trueppm-api 0.4.0__py3-none-any.whl

trueppm_api/apps/taskruns/tracker.py

@@ -0,0 +1,286 @@
+"""TaskRunTracker — context manager for reporting Celery task progress.
+
+Usage inside a Celery task::
+
+    @shared_task(bind=True)
+    def import_mpp(self, project_id, file_id):
+        with TaskRunTracker(self, project_id=project_id,
+                            task_name="import.mpp") as tracker:
+            tracker.update(10, "Parsing MPP file...")
+            tracker.update(80, "Creating tasks...")
+            tracker.set_result({"tasks_created": 487})
+
+Progress updates are debounced to at most 1 DB write + WebSocket broadcast per second,
+using a Redis key to track the last-update timestamp.
+
+Cancellation is signalled by writing a Redis key (set by the cancel API endpoint).
+The tracker checks this key on every ``update()`` call and raises ``TaskCancelled``
+if found, which the context manager catches and marks the run CANCELLED.
+"""
+
+from __future__ import annotations
+
+import logging
+import time
+from typing import Any
+
+from django.db import transaction
+from django.utils import timezone
+
+# Module-level import so tests can patch trueppm_api.apps.taskruns.tracker.broadcast_board_event.
+from trueppm_api.apps.sync.broadcast import broadcast_board_event
+
+logger = logging.getLogger(__name__)
+
+# Redis key patterns (both expire automatically).
+_DEBOUNCE_KEY = "task_run_debounce:{task_run_id}"
+_CANCEL_KEY = "task_run_cancel:{task_run_id}"
+_DEBOUNCE_TTL = 10  # seconds — key expires shortly after task completes
+_CANCEL_TTL = 300  # seconds
+
+
+class TaskCancelled(Exception):
+    """Raised inside a task when a cancellation signal is detected."""
+
+
+class TaskRunTracker:
+    """Context manager that creates/updates a TaskRun record and broadcasts events.
+
+    Args:
+        celery_task: The bound Celery task instance (``self`` inside the task).
+        project_id: UUID string of the associated Project, or None for global tasks.
+        task_name: Human-readable identifier (e.g. ``"scheduling.recalculate"``).
+        initiated_by_id: PK of the user who triggered the task, or None.
+    """
+
+    def __init__(
+        self,
+        celery_task: Any,
+        *,
+        project_id: str | None = None,
+        task_name: str = "",
+        initiated_by_id: Any = None,
+    ) -> None:
+        self._celery_task = celery_task
+        self._project_id = project_id
+        self._task_name = task_name or celery_task.name
+        self._initiated_by_id = initiated_by_id
+        self._task_run_id: str | None = None
+        self._result: dict[str, Any] | None = None
+        self._redis: Any = None
+
+    # ------------------------------------------------------------------
+    # Context manager protocol
+    # ------------------------------------------------------------------
+
+    def __enter__(self) -> TaskRunTracker:
+        from trueppm_api.apps.taskruns.models import TaskRun, TaskRunStatus
+
+        task_run = TaskRun.objects.create(
+            task_name=self._task_name,
+            celery_task_id=self._celery_task.request.id or "",
+            project_id=self._project_id,
+            initiated_by_id=self._initiated_by_id,
+            status=TaskRunStatus.RUNNING,
+            started_at=timezone.now(),
+        )
+        self._task_run_id = str(task_run.pk)
+
+        self._redis = self._get_redis()
+
+        self._broadcast(
+            "task_run_started",
+            {
+                "task_run_id": self._task_run_id,
+                "task_name": self._task_name,
+                "project_id": self._project_id,
+            },
+        )
+        return self
+
+    def __exit__(
+        self,
+        exc_type: type[BaseException] | None,
+        exc_val: BaseException | None,
+        exc_tb: object,
+    ) -> bool:
+        from trueppm_api.apps.taskruns.models import TaskRun, TaskRunStatus
+
+        if self._task_run_id is None:
+            return False
+
+        task_run = TaskRun.objects.filter(pk=self._task_run_id).first()
+        if task_run is None:
+            return False
+
+        now = timezone.now()
+
+        if exc_type is TaskCancelled:
+            task_run.status = TaskRunStatus.CANCELLED
+            task_run.completed_at = now
+            task_run.save(update_fields=["status", "completed_at"])
+            self._cleanup_redis()
+            self._broadcast("task_run_cancelled", {"task_run_id": self._task_run_id})
+            return True  # suppress exception
+
+        if exc_val is not None:
+            task_run.status = TaskRunStatus.FAILED
+            task_run.error_detail = str(exc_val)
+            task_run.completed_at = now
+            task_run.save(update_fields=["status", "error_detail", "completed_at"])
+            self._cleanup_redis()
+            self._broadcast(
+                "task_run_failed",
+                {
+                    "task_run_id": self._task_run_id,
+                    "error_detail": str(exc_val),
+                },
+            )
+            return False  # re-raise
+
+        task_run.status = TaskRunStatus.SUCCESS
+        task_run.progress_pct = 100
+        task_run.result_summary = self._result
+        task_run.completed_at = now
