OUT-4029 | Add tests for workspace-scoped task deletion

- Unit: softDeleteAllSubtasks and deleteAllAssigneeTasks delete by id/assignee
  scoped to workspaceId and never touch Labels rows
- Integration: two workspaces sharing a label string; deleting one workspace's
  tree soft-deletes only its own subtree and leaves the other untouched
- seedTask: optional label so integration tests can seed colliding labels

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: SandipBajracharya

src/app/api/tasks/subtasks.service.integration.test.ts

@@ -0,0 +1,53 @@
+import { buildLtree } from '@/utils/ltree'
+import User from '@api/core/models/User.model'
+import { SubtaskService } from '@api/tasks/subtasks.service'
+
+import { disconnectTestDb, getTestDb, seedTask, truncateAll, uuid } from '../../../../test/integration/db'
+
+// Real DB; Copilot is doubled only so the service constructs without a live SDK client.
+jest.mock('@/utils/CopilotAPI', () => ({
+  CopilotAPI: jest.fn().mockImplementation(() => ({})),
+}))
+
+const makeUser = (workspaceId: string) => new User('token', { internalUserId: uuid(), workspaceId } as never)
+
+// seedTask doesn't set the ltree path; mirror the app's addPathToTask here.
+const setPath = async (id: string, ...pathIds: string[]) => {
+  const path = buildLtree(...pathIds)
+  await getTestDb().$executeRaw`UPDATE "Tasks" SET path = ${path}::ltree WHERE id::text = ${id}`
+}
+
+describe('SubtaskService.softDeleteAllSubtasks (integration)', () => {
+  beforeEach(truncateAll)
+  afterAll(disconnectTestDb)
+
+  // Reproduces OUT-4029: colliding label strings across workspaces must not cause cross-workspace deletes.
+  it('deletes only the acting workspace subtree when a descendant shares a label string with another workspace', async () => {
+    const workspaceA = 'ws-a'
+    const workspaceB = 'ws-b'
+    const sharedLabel = 'THE10-001'
+
+    // Root is soft-deleted before softDeleteAllSubtasks runs (as in the real call sites), so
+    // the query returns only live descendants — the collision is on childA.
+    const rootA = await seedTask({ workspaceId: workspaceA, label: 'THE10-000', deletedAt: new Date() })
+    const childA = await seedTask({ workspaceId: workspaceA, parentId: rootA, label: sharedLabel })
+    await setPath(rootA, rootA)
+    await setPath(childA, rootA, childA)
+
+    // Different workspace, different id, but the SAME label string as descendant childA.
+    const taskB = await seedTask({ workspaceId: workspaceB, label: sharedLabel })
+    await setPath(taskB, taskB)
+
+    await new SubtaskService(makeUser(workspaceA)).softDeleteAllSubtasks(rootA)
+
+    const db = getTestDb()
+    const [ca, b] = await Promise.all([
+      db.task.findUnique({ where: { id: childA }, select: { deletedAt: true } }),
+      db.task.findUnique({ where: { id: taskB }, select: { deletedAt: true } }),
+    ])
+
+    expect(ca?.deletedAt).not.toBeNull()
+    // The colliding-label task in the other workspace must survive.
+    expect(b?.deletedAt).toBeNull()
+  })
+})

