# ghullammohiuddin/task-manager-api architecture

> Architecture diagram of the GitHub repository ghullammohiuddin/task-manager-api, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-14). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ghullammohiuddin/task-manager-api
- Repository: https://github.com/ghullammohiuddin/task-manager-api

## Overview

1. **Overall shape**
   - This is a Node.js/Express REST API backed by MySQL.
   - The code is organized into a classic layered backend: startup/bootstrap in `app.js`, request routing in `src/routes`, HTTP handling in `src/controllers`, business logic in `src/services`, and persistence in `src/database`.

2. **Request entrypoint and app bootstrap**
   - `app.js` is the runtime entrypoint.
   - It likely wires environment config, Express middleware, route mounting, and the global error handler.
   - Cross-cutting protections described in the README—Helmet and rate limiting—are part of this bootstrap layer, not the domain logic.

3. **Routing boundary**
   - The API is split into two route groups: `src/routes/auth.route.js` and `src/routes/task.route.js`.
   - Auth routes expose registration and login.
   - Task routes expose CRUD endpoints and are protected by authentication middleware.
   - This route layer is the first domain boundary: it decides which middleware applies before a request reaches a controller.

4. **Authentication and authorization flow**
   - `src/middlewares/auth.middleware.js` protects task endpoints.
   - The flow is stateless: a client sends a Bearer JWT, the middleware validates it, and the user identity is attached to the request for downstream use.
   - Authorization is user-scoped, meaning task operations are constrained to the authenticated user’s own records.

5. **Controller layer**
   - `src/controllers/user.controller.js` handles register/login HTTP concerns.
   - `src/controllers/task.controller.js` handles task CRUD and query-based retrieval.
   - Controllers are thin: they receive validated requests, call services, and return responses. They do not appear to contain database logic.

6. **Service layer as the business boundary**
   - `src/services/user.service.js` owns user registration and login behavior, including password hashing and token-related logic.
   - `src/services/task.service.js` owns task creation, retrieval, updates, deletion, filtering, pagination, and user ownership checks.
   - This layer is where the main business rules live, separating them from HTTP mechanics.

7. **Validation and input safety**
   - `src/validators/auth.validator.js` and `src/validators/task.validator.js` define Joi validation rules.
   - Validation happens before business logic, so malformed payloads are rejected early with consistent 400 responses.
   - The README also notes SQL-injection-safe parameterized queries and controlled dynamic query construction for filtering/sorting.

8. **Persistence layer**
   - `src/database/db.connection.js` manages the MySQL connection using `mysql2/promise`.
   - The database schema is created through SQL migrations in `src/migrations/001_create_user_table.sql` and `src/migrations/002_create_task_table.sql`.
   - This means the schema is managed outside the app runtime, and the app expects those tables to already exist.

9. **Error handling and async control**
   - `src/utils/catchAsync.js` is a wrapper to avoid repetitive try/catch in controllers.
   - `src/utils/AppError.js` standardizes domain/application errors with HTTP status semantics.
   - `src/middlewares/errorhandler.middleware.js` is the centralized error sink that converts thrown errors into the consistent JSON error contract described in the README.

10. **Important data flows**
   - **Register/Login:** route → validator → controller → user service → database → JWT/password response.
   - **Protected task request:** route → auth middleware → validator → controller → task service → database → response.
   - **List tasks:** request query params are validated and used by the task service to build paginated, filtered, sorted SQL against only the authenticated user’s rows.

11. **Security and operational boundaries**
   - Helmet, rate limiting, bcrypt, and JWT are the main security mechanisms.
   - Rate limiting is split between global API protection and stricter auth-route protection to reduce brute-force risk.
   - Passwords are never stored in plain text; only hashed values are persisted.

12. **How to draw the architecture**
   - Model it as four main tiers: client/HTTP interface, Express route+middleware layer, controller/service domain layer, and MySQL persistence.
   - Place validation and auth as pre-controller gates.
   - Place centralized error handling as a shared downstream boundary that receives failures from all layers.

Main entry points: [`src/database/db.connection.js`](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/database/db.connection.js) (MySQL), [`app.js`](https://github.com/ghullammohiuddin/task-manager-api/blob/main/app.js) (app.js), [`src/routes/task.route.js`](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/routes/task.route.js) (Task routes), [`src/controllers/task.controller.js`](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/controllers/task.controller.js) (Task controller)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["Runtime"]
  node_app["app.js<br/>bootstrap<br/>[app.js]"]
  node_env["Env config<br/>[env.config.js]"]
end

subgraph group_api["API Layer"]
  node_auth_route["Auth routes<br/>route set<br/>[auth.route.js]"]
  node_task_route["Task routes<br/>route set<br/>[task.route.js]"]
  node_auth_validator["Auth validator<br/>joi schema<br/>[auth.validator.js]"]
  node_task_validator["Task validator<br/>joi schema<br/>[task.validator.js]"]
  node_auth_mw["Auth middleware<br/>jwt guard<br/>[auth.middleware.js]"]
  node_user_controller["User controller<br/>http controller<br/>[user.controller.js]"]
  node_task_controller["Task controller<br/>http controller<br/>[task.controller.js]"]
end

subgraph group_domain["Domain Logic"]
  node_user_service["User service<br/>auth service<br/>[user.service.js]"]
  node_task_service["Task service<br/>[task.service.js]"]
end

subgraph group_persistence["Persistence"]
  node_db[("MySQL<br/>database<br/>[db.connection.js]")]
  node_user_migration["User schema<br/>sql migration"]
  node_task_migration["Task schema<br/>sql migration"]
end

subgraph group_shared["Shared"]
  node_catch_async["Catch async<br/>async wrapper<br/>[catchAsync.js]"]
  node_app_error["App error<br/>error model<br/>[AppError.js]"]
  node_error_mw["Error handler<br/>error middleware"]
end

node_app -->|"loads config"| node_env
node_app -->|"mounts"| node_auth_route
node_app -->|"mounts"| node_task_route
node_app -->|"uses"| node_error_mw
node_auth_route -->|"validates"| node_auth_validator
node_auth_route -->|"dispatches"| node_user_controller
node_task_route -->|"protects"| node_auth_mw
node_task_route -->|"validates"| node_task_validator
node_task_route -->|"dispatches"| node_task_controller
node_auth_mw -->|"authorizes"| node_task_controller
node_user_controller -.->|"wrapped by"| node_catch_async
node_task_controller -.->|"wrapped by"| node_catch_async
node_user_controller -->|"calls"| node_user_service
node_task_controller -->|"calls"| node_task_service
node_user_service -->|"queries"| node_db
node_task_service -->|"queries"| node_db
node_db -.->|"schema"| node_user_migration
node_db -.->|"schema"| node_task_migration
node_user_service -.->|"throws"| node_app_error
node_task_service -.->|"throws"| node_app_error
node_error_mw -->|"formats"| node_app_error
node_error_mw -.->|"captures"| node_db

