SILVER/NODEDC_TASKMANAGER
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

ФУНКЦИИ - МЕЖПРОЕКТНАЯ КОММУНИКАЦИЯ: блокировка и удаление участников воркспейса в God Mode

Browse Source
This commit is contained in:
DCCONSTRUCTIONS
2026-04-29 01:15:17 +03:00
parent 7bf416ec1f
commit 4ba3aab02e
19 changed files with 598 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plane-src/apps/api/plane/app/permissions/base.py
+5
View File
@@ -9,6 +9,8 @@ from rest_framework import status
from enum import Enum
from plane.utils.workspace_bans import release_expired_workspace_bans
class ROLE(Enum):
ADMIN = 20
@@ -20,6 +22,9 @@ def allow_permission(allowed_roles, level="PROJECT", creator=False, model=None):
def decorator(view_func):
@wraps(view_func)
def _wrapped_view(instance, request, *args, **kwargs):
if not request.user.is_anonymous and kwargs.get("slug"):
release_expired_workspace_bans(member=request.user, workspace_slug=kwargs["slug"])
# Check for creator if required
if creator and model:
# check if the user is part of the workspace or not
plane-src/apps/api/plane/app/permissions/project.py
+16
View File
@@ -8,6 +8,12 @@ from rest_framework.permissions import SAFE_METHODS, BasePermission
# Module import
from plane.db.models import ProjectMember, WorkspaceMember
from plane.db.models.project import ROLE
from plane.utils.workspace_bans import release_expired_workspace_bans
def release_request_workspace_ban(request, view):
if hasattr(view, "workspace_slug") and view.workspace_slug:
release_expired_workspace_bans(member=request.user, workspace_slug=view.workspace_slug)
class ProjectBasePermission(BasePermission):
@@ -15,6 +21,8 @@ class ProjectBasePermission(BasePermission):
if request.user.is_anonymous:
return False
release_request_workspace_ban(request, view)
## Safe Methods -> Handle the filtering logic in queryset
if request.method in SAFE_METHODS:
return WorkspaceMember.objects.filter(
@@ -58,6 +66,8 @@ class ProjectMemberPermission(BasePermission):
if request.user.is_anonymous:
return False
release_request_workspace_ban(request, view)
## Safe Methods -> Handle the filtering logic in queryset
if request.method in SAFE_METHODS:
return ProjectMember.objects.filter(
@@ -87,6 +97,8 @@ class ProjectEntityPermission(BasePermission):
if request.user.is_anonymous:
return False
release_request_workspace_ban(request, view)
# Handle requests based on project__identifier
if hasattr(view, "project_identifier") and view.project_identifier:
if request.method in SAFE_METHODS:
@@ -121,6 +133,8 @@ class ProjectAdminPermission(BasePermission):
if request.user.is_anonymous:
return False
release_request_workspace_ban(request, view)
return ProjectMember.objects.filter(
workspace__slug=view.workspace_slug,
member=request.user,
@@ -135,6 +149,8 @@ class ProjectLitePermission(BasePermission):
if request.user.is_anonymous:
return False
release_request_workspace_ban(request, view)
return ProjectMember.objects.filter(
workspace__slug=view.workspace_slug,
member=request.user,
plane-src/apps/api/plane/app/permissions/workspace.py
+18
View File
@@ -7,6 +7,7 @@ from rest_framework.permissions import BasePermission, SAFE_METHODS
# Module imports
from plane.db.models import WorkspaceMember
from plane.utils.workspace_bans import release_expired_workspace_bans
# Permission Mappings
@@ -15,6 +16,11 @@ Member = 15
Guest = 5
def release_request_workspace_ban(request, view):
if hasattr(view, "workspace_slug") and view.workspace_slug:
release_expired_workspace_bans(member=request.user, workspace_slug=view.workspace_slug)
# TODO: Move the below logic to python match - python v3.10
class WorkSpaceBasePermission(BasePermission):
def has_permission(self, request, view):
@@ -25,6 +31,8 @@ class WorkSpaceBasePermission(BasePermission):
