apiserver/plane/app/views/issue/attachment.py (1)

Line range hint 183-198: Handle FileAsset not found in get method

When a pk is provided in the get method, the code assumes the FileAsset exists. If it doesn't (e.g., invalid pk), a DoesNotExist exception will be raised, resulting in a 500 Internal Server Error.

Add exception handling to return a 404 response when the FileAsset is not found.

Apply this diff to handle exceptions:

if pk:
+    try:
        # Get the asset
        asset = FileAsset.objects.get(
            id=pk, workspace__slug=slug, project_id=project_id
        )
+    except FileAsset.DoesNotExist:
+        return Response(
+            {"error": "Asset not found.", "status": False},
+            status=status.HTTP_404_NOT_FOUND,
+        )

    # Check if the asset is uploaded
    if not asset.is_uploaded:
        return Response(

apiserver/plane/app/views/issue/attachment.py (2)

123-128: Create FileAsset after successful presigned URL generation

Currently, the FileAsset is created before generating the presigned URL. If the presigned URL generation fails, you'll have an orphaned FileAsset record without a valid upload path.

Consider creating the FileAsset only after successfully generating the presigned URL, or implement cleanup logic for failed cases.

Apply this diff to adjust the creation timing:

-# Create a File Asset
-asset = FileAsset.objects.create(
-    attributes={"name": name, "type": type, "size": size_limit},
-    asset=asset_key,
-    size=size_limit,
-    workspace_id=workspace.id,
-    created_by=request.user,
-    issue_id=issue_id,
-    project_id=project_id,
-    entity_type=FileAsset.EntityTypeContext.ISSUE_ATTACHMENT,
-)

# Get the presigned URL
storage = S3Storage(request=request)

try:
    presigned_url = storage.generate_presigned_post(
        object_name=asset_key, file_type=type, file_size=size_limit
    )
+except Exception as e:
+    return Response(
+        {"error": "Failed to generate upload URL.", "details": str(e), "status": False},
+        status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+    )

+# Create a File Asset only after successful presigned URL generation
+asset = FileAsset.objects.create(
+    attributes={"name": name, "type": type, "size": size_limit},
+    asset=asset_key,
+    size=size_limit,
+    workspace_id=workspace.id,
+    created_by=request.user,
+    issue_id=issue_id,
+    project_id=project_id,
+    entity_type=FileAsset.EntityTypeContext.ISSUE_ATTACHMENT,
+)

---

Line range hint 155-160: Remove physical files upon soft delete

In the delete method, the FileAsset is marked as deleted in the database, but the actual file in storage remains. This can lead to unnecessary storage costs and potential security risks since obsolete files are still accessible.

Consider implementing a background task or modifying the deletion logic to remove the physical file from storage when an asset is soft deleted.

apiserver/plane/settings/common.py (1)

364-375: Correct typo in comment and verify MIME types

There's a typo in the comment on line 374~: "Open Office Bae" should be "OpenOffice Base."

Also, ensure that all added MIME types are accurate and necessary for your application's use cases.

Apply this diff to fix the typo:

-    # Open Office Bae
+    # OpenOffice Base

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro