writable membership for the PAT principal.

- Resource reads and mutations include repository ownership in their database

  query. Composite foreign keys reject cross-repository comments, label and

  assignee links, milestones, and project items.

  assignee links, and milestones. A project item stores separate project and

  source-issue repository identities, so one board can include a readable

  issue from another repository without weakening project write authority.

- Issue and milestone numbers are repository-local. Project numbers are also

  repository-local for the repository-shaped LiveView surface.

- Project list, show, item, update-item, and field actions resolve the repository

  from the route. Public repositories allow anonymous reads. Private reads and

  every write require membership in that repository.

- Item creation accepts either the legacy repository-local `issue_number` or

  an `issue` object with `owner`, `repo`, and `number`. Cross-repository adds

  require write access to the project repository and read access to the source

  repository. Item lists omit source issues that the current viewer cannot

  read.

- Assignee reads return active repository members with writable roles, and

  issue assignment accepts only those members.

  repos/OWNER/REPOSITORY/projectsV2/PROJECT_NUMBER/items

```

To add an issue from another repository, identify its repository explicitly.

You must be able to write the project and read the source issue repository:

```sh

printf '%s' '{"issue":{"owner":"SOURCE_OWNER","repo":"SOURCE_REPOSITORY","number":37},"values":{"Status":"To Do"}}' | \

  openagents api -X POST --input - \

  repos/PROJECT_OWNER/PROJECT_REPOSITORY/projectsV2/PROJECT_NUMBER/items

```

Item responses include the source issue's `owner`, `repo`, `number`, `url`,

and `html_url`. The legacy `issue_number` form continues to select an issue

from the project repository.

Update the stored values for an item:

```sh

    repository_id = repository_id_for(repository, Map.get(attrs, "project_id"))

    %ProjectItem{}

    |> ProjectItem.changeset(Map.put(attrs, "repository_id", repository_id))

    |> ProjectItem.changeset(

      attrs

      |> Map.put("repository_id", repository_id)

      |> Map.put_new("issue_repository_id", repository.id)

    )

    |> Repo.insert()

  end

  schema "project_items" do

    field :values, :map

    field :project_id, :id

    field :issue_id, :id

    belongs_to :repository, Repository, type: :binary_id

    belongs_to :issue_repository, Repository, type: :binary_id

    belongs_to :issue, OpenAgents.Issues.Issue

    timestamps(type: :utc_datetime)

  end

  @doc false

  def changeset(project_item, attrs) do

    project_item

    |> cast(attrs, [:values, :project_id, :issue_id, :repository_id])

    |> validate_required([:project_id, :issue_id, :repository_id])

    |> cast(attrs, [:values, :project_id, :issue_id, :repository_id, :issue_repository_id])

    |> validate_required([:project_id, :issue_id, :repository_id, :issue_repository_id])

    |> unique_constraint([:project_id, :issue_id])

    |> foreign_key_constraint(:repository_id)

    |> foreign_key_constraint(:project_id)

    |> foreign_key_constraint(:issue_id)

    |> foreign_key_constraint(:project_id, name: :project_items_project_repository_fkey)

    |> foreign_key_constraint(:issue_id, name: :project_items_issue_repository_fkey)

    |> foreign_key_constraint(:issue_id, name: :project_items_issue_source_repository_fkey)

  end

end

  end

  def list_project_items(%Project{id: project_id, repository_id: repository_id}) do

    ProjectItem

    |> where(project_id: ^project_id, repository_id: ^repository_id)

    project_items_query(project_id, repository_id)

    |> order_by(asc: :id)

    |> preload(issue: :repository)

    |> Repo.all()

  end

  def list_visible_project_items(

        %Project{id: project_id, repository_id: repository_id},

        user

      ) do

    readable =

      from(repository in Repositories.readable_by(Repository, user), select: repository.id)

    project_items_query(project_id, repository_id)

    |> where([item], item.issue_repository_id in subquery(readable))

    |> order_by(asc: :id)

    |> preload(issue: :repository)

    |> Repo.all()

  end

  def get_project_item!(%Project{id: project_id, repository_id: repository_id}, id) do

    Repo.get_by!(ProjectItem,

    ProjectItem

    |> Repo.get_by!(

      id: id,

      project_id: project_id,

      repository_id: repository_id

    )

    |> Repo.preload(issue: :repository)

  end

  def get_visible_project_item!(

        %Project{id: project_id, repository_id: repository_id},

        id,

        user

      ) do

    readable =

      from(repository in Repositories.readable_by(Repository, user), select: repository.id)

    project_items_query(project_id, repository_id)

    |> where([item], item.id == ^id and item.issue_repository_id in subquery(readable))

    |> preload(issue: :repository)

    |> Repo.one!()

  end

  def create_project_item(attrs, project, actor \\ nil)

      when is_nil(actor) or is_struct(actor, User) do

    attrs = to_string_map(attrs)

    values = Map.get(attrs, "values", %{})

    issue_repository_id = Map.get(attrs, "issue_repository_id", project.repository_id)

    result =

      case Map.get(attrs, "issue_number") do

          |> ProjectItem.changeset(%{

            "project_id" => project.id,

            "repository_id" => project.repository_id,

            "issue_repository_id" => issue_repository_id,

            "values" => values

          })

          |> Ecto.Changeset.apply_action(:insert)

        issue_number ->

          issue =

            Repo.get_by!(Issue,

              repository_id: project.repository_id,

              repository_id: issue_repository_id,

              number: issue_number

            )

            "project_id" => project.id,

            "issue_id" => issue.id,

            "repository_id" => project.repository_id,

            "issue_repository_id" => issue_repository_id,

            "values" => values

          })

          |> Repo.insert()

          "has_issue" => match?(%ProjectItem{issue_id: id} when id != nil, item)

        })

        {:ok, item}

        {:ok, Repo.preload(item, issue: :repository)}

      result ->

        result

    end

  end

  defp project_items_query(project_id, repository_id) do

    from(item in ProjectItem,

      where: item.project_id == ^project_id and item.repository_id == ^repository_id

    )

  end

  defp number_conflict?(changeset) do

    Enum.any?(changeset.errors, fn {_field, {_message, options}} ->

      options[:constraint_name] == "projects_repository_id_number_index"

      }) do

    repository = visible_repository!(conn, owner, repo)

    project = Projects.get_project_by_number!(repository, parse_id!(project_number))

    render(conn, :items, items: Projects.list_project_items(project))

    render(conn, :items,

      items: Projects.list_visible_project_items(project, conn.assigns[:current_user])

    )

  rescue

    Ecto.NoResultsError -> not_found(conn)

  end

    repository = writable_repository!(conn, owner, repo)

    project = Projects.get_project_by_number!(repository, parse_id!(project_number))

    case cast_number(params["issue_number"]) do

    case issue_reference(conn, repository, params) do

      :error ->

        unprocessable(conn, %{issue_number: ["is invalid"]})

      {:ok, issue_number} ->

        params = Map.put(params, "issue_number", issue_number)

      {:ok, source_repository, issue_number} ->

        params =

          params

          |> Map.put("issue_number", issue_number)

          |> Map.put("issue_repository_id", source_repository.id)

        case Projects.create_project_item(params, project, conn.assigns.current_user) do

          {:ok, item} ->

      ) do

    repository = writable_repository!(conn, owner, repo)

    project = Projects.get_project_by_number!(repository, parse_id!(project_number))

    item = Projects.get_project_item!(project, parse_id!(item_id))

    item =

      Projects.get_visible_project_item!(

        project,

        parse_id!(item_id),

        conn.assigns.current_user

      )

    if is_map(Map.get(params, "values", %{})) do

      case Projects.update_project_item(item, params) do

  defp cast_number(_other), do: :error

  defp issue_reference(conn, _project_repository, %{"issue" => issue}) when is_map(issue) do

