feat: restrict member removal to admins and reassign tasks

todo/constants/messages.py

@@ -54,6 +54,8 @@ class ApiErrors:
     USER_NOT_FOUND_GENERIC = "User not found."
     SEARCH_QUERY_EMPTY = "Search query cannot be empty"
     TASK_ALREADY_IN_WATCHLIST = "Task is already in the watchlist"
+    CANNOT_REMOVE_OWNER = "Owner cannot be removed from the team"
+    CANNOT_REMOVE_POC = "POC cannot be removed from a team. Reassign the POC first."
 
 
 # Validation error messages

todo/exceptions/team_exceptions.py

@@ -0,0 +1,22 @@
+from todo.constants.messages import ApiErrors
+
+
+class BaseTeamException(Exception):
+    def __init__(self, message: str):
+        self.message = message
+        super().__init__(self.message)
+
+
+class CannotRemoveOwnerException(BaseTeamException):
+    def __init__(self, message=ApiErrors.CANNOT_REMOVE_OWNER):
+        super().__init__(message)
+
+
+class NotTeamAdminException(BaseTeamException):
+    def __init__(self, message=ApiErrors.UNAUTHORIZED_TITLE):
+        super().__init__(message)
+
+
+class CannotRemoveTeamPOCException(BaseTeamException):
+    def __init__(self, message=ApiErrors.CANNOT_REMOVE_POC):
+        super().__init__(message)

todo/migrations/0003_postgresauditlog_task_count.py

@@ -0,0 +1,17 @@
+# Generated by Django 5.1.5 on 2025-09-02 15:07
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("todo", "0002_rename_postgres_ta_assignee_95ca3b_idx_postgres_ta_assigne_f1c6e7_idx_and_more"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="postgresauditlog",
+            name="task_count",
+            field=models.IntegerField(blank=True, null=True),
+        ),
+    ]

todo/migrations/0004_alter_postgresuserrole_unique_together.py

@@ -0,0 +1,16 @@
+# Generated by Django 5.1.5 on 2025-09-05 15:27
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("todo", "0003_postgresauditlog_task_count"),
+    ]
+
+    operations = [
+        migrations.AlterUniqueTogether(
+            name="postgresuserrole",
+            unique_together={("user_id", "role_name", "scope", "team_id", "is_active")},
+        ),
+    ]

todo/migrations/0005_alter_postgresuserrole_unique_together_and_more.py

@@ -0,0 +1,24 @@
+# Generated by Django 5.1.5 on 2025-09-09 14:49
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("todo", "0004_alter_postgresuserrole_unique_together"),
+    ]
+
+    operations = [
+        migrations.AlterUniqueTogether(
+            name="postgresuserrole",
+            unique_together=set(),
+        ),
+        migrations.AddConstraint(
+            model_name="postgresuserrole",
+            constraint=models.UniqueConstraint(
+                condition=models.Q(("is_active", True)),
+                fields=("user_id", "role_name", "scope", "team_id"),
+                name="unique_active_user_team_role",
+            ),
+        ),
+    ]

todo/models/audit_log.py

@@ -23,3 +23,5 @@ class AuditLogModel(Document):
     assignee_to: PyObjectId | None = None
     # For general user reference (who performed the action)
     performed_by: PyObjectId | None = None
+    # For multiple task reassignments
+    task_count: int | None = None

todo/models/postgres/audit_log.py

@@ -17,6 +17,7 @@ class PostgresAuditLog(models.Model):
     assignee_from = models.CharField(max_length=24, null=True, blank=True)
     assignee_to = models.CharField(max_length=24, null=True, blank=True)
     performed_by = models.CharField(max_length=24, null=True, blank=True)
+    task_count = models.IntegerField(null=True, blank=True)
 
     last_sync_at = models.DateTimeField(auto_now=True)
     sync_status = models.CharField(

todo/models/postgres/user_role.py

@@ -27,7 +27,13 @@ class PostgresUserRole(models.Model):
 
