fix(space): public board create() methods raise HTTP 500 on invalid anchor (DeployBoard.DoesNotExist unhandled)

Summary

create() (and partial_update(), destroy()) methods in the public board ViewSets call DeployBoard.objects.get(anchor=anchor, ...) without try/except. An invalid or expired anchor value raises an unhandled DoesNotExist → HTTP 500. Correct behavior is HTTP 404.

Inconsistency

get_queryset() in all ViewSets already handles this correctly:

def get_queryset(self):
    try:
        project_deploy_board = DeployBoard.objects.get(...)
    except DeployBoard.DoesNotExist:
        return IssueComment.objects.none()  # safe fallback

create() methods do not:

def create(self, request, anchor, issue_id):
    project_deploy_board = DeployBoard.objects.get(anchor=anchor, entity_name="project")
    # ← raises DoesNotExist → HTTP 500 if anchor is invalid/expired

Impact

• Availability: Invalid anchor → server error in logs + 500 to client.
• Security: Minor — error signal distinguishable from 404. No data leaked.

Recommended Fix

def create(self, request, anchor, issue_id):
    try:
        project_deploy_board = DeployBoard.objects.get(anchor=anchor, entity_name="project")
    except DeployBoard.DoesNotExist:
        return Response({"error": "Project board not found."}, status=status.HTTP_404_NOT_FOUND)

Apply to all create(), partial_update(), and destroy() methods in:

• IssueCommentPublicViewSet
• IssueVotePublicViewSet
• IssueReactionPublicViewSet
• CommentReactionPublicViewSet

Affected File

apps/api/plane/space/views/issue.py

Related

Identified during security audit of PR #9498. Pre-existing issue, not introduced by that PR.

Start in apps/api/plane/space/views/issue.py and inspect the public methods on IssueCommentPublicViewSet, IssueVotePublicViewSet, IssueReactionPublicViewSet, and CommentReactionPublicViewSet. Compare their DeployBoard lookup with get_queryset(), then verify that invalid or expired anchors produce HTTP 404 rather than HTTP 500 across create(), partial_update(), and destroy().