10db2c9d1f
- Task Soft Delete:
- Add is_deleted, deleted_at, deleted_by fields to Task model
- Convert DELETE to soft delete with cascade to subtasks
- Add include_deleted query param (admin only)
- Add POST /api/tasks/{id}/restore endpoint
- Exclude deleted tasks from subtask_count
- Permission Change Audit:
- Add user.role_change event (high sensitivity)
- Add user.admin_change event (critical, triggers alert)
- Add PATCH /api/users/{id}/admin endpoint
- Add role.permission_change event type
- Append-Only Enforcement:
- Add DB triggers for audit_logs immutability (manual for production)
- Migration 008 with graceful trigger failure handling
- Tests: 11 new soft delete tests (153 total passing)
- OpenSpec: fix-audit-trail archived, fix-realtime-notifications & fix-weekly-report proposals added
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
628 lines
18 KiB
Python
628 lines
18 KiB
Python
import uuid
|
|
from datetime import datetime
|
|
from typing import List, Optional
|
|
from fastapi import APIRouter, Depends, HTTPException, status, Query, Request
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app.core.database import get_db
|
|
from app.models import User, Project, Task, TaskStatus, AuditAction
|
|
from app.schemas.task import (
|
|
TaskCreate, TaskUpdate, TaskResponse, TaskWithDetails, TaskListResponse,
|
|
TaskStatusUpdate, TaskAssignUpdate
|
|
)
|
|
from app.middleware.auth import (
|
|
get_current_user, check_project_access, check_task_access, check_task_edit_access
|
|
)
|
|
from app.middleware.audit import get_audit_metadata
|
|
from app.services.audit_service import AuditService
|
|
from app.services.trigger_service import TriggerService
|
|
|
|
router = APIRouter(tags=["tasks"])
|
|
|
|
# Maximum subtask depth
|
|
MAX_SUBTASK_DEPTH = 2
|
|
|
|
|
|
def get_task_depth(db: Session, task: Task) -> int:
|
|
"""Calculate the depth of a task in the hierarchy."""
|
|
depth = 1
|
|
current = task
|
|
while current.parent_task_id:
|
|
depth += 1
|
|
current = db.query(Task).filter(Task.id == current.parent_task_id).first()
|
|
if not current:
|
|
break
|
|
return depth
|
|
|
|
|
|
def task_to_response(task: Task) -> TaskWithDetails:
|
|
"""Convert a Task model to TaskWithDetails response."""
|
|
# Count only non-deleted subtasks
|
|
subtask_count = 0
|
|
if task.subtasks:
|
|
subtask_count = sum(1 for st in task.subtasks if not st.is_deleted)
|
|
|
|
return TaskWithDetails(
|
|
id=task.id,
|
|
project_id=task.project_id,
|
|
parent_task_id=task.parent_task_id,
|
|
title=task.title,
|
|
description=task.description,
|
|
priority=task.priority,
|
|
original_estimate=task.original_estimate,
|
|
time_spent=task.time_spent,
|
|
due_date=task.due_date,
|
|
assignee_id=task.assignee_id,
|
|
status_id=task.status_id,
|
|
blocker_flag=task.blocker_flag,
|
|
position=task.position,
|
|
created_by=task.created_by,
|
|
created_at=task.created_at,
|
|
updated_at=task.updated_at,
|
|
assignee_name=task.assignee.name if task.assignee else None,
|
|
status_name=task.status.name if task.status else None,
|
|
status_color=task.status.color if task.status else None,
|
|
creator_name=task.creator.name if task.creator else None,
|
|
subtask_count=subtask_count,
|
|
)
|
|
|
|
|
|
@router.get("/api/projects/{project_id}/tasks", response_model=TaskListResponse)
|
|
async def list_tasks(
|
|
project_id: str,
|
|
parent_task_id: Optional[str] = Query(None, description="Filter by parent task"),
|
|
status_id: Optional[str] = Query(None, description="Filter by status"),
|
|
assignee_id: Optional[str] = Query(None, description="Filter by assignee"),
|
|
include_deleted: bool = Query(False, description="Include deleted tasks (admin only)"),
|
|
db: Session = Depends(get_db),
|
|
current_user: User = Depends(get_current_user),
|
|
):
|
|
"""
|
|
List all tasks in a project.
