feat: Implement logic to prevent deletion of system tasks and rewards; update APIs and tests accordingly
All checks were successful
Gitea Actions Demo / build-and-push (push) Successful in 34s
All checks were successful
Gitea Actions Demo / build-and-push (push) Successful in 34s
This commit is contained in:
@@ -15,12 +15,12 @@
|
||||
4. As a safeguard, on the backend, the DELETE api requests should check to see if the "user_id" property of the requested task or reward is null. This is done by requesting the item from the database. The request provides the item's id. If the item is a system item, return 403. Let the return tell the requestor that the item is a system item and cannot be deleted.
|
||||
5. As a safeguard, make PUT/PATCH operations perform a copy-on-edit of the item. This is already implemented.
|
||||
6. Bulk deletion is not possible, don't make changes for this.
|
||||
7. For any item in the frontend or backend that does not have a "user_id" property, treat that as a system item (user_id=mull)
|
||||
7. For any item in the frontend or backend that does not have a "user_id" property, treat that as a system item (user_id=null)
|
||||
8. For both task and reward api create an application level constraint on the database that checks for user_id before mutation logic.
|
||||
|
||||
## Acceptance Criteria (The "Definition of Done")
|
||||
|
||||
- [ ] Logic: Task or Reward does not display the delete button when props.deletable is true and a list item is a system item.
|
||||
- [ ] UI: Doesn't show delete button for system items.
|
||||
- [ ] Backend Tests: Unit tests cover a delete API request for a system task or reward and returns a 403.
|
||||
- [ ] Frontend Tests: Add vitest for this feature in the frontend to make sure the delete button hidden or shown.
|
||||
- [x] Logic: Task or Reward does not display the delete button when props.deletable is true and a list item is a system item.
|
||||
- [x] UI: Doesn't show delete button for system items.
|
||||
- [x] Backend Tests: Unit tests cover a delete API request for a system task or reward and returns a 403.
|
||||
- [x] Frontend Tests: Add vitest for this feature in the frontend to make sure the delete button hidden or shown.
|
||||
Reference in New Issue
Block a user