+        model = ModuleLink
+        fields = "__all__"
+        read_only_fields = [
+            "workspace",
+            "project",
+            "created_by",
+            "updated_by",
+            "created_at",
+            "updated_at",
+            "module",
+        ]
+
+    def to_internal_value(self, data):
+        # Modify the URL before validation by appending http:// if missing
+        url = data.get("url", "")
+        if url and not url.startswith(("http://", "https://")):
+            data["url"] = "http://" + url
+
+        return super().to_internal_value(data)
+
+    def validate_url(self, value):
+        # Use Django's built-in URLValidator for validation
+        url_validator = URLValidator()
+        try:
+            url_validator(value)
+        except ValidationError:
+            raise serializers.ValidationError({"error": "Invalid URL format."})
+
+        return value
+
+    def create(self, validated_data):
+        validated_data["url"] = self.validate_url(validated_data.get("url"))
+        if ModuleLink.objects.filter(url=validated_data.get("url"), module_id=validated_data.get("module_id")).exists():
+            raise serializers.ValidationError({"error": "URL already exists."})
+        return super().create(validated_data)
+
+    def update(self, instance, validated_data):
+        validated_data["url"] = self.validate_url(validated_data.get("url"))
+        if (
+            ModuleLink.objects.filter(url=validated_data.get("url"), module_id=instance.module_id)
+            .exclude(pk=instance.id)
+            .exists()
+        ):
+            raise serializers.ValidationError({"error": "URL already exists for this Issue"})
+
+        return super().update(instance, validated_data)
+
+
+class ModuleSerializer(DynamicBaseSerializer):
+    member_ids = serializers.ListField(child=serializers.UUIDField(), required=False, allow_null=True)
+    is_favorite = serializers.BooleanField(read_only=True)
+    total_issues = serializers.IntegerField(read_only=True)
+    cancelled_issues = serializers.IntegerField(read_only=True)
+    completed_issues = serializers.IntegerField(read_only=True)
+    started_issues = serializers.IntegerField(read_only=True)
+    unstarted_issues = serializers.IntegerField(read_only=True)
+    backlog_issues = serializers.IntegerField(read_only=True)
+    total_estimate_points = serializers.FloatField(read_only=True)
+    completed_estimate_points = serializers.FloatField(read_only=True)
+
+    class Meta:
+        model = Module
+        fields = [
+            # Required fields
+            "id",
+            "workspace_id",
+            "project_id",
+            # Model fields
+            "name",
+            "description",
+            "description_text",
+            "description_html",
+            "start_date",
+            "target_date",
+            "status",
+            "lead_id",
+            "member_ids",
+            "view_props",
+            "sort_order",
+            "external_source",
+            "external_id",
+            "logo_props",
+            # computed fields
+            "total_estimate_points",
+            "completed_estimate_points",
+            "is_favorite",
+            "total_issues",
+            "cancelled_issues",
+            "completed_issues",
+            "started_issues",
+            "unstarted_issues",
+            "backlog_issues",
+            "created_at",
+            "updated_at",
+            "archived_at",
+        ]
+        read_only_fields = fields
+
+
+class ModuleDetailSerializer(ModuleSerializer):
+    link_module = ModuleLinkSerializer(read_only=True, many=True)
+    sub_issues = serializers.IntegerField(read_only=True)
+    backlog_estimate_points = serializers.FloatField(read_only=True)
+    unstarted_estimate_points = serializers.FloatField(read_only=True)
+    started_estimate_points = serializers.FloatField(read_only=True)
+    cancelled_estimate_points = serializers.FloatField(read_only=True)
+
+    class Meta(ModuleSerializer.Meta):
+        fields = ModuleSerializer.Meta.fields + [
+            "link_module",
+            "sub_issues",
+            "backlog_estimate_points",
+            "unstarted_estimate_points",
+            "started_estimate_points",
+            "cancelled_estimate_points",
+        ]
+
+
+class ModuleUserPropertiesSerializer(BaseSerializer):
+    class Meta:
+        model = ModuleUserProperties
+        fields = "__all__"
+        read_only_fields = ["workspace", "project", "module", "user"]

plane-src/apps/api/plane/app/serializers/notification.py

@@ -0,0 +1,28 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Module imports
+from .base import BaseSerializer
+from .user import UserLiteSerializer
+from plane.db.models import Notification, UserNotificationPreference
+
+# Third Party imports
+from rest_framework import serializers
+
+
+class NotificationSerializer(BaseSerializer):
+    triggered_by_details = UserLiteSerializer(read_only=True, source="triggered_by")
+    is_inbox_issue = serializers.BooleanField(read_only=True)
+    is_intake_issue = serializers.BooleanField(read_only=True)
+    is_mentioned_notification = serializers.BooleanField(read_only=True)
+
+    class Meta:
+        model = Notification
+        fields = "__all__"
+
+
+class UserNotificationPreferenceSerializer(BaseSerializer):
+    class Meta:
+        model = UserNotificationPreference
+        fields = "__all__"

