fix(time-entries): preserve deleted tags in timesheet edits

apps/time_entries/tests/test_views.py

@@ -3,6 +3,7 @@ from datetime import datetime
 from django.utils import timezone
 from rest_framework.test import APIClient
 
+from apps.tags.models import Tag
 from apps.time_entries.models import TimeEntry
 from apps.users.models import User
 from apps.workspaces.models import Workspace
@@ -49,3 +50,91 @@ def test_time_entry_list_returns_grouped_payload_for_ended_entries(db):
     assert len(response.data["groups"]) == 1
     assert len(response.data["groups"][0]["days"]) == 1
     assert response.data["groups"][0]["days"][0]["entries"][0]["id"] == str(first_entry.id)
+
+
+def test_time_entry_update_preserves_current_deleted_tags(db):
+    user = User.objects.create_user(mobile="09127777777", password="secret123")
+    workspace = Workspace.objects.create(name="Core", owner=user)
+    tag = Tag.objects.create(workspace=workspace, name="Legacy Tag", color="#475569")
+    entry = TimeEntry.objects.create(
+        workspace=workspace,
+        user=user,
+        description="Old",
+        start_time=make_aware(2026, 4, 24, 9, 0, 0),
+        end_time=make_aware(2026, 4, 24, 10, 30, 0),
+    )
+    entry.tags.set([tag])
+    tag.delete()
+
+    client = APIClient()
+    client.force_authenticate(user=user)
+
+    response = client.patch(
+        f"/api/time-entries/{entry.id}/",
+        {
+            "description": "Still editable",
+            "tags": [str(tag.id)],
+        },
+        format="json",
+    )
+
+    assert response.status_code == 200
+    assert response.data["description"] == "Still editable"
+    assert response.data["tag_details"][0]["is_deleted"] is True
+
+
+def test_time_entry_update_rejects_new_deleted_tag_attachment(db):
+    user = User.objects.create_user(mobile="09128888888", password="secret123")
+    workspace = Workspace.objects.create(name="Core", owner=user)
+    deleted_tag = Tag.objects.create(workspace=workspace, name="Deleted tag", color="#475569")
+    deleted_tag.delete()
+    entry = TimeEntry.objects.create(
+        workspace=workspace,
+        user=user,
+        description="Entry",
+        start_time=make_aware(2026, 4, 24, 9, 0, 0),
+        end_time=make_aware(2026, 4, 24, 10, 30, 0),
+    )
+
+    client = APIClient()
+    client.force_authenticate(user=user)
+
+    response = client.patch(
+        f"/api/time-entries/{entry.id}/",
+        {
+            "tags": [str(deleted_tag.id)],
+        },
+        format="json",
+    )
+
+    assert response.status_code == 400
+    assert "unavailable" in response.data["error"].lower()
+
+
+def test_time_entry_update_can_remove_current_deleted_tag(db):
+    user = User.objects.create_user(mobile="09129999999", password="secret123")
+    workspace = Workspace.objects.create(name="Core", owner=user)
+    deleted_tag = Tag.objects.create(workspace=workspace, name="Deleted tag", color="#475569")
+    entry = TimeEntry.objects.create(
+        workspace=workspace,
+        user=user,
+        description="Entry",
+        start_time=make_aware(2026, 4, 24, 9, 0, 0),
+        end_time=make_aware(2026, 4, 24, 10, 30, 0),
+    )
+    entry.tags.set([deleted_tag])
+    deleted_tag.delete()
+
+    client = APIClient()
+    client.force_authenticate(user=user)
+
+    response = client.patch(
+        f"/api/time-entries/{entry.id}/",
+        {
+            "tags": [],
+        },
+        format="json",
+    )
+
+    assert response.status_code == 200
+    assert response.data["tags"] == []