feat(phase-4): implement team workspace governance, threaded task comments, and attachments

[shashankch]

No description provided.

[Copilot]

🟡 Changes recommended

Authorization gaps on comment/attachment update/delete and unsafe filename/URL handling introduce concrete security and reliability issues that should be fixed before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Implements Phase 4 “Team Collaboration” features by adding team workspaces with role governance, plus task collaboration capabilities via threaded comments and file attachments, along with documentation and test coverage.

Changes:

• Added team workspace domain + REST API (create/join/list/update/members/roles/invite code/delete) with domain events.
• Added threaded task comments (root + replies) and task attachments (multipart upload, storage abstraction, download URLs) with domain events.
• Added DB migrations and updated docs/changelog/roadmap plus unit, web-layer, and integration tests.

File summaries

File	Description
src/test/java/com/taskmaster/team/integration/TeamIntegrationTest.java	End-to-end integration coverage for team workspace lifecycle.
src/test/java/com/taskmaster/team/application/service/TeamServiceTest.java	Unit tests for team service workflows and events.
src/test/java/com/taskmaster/team/adapter/in/TeamControllerTest.java	MockMvc tests for team REST endpoints.
src/test/java/com/taskmaster/collaboration/integration/CollaborationIntegrationTest.java	End-to-end integration coverage for comments + attachments.
src/test/java/com/taskmaster/collaboration/application/service/TaskCommentServiceTest.java	Unit tests for threaded comment service logic/events.
src/test/java/com/taskmaster/collaboration/application/service/TaskAttachmentServiceTest.java	Unit tests for attachment service logic/events.
src/test/java/com/taskmaster/collaboration/adapter/in/TaskCommentControllerTest.java	MockMvc tests for comment endpoints.
src/test/java/com/taskmaster/collaboration/adapter/in/TaskAttachmentControllerTest.java	MockMvc tests for attachment endpoints.
src/main/resources/db/migration/V9__create_task_comments_table.sql	Adds task_comments table for hierarchical comments.
src/main/resources/db/migration/V8__add_team_fk_to_tasks.sql	Adds FK from tasks.team_id to teams.id.
src/main/resources/db/migration/V7__create_team_members_table.sql	Adds team_members table with role constraints.
src/main/resources/db/migration/V6__create_teams_table.sql	Adds teams table with invite codes and owner FK.
src/main/resources/db/migration/V10__create_task_attachments_table.sql	Adds task_attachments table for attachment metadata.
src/main/resources/application-test.yml	Updates test profile app configuration (rate limiting).
src/main/java/com/taskmaster/team/domain/port/TeamRepository.java	Introduces domain port for team persistence.
src/main/java/com/taskmaster/team/domain/port/TeamMemberRepository.java	Introduces domain port for team membership persistence.
src/main/java/com/taskmaster/team/domain/port/TeamEventPublisher.java	Introduces domain port for publishing team events.
src/main/java/com/taskmaster/team/domain/model/TeamRole.java	Adds team role enum (OWNER/ADMIN/MEMBER).
src/main/java/com/taskmaster/team/domain/model/TeamMember.java	Adds JPA entity for team membership + role.
src/main/java/com/taskmaster/team/domain/model/Team.java	Adds JPA aggregate for teams + invite code generation.
src/main/java/com/taskmaster/team/domain/event/TeamMemberRoleUpdatedEvent.java	Adds domain event for member role changes.
src/main/java/com/taskmaster/team/domain/event/TeamMemberRemovedEvent.java	Adds domain event for member removals.
src/main/java/com/taskmaster/team/domain/event/TeamMemberJoinedEvent.java	Adds domain event for join actions.
src/main/java/com/taskmaster/team/domain/event/TeamDeletedEvent.java	Adds domain event for team deletion.
src/main/java/com/taskmaster/team/domain/event/TeamCreatedEvent.java	Adds domain event for team creation.
src/main/java/com/taskmaster/team/application/service/TeamService.java	Implements team workspace lifecycle + governance rules.
src/main/java/com/taskmaster/team/application/mapper/TeamMapper.java	Maps team aggregates to API DTOs (incl. members).
src/main/java/com/taskmaster/team/application/dto/UpdateTeamRequest.java	Adds DTO for updating team fields.
src/main/java/com/taskmaster/team/application/dto/UpdateMemberRoleRequest.java	Adds DTO for role update requests.
src/main/java/com/taskmaster/team/application/dto/TeamResponse.java	Adds team summary response DTO.
src/main/java/com/taskmaster/team/application/dto/TeamMemberResponse.java	Adds team member response DTO.
src/main/java/com/taskmaster/team/application/dto/TeamDetailResponse.java	Adds team detail response DTO including members.
src/main/java/com/taskmaster/team/application/dto/JoinTeamRequest.java	Adds invite-code join request DTO.
src/main/java/com/taskmaster/team/application/dto/CreateTeamRequest.java	Adds team create request DTO.
src/main/java/com/taskmaster/team/adapter/out/SpringEventTeamEventPublisher.java	Spring adapter to publish team domain events.
src/main/java/com/taskmaster/team/adapter/out/SpringDataJpaTeamRepository.java	Spring Data repo + query for listing user teams.
src/main/java/com/taskmaster/team/adapter/out/SpringDataJpaTeamMemberRepository.java	Spring Data repo for team membership lookups.
src/main/java/com/taskmaster/team/adapter/out/JpaTeamRepository.java	Adapter implementing TeamRepository via Spring Data.
src/main/java/com/taskmaster/team/adapter/out/JpaTeamMemberRepository.java	Adapter implementing TeamMemberRepository via Spring Data.
src/main/java/com/taskmaster/team/adapter/in/TeamController.java	REST controller for team workspace endpoints.
src/main/java/com/taskmaster/collaboration/domain/port/TaskCommentRepository.java	Introduces port for comment persistence.
src/main/java/com/taskmaster/collaboration/domain/port/TaskAttachmentRepository.java	Introduces port for attachment persistence.
src/main/java/com/taskmaster/collaboration/domain/port/FileStorageService.java	Introduces storage abstraction for attachments.
src/main/java/com/taskmaster/collaboration/domain/port/CollaborationEventPublisher.java	Introduces port for collaboration event publishing.
src/main/java/com/taskmaster/collaboration/domain/model/TaskComment.java	Adds JPA entity for threaded comments + soft delete.
src/main/java/com/taskmaster/collaboration/domain/model/TaskAttachment.java	Adds JPA entity for attachment metadata + storage key.
src/main/java/com/taskmaster/collaboration/domain/event/TaskCommentUpdatedEvent.java	Adds domain event for comment updates.
src/main/java/com/taskmaster/collaboration/domain/event/TaskCommentDeletedEvent.java	Adds domain event for comment soft deletes.
src/main/java/com/taskmaster/collaboration/domain/event/TaskCommentCreatedEvent.java	Adds domain event for comment creation/replies.
src/main/java/com/taskmaster/collaboration/domain/event/TaskAttachmentUploadedEvent.java	Adds domain event for attachment uploads.
src/main/java/com/taskmaster/collaboration/domain/event/TaskAttachmentDeletedEvent.java	Adds domain event for attachment deletions.
src/main/java/com/taskmaster/collaboration/application/service/TaskCommentService.java	Implements comment create/list/update/delete and events.
src/main/java/com/taskmaster/collaboration/application/service/TaskAttachmentService.java	Implements attachment upload/list/delete and events.
src/main/java/com/taskmaster/collaboration/application/mapper/CommentMapper.java	Maps comment entities into recursive threaded responses.
src/main/java/com/taskmaster/collaboration/application/mapper/AttachmentMapper.java	Maps attachments including generation of download URLs.
src/main/java/com/taskmaster/collaboration/application/dto/UpdateCommentRequest.java	Adds DTO for editing comment content.
src/main/java/com/taskmaster/collaboration/application/dto/CreateCommentRequest.java	Adds DTO for comment creation with optional parent ID.
src/main/java/com/taskmaster/collaboration/application/dto/CommentResponse.java	Adds recursive comment response DTO.
src/main/java/com/taskmaster/collaboration/application/dto/AttachmentResponse.java	Adds attachment response DTO including download URL.
src/main/java/com/taskmaster/collaboration/adapter/out/SpringEventCollaborationEventPublisher.java	Spring adapter to publish collaboration domain events.
src/main/java/com/taskmaster/collaboration/adapter/out/SpringDataJpaTaskCommentRepository.java	Spring Data repo for root-comment retrieval query.
src/main/java/com/taskmaster/collaboration/adapter/out/SpringDataJpaTaskAttachmentRepository.java	Spring Data repo for listing attachments by task.
src/main/java/com/taskmaster/collaboration/adapter/out/S3FileStorageService.java	Storage implementation (in-memory fallback + URL generation).
src/main/java/com/taskmaster/collaboration/adapter/out/JpaTaskCommentRepository.java	Adapter implementing TaskCommentRepository via Spring Data.
src/main/java/com/taskmaster/collaboration/adapter/out/JpaTaskAttachmentRepository.java	Adapter implementing TaskAttachmentRepository via Spring Data.
src/main/java/com/taskmaster/collaboration/adapter/in/TaskCommentController.java	REST controller for comment endpoints.
src/main/java/com/taskmaster/collaboration/adapter/in/TaskAttachmentController.java	REST controller for attachment endpoints.
README.md	Documents new Team/Comments/Attachments API areas and phase status.
docs/ROADMAP.md	Marks Phase 4 complete and lists delivered capabilities.
docs/api-specification.md	Adds detailed API spec sections for teams/comments/attachments.
CHANGELOG.md	Adds v0.4.0 release notes for the new collaboration features.