if request.method == "POST":
return True
release_request_workspace_ban(request, view)
## Safe Methods
if request.method in SAFE_METHODS:
return True
@@ -53,6 +61,8 @@ class WorkspaceOwnerPermission(BasePermission):
if request.user.is_anonymous:
return False
release_request_workspace_ban(request, view)
return WorkspaceMember.objects.filter(
workspace__slug=view.workspace_slug, member=request.user, role=Admin
).exists()
@@ -63,6 +73,8 @@ class WorkSpaceAdminPermission(BasePermission):
if request.user.is_anonymous:
return False
release_request_workspace_ban(request, view)
return WorkspaceMember.objects.filter(
member=request.user,
workspace__slug=view.workspace_slug,
@@ -76,6 +88,8 @@ class WorkspaceEntityPermission(BasePermission):
if request.user.is_anonymous:
return False
release_request_workspace_ban(request, view)
## Safe Methods -> Handle the filtering logic in queryset
if request.method in SAFE_METHODS:
return WorkspaceMember.objects.filter(
@@ -95,6 +109,8 @@ class WorkspaceViewerPermission(BasePermission):
if request.user.is_anonymous:
return False
release_request_workspace_ban(request, view)
return WorkspaceMember.objects.filter(
member=request.user, workspace__slug=view.workspace_slug, is_active=True
).exists()
@@ -105,6 +121,8 @@ class WorkspaceUserPermission(BasePermission):
if request.user.is_anonymous:
return False
release_request_workspace_ban(request, view)
return WorkspaceMember.objects.filter(
member=request.user, workspace__slug=view.workspace_slug, is_active=True
).exists()
plane-src/apps/api/plane/app/views/project/invite.py
+14 -1
View File
@@ -32,6 +32,7 @@ from plane.db.models import (
)
from plane.db.models.project import ProjectNetwork
from plane.utils.host import base_host
from plane.utils.workspace_bans import is_workspace_member_currently_banned, release_workspace_member_ban
class ProjectInvitationsViewset(BaseViewSet):
@@ -195,7 +196,19 @@ class ProjectJoinEndpoint(BaseAPIView):
)
if project_invite.responded_at is None:
project_invite.accepted = request.data.get("accepted", False)
accepted = request.data.get("accepted", False)
if accepted:
user = User.objects.filter(email=email).first()
workspace_member = WorkspaceMember.objects.filter(workspace__slug=slug, member=user).first()
if is_workspace_member_currently_banned(workspace_member):
return Response(
{"error": "You are banned from this workspace"},
status=status.HTTP_403_FORBIDDEN,
)
if workspace_member is not None and workspace_member.is_banned:
release_workspace_member_ban(workspace_member)
project_invite.accepted = accepted
project_invite.responded_at = timezone.now()
project_invite.save()
plane-src/apps/api/plane/app/views/workspace/base.py
+3
View File
@@ -50,6 +50,7 @@ from plane.bgtasks.event_tracking_task import track_event
from plane.utils.url import contains_url
from plane.utils.analytics_events import WORKSPACE_CREATED, WORKSPACE_DELETED
from plane.utils.csv_utils import sanitize_csv_row
from plane.utils.workspace_bans import release_expired_workspace_bans
class WorkSpaceViewSet(BaseViewSet):
@@ -207,6 +208,8 @@ class UserWorkSpacesEndpoint(BaseAPIView):
use_read_replica = True
def get(self, request):
release_expired_workspace_bans(member=request.user)
fields = [field for field in request.GET.get("fields", "").split(",") if field]
member_count = (
WorkspaceMember.objects.filter(workspace=OuterRef("id"), member__is_bot=False, is_active=True)
plane-src/apps/api/plane/app/views/workspace/invite.py
+40 -1
View File
@@ -31,6 +31,7 @@ from plane.db.models import User, Workspace, WorkspaceMember, WorkspaceMemberInv
from plane.utils.cache import invalidate_cache, invalidate_cache_directly
from plane.utils.host import base_host
from plane.utils.analytics_events import USER_JOINED_WORKSPACE, USER_INVITED_TO_WORKSPACE
from plane.utils.workspace_bans import is_workspace_member_currently_banned, release_workspace_member_ban
from .. import BaseViewSet
@@ -85,6 +86,17 @@ class WorkspaceInvitationsViewset(BaseViewSet):
status=status.HTTP_400_BAD_REQUEST,
)
banned_workspace_members = WorkspaceMember.objects.filter(
workspace_id=workspace.id,
member__email__in=[email.get("email") for email in emails],
is_banned=True,
).select_related("member")
if any(is_workspace_member_currently_banned(workspace_member) for workspace_member in banned_workspace_members):
return Response(
{"error": "Some users are banned from this workspace"},
status=status.HTTP_400_BAD_REQUEST,
)
workspace_invitations = []
for email in emails:
try:
@@ -174,7 +186,23 @@ class WorkspaceJoinEndpoint(BaseAPIView):
# If already responded then return error
if workspace_invite.responded_at is None:
workspace_invite.accepted = request.data.get("accepted", False)
accepted = request.data.get("accepted", False)
if accepted:
user = User.objects.filter(email=workspace_invite.email).first()
workspace_member = (
WorkspaceMember.objects.filter(workspace=workspace_invite.workspace, member=user).first()
if user is not None
else None
)
if is_workspace_member_currently_banned(workspace_member):
return Response(
{"error": "You are banned from this workspace"},
status=status.HTTP_403_FORBIDDEN,
)
if workspace_member is not None and workspace_member.is_banned:
release_workspace_member_ban(workspace_member)
workspace_invite.accepted = accepted
workspace_invite.responded_at = timezone.now()
workspace_invite.save()
@@ -260,6 +288,17 @@ class UserWorkspaceInvitationsViewSet(BaseViewSet):
# If the user is already a member of workspace and was deactivated then activate the user
for invitation in workspace_invitations:
workspace_member = WorkspaceMember.objects.filter(
workspace_id=invitation.workspace_id, member=request.user
).first()
if is_workspace_member_currently_banned(workspace_member):
return Response(
{"error": "You are banned from one or more invited workspaces"},
status=status.HTTP_403_FORBIDDEN,
)
if workspace_member is not None and workspace_member.is_banned:
release_workspace_member_ban(workspace_member)
invalidate_cache_directly(
path=f"/api/workspaces/{invitation.workspace.slug}/members/",
user=False,
plane-src/apps/api/plane/authentication/utils/redirection_path.py
+3
View File
@@ -3,9 +3,12 @@
# See the LICENSE file for details.
from plane.db.models import Profile, Workspace, WorkspaceMemberInvite
from plane.utils.workspace_bans import release_expired_workspace_bans
def get_redirection_path(user):
release_expired_workspace_bans(member=user)
# Handle redirections
profile, _ = Profile.objects.get_or_create(user=user)
plane-src/apps/api/plane/db/migrations/0136_workspace_member_ban.py
+32
View File
@@ -0,0 +1,32 @@
# Generated by Codex on 2026-04-29
from django.db import migrations, models
class Migration(migrations.Migration):
dependencies = [
("db", "0135_workspace_feature_entitlements"),
]
operations = [
migrations.AddField(
model_name="workspacemember",
name="is_banned",
field=models.BooleanField(default=False),
),
migrations.AddField(
model_name="workspacemember",
name="banned_at",
field=models.DateTimeField(blank=True, null=True),
),
migrations.AddField(
model_name="workspacemember",
name="banned_until",
field=models.DateTimeField(blank=True, null=True),
),
migrations.AddField(
model_name="workspacemember",
name="ban_project_member_ids",
field=models.JSONField(default=list),
),
]
plane-src/apps/api/plane/db/models/workspace.py
+4
View File
@@ -210,6 +210,10 @@ class WorkspaceMember(BaseModel):
default_props = models.JSONField(default=get_default_props)
issue_props = models.JSONField(default=get_issue_props)