src/app/api/tasks/subtasks.service.test.ts

@@ -0,0 +1,49 @@
+const mockQueryRawUnsafe = jest.fn()
+const mockTaskDeleteMany = jest.fn()
+const mockLabelDeleteMany = jest.fn()
+
+jest.mock('@/lib/db', () => ({
+  __esModule: true,
+  default: {
+    getInstance: () => ({
+      $queryRawUnsafe: mockQueryRawUnsafe,
+      task: { deleteMany: mockTaskDeleteMany },
+      label: { deleteMany: mockLabelDeleteMany },
+    }),
+  },
+}))
+
+jest.mock('@/utils/CopilotAPI', () => ({ CopilotAPI: jest.fn() }))
+
+import { SubtaskService } from '@api/tasks/subtasks.service'
+import User from '@api/core/models/User.model'
+import { UserRole } from '@api/core/types/user'
+
+const user = {
+  workspaceId: 'ws-1',
+  role: UserRole.IU,
+  internalUserId: 'iu-1',
+  token: 'token',
+} as unknown as User
+
+describe('SubtaskService#softDeleteAllSubtasks', () => {
+  beforeEach(() => jest.clearAllMocks())
+
+  it('deletes descendant tasks by id scoped to the workspace', async () => {
+    mockQueryRawUnsafe.mockResolvedValue([{ id: 'task-a' }, { id: 'task-b' }])
+
+    await new SubtaskService(user).softDeleteAllSubtasks('parent-id')
+
+    expect(mockTaskDeleteMany).toHaveBeenCalledWith({
+      where: { id: { in: ['task-a', 'task-b'] }, workspaceId: 'ws-1' },
+    })
+  })
+
+  it('never deletes Labels registry rows', async () => {
+    mockQueryRawUnsafe.mockResolvedValue([{ id: 'task-a' }])
+
+    await new SubtaskService(user).softDeleteAllSubtasks('parent-id')
+
+    expect(mockLabelDeleteMany).not.toHaveBeenCalled()
+  })
+})

src/app/api/tasks/tasks.service.deleteAllAssigneeTasks.test.ts

@@ -0,0 +1,54 @@
+const mockTaskFindMany = jest.fn()
+const mockTaskDeleteMany = jest.fn()
+const mockLabelDeleteMany = jest.fn()
+
+jest.mock('@/lib/db', () => ({
+  __esModule: true,
+  default: {
+    getInstance: () => ({
+      task: { findMany: mockTaskFindMany, deleteMany: mockTaskDeleteMany },
+      label: { deleteMany: mockLabelDeleteMany },
+    }),
+  },
+}))
+
+jest.mock('@/utils/CopilotAPI', () => ({
+  __esModule: true,
+  CopilotAPI: jest.fn().mockImplementation(() => ({})),
+}))
+
+import User from '@api/core/models/User.model'
+import { TasksService } from '@api/tasks/tasks.service'
+import { AssigneeType } from '@prisma/client'
+
+const makeUser = () =>
+  new User('token', {
+    internalUserId: 'iu-1',
+    workspaceId: 'ws-1',
+  } as never)
+
+describe('TasksService.deleteAllAssigneeTasks', () => {
+  beforeEach(() => {
+    mockTaskFindMany.mockReset()
+    mockTaskDeleteMany.mockReset()
+    mockLabelDeleteMany.mockReset()
+  })
+
+  it('deletes the assignee tasks scoped to the workspace', async () => {
+    mockTaskFindMany.mockResolvedValue([{ id: 'task-a', label: 'THE10-001' }])
+
+    await new TasksService(makeUser()).deleteAllAssigneeTasks('assignee-1', AssigneeType.client)
+
+    expect(mockTaskDeleteMany).toHaveBeenCalledWith({
+      where: { assigneeId: 'assignee-1', assigneeType: AssigneeType.client, workspaceId: 'ws-1' },
+    })
+  })
+
+  it('never deletes Labels registry rows', async () => {
+    mockTaskFindMany.mockResolvedValue([{ id: 'task-a', label: 'THE10-001' }])
+
+    await new TasksService(makeUser()).deleteAllAssigneeTasks('assignee-1', AssigneeType.client)
+
+    expect(mockLabelDeleteMany).not.toHaveBeenCalled()
+  })
+})

test/integration/db.ts

@@ -75,6 +75,7 @@ export type SeedTaskInput = {
   parentId?: string | null
   title?: string
   createdById?: string
+  label?: string
 }
 
 // The Tasks table has an `assignee_to_user_id_mapping` CHECK that ties assigneeType to which
@@ -101,7 +102,7 @@ export const seedTask = async (input: SeedTaskInput): Promise<string> => {
   await getTestDb().task.create({
     data: {
       id,
-      label: `T-${id.slice(0, 8)}`,
+      label: input.label ?? `T-${id.slice(0, 8)}`,
       title: input.title ?? 'Reminder task',
       workspaceId: input.workspaceId,
       createdById: input.createdById ?? uuid(),