|
|
"""
|
|
project = db.query(Project).filter(Project.id == project_id).first()
|
|
|
|
if not project:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail="Project not found",
|
|
)
|
|
|
|
if not check_project_access(current_user, project):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Access denied",
|
|
)
|
|
|
|
query = db.query(Task).filter(Task.project_id == project_id)
|
|
|
|
# Filter deleted tasks (only admin can include deleted)
|
|
if include_deleted and current_user.is_system_admin:
|
|
pass # Don't filter by is_deleted
|
|
else:
|
|
query = query.filter(Task.is_deleted == False)
|
|
|
|
# Apply filters
|
|
if parent_task_id is not None:
|
|
if parent_task_id == "":
|
|
# Root tasks only
|
|
query = query.filter(Task.parent_task_id == None)
|
|
else:
|
|
query = query.filter(Task.parent_task_id == parent_task_id)
|
|
else:
|
|
# By default, show only root tasks
|
|
query = query.filter(Task.parent_task_id == None)
|
|
|
|
if status_id:
|
|
query = query.filter(Task.status_id == status_id)
|
|
|
|
if assignee_id:
|
|
query = query.filter(Task.assignee_id == assignee_id)
|
|
|
|
tasks = query.order_by(Task.position, Task.created_at).all()
|
|
|
|
return TaskListResponse(
|
|
tasks=[task_to_response(t) for t in tasks],
|
|
total=len(tasks),
|
|
)
|
|
|
|
|
|
@router.post("/api/projects/{project_id}/tasks", response_model=TaskResponse, status_code=status.HTTP_201_CREATED)
|
|
async def create_task(
|
|
project_id: str,
|
|
task_data: TaskCreate,
|
|
request: Request,
|
|
db: Session = Depends(get_db),
|
|
current_user: User = Depends(get_current_user),
|
|
):
|
|
"""
|
|
Create a new task in a project.
|
|
"""
|
|
project = db.query(Project).filter(Project.id == project_id).first()
|
|
|
|
if not project:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail="Project not found",
|
|
)
|
|
|
|
if not check_project_access(current_user, project):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Access denied",
|
|
)
|
|
|
|
# Validate parent task and check depth
|
|
if task_data.parent_task_id:
|
|
parent_task = db.query(Task).filter(
|
|
Task.id == task_data.parent_task_id,
|
|
Task.project_id == project_id
|
|
).first()
|
|
|
|
if not parent_task:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="Parent task not found in this project",
|
|
)
|
|
|
|
# Check depth limit
|
|
parent_depth = get_task_depth(db, parent_task)
|
|
if parent_depth >= MAX_SUBTASK_DEPTH:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail=f"Maximum subtask depth ({MAX_SUBTASK_DEPTH}) exceeded",
|
|
)
|
|
|
|
# Validate status_id belongs to this project
|
|
if task_data.status_id:
|
|
status_obj = db.query(TaskStatus).filter(
|
|
TaskStatus.id == task_data.status_id,
|
|
TaskStatus.project_id == project_id
|
|
).first()
|
|
|
|
if not status_obj:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="Status not found in this project",
|
|
)
|
|
else:
|
|
# Use first status (To Do) as default
|
|
default_status = db.query(TaskStatus).filter(
|
|
TaskStatus.project_id == project_id
|
|
).order_by(TaskStatus.position).first()
|
|
task_data.status_id = default_status.id if default_status else None
|
|
|
|
# Get max position
|
|
max_pos_result = db.query(Task).filter(
|
|
Task.project_id == project_id,
|
|
Task.parent_task_id == task_data.parent_task_id
|
|
).order_by(Task.position.desc()).first()
|
|
next_position = (max_pos_result.position + 1) if max_pos_result else 0
|
|
|
|
task = Task(
|
|
id=str(uuid.uuid4()),
|
|
project_id=project_id,
|
|
parent_task_id=task_data.parent_task_id,
|
|
title=task_data.title,
|
|
description=task_data.description,
|
|
priority=task_data.priority.value if task_data.priority else "medium",
|
|
original_estimate=task_data.original_estimate,