    with owner when is_binary(owner) <- issue["owner"],

         repo when is_binary(repo) <- issue["repo"],

         {:ok, number} <- cast_number(issue["number"]) do

      {:ok, visible_repository!(conn, owner, repo), number}

    else

      _invalid -> :error

    end

  end

  defp issue_reference(_conn, project_repository, params) do

    case cast_number(params["issue_number"]) do

      {:ok, number} -> {:ok, project_repository, number}

      :error -> :error

    end

  end

  defp unprocessable(conn, errors) do

    conn

    |> put_status(:unprocessable_entity)

  end

  defp item_json(item) do

    issue = item.issue

    repository = issue.repository

    base_url = OpenAgentsWeb.Endpoint.url()

    %{

      id: item.id,

      issue_id: item.issue_id,

      issue: %{

        owner: repository.owner,

        repo: repository.name,

        number: issue.number,

        url:

          "#{base_url}/api/v3/repos/#{repository.owner}/#{repository.name}/issues/#{issue.number}",

        html_url: "#{base_url}/#{repository.owner}/#{repository.name}/issues/#{issue.number}"

      },

      values: item.values

    }

  end

  def mount(%{"owner" => owner, "repo" => repo, "number" => number}, _session, socket) do

    repository = Repositories.get_writable_by_path!(owner, repo, socket.assigns.current_user)

    project = Projects.get_project_by_number!(repository, String.to_integer(number))

    items = project_items(repository, project)

    items = project_items(project, socket.assigns.current_user)

    issue_options = issue_options(repository)

    {:ok,

      {:ok, _item} ->

        {:noreply,

         socket

         |> assign(:items, project_items(socket.assigns.repository, project))

         |> assign(:items, project_items(project, socket.assigns.current_user))

         |> assign(:form, to_form(ProjectItem.changeset(%ProjectItem{}, %{}), as: "item"))

         |> put_flash(:info, "Issue added to project")}

    end

  end

  defp project_items(repository, project) do

    Projects.list_project_items(project)

  defp project_items(project, user) do

    Projects.list_visible_project_items(project, user)

    |> Enum.map(fn item ->

      issue = Issues.get_issue!(repository, item.issue_id)

      issue = item.issue

      status = get_in(item.values, ["Status"]) || "To Do"

      Map.merge(item, %{issue: issue, status: status})

    end)

              <%= for item <- @items, item.status == status do %>

                <article class="card !m-0 !p-3">

                  <.link

                    navigate={~p"/#{@owner}/#{@repo}/issues/#{item.issue.number}"}

                    navigate={

                      ~p"/#{item.issue.repository.owner}/#{item.issue.repository.name}/issues/#{item.issue.number}"

                    }

                    class="btn px-0 text-sm font-semibold"

                    data-variant="link"

                  >

                    {item.issue.title}

                  </.link>

                  <span class="text-xs text-muted-foreground block">

                    #{item.issue.number}

                    {item.issue.repository.owner}/{item.issue.repository.name}#{item.issue.number}

                  </span>

                  <div class="flex flex-wrap gap-1 mt-2">

                    <%= for label <- item.issue.labels || [] do %>

  # Zero debounce means tests: refresh synchronously on the change message so

  # assertions need no waiting.

  defp schedule_refresh(socket) when @refresh_debounce_ms == 0 do

    load(socket)

  defp schedule_refresh(socket) do

    if @refresh_debounce_ms == 0,

      do: load(socket),

      else: schedule_debounced_refresh(socket)

  end

  defp schedule_refresh(socket) do

  defp schedule_debounced_refresh(socket) do

    case socket.assigns.refresh_timer_ref do

      nil ->

        assign(

    20260821082652,

    20260822082657,

    20260822120326,

    20260822132511

    20260822132511,

    20260822153929

  ],

  "required_tables": [

    "users",

defmodule OpenAgents.Repo.Migrations.AllowCrossRepositoryProjectItems do

  use Ecto.Migration

  def up do

    alter table(:project_items) do

      add :issue_repository_id,

          references(:repositories, type: :binary_id, on_delete: :delete_all)

