Setup

1. Backend

cd backend

# Create & activate virtual environment (recommended)
python -m venv venv
source venv/bin/activate        # Windows: venv\Scripts\activate

# Install dependencies
pip install -r requirements.txt

# Run migrations
python manage.py migrate

# (Optional) Create superuser for Django admin
python manage.py createsuperuser

# Populate demo data
python seed.py

# Start dev server
python manage.py runserver

Backend runs at http://localhost:8000

2. Frontend

cd frontend
npm install
npm run dev

Frontend runs at http://localhost:5173

The Vite proxy forwards all /api/* requests to the Django backend — no CORS issue in development.

![FlowTask Dashboard]

API Reference

Authentication

Tasks

Query Parameters (GET /api/tasks/)

?search=text              # searches title + description
?status=pending           # pending | in_progress | completed | cancelled
?priority=high            # low | medium | high | urgent
?assigned_to_me=true      # tasks assigned to current user
?created_by_me=true       # tasks created by current user
?is_overdue=true          # past due date, not completed
?due_date_before=YYYY-MM-DD
?due_date_after=YYYY-MM-DD
?ordering=-created_at     # any field, prefix - for descending
?page=2&page_size=10

Demo Accounts

After running seed.py:

Django admin panel: http://localhost:8000/admin

Key Architecture Notes

JWT Flow

1. User posts credentials to /api/accounts/login/
2. Server returns { access, refresh, user } — user object embedded in token response via CustomTokenObtainPairSerializer
3. Access token stored in localStorage, attached to every request via Axios interceptor
4. On 401, interceptor auto-refreshes using the refresh token, then retries the original request
5. Logout blacklists the refresh token server-side

Task Visibility

Users can see tasks they created OR tasks assigned to them. This is enforced in TaskViewSet.get_queryset() using a Q filter — not a permission class, so it's data-scoped rather than endpoint-scoped.

drf-rest-registration Note

drf-rest-registration is not available on PyPI for Python 3.10+. The registration endpoint in accounts/views.py (RegisterView) implements the same clean API contract: validates passwords match, hashes the password, returns the new user object with a 201 status. No functionality is lost.

Auto created_by

TaskViewSet.perform_create() injects created_by=request.user before saving — the frontend never needs to send this field.

Production Checklist

• Replace SECRET_KEY with a real secret (use python-decouple or env vars)
• Set DEBUG = False
• Replace SQLite with PostgreSQL
• Configure ALLOWED_HOSTS
• Set up static file serving (WhiteNoise or S3)
• Add rate limiting to auth endpoints
• Enable HTTPS and set SECURE_SSL_REDIRECT = True