bugsink 2.2.0__tar.gz → 2.2.1__tar.gz

{bugsink-2.2.0 → bugsink-2.2.1}/.github/workflows/ci.yml

@@ -25,9 +25,9 @@ jobs:
   ruff:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: "Set up Python 3.12"
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: "3.12"
     - name: Install Ruff
@@ -40,10 +40,10 @@ jobs:
   bandit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: 3.12
 
@@ -106,9 +106,9 @@ jobs:
       DB_USER: ${{ matrix.db_user }}
       DB_PASSWORD: ${{ matrix.db_password }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.python-version }}
     - name: Start MySQL If Needed
@@ -134,7 +134,7 @@ jobs:
         pip install -r requirements.development.txt
         pip install mysqlclient psycopg2
     - name: Check out event-samples
-      uses: actions/checkout@master
+      uses: actions/checkout@v6
       with:
         repository: bugsink/event-samples
         path: "event-samples"
@@ -169,17 +169,17 @@ jobs:
     # Build the Docker image, start it, wait for readiness, log in at /accounts/login/,
     # and verify that / redirects to /teams/.
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Build Docker image
         run: docker build -t bugsink-ci .
 
-      - name: Run container (admin:admin)
+      - name: Run container (no-reply@bugsink.com:admin)
         run: |
           docker rm -f bugsink-ci || true
           docker run -d --name bugsink-ci \
             -e SECRET_KEY=UtdHATKzQKLkz3izFFpxCKamhEdspeHmCQFvLx1DAwskqEuyKL \
-            -e CREATE_SUPERUSER=admin:admin \
+            -e CREATE_SUPERUSER=no-reply@bugsink.com:admin \
             -e PORT=8000 \
             -p 8000:8000 \
             bugsink-ci
@@ -214,7 +214,7 @@ jobs:
           CODE=$(curl -sS -b cookies.txt -c cookies.txt \
             -H "Content-Type: application/x-www-form-urlencoded" \
             -H "Referer: http://localhost:8000/accounts/login/" \
-            -d "username=admin&password=admin&csrfmiddlewaretoken=${CSRF}&next=/" \
+            -d "username=no-reply@bugsink.com&password=admin&csrfmiddlewaretoken=${CSRF}&next=/" \
             -o /dev/null -w "%{http_code}" \
             http://localhost:8000/accounts/login/)
 
@@ -236,3 +236,7 @@ jobs:
           fi
 
           echo "Login OK and / redirects to /teams/"
+
+      - name: Show Docker logs
+        if: always()
+        run: docker logs bugsink-ci || true

{bugsink-2.2.0 → bugsink-2.2.1}/.github/workflows/copilot-setup-steps.yml

@@ -19,14 +19,14 @@ jobs:
       SAMPLES_DIR: ${{ github.workspace }}/event-samples
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install project `pre-commit` hook
         run: |
           cp pre-commit .git/hooks/pre-commit
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 

{bugsink-2.2.0 → bugsink-2.2.1}/CHANGELOG.md

@@ -1,6 +1,24 @@
 # Changes
 
-## 2.2.0 (19 May 2026)
+## 2.2.1 (22 May 2026)
+
+### API
+
+* Add issue actions to the canonical API, see #214 and #401.
+* Add canonical API issue comment creation, see #352 and #401.
+* Accept issue friendly IDs in the canonical API, see #389 and #401.
+* Improve OpenAPI endpoint docs, see #390 and #401.
+* Use Bugsink's version as the OpenAPI spec version, see #307.
+
+### Smaller fixes
+
+* Fix long module names overlapping version values on event detail pages, see #377 and #382.
+* Validate `CREATE_SUPERUSER` email addresses and use the email as username in Docker server-start setup, see #394.
+* Development server: do not send email by default, see d6d5190441b3.
+* Docker: disable Gunicorn's unused control socket, see #405.
+* Sourcemap uploads without a project slug now log server-side context before returning `400`, see #404 and #408.
+
+## 2.2.0 (21 May 2026)
 
 ### Security
 
@@ -26,6 +44,7 @@ https://github.com/bugsink/bugsink/security/advisories/GHSA-5389-f7vh-wxj8
 
 ### Smaller fixes
 
+* Fix health-check `ALLOWED_HOSTS`-ignore, see #140, #397
 * Generate an `event_id` on `/store/` when the SDK does not send one, see #383.
 * Refresh issue title fields on every event digest, see #378.
 * Include ingest-dir cleanup in the `vacuum` command and warn about stale ingest-dir files, see 772fb1a9bff6 and

