How ghullammohiuddin/task-manager-api works
1. Overall shape
- This is a Node.js/Express REST API backed by MySQL.
- The code is organized into a classic layered backend: startup/bootstrap in app.js, request routing in src/routes, HTTP handling in src/controllers, business logic in src/services, and persistence in src/database.
2. Request entrypoint and app bootstrap
- app.js is the runtime entrypoint.
- It likely wires environment config, Express middleware, route mounting, and the global error handler.
- Cross-cutting protections described in the README—Helmet and rate limiting—are part of this bootstrap layer, not the domain logic.
3. Routing boundary
- The API is split into two route groups: src/routes/auth.route.js and src/routes/task.route.js.
- Auth routes expose registration and login.
- Task routes expose CRUD endpoints and are protected by authentication middleware.
- This route layer is the first domain boundary: it decides which middleware applies before a request reaches a controller.
4. Authentication and authorization flow
- src/middlewares/auth.middleware.js protects task endpoints.
- The flow is stateless: a client sends a Bearer JWT, the middleware validates it, and the user identity is attached to the request for downstream use.
- Authorization is user-scoped, meaning task operations are constrained to the authenticated user’s own records.
5. Controller layer
- src/controllers/user.controller.js handles register/login HTTP concerns.
- src/controllers/task.controller.js handles task CRUD and query-based retrieval.
- Controllers are thin: they receive validated requests, call services, and return responses. They do not appear to contain database logic.
6. Service layer as the business boundary
- src/services/user.service.js owns user registration and login behavior, including password hashing and token-related logic.
- src/services/task.service.js owns task creation, retrieval, updates, deletion, filtering, pagination, and user ownership checks.
- This layer is where the main business rules live, separating them from HTTP mechanics.
7. Validation and input safety
- src/validators/auth.validator.js and src/validators/task.validator.js define Joi validation rules.
- Validation happens before business logic, so malformed payloads are rejected early with consistent 400 responses.
- The README also notes SQL-injection-safe parameterized queries and controlled dynamic query construction for filtering/sorting.
8. Persistence layer
- src/database/db.connection.js manages the MySQL connection using mysql2/promise.
- The database schema is created through SQL migrations in src/migrations/001_create_user_table.sql and src/migrations/002_create_task_table.sql.
- This means the schema is managed outside the app runtime, and the app expects those tables to already exist.
9. Error handling and async control
- src/utils/catchAsync.js is a wrapper to avoid repetitive try/catch in controllers.
- src/utils/AppError.js standardizes domain/application errors with HTTP status semantics.
- src/middlewares/errorhandler.middleware.js is the centralized error sink that converts thrown errors into the consistent JSON error contract described in the README.
10. Important data flows
- Register/Login: route → validator → controller → user service → database → JWT/password response.
- Protected task request: route → auth middleware → validator → controller → task service → database → response.
- List tasks: request query params are validated and used by the task service to build paginated, filtered, sorted SQL against only the authenticated user’s rows.
11. Security and operational boundaries
- Helmet, rate limiting, bcrypt, and JWT are the main security mechanisms.
- Rate limiting is split between global API protection and stricter auth-route protection to reduce brute-force risk.
- Passwords are never stored in plain text; only hashed values are persisted.
12. How to draw the architecture
- Model it as four main tiers: client/HTTP interface, Express route+middleware layer, controller/service domain layer, and MySQL persistence.
- Place validation and auth as pre-controller gates.
- Place centralized error handling as a shared downstream boundary that receives failures from all layers.
Main entry points: db.connection.js MySQL · app.js app.js · task.route.js Task routes · task.controller.js Task controller
Components 17
Runtime
Process entrypoint and application bootstrap
- app.js · Express application bootstrap and global wiring
app.js - Env config · Loads and normalizes runtime environment settings
src/config/env.config.js
API Layer
HTTP routes, middleware, controllers, and validation
- Auth routes · Registration and login endpoints
src/routes/auth.route.js - Task routes · Protected task CRUD and query endpoints
src/routes/task.route.js - Auth validator · Request validation for registration and login
src/validators/auth.validator.js - Task validator · Request validation for task input and queries
src/validators/task.validator.js - Auth middleware · Verifies bearer tokens and attaches user identity
src/middlewares/auth.middleware.js - User controller · Handles registration and login requests
src/controllers/user.controller.js - Task controller · Handles task CRUD and list requests
src/controllers/task.controller.js
Domain Logic
Business rules for users and tasks
- User service · Registration, login, password hashing, token-related logic
src/services/user.service.js - Task service · Task CRUD, filtering, pagination, and ownership checks
src/services/task.service.js
Persistence
Database access and schema management
- MySQL · MySQL persistence accessed through mysql2/promise
src/database/db.connection.js - User schema · Creates the users table
src/migrations/001_create_user_table.sql - Task schema · Creates the tasks table
src/migrations/002_create_task_table.sql
Shared
Cross-cutting utilities and error handling
- Catch async · Reduces repetitive try/catch in controllers
src/utils/catchAsync.js - App error · Standard application error with HTTP semantics
src/utils/AppError.js - Error handler · Centralized JSON error response sink
src/middlewares/errorhandler.middleware.js
Connections 22
- app.js → Env config: loads config · Bootstrap reads environment settings before wiring the app
- app.js → Auth routes: mounts · Registers auth routes on the Express app
- app.js → Task routes: mounts · Registers task routes on the Express app
- app.js → Error handler: uses · Installs centralized error handling
- Auth routes → Auth validator: validates · Checks auth payloads before controller execution
- Auth routes → User controller: dispatches · Routes valid auth requests to the controller
- Task routes → Auth middleware: protects · Requires bearer JWTs for task endpoints
- Task routes → Task validator: validates · Checks task payloads and query parameters
- Task routes → Task controller: dispatches · Routes protected task requests to the controller
- Auth middleware → Task controller: authorizes · Attaches authenticated user context for downstream task access
- User controller → Catch async: wrapped by · Async request handling is wrapped to avoid repetitive try/catch
- Task controller → Catch async: wrapped by · Async request handling is wrapped to avoid repetitive try/catch
- User controller → User service: calls · Controller delegates business logic to user service
- Task controller → Task service: calls · Controller delegates business logic to task service
- User service → MySQL: queries · Reads and writes user records through MySQL connection
- Task service → MySQL: queries · Reads and writes task records through MySQL connection
- MySQL → User schema: schema · User table schema is defined by migration SQL
- MySQL → Task schema: schema · Task table schema is defined by migration SQL
- User service → App error: throws · Domain failures are normalized as application errors
- Task service → App error: throws · Domain failures are normalized as application errors
- Error handler → App error: formats · Converts application errors into the API error contract
- Error handler → MySQL: captures · Also handles unexpected persistence/runtime failures