     class Meta:
         db_table = "postgres_user_roles"
-        unique_together = ["user_id", "role_name", "scope", "team_id"]
+        constraints = [
+            models.UniqueConstraint(
+                fields=["user_id", "role_name", "scope", "team_id"],
+                condition=models.Q(is_active=True),
+                name="unique_active_user_team_role",
+            )
+        ]
         indexes = [
             models.Index(fields=["mongo_id"]),
             models.Index(fields=["user_id"]),

todo/repositories/audit_log_repository.py

@@ -29,6 +29,7 @@ def create(cls, audit_log: AuditLogModel) -> AuditLogModel:
             "assignee_from": str(audit_log.assignee_from) if audit_log.assignee_from else None,
             "assignee_to": str(audit_log.assignee_to) if audit_log.assignee_to else None,
             "performed_by": str(audit_log.performed_by) if audit_log.performed_by else None,
+            "task_count": int(audit_log.task_count) if audit_log.task_count else None,
         }
 
         dual_write_success = dual_write_service.create_document(

todo/repositories/task_assignment_repository.py

@@ -6,6 +6,7 @@
 from todo.models.task_assignment import TaskAssignmentModel
 from todo.repositories.common.mongo_repository import MongoRepository
 from todo.models.common.pyobjectid import PyObjectId
+from todo.constants.task import TaskStatus
 from todo.services.enhanced_dual_write_service import EnhancedDualWriteService
 