+        task_run.save(
+            update_fields=[
+                "status",
+                "progress_pct",
+                "result_summary",
+                "completed_at",
+            ]
+        )
+        self._cleanup_redis()
+        self._broadcast(
+            "task_run_completed",
+            {
+                "task_run_id": self._task_run_id,
+                "result_summary": self._result,
+            },
+        )
+        return False
+
+    # ------------------------------------------------------------------
+    # Public API
+    # ------------------------------------------------------------------
+
+    def update(self, pct: int, msg: str = "") -> None:
+        """Report progress.  Debounced to at most 1 write/second.
+
+        Raises:
+            TaskCancelled: if a cancel signal has been set for this run.
+        """
+        if self._task_run_id is None:
+            return
+
+        # Check for cancellation signal first.
+        self._check_cancelled()
+
+        # Debounce: skip if updated less than 1s ago.
+        if self._debounced():
+            return
+
+        from trueppm_api.apps.taskruns.models import TaskRun
+
+        TaskRun.objects.filter(pk=self._task_run_id).update(
+            progress_pct=pct,
+            progress_msg=msg,
+        )
+        self._broadcast(
+            "task_run_progress",
+            {
+                "task_run_id": self._task_run_id,
+                "pct": pct,
+                "msg": msg,
+            },
+        )
+
+    def set_result(self, result: dict[str, Any]) -> None:
+        """Store the result summary to be saved on successful exit."""
+        self._result = result
+
+    @property
+    def task_run_id(self) -> str | None:
+        """UUID string of the active TaskRun, available after __enter__."""
+        return self._task_run_id
+
+    # ------------------------------------------------------------------
+    # Internal helpers
+    # ------------------------------------------------------------------
+
+    def _get_redis(self) -> Any:
+        try:
+            from trueppm_api.core import valkey
+
+            return valkey.client(valkey.DB_CELERY, decode_responses=True)
+        except Exception:
+            return None
+
+    def _check_cancelled(self) -> None:
+        """Raise ``TaskCancelled`` if a cancel signal is set; no-op if Redis is down."""
+        if self._redis is None:
+            return
+        cancel_key = _CANCEL_KEY.format(task_run_id=self._task_run_id)
+        try:
+            if self._redis.exists(cancel_key):
+                raise TaskCancelled()
+        except TaskCancelled:
+            raise
+        except Exception:
+            pass  # Redis unavailable — continue without cancel check
+
+    def _debounced(self) -> bool:
+        """Return ``True`` when the last write was <1s ago (skip this update).
+
+        Records the current timestamp when the update is allowed to proceed. If
+        Redis is unavailable the update is never debounced.
+        """
+        if self._redis is None:
+            return False
+        debounce_key = _DEBOUNCE_KEY.format(task_run_id=self._task_run_id)
+        try:
+            now_ts = time.monotonic()
+            last_ts_bytes = self._redis.get(debounce_key)
+            if last_ts_bytes is not None:
+                last_ts = float(last_ts_bytes)
+                if now_ts - last_ts < 1.0:
+                    return True
+            self._redis.set(debounce_key, now_ts, ex=_DEBOUNCE_TTL)
+        except Exception:
+            pass  # Redis unavailable — proceed without debounce
+        return False
+
+    def _cleanup_redis(self) -> None:
+        if self._redis is None or self._task_run_id is None:
+            return
+        try:
+            debounce_key = _DEBOUNCE_KEY.format(task_run_id=self._task_run_id)
+            cancel_key = _CANCEL_KEY.format(task_run_id=self._task_run_id)
+            self._redis.delete(debounce_key, cancel_key)
+        except Exception:
+            # Best-effort teardown; failure must not crash the tracker (keys carry a TTL)
+            pass
+
+    def _broadcast(self, event_type: str, payload: dict[str, Any]) -> None:
+        if self._project_id is None:
+            return
+        # Defer the broadcast to commit (#1323). The tracker runs in a Celery task
+        # with no ambient transaction today, so on_commit fires the callback
+        # immediately and behavior is unchanged — but if a future caller ever runs
+        # tracker.update() inside transaction.atomic(), this guarantees peers never
+        # see a progress event for a write that then rolls back. Snapshot to plain
+        # locals and keep the best-effort guard *inside* the deferred callable so a
+        # commit-time channel-layer failure is still swallowed, not raised.
+        project_id = self._project_id
+
+        def _emit() -> None:
+            try:
+                broadcast_board_event(
+                    project_id=project_id,
+                    event_type=event_type,
+                    payload=payload,
+                )
+            except Exception as exc:
+                logger.warning("TaskRunTracker: broadcast failed: %s", exc)
+
+        transaction.on_commit(_emit)

