Chapter 34: Building a Complete App#

tina4 init taskflowcd taskflownpm install

TINA4_DEBUG=trueTINA4_SECRET=taskflow-dev-secret-change-in-productionTINA4_TOKEN_LIMIT=86400

-- UPCREATE TABLE users (    id INTEGER PRIMARY KEY AUTOINCREMENT,    name TEXT NOT NULL,    email TEXT NOT NULL UNIQUE,    password_hash TEXT NOT NULL,    role TEXT NOT NULL DEFAULT 'user',    created_at TEXT DEFAULT CURRENT_TIMESTAMP);​CREATE INDEX idx_users_email ON users(email);​-- DOWNDROP TABLE IF EXISTS users;

-- UPCREATE TABLE tasks (    id INTEGER PRIMARY KEY AUTOINCREMENT,    title TEXT NOT NULL,    description TEXT DEFAULT '',    status TEXT NOT NULL DEFAULT 'todo',    priority TEXT NOT NULL DEFAULT 'medium',    created_by INTEGER NOT NULL,    assigned_to INTEGER,    due_date TEXT,    completed_at TEXT,    created_at TEXT DEFAULT CURRENT_TIMESTAMP,    updated_at TEXT DEFAULT CURRENT_TIMESTAMP,    FOREIGN KEY (created_by) REFERENCES users(id),    FOREIGN KEY (assigned_to) REFERENCES users(id));​CREATE INDEX idx_tasks_status ON tasks(status);CREATE INDEX idx_tasks_assigned_to ON tasks(assigned_to);CREATE INDEX idx_tasks_created_by ON tasks(created_by);​-- DOWNDROP TABLE IF EXISTS tasks;

tina4 migrate

Running migrations...  [UP] 20260322000100_create_users_table.sql  [UP] 20260322000200_create_tasks_table.sql​  2 migrations applied

curl http://localhost:7148/health

{"status": "ok", "database": "connected"}

import { BaseModel, Auth } from "tina4-nodejs";​export class User extends BaseModel {    static tableName = "users";    static primaryKey = "id";    static hasMany = [        { model: "Task", foreignKey: "created_by", as: "createdTasks" },        { model: "Task", foreignKey: "assigned_to", as: "assignedTasks" }    ];​    id!: number;    name!: string;    email!: string;    passwordHash!: string;    role: string = "user";    createdAt!: string;​    async setPassword(password: string): Promise<void> {        this.passwordHash = await Auth.hashPassword(password);    }​    async verifyPassword(password: string): Promise<boolean> {        if (!this.passwordHash) return false;        return Auth.checkPassword(password, this.passwordHash);    }​    safeDict(): Record<string, any> {        const data = this.toDict();        delete data.passwordHash;        delete data.password_hash;        return data;    }}

import { BaseModel } from "tina4-nodejs/orm";​export class Task extends BaseModel {    static tableName = "tasks";    static primaryKey = "id";    static belongsTo = [        { model: "User", foreignKey: "created_by", as: "creator" },        { model: "User", foreignKey: "assigned_to", as: "assignee" }    ];​    static STATUSES = ["todo", "in_progress", "done", "cancelled"];    static PRIORITIES = ["low", "medium", "high", "urgent"];​    id!: number;    title!: string;    description: string = "";    status: string = "todo";    priority: string = "medium";    createdBy!: number;    assignedTo: number | null = null;    dueDate: string | null = null;    completedAt: string | null = null;    createdAt!: string;    updatedAt!: string;}

import { Auth } from "tina4-nodejs";​export function authMiddleware(req, res, next) {    const authHeader = req.headers["authorization"] ?? "";​    if (!authHeader || !authHeader.startsWith("Bearer ")) {        res({ error: "Authorization required" }, 401);        return;    }​    const token = authHeader.substring(7);​    const secret = process.env.TINA4_SECRET || "tina4-default-secret";    const payload = Auth.validToken(token, secret);    if (payload === null) {        res({ error: "Invalid or expired token" }, 401);        return;    }​    req.user = payload;    req.userId = payload.user_id;    next();}

