fix(analytics): scope Cycle and Module lookups by workspace slug to prevent cross-workspace data leak

[harsh4vardhan]

What

Add workspace__slug=self._workspace_slug to the Cycle and Module filter calls in the analytics charts endpoint.

Why

ProjectAdvanceAnalyticsStatsEndpoint and ProjectAdvanceAnalyticsChartEndpoint accept cycle_id and module_id as query params and look them up with only the primary key:

cycle = Cycle.objects.filter(id=cycle_id).first() # no workspace scope
module = Module.objects.filter(id=module_id).first() # no workspace scope

An authenticated member of Workspace A can supply a cycle or module UUID from Workspace B. Permission validation confirms the caller is a Workspace A member but does not validate that the supplied IDs belong to Workspace A. The response leaks Workspace B start_date and end_date.

How

before: cycle = Cycle.objects.filter(id=cycle_id).first()
after: cycle = Cycle.objects.filter(id=cycle_id, workspace__slug=self._workspace_slug).first()

before: module = Module.objects.filter(id=module_id).first()
after: module = Module.objects.filter(id=module_id, workspace__slug=self._workspace_slug).first()

The existing if cycle and cycle.start_date guards already return an empty response when the lookup returns None.

Closes #9601

harsh4vardhan

Summary by CodeRabbit

• Bug Fixes
  • Improved project analytics charts to ensure cycle and module data comes only from the selected workspace.
  • Preserved existing chart behavior while preventing unrelated workspace data from appearing.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2b5480eb-cdbc-44f8-a0d4-7f25bdf605d4

📥 Commits

Reviewing files that changed from the base of the PR and between 1c8a60f and 11cc85f.

📒 Files selected for processing (1)

• apps/api/plane/app/views/analytic/project_analytics.py

---

📝 Walkthrough

Walkthrough

The work-item completion chart now scopes cycle and module lookups to the selected workspace. This prevents cross-workspace objects from contributing date metadata to analytics responses.

Changes

Analytics workspace scoping

Layer / File(s)	Summary
Scope cycle and module lookups apps/api/plane/app/views/analytic/project_analytics.py	Cycle and module queries now filter by object ID and workspace slug.

Estimated code review effort: 2 (Simple) | ~5 minutes

Mergeability Score: ⚪ Minimal · up to 11cc8

This change scopes analytics lookups to the requested workspace, and no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• makeplane/plane#9532: Updates the same analytics cycle and module filtering logic.

Suggested reviewers: dheeru0198

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the workspace-scoping fix and the prevented cross-workspace data leak.
Description check	✅ Passed	The description clearly documents the change, security impact, implementation, and linked issue, but omits the repository template headings and test scenarios.
Linked Issues check	✅ Passed	The changes satisfy issue #9601 by scoping both Cycle and Module lookups to the requested workspace.
Out of Scope Changes check	✅ Passed	The two-line change is directly related to the linked security issue and introduces no unrelated scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}