[Bug Fix] Restrict the removal of the last task owner (#567)

* fix: add orphan guard for the last owner of the task

* test: update unit tests

Author: solenuk

src/main/java/com/itasocialacademy/oitassist/task/service/TaskServiceImpl.java

@@ -194,6 +194,11 @@ public TaskResponseDTO removeTaskOwner(Long taskId, RemoveOwnerRequestDTO remove
             .filter(o -> o.getId().getOwnerId().equals(userDetails.id())).findFirst();
 
         if (toRemove.isPresent()) {
+            if (task.getOwners().size() == 1) {
+                throw new ValidationException(
+                    "Cannot remove the last owner of a task",
+                    ErrorCode.COMMON_VALIDATION_FAILED);
+            }
             task.removeOwner(toRemove.get());
         } else {
             return getResponse(task);

src/test/java/com/itasocialacademy/oitassist/task/service/TaskServiceTest.java

@@ -545,6 +545,12 @@ void addTaskOwner_alreadyOwner_shouldReturnWithoutChanges() {
 
     @Test
     void removeTaskOwner_shouldSucceed() {
+        TaskOwner secondOwner = TaskOwner.builder()
+            .id(new TaskOwnerId(1L, 200L))
+            .task(taskBody)
+            .build();
+        taskBody.addOwner(secondOwner);
+
         RemoveOwnerRequestDTO request = new RemoveOwnerRequestDTO("currentowner@mail.com");
 
         UserAuthDetails owner =
@@ -563,9 +569,31 @@ void removeTaskOwner_shouldSucceed() {
         assertFalse(taskBody.getOwners().stream()
             .anyMatch(o -> o.getId().getOwnerId().equals(100L)));
 
+        assertTrue(taskBody.getOwners().stream()
+            .anyMatch(o -> o.getId().getOwnerId().equals(200L)));
+
         verify(taskBodyMapper).toResponse(taskBody, testFiles, "creator@mail.com");
     }
 
+    @Test
+    void removeTaskOwner_lastOwner_shouldThrowValidationException() {
+        RemoveOwnerRequestDTO request = new RemoveOwnerRequestDTO("currentowner@mail.com");
+
+        UserAuthDetails owner =
+            new UserAuthDetails(100L, "currentowner@mail.com", "12345678", Role.ORG);
+
+        when(securityFacade.hasRole("ADMIN")).thenReturn(true);
+        when(taskBodyRepository.findById(1L)).thenReturn(Optional.of(taskBody));
+        when(userFacade.findByEmail("currentowner@mail.com")).thenReturn(Optional.of(owner));
+
+        assertThrows(ValidationException.class,
+            () -> taskService.removeTaskOwner(1L, request));
+
+        assertEquals(1, taskBody.getOwners().size());
+        assertTrue(taskBody.getOwners().stream()
+            .anyMatch(o -> o.getId().getOwnerId().equals(100L)));
+    }
+
     @Test
     void removeTaskOwner_notAdmin_shouldThrowTaskAccessRestrictedException() {
         RemoveOwnerRequestDTO request = new RemoveOwnerRequestDTO("currentowner@mail.com");