Review details

Suppressed comments (2)

src/main/java/com/taskmaster/collaboration/application/service/TaskCommentService.java:132

• deleteComment enforces author ownership but does not enforce team membership for team-scoped tasks, unlike createComment/getTaskComments. A user removed from the team could still soft-delete their comment via direct comment ID.

    public void deleteComment(UUID commentId, UUID currentUserId) {
        TaskComment comment = taskCommentRepository.findById(commentId)
            .orElseThrow(() -> new ResourceNotFoundException("TaskComment", "id", commentId));

        if (!comment.getAuthor().getId().equals(currentUserId)) {

src/main/java/com/taskmaster/collaboration/application/service/TaskAttachmentService.java:131

• deleteAttachment checks uploader ownership but does not enforce team membership for team-scoped tasks. This is inconsistent with uploadAttachment/getTaskAttachments and allows ex-team-members to delete attachments on team tasks if they know the attachment ID.

    public void deleteAttachment(UUID attachmentId, UUID currentUserId) {
        TaskAttachment attachment = taskAttachmentRepository.findById(attachmentId)
            .orElseThrow(() -> new ResourceNotFoundException("TaskAttachment", "id", attachmentId));

        if (!attachment.getUploader().getId().equals(currentUserId)) {
            throw new ForbiddenException("You can only delete attachments you uploaded");
        }

• Files reviewed: 60/71 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.