fix: reject blank task content (#18)

Co-authored-by: Delega Bot <hello@delega.dev>

Author: ryanmcmillan

backend/schemas.py

@@ -20,6 +20,16 @@ def _normalize_recurring_type(v: Optional[str]) -> Optional[str]:
     return _RECURRING_TYPE_ALIASES.get(v, v)
 
 
+def _reject_blank_text(v: Optional[str], field_name: str) -> Optional[str]:
+    if v is None:
+        return v
+    if not isinstance(v, str):
+        return v
+    if not v.strip():
+        raise ValueError(f"{field_name} must not be blank")
+    return v
+
+
 # ============ Project Schemas ============
 
 class ProjectBase(BaseModel):
@@ -112,6 +122,11 @@ class TaskBase(BaseModel):
     reminder_time: Optional[datetime] = None
     context: Optional[dict] = None  # Persistent context blob for agent state
 
+    @field_validator("content")
+    @classmethod
+    def validate_content(cls, v):
+        return _reject_blank_text(v, "content")
+
 
 class TaskCreate(TaskBase):
     assigned_to_agent_id: Optional[int] = None  # Assign to agent at creation
@@ -141,6 +156,11 @@ class TaskUpdate(BaseModel):
     assigned_to_agent_id: Optional[int] = None  # Assign/reassign to agent
     context: Optional[dict] = None  # Update context blob
 
+    @field_validator("content")
+    @classmethod
+    def validate_content(cls, v):
+        return _reject_blank_text(v, "content")
+
     @field_validator("recurring_type", mode="before")
     @classmethod
     def normalize_recurring(cls, v):

backend/tests/test_permissions.py

@@ -535,3 +535,29 @@ def test_post_complete_and_uncomplete_keep_status_in_sync(self, fresh_db, client
         assert task.status == "open"
         assert task.completed_by_agent_id is None
         db.close()
+
+
+class TestTaskContentValidation:
+    """Task content must contain non-whitespace text."""
+
+    @pytest.mark.parametrize("content", ["", "   ", "\n\t"])
+    def test_create_task_rejects_blank_content(self, fresh_db, client, content):
+        _, agent_key = make_agent(fresh_db, "worker")
+
+        response = client.post("/api/tasks", json={"content": content}, headers=auth(agent_key))
+
+        assert response.status_code == 422
+        assert "content" in response.text.lower()
+
+    @pytest.mark.parametrize("content", ["", "   ", "\n\t"])
+    def test_update_task_rejects_blank_content(self, fresh_db, client, content):
+        _, agent_key = make_agent(fresh_db, "worker")
+
+        created = client.post("/api/tasks", json={"content": "valid"}, headers=auth(agent_key))
+        assert created.status_code == 200
+        task_id = created.json()["id"]
+
+        response = client.put(f"/api/tasks/{task_id}", json={"content": content}, headers=auth(agent_key))
+
+        assert response.status_code == 422
+        assert "content" in response.text.lower()