{bugsink-2.2.0 → bugsink-2.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bugsink
-Version: 2.2.0
+Version: 2.2.1
 Summary: Self-hosted Error Tracking
 Author-email: "Bugsink B.V." <info@bugsink.com>
 Project-URL: homepage, https://www.bugsink.com/

{bugsink-2.2.0 → bugsink-2.2.1}/bsmain/management/commands/prestart.py

@@ -2,6 +2,8 @@ import os
 
 from django.core.management.base import BaseCommand
 from django.contrib.auth import get_user_model
+from django.core.exceptions import ValidationError
+from django.core.validators import validate_email
 
 from phonehome.tasks import send_if_due
 
@@ -17,7 +19,7 @@ class Command(BaseCommand):
             return
 
         if ":" not in os.getenv("CREATE_SUPERUSER"):
-            raise ValueError("CREATE_SUPERUSER should be in the format 'username:password'")
+            raise ValueError("CREATE_SUPERUSER should be in the format 'email:password'")
 
         username, password = os.getenv("CREATE_SUPERUSER").split(":", 1)
 
@@ -28,7 +30,14 @@ class Command(BaseCommand):
 
             return
 
-        User.objects.create_superuser(username=username, password=password)
+        # Validate only when we're actually creating the user, so existing installations with a stale
+        # CREATE_SUPERUSER value keep starting normally.
+        try:
+            validate_email(username)
+        except ValidationError as e:
+            raise ValueError("CREATE_SUPERUSER email should be a valid email address") from e
+
+        User.objects.create_superuser(username=username, email=username, password=password)
         print(f"Superuser created: {username}")
 
     def handle(self, *args, **options):

{bugsink-2.2.0 → bugsink-2.2.1}/bugsink/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '2.2.0'
-__version_tuple__ = version_tuple = (2, 2, 0)
+__version__ = version = '2.2.1'
+__version_tuple__ = version_tuple = (2, 2, 1)
 
-__commit_id__ = commit_id = 'gdac28a708'
+__commit_id__ = commit_id = 'gea814dc8e'

{bugsink-2.2.0 → bugsink-2.2.1}/bugsink/gunicorn.docker.conf.py

@@ -1,4 +1,5 @@
 # gunicorn config file for Docker deployments
 import multiprocessing
 
+control_socket_disable = True
 workers = min(multiprocessing.cpu_count(), 4)

{bugsink-2.2.0 → bugsink-2.2.1}/bugsink/settings/default.py

@@ -6,6 +6,9 @@ from pathlib import Path
 
 from django.utils.log import DEFAULT_LOGGING
 
+from ..version import version as __version__
+
+
 # We have a single file for our default settings, and expect (if they use the singleserver setup) the end-users to
 # configure their setup using a single bugsink_conf.py also. To be able to have (slightly) different settings for e.g.
 # logging for various commands, we expose a variable I_AM_RUNNING that can be used to determine what command is being
@@ -90,7 +93,7 @@ REST_FRAMEWORK = {
 SPECTACULAR_SETTINGS = {
     'TITLE': 'Bugsink',
     'DESCRIPTION': 'Bugsink API Documentation',
-    'VERSION': '1.0.0',
+    'VERSION': __version__,
     'SERVE_INCLUDE_SCHEMA': False,  # keep the docs clean and not document the docs endpoint itself.
 
     "SECURITY": [

{bugsink-2.2.0 → bugsink-2.2.1}/bugsink/settings/development.py

@@ -73,11 +73,12 @@ SNAPPEA = {
     "PID_FILE": "/tmp/bugsink/snappea.pid",  # nosec B108
 }
 
-EMAIL_HOST = os.getenv("EMAIL_HOST")
-EMAIL_HOST_USER = os.getenv("EMAIL_HOST_USER")
-EMAIL_HOST_PASSWORD = os.getenv("EMAIL_HOST_PASSWORD")
-EMAIL_PORT = 587
-EMAIL_USE_TLS = True
+EMAIL_BACKEND = "django.core.mail.backends.console.EmailBackend"
+# EMAIL_HOST = os.getenv("EMAIL_HOST")
+# EMAIL_HOST_USER = os.getenv("EMAIL_HOST_USER")
+# EMAIL_HOST_PASSWORD = os.getenv("EMAIL_HOST_PASSWORD")
+# EMAIL_PORT = 587
+# EMAIL_USE_TLS = True
 
