plan_my_stuff 0.3.0 → 0.4.0

data/app/controllers/plan_my_stuff/comments_controller.rb

@@ -11,10 +11,14 @@ module PlanMyStuff
         body: comment_params[:body],
         user: pms_current_user,
         visibility: comment_params[:visibility]&.to_sym || :public,
+        waiting_on_reply: comment_params[:waiting_on_reply] == '1',
       )
 
       flash[:success] = 'Comment was successfully created.'
       redirect_to(plan_my_stuff.issue_path(@issue.number, repo: @issue.repo.full_name))
+    rescue PMS::LockedIssueError
+      flash[:error] = 'This issue is locked; no new comments can be posted.'
+      redirect_to(plan_my_stuff.issue_path(@issue.number, repo: @issue.repo.full_name))
     end
 
     # GET /issues/:issue_id/comments/:id/edit
@@ -58,7 +62,7 @@ module PlanMyStuff
 
       # @return [ActionController::Parameters]
       def comment_params
-        params.require(:comment).permit(:body, :visibility)
+        params.require(:comment).permit(:body, :visibility, :waiting_on_reply)
       end
 
       # Loads the issue and comment from params.

data/app/controllers/plan_my_stuff/issues/approvals_controller.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+module PlanMyStuff
+  module Issues
+    # CRUD for manager approvals on an issue. Backs the approvals panel
+    # on the issue show view.
+    #
+    # POST   /issues/:issue_id/approvals      -> create  (adds approver(s))
+    # PATCH  /issues/:issue_id/approvals/:id  -> update  (approves or revokes)
+    # DELETE /issues/:issue_id/approvals/:id  -> destroy (removes an approver)
+    #
+    class ApprovalsController < ApplicationController
+      # POST /issues/:issue_id/approvals
+      def create
+        unless support_user?
+          redirect_to_unauthorized(show_path)
+          return
+        end
+
+        user_ids = parse_viewer_ids(approval_params[:user_ids])
+        if user_ids.blank?
+          flash[:error] = 'No valid user IDs provided.'
+          redirect_to(show_path)
+          return
+        end
+
+        issue = PMS::Issue.find(params[:issue_id].to_i, repo: params[:repo])
+        issue.request_approvals!(user_ids: user_ids, user: pms_current_user)
+
+        flash[:success] = 'Approvers were successfully added.'
+        redirect_to(show_path)
+      rescue PMS::AuthorizationError, PMS::ValidationError => e
+        flash[:error] = e.message
+        redirect_to(show_path)
+      end
+
+      # PATCH /issues/:issue_id/approvals/:id
+      def update
+        status = approval_params[:status].to_s
+        target_id = params[:id].to_i
+
+        if %w[approved pending].exclude?(status)
+          head(:bad_request)
+          return
+        end
+
+        issue = PMS::Issue.find(params[:issue_id].to_i, repo: params[:repo])
+        caller_id = pms_current_user.present? ? PMS::UserResolver.user_id(pms_current_user) : nil
+
+        if status == 'approved'
+          unless caller_id == target_id
+            redirect_to_unauthorized(show_path)
+            return
+          end
+          issue.approve!(user: pms_current_user)
+          flash[:success] = 'Approval recorded.'
+        else
+          if caller_id != target_id && !support_user?
+            redirect_to_unauthorized(show_path)
+            return
+          end
+          issue.revoke_approval!(user: pms_current_user, target_user_id: target_id)
+          flash[:success] = 'Approval revoked.'
+        end
+
+        redirect_to(show_path)
+      rescue PMS::AuthorizationError, PMS::ValidationError => e
+        flash[:error] = e.message
+        redirect_to(show_path)
+      end
+
+      # DELETE /issues/:issue_id/approvals/:id
+      def destroy
+        unless support_user?
+          redirect_to_unauthorized(show_path)
+          return
+        end
+
+        issue = PMS::Issue.find(params[:issue_id].to_i, repo: params[:repo])
+        issue.remove_approvers!(user_ids: [params[:id].to_i], user: pms_current_user)
+
+        flash[:success] = 'Approver was successfully removed.'
+        redirect_to(show_path)
+      rescue PMS::AuthorizationError, PMS::ValidationError => e
+        flash[:error] = e.message
+        redirect_to(show_path)
+      end
+
+      private
+
+        # @return [ActionController::Parameters]
+        def approval_params
+          params.fetch(:approval, {}).permit(:status, :user_ids)
+        end
+
+        # @return [String]
+        def show_path
+          plan_my_stuff.issue_path(params[:issue_id], repo: params[:repo])
+        end
+    end
+  end
+end

data/app/controllers/plan_my_stuff/issues/closures_controller.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module PlanMyStuff
+  module Issues
+    # Handles closing and reopening issues via CRUD-style routes.
+    # Backs the Close/Reopen buttons on the issue show view (T-044).
+    #
+    # POST   /issues/:issue_id/closure -> create  (closes)
+    # DELETE /issues/:issue_id/closure -> destroy (reopens)
+    #
+    class ClosuresController < ApplicationController
+      # POST /issues/:issue_id/closure
+      def create
+        issue = PMS::Issue.find(params[:issue_id].to_i, repo: params[:repo])
+        issue.update!(state: :closed)
+
+        flash[:success] = 'Issue was successfully closed.'
+        redirect_to(plan_my_stuff.issue_path(issue.number, repo: issue.repo.full_name))
+      rescue PMS::Error, ArgumentError => e
+        flash[:error] = e.message
+        redirect_to(plan_my_stuff.issue_path(params[:issue_id], repo: params[:repo]))
+      end
+
+      # DELETE /issues/:issue_id/closure
+      def destroy
+        issue = PMS::Issue.find(params[:issue_id].to_i, repo: params[:repo])
+        issue.update!(state: :open)
+
+        flash[:success] = 'Issue was successfully reopened.'
+        redirect_to(plan_my_stuff.issue_path(issue.number, repo: issue.repo.full_name))
+      rescue PMS::Error, ArgumentError => e
+        flash[:error] = e.message
+        redirect_to(plan_my_stuff.issue_path(params[:issue_id], repo: params[:repo]))
+      end
+    end
+  end
+end

data/app/controllers/plan_my_stuff/issues/links_controller.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+
+module PlanMyStuff
+  module Issues
+    # CRUD for ticket relationships: +:related+ (metadata-backed) and
+    # +:blocked_by+ / +:parent+ / +:sub_ticket+ / +:duplicate_of+
+    # (native GitHub APIs). Backs the links panel on the issue show view.
+    #
+    # POST   /issues/:issue_id/links      -> create  (adds a link)
+    # DELETE /issues/:issue_id/links/:id  -> destroy (removes a link)
+    #
+    class LinksController < ApplicationController
+      NATIVE_DISPATCH = {
+        'related' => { add: :add_related!, remove: :remove_related! },
+        'blocked_by' => { add: :add_blocker!, remove: :remove_blocker! },
+        'sub_ticket' => { add: :add_sub_issue!, remove: :remove_sub_issue! },
+        'parent' => { add: :set_parent!, remove: :remove_parent! },
+        'duplicate_of' => { add: :mark_duplicate! },
+      }.freeze
+
+      # POST /issues/:issue_id/links
+      def create
+        type = link_params[:type].to_s
+        unless dispatch_allowed?(type, :add)
+          redirect_to_unauthorized(plan_my_stuff.issue_path(params[:issue_id], repo: params[:repo]))
+          return
+        end
+
+        issue = PMS::Issue.find(params[:issue_id].to_i, repo: params[:repo])
+        link = add_link(issue, type)
+
+        flash[:success] = "Linked #{link}"
+        redirect_to(plan_my_stuff.issue_path(params[:issue_id], repo: params[:repo]))
+      rescue PMS::ValidationError, ActiveModel::ValidationError, ArgumentError => e
+        flash[:error] = e.message
+        redirect_to(plan_my_stuff.issue_path(params[:issue_id], repo: params[:repo]))
+      end
+
+      # DELETE /issues/:issue_id/links/:id
+      def destroy
+        type, repo, number = parse_composite_id(params[:id])
+        unless dispatch_allowed?(type, :remove)
+          redirect_to_unauthorized(plan_my_stuff.issue_path(params[:issue_id], repo: params[:repo]))
+          return
+        end
+
+        issue = PMS::Issue.find(params[:issue_id].to_i, repo: params[:repo])
+        remove_link(issue, type, repo: repo, number: number)
+
+        flash[:success] = "Unlinked #{repo}##{number}"
+        redirect_to(plan_my_stuff.issue_path(params[:issue_id], repo: params[:repo]))
+      rescue PMS::ValidationError, ActiveModel::ValidationError, ArgumentError => e
+        flash[:error] = e.message
+        redirect_to(plan_my_stuff.issue_path(params[:issue_id], repo: params[:repo]))
+      end
+
+      private
+
+        # @return [ActionController::Parameters]
+        def link_params
+          params.require(:link).permit(:type, :issue_number, :repo)
+        end
+
+        # Only +:related+ may be mutated by non-support users. +destroy+
+        # is not defined for +:duplicate_of+ (reopen via GitHub).
+        #
+        # @return [Boolean]
+        #
+        def dispatch_allowed?(type, action)
+          entry = NATIVE_DISPATCH[type]
+          return false if entry.nil? || entry[action].nil?
+          # FIXME: should non-support users be able to alter related links?
+          return true if type == 'related'
+
+          support_user?
+        end
+
+        # @return [PMS::Link]
+        def add_link(issue, type)
+          method = NATIVE_DISPATCH.dig(type, :add)
+          target = {
+            type: type,
+            issue_number: link_params[:issue_number].to_i,
+            repo: link_params[:repo].presence || issue.repo.to_s,
+          }
+          case type
+          when 'related', 'duplicate_of'
+            issue.public_send(method, target, user: pms_current_user)
+          else
+            issue.public_send(method, target)
+          end
+        end
+
+        # @return [void]
+        def remove_link(issue, type, repo:, number:)
+          method = NATIVE_DISPATCH.dig(type, :remove)
+          target = { type: type, issue_number: number, repo: repo }
+          case type
+          when 'parent'
+            issue.public_send(method)
+          when 'related'
+            issue.public_send(method, target, user: pms_current_user)
+          else
+            issue.public_send(method, target)
+          end
+        end
+
+        # Parses +"{type}:{owner/repo}:{number}"+ out of +params[:id]+.
+        # The route helper URL-encodes outgoing segments, but Rack's
+        # default path decoder intentionally leaves +%2F+ escaped in
+        # path params (anti-path-traversal), so the repo portion can
+        # still contain +%2F+. Decode before splitting.
+        #
+        # @param id [String]
+        #
+        # @return [Array(String, String, Integer)] type, repo, number
+        #
+        def parse_composite_id(id)
+          decoded = CGI.unescape(id.to_s)
+          type, repo, number = decoded.split(':', 3)
+          raise(ArgumentError, "Invalid link id: #{id.inspect}") if number.blank?
+
+          [type, repo, number.to_i]
+        end
+    end
+  end
+end

data/app/controllers/plan_my_stuff/issues/takes_controller.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+module PlanMyStuff
+  module Issues
+    # Moves an issue's pipeline ProjectItem to "Started" via
+    # +PlanMyStuff::Pipeline.take!+. Backs the "Take" button on the
+    # mounted issue show view (T-RC-017). The primary UI path for a dev
+    # picking up work on an issue they've been assigned to.
+    #
+    class TakesController < ApplicationController
+      before_action :require_support_user!
+
+      # POST /issues/:issue_id/take
+      def create
+        issue_number = params[:issue_id].to_i
+        repo = params[:repo]
+
+        project_item = PlanMyStuff::Pipeline::IssueLinker.find_project_item(issue_number)
+        project_item ||= add_to_pipeline(issue_number, repo)
+
+        PlanMyStuff::Pipeline.take!(project_item)
+        assign_current_user(project_item)
+        flash[:success] ||= "Issue ##{issue_number} taken."
+
+        redirect_to(plan_my_stuff.issue_path(issue_number, repo: repo))
+      rescue ArgumentError, PlanMyStuff::Error => e
+        flash[:error] = e.message
+        redirect_to(plan_my_stuff.issue_path(issue_number, repo: repo))
+      end
+
+      private
+
+        # Redirects non-support users back to the issue page. Mirrors
+        # +Issues::ViewersController+'s authorization check.
+        #
+        # @return [void]
+        #
+        def require_support_user!
+          return if support_user?
+
+          redirect_to_unauthorized(
+            plan_my_stuff.issue_path(params[:issue_id], repo: params[:repo]),
+          )
+        end
+
+        # Adds an issue to the pipeline project so +Pipeline.take!+ has
+        # something to operate on when the user clicks "Take" on an
+        # issue that hasn't been submitted to the pipeline yet.
+        #
+        # @param issue_number [Integer]
+        # @param repo [String, nil]
+        #
+        # @return [PlanMyStuff::ProjectItem]
+        #
+        def add_to_pipeline(issue_number, repo)
+          issue = PlanMyStuff::Issue.find(issue_number, repo: repo)
+          pipeline_number = PlanMyStuff::Pipeline.resolve_pipeline_project_number
+          PlanMyStuff::ProjectItem.create!(issue, project_number: pipeline_number)
+        end
+
+        # Looks up the current user's GitHub login in
+        # +config.github_login_for+ (a +{user_id => login}+ hash) and
+        # assigns them on the project item. Assignment failures are
+        # logged and surfaced as a flash warning but do not revert the
+        # status move.
+        #
+        # @param project_item [PlanMyStuff::ProjectItem]
+        #
+        # @return [void]
+        #
+        def assign_current_user(project_item)
+          user = pms_current_user
+          user_id = user.present? ? PMS::UserResolver.user_id(user) : nil
+          login = PlanMyStuff.configuration.github_login_for[user_id]
+
+          if login.blank?
+            Rails.logger.info("[PMS] No github_login_for mapping for user #{user_id}; skipping Take assignment")
+            return
+          end
+
+          project_item.assign!(login)
+        rescue PlanMyStuff::Error => e
+          Rails.logger.warn("[PMS] Take assignment failed: #{e.message}")
+          flash[:warning] = "Issue taken but assignment failed: #{e.message}"
+        end
+    end
+  end
+end

