TaskFlow API

A backend workflow and job management API built with Python and FastAPI.

TaskFlow API provides user authentication and job management through REST APIs, with PostgreSQL as the database and JWT-based authentication, along with a Streamlit-based web interface for interacting with the application.

Features

• User signup and login
• JWT authentication
• Secure password hashing
• Encrypted cookie-based session handling in the Streamlit UI
• Create, read, update and delete jobs
• User-specific job access
• User/job authorization isolation
• PostgreSQL database
• Separate test database
• Automated API testing with Pytest
• Docker-based PostgreSQL test environment
• Dependency injection for database connection management
• Streamlit web UI
• REST API documentation with Swagger UI
• CI/CD pipeline using GitHub Actions
• Deployed on Render

Tech Stack

Backend

• Python
• FastAPI
• PostgreSQL
• Psycopg2
• JWT
• bcrypt
• python-dotenv

Frontend / UI

• Streamlit
• Streamlit Cookies Manager

Testing

• Pytest
• FastAPI
• Separate PostgreSL database

DevOps & Tools

• Docker
• Docker Compose
• Git & GitHub
• GitHub Actions
• Render

Project Structure

TaskFlow API
│
├── README.md
├── .dockerignore
├── .gitignore
├── docker-compose.yml
├── Dockerfile
├── requirements.txt
│
├── config.py
├── database.py
├── init_postgres.py
├── logger.py
├── models.py
├── security.py
├── main.py
│
├── routes/
│   ├── auth.py
│   └── jobs.py
│
├── ui/
│   ├── __init__.py
│   └── app.py
│   │
│   ├── components/
│   │   ├── __init__.py
│   │   ├── create_job.py
│   │   ├── delete_job.py
│   │   ├── jobs_table.py
│   │   ├── update_job.py
│   │
│   ├── services/
│   │   ├── __init__.py
│   │   ├── auth.py
│   │   ├── cookies.py
│   │   ├── jobs.py
│   │
│   └── views/
│   │   ├── __init__.py
│   │   ├── auth_page.py
│   │   ├── dashboard_page.py
│
└── tests/
    ├── __init__.py
    ├── conftest.py
    ├── test_auth.py
    └── test_jobs.py

Application Architecture

TaskFlow is structured into two main layers:

1. FastAPI Backend

The FastAPI application provides the REST API and handles:

• User authentication
• JWT token generation and validation
• Password hashing
• Job CRUD operations
• Database access
• User authorization

2. Streamlit UI

The Streamlit application provides a web interface on top of the FastAPI backend.

The UI is organized into:

• Views – authentication and dashboard pages
• Components – job creation, updating, deletion and job table components
• Services – API communication and cookie/session management

The Streamlit UI communicates with the FastAPI backend through its REST APIs rather than directly accessing the PostgreSQL database.

Authentication

TaskFlow API uses JWT-based authentication.

Users can:

1. Create an account using /signup
2. Login using /login
3. Receive a JWT access token
4. Use the token to access protected job APIs

Protected endpoints require:

Authorization: Bearer <access_token>

The Streamlit UI stores the authentication token using encrypted cookies so that the user session can persist across Streamlit reruns.

Job APIs

Method	Endpoint	Description
POST	/jobs	Create a job
GET	/jobs	Get user's jobs
PUT	/jobs/{job_id}	Update job status
DELETE	/jobs/{job_id}	Delete a job

Streamlit UI

The Streamlit interface provides a user-friendly way to interact with the TaskFlow API.

Authentication

The UI provides:

• Signup
• Login
• Logout
• Session persistence using encrypted cookies

Dashboard

Authenticated users can:

• View their jobs
• Create new jobs
• Update job status
• Delete jobs

The UI communicates with the deployed FastAPI backend through HTTP requests.

Testing

The project uses Pytest for automated API testing.

Tests run against a separate PostgreSQL test database rather than the production database.

Test coverage includes:

• Signup
• Login
• Duplicate signup
• Invalid login
• JWT authentication
• Job creation
• Job retrieval
• Job updates
• Job deletion
• Non-existent jobs
• Unauthorized access
• User/job authorization isolation

Run the tests with:

python -m pytest -v

Running Locally

1. Clone the repository

git clone <your-repository-url>
cd taskflow-api

2. Create a virtual environment

python -m venv .venv

On Windows:

.venv\Scripts\activate

3. Install dependencies

pip install -r requirements.txt

4. Configure environment variables

Create a .env file containing:

SECRET_KEY=<your-secret-key>
ALGORITHM=<your-algorithm>
DATABASE_URL=<your-database-url>
TEST_DATABASE_URL=<your-test-database-url>
COOKIES_PASSWORD=<your-cookie-encryption-password>

Do not commit .env to GitHub.

5. Run the application

uvicorn main:app --reload

The API will be available at:

http://localhost:8000

Interactive API documentation:

http://localhost:8000/docs

6. Run the Streamlit UI

In a separate terminal:

streamlit run ui/app.py

The Streamlit UI will be available at the URL displayed by Streamlit, typically:

http://localhost:8501

Docker

Docker Compose is used to run the PostgreSQL test database.

docker compose up -d

The test database is isolated from the production database.

Deployment

The application is deployed on Render as two independent services: the FastAPI backend and the Streamlit UI, communicating with each other over HTTPS.

The application uses PostgreSQL for persistent data storage.

Deployment is controlled by a CI/CD pipeline built with GitHub Actions:

1. On every push, an automated Pytest suite runs against an isolated PostgreSQL test database.
2. If all tests pass, a deploy job is triggered that calls Render's deploy hooks for both the backend and UI services.
3. Render's built-in auto-deploy is disabled for both services, so deployment only ever happens through this tested pipeline — broken code is never deployed to production.

Environment variables and secrets (including Render deploy hooks) are stored as GitHub Actions secrets and Render environment variables, rather than committed to the repository.

Future Improvements

• AI-powered job assistant: LLM integration (OpenAI/Anthropic API) to auto-generate job descriptions and summarize job status updates
• Semantic search over jobs using vector embeddings (pgvector) — natural language job queries instead of exact-match filtering
• Redis caching for frequently accessed job data
• Celery-based background processing for job notifications (async, non-blocking)
• Rate limiting on API endpoints
• API versioning
• Production-grade logging and monitoring (structured logs, error tracking)
• Automated tests for the Streamlit UI
• Cloud deployment on AWS/GCP for production-style, scalable infrastructure
• Additional job workflow features (e.g., due dates, priority levels)