|
|
due_date=task_data.due_date,
|
|
assignee_id=task_data.assignee_id,
|
|
status_id=task_data.status_id,
|
|
position=next_position,
|
|
created_by=current_user.id,
|
|
)
|
|
|
|
db.add(task)
|
|
|
|
# Audit log
|
|
AuditService.log_event(
|
|
db=db,
|
|
event_type="task.create",
|
|
resource_type="task",
|
|
action=AuditAction.CREATE,
|
|
user_id=current_user.id,
|
|
resource_id=task.id,
|
|
changes=[{"field": "title", "old_value": None, "new_value": task.title}],
|
|
request_metadata=get_audit_metadata(request),
|
|
)
|
|
|
|
db.commit()
|
|
db.refresh(task)
|
|
|
|
return task
|
|
|
|
|
|
@router.get("/api/tasks/{task_id}", response_model=TaskWithDetails)
|
|
async def get_task(
|
|
task_id: str,
|
|
db: Session = Depends(get_db),
|
|
current_user: User = Depends(get_current_user),
|
|
):
|
|
"""
|
|
Get a task by ID.
|
|
"""
|
|
task = db.query(Task).filter(Task.id == task_id).first()
|
|
|
|
if not task:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail="Task not found",
|
|
)
|
|
|
|
# Check if task is deleted (only admin can view deleted)
|
|
if task.is_deleted and not current_user.is_system_admin:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail="Task not found",
|
|
)
|
|
|
|
if not check_task_access(current_user, task, task.project):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Access denied",
|
|
)
|
|
|
|
return task_to_response(task)
|
|
|
|
|
|
@router.patch("/api/tasks/{task_id}", response_model=TaskResponse)
|
|
async def update_task(
|
|
task_id: str,
|
|
task_data: TaskUpdate,
|
|
request: Request,
|
|
db: Session = Depends(get_db),
|
|
current_user: User = Depends(get_current_user),
|
|
):
|
|
"""
|
|
Update a task.
|
|
"""
|
|
task = db.query(Task).filter(Task.id == task_id).first()
|
|
|
|
if not task:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail="Task not found",
|
|
)
|
|
|
|
if not check_task_edit_access(current_user, task, task.project):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Permission denied",
|
|
)
|
|
|
|
# Capture old values for audit and triggers
|
|
old_values = {
|
|
"title": task.title,
|
|
"description": task.description,
|
|
"priority": task.priority,
|
|
"due_date": task.due_date,
|
|
"original_estimate": task.original_estimate,
|
|
"time_spent": task.time_spent,
|
|
}
|
|
|
|
# Update fields
|
|
update_data = task_data.model_dump(exclude_unset=True)
|
|
for field, value in update_data.items():
|
|
if field == "priority" and value:
|
|
setattr(task, field, value.value)
|
|
else:
|
|
setattr(task, field, value)
|
|
|
|
# Capture new values for audit and triggers
|
|
new_values = {
|
|
"title": task.title,
|
|
"description": task.description,
|
|
"priority": task.priority,
|
|
"due_date": task.due_date,
|
|
"original_estimate": task.original_estimate,
|
|
"time_spent": task.time_spent,
|
|
}
|
|
|
|
# Detect changes and log
|
|
changes = AuditService.detect_changes(old_values, new_values)
|
|
if changes:
|
|
AuditService.log_event(
|
|
db=db,
|
|
event_type="task.update",
|
|
resource_type="task",
|
|
action=AuditAction.UPDATE,
|
|
user_id=current_user.id,
|
|
resource_id=task.id,
|
|
changes=changes,
|
|
request_metadata=get_audit_metadata(request),
|
|
)
|
|
|
|
# Evaluate triggers for priority changes
|
|
if "priority" in update_data:
|
|
TriggerService.evaluate_triggers(db, task, old_values, new_values, current_user)
|
|
|
|
db.commit()
|
|
db.refresh(task)
|
|
|
|
return task
|
|
|
|
|
|
@router.delete("/api/tasks/{task_id}", response_model=TaskResponse)
|
|
async def delete_task(
|
|
task_id: str,
|
|
request: Request,
|
|
db: Session = Depends(get_db),
|
|
current_user: User = Depends(get_current_user),
|
|
):
|
|
"""
|
|
Soft delete a task (cascades to subtasks).