data/app/controllers/plan_my_stuff/issues/viewers_controller.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module PlanMyStuff
+  module Issues
+    # Handles adding and removing viewers from the visibility allowlist via CRUD-style routes.
+    # Backs the viewer management UI on the issue edit view (T-045).
+    #
+    # POST   /issues/:issue_id/viewers      -> create  (adds viewer(s))
+    # DELETE /issues/:issue_id/viewers/:id  -> destroy (removes a viewer)
+    #
+    class ViewersController < ApplicationController
+      # POST /issues/:issue_id/viewers
+      def create
+        unless support_user?
+          redirect_to_unauthorized(plan_my_stuff.issue_path(params[:issue_id], repo: params[:repo]))
+          return
+        end
+
+        viewer_ids = parse_viewer_ids(params[:viewer_ids])
+        if viewer_ids.blank?
+          flash[:error] = 'No valid viewer IDs provided.'
+          redirect_to(plan_my_stuff.edit_issue_path(params[:issue_id], repo: params[:repo]))
+          return
+        end
+
+        issue = PMS::Issue.find(params[:issue_id].to_i, repo: params[:repo])
+        issue.add_viewers(user_ids: viewer_ids, user: pms_current_user)
+
+        flash[:success] = 'Viewers were successfully added.'
+        redirect_to(plan_my_stuff.edit_issue_path(params[:issue_id], repo: params[:repo]))
+      end
+
+      # DELETE /issues/:issue_id/viewers/:id
+      def destroy
+        unless support_user?
+          redirect_to_unauthorized(plan_my_stuff.issue_path(params[:issue_id], repo: params[:repo]))
+          return
+        end
+
+        issue = PMS::Issue.find(params[:issue_id].to_i, repo: params[:repo])
+        issue.remove_viewers(user_ids: [params[:id].to_i], user: pms_current_user)
+
+        flash[:success] = 'Viewer was successfully removed.'
+        redirect_to(plan_my_stuff.edit_issue_path(params[:issue_id], repo: params[:repo]))
+      end
+    end
+  end
+end

data/app/controllers/plan_my_stuff/issues/waitings_controller.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module PlanMyStuff
+  module Issues
+    # Toggles the waiting-on-user state on an issue via CRUD-style routes.
+    # Backs the "Mark waiting" / "Mark replied" button on the issue show view.
+    #
+    # POST   /issues/:issue_id/waiting -> create  (enters waiting-on-user)
+    # DELETE /issues/:issue_id/waiting -> destroy (clears waiting-on-user)
+    #
+    class WaitingsController < ApplicationController
+      # POST /issues/:issue_id/waiting
+      def create
+        unless support_user?
+          redirect_to_unauthorized(plan_my_stuff.issue_path(params[:issue_id], repo: params[:repo]))
+          return
+        end
+
+        issue = PMS::Issue.find(params[:issue_id].to_i, repo: params[:repo])
+        issue.enter_waiting_on_user!(user: pms_current_user)
+
+        flash[:success] = 'Issue marked as waiting on user reply.'
+        redirect_to(plan_my_stuff.issue_path(issue.number, repo: issue.repo.full_name))
+      rescue PMS::Error, ArgumentError => e
+        flash[:error] = e.message
+        redirect_to(plan_my_stuff.issue_path(params[:issue_id], repo: params[:repo]))
+      end
+
+      # DELETE /issues/:issue_id/waiting
+      def destroy
+        unless support_user?
+          redirect_to_unauthorized(plan_my_stuff.issue_path(params[:issue_id], repo: params[:repo]))
+          return
+        end
+
+        issue = PMS::Issue.find(params[:issue_id].to_i, repo: params[:repo])
+        issue.clear_waiting_on_user!
+
+        flash[:success] = 'Waiting-on-user state cleared.'
+        redirect_to(plan_my_stuff.issue_path(issue.number, repo: issue.repo.full_name))
+      rescue PMS::Error, ArgumentError => e
+        flash[:error] = e.message
+        redirect_to(plan_my_stuff.issue_path(params[:issue_id], repo: params[:repo]))
+      end
+    end
+  end
+end