plane-src/apps/api/plane/app/serializers/page.py

@@ -0,0 +1,225 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Third party imports
+from rest_framework import serializers
+import base64
+
+# Module imports
+from .base import BaseSerializer
+from plane.utils.content_validator import (
+    validate_binary_data,
+    validate_html_content,
+)
+from plane.db.models import (
+    Page,
+    PageLabel,
+    Label,
+    ProjectPage,
+    Project,
+    PageVersion,
+)
+
+
+class PageSerializer(BaseSerializer):
+    is_favorite = serializers.BooleanField(read_only=True)
+    labels = serializers.ListField(
+        child=serializers.PrimaryKeyRelatedField(queryset=Label.objects.all()),
+        write_only=True,
+        required=False,
+    )
+    # Many to many
+    label_ids = serializers.ListField(child=serializers.UUIDField(), required=False)
+    project_ids = serializers.ListField(child=serializers.UUIDField(), required=False)
+
+    class Meta:
+        model = Page
+        fields = [
+            "id",
+            "name",
+            "owned_by",
+            "access",
+            "color",
+            "labels",
+            "parent",
+            "is_favorite",
+            "is_locked",
+            "archived_at",
+            "workspace",
+            "created_at",
+            "updated_at",
+            "created_by",
+            "updated_by",
+            "view_props",
+            "logo_props",
+            "label_ids",
+            "project_ids",
+        ]
+        read_only_fields = ["workspace", "owned_by"]
+
+    def create(self, validated_data):
+        labels = validated_data.pop("labels", None)
+        project_id = self.context["project_id"]
+        owned_by_id = self.context["owned_by_id"]
+        description_json = self.context["description_json"]
+        description_binary = self.context["description_binary"]
+        description_html = self.context["description_html"]
+
+        # Get the workspace id from the project
+        project = Project.objects.get(pk=project_id)
+
+        # Create the page
+        page = Page.objects.create(
+            **validated_data,
+            description_json=description_json,
+            description_binary=description_binary,
+            description_html=description_html,
+            owned_by_id=owned_by_id,
+            workspace_id=project.workspace_id,
+        )
+
+        # Create the project page
+        ProjectPage.objects.create(
+            workspace_id=page.workspace_id,
+            project_id=project_id,
+            page_id=page.id,
+            created_by_id=page.created_by_id,
+            updated_by_id=page.updated_by_id,
+        )
+
+        # Create page labels
+        if labels is not None:
+            PageLabel.objects.bulk_create(
+                [
+                    PageLabel(
+                        label=label,
+                        page=page,
+                        workspace_id=page.workspace_id,
+                        created_by_id=page.created_by_id,
+                        updated_by_id=page.updated_by_id,
+                    )
+                    for label in labels
+                ],
+                batch_size=10,
+            )
+        return page
+
+    def update(self, instance, validated_data):
+        labels = validated_data.pop("labels", None)
+        if labels is not None:
+            PageLabel.objects.filter(page=instance).delete()
+            PageLabel.objects.bulk_create(
+                [
+                    PageLabel(
+                        label=label,
+                        page=instance,
+                        workspace_id=instance.workspace_id,
+                        created_by_id=instance.created_by_id,
+                        updated_by_id=instance.updated_by_id,
+                    )
+                    for label in labels
+                ],
+                batch_size=10,
+            )
+
+        return super().update(instance, validated_data)
+
+
+class PageDetailSerializer(PageSerializer):
+    description_html = serializers.CharField()
+
+    class Meta(PageSerializer.Meta):
+        fields = PageSerializer.Meta.fields + ["description_html"]
+
+
+class PageVersionSerializer(BaseSerializer):
+    class Meta:
+        model = PageVersion
+        fields = [
+            "id",
+            "workspace",
+            "page",
+            "last_saved_at",
+            "owned_by",
+            "created_at",
+            "updated_at",
+            "created_by",
+            "updated_by",
+        ]
+        read_only_fields = ["workspace", "page"]
+
+
+class PageVersionDetailSerializer(BaseSerializer):
+    class Meta:
+        model = PageVersion
+        fields = [
+            "id",
+            "workspace",
+            "page",
+            "last_saved_at",
+            "description_binary",
+            "description_html",
+            "description_json",
+            "owned_by",
+            "created_at",
+            "updated_at",
+            "created_by",
+            "updated_by",
+        ]
+        read_only_fields = ["workspace", "page"]
+
+
+class PageBinaryUpdateSerializer(serializers.Serializer):
+    """Serializer for updating page binary description with validation"""
+
+    description_binary = serializers.CharField(required=False, allow_blank=True)
+    description_html = serializers.CharField(required=False, allow_blank=True)
+    description_json = serializers.JSONField(required=False, allow_null=True)
+
+    def validate_description_binary(self, value):
+        """Validate the base64-encoded binary data"""
+        if not value:
+            return value
+
+        try:
+            # Decode the base64 data
+            binary_data = base64.b64decode(value)
+
+            # Validate the binary data
+            is_valid, error_message = validate_binary_data(binary_data)
+            if not is_valid:
+                raise serializers.ValidationError(f"Invalid binary data: {error_message}")
+
+            return binary_data
+        except Exception as e:
+            if isinstance(e, serializers.ValidationError):
+                raise
+            raise serializers.ValidationError("Failed to decode base64 data")
+
+    def validate_description_html(self, value):
+        """Validate the HTML content"""
+        if not value:
+            return value
+
+        # Use the validation function from utils
+        is_valid, error_message, sanitized_html = validate_html_content(value)
+        if not is_valid:
+            raise serializers.ValidationError(error_message)
+
+        # Return sanitized HTML if available, otherwise return original
+        return sanitized_html if sanitized_html is not None else value
+
+    def update(self, instance, validated_data):
+        """Update the page instance with validated data"""
+        if "description_binary" in validated_data:
+            instance.description_binary = validated_data.get("description_binary")
+
+        if "description_html" in validated_data:
+            instance.description_html = validated_data.get("description_html")
+
+        if "description_json" in validated_data:
+            instance.description_json = validated_data.get("description_json")
+
+        instance.save()
+        return instance

