Refactor project permissions checks to use team membership; enhance project deletion to remove associated tasks and categories

Author: batdimoiprint

Controllers/CategoryController.cs

@@ -34,16 +34,15 @@ public CategoryController(MongoDbService mongoDbService)
             return string.IsNullOrWhiteSpace(userId) ? null : userId;
         }
 
-        private bool HasProjectEditPermission(string projectId, string userId)
+        private bool IsProjectTeamMember(string projectId, string userId)
         {
             if (string.IsNullOrWhiteSpace(projectId) || string.IsNullOrWhiteSpace(userId)) return false;
             var db = _mongoDbService.GetDatabase();
             var projects = db.GetCollection<FlowModels.Project>("project");
             var proj = projects.Find(p => p.Id == projectId).FirstOrDefault();
             if (proj == null) return false;
-            if (proj.Permissions == null) return false;
-            if (!proj.Permissions.TryGetValue(userId, out var role)) return false;
-            return role == "Owner" || role == "Editor" || User.IsInRole("Admin");
+            if (proj.TeamMembers == null) return false;
+            return proj.TeamMembers.Contains(userId);
         }
 
         // GET /api/categories?projectId=<id>&includeTasks=true
@@ -115,7 +114,7 @@ public IActionResult Create([FromBody] FlowModels.Category category)
 
             var requesterId = GetUserIdFromToken();
             if (requesterId == null) return Unauthorized(new { message = "Invalid user token." });
-            if (!HasProjectEditPermission(category.ProjectId!, requesterId)) return Forbid("You do not have permission to create a category for this project.");
+            if (!IsProjectTeamMember(category.ProjectId!, requesterId)) return StatusCode(403, new { message = "You must be a team member of the project to create a category." });
 
             var db = _mongoDbService.GetDatabase();
             var categoriesCollection = db.GetCollection<FlowModels.Category>("categories");
@@ -139,7 +138,7 @@ public IActionResult Update(string id, [FromBody] FlowModels.Category updated)
 
             var requesterId = GetUserIdFromToken();
             if (requesterId == null) return Unauthorized(new { message = "Invalid user token." });
-            if (!HasProjectEditPermission(existing.ProjectId!, requesterId)) return Forbid("You do not have permission to update this category.");
+            if (!IsProjectTeamMember(existing.ProjectId!, requesterId)) return StatusCode(403, new { message = "You must be a team member of the project to update a category." });
 
             // Update fields
             if (!string.IsNullOrWhiteSpace(updated.CategoryName))
@@ -170,6 +169,15 @@ public IActionResult Delete(string id)
             // Deletion allowed if user has project edit permission
             // if (!HasProjectEditPermission(existing.ProjectId!, requesterId)) return Forbid("You do not have permission to delete this category.");
 
+            // Remove category reference from all subtasks in this project
+            var subTasksCollection = db.GetCollection<FlowModels.SubTask>("subtasks");
+            var updateDefinition = Builders<FlowModels.SubTask>.Update
+                .Set(t => t.Category, null);
+            subTasksCollection.UpdateMany(
+                t => t.ProjectId == existing.ProjectId && t.Category == existing.CategoryName,
+                updateDefinition
+            );
+
             categoriesCollection.DeleteOne(c => c.Id == id);
             return Ok(new { message = "Category deleted successfully.", id = id });
         }

Controllers/ProjectsController.cs

@@ -245,8 +245,20 @@ public IActionResult RemoveMember(string id, [FromBody] RemoveMemberDto dto)
                         if (result.MatchedCount == 0)
                             return NotFound(new { message = "Project not found." });
 
+                        // Remove the member from all subtasks in this project
+                        var subTasksCollection = db.GetCollection<FlowModels.SubTask>("subtasks");
+                        var subTaskFilter = Builders<FlowModels.SubTask>.Filter.And(
+                            Builders<FlowModels.SubTask>.Filter.Eq(st => st.ProjectId, id),
+                            Builders<FlowModels.SubTask>.Filter.AnyEq(st => st.AssignedTo, memberId)
+                        );
+                        var subTaskUpdate = Builders<FlowModels.SubTask>.Update.Pull(st => st.AssignedTo, memberId);
+                        var subTasksUpdateResult = subTasksCollection.UpdateMany(subTaskFilter, subTaskUpdate);
+
                         var updatedProject = collection.Find(p => p.Id == id).FirstOrDefault();
-                        return Ok(updatedProject);
+                        return Ok(new { 
+                            project = updatedProject, 
+                            tasksUpdated = subTasksUpdateResult.ModifiedCount 
+                        });
                     }
                     catch (Exception ex)
                     {
@@ -456,6 +468,14 @@ public IActionResult GetMembers(string id)
             var usersCollection = db.GetCollection<FlowModels.User>("user");
             var memberIds = project.TeamMembers ?? new List<string>();
 
+            // Filter out members who have "Client" role in permissions
+            if (project.Permissions != null)
+            {
+                memberIds = memberIds.Where(memberId => 
+                    !project.Permissions.TryGetValue(memberId, out var role) || role != "Client"
+                ).ToList();
+            }
+            
             if (memberIds.Count == 0)
                 return Ok(new List<object>());
 
@@ -613,8 +633,28 @@ public IActionResult Delete(string id)
             if (!isOwner && !User.IsInRole("Admin"))
                 return StatusCode(403, new { message = "Only the project owner or an admin can delete this project." });
 
+            // Delete all subtasks associated with this project
+            var subTasksCollection = db.GetCollection<FlowModels.SubTask>("subtasks");
+            var subTasksDeleteResult = subTasksCollection.DeleteMany(st => st.ProjectId == id);
+
+            // Delete all main tasks associated with this project
+            var mainTasksCollection = db.GetCollection<FlowModels.MainTask>("maintasks");
+            var mainTasksDeleteResult = mainTasksCollection.DeleteMany(mt => mt.ProjectId == id);
+
+            // Delete all categories associated with this project
+            var categoriesCollection = db.GetCollection<FlowModels.Category>("categories");
+            var categoriesDeleteResult = categoriesCollection.DeleteMany(c => c.ProjectId == id);
+
+            // Delete the project itself
             collection.DeleteOne(p => p.Id == id);
-            return Ok(new { message = "Project deleted successfully.", id = id });
+            
+            return Ok(new { 
+                message = "Project and all associated data deleted successfully.", 
+                id = id,
+                deletedSubTasks = subTasksDeleteResult.DeletedCount,
+                deletedMainTasks = mainTasksDeleteResult.DeletedCount,
+                deletedCategories = categoriesDeleteResult.DeletedCount
+            });
         }
 
         // 🔹 PATCH /api/projects/{id}/permissions