Inclusão de travas de seguraça para pastas

src/app/(app)/workspaces/[id]/membro/[memberId]/page.tsx

@@ -103,17 +103,21 @@ export default async function MemberFolderPage({
             </p>
           </div>
         </div>
-        <TaskDialog
-          workspaceId={workspaceId}
-          members={members}
-          defaultAssigneeId={member?.UserId}
-          trigger={
-            <Button>
-              <Plus className="mr-2 h-4 w-4" />
-              Nova tarefa
-            </Button>
-          }
-        />
+        {(role === "admin" || !member || member.UserId === user.id) && (
+          <TaskDialog
+            workspaceId={workspaceId}
+            members={members}
+            defaultAssigneeId={member?.UserId}
+            currentUserId={user.id}
+            isAdmin={role === "admin"}
+            trigger={
+              <Button>
+                <Plus className="mr-2 h-4 w-4" />
+                Nova tarefa
+              </Button>
+            }
+          />
+        )}
       </div>
 
       <StatusSummary tasks={tasks} />

src/app/(app)/workspaces/[id]/page.tsx

@@ -81,6 +81,8 @@ export default async function WorkspacePage({
           <TaskDialog
             workspaceId={workspaceId}
             members={members}
+            currentUserId={user.id}
+            isAdmin={isAdmin}
             trigger={
               <Button>
                 <Plus className="mr-2 h-4 w-4" />
@@ -104,6 +106,8 @@ export default async function WorkspacePage({
             tasks={tasks}
             members={members}
             workspaceId={workspaceId}
+            currentUserId={user.id}
+            isAdmin={isAdmin}
           />
         </TabsContent>
         <TabsContent value="list" className="mt-4">

src/components/tasks/task-board.tsx

@@ -65,6 +65,8 @@ export function TaskBoard({
                               members={members}
                               task={toFormValues(task)}
                               subtasks={subtasksByTask[task.Id] ?? []}
+                              currentUserId={currentUserId}
+                              isAdmin={isAdmin}
                               trigger={
                                 <Button
                                   variant="ghost"

src/components/tasks/task-by-person.tsx

@@ -48,10 +48,14 @@ export function TaskByPerson({
   tasks,
   members,
   workspaceId,
+  currentUserId,
+  isAdmin,
 }: {
   tasks: Task[];
   members: WorkspaceMember[];
   workspaceId: number;
+  currentUserId: number;
+  isAdmin: boolean;
   subtasksByTask?: Record<number, Subtask[]>;
 }) {
   const groups: PersonGroup[] = members.map((member) => ({
@@ -155,11 +159,14 @@ export function TaskByPerson({
               <ChevronRight className="h-4 w-4 shrink-0 text-muted-foreground" />
             </Link>
 
-            {group.userId !== null && (
+            {group.userId !== null &&
+              (isAdmin || group.userId === currentUserId) && (
               <TaskDialog
                 workspaceId={workspaceId}
                 members={members}
                 defaultAssigneeId={group.userId}
+                currentUserId={currentUserId}
+                isAdmin={isAdmin}
                 trigger={
                   <Button
                     variant="ghost"

src/components/tasks/task-dialog.tsx

@@ -66,6 +66,8 @@ export function TaskDialog({
   task,
   subtasks,
   defaultAssigneeId,
+  currentUserId,
+  isAdmin,
   trigger,
 }: {
   workspaceId: number;
@@ -73,8 +75,17 @@ export function TaskDialog({
   task?: TaskFormValues;
   subtasks?: Subtask[];
   defaultAssigneeId?: number;
+  currentUserId: number;
+  isAdmin: boolean;
   trigger: ReactNode;
 }) {
+  // Membros comuns só podem atribuir tarefas a si mesmos; mantém o
+  // responsável atual visível em modo edição.
+  const selectableMembers = isAdmin
+    ? members
+    : members.filter(
+        (m) => m.UserId === currentUserId || m.UserId === task?.assigneeId
+      );
   const [open, setOpen] = useState(false);
   const action = task
     ? updateTaskAction.bind(null, task.id)
@@ -175,7 +186,7 @@ export function TaskDialog({
                 <SelectValue placeholder="Sem responsável" />
               </SelectTrigger>
               <SelectContent>
-                {members.map((m) => (
+                {selectableMembers.map((m) => (
                   <SelectItem key={m.UserId} value={String(m.UserId)}>
                     {m.Name}
                   </SelectItem>

src/components/tasks/task-table.tsx

@@ -135,6 +135,8 @@ export function TaskTable({
                         members={members}
                         task={toFormValues(task)}
                         subtasks={subtasksByTask[task.Id] ?? []}
+                        currentUserId={currentUserId}
+                        isAdmin={isAdmin}
                         trigger={
                           <Button
                             variant="ghost"

src/lib/actions.ts

@@ -12,7 +12,7 @@ import {
 import {
   assertCanEditTask,
   assertWorkspaceAdmin,
-  assertWorkspaceMember,
+  getWorkspaceRole,
   requireUser,
 } from "./authz";
 import * as data from "./data";
@@ -265,7 +265,20 @@ export async function createTaskAction(
   if (!parsed.success) return { error: firstError(parsed.error) };
 
   try {
-    await assertWorkspaceMember(parsed.data.workspaceId, user);
+    const role = await getWorkspaceRole(parsed.data.workspaceId, user.id);
+    if (!role) {
+      return { error: "Você não tem acesso a este espaço de trabalho." };
+    }
+    // Membros comuns só criam tarefas para si mesmos (ou sem responsável).
+    if (
+      role !== "admin" &&
+      parsed.data.assigneeId !== undefined &&
+      parsed.data.assigneeId !== user.id
+    ) {
+      return {
+        error: "Apenas admins podem criar tarefas para outra pessoa.",
+      };
+    }
     await data.createTask(
       {
         workspaceId: parsed.data.workspaceId,
@@ -303,6 +316,18 @@ export async function updateTaskAction(
     const task = await data.getTask(taskId);
     if (!task) return { error: "Tarefa não encontrada." };
     await assertCanEditTask(task, user);
+    // Membros comuns não podem transferir a tarefa para outra pessoa.
+    const role = await getWorkspaceRole(task.WorkspaceId, user.id);
+    if (
+      role !== "admin" &&
+      parsed.data.assigneeId !== undefined &&
+      parsed.data.assigneeId !== user.id &&
+      parsed.data.assigneeId !== task.AssigneeId
+    ) {
+      return {
+        error: "Apenas admins podem atribuir tarefas a outra pessoa.",
+      };
+    }
     await data.updateTask(taskId, {
       workspaceId: task.WorkspaceId,
       title: parsed.data.title,