trueppm_api/apps/taskruns/urls.py

@@ -0,0 +1,46 @@
+"""URL configuration for taskruns app."""
+
+from __future__ import annotations
+
+from django.urls import path
+from rest_framework.routers import DefaultRouter
+
+from trueppm_api.apps.taskruns.views import (
+    GlobalTaskRunViewSet,
+    ProjectSchedulerRunViewSet,
+    ProjectTaskRunViewSet,
+)
+
+# Global task-run endpoints: /task-runs/<id>/ and /task-runs/active/.
+router = DefaultRouter()
+router.register(r"task-runs", GlobalTaskRunViewSet, basename="task-run")
+
+urlpatterns = [
+    # Nested under /projects/<project_pk>/task-runs/
+    path(
+        "projects/<project_pk>/task-runs/",
+        ProjectTaskRunViewSet.as_view({"get": "list"}),
+        name="project-task-runs-list",
+    ),
+    path(
+        "projects/<project_pk>/task-runs/<pk>/",
+        ProjectTaskRunViewSet.as_view({"get": "retrieve"}),
+        name="project-task-runs-detail",
+    ),
+    path(
+        "projects/<project_pk>/task-runs/<pk>/cancel/",
+        ProjectTaskRunViewSet.as_view({"post": "cancel"}),
+        name="project-task-runs-cancel",
+    ),
+    path(
+        "projects/<project_pk>/scheduler-runs/",
+        ProjectSchedulerRunViewSet.as_view({"get": "list"}),
+        name="project-scheduler-runs-list",
+    ),
+    path(
+        "projects/<project_pk>/scheduler-runs/<pk>/",
+        ProjectSchedulerRunViewSet.as_view({"get": "retrieve"}),
+        name="project-scheduler-runs-detail",
+    ),
+    *router.urls,
+]

trueppm_api/apps/taskruns/views.py

@@ -0,0 +1,195 @@
+"""Views for task run progress tracking API."""
+
+from __future__ import annotations
+
+from django.db.models import QuerySet
+from drf_spectacular.utils import OpenApiResponse, extend_schema
+from rest_framework import status
+from rest_framework.decorators import action
+from rest_framework.mixins import ListModelMixin, RetrieveModelMixin
+from rest_framework.permissions import BasePermission, IsAuthenticated
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.viewsets import GenericViewSet, ReadOnlyModelViewSet
+
+from trueppm_api.apps.access.permissions import IsProjectAdmin, IsProjectMember
+from trueppm_api.apps.idempotency.mixins import IdempotencyMixin
+from trueppm_api.apps.taskruns.models import TaskRun, TaskRunStatus
+from trueppm_api.apps.taskruns.serializers import SchedulerRunSerializer, TaskRunSerializer
+
+# Task name written by scheduling.tasks.recalculate_schedule via TaskRunTracker.
+# The scheduler-runs endpoint is a typed thin view over TaskRun filtered on this.
+SCHEDULER_TASK_NAME = "scheduling.recalculate"
+
+
+class ProjectTaskRunViewSet(
+    IdempotencyMixin, ListModelMixin, RetrieveModelMixin, GenericViewSet[TaskRun]
+):
+    """List and retrieve TaskRuns scoped to a project.
+
+    List/retrieve: Viewer+ (IsProjectMember).
+    Cancel: Admin+ (IsProjectAdmin).
+    """
+
+    serializer_class = TaskRunSerializer
+    # Exempt from the archived-write invariant (#3414). `cancel` is the viewset's only
+    # unsafe method and it writes no project data — it sets a Valkey cancel flag and
+    # revokes a Celery task. A run can still be in flight when the project is archived
+    # (archiving does not drain the queue), and gating the stop signal would leave an
+    # Admin unable to halt a job on a plan they just froze — the same catch-22 the
+    # `unarchive` bypass exists to avoid.
+    archived_write_exempt = (
+        "cancel signals an in-flight run to stop and writes no project state; blocking "
+        "it would strand a run started before the archive with no way to halt it"
+    )
+
+    def get_permissions(self) -> list[BasePermission]:
+        if self.action == "cancel":
+            return [IsAuthenticated(), IsProjectAdmin()]
+        return [IsAuthenticated(), IsProjectMember()]
+
+    def get_queryset(self) -> QuerySet[TaskRun]:
+        project_pk = self.kwargs["project_pk"]
+        # select_related('project') so the cancel action (obj.project) avoids an
+        # extra query per retrieved instance.
+        return TaskRun.objects.filter(project_id=project_pk).select_related("project")
+
+    def get_object(self) -> TaskRun:
+        obj: TaskRun = super().get_object()
+        self.check_object_permissions(self.request, obj.project)
+        return obj
+
+    @extend_schema(
+        summary="Cancel a task run",
+        responses={
+            202: OpenApiResponse(description="Cancellation requested. Body: {'detail': str}."),
+            409: OpenApiResponse(description="Task run is not active (not PENDING or RUNNING)."),
+        },
+    )
+    @action(detail=True, methods=["post"], url_path="cancel")
+    def cancel(self, request: Request, **kwargs: object) -> Response:
+        """Signal cancellation for a running task."""
+        task_run = self.get_object()
+
+        if task_run.status not in (TaskRunStatus.PENDING, TaskRunStatus.RUNNING):
+            return Response(
+                {"detail": "Task run is not active."},
+                status=status.HTTP_409_CONFLICT,
+            )
+
+        from trueppm_api.apps.taskruns.tracker import _CANCEL_KEY, _CANCEL_TTL
+        from trueppm_api.core import valkey
+
+        try:
+            r = valkey.client(valkey.DB_CELERY, decode_responses=True)
+            cancel_key = _CANCEL_KEY.format(task_run_id=str(task_run.pk))
+            r.set(cancel_key, "1", ex=_CANCEL_TTL)
+        except Exception:
+            pass  # Best-effort; tracker will also check on next update
+
+        # Also revoke the Celery task to interrupt it if it hasn't started yet.
+        if task_run.celery_task_id:
+            try:
+                from celery import current_app
+
+                current_app.control.revoke(task_run.celery_task_id, terminate=False)
+            except Exception:
+                # Best-effort; the Redis cancel flag above is the authoritative stop signal
+                pass