curl http://localhost:7148/api/tasks

{"error": "Authorization required"}

import { Router, Auth } from "tina4-nodejs";import { Database } from "tina4-nodejs/orm";import { authMiddleware } from "./middleware";​/** * Register a new user * @noauth * @tags Auth * @body {"name": "string", "email": "string", "password": "string"} * @response 201 {"message": "string", "user": {"id": "int", "name": "string", "email": "string"}} */Router.post("/api/auth/register", async (req, res) => {    const { name, email, password } = req.body;​    if (!name || !email || !password) {        return res.status(400).json({ error: "Name, email, and password are required" });    }​    if (password.length < 8) {        return res.status(400).json({ error: "Password must be at least 8 characters" });    }​    const db = Database.getConnection();    const existing = await db.fetchOne("SELECT id FROM users WHERE email = :email", { email });​    if (existing) {        return res.status(409).json({ error: "Email already registered" });    }​    const hash = await Auth.hashPassword(password);    await db.execute(        "INSERT INTO users (name, email, password_hash) VALUES (:name, :email, :hash)",        { name, email, hash }    );​    const user = await db.fetchOne("SELECT id, name, email, role FROM users WHERE id = last_insert_rowid()");​    return res.status(201).json({ message: "Registration successful", user });});​/** * Login and get JWT token * @noauth * @tags Auth * @body {"email": "string", "password": "string"} * @response 200 {"token": "string", "user": {"id": "int", "name": "string", "email": "string"}} */Router.post("/api/auth/login", async (req, res) => {    const { email, password } = req.body;​    if (!email || !password) {        return res.status(400).json({ error: "Email and password are required" });    }​    const db = Database.getConnection();    const user = await db.fetchOne(        "SELECT id, name, email, password_hash, role FROM users WHERE email = :email",        { email }    );​    if (!user || !(await Auth.checkPassword(password, user.password_hash))) {        return res.status(401).json({ error: "Invalid email or password" });    }​    const secret = process.env.TINA4_SECRET || "tina4-default-secret";    const token = Auth.getToken({        user_id: user.id,        email: user.email,        name: user.name,        role: user.role    }, secret);​    return res.json({        message: "Login successful",        token,        user: { id: user.id, name: user.name, email: user.email, role: user.role }    });});​/** * Get current user profile * @tags Auth * @response 200 {"id": "int", "name": "string", "email": "string", "role": "string", "created_at": "string"} */Router.get("/api/profile", async (req, res) => {    const db = Database.getConnection();    const user = await db.fetchOne(        "SELECT id, name, email, role, created_at FROM users WHERE id = :id",        { id: req.user.user_id }    );    return res.json(user);}, [authMiddleware]);

# Start the servertina4 serve

# Register a usercurl -X POST http://localhost:7148/api/auth/register \  -H "Content-Type: application/json" \  -d '{"name": "Alice Johnson", "email": "alice@example.com", "password": "securePass123"}'

{  "message": "Registration successful",  "user": {"id": 1, "name": "Alice Johnson", "email": "alice@example.com", "role": "user"}}

# Logincurl -X POST http://localhost:7148/api/auth/login \  -H "Content-Type: application/json" \  -d '{"email": "alice@example.com", "password": "securePass123"}'

{  "message": "Login successful",  "token": "eyJhbGciOiJIUzI1NiIs...",  "user": {"id": 1, "name": "Alice Johnson", "email": "alice@example.com", "role": "user"}}

export TOKEN="eyJhbGciOiJIUzI1NiIs..."

import { Router, Queue } from "tina4-nodejs";import { Database } from "tina4-nodejs/orm";import { cacheDelete } from "tina4-nodejs";import { authMiddleware } from "./middleware";import { Task } from "../orm/Task";import { pushTaskUpdate } from "./ws-tasks";​/** * List tasks with filters * @tags Tasks * @query string status Filter by status (todo, in_progress, done) * @query string priority Filter by priority (low, medium, high) * @query string assigned Filter by assigned user ID * @query int page Page number * @query int limit Results per page */Router.get("/api/tasks", async (req, res) => {    const db = Database.getConnection();    const userId = req.user.user_id;    const page = parseInt(req.query.page ?? "1", 10);    const limit = parseInt(req.query.limit ?? "20", 10);    const offset = (page - 1) * limit;​    const conditions = ["(created_by = :userId OR assigned_to = :userId)"];    const params: Record<string, any> = { userId };​    if (req.query.status) {        conditions.push("status = :status");        params.status = req.query.status;    }​    if (req.query.priority) {        conditions.push("priority = :priority");        params.priority = req.query.priority;    }​    if (req.query.assigned) {        conditions.push("assigned_to = :assignedTo");        params.assignedTo = parseInt(req.query.assigned, 10);    }​    const sql = `SELECT t.*,        creator.name as creator_name,        assignee.name as assignee_name        FROM tasks t        LEFT JOIN users creator ON t.created_by = creator.id        LEFT JOIN users assignee ON t.assigned_to = assignee.id        WHERE ${conditions.join(" AND ")}        ORDER BY            CASE t.priority WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 END,            t.created_at DESC        LIMIT :limit OFFSET :offset`;​    params.limit = limit;    params.offset = offset;​    const tasks = await db.fetch(sql, params);​    return res.json({ tasks, page, limit, count: tasks.length });}, [authMiddleware]);​/** * Get a single task * @tags Tasks * @param int id Task ID */Router.get("/api/tasks/{id:int}", async (req, res) => {    const db = Database.getConnection();    const task = await db.fetchOne(        `SELECT t.*, creator.name as creator_name, assignee.name as assignee_name         FROM tasks t         LEFT JOIN users creator ON t.created_by = creator.id         LEFT JOIN users assignee ON t.assigned_to = assignee.id         WHERE t.id = :id`,        { id: req.params.id }    );​    if (!task) {        return res.status(404).json({ error: "Task not found" });    }​    return res.json(task);}, [authMiddleware]);​/** * Create a task * @tags Tasks * @body {"title": "string", "description": "string", "priority": "string", "assigned_to": "int", "due_date": "string"} */Router.post("/api/tasks", async (req, res) => {    const db = Database.getConnection();    const { title, description, priority, assigned_to, due_date } = req.body;​    if (!title) {        return res.status(400).json({ error: "Title is required" });    }​    if (priority && !Task.PRIORITIES.includes(priority)) {        return res.status(400).json({ error: `Invalid priority. Must be one of: ${Task.PRIORITIES.join(", ")}` });    }​    await db.execute(        `INSERT INTO tasks (title, description, status, priority, created_by, assigned_to, due_date)         VALUES (:title, :description, 'todo', :priority, :createdBy, :assignedTo, :dueDate)`,        {            title,            description: description ?? "",            priority: priority ?? "medium",            createdBy: req.user.user_id,            assignedTo: assigned_to ?? null,            dueDate: due_date ?? null        }    );​    const task = await db.fetchOne("SELECT * FROM tasks WHERE id = last_insert_rowid()");​    // Invalidate dashboard cache    cacheDelete("dashboard:stats");​    // Queue notification if assigned to someone    if (assigned_to) {        const notifyQueue = new Queue({ topic: "task-notifications" });        notifyQueue.push({            type: "assigned",            task_id: task.id,            task_title: title,            assigned_to,            assigned_by: req.user.name        });    }​    // Push real-time update    pushTaskUpdate("created", task);​    return res.status(201).json(task);}, [authMiddleware]);​/** * Update a task * @tags Tasks */Router.put("/api/tasks/{id:int}", async (req, res) => {    const db = Database.getConnection();    const id = req.params.id;​    const existing = await db.fetchOne("SELECT * FROM tasks WHERE id = :id", { id });    if (!existing) {        return res.status(404).json({ error: "Task not found" });    }​    const { title, description, status, priority, assigned_to, due_date } = req.body;​    if (status && !Task.STATUSES.includes(status)) {        return res.status(400).json({ error: `Invalid status. Must be one of: ${Task.STATUSES.join(", ")}` });    }​    if (priority && !Task.PRIORITIES.includes(priority)) {        return res.status(400).json({ error: `Invalid priority. Must be one of: ${Task.PRIORITIES.join(", ")}` });    }​    const completedAt = status === "done" && existing.status !== "done"        ? new Date().toISOString()        : existing.completed_at;​    // Detect reassignment for notification    const oldAssignee = existing.assigned_to;    const newAssignee = assigned_to ?? existing.assigned_to;​    await db.execute(        `UPDATE tasks SET title = :title, description = :description, status = :status,         priority = :priority, assigned_to = :assignedTo, due_date = :dueDate,         completed_at = :completedAt, updated_at = CURRENT_TIMESTAMP         WHERE id = :id`,        {            title: title ?? existing.title,            description: description ?? existing.description,            status: status ?? existing.status,            priority: priority ?? existing.priority,            assignedTo: newAssignee,            dueDate: due_date ?? existing.due_date,            completedAt,            id        }    );​    const task = await db.fetchOne("SELECT * FROM tasks WHERE id = :id", { id });​    // Invalidate dashboard cache    cacheDelete("dashboard:stats");​    // Notify new assignee if reassigned    if (newAssignee && newAssignee !== oldAssignee) {        const notifyQueue = new Queue({ topic: "task-notifications" });        notifyQueue.push({            type: "assigned",            task_id: task.id,            task_title: task.title,            assigned_to: newAssignee,            assigned_by: req.user.name        });    }​    // Push real-time update    pushTaskUpdate("updated", task);​    return res.json(task);}, [authMiddleware]);​/** * Delete a task * @tags Tasks */Router.delete("/api/tasks/{id:int}", async (req, res) => {    const db = Database.getConnection();    const id = req.params.id;​    const existing = await db.fetchOne("SELECT * FROM tasks WHERE id = :id", { id });    if (!existing) {        return res.status(404).json({ error: "Task not found" });    }​    await db.execute("DELETE FROM tasks WHERE id = :id", { id });​    // Invalidate dashboard cache    cacheDelete("dashboard:stats");​    // Push real-time update    pushTaskUpdate("deleted", { id });​    return res.status(204).json(null);}, [authMiddleware]);