is_active = models.BooleanField(default=True)
is_banned = models.BooleanField(default=False)
banned_at = models.DateTimeField(null=True, blank=True)
banned_until = models.DateTimeField(null=True, blank=True)
ban_project_member_ids = models.JSONField(default=list)
getting_started_checklist = models.JSONField(default=dict)
tips = models.JSONField(default=dict)
explored_features = models.JSONField(default=dict)
plane-src/apps/api/plane/license/api/views/__init__.py
+1
View File
@@ -26,5 +26,6 @@ from .workspace import (
InstanceWorkSpaceAvailabilityCheckEndpoint,
InstanceWorkSpaceEndpoint,
InstanceWorkSpaceFeatureEndpoint,
InstanceWorkSpaceMemberBanEndpoint,
InstanceWorkSpaceMemberEndpoint,
)
plane-src/apps/api/plane/license/api/views/workspace.py
+80 -1
View File
@@ -8,6 +8,7 @@ from rest_framework import status
from django.db import IntegrityError
from django.db.models import Count, OuterRef, Func, F, Q
from django.utils import timezone
from django.utils.dateparse import parse_datetime
# Module imports
from plane.app.views.base import BaseAPIView
@@ -23,6 +24,7 @@ from plane.db.models import (
)
from plane.license.api.serializers import WorkspaceSerializer
from plane.utils.constants import RESTRICTED_WORKSPACE_SLUGS
from plane.utils.workspace_bans import release_expired_workspace_bans, release_workspace_member_ban
WORKSPACE_ROLES = {5, 15, 20}
@@ -46,6 +48,9 @@ def serialize_instance_workspace_member(workspace_member):
},
"role": workspace_member.role,
"is_active": workspace_member.is_active,
"is_banned": workspace_member.is_banned,
"banned_at": workspace_member.banned_at,
"banned_until": workspace_member.banned_until,
"created_at": workspace_member.created_at,
"active_project_count": getattr(workspace_member, "active_project_count", 0),
"admin_project_count": getattr(workspace_member, "admin_project_count", 0),
@@ -57,6 +62,7 @@ def has_other_workspace_admin(workspace_member):
workspace=workspace_member.workspace,
role=20,
is_active=True,
is_banned=False,
member__is_bot=False,
).exclude(pk=workspace_member.pk).exists()
@@ -87,8 +93,10 @@ def is_only_project_admin(workspace_member):
def get_workspace_member_queryset(workspace_id):
release_expired_workspace_bans(workspace_id=workspace_id)
return (
WorkspaceMember.objects.filter(workspace_id=workspace_id, member__is_bot=False, is_active=True)
WorkspaceMember.objects.filter(workspace_id=workspace_id, member__is_bot=False)
.filter(Q(is_active=True) | Q(is_banned=True))
.select_related("workspace", "member", "member__avatar_asset")
.annotate(
active_project_count=Count(
@@ -276,6 +284,77 @@ class InstanceWorkSpaceMemberEndpoint(BaseAPIView):
return Response(status=status.HTTP_204_NO_CONTENT)
class InstanceWorkSpaceMemberBanEndpoint(BaseAPIView):
permission_classes = [InstanceAdminPermission]
def patch(self, request, workspace_id, member_id):
workspace_member = get_workspace_member_queryset(workspace_id).filter(pk=member_id).first()
if not workspace_member:
return Response({"error": "Workspace member not found"}, status=status.HTTP_404_NOT_FOUND)
is_banned = request.data.get("is_banned")
if not isinstance(is_banned, bool):
return Response({"error": "is_banned must be a boolean"}, status=status.HTTP_400_BAD_REQUEST)
banned_until = None
if is_banned:
raw_banned_until = request.data.get("banned_until")
if raw_banned_until not in (None, ""):
banned_until = parse_datetime(str(raw_banned_until))
if banned_until is None:
return Response({"error": "banned_until must be an ISO datetime"}, status=status.HTTP_400_BAD_REQUEST)
if timezone.is_naive(banned_until):
banned_until = timezone.make_aware(banned_until, timezone.get_current_timezone())
if banned_until <= timezone.now():
return Response({"error": "banned_until must be in the future"}, status=status.HTTP_400_BAD_REQUEST)
