hardening(space): add project_id scope to destroy()/partial_update() lookups in public board views

[eltypical]

Summary

IssueReactionPublicViewSet.destroy() and IssueCommentPublicViewSet.partial_update() / destroy() fetch objects by pk + actor=request.user without additionally scoping to the board's project_id. This is a defense-in-depth gap.

Current Behavior

# IssueCommentPublicViewSet.partial_update() and destroy()
comment = IssueComment.objects.get(pk=pk, actor=request.user)
# No project_id or workspace_id constraint

# IssueReactionPublicViewSet.destroy()
issue_reaction = IssueReaction.objects.get(
    workspace_id=project_deploy_board.workspace_id,
    issue_id=issue_id,
    reaction=reaction_code,
    actor=request.user,
)
# Missing: project_id=project_deploy_board.project_id

Security Impact

Low. All lookups include actor=request.user — users can only affect their own objects. However, without project_id scoping, a user could modify/delete their own comment via a board from a different project within the same workspace, or delete their own reaction via any board in the workspace.

Recommended Fix

# IssueCommentPublicViewSet.partial_update() and destroy()
comment = IssueComment.objects.get(
    pk=pk,
    actor=request.user,
    project_id=project_deploy_board.project_id,
    workspace_id=project_deploy_board.workspace_id,
)

# IssueReactionPublicViewSet.destroy()
issue_reaction = IssueReaction.objects.get(
    workspace_id=project_deploy_board.workspace_id,
    project_id=project_deploy_board.project_id,   # add
    issue_id=issue_id,
    reaction=reaction_code,
    actor=request.user,
)

Affected File

apps/api/plane/space/views/issue.py

Related

Identified during security audit of PR #9498. Pre-existing issue, not introduced by that PR.