fix: resolve issues #27, #19, #14, #9, #7, #6

[vinoth12345678910]

Summary

This PR fixes 6 assigned issues (#27, #19, #14, #9, #7, #6) across the Task Pipeline application. Frontend changes include table text overflow handling, logout button with "Sign out" text label, and "Overdue"/"Due Soon" visual badges for task due dates. Backend changes include server-side validation for task creation, role-based access control (talentOnly middleware) to prevent IDOR, and JWT token versioning for server-side session invalidation on logout.

What Was Done

Issue #27 — [UI] Long Text Strings Break Table Constraints

• Added table-cell-truncate and text-truncate CSS classes to handle word-break and ellipsis truncation
• Applied to TasksTable (Title/Description columns) and SubmissionsPage (Task/Notes columns)
• Files: client/src/components/admin/TasksTable.jsx, client/src/pages/admin/SubmissionsPage.jsx, client/src/index.css

Issue #19 — [UX] Logout Button Lacks Clear Affordance

• Added "Sign out" text label next to the logout icon in both Admin and Talent sidebars
• Updated .logout-btn CSS to support icon+text layout with gap spacing
• Files: client/src/components/admin/Sidebar.jsx, client/src/components/talent/TalentSidebar.jsx, client/src/index.css

Issue #14 — [Feature] Add "Due Soon" and "Overdue" Visual Badges

• Added getDueDateStatus() utility that returns "Overdue" (past due) or "Due Soon" (within 3 days)
• Badges hidden for Approved/Submitted tasks
• Applied to TasksTable, TaskCard, and MyTasksList
• Files: client/src/components/admin/TasksTable.jsx, client/src/components/talent/TaskCard.jsx, client/src/components/talent/MyTasksList.jsx, client/src/index.css

Issue #9 — [Bug] Task Creation API Allows Empty Payloads

• Added validation: title (required, non-empty string), status (enum check), dueDate (valid date)
• Returns HTTP 400 with descriptive error messages
• Files: server/controllers/taskController.js

Issue #7 — [Security] IDOR Vulnerability in Task Details API

• Added talentOnly middleware that verifies req.user.role === 'Talent'
• Applied to all 3 talent routes: /tasks/available, /tasks/mine, /tasks/:id/claim
• Admin users now receive 403 "Access denied: Talent only"
• Files: server/middleware/authMiddleware.js, server/routes/talentRoutes.js

Issue #6 — [Security] Lack of Server-Side Session Invalidation Upon Logout

• Added tokenVersion field to User model (default: 0)
• generateToken now includes tokenVersion in JWT payload
• protect middleware verifies tokenVersion matches on each request
• Added POST /api/auth/logout endpoint that increments tokenVersion
• Frontend logout() calls server endpoint before clearing localStorage
• Files: server/models/User.js, server/controllers/authController.js, server/routes/authRoutes.js, server/middleware/authMiddleware.js, client/src/context/AuthContext.jsx, client/src/components/admin/Sidebar.jsx, client/src/components/talent/TalentSidebar.jsx

How It Was Tested

Frontend (Issues #27, #19, #14)

• Created tasks with 100+ character titles — text truncates with ellipsis, no layout break
• Verified logout button shows "Sign out" text in both admin and talent sidebars
• Verified "Overdue" badge (red) appears on tasks with past due dates
• Verified "Due Soon" badge (amber) appears on tasks due within 3 days
• Verified no badge appears for Approved/Submitted tasks or tasks without due dates

Backend (Issues #9, #7, #6)

• POST /api/tasks with empty body {} → 400 "Title is required"
• Admin token hitting /api/talent/tasks/mine → 403 "Access denied: Talent only"
• Talent token hitting /api/talent/tasks/mine → 200 with task list
• After logout, old JWT → 401 "Token has been revoked"
• New login after logout → fresh token works correctly

Build

• Client build: npm run build — passed
• Server syntax: node -c index.js — passed

Files Changed

File	Issue
client/src/index.css	#27, #19, #14
client/src/components/admin/TasksTable.jsx	#27, #14
client/src/pages/admin/SubmissionsPage.jsx	#27
client/src/components/admin/Sidebar.jsx	#19, #6
client/src/components/talent/TalentSidebar.jsx	#19, #6
client/src/components/talent/TaskCard.jsx	#14
client/src/components/talent/MyTasksList.jsx	#14
client/src/context/AuthContext.jsx	#6
server/controllers/taskController.js	#9
server/controllers/authController.js	#6
server/middleware/authMiddleware.js	#6, #7
server/models/User.js	#6
server/routes/authRoutes.js	#6
server/routes/talentRoutes.js	#7

Testing Notes

1. Start MongoDB: docker compose up -d
2. Seed database: cd server && npm run seed
3. Start server: cd server && npm run dev
4. Start client: cd client && npm run dev
5. Login as Admin: admin@taskpipeline.com / admin123
6. Login as Talent: alice@taskpipeline.com / talent123

Note on Lint

All 40 client lint errors and 1 server lint error are pre-existing in the original codebase (unused imports, unused variables). None were introduced by this PR. These are not related to the 6 assigned issues.

Checklist

Required before opening this PR: Complete these checks locally to ensure the code is ready for review. PRs opened without these checks passing may be closed.

• I ran cd client && npm run lint && npm run build and cd server && npm run lint && npm run build locally
• All checks passed (lint, build)
• No errors or warnings remain

Note: This is a pre-PR checklist completed before submission. Additional checklists below are completed after the PR is opened.

Short Demo Video (required)

---

• I have read and followed the Contribution and Qualification Guidelines

Required Checklist

Task & Workflow

• Create a new Branch exactly matching your assigned name (e.g. 27-26-22-7-5-pranav-test)
• PR title is exactly your assigned branch name
• Latest target branch (master) was pulled immediately before opening this PR

Quality & Safety

• Change tested locally
• Full diff reviewed before submitting (no blind copy/paste)
• No secrets, keys, or personal data included