Secure Task Management System

A comprehensive task management system built with role-based access control (RBAC) using NX monorepo architecture.

Setup Instructions

Prerequisites

Node.js (v20.17.0 or higher)
npm (v10.8.2 or higher)

1. Clone and Install Dependencies

npm install

2. Environment Configuration

# JWT Configuration
JWT_SECRET=your-super-secret-jwt-key-here
JWT_EXPIRES_IN=24h

# Database Configuration
DB_TYPE=sqlite
DB_DATABASE=taskmanager.db
DB_SYNCHRONIZE=true
DB_LOGGING=true

# API Configuration
API_PORT=3001
API_HOST=localhost

# CORS Configuration
CORS_ORIGIN=http://localhost:4200

3. Start the Backend API

# Start the NestJS API server
npx nx serve api

# The API will be available at http://localhost:3001

4. Start the Frontend Dashboard

# Start the Angular dashboard
npx nx serve dashboard

# The dashboard will be available at http://localhost:4200

5. Run Tests

# Run all tests
npm run test:all

# Run tests with coverage
npm run test:coverage

# Run tests in watch mode
npm run test:watch

6. Access the Application

Open your browser and navigate to http://localhost:4200
Use the pre-seeded test accounts to log in:

Test accounts:

Owner: [email protected] / password123
Admin: [email protected] / password123
Viewer: [email protected] / password123
Viewer: [email protected] / password123

Architecture Overview

NX Monorepo Layout and Rationale

This project follows a modular NX monorepo structure designed for scalability and maintainability:

faakash-BCA45B59-B747-4568-9BC5-94422F6F4984/
├── apps/
│   ├── api/                    # NestJS backend API
│   └── dashboard/             # Angular frontend
├── libs/
│   ├── data/                  # Shared TypeScript interfaces & DTOs
│   └── auth/                  # Reusable RBAC logic and decorators
└── dist/                      # Build outputs (generated)

Why NX Monorepo?

Code Sharing: Shared libraries eliminate duplication between frontend and backend
Type Safety: TypeScript interfaces shared across the entire stack
Consistent Builds: Single build system for all applications
Dependency Management: Centralized package management
Developer Experience: Single repository for full-stack development

Shared Libraries/Modules

`libs/data/` - Data Layer

Purpose: Centralized data models and DTOs
Contents:
- TypeORM entities (User, Task, Organization, etc.)
- DTOs for API requests/responses
- Enums and interfaces
Benefits: Type safety across frontend and backend

`libs/auth/` - Authentication Layer

Purpose: Reusable authentication and authorization logic
Contents:
- JWT authentication guards
- RBAC decorators and guards
- Audit logging service
Benefits: Consistent security implementation

System Flowcharts

The following flowcharts provide visual documentation of the system architecture and processes:

Available Flowcharts

APIRequestFlow.png - API request flow and authentication process
SystemArchFlow.png - Overall system architecture and component relationships
UserAuthentication.png - User authentication and authorization flow

These flowcharts are located in the Flowcharts/ directory and provide visual representations of:

How API requests are processed
System component interactions
User authentication and role-based access control flows

Data Model Explanation

Database Schema

The system uses a relational database with the following entities:

Core Entities

Users

Primary key: id (UUID)
Authentication: email, password (hashed)
Profile: firstName, lastName, status
Relationships: Many-to-many with Roles, One-to-many with Tasks

Organizations

Primary key: id (UUID)
Hierarchy: Self-referencing with parentId
Relationships: One-to-many with Users

Roles

Primary key: id (UUID)
Types: owner, admin, viewer
Relationships: Many-to-many with Users and Permissions

Tasks

Primary key: id (UUID)
Content: title, description, status, priority, category
Relationships: Many-to-one with Users (creator), Many-to-many with Users (assignments)

TaskAssignments

Junction table for many-to-many relationship between Tasks and Users
Tracks when users are assigned to tasks

AuditLogs

Security and compliance tracking
Records all user actions with timestamps and metadata

Entity Relationship Diagram

┌─────────────┐    ┌──────────────┐    ┌─────────────┐
│   Users     │    │ UserRoles    │    │    Roles    │
│             │◄───┤              ├───►│             │
│ - id        │    │ - userId     │    │ - id        │
│ - email     │    │ - roleId     │    │ - type      │
│ - password  │    │ - assignedAt │    │ - name      │
│ - firstName │    └──────────────┘    │ - desc      │
│ - lastName  │                        └─────────────┘
│ - status    │
└─────────────┘
       │
       │ 1:N
       ▼
┌─────────────┐    ┌───────────────┐    ┌─────────────┐
│   Tasks     │    │TaskAssignments│    │   Users     │
│             │◄───┤               ├───►│             │
│ - id        │    │ - taskId      │    │ - id        │
│ - title     │    │ - userId      │    │ - email     │
│ - desc      │    │ - assignedAt  │    │ - firstName │
│ - status    │    └───────────────┘    │ - lastName  │
│ - priority  │                         └─────────────┘
│ - category  │
│ - createdBy │
└─────────────┘

Access Control Implementation

Role Hierarchy

The system implements a three-tier role hierarchy:

1. Owner Role (Highest Authority)

Permissions: Full system access
Capabilities:
- Manage organizations and users
- View all tasks and audit logs
- Perform all CRUD operations
- System administration

2. Admin Role (Management Authority)

Permissions: Most system operations
Capabilities:
- Manage tasks and users
- View audit logs
- Create and assign tasks to multiple users
- Cannot manage organizations

3. Viewer Role (Read-Only)

Permissions: Limited read access
Capabilities:
- View tasks assigned to them
- Read-only access to their profile
- Cannot create, update, or delete resources

Permission Matrix

Resource	Action	Owner	Admin	Viewer
Tasks	Create	✅	✅	❌
Tasks	Read	✅	✅	✅
Tasks	Update	✅	✅	❌
Tasks	Delete	✅	✅	❌
Users	Create	✅	✅	❌
Users	Read	✅	✅	❌
Users	Update	✅	✅	❌
Users	Delete	✅	✅	❌
Audit Logs	Read	✅	✅	❌
Organizations	Manage	✅	❌	❌

JWT Authentication Integration

Token Structure

{
  "sub": "user-id",
  "email": "[email protected]",
  "roles": ["admin"],
  "iat": 1234567890,
  "exp": 1234654290
}

Authentication Flow

Login: User provides credentials
Validation: Backend validates with bcrypt
Token Generation: JWT created with user info and roles
Token Storage: Frontend stores in localStorage
Request Authorization: Token sent in Authorization header
Permission Check: RBAC guard validates permissions

Security Features

Password Hashing: bcrypt with salt rounds of 10
Token Expiration: 24-hour token lifetime
Role-based Access: Permissions checked on every request
Audit Logging: All authentication events tracked

API Documentation

Authentication Endpoints

POST /api/auth/login

Description: Authenticate user and return JWT token

Request Body:

{
  "email": "[email protected]",
  "password": "password123"
}

Response:

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "id": "user-id",
    "email": "[email protected]",
    "firstName": "Fnu",
    "lastName": "Aakash",
    "roles": ["admin"]
  }
}