Skip to content

fix: allow assignee and team admins to update tasks - #21

Merged
habiibullahm merged 8 commits into
mainfrom
bugfix/task-status-update-auth
Aug 5, 2026
Merged

habiibullahm merged 8 commits into
mainfrom
bugfix/task-status-update-auth

Conversation

@habiibullahm

Copy link
Copy Markdown
Owner

Summary

  • Widen task update authorization so creator, assignee, or team OWNER/ADMIN can update (enables Kanban for collaborators)
  • Keep delete creator-only
  • Includes Teams/Kanban/comments/realtime from feature/TASK-teams-api-and-ui (not yet on main via staging alone)
  • Integration tests for assignee/admin/member status updates and delete rules

Test plan

  • cd task-api && npm test -- --testPathPatterns=auth-tasks.integration -t "allows assignee and team"
  • Assignee can drag a Kanban card; plain team MEMBER cannot update another’s task
  • Assignee cannot delete; creator can delete

Muhammad Habiibullah and others added 8 commits July 29, 2026 02:27
Implement team CRUD and member management on the API, wire the existing UI client/store, and ship list/create/detail pages so Manage Teams navigates instead of showing a coming-soon toast.

Co-authored-by: Cursor <cursoragent@cursor.com>
Make team invites workable by exposing the account UUID with a Copy button on Settings, and the same control on team detail.

Co-authored-by: Cursor <cursoragent@cursor.com>
Validate team membership and assignees on create/update, support teamId/assignedToId list filters, and expose team/assignee fields plus filters in the task UI.

Co-authored-by: Cursor <cursoragent@cursor.com>
Allow users with task access to list/create comments, restrict edit/delete to authors, and show a comments panel on the task edit page.

Co-authored-by: Cursor <cursoragent@cursor.com>
Ship a status-column Kanban board with drag-and-drop status updates, Socket.IO realtime fan-out for task/comment events, and a notification bell for collaborators.

Co-authored-by: Cursor <cursoragent@cursor.com>
Update root, task-api, and task-web-ui documentation to match implemented endpoints and features, and list remaining polish as deferred.

Co-authored-by: Cursor <cursoragent@cursor.com>
Widen task update auth for Kanban collaboration while keeping delete creator-only.
Keep Socket.IO http server wiring and production mailer boot warning together.
@habiibullahm
habiibullahm marked this pull request as ready for review August 5, 2026 17:23
@habiibullahm
habiibullahm merged commit b1cae39 into main Aug 5, 2026
2 of 3 checks passed
@habiibullahm
habiibullahm deleted the bugfix/task-status-update-auth branch August 5, 2026 17:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant