TaskMaster CMS - Backend API

A modern, multi-tenant Content Management System API built with Node.js, Fastify, TypeScript, and Drizzle ORM. Each authenticated user can manage their own content while sharing common resources.

🚀 Features

Multi-Tenant Architecture

• User Isolation: Each user manages their own posts (published + drafts)
• Shared Resources: Categories and tags are shared across all users
• Public Access: Published posts are visible to everyone without authentication
• Ownership Validation: Users can only edit/delete their own posts

Technical Features

• Type-Safe API: Fully typed REST API with Zod validation
• Database: PostgreSQL managed with Drizzle ORM
• Authentication: Clerk integration with automatic user creation
• Auto-Reload: Development server with hot-reload using tsx watch

📦 Tech Stack

Technology	Purpose
Node.js	Runtime environment
Fastify	High-performance web framework
TypeScript	Type safety
PostgreSQL	Database (via Neon)
Drizzle ORM	Type-safe database queries
Zod	Schema validation
Clerk	Authentication & user management
Cuid2	Unique ID generation

🛠️ Setup & Installation

Prerequisites

• Node.js 18+ installed
• PostgreSQL database (recommend Neon for free hosting)
• Clerk account for authentication

1. Install Dependencies

npm install

2. Environment Variables

Create a .env file in the root directory:

# Database (Get from Neon.tech or your PostgreSQL provider)
DATABASE_URL="postgresql://user:password@host/database?sslmode=require"

# Clerk Authentication (Get from clerk.com dashboard)
CLERK_PUBLISHABLE_KEY="pk_test_..."
CLERK_SECRET_KEY="sk_test_..."

3. Database Setup

Run Migrations

npx drizzle-kit push

Seed Sample Data (Optional)

npm run seed

This creates:

• 2 sample users
• 3 roles (Admin, Author, Reader)
• 2 categories
• 4 tags
• 2 sample posts
• Sample comments and media

4. Start Development Server

npm run dev

Server runs at http://localhost:3333

The server will automatically reload when you make changes to the code.

📚 API Documentation

Authentication

All authenticated endpoints require these headers from Clerk:

• x-clerk-user-id: User's Clerk ID
• x-user-email: User's email
• x-user-name: User's display name
• x-user-image-url: User's avatar URL

Posts

Method	Endpoint	Auth	Description
GET	/api/posts	Public	List all published posts
GET	/api/posts/:id	Public	Get single post details
GET	/api/posts/my-posts	Required	Get user's own posts (all)
POST	/api/posts	Required	Create new post
PUT	/api/posts/:id	Required	Update own post
DELETE	/api/posts/:id	Required	Delete own post

Categories (Shared Resource)

Method	Endpoint	Auth	Description
GET	/api/categories	Public	List all categories
GET	/api/categories/:id	Public	Get category details
POST	/api/categories	Required	Create category
PUT	/api/categories/:id	Required	Update category
DELETE	/api/categories/:id	Required	Delete category

Tags (Shared Resource)

Method	Endpoint	Auth	Description
GET	/api/tags	Public	List all tags
GET	/api/tags/:id	Public	Get tag details
POST	/api/tags	Required	Create tag
PUT	/api/tags/:id	Required	Update tag
DELETE	/api/tags/:id	Required	Delete tag

Dashboard

Method	Endpoint	Auth	Description
GET	/api/dashboard/stats	Required	Get user-specific stats

Response:

{
  "totalPosts": 5,        // User's total posts
  "drafts": 2,            // User's draft posts
  "totalCategories": 10,  // Global count
  "totalTags": 15,        // Global count
  "totalUsers": 25        // Global count
}

Comments

Method	Endpoint	Auth	Description
GET	/api/posts/:postId/comments	Public	List post comments
POST	/api/posts/:postId/comments	Required	Add comment
DELETE	/api/comments/:id	Required	Delete comment

Users

Method	Endpoint	Auth	Description
GET	/api/users	Public	List all users
GET	/api/users/:id	Public	Get user details

📁 Project Structure

src/
├── db/
│   ├── index.ts           # Database connection
│   ├── schema.ts          # Database schema (tables)
│   └── seed.ts            # Sample data seeder
├── http/
│   ├── controllers/       # Business logic
│   │   ├── postsController.ts
│   │   ├── categoriesController.ts
│   │   ├── tagsController.ts
│   │   ├── dashboardController.ts
│   │   └── ...
│   ├── middlewares/       # Request interceptors
│   │   ├── authMiddleware.ts      # Authentication
│   │   └── roleMiddleware.ts      # Authorization (optional)
│   ├── routes/            # API route definitions
│   │   ├── postsRoutes.ts
│   │   ├── categoriesRoutes.ts
│   │   └── ...
│   └── server.ts          # Fastify server setup
├── lib/
│   └── env.ts             # Environment validation
└── services/              # External services (future)

🔒 Security Features

• Ownership Validation: Users can only modify their own posts
• Data Isolation: Each user's dashboard shows only their data
• Public Access Control: Only published posts are publicly visible
• Authentication Required: All mutations require valid Clerk session
• Auto User Creation: New users are automatically created on first login

🧪 Development

Available Scripts

npm run dev      # Start development server with hot-reload
npm run seed     # Seed database with sample data

Database Management

Using Drizzle Kit:

npx drizzle-kit studio    # Open Drizzle Studio (database GUI)
npx drizzle-kit push      # Push schema changes to database

🌐 CORS Configuration

Currently configured to accept requests from:

• http://localhost:5173 (Frontend dev server)

Update in src/http/server.ts if needed.