diff --git a/test/api/v3/integration/tasks/challenges/DELETE-tasks_id_challenge_challengeId.test.js b/test/api/v3/integration/tasks/challenges/DELETE-tasks_id_challenge_challengeId.test.js index 9ec2a65f8e..52f257be9b 100644 --- a/test/api/v3/integration/tasks/challenges/DELETE-tasks_id_challenge_challengeId.test.js +++ b/test/api/v3/integration/tasks/challenges/DELETE-tasks_id_challenge_challengeId.test.js @@ -2,6 +2,7 @@ import { generateUser, generateGroup, generateChallenge, + sleep, translate as t, } from '../../../../../helpers/api-integration/v3'; import { v4 as generateUUID } from 'uuid'; @@ -52,4 +53,62 @@ describe('DELETE /tasks/:id', () => { message: t('taskNotFound'), }); }); + + context('challenge member', () => { + let anotherUser; + let anotherUsersNewChallengeTaskID; + let newChallengeTask; + + beforeEach(async () => { + anotherUser = await generateUser(); + await user.post(`/groups/${guild._id}/invite`, { uuids: [anotherUser._id] }); + await anotherUser.post(`/groups/${guild._id}/join`); + await anotherUser.post(`/challenges/${challenge._id}/join`); + + newChallengeTask = await user.post(`/tasks/challenge/${challenge._id}`, { + text: 'test habit', + type: 'habit', + }); + + let anotherUserWithNewChallengeTask = await anotherUser.get('/user'); + anotherUsersNewChallengeTaskID = anotherUserWithNewChallengeTask.tasksOrder.habits[0]; + }); + + it('returns error when user attempts to delete an active challenge task', async () => { + await expect(anotherUser.del(`/tasks/${anotherUsersNewChallengeTaskID}`)) + .to.eventually.be.rejected.and.eql({ + code: 401, + error: 'NotAuthorized', + message: t('cantDeleteChallengeTasks'), + }); + }); + + it('allows user to delete challenge task after user leaves challenge', async () => { + await anotherUser.post(`/challenges/${challenge._id}/leave`); + + await expect(anotherUser.del(`/tasks/${anotherUsersNewChallengeTaskID}`)); + + await expect(anotherUser.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({ + code: 404, + error: 'NotFound', + message: t('taskNotFound'), + }); + }); + + it('allows user to delete challenge task after challenge task is broken', async () => { + await expect(user.del(`/tasks/${newChallengeTask._id}`)); + + await sleep(0.5); + + await expect(anotherUser.del(`/tasks/${anotherUsersNewChallengeTaskID}`)); + + await sleep(0.5); + + await expect(anotherUser.get(`/tasks/${anotherUsersNewChallengeTaskID}`)).to.eventually.be.rejected.and.eql({ + code: 404, + error: 'NotFound', + message: t('taskNotFound'), + }); + }); + }); }); diff --git a/website/src/controllers/api-v3/tasks.js b/website/src/controllers/api-v3/tasks.js index 952076ab82..bafdadaeb4 100644 --- a/website/src/controllers/api-v3/tasks.js +++ b/website/src/controllers/api-v3/tasks.js @@ -914,7 +914,7 @@ api.deleteTask = { if (challenge.leader !== user._id) throw new NotAuthorized(res.t('onlyChalLeaderEditTasks')); } else if (task.userId !== user._id) { // If the task is owned by an user make it's the current one throw new NotFound(res.t('taskNotFound')); - } else if (task.userId && task.challenge.id) { + } else if (task.userId && task.challenge.id && !task.challenge.broken) { throw new NotAuthorized(res.t('cantDeleteChallengeTasks')); }