fix(backend): harden write registrar boundaries

backend/internal/logic/tasks/service_test.go

@@ -2,6 +2,7 @@ package tasks
 
 import (
 	"fmt"
+	"sync"
 	"testing"
 
 	"github.com/glebarez/sqlite"
@@ -10,6 +11,30 @@ import (
 	"senlinai-agent/backend/internal/models"
 )
 
+func TestUpdateLocksTaskBeforeProjectValidation(t *testing.T) {
+	database, owner, project, task := newTaskLockFixture(t)
+	queries := captureTaskQueryOrder(t, database)
+
+	_, err := NewService(database).Update(owner.ID, project.Identity, task.Identity, UpdateTaskInput{Title: task.Title})
+
+	require.NoError(t, err)
+	require.NotEmpty(t, *queries)
+	require.Equal(t, "task:locked-in-tx", (*queries)[0])
+}
+
+func TestShareObjectLocksTaskBeforeObjectValidation(t *testing.T) {
+	database, _, project, task := newTaskLockFixture(t)
+	note := models.SenlinAgentNote{ProjectID: project.ID, CreatedBy: task.CreatedBy, Title: "Context", Markdown: "Private"}
+	require.NoError(t, database.Create(&note).Error)
+	queries := captureTaskQueryOrder(t, database)
+
+	err := NewService(database).ShareObject(task.ID, "note", note.ID)
+
+	require.NoError(t, err)
+	require.NotEmpty(t, *queries)
+	require.Equal(t, "task:locked-in-tx", (*queries)[0])
+}
+
 func TestAssigneeOnlySeesExplicitlySharedObjects(t *testing.T) {
 	database := newTestDB(t)
 	assigneeID := uint(2)
@@ -28,7 +53,7 @@ func TestAssigneeOnlySeesExplicitlySharedObjects(t *testing.T) {
 	require.NoError(t, err)
 	require.Len(t, after, 1)
 	require.Equal(t, "note", after[0].ObjectType)
-	require.Equal(t, note.ID, after[0].ObjectID)
+	require.Equal(t, note.Identity, after[0].ObjectID)
 }
 
 func TestShareObjectRejectsUnsupportedType(t *testing.T) {
@@ -53,16 +78,32 @@ func TestShareObjectRejectsObjectFromAnotherProject(t *testing.T) {
 	require.ErrorContains(t, err, "shared object not found in task project")
 }
 
-func TestAssignRecordsProjectEvent(t *testing.T) {
+func TestAssignResolvesIdentityAndTaskDTOReflectsReassignment(t *testing.T) {
 	database := newTestDB(t)
-	task := models.SenlinAgentTask{ProjectID: 7, CreatedBy: 1, Title: "安排评审"}
+	owner := models.SenlinAgentUser{Email: "owner@example.com", DisplayName: "Owner", PasswordHash: "hash"}
+	first := models.SenlinAgentUser{Email: "first@example.com", DisplayName: "First", PasswordHash: "hash"}
+	second := models.SenlinAgentUser{Email: "second@example.com", DisplayName: "Second", PasswordHash: "hash"}
+	require.NoError(t, database.Create(&owner).Error)
+	require.NoError(t, database.Create(&first).Error)
+	require.NoError(t, database.Create(&second).Error)
+	project := models.SenlinAgentProject{OwnerID: owner.ID, Name: "Alpha", Identifier: "ALPHA"}
+	require.NoError(t, database.Create(&project).Error)
+	task := models.SenlinAgentTask{ProjectID: project.ID, CreatedBy: owner.ID, Title: "安排评审", Status: "open"}
 	require.NoError(t, database.Create(&task).Error)
-	service := NewService()
+	service := NewService(database)
 
-	require.NoError(t, service.Assign(task.ID, 2))
+	require.NoError(t, service.Assign(task.ID, first.Identity))
+	assigned, err := service.Update(owner.ID, project.Identity, task.Identity, UpdateTaskInput{Title: task.Title})
+	require.NoError(t, err)
+	require.Equal(t, first.Identity, *assigned.AssigneeID)
+
+	require.NoError(t, service.Assign(task.ID, second.Identity))
+	reassigned, err := service.Update(owner.ID, project.Identity, task.Identity, UpdateTaskInput{Title: task.Title})
+	require.NoError(t, err)
+	require.Equal(t, second.Identity, *reassigned.AssigneeID)
 
 	var event models.SenlinAgentProjectEvent
-	require.NoError(t, database.Where("project_id = ? AND entity_type = ? AND entity_id = ?", 7, "task", task.ID).First(&event).Error)
+	require.NoError(t, database.Where("project_id = ? AND entity_type = ? AND entity_id = ?", project.ID, "task", task.ID).Order("id desc").First(&event).Error)
 	require.Equal(t, "task_assigned", event.EventType)
 }
 
@@ -74,3 +115,45 @@ func newTestDB(t *testing.T) *gorm.DB {
 	models.DBService = database
 	return database
 }
+
+func newTaskLockFixture(t *testing.T) (*gorm.DB, models.SenlinAgentUser, models.SenlinAgentProject, models.SenlinAgentTask) {
+	t.Helper()
+	database := newTestDB(t)
+	owner := models.SenlinAgentUser{Email: "lock-owner@example.com", DisplayName: "Owner", PasswordHash: "hash"}
+	require.NoError(t, database.Create(&owner).Error)
+	project := models.SenlinAgentProject{OwnerID: owner.ID, Name: "Lock", Identifier: "LOCK"}
+	require.NoError(t, database.Create(&project).Error)
+	task := models.SenlinAgentTask{ProjectID: project.ID, CreatedBy: owner.ID, Title: "Lock me", Status: "open"}
+	require.NoError(t, database.Create(&task).Error)
+	return database, owner, project, task
+}
+
+func captureTaskQueryOrder(t *testing.T, database *gorm.DB) *[]string {
+	t.Helper()
+	var mutex sync.Mutex
+	queries := make([]string, 0, 4)
+	callbackName := "test:capture_task_lock_" + t.Name()
+	require.NoError(t, database.Callback().Query().Before("gorm:query").Register(callbackName, func(tx *gorm.DB) {
+		table := tx.Statement.Table
+		if tx.Statement.Schema != nil {
+			table = tx.Statement.Schema.Table
+		}
+		if table != (models.SenlinAgentTask{}).TableName() && table != (models.SenlinAgentProject{}).TableName() {
+			return
+		}
+		entry := "project"
+		if table == (models.SenlinAgentTask{}).TableName() {
+			entry = "task"
+			if _, ok := tx.Statement.Clauses["FOR"]; ok {
+				entry += ":locked"
+				if _, ok := tx.Statement.ConnPool.(gorm.TxCommitter); ok {
+					entry += "-in-tx"
+				}
+			}
+		}
+		mutex.Lock()
+		queries = append(queries, entry)
+		mutex.Unlock()
+	}))
+	return &queries
+}