From 5eb5942dd82e20053648e62c8485661b94a1aa8e Mon Sep 17 00:00:00 2001
From: Michael Uray <michaeluray@users.noreply.github.com>
Date: Sun, 18 Oct 2026 04:18:48 +0000
Subject: [PATCH 1/3] feat(tracker): create a milestone from the milestone
 selector

The milestone selector used when creating or editing an issue only listed existing milestones, so a milestone that did not exist yet could not be added without leaving the issue dialog. NewMilestone also did not report the created milestone back to its caller.

The selector now offers a "New Milestone" entry when it is bound to a single project. It opens the existing NewMilestone dialog for that project and selects the created milestone afterwards (only if it was created in the same project, since the dialog allows changing the project). NewMilestone now passes the id of the created milestone when it closes.

Fixes #4858

Signed-off-by: Michael Uray <michaeluray@users.noreply.github.com>
---
 .../milestones/MilestoneSelector.svelte       | 44 ++++++++++++++++---
 .../components/milestones/NewMilestone.svelte |  6 ++-
 2 files changed, 43 insertions(+), 7 deletions(-)

diff --git a/plugins/tracker-resources/src/components/milestones/MilestoneSelector.svelte b/plugins/tracker-resources/src/components/milestones/MilestoneSelector.svelte
index b15f51cc29d..744e51d7ba6 100644
--- a/plugins/tracker-resources/src/components/milestones/MilestoneSelector.svelte
+++ b/plugins/tracker-resources/src/components/milestones/MilestoneSelector.svelte
@@ -15,12 +15,22 @@
 <script lang="ts">
   import { DocumentQuery, Ref, SortingOrder } from '@hcengineering/core'
   import { IntlString, getEmbeddedLabel, translateCB } from '@hcengineering/platform'
-  import { createQuery } from '@hcengineering/presentation'
+  import { createQuery, getClient } from '@hcengineering/presentation'
   import { Milestone } from '@hcengineering/tracker'
   import type { ButtonKind, ButtonSize, LabelAndProps, PopupResult } from '@hcengineering/ui'
-  import { Button, ButtonShape, Label, SelectPopup, eventToHTMLElement, showPopup, themeStore } from '@hcengineering/ui'
+  import {
+    Button,
+    ButtonShape,
+    IconAdd,
+    Label,
+    SelectPopup,
+    eventToHTMLElement,
+    showPopup,
+    themeStore
+  } from '@hcengineering/ui'
   import tracker from '../../plugin'
   import { milestoneStatusAssets } from '../../types'
+  import NewMilestone from './NewMilestone.svelte'
 
   export let value: Ref<Milestone> | null | undefined
   export let space: DocumentQuery<Milestone>['space'] | undefined = undefined
@@ -76,7 +86,11 @@
     selectedMilestone = milestones.find((it) => it._id === newMilestoneId)
   }
 
-  const getMilestoneInfo = (rawMilestones: Milestone[], sp: Milestone | undefined) => {
+  const createMilestoneId = '#createMilestone'
+  // A new milestone can be created only when the selector is bound to a single project
+  $: canCreate = isEditable && !isAction && typeof space === 'string'
+
+  const getMilestoneInfo = (rawMilestones: Milestone[], sp: Milestone | undefined, canCreate: boolean) => {
     return [
       {
         id: null,
@@ -84,6 +98,7 @@
         label: tracker.string.NoMilestone,
         isSelected: sp === undefined
       },
+      ...(canCreate ? [{ id: createMilestoneId, icon: IconAdd, label: tracker.string.NewMilestone }] : []),
       ...rawMilestones.map((p) => ({
         id: p._id,
         icon: tracker.icon.Milestone,
@@ -94,7 +109,22 @@
     ]
   }
 
-  $: milestones = getMilestoneInfo(rawMilestones, selectedMilestone)
+  $: milestones = getMilestoneInfo(rawMilestones, selectedMilestone, canCreate)
+
+  const client = getClient()
+
+  function createMilestone (): void {
+    if (typeof space !== 'string') return
+    const project = space
+    showPopup(NewMilestone, { space: project }, 'top', async (milestoneId: Ref<Milestone> | undefined) => {
+      if (milestoneId == null) return
+      // The project can be changed inside the dialog, select the milestone only if it belongs to our project
+      const milestone = await client.findOne(tracker.class.Milestone, { _id: milestoneId })
+      if (milestone?.space === project) {
+        onChange?.(milestoneId)
+      }
+    })
+  }
 