plane-src/apps/api/plane/app/serializers/project.py

@@ -0,0 +1,236 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Third party imports
+from rest_framework import serializers
+
+# Python imports
+import re
+
+# Module imports
+from .base import BaseSerializer, DynamicBaseSerializer
+from django.db.models import Max
+from plane.app.serializers.workspace import WorkspaceLiteSerializer
+from plane.app.serializers.user import UserLiteSerializer, UserAdminLiteSerializer
+from plane.db.models import (
+    Project,
+    ProjectMember,
+    ProjectMemberInvite,
+    ProjectIdentifier,
+    DeployBoard,
+    ProjectPublicMember,
+    IssueSequence,
+)
+from plane.utils.content_validator import (
+    validate_html_content,
+)
+
+
+class ProjectSerializer(BaseSerializer):
+    workspace_detail = WorkspaceLiteSerializer(source="workspace", read_only=True)
+    inbox_view = serializers.BooleanField(read_only=True, source="intake_view")
+
+    class Meta:
+        model = Project
+        fields = "__all__"
+        read_only_fields = ["workspace", "deleted_at"]
+
+    def validate_name(self, name):
+        project_id = self.instance.id if self.instance else None
+        workspace_id = self.context["workspace_id"]
+
+        if re.match(Project.FORBIDDEN_IDENTIFIER_CHARS_PATTERN, name):
+            raise serializers.ValidationError(detail="PROJECT_NAME_CANNOT_CONTAIN_SPECIAL_CHARACTERS")
+
+        project = Project.objects.filter(name=name, workspace_id=workspace_id)
+
+        if project_id:
+            project = project.exclude(id=project_id)
+
+        if project.exists():
+            raise serializers.ValidationError(
+                detail="PROJECT_NAME_ALREADY_EXIST",
+            )
+
+        return name
+
+    def validate_identifier(self, identifier):
+        project_id = self.instance.id if self.instance else None
+        workspace_id = self.context["workspace_id"]
+
+        if re.match(Project.FORBIDDEN_IDENTIFIER_CHARS_PATTERN, identifier):
+            raise serializers.ValidationError(detail="PROJECT_IDENTIFIER_CANNOT_CONTAIN_SPECIAL_CHARACTERS")
+
+        project = Project.objects.filter(identifier=identifier, workspace_id=workspace_id)
+
+        if project_id:
+            project = project.exclude(id=project_id)
+
+        if project.exists():
+            raise serializers.ValidationError(
+                detail="PROJECT_IDENTIFIER_ALREADY_EXIST",
+            )
+
+        return identifier
+
+    def validate(self, data):
+        # Validate description content for security
+        if "description_html" in data and data["description_html"]:
+            is_valid, error_msg, sanitized_html = validate_html_content(str(data["description_html"]))
+            # Update the data with sanitized HTML if available
+            if sanitized_html is not None:
+                data["description_html"] = sanitized_html
+
+            if not is_valid:
+                raise serializers.ValidationError({"error": "html content is not valid"})
+
+        return data
+
+    def create(self, validated_data):
+        workspace_id = self.context["workspace_id"]
+
+        project = Project.objects.create(**validated_data, workspace_id=workspace_id)
+
+        ProjectIdentifier.objects.create(name=project.identifier, project=project, workspace_id=workspace_id)
+
+        return project
+
+
+class ProjectLiteSerializer(BaseSerializer):
+    class Meta:
+        model = Project
+        fields = [
+            "id",
+            "identifier",
+            "name",
+            "cover_image",
+            "cover_image_url",
+            "logo_props",
+            "description",
+        ]
+        read_only_fields = fields
+
+
+class ProjectListSerializer(DynamicBaseSerializer):
+    is_favorite = serializers.BooleanField(read_only=True)
+    sort_order = serializers.FloatField(read_only=True)
+    member_role = serializers.IntegerField(read_only=True)
+    anchor = serializers.CharField(read_only=True)
+    members = serializers.SerializerMethodField()
+    cover_image_url = serializers.CharField(read_only=True)
+    inbox_view = serializers.BooleanField(read_only=True, source="intake_view")
+    next_work_item_sequence = serializers.SerializerMethodField()
+
+    def get_members(self, obj):
+        project_members = getattr(obj, "members_list", None)
+        if project_members is not None:
+            # Filter members by the project ID
+            return [member.member_id for member in project_members if member.is_active and not member.member.is_bot]
+        return []
+
+    def get_next_work_item_sequence(self, obj):
+        """Get the next sequence ID that will be assigned to a new issue"""
+        max_sequence = IssueSequence.objects.filter(project_id=obj.id).aggregate(max_seq=Max("sequence"))["max_seq"]
+        return (max_sequence + 1) if max_sequence else 1
+
+    class Meta:
+        model = Project
+        fields = "__all__"
+
+
+class ProjectDetailSerializer(BaseSerializer):
+    # workspace = WorkSpaceSerializer(read_only=True)
+    default_assignee = UserLiteSerializer(read_only=True)
+    project_lead = UserLiteSerializer(read_only=True)
+    is_favorite = serializers.BooleanField(read_only=True)
+    sort_order = serializers.FloatField(read_only=True)
+    member_role = serializers.IntegerField(read_only=True)
+    anchor = serializers.CharField(read_only=True)
+
+    class Meta:
+        model = Project
+        fields = "__all__"
+
+
+class ProjectMemberSerializer(BaseSerializer):
+    workspace = WorkspaceLiteSerializer(read_only=True)
+    project = ProjectLiteSerializer(read_only=True)
+    member = UserLiteSerializer(read_only=True)
+
+    class Meta:
+        model = ProjectMember
+        fields = "__all__"
+
+
+class ProjectMemberPreferenceSerializer(BaseSerializer):
+    class Meta:
+        model = ProjectMember
+        fields = ["preferences", "project_id", "member_id", "workspace_id"]
+
+    def validate_preferences(self, value):
+        preferences = self.instance.preferences
+
+        preferences.update(value)
+        return preferences
+
+
+class ProjectMemberAdminSerializer(BaseSerializer):
+    workspace = WorkspaceLiteSerializer(read_only=True)
+    project = ProjectLiteSerializer(read_only=True)
+    member = UserAdminLiteSerializer(read_only=True)
+
+    class Meta:
+        model = ProjectMember
+        fields = "__all__"
+
+
+class ProjectMemberRoleSerializer(DynamicBaseSerializer):
+    original_role = serializers.IntegerField(source="role", read_only=True)
+
+    class Meta:
+        model = ProjectMember
+        fields = ("id", "role", "member", "project", "original_role", "created_at")
+        read_only_fields = ["original_role", "created_at"]
+
+
+class ProjectMemberInviteSerializer(BaseSerializer):
+    project = ProjectLiteSerializer(read_only=True)
+    workspace = WorkspaceLiteSerializer(read_only=True)
+
+    class Meta:
+        model = ProjectMemberInvite
+        fields = "__all__"
+
+
+class ProjectIdentifierSerializer(BaseSerializer):
+    class Meta:
+        model = ProjectIdentifier
+        fields = "__all__"
+
+
+class ProjectMemberLiteSerializer(BaseSerializer):
+    member = UserLiteSerializer(read_only=True)
+    is_subscribed = serializers.BooleanField(read_only=True)
+
+    class Meta:
+        model = ProjectMember
+        fields = ["member", "id", "is_subscribed"]
+        read_only_fields = fields
+
+
+class DeployBoardSerializer(BaseSerializer):
+    project_details = ProjectLiteSerializer(read_only=True, source="project")
+    workspace_detail = WorkspaceLiteSerializer(read_only=True, source="workspace")
+
+    class Meta:
+        model = DeployBoard
+        fields = "__all__"
+        read_only_fields = ["workspace", "project", "anchor"]
+
+
+class ProjectPublicMemberSerializer(BaseSerializer):
+    class Meta:
+        model = ProjectPublicMember
+        fields = "__all__"
+        read_only_fields = ["workspace", "project", "member"]