|
|
"""
|
|
task = db.query(Task).filter(Task.id == task_id).first()
|
|
|
|
if not task:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail="Task not found",
|
|
)
|
|
|
|
if task.is_deleted:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="Task is already deleted",
|
|
)
|
|
|
|
if not check_task_edit_access(current_user, task, task.project):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Permission denied",
|
|
)
|
|
|
|
now = datetime.utcnow()
|
|
|
|
# Soft delete the task
|
|
task.is_deleted = True
|
|
task.deleted_at = now
|
|
task.deleted_by = current_user.id
|
|
|
|
# Cascade soft delete to subtasks
|
|
def soft_delete_subtasks(parent_task):
|
|
for subtask in parent_task.subtasks:
|
|
if not subtask.is_deleted:
|
|
subtask.is_deleted = True
|
|
subtask.deleted_at = now
|
|
subtask.deleted_by = current_user.id
|
|
soft_delete_subtasks(subtask)
|
|
|
|
soft_delete_subtasks(task)
|
|
|
|
# Audit log
|
|
AuditService.log_event(
|
|
db=db,
|
|
event_type="task.delete",
|
|
resource_type="task",
|
|
action=AuditAction.DELETE,
|
|
user_id=current_user.id,
|
|
resource_id=task.id,
|
|
changes=[{"field": "is_deleted", "old_value": False, "new_value": True}],
|
|
request_metadata=get_audit_metadata(request),
|
|
)
|
|
|
|
db.commit()
|
|
db.refresh(task)
|
|
|
|
return task
|
|
|
|
|
|
@router.post("/api/tasks/{task_id}/restore", response_model=TaskResponse)
|
|
async def restore_task(
|
|
task_id: str,
|
|
request: Request,
|
|
db: Session = Depends(get_db),
|
|
current_user: User = Depends(get_current_user),
|
|
):
|
|
"""
|
|
Restore a soft-deleted task (admin only).
|
|
"""
|
|
if not current_user.is_system_admin:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Only system administrators can restore deleted tasks",
|
|
)
|
|
|
|
task = db.query(Task).filter(Task.id == task_id).first()
|
|
|
|
if not task:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail="Task not found",
|
|
)
|
|
|
|
if not task.is_deleted:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="Task is not deleted",
|
|
)
|
|
|
|
# Restore the task
|
|
task.is_deleted = False
|
|
task.deleted_at = None
|
|
task.deleted_by = None
|
|
|
|
# Audit log
|
|
AuditService.log_event(
|
|
db=db,
|
|
event_type="task.restore",
|
|
resource_type="task",
|
|
action=AuditAction.UPDATE,
|
|
user_id=current_user.id,
|
|
resource_id=task.id,
|
|
changes=[{"field": "is_deleted", "old_value": True, "new_value": False}],
|
|
request_metadata=get_audit_metadata(request),
|
|
)
|
|
|
|
db.commit()
|
|
db.refresh(task)
|
|
|
|
return task
|
|
|
|
|
|
@router.patch("/api/tasks/{task_id}/status", response_model=TaskResponse)
|
|
async def update_task_status(
|
|
task_id: str,
|
|
status_data: TaskStatusUpdate,
|
|
db: Session = Depends(get_db),
|
|
current_user: User = Depends(get_current_user),
|
|
):
|
|
"""
|
|
Update task status.
