Track project · 12

Secure TaskFlow End to End

Add Supabase identity, verify tokens in NestJS, and enforce roles, permissions, ownership, and tenant isolation on the API.

Build plan

Work through it one observable step at a time

01
Complete sign-up/sign-in and inspect the returned session.
02
Send an access token as a bearer token to the API.
03
Verify signature/issuer/audience/expiry before constructing current-user context.
04
Protect routes with a NestJS guard.
05
Return 401 for unusable authentication and 403 for valid identity without permission.
06
Add role/permission checks for one action.
07
Load the target task and enforce ownership/workspace membership server-side.
08
Perform an IDOR test by changing a task id while using another valid user token.
09
Add regression tests proving cross-tenant reads/writes stay forbidden.

Evidence

Do not rely on “it seems to work”

Evidence to collect

A clean Git diff or file-tree changeCommands used and their exit/resultBrowser, HTTP, database, test, container, or CI evidence that proves the behaviorOne deliberate failure, the evidence you used, and the root-cause fixA short explanation of why the final responsibility lives in the chosen layer

Project exit ticket

Close the project only when these are true

Completion

I can demonstrate every deliverable.I can reproduce one key part without the walkthrough.I can explain one trade-off I deliberately chose.I can show one failure that my tests, constraints, or runbook now protects against.