 SERVER_EMAIL = DEFAULT_FROM_EMAIL = 'Bugsink Development Server <bugsink@example.org>'
 

{bugsink-2.2.0 → bugsink-2.2.1}/bugsink/urls.py

@@ -18,7 +18,7 @@ from files.views import chunk_upload, artifact_bundle_assemble, difs_assemble, a
 from bugsink.decorators import login_exempt
 
 from events.api_views import EventViewSet
-from issues.api_views import IssueViewSet
+from issues.api_views import IssueCommentViewSet, IssueViewSet
 from projects.api_views import ProjectViewSet
 from releases.api_views import ReleaseViewSet
 from teams.api_views import TeamViewSet
@@ -34,6 +34,7 @@ admin.site.index_title = "Admin"  # everyone calls this the "admin" anyway. Let'
 
 api_router = routers.DefaultRouter()
 api_router.register(r'events', EventViewSet)
+api_router.register(r'issue-comments', IssueCommentViewSet, basename='issue-comment')
 api_router.register(r'issues', IssueViewSet)
 api_router.register(r'projects', ProjectViewSet)
 api_router.register(r'releases', ReleaseViewSet)

{bugsink-2.2.0 → bugsink-2.2.1}/bugsink.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bugsink
-Version: 2.2.0
+Version: 2.2.1
 Summary: Self-hosted Error Tracking
 Author-email: "Bugsink B.V." <info@bugsink.com>
 Project-URL: homepage, https://www.bugsink.com/

{bugsink-2.2.0 → bugsink-2.2.1}/events/api_views.py

@@ -3,12 +3,13 @@ from rest_framework import viewsets
 from rest_framework.exceptions import ValidationError
 from rest_framework.decorators import action
 from rest_framework.response import Response
-from drf_spectacular.utils import extend_schema, OpenApiParameter, OpenApiTypes, OpenApiResponse
+from drf_spectacular.utils import extend_schema, OpenApiExample, OpenApiParameter, OpenApiTypes, OpenApiResponse
 
 
 from bugsink.utils import assert_
 from bugsink.api_pagination import AscDescCursorPagination
 from bugsink.api_mixins import AtomicRequestMixin
+from issues.models import issue_lookup_kwargs
 
 from .models import Event
 from .serializers import EventListSerializer, EventDetailSerializer
@@ -26,12 +27,6 @@ class EventPagination(AscDescCursorPagination):
 
 
 class EventViewSet(AtomicRequestMixin, viewsets.ReadOnlyModelViewSet):
-    """
-    LIST requires: ?issue=<uuid>
-    Optional: ?order=asc|desc   (default: desc)
-    LIST omits `data`, ordered by digest_order
-    RETRIEVE includes `data` (pure PK lookup; no filters/order applied)
-    """
     queryset = Event.objects.all()  # router requirement for basename inference
     serializer_class = EventListSerializer
     pagination_class = EventPagination
@@ -42,16 +37,19 @@ class EventViewSet(AtomicRequestMixin, viewsets.ReadOnlyModelViewSet):
         if "issue" not in query_params:
             raise ValidationError({"issue": ["This field is required."]})
 
-        return queryset.filter(issue=query_params["issue"])
+        lookup_kwargs = {"issue__" + k: v for k, v in issue_lookup_kwargs(query_params["issue"]).items()}
+        return queryset.filter(issue__is_deleted=False, **lookup_kwargs)
 
     @extend_schema(
+        summary="List events",
+        description="List events for an issue. The list response omits the full event `data` payload.",
         parameters=[
             OpenApiParameter(
                 name="issue",
-                type=OpenApiTypes.UUID,
+                type=OpenApiTypes.STR,
                 location=OpenApiParameter.QUERY,
                 required=True,
-                description="Filter events by issue UUID (required).",
+                description="Filter events by issue UUID or friendly ID (required).",
             ),
             OpenApiParameter(
                 name="order",
@@ -66,6 +64,17 @@ class EventViewSet(AtomicRequestMixin, viewsets.ReadOnlyModelViewSet):
     def list(self, request, *args, **kwargs):
         return super().list(request, *args, **kwargs)
 
