166-19-11-7-5-1-aditi-mishra

[Adi-1805]

Resolves all 6 assigned qualification issues across Bug, Security, Feature, UI, and UX categories. Fixes cascade task deletion leaving orphaned submission records (#5), successive submissions returning stale data (#1), an IDOR vulnerability with missing ObjectId validation and broken authorization checks (#7), adds server-side search and status filtering to the Admin task list (#11), separates Available Tasks discovery and My Tasks into distinct routes with search/sort controls (#166), and replaces the bare logout icon with a clearly labelled "Sign Out" button (#19).

Checklist

Required before opening this PR: Complete these checks locally to ensure the code is ready for review. PRs opened without these checks passing may be closed.

• I ran cd client && npm run lint && npm run build and cd server && npm run lint && npm run build locally
• All checks passed (lint, build)
• No errors or warnings remain

Note: This is a pre-PR checklist completed before submission. Additional checklists below are completed after the PR is opened.

Short Demo Video (required)

🎥 Demo Video: https://youtu.be/wkybU7GFj_U

---

• I have read and followed the Contribution and Qualification Guidelines

Required Checklist

Task & Workflow

• Create a new Branch exactly matching your assigned name (166-19-11-7-5-1-aditi-mishra)
• PR title is exactly your assigned branch name
• Latest target branch (master) was pulled immediately before opening this PR

Quality & Safety

• Change tested locally
• Full diff reviewed before submitting (no blind copy/paste)
• No secrets, keys, or personal data included

---

Checklist Completion Rule

The checklist must be completed after the Pull Request is opened.

Process:

1. Create and submit the Pull Request
2. Reopen the Pull Request page
3. Complete all required checklist items
4. Ensure your PR link and Voice recorded video are submitted before the deadline

Incomplete or incorrect checklists will result in the PR being closed.

---

What Was Done

🐛 Closes #5 — Task Deletion Leaves Orphaned Records

server/controllers/taskController.js

deleteTask only removed the Task document, leaving Submission records behind as orphaned data.

Fix: Promise.all now atomically deletes the Task and all associated Submission documents in one operation.

- await Task.findByIdAndDelete(req.params.id);
+ await Promise.all([
+   Task.findByIdAndDelete(req.params.id),
+   Submission.deleteMany({ taskId: req.params.id }),
+ ]);

---

🐛 Closes #1 — Successive Task Submissions Overwrite Previous Data

server/controllers/submissionController.js, server/models/Submission.js

getSubmission fetched without sorting so stale records could be returned. reviewStatus had no schema-level enum constraint allowing arbitrary string values.

Fix: getSubmission now uses .sort({ createdAt: -1 }). Submission.js enforces enum: ['Pending', 'Approved', 'Rejected']. reviewSubmission validates the incoming status before persisting.

---

🔐 Closes #7 — IDOR Vulnerability in Task Details API

taskController.js, submissionController.js, talentController.js

Malformed IDs passed directly to Mongoose caused unhandled CastError (500). Talent users could access any task by ID. The IDOR check in getSubmission incorrectly compared a populated Mongoose object using .toString().

Fix: mongoose.Types.ObjectId.isValid() guards on all ID params return a clean 400. Talent IDOR check in getTaskById restricts access to Open or self-assigned tasks. getSubmission corrected to use .talentId._id.toString(). reviewSubmission now syncs the parent Task status to Approved or Rejected.

---

✨ Closes #11 — Add Search and Status Filtering to Admin Task List

taskController.js, client/src/api/tasks.js, AdminDashboard.jsx

getAllTasks always returned every task with no filtering support.

Fix: Accepts search (MongoDB $regex, case-insensitive on title and description) and status (exact match) query params. The client passes these on every keystroke, debounced at 300ms.

---

🎨 Closes #166 — Available Tasks Discovery Redesign

App.jsx, TalentDashboard.jsx, AvailableTasksList.jsx

Available Tasks and My Tasks were rendered together on one page. Clicking "My Tasks" in the sidebar caused a 404.

Fix: Added /talent/tasks route in App.jsx. TalentDashboard uses useLocation to conditionally render the discovery board at /talent/dashboard or the assigned tasks list at /talent/tasks. AvailableTasksList gains a local search bar and sort dropdown (Newest / Due Date / A–Z).

---

🖱️ Closes #19 — Logout Button Lacks Clear Affordance

admin/Sidebar.jsx, talent/TalentSidebar.jsx

The logout was a bare icon with no visible label or interactive affordance.

Fix: Replaced with a full-width "Sign Out" button with a red-tinted background, visible border, and hover deepening effect in both Admin and Talent sidebars.