From a160a88b0817d30a4274ba77f3565e7066f9fcb0 Mon Sep 17 00:00:00 2001
From: lorentz <lorentz@wulfconsulting.com>
Date: Wed, 8 Apr 2026 02:37:33 +0000
Subject: [PATCH] fix: add task suppression to /api/tasks GET route (used by
 admin 'view as' feature)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This was the 4th location missing the filter — the API endpoint had no
suppression at all, so old/dead tasks showed when admins viewed other users' tasks.
---
 ondeck/src/app/api/tasks/route.ts | 50 +++++++++++++++++++++++++------
 1 file changed, 41 insertions(+), 9 deletions(-)

diff --git a/ondeck/src/app/api/tasks/route.ts b/ondeck/src/app/api/tasks/route.ts
index 6344dc8..1c2e2fb 100644
--- a/ondeck/src/app/api/tasks/route.ts
+++ b/ondeck/src/app/api/tasks/route.ts
@@ -23,16 +23,48 @@ export async function GET(request: NextRequest) {
 
     const where: any = {}
 
-    if (status) where.status = status
-    if (clientId) where.clientId = clientId
-    if (department) where.department = department
-    if (designationId) {
-      where.client = {
-        OR: [
-          { designationId },
-          { designation2Id: designationId },
-        ],
+    // Task suppression: exclude dead policies, expired groups, and old tasks
+    const cutoff = new Date()
+    cutoff.setDate(cutoff.getDate() - 7)
+    const showArchived = searchParams.get('archived') === 'true'
+
+    if (!showArchived) {
+      where.NOT = {
+        policy: { status: { in: ['Cancelled', 'Expired', 'Non-Renewed', 'Rewritten', 'Not taken'] } },
       }
+      where.OR = [
+        { policyGroupId: null },
+        { policyGroup: { renewalDate: { gte: cutoff } } },
+      ]
+      where.AND = [
+        {
+          OR: [
+            { dueDate: { gte: cutoff } },
+            { status: { in: ['COMPLETED', 'CANCELLED', 'NA'] } },
+          ],
+        },
+      ]
+    }
+
+    if (status) where.status = status
+    if (clientId) {
+      if (!where.AND) where.AND = []
+      where.AND.push({ clientId })
+    }
+    if (department) {
+      if (!where.AND) where.AND = []
+      where.AND.push({ department })
+    }
+    if (designationId) {
+      if (!where.AND) where.AND = []
+      where.AND.push({
+        client: {
+          OR: [
+            { designationId },
+            { designation2Id: designationId },
+          ],
+        },
+      })
     }
     if (viewUserId) {
       const userRoles = (session.user as any).roles || []