nexus/backend/Controllers/TasksController.cs

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using System.Security.Claims;
using Nexus.Api.Data;
using Nexus.Api.DTOs;
using Nexus.Api.Models;
using Nexus.Api.Repositories;
using Nexus.Api.Services;

namespace Nexus.Api.Controllers;

[Authorize]
[ApiController]
[Route("api/v1/tasks")]
public class TasksController(
    ITaskService taskService,
    IAgentService agentService,
    IConfiguration configuration,
    IActivityRepository activityRepository) : ControllerBase
{
    [HttpGet]
    public async Task<IResult> GetAll(CancellationToken ct)
        => Results.Ok(await taskService.GetAllAsync(ct));

    [HttpPost]
    public async Task<IResult> Create([FromBody] CreateTaskRequest request, CancellationToken ct)
    {
        if (string.IsNullOrWhiteSpace(request.Title))
            return Results.ValidationProblem(new Dictionary<string, string[]> { ["title"] = ["Title is required."] });

        var task = await taskService.CreateAsync(request, ct);
        return Results.Created($"/api/v1/tasks/{task.Id}", task);
    }

    [HttpGet("pending-approval")]
    [Authorize(Roles = "owner")]
    public async Task<IResult> GetPendingApproval(CancellationToken ct)
    {
        var pending = await taskService.GetPendingApprovalAsync(ct);
        return Results.Ok(pending.Select(x => new { x.Id, x.Title, x.State, x.Priority, x.ProjectId, x.UpdatedAt }));
    }

    [HttpPost("{id:guid}/approve")]
    [Authorize(Roles = "owner")]
    public async Task<IResult> Approve(Guid id, CancellationToken ct)
    {
        var result = await taskService.ApproveAsync(id, ct);
        await WriteApprovalAuditAsync(id, "approve", result.Outcome, result.Task?.State, ct);
        return result.Outcome switch
        {
            TaskOperationOutcome.NotFound => Results.NotFound(),
            TaskOperationOutcome.InvalidState => Results.Problem(
                title: "Approval denied",
                detail: "Only tasks in 'In progress' or 'Blocked' state can be approved.",
                statusCode: StatusCodes.Status403Forbidden),
            _ => Results.Ok(result.Task)
        };
    }

    [HttpPost("{id:guid}/reject")]
    [Authorize(Roles = "owner")]
    public async Task<IResult> Reject(Guid id, CancellationToken ct)
    {
        var result = await taskService.RejectAsync(id, ct);
        await WriteApprovalAuditAsync(id, "reject", result.Outcome, result.Task?.State, ct);
        return result.Outcome switch
        {
            TaskOperationOutcome.NotFound => Results.NotFound(),
            TaskOperationOutcome.InvalidState => Results.Problem(
                title: "Rejection denied",
                detail: "Only tasks in 'In progress' or 'Blocked' state can be rejected.",
                statusCode: StatusCodes.Status403Forbidden),
            _ => Results.Ok(result.Task)
        };
    }

    [HttpPatch("{id:guid}/state")]
    public async Task<IResult> UpdateState(Guid id, [FromBody] UpdateTaskStateRequest request, CancellationToken ct)
    {
        if (!TaskStateHelper.IsValidState(request.State))
            return Results.ValidationProblem(new Dictionary<string, string[]> { ["state"] = ["Unsupported task state."] });

        var result = await taskService.UpdateStateAsync(id, request.State, ct);
        return result.Outcome switch
        {
            TaskOperationOutcome.NotFound => Results.NotFound(),
            TaskOperationOutcome.InvalidState => Results.Problem(
                title: "Action denied",
                detail: "Statusänderungen sind nur Iris und Bao vorbehalten. Sub-Agenten können Tasks nicht verschieben.",
                statusCode: StatusCodes.Status403Forbidden),
            _ => Results.Ok(result.Task)
        };
    }

    [HttpPatch("{id:guid}")]
    public async Task<IResult> Update(Guid id, [FromBody] UpdateTaskRequest request, CancellationToken ct)
    {
        var result = await taskService.UpdateAsync(id, request, ct);
        return result.Outcome switch
        {
            TaskOperationOutcome.NotFound => Results.NotFound(),
            _ => Results.Ok(result.Task)
        };
    }