data/app/controllers/plan_my_stuff/issues_controller.rb

@@ -49,6 +49,8 @@ module PlanMyStuff
       @comments = filter_visible_comments(@issue.comments)
       @support_user = support_user?
       @current_user_id = pms_current_user.present? ? PMS::UserResolver.user_id(pms_current_user) : nil
+      @pipeline_enabled = PMS.configuration.pipeline_enabled
+      @pipeline_item = load_pipeline_item(@issue.number) if @pipeline_enabled
     end
 
     # GET /issues/:id/edit
@@ -73,58 +75,10 @@ module PlanMyStuff
       @support_user = support_user?
       flash.now[:error] = 'Issue was modified by someone else. Please review the latest changes and try again.'
       render(:edit, status: PMS.unprocessable_status)
-    end
-
-    # PATCH /issues/:id/close
-    def close
-      @issue = PMS::Issue.find(params[:id].to_i, repo: params[:repo])
-      @issue.update!(state: :closed)
-
-      flash[:success] = 'Issue was successfully closed.'
-      redirect_to(plan_my_stuff.issue_path(@issue.number, repo: @issue.repo.full_name))
-    end
-
-    # PATCH /issues/:id/reopen
-    def reopen
-      @issue = PMS::Issue.find(params[:id].to_i, repo: params[:repo])
-      @issue.update!(state: :open)
-
-      flash[:success] = 'Issue was successfully reopened.'
-      redirect_to(plan_my_stuff.issue_path(@issue.number, repo: @issue.repo.full_name))
-    end
-
-    # POST /issues/:id/add_viewers
-    def add_viewers
-      unless support_user?
-        redirect_to_unauthorized(plan_my_stuff.issue_path(params[:id], repo: params[:repo]))
-        return
-      end
-
-      viewer_ids = parse_viewer_ids(params[:viewer_ids])
-      if viewer_ids.blank?
-        flash[:error] = 'No valid viewer IDs provided.'
-        redirect_to(plan_my_stuff.edit_issue_path(params[:id], repo: params[:repo]))
-        return
-      end
-
-      PMS::Issue.add_viewers(number: params[:id].to_i, user_ids: viewer_ids, repo: params[:repo])
-
-      flash[:success] = 'Viewers were successfully added.'
-      redirect_to(plan_my_stuff.edit_issue_path(params[:id], repo: params[:repo]))
-    end
-
-    # DELETE /issues/:id/remove_viewer
-    def remove_viewer
-      unless support_user?
-        redirect_to_unauthorized(plan_my_stuff.issue_path(params[:id], repo: params[:repo]))
-        return
-      end
-
-      viewer_id = params[:viewer_id].to_i
-      PMS::Issue.remove_viewers(number: params[:id].to_i, user_ids: [viewer_id], repo: params[:repo])
-
-      flash[:success] = 'Viewer was successfully removed.'
-      redirect_to(plan_my_stuff.edit_issue_path(params[:id], repo: params[:repo]))
+    rescue PMS::ValidationError => e
+      @support_user = support_user?
+      flash.now[:error] = e.message
+      render(:edit, status: PMS.unprocessable_status)
     end
 
