fixxed color selector in the category settings and fixxed drag and drop

subtask

backend/dist/routes/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AASA,QAAA,MAAM,MAAM,4CAAW,CAAC;AAmFxB,eAAe,MAAM,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AAYA,QAAA,MAAM,MAAM,4CAAW,CAAC;AA0LxB,eAAe,MAAM,CAAC"}

backend/dist/routes/auth.js

@@ -1,4 +1,7 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const express_1 = require("express");
 const asyncHandler_1 = require("../utils/asyncHandler");
@@ -8,7 +11,47 @@ const drizzle_orm_1 = require("drizzle-orm");
 const auth_1 = require("../utils/auth");
 const errorHandler_1 = require("../middleware/errorHandler");
 const zod_1 = require("zod");
+const bcryptjs_1 = __importDefault(require("bcryptjs"));
+const express_rate_limit_1 = __importDefault(require("express-rate-limit"));
+const crypto_1 = __importDefault(require("crypto"));
 const router = (0, express_1.Router)();
+// Rate limiting for auth endpoints
+const authLimiter = (0, express_rate_limit_1.default)({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 10, // limit each IP to 10 requests per windowMs
+    message: {
+        error: {
+            code: 'RATE_LIMITED',
+            message: 'Too many attempts. Please try again later.',
+        },
+    },
+    standardHeaders: true,
+    legacyHeaders: false,
+});
+const loginLimiter = (0, express_rate_limit_1.default)({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 5, // stricter limit for login
+    message: {
+        error: {
+            code: 'RATE_LIMITED',
+            message: 'Too many login attempts. Please try again later.',
+        },
+    },
+    standardHeaders: true,
+    legacyHeaders: false,
+});
+const passwordResetLimiter = (0, express_rate_limit_1.default)({
+    windowMs: 60 * 60 * 1000, // 1 hour
+    max: 3, // very strict for password reset
+    message: {
+        error: {
+            code: 'RATE_LIMITED',
+            message: 'Too many password reset requests. Please try again later.',
+        },
+    },
+    standardHeaders: true,
+    legacyHeaders: false,
+});
 const usernameSchema = zod_1.z
     .string()
     .min(3)
@@ -22,15 +65,24 @@ const loginSchema = zod_1.z.object({
     username: zod_1.z.string(),
     password: zod_1.z.string(),
 });
-// In production, use bcrypt or argon2 for password hashing
-function hashPassword(password) {
-    // Simple hash for demo - replace with bcrypt in production
-    return Buffer.from(password).toString('base64');
+const forgotPasswordSchema = zod_1.z.object({
+    username: zod_1.z.string().min(1),
+});
+const resetPasswordSchema = zod_1.z.object({
+    token: zod_1.z.string().min(1),
+    password: zod_1.z.string().min(8),
+});
+const BCRYPT_ROUNDS = 12;
+async function hashPassword(password) {
+    return bcryptjs_1.default.hash(password, BCRYPT_ROUNDS);
 }
-function verifyPassword(password, hash) {
-    return hashPassword(password) === hash;
+async function verifyPassword(password, hash) {
+    return bcryptjs_1.default.compare(password, hash);
 }
-router.post('/register', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
+function generateResetToken() {
+    return crypto_1.default.randomBytes(32).toString('hex');
+}
+router.post('/register', authLimiter, (0, asyncHandler_1.asyncHandler)(async (req, res) => {
     const data = registerSchema.parse(req.body);
     const existing = await db_1.db.select().from(schema_1.users).where((0, drizzle_orm_1.eq)(schema_1.users.username, data.username)).limit(1);
     if (existing.length > 0) {
@@ -41,7 +93,7 @@ router.post('/register', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
     await db_1.db.insert(schema_1.users).values({
         id: userId,
         username: data.username,
-        passwordHash: hashPassword(data.password),
+        passwordHash: await hashPassword(data.password),
         createdAt: now,
     });
     const token = (0, auth_1.generateToken)({ userId, username: data.username });
@@ -50,7 +102,7 @@ router.post('/register', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
         token,
     });
 }));
-router.post('/login', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
+router.post('/login', loginLimiter, (0, asyncHandler_1.asyncHandler)(async (req, res) => {
     const data = loginSchema.parse(req.body);
     const user = await db_1.db.select().from(schema_1.users).where((0, drizzle_orm_1.eq)(schema_1.users.username, data.username)).limit(1);
     if (user.length === 0 || !verifyPassword(data.password, user[0].passwordHash)) {
@@ -72,5 +124,45 @@ router.get('/me', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
     }
     res.json({ id: user[0].id, username: user[0].username });
 }));
+router.post('/forgot-password', passwordResetLimiter, (0, asyncHandler_1.asyncHandler)(async (req, res) => {
+    const data = forgotPasswordSchema.parse(req.body);
+    const user = await db_1.db.select().from(schema_1.users).where((0, drizzle_orm_1.eq)(schema_1.users.username, data.username)).limit(1);
+    // Always return success to prevent username enumeration
+    if (user.length === 0) {
+        res.json({ success: true });
+        return;
+    }
+    const resetToken = generateResetToken();
+    const resetTokenExpiry = Date.now() + 3600000; // 1 hour
+    await db_1.db
+        .update(schema_1.users)
+        .set({ resetToken, resetTokenExpiry })
+        .where((0, drizzle_orm_1.eq)(schema_1.users.id, user[0].id));
+    // In production, send email with reset link
+    // For now, return token in response (dev only)
+    if (process.env.NODE_ENV !== 'production') {
+        res.json({ success: true, resetToken });
+    }
+    else {
+        res.json({ success: true });
+    }
+}));
+router.post('/reset-password', passwordResetLimiter, (0, asyncHandler_1.asyncHandler)(async (req, res) => {
+    const data = resetPasswordSchema.parse(req.body);
+    const user = await db_1.db
+        .select()
+        .from(schema_1.users)
+        .where((0, drizzle_orm_1.eq)(schema_1.users.resetToken, data.token))
+        .limit(1);
+    if (user.length === 0 || !user[0].resetTokenExpiry || user[0].resetTokenExpiry < Date.now()) {
+        throw new errorHandler_1.AppError('INVALID_TOKEN', 'Invalid or expired reset token', 400);
+    }
+    const newPasswordHash = await hashPassword(data.password);
+    await db_1.db
+        .update(schema_1.users)
+        .set({ passwordHash: newPasswordHash, resetToken: null, resetTokenExpiry: null })
+        .where((0, drizzle_orm_1.eq)(schema_1.users.id, user[0].id));
+    res.json({ success: true });
+}));
 exports.default = router;
 //# sourceMappingURL=auth.js.map