    end

    execute("UPDATE project_items SET issue_repository_id = repository_id")

    execute("ALTER TABLE project_items ALTER COLUMN issue_repository_id SET NOT NULL")

    execute("ALTER TABLE project_items DROP CONSTRAINT project_items_issue_repository_fkey")

    create index(:project_items, [:issue_repository_id])

    create unique_index(:project_items, [:project_id, :issue_id])

    execute("""

    ALTER TABLE project_items

      ADD CONSTRAINT project_items_issue_source_repository_fkey

      FOREIGN KEY (issue_id, issue_repository_id)

      REFERENCES issues (id, repository_id)

      ON DELETE RESTRICT

    """)

  end

  def down do

    execute("DELETE FROM project_items WHERE issue_repository_id <> repository_id")

    execute(

      "ALTER TABLE project_items DROP CONSTRAINT project_items_issue_source_repository_fkey"

    )

    drop unique_index(:project_items, [:project_id, :issue_id])

    drop index(:project_items, [:issue_repository_id])

    execute("""

    ALTER TABLE project_items

      ADD CONSTRAINT project_items_issue_repository_fkey

      FOREIGN KEY (issue_id, repository_id)

      REFERENCES issues (id, repository_id)

      ON DELETE RESTRICT

    """)

    alter table(:project_items), do: remove(:issue_repository_id)

  end

end

    end

  end

  test "project-item and comment constraints reject cross-repository parents", %{

  test "project-item and comment constraints reject mismatched repository identities", %{

    initial: initial,

    second: second,

    user: user

             |> ProjectItem.changeset(%{

               project_id: project.id,

               issue_id: second_issue.id,

               repository_id: initial.id

               repository_id: initial.id,

               issue_repository_id: initial.id

             })

             |> Repo.insert()

      assert issue_id == issue.id

    end

    test "POST .../items adds a readable issue from another repository", %{

      conn: conn,

      project: project

    } do

      source =

        repository_fixture(%{owner: "SourceOrg", name: "source-api", visibility: "public"})

      {:ok, issue} = Issues.create_issue(source, %{title: "Cross-repository work"})

      conn =

        post(

          conn,

          ~p"/api/v3/repos/ProjectTestOrg/project-api/projectsV2/#{project.number}/items",

          %{issue: %{owner: "SourceOrg", repo: "source-api", number: issue.number}}

        )

      assert %{

               "items" => [

                 %{

                   "issue_id" => issue_id,

                   "issue" => %{

                     "owner" => "SourceOrg",

                     "repo" => "source-api",

                     "number" => number,

                     "html_url" => html_url

                   }

                 }

               ]

             } = json_response(conn, 201)

      assert issue_id == issue.id

      assert number == issue.number

      assert html_url =~ "/SourceOrg/source-api/issues/#{issue.number}"

      assert [%{issue_repository_id: source_id}] = Projects.list_project_items(project)

      assert source_id == source.id

    end

    test "POST .../items hides an unreadable source repository", %{

      conn: conn,

      project: project

    } do

      source =

        repository_fixture(%{owner: "SecretOrg", name: "secret-api", visibility: "private"})

      {:ok, issue} = Issues.create_issue(source, %{title: "Private work"})

      conn =

        post(

          conn,

          ~p"/api/v3/repos/ProjectTestOrg/project-api/projectsV2/#{project.number}/items",

          %{issue: %{owner: "SecretOrg", repo: "secret-api", number: issue.number}}

        )

      assert json_response(conn, 404) == %{"message" => "Not Found"}

      assert Projects.list_project_items(project) == []

    end

    test "POST .../projectsV2/:project_number/items stores field values", %{

      conn: conn,

      project: project,