    [HttpDelete("{id:guid}")]
    public async Task<IResult> Delete(Guid id, CancellationToken ct)
    {
        var result = await taskService.DeleteAsync(id, ct);
        return result.Outcome switch
        {
            TaskOperationOutcome.NotFound => Results.NotFound(),
            TaskOperationOutcome.InvalidState => Results.Problem(
                title: "Task deletion denied",
                detail: "Only tasks in 'Done' or 'Backlog' state can be deleted.",
                statusCode: StatusCodes.Status403Forbidden),
            _ => Results.NoContent()
        };
    }

    // ── Board & Stale-Reset (für Iris Autonomous Worker) ──

    /// <summary>
    /// Gibt das Task-Board zurück (gruppiert nach Status, priorisiert sortiert).
    /// Wird vom Iris Autonomous Worker genutzt.
    ///
    /// SICHERHEIT: Erfordert X-Agent-Id Header (bel. erkannter Agent) ODER
    /// X-Nexus-Api-Key / JWT. Kein [AllowAnonymous] mehr.
    /// Für Agent-zu-Agent-Kommunikation den /api/bridge/board Endpunkt nutzen.
    /// </summary>
    [AllowAnonymous]
    [HttpGet("board")]
    public async Task<IResult> GetBoard(CancellationToken ct)
    {
        var agentHeader = await RequestAuthorizationHelper.ResolveAllowedAgentHeaderAsync(HttpContext, agentService, ct);
        var isApiKey = RequestAuthorizationHelper.IsAuthenticatedService(HttpContext, configuration);
        var isAuth = HttpContext.User.Identity?.IsAuthenticated == true;

        if (string.IsNullOrWhiteSpace(agentHeader) && !isApiKey && !isAuth)
            return Results.Unauthorized();

        return Results.Ok(await taskService.GetBoardAsync(ct));
    }

    /// <summary>
    /// Setzt stale Tasks (InProgress, älter als N Stunden) zurück auf Backlog.
    /// Wird vom Iris Autonomous Worker genutzt.
    ///
    /// SICHERHEIT: Erfordert X-Agent-Id Header (nur iris) ODER
    /// X-Nexus-Api-Key / Service-Principal ODER owner/admin JWT.
    /// Für Agent-zu-Agent-Kommunikation den /api/bridge Endpunkt nutzen.
    /// </summary>
    [AllowAnonymous]
    [HttpPost("reset-stale")]
    public async Task<IResult> ResetStale([FromBody] ResetStaleRequest request, CancellationToken ct)
    {
        var agentHeaderResolution = await RequestAuthorizationHelper.ResolveAgentHeaderAsync(HttpContext, agentService, ct);
        var isService = RequestAuthorizationHelper.IsAuthenticatedService(HttpContext, configuration);
        var isPrivilegedUser = RequestAuthorizationHelper.IsPrivilegedUser(HttpContext);

        var isIris = string.Equals(agentHeaderResolution.AgentId, "iris", StringComparison.OrdinalIgnoreCase);
        if (!isIris && !isService && !isPrivilegedUser)
        {
            // A presented but unrecognized agent header is an invalid credential, not a missing one.
            if (HttpContext.User.Identity?.IsAuthenticated == true || agentHeaderResolution.HeaderProvided)
                return Results.Forbid();

            return Results.Unauthorized();
        }

        var count = await taskService.ResetStaleAsync(request.StaleHours, ct);
        return Results.Ok(new ResetStaleResponse(count));
    }

    private async Task WriteApprovalAuditAsync(
        Guid taskId,
        string action,
        TaskOperationOutcome outcome,
        string? state,
        CancellationToken ct)
    {
        await activityRepository.AddAsync(new ActivityEvent
        {
            Type = "task_approval_audit",
            Message = $"Task approval task={taskId} action={action} caller={DescribeCaller(HttpContext.User)} outcome={outcome} checkpoint={(state ?? "none")}",
            TaskId = taskId
        }, ct);
    }

    private static string DescribeCaller(ClaimsPrincipal user)
    {
        var subject = user.FindFirst(ClaimTypes.NameIdentifier)?.Value
            ?? user.FindFirst(ClaimTypes.Email)?.Value
            ?? user.Identity?.Name
            ?? "unknown";

        var role = user.FindFirst(ClaimTypes.Role)?.Value ?? "owner";
        return $"{role}:{subject}".ToLowerInvariant();
    }
}