# Set your token from the login stepTOKEN="eyJhbGciOiJIUzI1NiIs..."​# Create a taskcurl -X POST http://localhost:7148/api/tasks \  -H "Content-Type: application/json" \  -H "Authorization: Bearer $TOKEN" \  -d '{"title": "Design database schema", "priority": "high"}'

{  "id": 1,  "title": "Design database schema",  "priority": "high",  "status": "todo",  "created_by": 1,  "created_at": "2026-03-22 10:00:00"}

# Create more taskscurl -X POST http://localhost:7148/api/tasks \  -H "Content-Type: application/json" \  -H "Authorization: Bearer $TOKEN" \  -d '{"title": "Build API endpoints", "priority": "high"}'​curl -X POST http://localhost:7148/api/tasks \  -H "Content-Type: application/json" \  -H "Authorization: Bearer $TOKEN" \  -d '{"title": "Write documentation", "priority": "medium", "due_date": "2026-04-01"}'​# List all taskscurl http://localhost:7148/api/tasks \  -H "Authorization: Bearer $TOKEN"​# Update a task statuscurl -X PUT http://localhost:7148/api/tasks/1 \  -H "Content-Type: application/json" \  -H "Authorization: Bearer $TOKEN" \  -d '{"status": "done"}'​# Delete a taskcurl -X DELETE http://localhost:7148/api/tasks/3 \  -H "Authorization: Bearer $TOKEN"

import { Router, cacheGet, cacheSet } from "tina4-nodejs";import { Database } from "tina4-nodejs/orm";import { authMiddleware } from "./middleware";​/** * Dashboard statistics * @tags Dashboard * @response 200 {"total_tasks": "int", "by_status": "object", "overdue_tasks": "int", "total_users": "int"} */Router.get("/api/dashboard/stats", async (req, res) => {    const userId = req.user.user_id;    const cacheKey = `dashboard:${userId}`;​    const cached = await cacheGet(cacheKey);    if (cached) {        return res.json({ ...cached, source: "cache" });    }​    const db = Database.getConnection();​    const total = await db.fetchOne(        "SELECT COUNT(*) as count FROM tasks WHERE created_by = :userId OR assigned_to = :userId",        { userId }    );​    const todo = await db.fetchOne(        "SELECT COUNT(*) as count FROM tasks WHERE (created_by = :userId OR assigned_to = :userId) AND status = 'todo'",        { userId }    );​    const inProgress = await db.fetchOne(        "SELECT COUNT(*) as count FROM tasks WHERE (created_by = :userId OR assigned_to = :userId) AND status = 'in_progress'",        { userId }    );​    const done = await db.fetchOne(        "SELECT COUNT(*) as count FROM tasks WHERE (created_by = :userId OR assigned_to = :userId) AND status = 'done'",        { userId }    );​    const overdue = await db.fetchOne(        "SELECT COUNT(*) as count FROM tasks WHERE (created_by = :userId OR assigned_to = :userId) AND status != 'done' AND due_date < date('now')",        { userId }    );​    const users = await db.fetchOne("SELECT COUNT(*) as count FROM users");​    const recentTasks = await db.fetch(        `SELECT t.*, u.name as assignee_name FROM tasks t         LEFT JOIN users u ON t.assigned_to = u.id         WHERE t.created_by = :userId OR t.assigned_to = :userId         ORDER BY t.created_at DESC LIMIT 10`,        { userId }    );​    const stats = {        total_tasks: total.count,        todo: todo.count,        in_progress: inProgress.count,        done: done.count,        overdue_tasks: overdue.count,        total_users: users.count,        recent_tasks: recentTasks    };​    await cacheSet(cacheKey, stats, 30);​    return res.json({ ...stats, source: "database" });}, [authMiddleware]);​/** * Dashboard HTML page * @noauth * @tags Dashboard */Router.get("/admin", async (req, res) => {    return res.render("dashboard.html", {});});

curl http://localhost:7148/api/dashboard/stats \  -H "Authorization: Bearer $TOKEN"

{  "total_tasks": 2,  "todo": 1,  "in_progress": 0,  "done": 1,  "overdue_tasks": 0,  "total_users": 1,  "recent_tasks": [...],  "source": "database"}

curl http://localhost:7148/api/dashboard/stats \  -H "Authorization: Bearer $TOKEN"

{  "total_tasks": 2,  "todo": 1,  "done": 1,  "source": "cache"}

import { Router } from "tina4-nodejs";​Router.websocket("/ws/tasks", async (connection, event, data) => {    if (event === "open") {        connection.send(JSON.stringify({            type: "connected",            message: "Listening for task updates"        }));    }​    if (event === "message") {        const message = JSON.parse(data);        if (message.type === "ping") {            connection.send(JSON.stringify({ type: "pong" }));        }    }});​/** * Push a task update to all connected WebSocket clients. */export function pushTaskUpdate(action: string, task: any): void {    Router.pushToWebSocket("/ws/tasks", JSON.stringify({        type: "task_update",        action,        task    }));}

import { Queue, Messenger } from "tina4-nodejs";import { Database } from "tina4-nodejs/orm";​const notifyQueue = new Queue({ topic: "task-notifications" });​notifyQueue.process(async (job) => {    const { type, task_title, task_id, assigned_to, assigned_by } = job.payload as any;​    const db = Database.getConnection();    const user = await db.fetchOne("SELECT name, email FROM users WHERE id = :id", { id: assigned_to });​    if (!user) {        job.complete();        return;    }​    console.log(`[Notification] Task "${task_title}" assigned to ${user.name} by ${assigned_by}`);​    const mailer = new Messenger();    await mailer.send({        to: user.email,        subject: `New Task Assigned: ${task_title}`,        body: `<h2>New Task Assigned</h2>               <p>Hi ${user.name},</p>               <p><strong>${assigned_by}</strong> assigned you a new task:</p>               <div style="border:1px solid #ddd; padding:16px; margin:16px 0;">                   <h3>${task_title}</h3>                   <p><a href="http://localhost:7148/admin#task-${task_id}">View Task</a></p>               </div>`,        html: true    });​    job.complete();});