if workspace_member.role == 20 and not has_other_workspace_admin(workspace_member):
return Response(
{"error": "Cannot ban the only workspace admin"},
status=status.HTTP_400_BAD_REQUEST,
)
if is_only_project_admin(workspace_member):
return Response(
{"error": "Cannot ban a member who is the only admin in one or more projects"},
status=status.HTTP_400_BAD_REQUEST,
)
project_member_ids = list(
ProjectMember.objects.filter(
workspace_id=workspace_id,
member_id=workspace_member.member_id,
is_active=True,
).values_list("id", flat=True)
)
ProjectMember.objects.filter(
workspace_id=workspace_id,
member_id=workspace_member.member_id,
is_active=True,
).update(is_active=False, updated_at=timezone.now())
workspace_member.is_banned = True
workspace_member.banned_at = timezone.now()
workspace_member.banned_until = banned_until
workspace_member.ban_project_member_ids = [str(project_member_id) for project_member_id in project_member_ids]
workspace_member.is_active = False
workspace_member.save(
update_fields=[
"is_banned",
"banned_at",
"banned_until",
"ban_project_member_ids",
"is_active",
"updated_at",
]
)
else:
release_workspace_member_ban(workspace_member)
workspace_member = get_workspace_member_queryset(workspace_id).get(pk=member_id)
return Response(serialize_instance_workspace_member(workspace_member), status=status.HTTP_200_OK)
class InstanceWorkSpaceFeatureEndpoint(BaseAPIView):
permission_classes = [InstanceAdminPermission]
plane-src/apps/api/plane/license/urls.py
+6
View File
@@ -19,6 +19,7 @@ from plane.license.api.views import (
InstanceWorkSpaceAvailabilityCheckEndpoint,
InstanceWorkSpaceEndpoint,
InstanceWorkSpaceFeatureEndpoint,
InstanceWorkSpaceMemberBanEndpoint,
InstanceWorkSpaceMemberEndpoint,
)
@@ -83,6 +84,11 @@ urlpatterns = [
InstanceWorkSpaceMemberEndpoint.as_view(),
name="instance-workspace-member",
),
path(
"workspaces/<uuid:workspace_id>/members/<uuid:member_id>/ban/",
InstanceWorkSpaceMemberBanEndpoint.as_view(),
name="instance-workspace-member-ban",
),
path(
"workspaces/<uuid:workspace_id>/features/",
InstanceWorkSpaceFeatureEndpoint.as_view(),
plane-src/apps/api/plane/utils/workspace_bans.py
+57
View File
@@ -0,0 +1,57 @@
from django.db import transaction
from django.utils import timezone
from plane.db.models import ProjectMember, WorkspaceMember
def is_workspace_member_currently_banned(workspace_member):
return bool(
workspace_member
and workspace_member.is_banned
and (workspace_member.banned_until is None or workspace_member.banned_until > timezone.now())
)
def release_workspace_member_ban(workspace_member):
project_member_ids = workspace_member.ban_project_member_ids or []
with transaction.atomic():
if project_member_ids:
ProjectMember.objects.filter(
id__in=project_member_ids,
workspace_id=workspace_member.workspace_id,
member_id=workspace_member.member_id,
).update(is_active=True, updated_at=timezone.now())
workspace_member.is_active = True
workspace_member.is_banned = False
workspace_member.banned_at = None
workspace_member.banned_until = None
workspace_member.ban_project_member_ids = []
workspace_member.save(
update_fields=[
"is_active",
"is_banned",
"banned_at",
"banned_until",
"ban_project_member_ids",
"updated_at",
]
)
def release_expired_workspace_bans(member=None, workspace_slug=None, workspace_id=None):
queryset = WorkspaceMember.objects.filter(
is_banned=True,
banned_until__isnull=False,
banned_until__lte=timezone.now(),
)
if member is not None:
queryset = queryset.filter(member=member)
if workspace_slug is not None:
queryset = queryset.filter(workspace__slug=workspace_slug)
if workspace_id is not None:
queryset = queryset.filter(workspace_id=workspace_id)
for workspace_member in queryset:
release_workspace_member_ban(workspace_member)