Vapor REST API Backend for Task Management

Project roadmap

1. 01

   Create the Vapor project

   ~1.5h

   Install Vapor's toolbox and create a project with Fluent and the PostgreSQL driver. Run PostgreSQL with Docker Compose, configure the database from environment variables, and add a GET /health route. Done when: the server starts, connects to the database and answers /health.

2. 02

   Define models and migrations

   ~2h

   Create Fluent models User (email unique and password hash), Project (name and owner) and Task (title, notes, status as an enum, priority, due date and project), with @Parent and @Children relations, and a migration for each (with foreign keys, cascading deletes and a unique index on the email). Run the migrations automatically at startup in development. Done when: the tables are created by the migrations.

3. 03

   Add JWT authentication

   ~2h

   Add POST /auth/register (validating the email and a password of at least 10 characters, hashed with Bcrypt) and POST /auth/login returning a JWT signed with a secret from the environment and expiring after an hour, using the JWT package. Add a JWT authenticator and guard middleware for protected routes. Done when: users can register and log in, and protected routes reject missing or expired tokens with 401.

4. 04

   Build the routes with authorization

   ~2.5h

   Create controllers for projects (list, create, rename and delete) and tasks within a project (list with filters for status and due date, create, update and delete), always loading data filtered by the logged-in user, so other users' projects return 404. Use Content structs with Validatable rules for requests and separate response structs. Done when: every endpoint works, and a user can never read or change another user's data.

5. 05

   Run it with Docker

   ~1h

   Use the Dockerfile Vapor generates (a multi-stage build producing a small image) and a docker-compose.yml running the app and PostgreSQL with a health check, a volume for the data, and migrations run on start. Document running it in README.md. Done when: docker compose up starts the whole service, and the API works.

6. 06

   Write integration tests

   ~2h

   Write tests with XCTVapor (or VaporTesting) against a separate test database: registration and login, token checks, creating projects and tasks, filters, validation errors, and authorization between two users. Reset the database between tests by reverting and re-running migrations. Done when: swift test passes.

Resources

• DocsVapor documentation
• DocsVapor: Fluent overview
• DocsVapor: JWT
• DocsVapor: validation
• DocsVapor: Docker deployment