feat: Implement user validation and ownership checks for image, reward, and task APIs

- Added `get_validated_user_id` utility function to validate user authentication across multiple APIs.
- Updated image upload, request, and listing endpoints to ensure user ownership and proper error handling.
- Enhanced reward management endpoints to include user validation and ownership checks.
- Modified task management endpoints to enforce user authentication and ownership verification.
- Updated models to include `user_id` for images, rewards, tasks, and children to track ownership.
- Implemented frontend changes to ensure UI reflects the ownership of tasks and rewards.
- Added a new feature specification to prevent deletion of system tasks and rewards.

backend/api/task_api.py

@@ -1,7 +1,7 @@
 from flask import Blueprint, request, jsonify
 from tinydb import Query
 
-from api.utils import send_event_for_current_user
+from api.utils import send_event_for_current_user, get_validated_user_id
 from backend.events.types.child_tasks_set import ChildTasksSet
 from db.db import task_db, child_db
 from events.types.event import Event
@@ -14,6 +14,9 @@ task_api = Blueprint('task_api', __name__)
 # Task endpoints
 @task_api.route('/task/add', methods=['PUT'])
 def add_task():
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     data = request.get_json()
     name = data.get('name')
     points = data.get('points')
@@ -21,7 +24,7 @@ def add_task():
     image = data.get('image_id', '')
     if not name or points is None or is_good is None:
         return jsonify({'error': 'Name, points, and is_good are required'}), 400
-    task = Task(name=name, points=points, is_good=is_good, image_id=image)
+    task = Task(name=name, points=points, is_good=is_good, image_id=image, user_id=user_id)
     task_db.insert(task.to_dict())
     send_event_for_current_user(Event(EventType.TASK_MODIFIED.value,
                                         TaskModified(task.id, TaskModified.OPERATION_ADD)))
@@ -29,28 +32,45 @@ def add_task():
 
 @task_api.route('/task/<id>', methods=['GET'])
 def get_task(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     TaskQuery = Query()
-    result = task_db.search(TaskQuery.id == id)
+    result = task_db.search((TaskQuery.id == id) & ((TaskQuery.user_id == user_id) | (TaskQuery.user_id == None)))
     if not result:
         return jsonify({'error': 'Task not found'}), 404
     return jsonify(result[0]), 200
 
 @task_api.route('/task/list', methods=['GET'])
 def list_tasks():
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     ids_param = request.args.get('ids')
-    tasks = task_db.all()
+    TaskQuery = Query()
+    tasks = task_db.search((TaskQuery.user_id == user_id) | (TaskQuery.user_id == None))
     if ids_param is not None:
         if ids_param.strip() == '':
             tasks = []
         else:
             ids = set(ids_param.split(','))
             tasks = [task for task in tasks if task.get('id') in ids]
-    return jsonify({'tasks': tasks}), 200
+
+    user_tasks = {t['name'].strip().lower(): t for t in tasks if t.get('user_id') == user_id}
+    filtered_tasks = []
+    for t in tasks:
+        if t.get('user_id') is None and t['name'].strip().lower() in user_tasks:
+            continue  # Skip default if user version exists
+        filtered_tasks.append(t)
+    return jsonify({'tasks': filtered_tasks}), 200
 
 @task_api.route('/task/<id>', methods=['DELETE'])
 def delete_task(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     TaskQuery = Query()
-    removed = task_db.remove(TaskQuery.id == id)
+    removed = task_db.remove((TaskQuery.id == id) & ((TaskQuery.user_id == user_id) | (TaskQuery.user_id == None)))
     if removed:
         # remove the task id from any child's task list
         ChildQuery = Query()
@@ -66,11 +86,17 @@ def delete_task(id):
 
 @task_api.route('/task/<id>/edit', methods=['PUT'])
 def edit_task(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     TaskQuery = Query()
-    existing = task_db.get(TaskQuery.id == id)
+    existing = task_db.get((TaskQuery.id == id) & ((TaskQuery.user_id == user_id) | (TaskQuery.user_id == None)))
     if not existing:
         return jsonify({'error': 'Task not found'}), 404
 
+    task = Task.from_dict(existing)
+    is_dirty = False
+
     data = request.get_json(force=True) or {}
     updates = {}
 
@@ -78,7 +104,8 @@ def edit_task(id):
         name = data.get('name', '').strip()
         if not name:
             return jsonify({'error': 'Name cannot be empty'}), 400
-        updates['name'] = name
+        task.name = name
+        is_dirty = True
 
     if 'points' in data:
         points = data.get('points')
@@ -86,22 +113,32 @@ def edit_task(id):
             return jsonify({'error': 'Points must be an integer'}), 400
         if points <= 0:
             return jsonify({'error': 'Points must be a positive integer'}), 400
-        updates['points'] = points
+        task.points = points
+        is_dirty = True
 
     if 'is_good' in data:
         is_good = data.get('is_good')
         if not isinstance(is_good, bool):
             return jsonify({'error': 'is_good must be a boolean'}), 400
-        updates['is_good'] = is_good
+        task.is_good = is_good
+        is_dirty = True
 
     if 'image_id' in data:
-        updates['image_id'] = data.get('image_id', '')
+        task.image_id = data.get('image_id', '')
+        is_dirty = True
 
-    if not updates:
+    if not is_dirty:
         return jsonify({'error': 'No valid fields to update'}), 400
+    
+    if task.user_id is None: # public task
+        new_task = Task(name=task.name, points=task.points, is_good=task.is_good, image_id=task.image_id, user_id=user_id)
+        task_db.insert(new_task.to_dict())
+        send_event_for_current_user(Event(EventType.TASK_MODIFIED.value,
+                                        TaskModified(new_task.id, TaskModified.OPERATION_ADD)))
 
-    task_db.update(updates, TaskQuery.id == id)
-    updated = task_db.get(TaskQuery.id == id)
+        return jsonify(new_task.to_dict()), 200
+
+    task_db.update(task.to_dict(), (TaskQuery.id == id) & ((TaskQuery.user_id == user_id) | (TaskQuery.user_id == None)))
     send_event_for_current_user(Event(EventType.TASK_MODIFIED.value,
                                         TaskModified(id, TaskModified.OPERATION_EDIT)))
-    return jsonify(updated), 200
+    return jsonify(task.to_dict()), 200