feat: allow authorized task deletion

apps/tasks/test_tasks.py

@@ -37,6 +37,35 @@ class TaskAccessTests(TestCase):
         response = self.client.get(reverse("task-edit", args=(self.task.pk,)))
         self.assertEqual(response.status_code, 403)
 
+    def test_worker_can_delete_own_task(self):
+        own_task = Task.objects.create(
+            project=self.project, assignee=self.worker, title="Своя задача", description="Описание",
+            work_date=date(2026, 7, 14), duration_minutes=60, hourly_rate=Decimal("1000.00"),
+            amount=Decimal("1000.00"), created_by=self.worker,
+        )
+        self.client.force_login(self.worker)
+        response = self.client.post(reverse("task-delete", args=(own_task.pk,)))
+        self.assertRedirects(response, reverse("task-list"))
+        self.assertFalse(Task.objects.filter(pk=own_task.pk).exists())
+
+    def test_worker_cannot_delete_another_users_task(self):
+        self.client.force_login(self.worker)
+        response = self.client.post(reverse("task-delete", args=(self.task.pk,)))
+        self.assertEqual(response.status_code, 403)
+        self.assertTrue(Task.objects.filter(pk=self.task.pk).exists())
+
+    def test_admin_can_delete_any_task(self):
+        self.client.force_login(self.admin)
+        response = self.client.post(reverse("task-delete", args=(self.task.pk,)))
+        self.assertRedirects(response, reverse("task-list"))
+        self.assertFalse(Task.objects.filter(pk=self.task.pk).exists())
+
+    def test_delete_confirmation_does_not_delete_task(self):
+        self.client.force_login(self.other)
+        response = self.client.get(reverse("task-delete", args=(self.task.pk,)))
+        self.assertContains(response, "Удаление задачи")
+        self.assertTrue(Task.objects.filter(pk=self.task.pk).exists())
+
     def test_create_copies_rate_and_calculates_rounded_amount(self):
         self.client.force_login(self.worker)
         response = self.client.post(reverse("task-create"), {

apps/tasks/urls.py

@@ -6,4 +6,5 @@ urlpatterns = [
     path("", views.task_list, name="task-list"),
     path("create/", views.task_create, name="task-create"),
     path("<int:pk>/edit/", views.task_edit, name="task-edit"),
+    path("<int:pk>/delete/", views.task_delete, name="task-delete"),
 ]

apps/tasks/views.py

@@ -59,3 +59,15 @@ def task_edit(request, pk):
         task.save()
         return redirect("task-list")
     return render(request, "tasks/task_form.html", {"form": form, "heading": "Редактирование задачи", "task": task})
+
+
+@login_required
+@transaction.atomic
+def task_delete(request, pk):
+    task = get_object_or_404(Task.objects.select_related("project__company", "assignee"), pk=pk)
+    if not request.user.is_app_admin and task.assignee_id != request.user.id:
+        raise PermissionDenied
+    if request.method == "POST":
+        task.delete()
+        return redirect("task-list")
+    return render(request, "tasks/task_confirm_delete.html", {"task": task})