plane-src/apps/api/plane/app/serializers/state.py

@@ -0,0 +1,41 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Module imports
+from .base import BaseSerializer
+from rest_framework import serializers
+
+from plane.db.models import State, StateGroup
+
+
+class StateSerializer(BaseSerializer):
+    order = serializers.FloatField(required=False)
+
+    class Meta:
+        model = State
+        fields = [
+            "id",
+            "project_id",
+            "workspace_id",
+            "name",
+            "color",
+            "group",
+            "default",
+            "description",
+            "sequence",
+            "order",
+        ]
+        read_only_fields = ["workspace", "project"]
+
+    def validate(self, attrs):
+        if attrs.get("group") == StateGroup.TRIAGE.value:
+            raise serializers.ValidationError("Cannot create triage state")
+        return attrs
+
+
+class StateLiteSerializer(BaseSerializer):
+    class Meta:
+        model = State
+        fields = ["id", "name", "color", "group"]
+        read_only_fields = fields

plane-src/apps/api/plane/app/serializers/user.py

@@ -0,0 +1,212 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Third party imports
+from rest_framework import serializers
+
+# Module import
+from plane.db.models import Account, Profile, User, Workspace, WorkspaceMemberInvite
+from plane.utils.url import contains_url
+
+from .base import BaseSerializer
+
+
+class UserSerializer(BaseSerializer):
+    def validate_first_name(self, value):
+        if contains_url(value):
+            raise serializers.ValidationError("First name cannot contain a URL.")
+        return value
+
+    def validate_last_name(self, value):
+        if contains_url(value):
+            raise serializers.ValidationError("Last name cannot contain a URL.")
+        return value
+
+    class Meta:
+        model = User
+        # Exclude password field from the serializer
+        fields = [field.name for field in User._meta.fields if field.name != "password"]
+        # Make all system fields and email read only
+        read_only_fields = [
+            "id",
+            "username",
+            "mobile_number",
+            "email",
+            "token",
+            "created_at",
+            "updated_at",
+            "is_superuser",
+            "is_staff",
+            "is_managed",
+            "last_active",
+            "last_login_time",
+            "last_logout_time",
+            "last_login_ip",
+            "last_logout_ip",
+            "last_login_uagent",
+            "last_location",
+            "last_login_medium",
+            "created_location",
+            "is_bot",
+            "is_password_autoset",
+            "is_email_verified",
+            "is_active",
+            "token_updated_at",
+        ]
+
+        # If the user has already filled first name or last name then he is onboarded
+        def get_is_onboarded(self, obj):
+            return bool(obj.first_name) or bool(obj.last_name)
+
+
+class UserMeSerializer(BaseSerializer):
+    class Meta:
+        model = User
+        fields = [
+            "id",
+            "avatar",
+            "cover_image",
+            "avatar_url",
+            "cover_image_url",
+            "date_joined",
+            "display_name",
+            "email",
+            "first_name",
+            "last_name",
+            "is_active",
+            "is_bot",
+            "is_email_verified",
+            "user_timezone",
+            "username",
+            "is_password_autoset",
+            "is_email_verified",
+            "last_login_medium",
+            "last_login_time",
+        ]
+        read_only_fields = fields
+
+
+class UserMeSettingsSerializer(BaseSerializer):
+    workspace = serializers.SerializerMethodField()
+
+    class Meta:
+        model = User
+        fields = ["id", "email", "workspace"]
+        read_only_fields = fields
+
+    def get_workspace(self, obj):
+        workspace_invites = WorkspaceMemberInvite.objects.filter(email=obj.email).count()
+
+        # profile
+        profile = Profile.objects.get(user=obj)
+        if (
+            profile.last_workspace_id is not None
+            and Workspace.objects.filter(
+                pk=profile.last_workspace_id,
+                workspace_member__member=obj.id,
+                workspace_member__is_active=True,
+            ).exists()
+        ):
+            workspace = Workspace.objects.filter(
+                pk=profile.last_workspace_id,
+                workspace_member__member=obj.id,
+                workspace_member__is_active=True,
+            ).first()
+            logo_asset_url = workspace.logo_asset.asset_url if workspace.logo_asset is not None else ""
+            return {
+                "last_workspace_id": profile.last_workspace_id,
+                "last_workspace_slug": (workspace.slug if workspace is not None else ""),
+                "last_workspace_name": (workspace.name if workspace is not None else ""),
+                "last_workspace_logo": (logo_asset_url),
+                "fallback_workspace_id": profile.last_workspace_id,
+                "fallback_workspace_slug": (workspace.slug if workspace is not None else ""),
+                "invites": workspace_invites,
+            }
+        else:
+            fallback_workspace = (
+                Workspace.objects.filter(workspace_member__member_id=obj.id, workspace_member__is_active=True)
+                .order_by("created_at")
+                .first()
+            )
+            return {
+                "last_workspace_id": None,
+                "last_workspace_slug": None,
+                "fallback_workspace_id": (fallback_workspace.id if fallback_workspace is not None else None),
+                "fallback_workspace_slug": (fallback_workspace.slug if fallback_workspace is not None else None),
+                "invites": workspace_invites,
+            }
+
+
+class UserLiteSerializer(BaseSerializer):
+    class Meta:
+        model = User
+        fields = [
+            "id",
+            "first_name",
+            "last_name",
+            "avatar",
+            "avatar_url",
+            "is_bot",
+            "display_name",
+        ]
+        read_only_fields = ["id", "is_bot"]
+
+
+class UserAdminLiteSerializer(BaseSerializer):
+    class Meta:
+        model = User
+        fields = [
+            "id",
+            "first_name",
+            "last_name",
+            "avatar",
+            "avatar_url",
+            "is_bot",
+            "display_name",
+            "email",
+            "last_login_medium",
+        ]
+        read_only_fields = ["id", "is_bot"]
+
+
+class ChangePasswordSerializer(serializers.Serializer):
+    model = User
+
+    """
+    Serializer for password change endpoint.
+    """
+    old_password = serializers.CharField(required=True)
+    new_password = serializers.CharField(required=True, min_length=8)
+    confirm_password = serializers.CharField(required=True, min_length=8)
+
+    def validate(self, data):
+        if data.get("old_password") == data.get("new_password"):
+            raise serializers.ValidationError({"error": "New password cannot be same as old password."})
+
+        if data.get("new_password") != data.get("confirm_password"):
+            raise serializers.ValidationError({"error": "Confirm password should be same as the new password."})
+
+        return data
+
+
+class ResetPasswordSerializer(serializers.Serializer):
+    """
+    Serializer for password change endpoint.
+    """
+
+    new_password = serializers.CharField(required=True, min_length=8)
+
+
+class ProfileSerializer(BaseSerializer):
+    class Meta:
+        model = Profile
+        fields = "__all__"
+        read_only_fields = ["user"]
+
+
+class AccountSerializer(BaseSerializer):
+    class Meta:
+        model = Account
+        fields = "__all__"
+        read_only_fields = ["user"]