+    @extend_schema(
+        summary="Retrieve an event",
+        description=(
+            "Retrieve an event by internal Bugsink event UUID. "
+            "The detail response includes the full `data` payload."
+        ),
+        responses=EventDetailSerializer,
+    )
+    def retrieve(self, request, *args, **kwargs):
+        return super().retrieve(request, *args, **kwargs)
+
     def get_object(self):
         """
         DRF's get_object(), but we intentionally bypass filter_queryset for detail routes to keep PK lookups
@@ -94,8 +103,21 @@ class EventViewSet(AtomicRequestMixin, viewsets.ReadOnlyModelViewSet):
         return EventDetailSerializer if self.action == "retrieve" else EventListSerializer
 
     @extend_schema(
+        summary="Render an event stacktrace",
         description="Render the event's stacktrace (frames, source, locals) as Markdown-like text.",
-        responses={200: OpenApiResponse(response=str, description="Stacktrace as Markdown")},
+        responses={
+            200: OpenApiResponse(
+                response=str,
+                description="Stacktrace as Markdown",
+                examples=[
+                    OpenApiExample(
+                        "Stacktrace",
+                        value="Traceback (most rece...",
+                        response_only=True,
+                    ),
+                ],
+            )
+        },
     )
     @action(
         detail=True,

{bugsink-2.2.0 → bugsink-2.2.1}/files/views.py

@@ -238,6 +238,7 @@ def artifact_bundle_assemble(request, organization_slug):
     chunk_checksums = data["chunks"]
     projects, error = get_artifact_bundle_projects(data)
     if error is not None:
+        logger.warning("Rejected artifact bundle: project slug is missing or does not match an existing project.")
         return JsonResponse({"error": error}, status=400)
 
     # sentry-cli >= 3.x calls this endpoint before uploading chunks (to learn which ones are missing), then uploads

bugsink-2.2.1/issues/api_views.py

@@ -0,0 +1,296 @@
+from django.shortcuts import get_object_or_404
+from rest_framework import mixins, status, viewsets
+from rest_framework.decorators import action
+from rest_framework.pagination import CursorPagination
+from rest_framework.exceptions import ValidationError
+from rest_framework.response import Response
+from drf_spectacular.utils import extend_schema, OpenApiParameter, OpenApiTypes
+
+from bugsink.api_mixins import AtomicRequestMixin
+from bugsink.utils import assert_
+
+from .models import Issue, IssueStateManager, TurningPoint, apply_issue_action, issue_lookup_kwargs
+from .serializers import (
+    IssueCommentSerializer,
+    IssueMuteForSerializer,
+    IssueMuteUntilSerializer,
+    IssueSerializer,
+)
+
+
+class IssuesCursorPagination(CursorPagination):
+    """
+    Cursor paginator for /issues supporting ?sort=… and ?order=asc|desc.
+
+    Sort modes are named after the *primary* column:
+      - sort=digest_order → unique per project → no tie-breakers needed
+      - sort=last_seen    → timestamp          → tie-breaker on id
+
+    Direction applies to primary *and beyond* (i.e. all fields in the list).
+    The view MUST filter by project; ordering is handled here.
+    """
+    # Cursor pagination requires an indexed, mostly-stable ordering. Stable mode: sort=digest_order (default). We
+    # require ?project=<uuid> and have a composite (project_id, digest_order) index, so ORDER BY digest_order after
+    # filtering by project is fast and cursor-stable.
+
+    # We also offer a "recent" mode: sort=last_seen. This is not stable, as new events can come in mid-cursor, and
+    # reshuffle things causing misses or duplicates. However, this is the desired UX for a "recent activity" view.
+    # i.e. the typical usage would in fact just be to get the "first page" of recent activity.
+    page_size = 250
+    default_direction = "asc"
+    default_sort = "digest_order"
+
+    VALID_SORTS = ("digest_order", "last_seen")
+    VALID_ORDERS = ("asc", "desc")
+
+    def get_ordering(self, request, queryset, view):
+        sort = request.query_params.get("sort", self.default_sort)
+        if sort not in self.VALID_SORTS:
+            raise ValidationError({"sort": ["Must be 'digest_order' or 'last_seen'."]})
+
+        order = request.query_params.get("order", self.default_direction)
+        if order not in self.VALID_ORDERS:
+            raise ValidationError({"order": ["Must be 'asc' or 'desc'."]})
+
+        desc = (order == "desc")
+
+        if sort == "digest_order":
+            # Unique per project; stable cursor once filtered by project.
+            return ["-digest_order" if desc else "digest_order"]
+
+        # sort == "last_seen": timestamp needs a deterministic tie-breaker.
+        if desc:
+            return ["-last_seen", "-id"]
+        return ["last_seen", "id"]
+
+
+class IssueViewSet(AtomicRequestMixin, viewsets.ReadOnlyModelViewSet):
+    queryset = Issue.objects.filter(is_deleted=False).select_related("project")  # hide soft-deleted; router basename
+    serializer_class = IssueSerializer
+    pagination_class = IssuesCursorPagination
+    http_method_names = ["get", "post", "delete", "head", "options"]
+
+    def get_queryset(self):
+        return self.queryset
+
+    @extend_schema(
+        summary="List issues",
+        description="List issues for a project.",
+        parameters=[
+            OpenApiParameter(
+                name="project",
+                type=OpenApiTypes.INT,
+                location=OpenApiParameter.QUERY,
+                required=True,
+                description="Filter issues by project id (required).",
+            ),
+            OpenApiParameter(
+                name="sort",
+                type=OpenApiTypes.STR,
+                location=OpenApiParameter.QUERY,
+                required=False,
+                enum=["digest_order", "last_seen"],
+                description="Sort mode (default: digest_order).",
+            ),
+            OpenApiParameter(
+                name="order",
+                type=OpenApiTypes.STR,
+                location=OpenApiParameter.QUERY,
+                required=False,
+                enum=["asc", "desc"],
+                description="Sort order (default: asc).",
+            ),
+        ]
+    )
+    def list(self, request, *args, **kwargs):
+        return super().list(request, *args, **kwargs)
+
+    @extend_schema(
+        summary="Retrieve an issue",
+        description="Retrieve an issue by issue UUID or friendly ID.",
+        responses=IssueSerializer,
+    )
+    def retrieve(self, request, *args, **kwargs):
+        return super().retrieve(request, *args, **kwargs)
+
+    @extend_schema(
+        summary="Delete an issue",
+        description="Delete an issue.",
+    )
+    def destroy(self, request, *args, **kwargs):
+        issue = self.get_object()
+        issue.delete_deferred()
+        return Response(status=status.HTTP_204_NO_CONTENT)
+
+    def filter_queryset(self, queryset):
+        queryset = super().filter_queryset(queryset)
+        if self.action != "list":
+            return queryset
+
+        project = self.request.query_params.get("project")
+        if not project:
+            # the below at least until we have a UI for cross-project Issue listing, i.e. #190
+            raise ValidationError({"project": ["This field is required."]})
+
+        return queryset.filter(project=project)
+
+    def get_object(self):
+        """
+        DRF's get_object(), but bypass filter_queryset for detail.
+        """
+        # NOTE: alternatively, we just complain hard when a filter is applied to a detail view.
+        # TODO: copy/paste from events/api_views.py
+        queryset = self.get_queryset()
+
+        lookup_url_kwarg = self.lookup_url_kwarg or self.lookup_field
+        assert_(
+            lookup_url_kwarg in self.kwargs,
