chore/.github/specs/archive/no-delete-system-tasks-and-rewards.md

Feature: Do Not Allow System Tasks or System Rewards To Be Deleted

Context:

• Goal: In Task List view and Reward List view, do not allow items to be deleted by the user if they are system tasks.
• User Story: As a [user], I want to only be able to press the delete button on a task or reward if that item is not a system task or reward so that shared system tasks are not deleted for other users.

Technical Requirements

• File Affected: ItemList.vue, TaskView.vue, RewardView.vue, task_api.py, reward_api.py
• Logic:
  1. Starting with ItemList.vue, we should check to see if any item in the list has an "user_id" property and if that property is null.
  2. If the property is null, that means the item is not owned by a user, so do no display a delete button.
  3. If the ItemList has it's deletable property as false, don't bother checking each item for user_id as the delete button will not display.
  4. As a safeguard, on the backend, the DELETE api requests should check to see if the "user_id" property of the requested task or reward is null. This is done by requesting the item from the database. The request provides the item's id. If the item is a system item, return 403. Let the return tell the requestor that the item is a system item and cannot be deleted.
  5. As a safeguard, make PUT/PATCH operations perform a copy-on-edit of the item. This is already implemented.
  6. Bulk deletion is not possible, don't make changes for this.
  7. For any item in the frontend or backend that does not have a "user_id" property, treat that as a system item (user_id=null)
  8. For both task and reward api create an application level constraint on the database that checks for user_id before mutation logic.

Acceptance Criteria (The "Definition of Done")

• Logic: Task or Reward does not display the delete button when props.deletable is true and a list item is a system item.
• UI: Doesn't show delete button for system items.
• Backend Tests: Unit tests cover a delete API request for a system task or reward and returns a 403.
• Frontend Tests: Add vitest for this feature in the frontend to make sure the delete button hidden or shown.