Task API
REST API for task management with JWT authentication, role- and ownership-based access control, data validation and a test suite. The system models users and tasks on PostgreSQL and is fully dockerized.
My role
Task API is designed as a solid, reusable backend foundation for any task management application. The architecture separates HTTP transport from business logic and data access, so each responsibility stays isolated and is easy to test and maintain. Authentication, role- and ownership-based access control, data validation and Docker packaging all build on top of that structure.
- REST API in Express (TypeScript): design of the authentication endpoints and the task CRUD, with a modular architecture (routes → controller → service) that separates HTTP transport from business logic.
- Authentication and authorization: sign-up and login with bcrypt-hashed passwords and JSON Web Token issuance; authentication middleware protecting private routes and a role scheme (USER / ADMIN) with ownership, so each user only accesses their own tasks and the admin accesses all.
- Data layer with Prisma + PostgreSQL: data model for users and tasks with versioned migrations, relations and cascade deletes, resolving access control in the service layer.
- Validation and error handling: input validation with Zod at the edge of each operation and a centralized error handler returning uniform responses.
- Testing: unit tests of the service with Prisma mocked and end-to-end tests with Supertest against a real test database.
- DevOps: containerization with a multi-stage Dockerfile and orchestration of the API + PostgreSQL with docker-compose, applying migrations automatically on startup.
Key features
- User authentication with sign-up and login, hashed passwords (bcrypt) and JSON Web Token-based sessions.
- Role-based (USER / ADMIN) and ownership access control: each user manages only their tasks; the admin accesses all.
- Full task CRUD (create, list, detail, edit and delete) with statuses (TODO, IN_PROGRESS, DONE).
- Input data validation with Zod and centralized error handling with uniform responses.
- Unit (service) and end-to-end (Supertest) test suite covering authentication and CRUD.
- Reproducible environment with Docker: API + PostgreSQL in a single command, with automatic migrations on startup.
Impact
The result is a robust, typed and secure API that serves as a solid foundation for any task management application. Role- and ownership-based access control ensures each user only operates on their own data, while validation and centralized error handling keep responses consistent. The combination of automated tests and a fully dockerized setup makes it possible to spin up the project and verify it works correctly with a single command, easing development, review and deployment.
Technologies
| Technology | Use / Implementation |
|---|---|
| Node.js · Express | Server and REST API, with a modular architecture (routes, controllers and services). |
| TypeScript | Static typing across the whole project for greater robustness and maintainability. |
| Prisma | ORM and versioned migrations over PostgreSQL; modeling of users and tasks. |
| PostgreSQL | Relational database for users and tasks. |
| JWT + bcrypt | Token-based authentication and secure password hashing. |
| Zod | Data validation at the edge of each API operation. |
| Vitest + Supertest | Unit tests of the service and end-to-end tests of the endpoints. |
| Docker + docker-compose | Containerization of the API and PostgreSQL, with automatic migrations on startup. |