169-30-21-8-6-5-anurag-gupta

[Anurag2618g]

Summary

This Pull Request completes the six assigned qualification issues (#169, #30, #21, #8, #6, and #5). It implements a secure server-side logout mechanism, upgrades the submission flow to handle multiple files, resolves database consistency bugs during task deletion and review cascading, and delivers critical UI enhancements including premium dark mode and password visibility toggles. All changes have been tested locally and pass strict linting and build checks.

Checklist

Required before opening this PR: Complete these checks locally to ensure the code is ready for review. PRs opened without these checks passing may be closed.

• I ran cd client && npm run lint && npm run build and cd server && npm run lint && npm run build locally
• All checks passed (lint, build)
• No errors or warnings remain

Note: This is a pre-PR checklist completed before submission. Additional checklists below are completed after the PR is opened.

Short Demo Video (required)

https://drive.google.com/file/d/1XZgzJt-9Trqn5rKv3kfEV64U_wJyiwcW/view?usp=sharing

---

• I have read and followed the Contribution and Qualification Guidelines

Required Checklist

Task & Workflow

• Create a new Branch exactly matching your assigned name
• PR title is exactly your assigned branch name
• Latest target branch (master) was pulled immediately before opening this PR

Quality & Safety

• Change tested locally
• Full diff reviewed before submitting (no blind copy/paste)
• No secrets, keys, or personal data included

---

Issues Completed

Issue #169 - Premium Dark Mode Implementation

Problem

The application was hardcoded to a dark theme using inline styles and CSS variables, offering no light mode or system preference synchronization.

Implementation

• Enabled Tailwind v4's class-based dark mode (@custom-variant dark).
• Created a standalone ThemeToggle component that synchronizes localStorage and animates an SVG icon.
• Injected a blocking <script> in index.html before React hydrates to prevent theme flickering on initial load.

Result

The application now supports a fully functional, persistent dark/light mode toggle accessible from every page.

Issue #30 - Password Fields Lack Visibility Toggle

Problem

Password inputs on Login and Register forms were hardcoded to type="password", causing typos with no way to verify input.

Implementation

• Added a showPassword state toggle to conditionally switch the input type between text and password.
• Added absolute-positioned SVG eye icons to the input fields with dynamic accessibility labels.

Result

Users can safely reveal and hide their passwords without accidentally submitting the forms.

Issue #21 - Modify Upload System to Support Multiple Files

Problem

The submission flow and database schema were strictly limited to a single file per submission.

Implementation

• Updated the Mongoose Submission model to accept an array of strings (fileUrls).
• Changed the backend Multer configuration from upload.single() to upload.array('files', 10).
• Updated the frontend SubmitTaskModal to append multiple files to the FormData object using an array.

Result

Talent users can now upload and submit multiple files simultaneously, which render correctly in the Admin review panel.

Issue #8 – Submission Review Status Not Cascading

Problem

Reviewing a submission updated only the submission document while the parent task remained in the previous state.

Implementation

• Updated the review workflow to synchronize the parent task status.
• Approved submissions now update the task status to Approved.
• Rejected submissions now update the task status to Rejected.

Result

Task and submission status remain perfectly synchronized.

Issue #6 - Token Invalidation on Logout

Problem

Logout was strictly client-side. JWTs remained cryptographically valid on the server until expiration, leaving them vulnerable to replay attacks.

Implementation

• Created a BlockedToken Mongoose model with a MongoDB TTL (Time-To-Live) index to automatically purge documents at their natural expiry.
• Created a logoutUser controller that upserts the active JWT into the BlockedToken collection.
• Updated the protect auth middleware to check BlockedToken.exists() and reject blacklisted tokens with a 401.

Result

Logging out now actively invalidates the session token on the server-side, securing the API against captured token reuse.

Issue #5 – Task Deletion Leaves Orphaned Records

Problem

Deleting a task crashed the server or left related submission records orphaned in the database due to an invalid Mongoose query.

Implementation

• Implemented cascading deletion using Mongoose's deleteMany() to remove all associated submissions prior to deleting the parent task.

Result

Prevents database bloating and orphaned records while ensuring successful API responses.

---

Files Changed

Backend

• server/models/BlockedToken.js (new)
• server/models/Submission.js
• server/controllers/authController.js
• server/controllers/submissionController.js
• server/controllers/taskController.js
• server/middleware/authMiddleware.js
• server/routes/authRoutes.js
• server/routes/auth.js (new)
• server/routes/submissionRoutes.js

Frontend

• client/index.html
• client/src/index.css
• client/src/components/common/ThemeToggle.jsx (new)
• client/src/components/admin/Sidebar.jsx
• client/src/components/admin/TasksTable.jsx
• client/src/components/talent/TalentSidebar.jsx
• client/src/components/talent/SubmitTaskModal.jsx
• client/src/components/talent/SubmissionReviewModal.jsx
• client/src/pages/auth/LoginPage.jsx
• client/src/pages/auth/RegisterPage.jsx
• client/src/pages/admin/AdminDashboard.jsx
• client/src/pages/admin/SubmissionsPage.jsx
• client/src/context/AuthContext.jsx

---

Screenshots

---

Closes

Closes #169
Closes #30
Closes #21
Closes #8
Closes #6
Closes #5