🚀 Task API

Secure • Containerized • Documented

A modern RESTful Task Management API built with Node.js, Express.js, PostgreSQL, Docker, Supabase Auth, and JWT.

---

✨ Project at a Glance

Task API evolved from a basic CRUD exercise into a persistent, containerized, authenticated backend.

Stage	Evolution
A1	In-memory REST CRUD API
A2	SQLite persistence
A3	PostgreSQL + Docker Compose
A4	Supabase Auth + JWT-protected routes

Current capabilities

• 🔐 Supabase email/password authentication
• 🎟️ JWT bearer authorization
• 🛡️ Reusable requireAuth middleware
• 📦 Protected task CRUD operations
• 🐘 PostgreSQL persistence
• 🐳 Docker + Docker Compose
• 💾 Persistent Docker volume
• 🧷 Parameterized SQL queries
• ❤️ Real database health check
• 📖 Swagger UI with Authorize support
• ⚙️ .env-based configuration

---

🧰 Tech Stack

Node.js	Express	PostgreSQL	Docker	Supabase
JWT	Swagger	OpenAPI	Postman	Git

---

🏗️ Architecture

Client / Swagger UI
        │
        ├── signup / login ──────► Supabase Auth
        │                              │
        │                         JWT access token
        │                              │
        ◄───────────────────────────────┘
        │
        │ Authorization: Bearer <JWT>
        ▼
┌────────────────────────┐
│ Node.js + Express API  │
│      Port 3000         │
└───────────┬────────────┘
            │
      requireAuth
            │
            ▼
┌────────────────────────┐
│ Protected Task Routes  │
└───────────┬────────────┘
            │ parameterized SQL
            ▼
┌────────────────────────┐
│ PostgreSQL Container   │
└───────────┬────────────┘
            │
            ▼
     Docker Volume
       taskdata

---

🔐 Authentication

The API uses Supabase Auth for user authentication. After login, Supabase returns a JWT access token.

Protected requests use:

Authorization: Bearer <ACCESS_TOKEN>

Without a valid token, protected routes return 401 Unauthorized.

Authentication flow

Email + Password
      ↓
POST /auth/login
      ↓
Supabase Auth
      ↓
JWT access_token
      ↓
Bearer Authorization
      ↓
requireAuth middleware
      ↓
Protected API

Security: Never commit .env, passwords, Supabase secrets, or real JWT access tokens.

---

📡 API Endpoints

Method	Endpoint	Access	Purpose
POST	/auth/signup	🌐 Public	Create account
POST	/auth/login	🌐 Public	Login and receive JWT
POST	/auth/logout	🔒 Protected	Logout
GET	/	🌐 Public	API information
GET	/health	🌐 Public	API + DB health
GET	/tasks	🔒 Protected	Get all tasks
GET	/tasks/:id	🔒 Protected	Get task by ID
POST	/tasks	🔒 Protected	Create task
PUT	/tasks/:id	🔒 Protected	Update task
DELETE	/tasks/:id	🔒 Protected	Delete task

---

🚀 Quick Start

1. Clone

git clone https://github.com/100rabheimer/task-api.git
cd task-api

2. Configure .env

Copy .env.example to .env and add your own values:

DATABASE_URL=postgres://postgres:your_password@db:5432/tasks
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_KEY=your_supabase_anon_or_publishable_key
PORT=3000

3. Start with Docker

docker compose up --build

Then open:

Resource	Local URL
API	http://localhost:3000
Health	http://localhost:3000/health
Swagger UI	http://localhost:3000/docs

Stop the stack with:

docker compose down

---

🗄️ PostgreSQL

Schema:

CREATE TABLE IF NOT EXISTS tasks (
    id SERIAL PRIMARY KEY,
    title TEXT NOT NULL,
    done BOOLEAN NOT NULL DEFAULT FALSE
);

Example task:

{
  "id": 1,
  "title": "Learn Express",
  "done": false
}

The app seeds initial records only when the table is empty.

---

🧪 Login & Protected Route Example

Login

POST /auth/login
Content-Type: application/json

{
  "email": "user@example.com",
  "password": "StrongPassword123!"
}

Then use the returned access_token:

GET /tasks
Authorization: Bearer <ACCESS_TOKEN>

PowerShell

$login = Invoke-RestMethod `
  -Uri "http://localhost:3000/auth/login" `
  -Method Post `
  -ContentType "application/json" `
  -Body '{"email":"user@example.com","password":"StrongPassword123!"}'

$token = $login.access_token

Invoke-RestMethod `
  -Uri "http://localhost:3000/tasks" `
  -Method Get `
  -Headers @{ Authorization = "Bearer $token" }

---

📖 Swagger UI

Open:

http://localhost:3000/docs

For protected endpoints:

1. Run POST /auth/login.
2. Copy the returned access_token.
3. Click Authorize 🔒.
4. Paste the JWT.
5. Run any protected /tasks endpoint.

Swagger sends the bearer token automatically after authorization.

Crop or hide JWT values before adding Swagger screenshots to a public repository.

---

❤️ Health Check

GET /health executes:

SELECT 1;

Expected response:

{
  "status": "ok",
  "database": "connected"
}

This verifies both the API and PostgreSQL connection.

---

📁 Project Structure

task-api/
│
├── assets/
│   └── postgres-database.png
│
├── authMiddleware.js
├── supabaseClient.js
├── db.js
├── index.js
├── openapi.json
│
├── Dockerfile
├── compose.yaml
├── .dockerignore
├── .env.example
├── .gitignore
│
├── package.json
├── package-lock.json
└── README.md

---

📸 Database Preview

Inspect PostgreSQL:

docker compose exec db psql -U postgres -d tasks

Inside psql:

\dt
SELECT * FROM tasks;

---

🧪 Verified

• ✅ Signup and login
• ✅ JWT access token returned
• ✅ Protected routes reject missing authorization
• ✅ Valid JWT grants task access
• ✅ Swagger Bearer authorization works
• ✅ PostgreSQL CRUD works
• ✅ Parameterized queries
• ✅ Database health check
• ✅ Docker Compose startup
• ✅ Persistent database volume
• ✅ .env kept outside Git

---

🧠 What I Learned

Backend: REST design, Express middleware, CRUD, validation, HTTP status codes.

Database: PostgreSQL, node-postgres, parameterized queries, initialization, persistence.

Security: Supabase Auth, JWTs, bearer authorization, protected routes, environment secrets.

DevOps: Docker, Docker Compose, container networking, volumes, reproducible local setup.

Documentation: OpenAPI 3 and Swagger UI with authenticated endpoint testing.

---

🔒 Security Notes

• .env is Git-ignored.
• .env.example contains placeholders only.
• Password authentication is handled by Supabase.
• No custom password hashing is implemented in this API.
• SQL values use parameterized queries.
• Protected endpoints require bearer authentication.
• Real JWTs and credentials must not appear in public screenshots.

---

👨‍💻 Author

Saurabh Pandey

Backend Development • REST APIs • Node.js • PostgreSQL • Docker