   let milestonePopup: PopupResult | undefined
   const handleMilestoneEditorOpened = async (event: MouseEvent): Promise<void> => {
@@ -108,8 +138,12 @@
       { value: milestones, placeholder: popupPlaceholder, searchable: true },
       eventToHTMLElement(event),
       (evt) => {
-        onChange?.(evt)
         milestonePopup = undefined
+        if (evt === createMilestoneId) {
+          createMilestone()
+          return
+        }
+        onChange?.(evt)
       }
     )
   }
diff --git a/plugins/tracker-resources/src/components/milestones/NewMilestone.svelte b/plugins/tracker-resources/src/components/milestones/NewMilestone.svelte
index a74c93fa508..ec7906db317 100644
--- a/plugins/tracker-resources/src/components/milestones/NewMilestone.svelte
+++ b/plugins/tracker-resources/src/components/milestones/NewMilestone.svelte
@@ -38,8 +38,10 @@
     targetDate: Date.now() + 14 * 24 * 60 * 60 * 1000
   }
 
+  let createdMilestone: Ref<Milestone> | undefined
+
   async function onSave () {
-    await client.createDoc(tracker.class.Milestone, space, object)
+    createdMilestone = await client.createDoc(tracker.class.Milestone, space, object)
   }
 </script>
 
@@ -49,7 +51,7 @@
   canSave={object.label !== ''}
   okLabel={tracker.string.CreateMilestone}
   gap={'gapV-4'}
-  on:close={() => dispatch('close')}
+  on:close={() => dispatch('close', createdMilestone)}
   on:changeContent
 >
   <svelte:fragment slot="header">

From 397a61160935d27d231f73fd94120121428362b9 Mon Sep 17 00:00:00 2001
From: Michael Uray <michaeluray@users.noreply.github.com>
Date: Thu, 29 Oct 2026 06:00:52 +0000
Subject: [PATCH 2/3] fix(tracker): offer milestone creation only to users who
 may create milestones

Signed-off-by: Michael Uray <michaeluray@users.noreply.github.com>
---
 .../milestones/MilestoneSelector.svelte       |  6 +-
 .../__tests__/milestonePermissions.test.ts    | 98 +++++++++++++++++++
 .../milestones/milestonePermissions.ts        | 22 +++++
 3 files changed, 124 insertions(+), 2 deletions(-)
 create mode 100644 plugins/tracker-resources/src/components/milestones/__tests__/milestonePermissions.test.ts
 create mode 100644 plugins/tracker-resources/src/components/milestones/milestonePermissions.ts

diff --git a/plugins/tracker-resources/src/components/milestones/MilestoneSelector.svelte b/plugins/tracker-resources/src/components/milestones/MilestoneSelector.svelte
index 744e51d7ba6..32cc417bb98 100644
--- a/plugins/tracker-resources/src/components/milestones/MilestoneSelector.svelte
+++ b/plugins/tracker-resources/src/components/milestones/MilestoneSelector.svelte
@@ -13,6 +13,7 @@
 // limitations under the License.
 -->
 <script lang="ts">
+  import { permissionsStore } from '@hcengineering/contact-resources'
   import { DocumentQuery, Ref, SortingOrder } from '@hcengineering/core'
   import { IntlString, getEmbeddedLabel, translateCB } from '@hcengineering/platform'
   import { createQuery, getClient } from '@hcengineering/presentation'
@@ -30,6 +31,7 @@
   } from '@hcengineering/ui'
   import tracker from '../../plugin'
   import { milestoneStatusAssets } from '../../types'
+  import { canCreateMilestone } from './milestonePermissions'
   import NewMilestone from './NewMilestone.svelte'
 
   export let value: Ref<Milestone> | null | undefined
@@ -88,7 +90,7 @@
 
   const createMilestoneId = '#createMilestone'
   // A new milestone can be created only when the selector is bound to a single project
-  $: canCreate = isEditable && !isAction && typeof space === 'string'
+  $: canCreate = canCreateMilestone(space, isEditable, isAction, $permissionsStore)
 
   const getMilestoneInfo = (rawMilestones: Milestone[], sp: Milestone | undefined, canCreate: boolean) => {
     return [
@@ -114,7 +116,7 @@
   const client = getClient()
 