 
@@ -355,3 +356,163 @@ def deactivate_by_task_id(cls, task_id: str, user_id: str) -> bool:
             return result.modified_count > 0
         except Exception:
             return False
+
+    @classmethod
+    def reassign_tasks_from_user_to_team(cls, user_id: str, team_id: str, performed_by_user_id: str):
+        """
+        Reassign all tasks of user to team
+        """
+        client = cls.get_client()
+        collection = cls.get_collection()
+
+        with client.start_session() as session:
+            try:
+                with session.start_transaction():
+                    now = datetime.now(timezone.utc)
+                    pipeline = [
+                        {
+                            "$match": {
+                                "team_id": {"$in": [team_id, ObjectId(team_id)]},
+                                "assignee_id": {"$in": [user_id, ObjectId(user_id)]},
+                                "user_type": "user",
+                                "is_active": True,
+                            }
+                        },
+                        {
+                            "$addFields": {
+                                "task_id_obj": {
+                                    "$convert": {
+                                        "input": "$task_id",
+                                        "to": "objectId",
+                                        "onError": "$task_id",
+                                        "onNull": None,
+                                    }
+                                }
+                            }
+                        },
+                        {
+                            "$lookup": {
+                                "from": "tasks",
+                                "localField": "task_id_obj",
+                                "foreignField": "_id",
+                                "as": "task_info",
+                            }
+                        },
+                        {"$unwind": "$task_info"},
+                        {"$match": {"task_info.status": {"$ne": TaskStatus.DONE.value}}},
+                    ]
+                    user_task_assignments = list(collection.aggregate(pipeline))
+                    if not user_task_assignments:
+                        return 0
+                    not_done_task_assignment_ids = [assignment["_id"] for assignment in user_task_assignments]
+                    not_done_task_ids = [assignment["task_id_obj"] for assignment in user_task_assignments]
+                    collection.update_many(
+                        {"_id": {"$in": not_done_task_assignment_ids}},
+                        {"$set": {"is_active": False, "updated_by": ObjectId(performed_by_user_id), "updated_at": now}},
+                        session=session,
+                    )
+
+                    new_assignments = []
+
+                    operations = []
+                    dual_write_service = EnhancedDualWriteService()
+                    for assignment in user_task_assignments:
+                        operations.append(
+                            {
+                                "collection_name": "task_assignments",
+                                "operation": "update",
+                                "mongo_id": assignment["_id"],
+                                "data": {
+                                    "task_mongo_id": str(assignment["task_id"]),
+                                    "assignee_id": str(assignment["assignee_id"]),
+                                    "user_type": assignment["user_type"],
+                                    "team_id": str(assignment["team_id"]),
+                                    "is_active": False,
+                                    "created_at": assignment["created_at"],
+                                    "updated_at": datetime.now(timezone.utc),
+                                    "created_by": str(assignment["created_by"]),
+                                    "updated_by": str(performed_by_user_id),
+                                },
+                            }
+                        )
+                        new_assignment_id = PyObjectId()
+                        new_assignments.append(
+                            TaskAssignmentModel(
+                                _id=new_assignment_id,
+                                task_id=assignment["task_id_obj"],
+                                assignee_id=PyObjectId(team_id),
+                                user_type="team",
+                                created_by=PyObjectId(performed_by_user_id),
+                                updated_by=None,
+                                team_id=PyObjectId(team_id),
+                            ).model_dump(mode="json", by_alias=True, exclude_none=True)
+                        )
+                        operations.append(
+                            {
+                                "collection_name": "task_assignments",
+                                "operation": "create",
+                                "mongo_id": new_assignment_id,
+                                "data": {
+                                    "task_mongo_id": str(assignment["task_id"]),
+                                    "assignee_id": str(team_id),
+                                    "user_type": "team",
+                                    "team_id": str(team_id),
+                                    "is_active": True,
+                                    "created_at": datetime.now(timezone.utc),
+                                    "updated_at": None,
+                                    "created_by": str(performed_by_user_id),
+                                    "updated_by": None,
+                                },
+                            }
+                        )
+                        task_details = assignment["task_info"]
+                        operations.append(
+                            {
+                                "collection_name": "tasks",
+                                "operation": "update",
+                                "mongo_id": assignment["task_id"],
+                                "data": {
+                                    "title": task_details.get("title"),
+                                    "description": task_details.get("description"),
+                                    "priority": task_details.get("priority"),
+                                    "status": TaskStatus.TODO,
+                                    "displayId": task_details.get("displayId"),
+                                    "deferredDetails": None,
+                                    "isAcknowledged": task_details.get("isAcknowledged", False),
+                                    "isDeleted": task_details.get("isDeleted", False),
+                                    "startedAt": task_details.get("startedAt"),
+                                    "dueAt": task_details.get("dueAt"),
+                                    "createdAt": task_details.get("createdAt"),
+                                    "updatedAt": datetime.now(timezone.utc),
+                                    "createdBy": str(task_details.get("createdBy")),
+                                    "updated_by": str(performed_by_user_id),
+                                },
+                            }
+                        )
+
+                    if new_assignments:
+                        collection.insert_many(new_assignments, session=session)
+                        from todo.repositories.task_repository import TaskRepository
+
+                        tasks_collection = TaskRepository.get_collection()
+                        tasks_collection.update_many(
+                            {"_id": {"$in": not_done_task_ids}},
+                            {
+                                "$set": {
+                                    "status": TaskStatus.TODO.value,
+                                    "deferredDetails": None,
+                                    "updatedAt": datetime.now(timezone.utc),
+                                }
+                            },
+                            session=session,
+                        )
+                        dual_write_success = dual_write_service.batch_operations(operations)
+
+                        if not dual_write_success:
+                            import logging
+
+                            logger = logging.getLogger(__name__)
+                            logger.warning("Failed to sync task reassignments to Postgres")
+                    return len(new_assignments)
+            except Exception:
+                return 0

todo/serializers/remove_from_team_serializer.py

@@ -0,0 +1,18 @@
+from rest_framework import serializers
+from bson import ObjectId
+from todo.constants.messages import ValidationErrors
+
+
+class RemoveFromTeamSerializer(serializers.Serializer):
+    team_id = serializers.CharField()
+    user_id = serializers.CharField()
+
+    def validate_team_id(self, value):
+        if not ObjectId.is_valid(value):
+            raise serializers.ValidationError(ValidationErrors.INVALID_OBJECT_ID.format(value))
+        return value
+
+    def validate_user_id(self, value):
+        if not ObjectId.is_valid(value):
+            raise serializers.ValidationError(ValidationErrors.INVALID_OBJECT_ID.format(value))
+        return value