+            'Expected view %s to be called with a URL keyword argument named "%s".'
+            % (self.__class__.__name__, lookup_url_kwarg)
+        )
+
+        obj = get_object_or_404(queryset, **issue_lookup_kwargs(self.kwargs[lookup_url_kwarg]))
+        self.check_object_permissions(self.request, obj)
+        return obj
+
+    def _action_response(self, issue):
+        issue.save()
+        return Response(self.get_serializer(issue).data)
+
+    def _assert_unresolved(self, issue):
+        if issue.is_resolved:
+            raise ValidationError({"detail": "Issue is already resolved."})
+
+    def _assert_unmuted(self, issue):
+        if issue.is_muted:
+            raise ValidationError({"detail": "Issue is already muted."})
+
+    def _apply_issue_action(self, issue, action):
+        # Bearer-token API auth currently represents a global token, not a user.
+        apply_issue_action(IssueStateManager, issue, action, user=None)
+        return self._action_response(issue)
+
+    @extend_schema(
+        summary="Resolve an issue",
+        description="Mark this issue as resolved.",
+        request=OpenApiTypes.NONE,
+        responses=IssueSerializer,
+    )
+    @action(detail=True, methods=["post"])
+    def resolve(self, request, pk=None):
+        issue = self.get_object()
+        self._assert_unresolved(issue)
+        return self._apply_issue_action(issue, "resolve")
+
+    @extend_schema(
+        summary="Resolve an issue in the next release",
+        description="Mark this issue as resolved by the next release.",
+        request=OpenApiTypes.NONE,
+        responses=IssueSerializer,
+    )
+    @action(detail=True, methods=["post"], url_path="resolve-next")
+    def resolve_next(self, request, pk=None):
+        issue = self.get_object()
+        self._assert_unresolved(issue)
+        return self._apply_issue_action(issue, "resolved_next")
+
+    @extend_schema(
+        summary="Resolve an issue in the latest release",
+        description="Mark this issue as resolved in the latest release.",
+        request=OpenApiTypes.NONE,
+        responses=IssueSerializer,
+    )
+    @action(detail=True, methods=["post"], url_path="resolve-latest")
+    def resolve_latest(self, request, pk=None):
+        issue = self.get_object()
+        self._assert_unresolved(issue)
+        if not issue.project.has_releases:
+            raise ValidationError({"detail": "Project has no releases."})
+
+        latest_release = issue.project.get_latest_release()
+        if latest_release.version + "\n" in issue.events_at:
+            raise ValidationError({"detail": "Issue has already occurred in the latest release."})
+
+        return self._apply_issue_action(issue, "resolved_release:" + latest_release.version)
+
+    @extend_schema(
+        summary="Mute an issue",
+        description="Mute this issue.",
+        request=OpenApiTypes.NONE,
+        responses=IssueSerializer,
+    )
+    @action(detail=True, methods=["post"])
+    def mute(self, request, pk=None):
+        issue = self.get_object()
+        self._assert_unresolved(issue)
+        self._assert_unmuted(issue)
+        return self._apply_issue_action(issue, "mute")
+
+    @extend_schema(
+        summary="Mute an issue for a period",
+        description="Mute this issue for a relative period, e.g. for 3 days.",
+        request=IssueMuteForSerializer,
+        responses=IssueSerializer,
+    )
+    @action(detail=True, methods=["post"], url_path="mute-for")
+    def mute_for(self, request, pk=None):
+        serializer = IssueMuteForSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        period_name = serializer.validated_data["period_name"]
+        nr_of_periods = serializer.validated_data["nr_of_periods"]
+
+        issue = self.get_object()
+        self._assert_unresolved(issue)
+        self._assert_unmuted(issue)
+        return self._apply_issue_action(issue, f"mute_for:{period_name},{nr_of_periods},")
+
+    @extend_schema(
+        summary="Mute an issue until a threshold is reached",
+        description="Mute this issue until a threshold is reached, e.g. more than 10 events in 1 hour.",
+        request=IssueMuteUntilSerializer,
+        responses=IssueSerializer,
+    )
+    @action(detail=True, methods=["post"], url_path="mute-until")
+    def mute_until(self, request, pk=None):
+        serializer = IssueMuteUntilSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        period_name = serializer.validated_data["period_name"]
+        nr_of_periods = serializer.validated_data["nr_of_periods"]
+        gte_threshold = serializer.validated_data["gte_threshold"]
+
+        issue = self.get_object()
+        self._assert_unresolved(issue)
+        self._assert_unmuted(issue)
+        return self._apply_issue_action(issue, f"mute_until:{period_name},{nr_of_periods},{gte_threshold}")
+
+    @extend_schema(
+        summary="Unmute an issue",
+        description="Unmute this issue.",
+        request=OpenApiTypes.NONE,
+        responses=IssueSerializer,
+    )
+    @action(detail=True, methods=["post"])
+    def unmute(self, request, pk=None):
+        issue = self.get_object()
+        self._assert_unresolved(issue)
+        if not issue.is_muted:
+            raise ValidationError({"detail": "Issue is not muted."})
+
+        return self._apply_issue_action(issue, "unmute")
+
+    # NOTE: No 'unresolve' action: reopen is intentionally not exposed in the UI either. See apply_issue_action.
+
+
+class IssueCommentViewSet(AtomicRequestMixin, mixins.CreateModelMixin, viewsets.GenericViewSet):
+    queryset = TurningPoint.objects.none()  # router basename only
+    serializer_class = IssueCommentSerializer
+    http_method_names = ["post", "head", "options"]
+
+    @extend_schema(
+        summary="Create an issue comment",
+        description="Add a comment to an issue. `issue` accepts an issue UUID or friendly ID.",
+        request=IssueCommentSerializer,
+        responses=IssueCommentSerializer,
+    )
+    def create(self, request, *args, **kwargs):
+        return super().create(request, *args, **kwargs)