[vidiyala99]

Same fix as #2404 (already merged into main and live on production), brought to development so the next release to main doesn't bring the bug back. The commit is cherry-picked unchanged; tests re-run on development.

Description

Since today's backend release to main (#2399, 3.17), the Dashboard's Team Member Tasks never loads for volunteers. GET /api/user/:userId/teams/tasks returns 400 {"error":{}} for every requestor without the seeNumberOfTimesTimeAdded permission (all volunteers). Admins and owners have that permission, so their dashboards still work. Reported by Jae on the account rukmangadaruku@gmail.com; I reproduced it on my own volunteer account on production (no extra permissions), so it is not caused by the new task deadlines permission.

Related PRs (if any):

• Introduced with the task extension count feature (Roshini Seelamsetty : Implement permissions logic for task extension count visibility #2181), released in Backend Release to Main [3.17] #2399.
• No frontend change needed.

Main changes explained:

• Root cause: removeTaskExtensionCounts (taskController.js) hides deadlineCount by walking the response recursively. The team tasks response contains mongoose documents (populated teams), which hold references back to their parents, so the walk never ends: RangeError: Maximum call stack size exceeded. The catch block returns it as 400, and the empty {} body is the serialized RangeError.
• Fix: strip deadlineCount from a plain JSON copy instead (JSON.parse(JSON.stringify(value))). That copy is exactly what res.send serializes anyway, so the response shape is unchanged, and it has no cycles.
• getTaskById used the same function only for its in-place side effect; it now sends the returned copy (same fix for volunteers opening a single task).
• Users with seeNumberOfTimesTimeAdded still receive deadlineCount unchanged.

How to test:

1. Check out this branch, npm install, npm run build, npm start.
2. npx jest src/controllers/taskController.spec.js: 59 tests pass, including 2 new ones (cyclic documents without the count permission return 200 with deadlineCount removed; with the permission it is kept).
3. Log in as a Volunteer and open the Dashboard: Team Member Tasks loads (before: grey placeholder rows, console shows teams/tasks 400).
4. Log in as an Admin/Owner: Team Member Tasks still loads and the "# of Times Time Added" count still shows.

Test evidence:

• New test fails on the old code with the same production error (RangeError: Maximum call stack size exceeded) and passes with the fix.
• Real-database check: the actual controller and helpers against an in-memory MongoDB seeded with two volunteers on one team and an assigned task. Before: 400 for a volunteer viewing their own tasks and a teammate's. After: 200 with the team member list and tasks.
• Production, my volunteer account: 400 {"error":{}} before the fix, 200 after the deploy (see screenshots).

Screenshots (production, volunteer account)

Before the fix: Team Member Tasks stays on grey placeholder rows; GET /api/user/<id>/teams/tasks returned 400 {"error":{}}.

After the fix (deployed 17:43 PT on 2026-10-13): the same dashboard lists the assigned tasks; the endpoint returns 200 and deadlineCount is left out for a volunteer.

Note:

Production is already fixed by #2404 (Jae confirmed the reported account's dashboard loads). This PR only syncs development.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
90.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud