OUT-2898 | Show tasks assigned to clients within a company on company details page

[arpandhakal]

Summary

• When an internal user enters CRM preview mode for a company, also include tasks assigned to clients of that company (TEAM TASKS) and IU tasks shared with those clients (SHARED WITH TEAM). Previously only tasks assigned to the company itself and IU tasks shared with the company were visible.
• Mirrored the same access rule in CommentService so comments stay aligned with task visibility (and fixed a latent strict parse(clientId) that would have thrown for any company-only auth context).
• The shared task/comment filter is now async; copilot.getCompanyClients is only called in the new IU-company-preview branch and the result is memoized per request to avoid duplicate calls.

Context

Linear: OUT-2898

Today the company-details CRM view shows:

1. Tasks assigned to the company
2. IU tasks shared with the company

This PR adds:
3. Tasks assigned to clients within the company
4. IU tasks shared with those clients

Other flows (client preview, CU portal, normal IU listing) skip the new branch entirely, so they incur no extra I/O — only an await on a synchronously resolved promise.

Test plan

• As an IU, enter CRM preview for a company that has clients with their own tasks → confirm those tasks now appear in the company task list
• In the same view, confirm IU-assigned tasks shared with one of the company's clients appear (SHARED WITH TEAM)
• Existing visibility unchanged: tasks assigned to the company and IU tasks shared with the company still appear
• Open one of the new tasks and confirm comments load (CommentService access path)
• Client preview (an actual CU) still sees only their own + company-shared tasks — no leakage of other clients' tasks
• CU portal user (no internalUserId) does not gain access to other clients' tasks
• Normal IU board listing performance unchanged (no extra Copilot calls in non-preview flows)

Testing

Task assigned to a client of the company is also visible for company CRM. Task associated with a client of the company is also visible for company CRM.

🤖 Generated with Claude Code

[linear-code]

OUT-2898 Show tasks assigned to clients within a company on company details page

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tasks-app	Ready	Preview, Comment	May 7, 2026 6:16am

[greptile-apps]

Greptile Summary

This PR extends the IU company-preview CRM view to include tasks assigned to the company's individual clients (TEAM TASKS) and IU tasks shared with those clients (SHARED WITH TEAM), in addition to the previously visible company-level tasks. CommentService is updated in parallel to keep comment access aligned with task visibility, and the latent parse(clientId) bug is fixed in both places.

• getClientOrCompanyAssigneeFilter becomes async in both TasksSharedService and CommentService, adding a new isIuCompanyPreview branch that calls getCompanyClients and expands the Prisma OR filter to cover client-assigned tasks and client associations.
• All call sites in tasks.service.ts and public/public.service.ts are updated to await the now-async buildTaskPermissions.
• Per-request memoization via _companyClientIdsPromise prevents duplicate Copilot API calls when both the task and comment filters run in the same request.

Confidence Score: 4/5

Safe to merge; the new IU-company-preview branch is isolated and does not affect CU portal or normal IU flows.

The new isIuCompanyPreview branch is correctly gated and the two findings are edge-case hardening items that do not affect correct-token requests in normal operation.

tasksShared.service.ts and comment.service.ts both carry the parse(companyId) asymmetry and duplicate memoization cache.

Important Files Changed

Filename	Overview
src/app/api/tasks/tasksShared.service.ts	Adds async getClientOrCompanyAssigneeFilter with isIuCompanyPreview branch and memoized getCompanyClientIds; minor: parse(companyId) could throw raw ZodError in an invalid-token edge case, and the memoization cache doesn't key by companyId
src/app/api/comments/comment.service.ts	Mirrors the task visibility fix for comments; fixes the latent strict parse(clientId) in this copy of the filter; same parse(companyId) asymmetry remains
src/app/api/tasks/tasks.service.ts	Mechanically adds await to all buildTaskPermissions call sites; no logic changes
src/app/api/tasks/public/public.service.ts	Mechanically adds await to all buildTaskPermissions call sites; no logic changes

_{Reviews (1): Last reviewed commit: "feat(OUT-2898): show tasks assigned to c..." | Re-trigger Greptile}

[greptile-apps]

Strict parse(companyId) not patched alongside clientId

The PR explicitly fixed parse(clientId) → safeParse(clientId).data to handle the company-only auth context. The adjacent z.string().uuid().parse(this.user.companyId) is still strict: if the guard user.clientId || user.companyId fires with only clientId set (e.g., a client token that somehow lacks a companyId), this throws a raw ZodError (500) instead of a clean APIError. The same issue exists at the same line in comment.service.ts.

[vercel]

Deployment failed with the following error:

Deploying Serverless Functions to multiple regions is restricted to the Pro and Enterprise plans.

Learn More: https://vercel.link/multiple-function-regions

[priosshrsth]

lgtm