<!DOCTYPE html><html><head><meta charset="UTF-8"></head><body>    <div class="container">        <h2>New Task Assigned</h2>        <p>Hi {{ assignee_name }},</p>        <p><strong>{{ creator_name }}</strong> assigned you a new task:</p>         <div class="card">            <div class="card-body">                <h3>{{ task_title }}</h3>                <p>{{ task_description }}</p>                <table class="table">                    <tr><td><strong>Priority:</strong></td><td>{{ task_priority }}</td></tr>                    <tr><td><strong>Due:</strong></td><td>{{ task_due_date }}</td></tr>                </table>            </div>        </div>         <p><a href="{{ task_url }}">View Task</a></p>    </div></body></html>

{% extends "base.html" %} {% block title %}TaskFlow Dashboard{% endblock %} {% block content %}<h1>Dashboard</h1> <div id="stats" class="row mb-4">    <div class="col-md-2"><div class="card"><div class="card-body">        <h6 class="text-muted">Total</h6><h2 id="stat-total">--</h2>    </div></div></div>    <div class="col-md-2"><div class="card"><div class="card-body">        <h6 class="text-muted">To Do</h6><h2 id="stat-todo">--</h2>    </div></div></div>    <div class="col-md-2"><div class="card"><div class="card-body">        <h6 class="text-muted">In Progress</h6><h2 id="stat-progress">--</h2>    </div></div></div>    <div class="col-md-2"><div class="card"><div class="card-body">        <h6 class="text-muted">Done</h6><h2 id="stat-done">--</h2>    </div></div></div>    <div class="col-md-2"><div class="card"><div class="card-body">        <h6 class="text-muted">Overdue</h6><h2 id="stat-overdue" class="text-danger">--</h2>    </div></div></div>    <div class="col-md-2"><div class="card"><div class="card-body">        <h6 class="text-muted">Users</h6><h2 id="stat-users">--</h2>    </div></div></div></div> <div class="row">    <div class="col-md-8">        <div class="card">            <div class="card-header d-flex justify-content-between">                <span>Recent Tasks</span>                <button class="btn btn-sm btn-primary" data-toggle="modal" data-target="#newTaskModal">                    New Task                </button>            </div>            <div class="card-body">                <table class="table table-striped" id="task-table">                    <thead>                        <tr><th>Title</th><th>Assignee</th><th>Priority</th><th>Status</th></tr>                    </thead>                    <tbody id="task-list"></tbody>                </table>            </div>        </div>    </div>    <div class="col-md-4">        <div class="card">            <div class="card-header">Live Updates</div>            <div class="card-body" id="live-updates">                <p class="text-muted">Connecting...</p>            </div>        </div>    </div></div> <script src="/js/frond.min.js"></script><script>    var token = localStorage.getItem("token");    if (token) frond.setToken(token);     // Load dashboard stats    frond.get("/api/dashboard/stats", function (data) {        document.getElementById("stat-total").textContent = data.total_tasks;        document.getElementById("stat-todo").textContent = data.todo;        document.getElementById("stat-progress").textContent = data.in_progress;        document.getElementById("stat-done").textContent = data.done;        document.getElementById("stat-overdue").textContent = data.overdue_tasks;        document.getElementById("stat-users").textContent = data.total_users;         var tbody = document.getElementById("task-list");        tbody.innerHTML = "";        (data.recent_tasks || []).forEach(function (task) {            var tr = document.createElement("tr");            var badgeColor = {todo: "secondary", in_progress: "warning",                             done: "success", cancelled: "danger"};            tr.innerHTML = "<td>" + task.title + "</td>" +                "<td>" + (task.assignee_name || "Unassigned") + "</td>" +                "<td>" + task.priority + "</td>" +                "<td><span class='badge bg-" + (badgeColor[task.status] || "secondary") +                "'>" + task.status + "</span></td>";            tbody.appendChild(tr);        });    });     // WebSocket for live updates    var ws = frond.ws("/ws/tasks");    var updates = document.getElementById("live-updates");     ws.on("open", function () {        updates.innerHTML = "<p class='text-success'>Connected - listening for updates</p>";    });     ws.on("message", function (raw) {        var msg = JSON.parse(raw);        if (msg.type === "task_update") {            var div = document.createElement("div");            div.innerHTML = "<strong>" + msg.action + ":</strong> " + msg.task.title;            updates.prepend(div);             // Refresh stats            frond.get("/api/dashboard/stats", function () {});        }    });</script>{% endblock %}

curl http://localhost:7148/admin

import { tests, assertEqual, assertTrue, runAll, Auth } from "tina4-nodejs";import { TestClient } from "tina4-nodejs/test";​const client = new TestClient();​function randomEmail(): string {    const hex = Math.random().toString(16).substring(2, 10);    return `test-${hex}@example.com`;}​async function registerAndLogin(): Promise<string> {    const email = randomEmail();    await client.post("/api/auth/register", {        name: "Test User",        email,        password: "TestPassword123!"    });    const loginResp = await client.post("/api/auth/login", {        email,        password: "TestPassword123!"    });    return loginResp.body.token;}​// Test registrationconst testRegister = tests(    assertEqual([201]))(async function testRegister(): Promise<number> {    const resp = await client.post("/api/auth/register", {        name: "Alice",        email: randomEmail(),        password: "SecurePass123!"    });    return resp.statusCode;});​// Test login returns a tokenconst testLogin = tests(    assertTrue([true]))(async function testLogin(): Promise<boolean> {    const email = randomEmail();    await client.post("/api/auth/register", {        name: "Bob",        email,        password: "SecurePass123!"    });    const resp = await client.post("/api/auth/login", {        email,        password: "SecurePass123!"    });    return resp.statusCode === 200 && resp.body.token !== undefined;});​// Test task creationconst testCreateTask = tests(    assertTrue([true]))(async function testCreateTask(): Promise<boolean> {    const token = await registerAndLogin();    const resp = await client.post("/api/tasks", {        title: "Test Task",        description: "A test task",        priority: "high"    }, { headers: { Authorization: `Bearer ${token}` } });    return resp.statusCode === 201 && resp.body.title === "Test Task" && resp.body.priority === "high";});​// Test listing tasksconst testListTasks = tests(    assertTrue([true]))(async function testListTasks(): Promise<boolean> {    const token = await registerAndLogin();    await client.post("/api/tasks", { title: "List Task 1" }, { headers: { Authorization: `Bearer ${token}` } });    await client.post("/api/tasks", { title: "List Task 2" }, { headers: { Authorization: `Bearer ${token}` } });    const resp = await client.get("/api/tasks", { headers: { Authorization: `Bearer ${token}` } });    return resp.statusCode === 200 && resp.body.tasks.length >= 2;});​// Test updating task statusconst testUpdateTaskStatus = tests(    assertTrue([true]))(async function testUpdateTaskStatus(): Promise<boolean> {    const token = await registerAndLogin();    const createResp = await client.post("/api/tasks", { title: "Status Task" },        { headers: { Authorization: `Bearer ${token}` } });    const taskId = createResp.body.id;    const resp = await client.put(`/api/tasks/${taskId}`, { status: "done" },        { headers: { Authorization: `Bearer ${token}` } });    return resp.statusCode === 200 && resp.body.status === "done" && resp.body.completed_at !== null;});​// Test deleting a taskconst testDeleteTask = tests(    assertEqual([204]))(async function testDeleteTask(): Promise<number> {    const token = await registerAndLogin();    const createResp = await client.post("/api/tasks", { title: "Delete Me" },        { headers: { Authorization: `Bearer ${token}` } });    const taskId = createResp.body.id;    const resp = await client.delete(`/api/tasks/${taskId}`,        { headers: { Authorization: `Bearer ${token}` } });    return resp.statusCode;});​// Test dashboard statsconst testDashboardStats = tests(    assertTrue([true]))(async function testDashboardStats(): Promise<boolean> {    const token = await registerAndLogin();    await client.post("/api/tasks", { title: "Stats Task" },        { headers: { Authorization: `Bearer ${token}` } });    const resp = await client.get("/api/dashboard/stats",        { headers: { Authorization: `Bearer ${token}` } });    return resp.statusCode === 200 && resp.body.total_tasks >= 1;});​// Test unauthorized accessconst testUnauthorizedAccess = tests(    assertEqual([401]))(async function testUnauthorizedAccess(): Promise<number> {    const resp = await client.get("/api/tasks");    return resp.statusCode;});​// Test that token creation and validation round-trips correctlyconst testTokenRoundTrip = tests(    assertTrue([{ userId: 1, role: "admin" }]),)(function testTokenRoundTrip(payload: Record<string, unknown>): boolean {    const secret = process.env.TINA4_SECRET || "test-secret";    const token = Auth.getToken(payload, secret);    const decoded = Auth.validToken(token, secret);    return decoded !== null && decoded.userId === payload.userId;});​// Test that password hashing and checking worksconst testPasswordHash = tests(    assertTrue(["securePass123"]),)(function testPasswordHash(password: string): boolean {    const hash = Auth.hashPassword(password);    return Auth.checkPassword(password, hash);});​runAll();

npm test

Running tests...​  TaskFlowTest    [PASS] testRegister    [PASS] testLogin    [PASS] testCreateTask    [PASS] testListTasks    [PASS] testUpdateTaskStatus    [PASS] testDeleteTask    [PASS] testDashboardStats    [PASS] testUnauthorizedAccess    [PASS] testTokenRoundTrip    [PASS] testPasswordHash​  10 tests, 10 passed, 0 failed (1.12s)

FROM node:20-alpineWORKDIR /appCOPY package*.json ./RUN npm ci --only=productionCOPY dist/ ./dist/COPY src/templates/ ./src/templates/COPY src/public/ ./src/public/COPY migrations/ ./migrations/RUN mkdir -p data logsENV TINA4_DEBUG=falseEXPOSE 7148​HEALTHCHECK --interval=30s --timeout=5s --retries=3 \  CMD curl -f http://localhost:7148/health || exit 1​CMD ["node", "dist/app.js"]

services:  app:    build: .    ports:      - "7148:7148"    environment:      - TINA4_DEBUG=false      - TINA4_SECRET=${JWT_SECRET:-change-me-in-production}      - TINA4_CACHE_BACKEND=redis      - TINA4_CACHE_URL=redis://redis:6379    volumes:      - taskflow-data:/app/data      - taskflow-logs:/app/logs    depends_on:      - redis    restart: unless-stopped​  redis:    image: redis:7-alpine    restart: unless-stopped​volumes:  taskflow-data:  taskflow-logs:

tina4 builddocker compose up -d --build

curl http://localhost:7148/health

{"status": "ok", "version": "1.0.0", "database": "connected"}

taskflow/├── .env├── .env.example├── .gitignore├── package.json├── package-lock.json├── tsconfig.json├── app.ts├── Dockerfile├── docker-compose.yml├── src/│   ├── routes/│   │   ├── auth.ts                # Registration, login│   │   ├── tasks.ts               # Task CRUD│   │   ├── dashboard.ts           # Dashboard stats + page│   │   ├── middleware.ts          # Auth middleware│   │   ├── queue-consumers.ts     # Email notification consumer│   │   └── ws-tasks.ts            # WebSocket event handlers│   ├── orm/│   │   ├── User.ts                # User model with auth methods│   │   └── Task.ts                # Task model with relationships│   ├── migrations/│   │   ├── 20260322000100_create_users_table.sql│   │   └── 20260322000200_create_tasks_table.sql│   ├── templates/│   │   ├── base.html              # Base layout│   │   ├── dashboard.html         # Dashboard page│   │   ├── emails/│   │   │   └── task-assigned.html # Assignment notification│   │   └── errors/│   │       ├── 404.html│   │       └── 500.html│   ├── public/│   │   ├── css/│   │   │   └── tina4.css│   │   └── js/│   │       ├── tina4.min.js│   │       └── frond.min.js│   └── locales/│       └── en.json├── data/│   └── app.db├── dist/                          # Production build output├── logs/├── secrets/└── tests/    └── TaskFlowTest.ts