Issue Summary

• In Defect slide-out using magnifying glass allows the assignment of a Story that belongs to a different Program
• In API, only Stories belonging to the same Program are allowed
• In API, assigning Stories that belongs to a different Program render HTTP 400 error
  This behavior also happens for PI and Team, for example. It seems that if there’s some “Program misalignment”, the whole Defect just can’t be updated/PATCH’d

Steps to Reproduce

1. I’ve got Portfolio A and Portfolio B
2. I’ve got Program A, under Portfolio A and Program B, under Portfolio B
3. I’ve setup Defect A, that belongs to Program A
4. I’ve setup Story B, that belongs to Program B
5. In UI, I can assign Story B to Defect A’s (via slide-out).
6. In UI, I can assign any story from any program/portfolio to Defect A’s (via slide-out).
   1. Browse to Defects grid
   2. Clear up configuration bar (Tier1 filter)
   3. Find Defect A. Open its slide-out details
   4. Click the magnifying glass. A modal of Stories will display.
   5. Notice several stories are displayed, not only the ones belonging to Defect A's Program
   6. Select any Story. The modal will close out.
   7. Click Save/Save and Close
7. In API, the same operation render a HTTP 400 Cannot update defect with id XX. Value for story is invalid.
8. In API, assigning any other story belonging to Program A works just fine. Stories from any other Program results in the error above.

Expected Results

• Any existing Story in the system is allowed if selected via magnifying glass 
• Follow the logic of UI 

(confirmed with PdM)

Actual Results

• Only Stories assigned to the same Program should be allowed to be assigned

Workaround

• On step 6.2, if you set Tier1 to the Defect's Program, then the modal works as the type-in field