TaskFlow

Category: Productivity
Platform: Web App
Year: 2026; Built
Developer: Jake
Stat: 48; REST endpoints
Stat: 11; Prisma models
Stat: ~485; automated tests

Preview

Web · Desktop & Mobile

A full-stack task manager with a list view, a drag-and-drop Kanban board and a month calendar. It has email-OTP sign-up, Google and GitHub sign-in, task images, reminders and email notifications, and runs in production on Cloudflare.

What's Included

Email-OTP sign-up, login with email or username, password reset
Google and GitHub sign-in with explicit account linking
Task table with search, filters, sorting and pagination kept in the URL
Kanban board with drag and drop, plus a mobile "move task" sheet
Task details with an image gallery, reminders and activity
Dashboard with completion rate, priorities, agenda and due-soon tasks
Month calendar and a full activity history
Notification bell, reminders, daily digest and new sign-in alerts
Profile with sessions, connected accounts and email change by OTP
Light and dark theme, responsive layout and keyboard shortcuts

The Problem

The brief for a full-stack technical assessment was a task manager in React + TypeScript and Node + PostgreSQL. TaskFlow treats that brief as a real product: secure accounts, three ways to see your work, reminders that actually arrive, and a live deployment instead of a localhost demo.

By the Numbers

48
REST endpoints
11
Prisma models
~485
automated tests
13
app routes

Under the Hood

Highlight 01
Refresh tokens that detect theft
Sessions use a 15-minute JWT plus an opaque refresh token stored only as a SHA-256 hash. Reusing an old refresh token outside a 30-second grace window revokes the session, and the client refreshes through a single in-flight request.
Highlight 02
Account-safe sign-up and reset
Pending sign-ups live in Redis with the OTP stored as an HMAC and an atomic attempt cap. Forgot-password responses look the same whether or not the account exists, and new passwords are checked against Have I Been Pwned.
Highlight 03
Reminders sent exactly once
One BullMQ job runs every minute and reads due reminders from Postgres, instead of one delayed job per reminder. Claims use conditional updates and dedupe keys, and the timing is time-zone and DST aware.
Highlight 04
An image pipeline that trusts nothing
Uploads are decoded with sharp rather than trusted by MIME type, guarded against decompression bombs, rotated from EXIF and re-encoded to WebP sizes. Storage sits behind one driver interface with local, S3 and R2 backends.
Highlight 05
Kanban ordering in one write
A dropped card takes the midpoint of its neighbours’ positions, so a move updates a single row. The column is renumbered only when the gaps get too small.
Highlight 06
One contract, client and server
Shared Zod schemas validate requests on both sides and generate the OpenAPI 3.1 docs. In production a Cloudflare Worker fronts the containerised Express API, with R2 for files.

Information