fix(cycle): prevent editing completed cycles via sort_order payload

[arhxam]

Description

The cycle update endpoints are meant to lock completed cycles (those whose end_date is in the past) so that only sort_order can be changed. In practice, any field — name, description, start_date/end_date — can be modified as long as sort_order is included alongside the other fields in the same PATCH.

Root cause: both the app view (plane/app/views/cycle/base.py) and the public API view (plane/api/views/cycle.py) correctly build a sanitized payload for completed cycles:

request_data = request.data
if cycle.end_date is not None and cycle.end_date < timezone.now():
    if "sort_order" in request_data:
        request_data = {"sort_order": request_data.get("sort_order", cycle.sort_order)}
    else:
        return Response({"error": "The Cycle has already been completed so it cannot be edited"}, ...)

…but then hand the original request.data (not the sanitized request_data) to the serializer:

serializer = CycleWriteSerializer(cycle, data=request.data, partial=True, ...)  # bug

So the sanitization is dead code and every field leaks through.

Fix: pass the sanitized request_data to the serializer in both views (and to the external_id conflict guard in the API view, so external_id/external_source are likewise ignored for completed cycles). Behavior for non-completed cycles is unchanged, since there request_data is request.data.

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Test Scenarios

Added two contract tests in plane/tests/contract/api/test_cycles.py:

• test_update_completed_cycle_rejected — a PATCH with only name on a completed cycle returns 400 and leaves the cycle unchanged.
• test_update_completed_cycle_only_changes_sort_order — a PATCH with sort_order plus name/description returns 200, applies only sort_order, and leaves name/description untouched (the regression this fixes).

py_compile passes on all touched files. The DB-backed contract suite requires PostgreSQL, which I could not stand up locally; the tests are written against the existing test_cycles.py fixtures and style.

References

Fixes #9362

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 61dd978a-3d95-4d73-9975-dcdf40487db2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
18 out of 19 committers have signed the CLA.

✅ sriramveeraghanta
✅ KanteshMurade
✅ MinitJain
✅ jamartineztelecoengineer84-dotcom
✅ sangeethailango
✅ b-saikrishnakanth
✅ bubacho
✅ astarte75
✅ pratapalakshmi
✅ mguptahub
✅ durgeshhhhhhh
✅ Rahulcheryala
✅ karthiksuki
✅ ch4og
✅ okxint
✅ codingwolf-at
✅ akhil-vamshi-konam
✅ wildsurfer
❌ arhxam
_{You have signed the CLA already but the status is still pending? Let us recheck it.}