feat(api): align task delete authorization with role/assignee rules and update integration tests

Author: Diogo-Ferraz

src/TaskManagement.Api/Features/TaskItems/Commands/Handlers/DeleteTaskItemCommandHandler.cs

@@ -45,13 +45,13 @@ public async Task Handle(DeleteTaskItemCommand request, CancellationToken cancel
 
             var isAdmin = _currentUserService.IsInRole(Roles.Administrator);
             var isProjectManager = _currentUserService.IsInRole(Roles.ProjectManager);
+            var isAssignee = taskItem.AssignedUserId == currentUserId;
             var isProjectMember = await _dbContext.ProjectMembers
                 .AnyAsync(pm => pm.ProjectId == taskItem.ProjectId && pm.UserId == currentUserId, cancellationToken);
             bool isProjectOwner = taskItem.Project.OwnerUserId == currentUserId;
             var canDeleteAsProjectManager = isProjectManager && (isProjectOwner || isProjectMember);
 
-            // Keep user deletes stricter: owner-only unless elevated role.
-            if (!isAdmin && !canDeleteAsProjectManager && !isProjectOwner)
+            if (!isAdmin && !canDeleteAsProjectManager && !isProjectOwner && !isAssignee)
             {
                 throw new ForbiddenAccessException("User is not authorized to delete this task item.");
             }

tests/TaskManagement.Api.Tests/IntegrationTests/Features/TaskItems/DeleteTaskItemEndpointTests.cs

@@ -169,7 +169,7 @@ public async Task DeleteTaskItem_WhenUserIsAdministrator_ShouldReturnNoContentAn
         }
 
         [Fact]
-        public async Task DeleteTaskItem_WhenUserIsAssigneeButNotOwner_ShouldReturnForbidden()
+        public async Task DeleteTaskItem_WhenUserIsAssigneeButNotOwner_ShouldReturnNoContentAndDeleteTask()
         {
             // Arrange
             SetAuthenticatedUser(_taskAssigneeId);
@@ -184,15 +184,15 @@ public async Task DeleteTaskItem_WhenUserIsAssigneeButNotOwner_ShouldReturnForbi
             var response = await _client.DeleteAsync($"/api/taskitems/{_taskToDeleteId}");
 
             // Assert Response
-            response.StatusCode.Should().Be(HttpStatusCode.Forbidden);
+            response.StatusCode.Should().Be(HttpStatusCode.NoContent);
 
             // Assert Database State
             using (var scope = _factory.Services.CreateScope())
             {
                 var dbContext = scope.ServiceProvider.GetRequiredService<TaskManagementDbContext>();
                 var taskInDb = await dbContext.TaskItems.FindAsync(_taskToDeleteId);
-                taskInDb.Should().NotBeNull();
-                (await dbContext.TaskItems.Where(t => t.ProjectId == _projectId).CountAsync()).Should().Be(initialTaskCount);
+                taskInDb.Should().BeNull();
+                (await dbContext.TaskItems.Where(t => t.ProjectId == _projectId).CountAsync()).Should().Be(initialTaskCount - 1);
             }
         }