plane-src/apps/api/plane/app/serializers/view.py

@@ -0,0 +1,86 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Third party imports
+from rest_framework import serializers
+
+# Module imports
+from .base import DynamicBaseSerializer
+from plane.db.models import IssueView
+from plane.utils.issue_filters import issue_filters
+
+
+class ViewIssueListSerializer(serializers.Serializer):
+    def get_assignee_ids(self, instance):
+        return [assignee.assignee_id for assignee in instance.issue_assignee.all()]
+
+    def get_label_ids(self, instance):
+        return [label.label_id for label in instance.label_issue.all()]
+
+    def get_module_ids(self, instance):
+        return [module.module_id for module in instance.issue_module.all()]
+
+    def to_representation(self, instance):
+        data = {
+            "id": instance.id,
+            "name": instance.name,
+            "state_id": instance.state_id,
+            "sort_order": instance.sort_order,
+            "completed_at": instance.completed_at,
+            "estimate_point": instance.estimate_point_id,
+            "priority": instance.priority,
+            "start_date": instance.start_date,
+            "target_date": instance.target_date,
+            "sequence_id": instance.sequence_id,
+            "project_id": instance.project_id,
+            "parent_id": instance.parent_id,
+            "cycle_id": instance.cycle_id,
+            "sub_issues_count": instance.sub_issues_count,
+            "created_at": instance.created_at,
+            "updated_at": instance.updated_at,
+            "created_by": instance.created_by_id,
+            "updated_by": instance.updated_by_id,
+            "attachment_count": instance.attachment_count,
+            "link_count": instance.link_count,
+            "is_draft": instance.is_draft,
+            "archived_at": instance.archived_at,
+            "state__group": instance.state.group if instance.state else None,
+            "assignee_ids": self.get_assignee_ids(instance),
+            "label_ids": self.get_label_ids(instance),
+            "module_ids": self.get_module_ids(instance),
+        }
+        return data
+
+
+class IssueViewSerializer(DynamicBaseSerializer):
+    is_favorite = serializers.BooleanField(read_only=True)
+
+    class Meta:
+        model = IssueView
+        fields = "__all__"
+        read_only_fields = [
+            "workspace",
+            "project",
+            "query",
+            "owned_by",
+            "access",
+            "is_locked",
+        ]
+
+    def create(self, validated_data):
+        query_params = validated_data.get("filters", {})
+        if bool(query_params):
+            validated_data["query"] = issue_filters(query_params, "POST")
+        else:
+            validated_data["query"] = {}
+        return IssueView.objects.create(**validated_data)
+
+    def update(self, instance, validated_data):
+        query_params = validated_data.get("filters", {})
+        if bool(query_params):
+            validated_data["query"] = issue_filters(query_params, "POST")
+        else:
+            validated_data["query"] = {}
+        validated_data["query"] = issue_filters(query_params, "PATCH")
+        return super().update(instance, validated_data)

plane-src/apps/api/plane/app/serializers/webhook.py

@@ -0,0 +1,102 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Python imports
+import socket
+import ipaddress
+from urllib.parse import urlparse
+
+# Third party imports
+from rest_framework import serializers
+
+# Module imports
+from .base import DynamicBaseSerializer
+from plane.db.models import Webhook, WebhookLog
+from plane.db.models.webhook import validate_domain, validate_schema
+
+
+class WebhookSerializer(DynamicBaseSerializer):
+    url = serializers.URLField(validators=[validate_schema, validate_domain])
+
+    def create(self, validated_data):
+        url = validated_data.get("url", None)
+
+        # Extract the hostname from the URL
+        hostname = urlparse(url).hostname
+        if not hostname:
+            raise serializers.ValidationError({"url": "Invalid URL: No hostname found."})
+
+        # Resolve the hostname to IP addresses
+        try:
+            ip_addresses = socket.getaddrinfo(hostname, None)
+        except socket.gaierror:
+            raise serializers.ValidationError({"url": "Hostname could not be resolved."})
+
+        if not ip_addresses:
+            raise serializers.ValidationError({"url": "No IP addresses found for the hostname."})
+
+        for addr in ip_addresses:
+            ip = ipaddress.ip_address(addr[4][0])
+            if ip.is_private or ip.is_loopback or ip.is_reserved or ip.is_link_local:
+                raise serializers.ValidationError({"url": "URL resolves to a blocked IP address."})
+
+        # Additional validation for multiple request domains and their subdomains
+        request = self.context.get("request")
+        disallowed_domains = ["plane.so"]  # Add your disallowed domains here
+        if request:
+            request_host = request.get_host().split(":")[0]  # Remove port if present
+            disallowed_domains.append(request_host)
+
+        # Check if hostname is a subdomain or exact match of any disallowed domain
+        if any(hostname == domain or hostname.endswith("." + domain) for domain in disallowed_domains):
+            raise serializers.ValidationError({"url": "URL domain or its subdomain is not allowed."})
+
+        return Webhook.objects.create(**validated_data)
+
+    def update(self, instance, validated_data):
+        url = validated_data.get("url", None)
+        if url:
+            # Extract the hostname from the URL
+            hostname = urlparse(url).hostname
+            if not hostname:
+                raise serializers.ValidationError({"url": "Invalid URL: No hostname found."})
+
+            # Resolve the hostname to IP addresses
+            try:
+                ip_addresses = socket.getaddrinfo(hostname, None)
+            except socket.gaierror:
+                raise serializers.ValidationError({"url": "Hostname could not be resolved."})
+
+            if not ip_addresses:
+                raise serializers.ValidationError({"url": "No IP addresses found for the hostname."})
+
+            for addr in ip_addresses:
+                ip = ipaddress.ip_address(addr[4][0])
+                if ip.is_private or ip.is_loopback or ip.is_reserved or ip.is_link_local:
+                    raise serializers.ValidationError({"url": "URL resolves to a blocked IP address."})
+
+            # Additional validation for multiple request domains and their subdomains
+            request = self.context.get("request")
+            disallowed_domains = ["plane.so"]  # Add your disallowed domains here
+            if request:
+                request_host = request.get_host().split(":")[0]  # Remove port if present
+                disallowed_domains.append(request_host)
+
+            # Check if hostname is a subdomain or exact match of any disallowed domain
+            if any(hostname == domain or hostname.endswith("." + domain) for domain in disallowed_domains):
+                raise serializers.ValidationError({"url": "URL domain or its subdomain is not allowed."})
+
+        return super().update(instance, validated_data)
+
+    class Meta:
+        model = Webhook
+        fields = "__all__"
+        read_only_fields = ["workspace", "secret_key", "deleted_at"]
+
+
+class WebhookLogSerializer(DynamicBaseSerializer):
+    class Meta:
+        model = WebhookLog
+        fields = "__all__"
+        read_only_fields = ["workspace", "webhook"]