     private
@@ -135,7 +89,6 @@ module PlanMyStuff
       end
 
       # Filters comments to only those visible to the current user.
-      # Falls back to showing all comments if no current_user is available.
       #
       # @param comments [Array<PlanMyStuff::Comment>]
       #
@@ -143,9 +96,23 @@ module PlanMyStuff
       #
       def filter_visible_comments(comments)
         user = pms_current_user
-        return comments unless user
-
         comments.select { |comment| comment.visible_to?(user) }
       end
+
+      # Looks up the pipeline ProjectItem for this issue, if any.
+      # Returns nil when the item cannot be loaded for any reason --
+      # issue show should never break because the pipeline lookup
+      # failed.
+      #
+      # @param issue_number [Integer]
+      #
+      # @return [PlanMyStuff::ProjectItem, nil]
+      #
+      def load_pipeline_item(issue_number)
+        PMS::Pipeline::IssueLinker.find_project_item(issue_number)
+      rescue ArgumentError, PMS::Error => e
+        Rails.logger.warn("[PlanMyStuff] Failed to load pipeline item for issue ##{issue_number}: #{e.message}")
+        nil
+      end
   end
 end

data/app/controllers/plan_my_stuff/labels_controller.rb

@@ -3,7 +3,7 @@
 module PlanMyStuff
   class LabelsController < ApplicationController
     # POST /issues/:issue_id/labels
-    def add_to_issue
+    def create
       labels = parse_labels(params[:label_name])
       if labels.blank?
         flash[:error] = 'Label name is required.'
@@ -18,10 +18,10 @@ module PlanMyStuff
       redirect_to(plan_my_stuff.issue_path(issue.number, repo: issue.repo.full_name))
     end
 
-    # DELETE /issues/:issue_id/labels/:name
-    def remove_from_issue
+    # DELETE /issues/:issue_id/labels/:id
+    def destroy
       issue = PMS::Issue.find(params[:issue_id].to_i, repo: params[:repo])
-      PMS::Label.remove(issue: issue, labels: [params[:name]])
+      PMS::Label.remove(issue: issue, labels: [params[:id]])
 
       flash[:success] = 'Label was successfully removed.'
       redirect_to(plan_my_stuff.issue_path(issue.number, repo: issue.repo.full_name))

data/app/controllers/plan_my_stuff/project_items/assignments_controller.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module PlanMyStuff
+  module ProjectItems
+    # Handles assigning and unassigning project item assignees via CRUD-style routes.
+    # Backs the assign/unassign forms on the project board view (T-047).
+    #
+    # PATCH  /projects/:project_id/items/:item_id/assignment -> update (assign)
+    # DELETE /projects/:project_id/items/:item_id/assignment -> destroy (unassign)
+    #
+    class AssignmentsController < ApplicationController
+      # PATCH /projects/:project_id/items/:item_id/assignment
+      def update
+        item = find_project_item
+        assignees = parse_assignees(params[:assignee])
+
+        item.assign!(assignees)
+
+        flash[:success] = "Item assigned to #{assignees.join(', ')}."
+        redirect_to(plan_my_stuff.project_path(params[:project_id]))
+      rescue ArgumentError, PMS::Error => e
+        flash[:error] = e.message
+        redirect_to(plan_my_stuff.project_path(params[:project_id]))
+      end
+
+      # DELETE /projects/:project_id/items/:item_id/assignment
+      def destroy
+        if params[:username].blank?
+          flash[:error] = 'Username is required to unassign.'
+          redirect_to(plan_my_stuff.project_path(params[:project_id]))
+          return
+        end
+
+        item = find_project_item
+        current_assignees = item.field_values['Assignees'] || []
+        remaining = current_assignees - [params[:username]]
+
+        item.assign!(remaining)
+
+        flash[:success] = "#{params[:username]} unassigned."
+        redirect_to(plan_my_stuff.project_path(params[:project_id]))
+      rescue ArgumentError, PMS::Error => e
+        flash[:error] = e.message
+        redirect_to(plan_my_stuff.project_path(params[:project_id]))
+      end
+
+      private
+
+        # Finds the project item by item_id within the given project.
+        #
+        # @return [PlanMyStuff::ProjectItem]
+        #
+        def find_project_item
+          project = PMS::Project.find(params[:project_id].to_i)
+          item = project.items.find { |i| i.id == params[:item_id] }
+
+          raise(PMS::APIError, "Item not found: #{params[:item_id]}") unless item
+
+          item
+        end
+
+        # Splits a comma-separated assignees string into an array.
+        #
+        # @param assignees_string [String, nil]
+        #
+        # @return [Array<String>]
+        #
+        def parse_assignees(assignees_string)
+          return [] if assignees_string.blank?
+
+          assignees_string.split(',').filter_map { |a| a.strip.presence }
+        end
+    end
+  end
+end