   function createMilestone (): void {
-    if (typeof space !== 'string') return
+    if (!canCreate || typeof space !== 'string') return
     const project = space
     showPopup(NewMilestone, { space: project }, 'top', async (milestoneId: Ref<Milestone> | undefined) => {
       if (milestoneId == null) return
diff --git a/plugins/tracker-resources/src/components/milestones/__tests__/milestonePermissions.test.ts b/plugins/tracker-resources/src/components/milestones/__tests__/milestonePermissions.test.ts
new file mode 100644
index 00000000000..8b78ca62b3f
--- /dev/null
+++ b/plugins/tracker-resources/src/components/milestones/__tests__/milestonePermissions.test.ts
@@ -0,0 +1,98 @@
+//
+// Copyright © 2026 Hardcore Engineering Inc.
+// SPDX-License-Identifier: EPL-2.0
+//
+
+import type { PermissionsStore } from '@hcengineering/contact'
+import type { Permission, Ref } from '@hcengineering/core'
+import type { Project } from '@hcengineering/tracker'
+import { canCreateMilestone } from '../milestonePermissions'
+
+jest.mock('@hcengineering/view-resources', () => jest.requireActual('../../../../../view-resources/src/permissions'))
+jest.mock('@hcengineering/platform', () => ({
+  ...jest.requireActual('@hcengineering/platform'),
+  getMetadata: jest.fn()
+}))
+jest.mock('@hcengineering/presentation', () => ({
+  getClient: () => ({
+    getHierarchy: () => ({ getAncestors: (objectClass: string) => [objectClass] }),
+    getModel: () => ({
+      findAllSync: (_class: string, query: { txClass: string }) =>
+        query.txClass === 'core:class:TxCreateDoc'
+          ? [
+              {
+                _id: 'allow-milestone',
+                objectClass: 'tracker:class:Milestone'
+              },
+              {
+                _id: 'forbid-milestone',
+                objectClass: 'tracker:class:Milestone',
+                forbid: true
+              }
+            ]
+          : []
+    })
+  })
+}))
+jest.mock('../../../plugin', () => ({
+  __esModule: true,
+  default: { class: { Milestone: 'tracker:class:Milestone' } }
+}))
+
+const project = 'project' as Ref<Project>
+const otherProject = 'other-project' as Ref<Project>
+
+function permissions (permission?: string, restricted: boolean = false): PermissionsStore {
+  return {
+    ps: permission === undefined ? {} : { [project]: new Set([permission as Ref<Permission>]) },
+    ap: {},
+    ms: {},
+    whitelist: new Set(),
+    restrictedSpaces: new Set(restricted ? [project] : [])
+  }
+}
+
+describe('milestone creation permissions', () => {
+  it('offers creation to a permitted user in a restricted project', () => {
+    expect(canCreateMilestone(project, true, false, permissions('allow-milestone', true))).toBe(true)
+  })
+
+  it('hides creation from a forbidden user even in an unrestricted project', () => {
+    expect(canCreateMilestone(project, true, false, permissions('forbid-milestone'))).toBe(false)
+  })
+
+  it('hides creation in a restricted project without a creation grant', () => {
+    const store = permissions(undefined, true)
+    store.ps[project] = new Set()
+    expect(canCreateMilestone(project, true, false, store)).toBe(false)
+  })
+
+  it('stays hidden while permissions load and when a forbidden result arrives', () => {
+    expect(canCreateMilestone(project, true, false, permissions())).toBe(false)
+    expect(canCreateMilestone(project, true, false, permissions('forbid-milestone'))).toBe(false)
+  })
+
+  it('appears after permissions load and disappears when permission is revoked', () => {
+    expect(canCreateMilestone(project, true, false, permissions())).toBe(false)
+    expect(canCreateMilestone(project, true, false, permissions('allow-milestone', true))).toBe(true)
+    expect(canCreateMilestone(project, true, false, permissions('forbid-milestone', true))).toBe(false)
+  })
+
+  it('does not carry permission over to another project', () => {
+    expect(canCreateMilestone(otherProject, true, false, permissions('allow-milestone'))).toBe(false)
+  })
+
+  it('allows creation in a whitelisted project', () => {
+    const store = permissions()
+    store.whitelist.add(project)
+    expect(canCreateMilestone(project, true, false, store)).toBe(true)
+  })
+
+  it('requires an editable selector bound to a single project outside action mode', () => {
+    const store = permissions('allow-milestone')
+    expect(canCreateMilestone(project, false, false, store)).toBe(false)
+    expect(canCreateMilestone(project, true, true, store)).toBe(false)
+    expect(canCreateMilestone(undefined, true, false, store)).toBe(false)
+    expect(canCreateMilestone({ $in: [project, otherProject] }, true, false, store)).toBe(false)
+  })
+})
diff --git a/plugins/tracker-resources/src/components/milestones/milestonePermissions.ts b/plugins/tracker-resources/src/components/milestones/milestonePermissions.ts
new file mode 100644
index 00000000000..c77beb8090b
--- /dev/null
+++ b/plugins/tracker-resources/src/components/milestones/milestonePermissions.ts
@@ -0,0 +1,22 @@
+//
+// Copyright © 2026 Hardcore Engineering Inc.
+// SPDX-License-Identifier: EPL-2.0
+//
+
+import type { PermissionsStore } from '@hcengineering/contact'
+import type { DocumentQuery } from '@hcengineering/core'
+import type { Milestone } from '@hcengineering/tracker'
+import { canCreateObject } from '@hcengineering/view-resources'
+import tracker from '../../plugin'
+
+export function canCreateMilestone (
+  space: DocumentQuery<Milestone>['space'] | undefined,
+  isEditable: boolean,
+  isAction: boolean,
+  permissions: PermissionsStore
+): boolean {
+  if (!isEditable || isAction || typeof space !== 'string') return false
+  // The permissions query loads asynchronously. Do not allow creation before this project is known.
+  if (!permissions.whitelist.has(space) && permissions.ps[space] === undefined) return false
+  return canCreateObject(tracker.class.Milestone, space, permissions)
+}

