feat(activities): let creators lock edit and delete to themselves

Add editPolicy (default creator-only), enforce it in the API, surface clear permission messages, and drop the redundant edit menu now that detail is editable.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/activities/activities.service.ts

@@ -68,6 +68,21 @@ function canForceClose(
   return actor.role === 'owner' || actor.role === 'admin' || actor.userId === createdById;
 }
 
+function canMutateActivity(
+  actor: { userId: string; role: string },
+  row: {
+    createdById?: string | null;
+    editPolicy?: 'creator' | 'assignees' | null;
+    assigneeId?: string | null;
+    assignees?: Array<{ id: string }>;
+  },
+): boolean {
+  if (actor.role === 'owner' || actor.role === 'admin') return true;
+  if (row.createdById && actor.userId === row.createdById) return true;
+  if ((row.editPolicy ?? 'creator') !== 'assignees') return false;
+  return assigneeIdList(row).includes(actor.userId);
+}
+
 function reconcileAllShares(assigneeIds: string[], completedByIds: string[]) {
   const kept = [...new Set(completedByIds.filter((id) => assigneeIds.includes(id)))];
   const done = assigneeIds.length > 0 && assigneeIds.every((id) => kept.includes(id));
@@ -737,6 +752,7 @@ export class ActivitiesService {
           : undefined,
         completionMode: dto.completionMode === 'all' ? 'all' : 'any',
         completedByIds: [],
+        editPolicy: dto.editPolicy === 'assignees' ? 'assignees' : 'creator',
         createdById: userId,
       },
       include,
@@ -813,10 +829,15 @@ export class ActivitiesService {
         participantIds: true,
         completionMode: true,
         completedByIds: true,
+        editPolicy: true,
+        createdById: true,
         assigneeId: true,
         assignees: { select: { id: true } },
       },
     });
+    if (!existing || !canMutateActivity(actor, existing)) {
+      throw new ForbiddenException('شما مجوز ویرایش این فعالیت را ندارید');
+    }
     const data: Prisma.ActivityUncheckedUpdateInput = {};
     if (dto.title !== undefined) data.title = dto.title.trim();
     if ('boardId' in dto) {
@@ -932,6 +953,9 @@ export class ActivitiesService {
     const modeChanged = dto.completionMode === 'any' || dto.completionMode === 'all';
     const nextMode = modeChanged ? dto.completionMode! : (existing?.completionMode ?? 'any');
     if (modeChanged) data.completionMode = nextMode;
+    if (dto.editPolicy === 'creator' || dto.editPolicy === 'assignees') {
+      data.editPolicy = dto.editPolicy;
+    }
     const prevAssigneeIds = assigneeIdList(existing ?? {});
     const nextIds = nextAssigneeIds ?? prevAssigneeIds;
     const explicitDone = dto.status === 'done';
@@ -1105,6 +1129,18 @@ export class ActivitiesService {
     actor: ActivityActor,
   ): Promise<void> {
     await this.ensureExists(organizationId, id, actor);
+    const existing = await this.prisma.activity.findFirst({
+      where: { id, organizationId },
+      select: {
+        createdById: true,
+        editPolicy: true,
+        assigneeId: true,
+        assignees: { select: { id: true } },
+      },
+    });
+    if (!existing || !canMutateActivity(actor, existing)) {
+      throw new ForbiddenException('شما مجوز حذف این فعالیت را ندارید');
+    }
     const images = await this.prisma.activityImage.findMany({
       where: { activityId: id, organizationId },
       select: { storageKey: true, sizeBytes: true },
@@ -1125,6 +1161,18 @@ export class ActivitiesService {
     actor: ActivityActor,
   ): Promise<ActivityImageDto> {
     await this.ensureExists(organizationId, activityId, actor);
+    const gate = await this.prisma.activity.findFirst({
+      where: { id: activityId, organizationId },
+      select: {
+        createdById: true,
+        editPolicy: true,
+        assigneeId: true,
+        assignees: { select: { id: true } },
+      },
+    });
+    if (!gate || !canMutateActivity(actor, gate)) {
+      throw new ForbiddenException('شما مجوز ویرایش این فعالیت را ندارید');
+    }
     if (!file?.buffer?.length) {
       throw new BadRequestException('فایلی ارسال نشده است');
     }
@@ -1219,6 +1267,18 @@ export class ActivitiesService {
     actor: ActivityActor,
   ): Promise<void> {
     await this.ensureExists(organizationId, activityId, actor);
+    const gate = await this.prisma.activity.findFirst({
+      where: { id: activityId, organizationId },
+      select: {
+        createdById: true,
+        editPolicy: true,
+        assigneeId: true,
+        assignees: { select: { id: true } },
+      },
+    });
+    if (!gate || !canMutateActivity(actor, gate)) {
+      throw new ForbiddenException('شما مجوز ویرایش این فعالیت را ندارید');
+    }
     const row = await this.prisma.activityImage.findFirst({
       where: { id: imageId, activityId, organizationId },
     });
@@ -1570,6 +1630,7 @@ export class ActivitiesService {
       completedAt: row.completedAt?.toISOString() ?? null,
       completionMode: row.completionMode ?? 'any',
       completedByIds: row.completedByIds ?? [],
+      editPolicy: row.editPolicy ?? 'creator',
       importSource: row.importSource ?? 'manual',
       promotedFromPriorAt: row.promotedFromPriorAt?.toISOString() ?? null,
       tags: row.tags ?? [],

apps/api/src/activities/dto.ts

@@ -388,6 +388,10 @@ export class CreateActivityDto {
   @IsOptional()
   @IsIn(['any', 'all'])
   completionMode?: 'any' | 'all';
+
+  @IsOptional()
+  @IsIn(['creator', 'assignees'])
+  editPolicy?: 'creator' | 'assignees';
 }
 
 export class UpdateActivityDto {
@@ -492,4 +496,8 @@ export class UpdateActivityDto {
   @IsOptional()
   @IsIn(['any', 'all'])
   completionMode?: 'any' | 'all';
+
+  @IsOptional()
+  @IsIn(['creator', 'assignees'])
+  editPolicy?: 'creator' | 'assignees';
 }