📝 Express Task Management API

A production-quality, secure REST API for task management built with Node.js, Express.js, and MongoDB. Features JWT authentication, role-less per-user task ownership, input validation, centralized error handling, a clean service-layer architecture, automated tests.

---

✨ Features

• ✅ User Authentication — Register, login, logout with JWT (httpOnly cookies + Bearer tokens)
• ✅ Refresh Token Rotation — /auth/refresh issues new token pairs
• ✅ Task CRUD — Create, read, update, delete, and status updates
• ✅ Ownership Enforcement — Every user only sees/manipulates their own tasks
• ✅ Validation — express-validator on every input
• ✅ Pagination & Filtering — page, limit, status, priority, search, date-range, sorting
• ✅ Task Statistics — total / pending / in-progress / completed / overdue
• ✅ Soft Delete — tasks are tombstoned (deletedAt), not destroyed
• ✅ Security — Helmet, CORS, rate limiting, bcrypt hashing, payload limits, secure cookies
• ✅ Centralized Error Handling — consistent { success, message, errors } shape
• ✅ Clean Architecture — routes → controllers → services → models
• ✅ Automated Tests — Jest + Supertest against an in-memory MongoDB

---

🛠 Tech Stack

Layer	Technology
Runtime	Node.js
Framework	Express.js
Database	MongoDB
Auth	JWT + bcrypt
Validation	express-validator
Security	helmet, cors, express-rate-limit, cookie-parser
Logging	morgan
Env	dotenv
Testing	Jest, Supertest, mongodb-memory-server
Quality	ESLint, Prettier

---

🌐 Live API

The API is deployed and publicly accessible at:

Base URL: https://task-management-vznr.onrender.com

• All endpoints below are relative to this base URL.

---

🔗 API Endpoints

Method	Endpoint	Auth	Description
POST	/api/auth/register	No	Register a user
POST	/api/auth/login	No	Login
POST	/api/auth/logout	Yes	Logout
POST	/api/auth/refresh	No	Rotate refresh token
GET	/api/tasks	Yes	List tasks (filter/paginate)
POST	/api/tasks	Yes	Create a task
GET	/api/tasks/stats	Yes	Task statistics
GET	/api/tasks/:id	Yes	Get one task
PUT	/api/tasks/:id	Yes	Update a task
PATCH	/api/tasks/:id/status	Yes	Update task status
DELETE	/api/tasks/:id	Yes	Soft-delete a task
GET	/api/users/profile	Yes	Get profile
PUT	/api/users/profile	Yes	Update profile
GET	/api/health	No	Health check

Full documentation with request/response examples → docs/API.md

---