click node_app "https://github.com/ghullammohiuddin/task-manager-api/blob/main/app.js"
click node_env "https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/config/env.config.js"
click node_auth_route "https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/routes/auth.route.js"
click node_task_route "https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/routes/task.route.js"
click node_auth_validator "https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/validators/auth.validator.js"
click node_task_validator "https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/validators/task.validator.js"
click node_auth_mw "https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/middlewares/auth.middleware.js"
click node_user_controller "https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/controllers/user.controller.js"
click node_task_controller "https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/controllers/task.controller.js"
click node_user_service "https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/services/user.service.js"
click node_task_service "https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/services/task.service.js"
click node_db "https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/database/db.connection.js"
click node_user_migration "https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/migrations/001_create_user_table.sql"
click node_task_migration "https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/migrations/002_create_task_table.sql"
click node_catch_async "https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/utils/catchAsync.js"
click node_app_error "https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/utils/AppError.js"
click node_error_mw "https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/middlewares/errorhandler.middleware.js"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_app,node_env toneBlue
class node_auth_route,node_task_route,node_auth_validator,node_task_validator,node_auth_mw,node_user_controller,node_task_controller toneAmber
class node_user_service,node_task_service toneMint
class node_db,node_user_migration,node_task_migration toneRose
class node_catch_async,node_app_error,node_error_mw toneIndigo
```

## Components

### Runtime

Process entrypoint and application bootstrap

- [app.js](https://github.com/ghullammohiuddin/task-manager-api/blob/main/app.js): bootstrap · Express application bootstrap and global wiring · `app.js`
- [Env config](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/config/env.config.js): config · Loads and normalizes runtime environment settings · `src/config/env.config.js`

### API Layer

HTTP routes, middleware, controllers, and validation

- [Auth routes](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/routes/auth.route.js): route set · Registration and login endpoints · `src/routes/auth.route.js`
- [Task routes](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/routes/task.route.js): route set · Protected task CRUD and query endpoints · `src/routes/task.route.js`
- [Auth validator](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/validators/auth.validator.js): joi schema · Request validation for registration and login · `src/validators/auth.validator.js`
- [Task validator](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/validators/task.validator.js): joi schema · Request validation for task input and queries · `src/validators/task.validator.js`
- [Auth middleware](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/middlewares/auth.middleware.js): jwt guard · Verifies bearer tokens and attaches user identity · `src/middlewares/auth.middleware.js`
- [User controller](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/controllers/user.controller.js): http controller · Handles registration and login requests · `src/controllers/user.controller.js`
- [Task controller](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/controllers/task.controller.js): http controller · Handles task CRUD and list requests · `src/controllers/task.controller.js`

### Domain Logic

Business rules for users and tasks

- [User service](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/services/user.service.js): auth service · Registration, login, password hashing, token-related logic · `src/services/user.service.js`
- [Task service](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/services/task.service.js): task service · Task CRUD, filtering, pagination, and ownership checks · `src/services/task.service.js`

### Persistence

Database access and schema management

- [MySQL](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/database/db.connection.js): database · MySQL persistence accessed through mysql2/promise · `src/database/db.connection.js`
- [User schema](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/migrations/001_create_user_table.sql): sql migration · Creates the users table · `src/migrations/001_create_user_table.sql`
- [Task schema](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/migrations/002_create_task_table.sql): sql migration · Creates the tasks table · `src/migrations/002_create_task_table.sql`

### Shared

Cross-cutting utilities and error handling

- [Catch async](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/utils/catchAsync.js): async wrapper · Reduces repetitive try/catch in controllers · `src/utils/catchAsync.js`
- [App error](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/utils/AppError.js): error model · Standard application error with HTTP semantics · `src/utils/AppError.js`
- [Error handler](https://github.com/ghullammohiuddin/task-manager-api/blob/main/src/middlewares/errorhandler.middleware.js): error middleware · Centralized JSON error response sink · `src/middlewares/errorhandler.middleware.js`

## Connections

- app.js → Env config: loads config · Bootstrap reads environment settings before wiring the app
- app.js → Auth routes: mounts · Registers auth routes on the Express app
- app.js → Task routes: mounts · Registers task routes on the Express app
- app.js → Error handler: uses · Installs centralized error handling
- Auth routes → Auth validator: validates · Checks auth payloads before controller execution
- Auth routes → User controller: dispatches · Routes valid auth requests to the controller
- Task routes → Auth middleware: protects · Requires bearer JWTs for task endpoints
- Task routes → Task validator: validates · Checks task payloads and query parameters
- Task routes → Task controller: dispatches · Routes protected task requests to the controller
- Auth middleware → Task controller: authorizes · Attaches authenticated user context for downstream task access
- User controller → Catch async: wrapped by · Async request handling is wrapped to avoid repetitive try/catch
- Task controller → Catch async: wrapped by · Async request handling is wrapped to avoid repetitive try/catch
- User controller → User service: calls · Controller delegates business logic to user service
- Task controller → Task service: calls · Controller delegates business logic to task service
- User service → MySQL: queries · Reads and writes user records through MySQL connection
- Task service → MySQL: queries · Reads and writes task records through MySQL connection
- MySQL → User schema: schema · User table schema is defined by migration SQL
- MySQL → Task schema: schema · Task table schema is defined by migration SQL
- User service → App error: throws · Domain failures are normalized as application errors
- Task service → App error: throws · Domain failures are normalized as application errors
- Error handler → App error: formats · Converts application errors into the API error contract
- Error handler → MySQL: captures · Also handles unexpected persistence/runtime failures