fix: scope workspace user preference filter to current user (#9279)

* fix: scope workspace user preference filter to current user

Without user=request.user on the PATCH filter, the ORM could match
another user's preference record in the same workspace, causing
pin/unpin state to leak across users or silently fail to persist.

Fixes #9260

Signed-off-by: okxint <cashmein.eth@gmail.com>

* test: add regression coverage for workspace user preference scoping (#9260)

Adds contract tests for the sidebar preference PATCH endpoint:

- test_patch_only_updates_requesting_users_preference: in a multi-member
  workspace, a member's PATCH must update only their own preference row,
  never another member's. Fails against the pre-fix code (the unscoped
  .first() mutates the most-recently-created row regardless of user).
- test_patch_updates_own_preference: baseline that a member's PATCH
  persists to their own row.

Verified RED on the unpatched view and GREEN with the user=request.user
filter from #9261.

* fix(api): wrap long line to satisfy ruff E501 in user preference view

---------

Signed-off-by: okxint <cashmein.eth@gmail.com>
Co-authored-by: okxint <cashmein.eth@gmail.com>

Author: sriramveeraghanta

apps/api/plane/app/views/workspace/user_preference.py

@@ -85,7 +85,9 @@ def patch(self, request, slug):
             if not key:
                 continue
 
-            preference = WorkspaceUserPreference.objects.filter(key=key, workspace__slug=slug).first()
+            preference = WorkspaceUserPreference.objects.filter(
+                key=key, workspace__slug=slug, user=request.user
+            ).first()
 
             if not preference:
                 continue

apps/api/plane/tests/contract/app/test_workspace_user_preference_app.py

@@ -0,0 +1,83 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from datetime import timedelta
+
+import pytest
+from django.urls import reverse
+from django.utils import timezone
+from rest_framework import status
+
+from plane.db.models import User, WorkspaceMember
+from plane.db.models.workspace import WorkspaceUserPreference
+
+
+@pytest.mark.contract
+class TestWorkspaceUserPreferencePatch:
+    """Contract tests for the sidebar preference PATCH endpoint.
+
+    Regression coverage for #9260: ``patch`` filtered ``WorkspaceUserPreference``
+    by ``key``/``workspace__slug`` only, so in a workspace with multiple members
+    ``.first()`` (ordered by ``-created_at``) could return — and mutate — another
+    member's preference row instead of the requesting user's.
+    """
+
+    KEY = WorkspaceUserPreference.UserPreferenceKeys.ANALYTICS.value
+
+    @pytest.mark.django_db
+    def test_patch_only_updates_requesting_users_preference(self, session_client, create_user, workspace):
+        """A member's PATCH must update only their own preference, never another member's."""
+        # A second, more-recently-active member of the same workspace.
+        other_user = User.objects.create(
+            email="other@plane.so", username="other_user", first_name="Other", last_name="User"
+        )
+        WorkspaceMember.objects.create(workspace=workspace, member=other_user, role=15)
+
+        own_pref = WorkspaceUserPreference.objects.create(
+            workspace=workspace, user=create_user, key=self.KEY, is_pinned=False, sort_order=100
+        )
+        other_pref = WorkspaceUserPreference.objects.create(
+            workspace=workspace, user=other_user, key=self.KEY, is_pinned=False, sort_order=200
+        )
+
+        # Force the other member's row to sort first under the model's ``-created_at``
+        # ordering, so an unscoped ``.first()`` would deterministically pick it.
+        now = timezone.now()
+        WorkspaceUserPreference.objects.filter(pk=own_pref.pk).update(created_at=now)
+        WorkspaceUserPreference.objects.filter(pk=other_pref.pk).update(created_at=now + timedelta(minutes=1))
+
+        url = reverse("workspace-user-preference", kwargs={"slug": workspace.slug})
+        response = session_client.patch(
+            url, [{"key": self.KEY, "is_pinned": True, "sort_order": 999}], format="json"
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+
+        own_pref.refresh_from_db()
+        other_pref.refresh_from_db()
+
+        # The requesting user's preference is updated...
+        assert own_pref.is_pinned is True
+        assert own_pref.sort_order == 999
+        # ...and the other member's preference is left untouched.
+        assert other_pref.is_pinned is False
+        assert other_pref.sort_order == 200
+
+    @pytest.mark.django_db
+    def test_patch_updates_own_preference(self, session_client, create_user, workspace):
+        """Baseline: a member's PATCH persists changes to their own preference row."""
+        preference = WorkspaceUserPreference.objects.create(
+            workspace=workspace, user=create_user, key=self.KEY, is_pinned=False, sort_order=100
+        )
+
+        url = reverse("workspace-user-preference", kwargs={"slug": workspace.slug})
+        response = session_client.patch(
+            url, [{"key": self.KEY, "is_pinned": True, "sort_order": 42}], format="json"
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+
+        preference.refresh_from_db()
+        assert preference.is_pinned is True
+        assert preference.sort_order == 42