Changeset 0.28.6 (#192)

server/handlers/tasks.go

@@ -141,6 +141,22 @@ func (h *TaskHandler) Create(c *gin.Context) {
 		return
 	}
 
+	// v0.28.6: System tasks — admin-only, requires valid system_function
+	if t.TaskType == "system" {
+		if c.GetString("role") != "admin" {
+			c.JSON(http.StatusForbidden, gin.H{"error": "system tasks are admin-only"})
+			return
+		}
+		if t.SystemFunction == "" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "system_function is required for system tasks"})
+			return
+		}
+		if err := taskutil.ValidateSystemFunc(t.SystemFunction); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+	}
+
 	// Validate required fields
 	if t.Name == "" {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "name is required"})
@@ -540,3 +556,9 @@ func (h *TriggerHandler) Handle(c *gin.Context) {
 		"task_id":   task.ID,
 	})
 }
+
+// ListSystemFunctions returns the available system function names and descriptions.
+// GET /admin/system-functions
+func (h *TaskHandler) ListSystemFunctions(c *gin.Context) {
+	c.JSON(http.StatusOK, gin.H{"data": taskutil.ListSystemFuncs()})
+}