plane-src/apps/api/plane/app/serializers/workspace.py

@@ -0,0 +1,333 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Third party imports
+from rest_framework import serializers
+
+# Module imports
+from .base import BaseSerializer, DynamicBaseSerializer
+from .user import UserLiteSerializer, UserAdminLiteSerializer
+
+
+from plane.db.models import (
+    Workspace,
+    WorkspaceMember,
+    WorkspaceMemberInvite,
+    WorkspaceTheme,
+    WorkspaceUserProperties,
+    WorkspaceUserLink,
+    UserRecentVisit,
+    Issue,
+    Page,
+    Project,
+    ProjectMember,
+    WorkspaceHomePreference,
+    Sticky,
+    WorkspaceUserPreference,
+)
+from plane.utils.constants import RESTRICTED_WORKSPACE_SLUGS
+from plane.utils.url import contains_url
+from plane.utils.content_validator import (
+    validate_html_content,
+    validate_binary_data,
+)
+
+# Django imports
+from django.core.validators import URLValidator
+from django.core.exceptions import ValidationError
+import re
+
+
+class WorkSpaceSerializer(DynamicBaseSerializer):
+    total_members = serializers.IntegerField(read_only=True)
+    logo_url = serializers.CharField(read_only=True)
+    role = serializers.IntegerField(read_only=True)
+
+    def validate_name(self, value):
+        # Check if the name contains a URL
+        if contains_url(value):
+            raise serializers.ValidationError("Name must not contain URLs")
+        return value
+
+    def validate_slug(self, value):
+        # Check if the slug is restricted
+        if value in RESTRICTED_WORKSPACE_SLUGS:
+            raise serializers.ValidationError("Slug is not valid")
+        # Slug should only contain alphanumeric characters, hyphens, and underscores
+        if not re.match(r"^[a-zA-Z0-9_-]+$", value):
+            raise serializers.ValidationError(
+                "Slug can only contain letters, numbers, hyphens (-), and underscores (_)"
+            )
+        return value
+
+    class Meta:
+        model = Workspace
+        fields = "__all__"
+        read_only_fields = [
+            "id",
+            "created_by",
+            "updated_by",
+            "created_at",
+            "updated_at",
+            "owner",
+            "logo_url",
+        ]
+
+
+class WorkspaceLiteSerializer(BaseSerializer):
+    class Meta:
+        model = Workspace
+        fields = ["name", "slug", "id", "logo_url"]
+        read_only_fields = fields
+
+
+class WorkSpaceMemberSerializer(DynamicBaseSerializer):
+    member = UserLiteSerializer(read_only=True)
+
+    class Meta:
+        model = WorkspaceMember
+        fields = "__all__"
+
+
+class WorkspaceMemberMeSerializer(BaseSerializer):
+    draft_issue_count = serializers.IntegerField(read_only=True)
+
+    class Meta:
+        model = WorkspaceMember
+        fields = "__all__"
+
+
+class WorkspaceMemberAdminSerializer(DynamicBaseSerializer):
+    member = UserAdminLiteSerializer(read_only=True)
+
+    class Meta:
+        model = WorkspaceMember
+        fields = "__all__"
+
+
+class WorkSpaceMemberInviteSerializer(BaseSerializer):
+    workspace = WorkspaceLiteSerializer(read_only=True)
+    invite_link = serializers.SerializerMethodField()
+
+    def get_invite_link(self, obj):
+        return f"/workspace-invitations/?invitation_id={obj.id}&slug={obj.workspace.slug}&token={obj.token}"
+
+    class Meta:
+        model = WorkspaceMemberInvite
+        fields = "__all__"
+        read_only_fields = [
+            "id",
+            "email",
+            "token",
+            "workspace",
+            "message",
+            "responded_at",
+            "created_at",
+            "updated_at",
+            "invite_link",
+        ]
+
+
+class WorkspaceThemeSerializer(BaseSerializer):
+    class Meta:
+        model = WorkspaceTheme
+        fields = "__all__"
+        read_only_fields = ["workspace", "actor"]
+
+
+class WorkspaceUserPropertiesSerializer(BaseSerializer):
+    class Meta:
+        model = WorkspaceUserProperties
+        fields = "__all__"
+        read_only_fields = ["workspace", "user"]
+
+
+class WorkspaceUserLinkSerializer(BaseSerializer):
+    class Meta:
+        model = WorkspaceUserLink
+        fields = "__all__"
+        read_only_fields = ["workspace", "owner"]
+
+    def to_internal_value(self, data):
+        url = data.get("url", "")
+        if url and not url.startswith(("http://", "https://")):
+            data["url"] = "http://" + url
+
+        return super().to_internal_value(data)
+
+    def validate_url(self, value):
+        url_validator = URLValidator()
+        try:
+            url_validator(value)
+        except ValidationError:
+            raise serializers.ValidationError({"error": "Invalid URL format."})
+
+        return value
+
+    def create(self, validated_data):
+        # Filtering the WorkspaceUserLink with the given url to check if the link already exists.
+
+        url = validated_data.get("url")
+
+        workspace_user_link = WorkspaceUserLink.objects.filter(
+            url=url,
+            workspace_id=validated_data.get("workspace_id"),
+            owner_id=validated_data.get("owner_id"),
+        )
+
+        if workspace_user_link.exists():
+            raise serializers.ValidationError({"error": "URL already exists for this workspace and owner"})
+
+        return super().create(validated_data)
+
+    def update(self, instance, validated_data):
+        # Filtering the WorkspaceUserLink with the given url to check if the link already exists.
+
+        url = validated_data.get("url")
+
+        workspace_user_link = WorkspaceUserLink.objects.filter(
+            url=url, workspace_id=instance.workspace_id, owner=instance.owner
+        )
+
+        if workspace_user_link.exclude(pk=instance.id).exists():
+            raise serializers.ValidationError({"error": "URL already exists for this workspace and owner"})
+
+        return super().update(instance, validated_data)
+
+
+class IssueRecentVisitSerializer(serializers.ModelSerializer):
+    project_identifier = serializers.SerializerMethodField()
+    assignees = serializers.SerializerMethodField()
+
+    class Meta:
+        model = Issue
+        fields = [
+            "id",
+            "name",
+            "state",
+            "priority",
+            "assignees",
+            "type",
+            "sequence_id",
+            "project_id",
+            "project_identifier",
+        ]
+
+    def get_project_identifier(self, obj):
+        project = obj.project
+        return project.identifier if project else None
+
+    def get_assignees(self, obj):
+        return list(obj.assignees.filter(issue_assignee__deleted_at__isnull=True).values_list("id", flat=True))
+
+
+class ProjectRecentVisitSerializer(serializers.ModelSerializer):
+    project_members = serializers.SerializerMethodField()
+
+    class Meta:
+        model = Project
+        fields = ["id", "name", "logo_props", "project_members", "identifier"]
+
+    def get_project_members(self, obj):
+        members = ProjectMember.objects.filter(project_id=obj.id, member__is_bot=False, is_active=True).values_list(
+            "member", flat=True
+        )
+
+        return members
+
+
+class PageRecentVisitSerializer(serializers.ModelSerializer):
+    project_id = serializers.SerializerMethodField()
+    project_identifier = serializers.SerializerMethodField()
+
+    class Meta:
+        model = Page
+        fields = [
+            "id",
+            "name",
+            "logo_props",
+            "project_id",
+            "owned_by",
+            "project_identifier",
+        ]
+
+    def get_project_id(self, obj):
+        return obj.project_id if hasattr(obj, "project_id") else obj.projects.values_list("id", flat=True).first()
+
+    def get_project_identifier(self, obj):
+        project = obj.projects.first()
+
+        return project.identifier if project else None
+
+
+def get_entity_model_and_serializer(entity_type):
+    entity_map = {
+        "issue": (Issue, IssueRecentVisitSerializer),
+        "page": (Page, PageRecentVisitSerializer),
+        "project": (Project, ProjectRecentVisitSerializer),
+    }
+    return entity_map.get(entity_type, (None, None))
+
+
+class WorkspaceRecentVisitSerializer(BaseSerializer):
+    entity_data = serializers.SerializerMethodField()
+
+    class Meta:
+        model = UserRecentVisit
+        fields = ["id", "entity_name", "entity_identifier", "entity_data", "visited_at"]
+        read_only_fields = ["workspace", "owner", "created_by", "updated_by"]
+
+    def get_entity_data(self, obj):
+        entity_name = obj.entity_name
+        entity_identifier = obj.entity_identifier
+
+        entity_model, entity_serializer = get_entity_model_and_serializer(entity_name)
+
+        if entity_model and entity_serializer:
+            try:
+                entity = entity_model.objects.get(pk=entity_identifier)
+
+                return entity_serializer(entity).data
+            except entity_model.DoesNotExist:
+                return None
+        return None
+
+
+class WorkspaceHomePreferenceSerializer(BaseSerializer):
+    class Meta:
+        model = WorkspaceHomePreference
+        fields = ["key", "is_enabled", "sort_order"]
+        read_only_fields = ["workspace", "created_by", "updated_by"]
+
+
+class StickySerializer(BaseSerializer):
+    class Meta:
+        model = Sticky
+        fields = "__all__"
+        read_only_fields = ["workspace", "owner"]
+        extra_kwargs = {"name": {"required": False}}
+
+    def validate(self, data):
+        # Validate description content for security
+        if "description_html" in data and data["description_html"]:
+            is_valid, error_msg, sanitized_html = validate_html_content(data["description_html"])
+            if not is_valid:
+                raise serializers.ValidationError({"error": "html content is not valid"})
+            # Update the data with sanitized HTML if available
+            if sanitized_html is not None:
+                data["description_html"] = sanitized_html
+
+        if "description_binary" in data and data["description_binary"]:
+            is_valid, error_msg = validate_binary_data(data["description_binary"])
+            if not is_valid:
+                raise serializers.ValidationError({"description_binary": "Invalid binary data"})
+
+        return data
+
+
+class WorkspaceUserPreferenceSerializer(BaseSerializer):
+    class Meta:
+        model = WorkspaceUserPreference
+        fields = ["key", "is_pinned", "sort_order"]
+        read_only_fields = ["workspace", "created_by", "updated_by"]