+
+        return Response({"detail": "Cancellation requested."}, status=status.HTTP_202_ACCEPTED)
+
+
+class GlobalTaskRunViewSet(ReadOnlyModelViewSet[TaskRun]):
+    """Global task run access — detail by UUID and active runs across projects.
+
+    Active runs are scoped to projects where the requesting user is a member.
+    This is a personal in-flight view, not a PMO rollup.
+    """
+
+    serializer_class = TaskRunSerializer
+    permission_classes = [IsAuthenticated]
+
+    def get_queryset(self) -> QuerySet[TaskRun]:
+        from django.contrib.auth.models import AbstractBaseUser
+
+        from trueppm_api.apps.access.models import ProjectMembership
+
+        user = self.request.user
+        # Scope to projects the user is a member of. AnonymousUser is excluded
+        # by IsAuthenticated before this is called, but mypy needs the cast.
+        if not isinstance(user, AbstractBaseUser):
+            return TaskRun.objects.none()
+        # is_deleted=False (#819 sibling): without this, a user whose
+        # membership was soft-deleted still sees task-run history (including
+        # scheduler-run audit metadata) for projects they were removed from.
+        # Same pattern fixed in VelocitySuggestionViewSet.get_queryset.
+        project_ids = ProjectMembership.objects.filter(
+            user=user, is_deleted=False, project__is_deleted=False
+        ).values_list("project_id", flat=True)
+        return TaskRun.objects.filter(project_id__in=project_ids)
+
+    @extend_schema(
+        summary="List active task runs",
+        responses={200: TaskRunSerializer(many=True)},
+    )
+    @action(detail=False, methods=["get"], url_path="active")
+    def active(self, request: Request) -> Response:
+        """Return PENDING + RUNNING task runs across the user's projects.
+
+        Paginated (#1317): the ``list`` action already pages through the project
+        default, but this custom action returned the full set — across many
+        projects with long-running recalcs that is unbounded.
+        """
+        qs = self.get_queryset().filter(status__in=[TaskRunStatus.PENDING, TaskRunStatus.RUNNING])
+        page = self.paginate_queryset(qs)
+        if page is not None:
+            return self.get_paginated_response(self.get_serializer(page, many=True).data)
+        return Response(self.get_serializer(qs, many=True).data)
+
+
+class ProjectSchedulerRunViewSet(ListModelMixin, RetrieveModelMixin, GenericViewSet[TaskRun]):
+    """Scheduler recalculation history for a project.
+
+    Thin typed view over TaskRun filtered to ``task_name='scheduling.recalculate'``.
+    Used by the Shell's "last recalculated" indicator and for SOC 2 audit evidence
+    (filter by status / date range, read-only).
+
+    Query params:
+        status: one or more TaskRunStatus values (repeat: ?status=success&status=failed)
+        started_after: ISO-8601 datetime — include runs with started_at >= this
+        started_before: ISO-8601 datetime — include runs with started_at <= this
+        ordering: created_at | -created_at (default: -created_at)
+    """
+
+    serializer_class = SchedulerRunSerializer
+    permission_classes = [IsAuthenticated, IsProjectMember]
+
+    def get_queryset(self) -> QuerySet[TaskRun]:
+        project_pk = self.kwargs["project_pk"]
+        qs = TaskRun.objects.filter(
+            project_id=project_pk, task_name=SCHEDULER_TASK_NAME
+        ).select_related("initiated_by")
+
+        statuses = self.request.query_params.getlist("status")
+        valid = {s.value for s in TaskRunStatus}
+        statuses = [s for s in statuses if s in valid]
+        if statuses:
+            qs = qs.filter(status__in=statuses)
+
+        started_after = self.request.query_params.get("started_after")
+        if started_after:
+            qs = qs.filter(started_at__gte=started_after)
+        started_before = self.request.query_params.get("started_before")
+        if started_before:
+            qs = qs.filter(started_at__lte=started_before)
+
+        ordering = self.request.query_params.get("ordering", "-created_at")
+        if ordering not in ("created_at", "-created_at"):
+            ordering = "-created_at"
+        return qs.order_by(ordering)
+
+    def get_object(self) -> TaskRun:
+        obj: TaskRun = super().get_object()
+        self.check_object_permissions(self.request, obj.project)
+        return obj

trueppm_api/apps/teams/__init__.py

@@ -0,0 +1,8 @@
+"""Teams app (ADR-0078, OSS) — the Scrum team that owns a sprint commitment.
+
+0.3 minimal slice (#927): the ``Team`` entity with one auto-created default team
+per project, plus ``TeamMembership`` carrying the two-axis model — an ordinal
+access role (Member/Admin) and two independent facets (``is_scrum_master``,
+``is_product_owner``). Multi-team UX, sprint/task team binding, and the MCP
+per-team opt-in stay in #599 (0.6).
+"""

trueppm_api/apps/teams/apps.py

@@ -0,0 +1,16 @@
+"""App config for the teams app (ADR-0078)."""
+
+from __future__ import annotations
+
+from django.apps import AppConfig
+
+
+class TeamsConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "trueppm_api.apps.teams"
+
+    def ready(self) -> None:
+        # Import for side effect: the auto-membership invariant (ADR-0078 §F).
+        # A ProjectMembership write mirrors onto the project's default team so a
+        # new project member never sees a second "join the team" step.
+        from trueppm_api.apps.teams import signals  # noqa: F401

trueppm_api/apps/teams/migrations/0001_initial.py

@@ -0,0 +1,139 @@
+# Generated by Django 5.2.14 on 2026-06-03 11:19
+
+import uuid
+
+import django.db.models.deletion
+import django.utils.timezone
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    initial = True
+
+    dependencies = [
+        ("projects", "0057_historicalsprint_binding_committed_snapshot_and_more"),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="Team",
+            fields=[
+                (
+                    "id",
+                    models.UUIDField(
+                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
+                    ),
+                ),
+                ("server_version", models.BigIntegerField(default=0, editable=False)),
+                ("is_deleted", models.BooleanField(db_index=True, default=False)),
+                ("deleted_version", models.BigIntegerField(blank=True, editable=False, null=True)),
+                ("name", models.CharField(max_length=255)),
+                ("short_id", models.CharField(max_length=8)),
+                ("description", models.TextField(blank=True, default="")),
+                ("is_default", models.BooleanField(db_index=True, default=False)),
+                (
+                    "created_at",
+                    models.DateTimeField(default=django.utils.timezone.now, editable=False),
+                ),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                (
+                    "created_by",
+                    models.ForeignKey(
+                        blank=True,
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        related_name="created_teams",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+                (
+                    "project",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="teams",
+                        to="projects.project",
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "teams_team",
+            },
+        ),
+        migrations.CreateModel(
+            name="TeamMembership",
+            fields=[
+                (
+                    "id",
+                    models.UUIDField(
+                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
+                    ),
+                ),
+                ("server_version", models.BigIntegerField(default=0, editable=False)),
+                ("is_deleted", models.BooleanField(db_index=True, default=False)),
+                ("deleted_version", models.BigIntegerField(blank=True, editable=False, null=True)),
+                (
+                    "role",
+                    models.CharField(
+                        choices=[("member", "Member"), ("admin", "Admin")],
+                        default="member",
+                        max_length=16,
+                    ),
+                ),
+                ("is_scrum_master", models.BooleanField(default=False)),
+                ("is_product_owner", models.BooleanField(default=False)),
+                (
+                    "created_at",
+                    models.DateTimeField(default=django.utils.timezone.now, editable=False),
+                ),
+                (
+                    "team",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="memberships",
+                        to="teams.team",
+                    ),
+                ),
+                (
+                    "user",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="team_memberships",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "teams_team_membership",
+            },
+        ),
+        migrations.AddConstraint(
+            model_name="team",
+            constraint=models.UniqueConstraint(
+                condition=models.Q(("is_deleted", False)),
+                fields=("project", "name"),
+                name="team_name_per_project_unique",
+            ),
+        ),
+        migrations.AddConstraint(
+            model_name="team",
+            constraint=models.UniqueConstraint(
+                condition=models.Q(("is_default", True), ("is_deleted", False)),
+                fields=("project",),
+                name="team_one_default_per_project",
+            ),
+        ),
+        migrations.AddIndex(
+            model_name="teammembership",
+            index=models.Index(fields=["team", "user"], name="tm_team_user_idx"),
+        ),
+        migrations.AddConstraint(
+            model_name="teammembership",
+            constraint=models.UniqueConstraint(
+                condition=models.Q(("is_deleted", False)),
+                fields=("team", "user"),
+                name="team_member_unique",
+            ),
+        ),
+    ]