Shouldn't update type in task PUT

src/server/api.coffee

@@ -54,12 +54,18 @@ router.get '/task/:id', auth, (req, res) ->
 
 validateTask = (req, res, next) ->
   task = {}
+  newTask = { type, text, notes, value, up, down, completed } = req.body
+
   # If we're updating, get the task from the user
   if req.method is 'PUT'
     task = req.userObj?.tasks[req.params.id]
     return res.json 400, err: "No task found." if !task || _.isEmpty(task)
-
-  newTask = { type, text, notes, value, up, down, completed } = req.body
+    # Strip for now
+    type = undefined
+    delete newTask.type
+  else if req.method is 'POST'
+    unless /^habit|todo|daily|reward$/.test type
+      return res.json 400, err: 'type must be habit, todo, daily, or reward'
 
   text = sanitize(text).xss()
   notes = sanitize(notes).xss()
@@ -85,9 +91,6 @@ router.post '/user/task', auth, validateTask, (req, res) ->
   task = req.task
   type = task.type
 
-  unless /^habit|todo|daily|reward$/.test type
-    return res.json 400, err: 'type must be habit, todo, daily, or reward'
-
   model = req.getModel()
   model.ref '_user', req.user
   model.refList "_#{type}List", "_user.tasks", "_user.#{type}Ids"

test/api.mocha.coffee

@@ -175,8 +175,23 @@ describe 'API', ->
           expect(res.body).to.eql currentUser.tasks[tid]
           done()
 
+    it 'PUT /api/v1/task/:id (shouldnt update type)', (done) ->
+      tid = _.pluck(currentUser.tasks, 'id')[1]
+      type = if currentUser.tasks[tid].type is 'habit' then 'daily' else 'habit'
+      request.put("#{baseURL}/task/#{tid}")
+        .set('Accept', 'application/json')
+        .set('X-API-User', currentUser.id)
+        .set('X-API-Key', currentUser.apiToken)
+        .send(type: type, text: 'fishman')
+        .end (res) ->
+          expect(res.body.err).to.be undefined
+          expect(res.statusCode).to.be 200
+          currentUser.tasks[tid].text = 'fishman'
+          expect(res.body).to.eql currentUser.tasks[tid]
+          done()
+
     it 'PUT /api/v1/task/:id (update notes)', (done) ->
-      tid = _.pluck(currentUser.tasks, 'id')[0]
+      tid = _.pluck(currentUser.tasks, 'id')[2]
       request.put("#{baseURL}/task/#{tid}")
         .set('Accept', 'application/json')
         .set('X-API-User', currentUser.id)