From 7b4fb121b4e35a3fd1a642dd11c12f388a39eba6 Mon Sep 17 00:00:00 2001
From: Michael Uray <michaeluray@users.noreply.github.com>
Date: Thu, 29 Oct 2026 07:19:44 +0000
Subject: [PATCH 3/3] fix(tracker): check the milestone permission for the
 selected project before saving

Signed-off-by: Michael Uray <michaeluray@users.noreply.github.com>
---
 .../milestones/MilestoneSelector.svelte       |  1 +
 .../components/milestones/NewMilestone.svelte |  7 ++++-
 .../__tests__/milestonePermissions.test.ts    | 29 +++++++++++++++----
 .../milestones/milestonePermissions.ts        |  8 +++++
 4 files changed, 38 insertions(+), 7 deletions(-)

diff --git a/plugins/tracker-resources/src/components/milestones/MilestoneSelector.svelte b/plugins/tracker-resources/src/components/milestones/MilestoneSelector.svelte
index 32cc417bb98..430d1b5330c 100644
--- a/plugins/tracker-resources/src/components/milestones/MilestoneSelector.svelte
+++ b/plugins/tracker-resources/src/components/milestones/MilestoneSelector.svelte
@@ -90,6 +90,7 @@
 
   const createMilestoneId = '#createMilestone'
   // A new milestone can be created only when the selector is bound to a single project
+  // and the user may create milestones in it
   $: canCreate = canCreateMilestone(space, isEditable, isAction, $permissionsStore)
 
   const getMilestoneInfo = (rawMilestones: Milestone[], sp: Milestone | undefined, canCreate: boolean) => {
diff --git a/plugins/tracker-resources/src/components/milestones/NewMilestone.svelte b/plugins/tracker-resources/src/components/milestones/NewMilestone.svelte
index ec7906db317..a0beb8d72a6 100644
--- a/plugins/tracker-resources/src/components/milestones/NewMilestone.svelte
+++ b/plugins/tracker-resources/src/components/milestones/NewMilestone.svelte
@@ -13,6 +13,7 @@
 // limitations under the License.
 -->
 <script lang="ts">
+  import { permissionsStore } from '@hcengineering/contact-resources'
   import { Data, Ref } from '@hcengineering/core'
   import { IntlString } from '@hcengineering/platform'
   import { Card, getClient, SpaceSelector } from '@hcengineering/presentation'
@@ -23,6 +24,7 @@
   import tracker from '../../plugin'
   import MilestoneStatusEditor from './MilestoneStatusEditor.svelte'
   import ProjectPresenter from '../projects/ProjectPresenter.svelte'
+  import { canSaveMilestone } from './milestonePermissions'
 
   export let space: Ref<Project>
   const dispatch = createEventDispatcher()
@@ -40,7 +42,10 @@
 
