Skip to content

Resolves #4, #6, #9, #11, #26, #166 — Core Security, Validation & UI Enhancements - #333

Open
shouryapratap132006 wants to merge 6 commits into
modelsuite-ai:masterfrom
shouryapratap132006:166-26-11-9-6-4-shourya-pratap
Open

Resolves #4, #6, #9, #11, #26, #166 — Core Security, Validation & UI Enhancements#333
shouryapratap132006 wants to merge 6 commits into
modelsuite-ai:masterfrom
shouryapratap132006:166-26-11-9-6-4-shourya-pratap

Conversation

@shouryapratap132006

@shouryapratap132006 shouryapratap132006 commented Jul 21, 2026

Copy link
Copy Markdown

Closes #4, Closes #6, Closes #9, Closes #11, Closes #26, Closes #166

Summary of Changes

Issue #4 — [Security] Unrestricted File Uploads Accept Executable Files

  • Configured Multer with explicit MIME type and file extension allowlists (images, pdf, doc/docx, xls/xlsx, txt).
  • Enforced a 10 MB maximum file size limit.
  • Added Express error middleware to return clean 400 Bad Request responses on upload errors or invalid file types/executables.

Issue #9 — [Bug] Task Creation API Allows Empty Payloads

  • Added server-side validation to createTask returning 400 Bad Request when title is missing or empty whitespace.
  • Updated Task schema with required: true, trim: true, and default status: 'Open'.
  • Added client-side form validation with real-time error clearing on input change in CreateTaskModal.

Issue #6 — [Security] Lack of Server-Side Session Invalidation Upon Logout

  • Implemented an in-memory token blocklist set (tokenBlocklist.js).
  • Created POST /api/auth/logout endpoint to add invalidated JWTs to the blocklist.
  • Updated protect middleware to check blocklist and reject invalidated tokens with 401 Unauthorized.
  • Updated client AuthContext.logout() to call the server-side logout before clearing storage.

Issue #11 — [Feature] Add Search and Status Filtering to Admin Task List

  • Enhanced task search in AdminDashboard to cover title, description, and assigned talent name.
  • Added a "Clear filters" button when filters are active.
  • Added context-aware empty states to TasksTable.

Issue #166 — Available Tasks Discovery Redesign

  • Redesigned AvailableTasksList with search filtering (title/description), live task counters, and improved empty states.
  • Enhanced TaskCard with date formatting, color-coded urgency badges ("Overdue", "Due today", "Due tomorrow", "Xd left"), and hover animations.

Issue #26 — [UX] Missing Confirmation Dialogs for Destructive Action

  • Built a reusable ConfirmDialog modal component.
  • Added confirmation prompts prior to deleting tasks in TasksTable and rejecting submissions in SubmissionReviewModal.

@shouryapratap132006
fix(modelsuite-ai#4): restrict file uploads to safe types with 10 MB …
df19c5a 
…size limit

- Add MIME type allowlist (images, pdf, doc/docx, xls/xlsx, txt)
- Add file extension allowlist validated alongside MIME type
- Add 10 MB file size limit via multer limits config
- Add Express error handler on submission route to return clean 400
  for MulterError (size) and fileFilter rejections (bad type)
- Executables (.exe, .sh, .bat, .php, .js, etc.) are now rejected
@shouryapratap132006
fix(modelsuite-ai#9): validate required title field on task creation
9f1c6e3 
- Server: return 400 with clear message when title is missing/empty
- Model: add required:true + trim to title field; add 'Open' default status
- Client: inline error state on CreateTaskModal when title is blank;
  red border + error message cleared as user types; aria attributes added
@shouryapratap132006
fix(modelsuite-ai#6): implement server-side token invalidation on logout
6b841fa 
- Add server/config/tokenBlocklist.js: in-memory Set for invalidated JWTs
- Add POST /api/auth/logout route (requires valid token via protect)
- logoutUser controller adds current token to blocklist
- protect middleware rejects blocklisted tokens with 401
- AuthContext.logout() now awaits POST /api/auth/logout before clearing
  localStorage, so captured tokens are server-side invalidated
- Sidebar and TalentSidebar await async logout before navigating
- Token expiry shortened from 7d to 1d (reduces blocklist retention)
@shouryapratap132006
feat(modelsuite-ai#11): enhance admin task search and status filter
6327c70 
- Extend search scope to include task description (was title + assignee only)
- Add 'Clear filters' (x Clear) button that appears when any filter is active
- Add unique ids to search input and status select for testability
- TasksTable shows context-aware empty state: distinguishes between
  'no tasks exist' vs 'no tasks match current filters'
@shouryapratap132006
feat(modelsuite-ai#166): redesign available tasks discovery UI
b87f6d7 
TaskCard.jsx:
- Proper date formatting using toLocaleDateString
- Urgency chips: 'Overdue', 'Due today', 'Due tomorrow', 'X days left'
  with color coding (red/amber/neutral)
- Description line-clamp to 2 lines to keep cards uniform
- Subtle hover box-shadow effect
- Unique id on Claim button for testability

AvailableTasksList.jsx:
- Search bar filtering by title and description with useMemo
- Live counter showing matched / total count
- 'Clear' button when search is active
- Context-aware empty states: no tasks vs no matches
- Icon in empty state changes between search and default
@shouryapratap132006
feat(modelsuite-ai#26): add confirmation dialogs for destructive actions
8cc265c 
- New ConfirmDialog component: reusable modal with title, warning icon,
  message, Cancel and configurable confirm button (danger/warning variants)
- TasksTable: delete task button now opens ConfirmDialog showing the task
  title; API call only fires after explicit user confirmation
- SubmissionReviewModal: Reject button opens ConfirmDialog showing talent
  name; Approve remains immediate (non-destructive, no confirm needed)
- Both destructive buttons given unique ids for testability
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment