Development

.gitignore

@@ -4,4 +4,6 @@ node_modules/
 dist/
 .DS_Store
 structure.md
-CLAUDE.md
+CLAUDE.md
+
+/docs/*

README.md

@@ -1,12 +1,83 @@
-# Build and run the API container with host networking
+# Todo API
 
+RESTful API for a Todo application built with **Express.js**, **TypeScript**, and **MongoDB**.
+
+## Stack
+
+- **Runtime**: Node.js + TypeScript
+- **Framework**: Express.js
+- **Database**: MongoDB + Mongoose
+- **Auth**: Passport.js — Local, JWT, Google OAuth2
+- **Validation**: Zod + OpenAPI auto-generation
+- **Email**: React Email + Resend
+- **Testing**: Jest + Supertest
+
+## Getting Started
+
+```bash
+# Install dependencies
+npm install
+
+# Copy and fill environment variables
+cp .env.example .env
+
+# Start dev server
+npm run dev
+```
+
+## Environment Variables
+
+| Variable | Description |
+|---|---|
+| `MONGO_URI` | MongoDB connection string |
+| `JWT_SECRET` | JWT signing secret |
+| `GOOGLE_CLIENT_ID` | Google OAuth client ID |
+| `GOOGLE_CLIENT_SECRET` | Google OAuth client secret |
+| `RESEND_API_KEY` | Resend email service key |
+| `CORS_ORIGIN` | Allowed CORS origin |
+
+## API Endpoints
+
+| Prefix | Description |
+|---|---|
+| `/api/auth/*` | Register, login, OAuth, password reset |
+| `/api/tasks/*` | Task CRUD with filtering & ordering |
+| `/api/tags/*` | Tag CRUD with auto color assignment |
+| `/api/operations/*` | Bulk task operations |
+| `/api/jobs/*` | Scheduled jobs (daily reminders) |
+| `/api-docs` | Swagger UI documentation |
+
+## Scripts
+
+```bash
+npm run dev           # Dev server with hot reload
+npm run build         # TypeScript build
+npm start             # Production server
+npm test              # Run tests
+npm run test:coverage # Tests with coverage report
+npm run email         # Email template dev server
+```
+
+## Project Structure
+
+```
+src/
+├── controllers/   # HTTP handlers
+├── services/      # Business logic
+├── models/        # Mongoose schemas
+├── routes/        # Express routes
+├── middlewares/   # Auth, validation, rate limiting
+├── schemas/       # Zod schemas
+└── openapi/       # OpenAPI doc generation
+```
+
+## Docker
+
+```bash
 docker build -t todo-api --target development .
+docker run --name todo-api --network host -v .:/app -v /app/node_modules todo-api
+```
 
-docker run --name todo-api --network host \
- -v .:/app \
- -v /app/node_modules \
- todo-api
+## Author
 
-docker start todo-api
-docker stop todo-api
-docker logs -f todo-api
+[HRulier](https://github.com/HRulier)

jest.config.ts

@@ -10,6 +10,7 @@ export default {
   testMatch: ["**/tests/**/*.test.ts"],
   moduleNameMapper: {
     "^~/(.*)$": "<rootDir>/src/$1",
+    "nanoid": "<rootDir>/tests/__mocks__/nanoid.js",
   },
   setupFilesAfterEnv: ["<rootDir>/tests/setup.ts"],
 };

package.json

@@ -15,13 +15,13 @@
     "type": "git",
     "url": "git+https://github.com/HRulier/todo-api.git"
   },
-  "author": "",
+  "author": "HRulier",
   "license": "ISC",
   "bugs": {
     "url": "https://github.com/HRulier/todo-api/issues"
   },
   "homepage": "https://github.com/HRulier/todo-api#readme",
-  "description": "",
+  "description": "RESTful API for a Todo application — Express.js, TypeScript, MongoDB with JWT & OAuth2 authentication",
   "devDependencies": {
     "@types/cookie-parser": "^1.4.8",
     "@types/cors": "^2.8.17",
@@ -64,11 +64,13 @@
     "jsonwebtoken": "^9.0.2",
     "mongoose": "^8.11.0",
     "morgan": "^1.10.0",
+    "nanoid": "^5.1.5",
     "nodemon": "^3.1.9",
     "passport": "^0.7.0",
     "passport-google-oauth20": "^2.0.0",
     "passport-jwt": "^4.0.1",
     "passport-local": "^1.0.0",
+    "passport-slack-oauth2": "^1.2.0",
     "react": "19.0.0",
     "react-dom": "19.0.0",
     "resend": "^4.1.2",

src/config/passport.ts

@@ -3,6 +3,7 @@ import User from "~/models/user";
 import passportJWT from "passport-jwt";
 import passportLocal from "passport-local";
 import passportGoogleOAuth20 from "passport-google-oauth20";
+import passportSlackOAuth20 from "passport-slack-oauth2";
 
 import dotenv from "dotenv";
 import dotEnvConfig from "./dot-env";
@@ -14,6 +15,7 @@ dotenv.config(dotEnvConfig);
 const { Strategy: LocalStrategy } = passportLocal;
 const { Strategy: JwtStrategy, ExtractJwt } = passportJWT;
 const { Strategy: GoogleStrategy } = passportGoogleOAuth20;
+const { Strategy: SlackStrategy } = passportSlackOAuth20;
 
 // Setting username field to email rather than username
 const localOptions = {
@@ -145,6 +147,7 @@ const googleStrategy = new GoogleStrategy(
           firstName: profile.name?.familyName || "Non renseigné",
           lastName: profile.name?.givenName || "Non renseigné",
         },
+        timezone: stateData?.timezone,
       });
 
       // Pass both user and state data to the callback
@@ -156,6 +159,76 @@ const googleStrategy = new GoogleStrategy(
   }
 );
 
+// Slack 0Auth2
+
+const SLACK_CLIENT_ID = process.env.SLACK_CLIENT_ID as string;
+const SLACK_CLIENT_SECRET = process.env.SLACK_CLIENT_SECRET as string;
+
+const slackStrategy = new SlackStrategy(
+  {
+    clientID: SLACK_CLIENT_ID,
+    clientSecret: SLACK_CLIENT_SECRET,
+    callbackURL: `${process.env.API_URL}/auth/slack/callback`,
+    passReqToCallback: true,
+    scope: ["identity.basic", "email"],
+  },
+  async (
+    req: any,
+    accessToken: any,
+    refreshToken: any,
+    profile: any,
+    done: any
+  ) => {
+    let stateData = null;
+
+    // Extract and decode state parameter if present
+    if (req.query.state) {
+      try {
+        // Validate state parameter as string because it's base64url
+        if (typeof req.query.state !== "string") {
+          throw new Error("Invalid state parameter format");
+        }
+
+        const decodedState = Buffer.from(
+          req.query.state,
+          "base64url"
+        ).toString();
+
+        const stateObject = JSON.parse(decodedState);
+
+        if (!stateObject.data || typeof stateObject.data !== "object") {
+          throw new Error("Missing or invalid data in state");
+        }
+
+        stateData = stateObject.data;
+      } catch (stateError: any) {
+        console.error("OAuth state validation failed:", {
+          error: stateError.message,
+          stateLength: req.query.state?.length || 0,
+          userAgent: req.get("User-Agent"),
+          ip: req.ip || req.connection.remoteAddress,
+        });
+
+        // For security reasons, don't expose detailed error messages
+        // Continue without state data - don't fail the authentication
+        stateData = null;
+      }
+    }
+    const user = await findOrCreateUser({
+      email: profile.user.email,
+      slackId: profile.user.id,
+      profile: {
+        firstName: profile.user.name || "Non renseigné",
+        lastName: "Non renseigné",
+      },
+      timezone: stateData?.timezone,
+    });
+
+    done(null, { user });
+  }
+);
+
 passport.use(jwtLogin);
 passport.use(localLogin);
 passport.use(googleStrategy);
+passport.use(slackStrategy);