|
|
"""
|
|
task = db.query(Task).filter(Task.id == task_id).first()
|
|
|
|
if not task:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail="Task not found",
|
|
)
|
|
|
|
if not check_task_edit_access(current_user, task, task.project):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Permission denied",
|
|
)
|
|
|
|
# Validate new status belongs to same project
|
|
new_status = db.query(TaskStatus).filter(
|
|
TaskStatus.id == status_data.status_id,
|
|
TaskStatus.project_id == task.project_id
|
|
).first()
|
|
|
|
if not new_status:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="Status not found in this project",
|
|
)
|
|
|
|
# Capture old status for triggers
|
|
old_status_id = task.status_id
|
|
|
|
task.status_id = status_data.status_id
|
|
|
|
# Auto-set blocker_flag based on status name
|
|
if new_status.name.lower() == "blocked":
|
|
task.blocker_flag = True
|
|
else:
|
|
task.blocker_flag = False
|
|
|
|
# Evaluate triggers for status changes
|
|
if old_status_id != status_data.status_id:
|
|
TriggerService.evaluate_triggers(
|
|
db, task,
|
|
{"status_id": old_status_id},
|
|
{"status_id": status_data.status_id},
|
|
current_user
|
|
)
|
|
|
|
db.commit()
|
|
db.refresh(task)
|
|
|
|
return task
|
|
|
|
|
|
@router.patch("/api/tasks/{task_id}/assign", response_model=TaskResponse)
|
|
async def assign_task(
|
|
task_id: str,
|
|
assign_data: TaskAssignUpdate,
|
|
request: Request,
|
|
db: Session = Depends(get_db),
|
|
current_user: User = Depends(get_current_user),
|
|
):
|
|
"""
|
|
Assign or unassign a task.
|
|
"""
|
|
task = db.query(Task).filter(Task.id == task_id).first()
|
|
|
|
if not task:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail="Task not found",
|
|
)
|
|
|
|
if not check_task_edit_access(current_user, task, task.project):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Permission denied",
|
|
)
|
|
|
|
# Validate assignee exists if provided
|
|
if assign_data.assignee_id:
|
|
assignee = db.query(User).filter(User.id == assign_data.assignee_id).first()
|
|
if not assignee:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="Assignee not found",
|
|
)
|
|
|
|
old_assignee_id = task.assignee_id
|
|
task.assignee_id = assign_data.assignee_id
|
|
|
|
# Audit log
|
|
AuditService.log_event(
|
|
db=db,
|
|
event_type="task.assign",
|
|
resource_type="task",
|
|
action=AuditAction.UPDATE,
|
|
user_id=current_user.id,
|
|
resource_id=task.id,
|
|
changes=[{"field": "assignee_id", "old_value": old_assignee_id, "new_value": assign_data.assignee_id}],
|
|
request_metadata=get_audit_metadata(request),
|
|
)
|
|
|
|
# Evaluate triggers for assignee changes
|
|
if old_assignee_id != assign_data.assignee_id:
|
|
TriggerService.evaluate_triggers(
|
|
db, task,
|
|
{"assignee_id": old_assignee_id},
|
|
{"assignee_id": assign_data.assignee_id},
|
|
current_user
|
|
)
|
|
|
|
db.commit()
|
|
db.refresh(task)
|
|
|
|
return task
|
|
|
|
|
|
@router.get("/api/tasks/{task_id}/subtasks", response_model=TaskListResponse)
|
|
async def list_subtasks(
|
|
task_id: str,
|
|
include_deleted: bool = Query(False, description="Include deleted subtasks (admin only)"),
|
|
db: Session = Depends(get_db),
|
|
current_user: User = Depends(get_current_user),
|
|
):
|
|
"""
|
|
List subtasks of a task.
|
|
"""
|
|
task = db.query(Task).filter(Task.id == task_id).first()
|
|
|
|
if not task:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail="Task not found",
|
|
)
|
|
|
|
if not check_task_access(current_user, task, task.project):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Access denied",
|
|
)
|
|
|
|
query = db.query(Task).filter(Task.parent_task_id == task_id)
|
|
|
|
# Filter deleted subtasks (only admin can include deleted)
|
|
if not (include_deleted and current_user.is_system_admin):
|
|
query = query.filter(Task.is_deleted == False)
|
|
|
|
subtasks = query.order_by(Task.position, Task.created_at).all()
|
|
|
|
return TaskListResponse(
|
|
tasks=[task_to_response(t) for t in subtasks],
|
|
total=len(subtasks),
|
|
)
|