Merge pull request #6 from kavinda-100/develop

Develop

Author: kavinda-100

.github/copilot-instructions.md

@@ -0,0 +1,15 @@
+---
+description: 'Use when a task spans both backend and frontend in Sprintly (route/DTO/response contract changes). Enforces strict cross-stack compatibility between Rust API and public UI.'
+name: 'Sprintly Cross-Stack Integration Rules'
+---
+
+# Sprintly Cross-Stack Integration Rules
+
+- Treat every rule in this file as a strict requirement, not a suggestion.
+- If backend DTOs/routes/response fields change, update frontend API usage in `public/` within the same task.
+- If frontend behavior requires contract changes, update controllers/routes/DTOs in the same task.
+- Keep response compatibility strict: frontend must consume `ApiResponse<T>` shape (`success`, `status_code`, `message`, `data`).
+- Keep error compatibility strict: backend errors must continue to come from `ApiError` and remain parseable by frontend flows.
+- Do not merge changes that leave backend and frontend out of sync.
+
+# For Now We Only work with the backend/api. (DO NOT GENERATE FRONTEND CODE YET UNTIL I ASK YOU TO DO SO)

.github/instructions/sprintly-api.instructions.md

@@ -0,0 +1,31 @@
+---
+description: 'Use when implementing or modifying Sprintly backend code in Rust/Axum/SQLx, including controllers, routes, auth, DTO validation, utils, and migrations. Enforces strict backend architecture and error/response patterns.'
+name: 'Sprintly Backend Strict Conventions'
+applyTo: 'src/**/*.rs, migrations/**/*.sql, API.http'
+---
+
+# Sprintly Backend Strict Conventions
+
+- Treat every rule in this file as a strict requirement, not a suggestion.
+- Use Rust with async/await for all I/O, especially DB and HTTP handlers.
+- Keep the architecture flow per resource as models -> controllers -> routes.
+- Prefer UUID primary keys for users, tasks, projects, workspaces, and lookup entities.
+- Use SQLx idioms (`query_as`, `FromRow`) and map DB errors to HTTP status codes (`404` not found, `500` internal error).
+- In Axum handlers, use `Router::new().route(...)` and shared state through `State`.
+- Use `chrono::Utc` or `chrono::NaiveDateTime` for timestamps.
+- Keep naming consistent: `snake_case` for functions and `PascalCase` for structs.
+- Keep imports clean and grouped as standard, external, then internal.
+- Prefer readable multiline SQL for complex queries.
+- For many-to-many task assignments, use join tables (for example `task_assignees`) with proper foreign keys.
+- Keep migrations in `migrations/`, add constraints deliberately (`UNIQUE`, foreign keys with `ON DELETE CASCADE` where appropriate), and use `uuid-ossp` for UUID generation when needed.
+
+## Controller Error/Response Pattern (Strict)
+
+- Follow the controller style used in `src/controllers/auth_controller.rs` for new and modified handlers.
+- Controller signatures must return `Result<Json<ApiResponse<T>>, ApiError>`.
+- Success responses must use `ApiResponse::new(...)` from `src/utils/response.rs`.
+- Failures must use `ApiError` variants from `src/utils/api_error.rs`; do not return ad-hoc JSON/string errors.
+- For DTO validation, call `payload.validate()` and convert errors using `format_validation_errors(...)` from `src/utils/mod.rs`, then return `ApiError::BadRequest(...)`.
+- Map database/crypto/JWT failures with `map_err(...)` into the correct `ApiError` variant.
+- Keep structured tracing logs (`tracing::info!`, `tracing::warn!`, `tracing::error!`) for key controller actions and failures.
+- Return API responses using `ApiResponse<T>` with consistent keys: `success`, `status_code`, `message`, `data`.

.github/instructions/sprintly-backend.instructions.md

@@ -0,0 +1,15 @@
+---
+description: 'Use when implementing or modifying Sprintly static UI in public HTML/CSS/JS files. Enforces strict public-folder conventions and backend response compatibility.'
+name: 'Sprintly Frontend Strict Conventions'
+applyTo: 'public/**/*.html, public/**/*.css, public/**/*.js'
+---
+
+# Sprintly Frontend Strict Conventions
+
+- Treat every rule in this file as a strict requirement, not a suggestion.
+- Keep frontend implementation simple and framework-free (plain HTML/CSS/JS) unless explicitly requested otherwise.
+- Preserve existing page structure and style conventions across `public/index.html`, `public/login.html`, `public/register.html`, `public/styles.css`, and `public/table.js`.
+- Keep static pages compatible with backend routes and auth flow.
+- When changing frontend API interactions, keep endpoint paths and HTTP methods aligned with backend routes.
+- Parse and handle API responses using the established response shape: `success`, `status_code`, `message`, `data`.
+- Do not introduce response contracts on the frontend that differ from `ApiResponse<T>` returned by backend controllers.

.github/instructions/sprintly-frontend.instructions.md

@@ -1,3 +1,4 @@
 pub mod auth_controller;
+pub mod project_controller;
 pub mod root_controller;
 pub mod workspace_controller;

