fix(storage): honour MINIO_ENDPOINT_SSL when building export presigned URLs

[Hayyan612]

Description

Presigned download URLs generated by the export task come back on http:// even when MINIO_ENDPOINT_SSL=1 is set, so on an https instance the browser blocks the download silently.

There are two presigned-URL paths and only one of them honoured the flag.

S3Storage checks it directly, apps/api/plane/settings/storage.py:41:

if os.environ.get("MINIO_ENDPOINT_SSL") == "1":
    endpoint_protocol = "https"
else:
    endpoint_protocol = request.scheme if request else "http"

The export task never touches S3Storage. It builds its own boto3 client, apps/api/plane/bgtasks/export_task.py:65-73:

presign_s3 = boto3.client(
    "s3",
    endpoint_url=(
        f"{settings.AWS_S3_URL_PROTOCOL}//{str(settings.AWS_S3_CUSTOM_DOMAIN).replace('/uploads', '')}/"
    ),
    ...
)

and AWS_S3_URL_PROTOCOL was taken from the scheme of WEB_URL, not from MINIO_ENDPOINT_SSL and not from AWS_S3_ENDPOINT_URL. That is the only definition and the only use of the setting in the repo.

This is the default path for self-hosters rather than an edge case: deployments/cli/community/variables.env:15 hardcodes WEB_URL=http://${APP_DOMAIN}, so anyone terminating TLS at a proxy gets http: here regardless of what they set.

This PR makes the setting mirror the check storage.py already makes, so the two paths agree.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• Feature (non-breaking change which adds functionality)
• Improvement (change that would cause existing functionality to not work as expected)
• Code refactoring
• Performance improvements
• Documentation update

Test Scenarios

Exercised the settings logic across the realistic configurations to confirm nothing but the intended case moves:

config	before	after
TLS at proxy, internal http, MINIO_ENDPOINT_SSL=1	http://plane.example.com/	https://plane.example.com/
compose default, flag unset	http://plane.example.com/	unchanged
WEB_URL already https	https://plane.example.com/	unchanged
plain http deploy, MINIO_ENDPOINT_SSL=0	http://192.168.1.50/	unchanged

Only a deployment that explicitly opted into SSL changes behaviour. ruff check passes and the changed line is ruff format clean.

Two things reviewers should know:

• ExporterHistory.url is a stored URLField written once at export_task.py:118, so rows created before this change keep their old http:// links. Only new exports come back corrected.
• This looks like the same root cause as [bug]: Url for images/attachments wrong http instead of https #5827, but I have not been able to test the images and attachments surface, so I have not claimed it there.

There is already a # TODO: Change the upload_to_s3 function to use the new storage method at export_task.py:41. Routing export through S3Storage would remove this whole class of divergence rather than patching one symptom, but it is a much larger change, so I kept this to the single line that makes the two paths agree. Happy to take it that way instead if you would prefer.

References

Fixes #9550
Related #5827

Summary by CodeRabbit

• Bug Fixes
  • Corrected storage URL handling so secure MinIO connections consistently use HTTPS.
  • Preserved the configured website URL scheme for other storage connections.
  • Improved custom storage domain handling based on the configured website URL and bucket name.

[coldtea-pr-lens]

◈ PR Lens

🟢 +0 new · 🟠 ~1 changed · 🔴 -0 removed · 1 flow · 2 files · commit dc63f51

Architecture

1 component touched across 4 lanes.

Open the interactive canvas

Data flow

Presigning MinIO export download URL

Open the interactive canvas

View

• Architecture lens
• Data flow lens
• Expand every detail

Tip

Switch GitHub to dark mode and the diagrams follow. The moving dots are this pull request's data in motion.

🪧 More tips

• Run npx skills add coldteadotai/pr-lens, then tell your coding agent: "Diagram the change you just made with PR Lens and attach it to the pull request."
• Run npx @coldtea/pr-lens-cli analyze --base origin/main on a branch, then npx @coldtea/pr-lens-cli render .pr-lens/graph.json. Same lenses, your own model key, before the pull request exists.
• Untick Architecture lens or Data flow lens under View to hide a diagram, or tick Expand every detail to open every section. The comment redraws in a few seconds.
• Click the link under each diagram to open it on a canvas you can zoom, pan and step through.
• The diagrams are links. Click one to open it on the canvas, then press W or click play to walk through the change.
• Open a diagram on the canvas, then press W or click play to walk through the change one step at a time.
• The CLI's render reads .github/pr-lens.yml and applies your renames, exclusions and lane pins at draw time.
• Set github.comment.collapsed: true in .github/pr-lens.yml to fold the comment behind one View architecture and data flow row. Drawing still runs on every push.
• Add .github/workflows/pr-lens.yml with coldteadotai/pr-lens/packages/action@v0 and your model provider's key as its api-key to run PR Lens from your own CI. Any /chat/completions endpoint works.
• Push a commit and the comment redraws for the new head. A slow older run never overwrites a newer one.

---

Thanks for using PR Lens! It's built by Coldtea, free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: cbc40980-dfe3-4bed-95aa-7449d096a710

📥 Commits

Reviewing files that changed from the base of the PR and between c2e873b and dc63f51.

📒 Files selected for processing (1)

• apps/api/plane/tests/unit/settings/test_export_url_protocol.py

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The change updates AWS_S3_URL_PROTOCOL to use HTTPS when MINIO_ENDPOINT_SSL equals "1". New tests cover forced HTTPS, fallback to WEB_URL, and custom-domain resolution.

Changes

S3 URL protocol resolution

Layer / File(s)	Summary
Protocol selection apps/api/plane/settings/common.py	AWS_S3_URL_PROTOCOL selects "https:" when MINIO_ENDPOINT_SSL equals "1"; otherwise, it uses the parsed WEB_URL scheme.
Protocol resolution tests apps/api/plane/tests/unit/settings/test_export_url_protocol.py	Tests reload settings with controlled environment values and verify protocol selection and AWS_S3_CUSTOM_DOMAIN resolution.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to dc63f

The change is scoped to correcting export URL protocol selection, with coverage for SSL override and fallback behavior; no merge-blocking risk is established.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary change: honoring MINIO_ENDPOINT_SSL when generating export presigned URLs.
Description check	✅ Passed	The description explains the bug, affected code paths, implementation, behavior changes, test scenarios, limitations, and references. The optional Screenshots and Media section is omitted, but this is…
Linked Issues check	✅ Passed	The change addresses issue #9550. AWS_S3_URL_PROTOCOL now selects https: when MINIO_ENDPOINT_SSL == "1". Other configurations retain the WEB_URL scheme. The added tests cover the SSL override,…
Out of Scope Changes check	✅ Passed	The source change is limited to export URL protocol selection in apps/api/plane/settings/common.py. The new settings tests directly verify the issue behavior. No unrelated change is shown, and no fi…
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 2 files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Git: CodeRabbit could not clone the repository, so clone-backed analysis was skipped and this review may be incomplete. Verify repository clone access, such as SSH credentials, before requesting another full review. If clone access is intentionally unavailable, use path_filters to narrow the review scope.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟡 Changes recommended

Add regression tests covering SSL-enabled and fallback configurations.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This pull request fixes export presigned URLs to honor MINIO_ENDPOINT_SSL.

Changes:

• Uses HTTPS when MINIO_ENDPOINT_SSL=1.
• Preserves the existing WEB_URL scheme fallback.

File summaries

File	Summary
apps/api/plane/settings/common.py	Applies the MinIO SSL flag to export URL protocol generation; regression tests are still needed.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Hayyan612]

Good catch, added in dc63f51.

plane/tests/unit/settings/test_export_url_protocol.py reloads plane.settings.common under a patched environment, since as you noted the value is computed at import time and the existing S3Storage tests never reach it. Five cases:

• MINIO_ENDPOINT_SSL=1 with an http WEB_URL gives https: (the TLS-at-proxy case this PR fixes)
• MINIO_ENDPOINT_SSL=0 falls back to the WEB_URL scheme
• unset flag falls back to the WEB_URL scheme
• an https WEB_URL with no flag is unchanged
• AWS_S3_CUSTOM_DOMAIN is still built from the WEB_URL host plus the bucket, so the override does not disturb the host half of the endpoint

I checked the suite actually catches the regression rather than just passing alongside the fix. Reverting the one-line change locally:

FAILED test_export_url_protocol.py::TestExportURLProtocol::test_ssl_flag_forces_https_when_web_url_is_http
1 failed, 4 passed

The three fallback cases pass in both states, which is the point of them, and only the new behaviour fails without the fix. With the fix, 5 passed.

An autouse fixture reloads plane.settings.common again on teardown so the module is left as the rest of the suite expects. ruff check and ruff format --check both pass on the new file.