todo/services/task_assignment_service.py

@@ -150,3 +150,24 @@ def delete_task_assignment(cls, task_id: str, user_id: str) -> bool:
         Delete task assignment by task ID.
         """
         return TaskAssignmentRepository.delete_assignment(task_id, user_id)
+
+    @classmethod
+    def reassign_tasks_from_user_to_team(cls, user_id: str, team_id: str, performed_by_user_id: str):
+        """
+        Reassign all tasks of user to team
+        """
+        reassigned_tasks_count = TaskAssignmentRepository.reassign_tasks_from_user_to_team(
+            user_id, team_id, performed_by_user_id
+        )
+        if reassigned_tasks_count > 0:
+            AuditLogRepository.create(
+                AuditLogModel(
+                    team_id=PyObjectId(team_id),
+                    performed_by=PyObjectId(performed_by_user_id),
+                    task_count=reassigned_tasks_count,
+                    action="tasks_reassigned_to_team",
+                    assignee_from=PyObjectId(user_id),
+                    assignee_to=PyObjectId(team_id),
+                )
+            )
+        return reassigned_tasks_count

todo/services/team_service.py

@@ -13,6 +13,15 @@
 from todo.models.audit_log import AuditLogModel
 from todo.repositories.audit_log_repository import AuditLogRepository
 from todo.dto.responses.error_response import ApiErrorResponse, ApiErrorDetail
+from todo.constants.role import RoleScope
+from todo.services.user_role_service import UserRoleService
+from todo.services.task_assignment_service import TaskAssignmentService
+from todo.services.user_service import UserService
+from todo.exceptions.team_exceptions import (
+    CannotRemoveOwnerException,
+    NotTeamAdminException,
+    CannotRemoveTeamPOCException,
+)
 
 DEFAULT_ROLE_ID = "1"
 
@@ -483,7 +492,28 @@ class TeamOrUserNotFound(Exception):
         pass
 
     @classmethod
-    def remove_member_from_team(cls, user_id: str, team_id: str, removed_by_user_id: str = None):
+    def remove_member_from_team(cls, user_id: str, team_id: str, removed_by_user_id: str):
+        team = TeamService.get_team_by_id(team_id)
+        team_members = UserService.get_users_by_team_id(team_id)
+        team_member_ids = [user.id for user in team_members]
+
+        if user_id not in team_member_ids:
+            raise cls.TeamOrUserNotFound
+        if user_id == team.created_by:
+            raise CannotRemoveOwnerException()
+        if user_id == team.poc_id:
+            raise CannotRemoveTeamPOCException()
+        if user_id != removed_by_user_id:
+            if not UserRoleService.has_role(removed_by_user_id, RoleName.ADMIN.value, RoleScope.TEAM.value, team_id):
+                raise NotTeamAdminException()
+
+        user_roles = UserRoleService.get_user_roles(user_id, RoleScope.TEAM.value, team_id)
+        user_role_ids = [roles["role_id"] for roles in user_roles]
+        for role_id in user_role_ids:
+            UserRoleService.remove_role_by_id(user_id, role_id, RoleScope.TEAM.value, team_id)
+
+        TaskAssignmentService.reassign_tasks_from_user_to_team(user_id, team_id, removed_by_user_id)
+
         from todo.repositories.user_team_details_repository import UserTeamDetailsRepository
 
         success = UserTeamDetailsRepository.remove_member_from_team(user_id=user_id, team_id=team_id)
@@ -494,7 +524,7 @@ def remove_member_from_team(cls, user_id: str, team_id: str, removed_by_user_id:
         AuditLogRepository.create(
             AuditLogModel(
                 team_id=PyObjectId(team_id),
-                action="member_removed_from_team",
+                action="member_removed_from_team" if user_id != removed_by_user_id else "member_left_team",
                 performed_by=PyObjectId(removed_by_user_id) if removed_by_user_id else PyObjectId(user_id),
             )
         )