src/controllers/mod.rs

@@ -0,0 +1,179 @@
+use axum::{
+    Json,
+    extract::{Path, State},
+    http::StatusCode,
+};
+use uuid::Uuid;
+use validator::Validate;
+
+use crate::{
+    config::AppState,
+    dtos::project_dto::{CreateProjectPayload, ProjectResponse, UpdateProjectPayload},
+    middleware::auth::AuthUser,
+    models::Project,
+    utils::{api_error::ApiError, format_validation_errors, response::ApiResponse},
+};
+
+/**
+ * Controller function to create a new project within a workspace. Validates the input payload, checks user authentication, and interacts with the database to persist the new project. Returns a structured API response with the created project details or appropriate error messages.
+ * Path: POST /api/v1/projects
+ */
+pub async fn create_project(
+    State(state): State<AppState>,
+    AuthUser(user): AuthUser,
+    Json(payload): Json<CreateProjectPayload>,
+) -> Result<Json<ApiResponse<ProjectResponse>>, ApiError> {
+    // logging the project creation attempt with the email (but not the password)
+    tracing::info!(
+        "Attempting to create project with name: {} for workspace: {} by user: {}",
+        payload.name,
+        payload.workspace_id,
+        user.email
+    );
+
+    // Validate the input payload
+    payload.validate().map_err(|e| {
+        let error_messages = format_validation_errors(&e);
+        tracing::error!("Validation errors: {}", error_messages);
+        ApiError::BadRequest(error_messages)
+    })?;
+
+    // create the project in the database
+    let project = sqlx::query_as::<_, Project>(
+        "INSERT INTO projects (workspace_id, name, description)
+        VALUES ($1, $2, $3)
+        RETURNING *",
+    )
+    .bind(payload.workspace_id)
+    .bind(&payload.name)
+    .bind(&payload.description)
+    .fetch_one(&state.db)
+    .await
+    .map_err(|_| ApiError::InternalServerError("Failed to create project".into()))?;
+
+    // return the created project in the response
+    Ok(Json(ApiResponse::new(
+        true,
+        StatusCode::CREATED,
+        "Project created successfully",
+        Some(ProjectResponse {
+            id: project.id,
+            workspace_id: project.workspace_id,
+            name: project.name,
+            description: project.description,
+            created_at: project.created_at,
+            updated_at: project.updated_at,
+        }),
+    )))
+}
+
+/**
+ * Controller function to update an existing project. Validates the input payload, checks user authentication, verifies project existence, and updates the project details in the database. Returns a structured API response with the updated project details or appropriate error messages.
+ * Path: PUT /api/v1/projects/{id}
+ */
+pub async fn update_project(
+    State(state): State<AppState>,
+    AuthUser(user): AuthUser,
+    Path(project_id): Path<Uuid>,
+    Json(payload): Json<UpdateProjectPayload>,
+) -> Result<Json<ApiResponse<ProjectResponse>>, ApiError> {
+    // logging the project update attempt with the email (but not the password)
+    tracing::info!(
+        "Attempting to update project with id: {} by user: {}",
+        project_id,
+        user.email
+    );
+
+    // Validate the input payload
+    payload.validate().map_err(|e| {
+        let error_messages = format_validation_errors(&e);
+        tracing::error!("Validation errors: {}", error_messages);
+        ApiError::BadRequest(error_messages)
+    })?;
+
+    // Check if the project exists
+    let existing_project = sqlx::query_as::<_, Project>("SELECT * FROM projects WHERE id = $1")
+        .bind(project_id)
+        .fetch_optional(&state.db)
+        .await
+        .map_err(|_| ApiError::InternalServerError("Failed to query project".into()))?;
+
+    // If the project does not exist, return a 404 error
+    if existing_project.is_none() {
+        tracing::warn!("Project with id: {} not found", project_id);
+        return Err(ApiError::NotFound("Project not found".into()));
+    }
+
+    // Update the project in the database
+    let updated_project = sqlx::query_as::<_, Project>(
+        "UPDATE projects SET name = COALESCE($1, name), description = COALESCE($2, description), updated_at = NOW()
+        WHERE id = $3
+        RETURNING *",
+    )
+    .bind(&payload.name)
+    .bind(&payload.description)
+    .bind(project_id)
+    .fetch_one(&state.db)
+    .await
+    .map_err(|_| ApiError::InternalServerError("Failed to update project".into()))?;
+
+    // return the updated project in the response
+    Ok(Json(ApiResponse::new(
+        true,
+        StatusCode::OK,
+        "Project updated successfully",
+        Some(ProjectResponse {
+            id: updated_project.id,
+            workspace_id: updated_project.workspace_id,
+            name: updated_project.name,
+            description: updated_project.description,
+            created_at: updated_project.created_at,
+            updated_at: updated_project.updated_at,
+        }),
+    )))
+}
+
+/**
+ * Controller function to delete an existing project. Checks user authentication, verifies project existence, and deletes the project from the database. Returns a structured API response indicating success or appropriate error messages.
+ * Path: DELETE /api/v1/projects/{id}
+ */
+pub async fn delete_project(
+    State(state): State<AppState>,
+    AuthUser(user): AuthUser,
+    Path(project_id): Path<Uuid>,
+) -> Result<Json<ApiResponse<()>>, ApiError> {
+    // logging the project deletion attempt with the email (but not the password)
+    tracing::info!(
+        "Attempting to delete project with id: {} by user: {}",
+        project_id,
+        user.email
+    );
+
+    // Check if the project exists
+    let existing_project = sqlx::query_as::<_, Project>("SELECT * FROM projects WHERE id = $1")
+        .bind(project_id)
+        .fetch_optional(&state.db)
+        .await
+        .map_err(|_| ApiError::InternalServerError("Failed to query project".into()))?;
+
+    // If the project does not exist, return a 404 error
+    if existing_project.is_none() {
+        tracing::warn!("Project with id: {} not found", project_id);
+        return Err(ApiError::NotFound("Project not found".into()));
+    }
+
+    // Delete the project from the database
+    sqlx::query("DELETE FROM projects WHERE id = $1")
+        .bind(project_id)
+        .execute(&state.db)
+        .await
+        .map_err(|_| ApiError::InternalServerError("Failed to delete project".into()))?;
+
+    // return a success response with no data
+    Ok(Json(ApiResponse::new(
+        true,
+        StatusCode::OK,
+        "Project deleted successfully",
+        None,
+    )))
+}