fix: Enforce task author immutability upon modification

[Mike031289]

Description

This Pull Request addresses a data integrity vulnerability where editing an existing task could potentially alter or clear its original author. It ensures that the task's ownership remains strictly immutable during a POST form submission, blocking any external attempt to falsify or wipe out data ownership.

Changes Made

1. Form Protection (src/AppBundle/Form/TaskType.php)

• Inspected the form structure to ensure no user or author field is exposed or modifiable by the client during edition.

2. Controller Security (src/AppBundle/Controller/TaskController.php)

• Updated editAction() to snapshot the $originalAuthor reference before handling the request payload.
• Forced re-assignment of the original author right before flushing the entity manager ($task->setUser($originalAuthor)), making the property fully tamper-proof.

3. Functional Testing (tests/AppBundle/Controller/TaskControllerTest.php)

• Implemented testEditTaskUserRemainsImmutable() using HTTP Basic Auth.
• The test simulates a task modification via a POST request, flushes/clears the Doctrine identity map, and asserts via database IDs that the title was updated while the user relation remained untouched.

How to Test / Review

1. Switch to this branch: git checkout fix/task-author-immutable
2. Reset the test environment and database fixtures:

   php bin/console cache:clear --env=test
   php bin/console doctrine:schema:update --force --env=test
   php bin/console doctrine:fixtures:load --env=test -n

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}