   let createdMilestone: Ref<Milestone> | undefined
 
+  $: canSave = canSaveMilestone(space, object.label, $permissionsStore)
+
   async function onSave () {
+    if (!canSaveMilestone(space, object.label, $permissionsStore)) return
     createdMilestone = await client.createDoc(tracker.class.Milestone, space, object)
   }
 </script>
@@ -48,7 +53,7 @@
 <Card
   label={tracker.string.NewMilestone}
   okAction={onSave}
-  canSave={object.label !== ''}
+  {canSave}
   okLabel={tracker.string.CreateMilestone}
   gap={'gapV-4'}
   on:close={() => dispatch('close', createdMilestone)}
diff --git a/plugins/tracker-resources/src/components/milestones/__tests__/milestonePermissions.test.ts b/plugins/tracker-resources/src/components/milestones/__tests__/milestonePermissions.test.ts
index 8b78ca62b3f..f0b69fca2cb 100644
--- a/plugins/tracker-resources/src/components/milestones/__tests__/milestonePermissions.test.ts
+++ b/plugins/tracker-resources/src/components/milestones/__tests__/milestonePermissions.test.ts
@@ -6,7 +6,7 @@
 import type { PermissionsStore } from '@hcengineering/contact'
 import type { Permission, Ref } from '@hcengineering/core'
 import type { Project } from '@hcengineering/tracker'
-import { canCreateMilestone } from '../milestonePermissions'
+import { canCreateMilestone, canSaveMilestone } from '../milestonePermissions'
 
 jest.mock('@hcengineering/view-resources', () => jest.requireActual('../../../../../view-resources/src/permissions'))
 jest.mock('@hcengineering/platform', () => ({
@@ -67,11 +67,6 @@ describe('milestone creation permissions', () => {
     expect(canCreateMilestone(project, true, false, store)).toBe(false)
   })
 
-  it('stays hidden while permissions load and when a forbidden result arrives', () => {
-    expect(canCreateMilestone(project, true, false, permissions())).toBe(false)
-    expect(canCreateMilestone(project, true, false, permissions('forbid-milestone'))).toBe(false)
-  })
-
   it('appears after permissions load and disappears when permission is revoked', () => {
     expect(canCreateMilestone(project, true, false, permissions())).toBe(false)
     expect(canCreateMilestone(project, true, false, permissions('allow-milestone', true))).toBe(true)
@@ -96,3 +91,25 @@ describe('milestone creation permissions', () => {
     expect(canCreateMilestone({ $in: [project, otherProject] }, true, false, store)).toBe(false)
   })
 })
+
+describe('milestone dialog save permissions', () => {
+  it('requires a label even when the user may create milestones', () => {
+    const store = permissions('allow-milestone', true)
+    expect(canSaveMilestone(project, '', store)).toBe(false)
+    expect(canSaveMilestone(project, 'Release', store)).toBe(true)
+  })
+
+  it('disables saving when the dialog switches to a forbidden project and enables it on return', () => {
+    const store = permissions('allow-milestone', true)
+    store.ps[otherProject] = new Set(['forbid-milestone' as Ref<Permission>])
+    expect(canSaveMilestone(project, 'Release', store)).toBe(true)
+    expect(canSaveMilestone(otherProject, 'Release', store)).toBe(false)
+    expect(canSaveMilestone(project, 'Release', store)).toBe(true)
+  })
+
+  it('waits for permissions and disables saving when permission is revoked', () => {
+    expect(canSaveMilestone(project, 'Release', permissions())).toBe(false)
+    expect(canSaveMilestone(project, 'Release', permissions('allow-milestone', true))).toBe(true)
+    expect(canSaveMilestone(project, 'Release', permissions('forbid-milestone', true))).toBe(false)
+  })
+})
diff --git a/plugins/tracker-resources/src/components/milestones/milestonePermissions.ts b/plugins/tracker-resources/src/components/milestones/milestonePermissions.ts
index c77beb8090b..bef1c5ffeee 100644
--- a/plugins/tracker-resources/src/components/milestones/milestonePermissions.ts
+++ b/plugins/tracker-resources/src/components/milestones/milestonePermissions.ts
@@ -20,3 +20,11 @@ export function canCreateMilestone (
   if (!permissions.whitelist.has(space) && permissions.ps[space] === undefined) return false
   return canCreateObject(tracker.class.Milestone, space, permissions)
 }
+
+export function canSaveMilestone (
+  space: DocumentQuery<Milestone>['space'] | undefined,
+  label: string,
+  permissions: PermissionsStore
+): boolean {
+  return label !== '' && canCreateMilestone(space, true, false, permissions)
+}