Ryan Kegel
fd70eca0c9
All checks were successful
Gitea Actions Demo / build-and-push (push) Successful in 23s
- Implemented logic to hide delete button for system tasks and rewards in ItemList.vue, TaskView.vue, and RewardView.vue. - Added backend checks in task_api.py and reward_api.py to return 403 for delete requests on system items. - Ensured that items without a user_id are treated as system items across frontend and backend. - Updated acceptance criteria to include UI and backend tests for the new functionality.
2.1 KiB
2.1 KiB
Feature: Do Not Allow System Tasks or System Rewards To Be Deleted
Context:
- Goal: In Task List view and Reward List view, do not allow items to be deleted by the user if they are system tasks.
- User Story: As a [user], I want to only be able to press the delete button on a task or reward if that item is not a system task or reward so that shared system tasks are not deleted for other users.
Technical Requirements
- File Affected: ItemList.vue, TaskView.vue, RewardView.vue, task_api.py, reward_api.py
- Logic:
- Starting with ItemList.vue, we should check to see if any item in the list has an "user_id" property and if that property is null.
- If the property is null, that means the item is not owned by a user, so do no display a delete button.
- If the ItemList has it's deletable property as false, don't bother checking each item for user_id as the delete button will not display.
- As a safeguard, on the backend, the DELETE api requests should check to see if the "user_id" property of the requested task or reward is null. This is done by requesting the item from the database. The request provides the item's id. If the item is a system item, return 403. Let the return tell the requestor that the item is a system item and cannot be deleted.
- As a safeguard, make PUT/PATCH operations perform a copy-on-edit of the item. This is already implemented.
- Bulk deletion is not possible, don't make changes for this.
- For any item in the frontend or backend that does not have a "user_id" property, treat that as a system item (user_id=null)
- For both task and reward api create an application level constraint on the database that checks for user_id before mutation logic.
Acceptance Criteria (The "Definition of Done")
- Logic: Task or Reward does not display the delete button when props.deletable is true and a list item is a system item.
- UI: Doesn't show delete button for system items.
- Backend Tests: Unit tests cover a delete API request for a system task or reward and returns a 403.
- Frontend Tests: Add vitest for this feature in the frontend to make sure the delete button hidden or shown.