backend/dist/routes/friends.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"friends.d.ts","sourceRoot":"","sources":["../../src/routes/friends.ts"],"names":[],"mappings":"AAUA,QAAA,MAAM,MAAM,4CAAW,CAAC;AAsKxB,eAAe,MAAM,CAAC"}
+{"version":3,"file":"friends.d.ts","sourceRoot":"","sources":["../../src/routes/friends.ts"],"names":[],"mappings":"AAUA,QAAA,MAAM,MAAM,4CAAW,CAAC;AAuLxB,eAAe,MAAM,CAAC"}

backend/dist/routes/friends.js

@@ -53,6 +53,17 @@ router.get('/', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
     }));
     res.json({ friends, incoming, outgoing });
 }));
+router.get('/search', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
+    const { q } = validation_1.searchQuerySchema.parse(req.query);
+    const userId = req.user.userId;
+    const results = await db_1.db
+        .select({ id: schema_1.users.id, username: schema_1.users.username })
+        .from(schema_1.users)
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.ne)(schema_1.users.id, userId), (0, drizzle_orm_1.ilike)(schema_1.users.username, `%${q}%`)))
+        .orderBy((0, drizzle_orm_1.asc)(schema_1.users.username))
+        .limit(20);
+    res.json(results);
+}));
 router.post('/requests', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
     const { username } = validation_1.friendRequestSchema.parse(req.body);
     const userId = req.user.userId;

backend/dist/routes/repeatProfiles.d.ts

@@ -0,0 +1,3 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;
+//# sourceMappingURL=repeatProfiles.d.ts.map

backend/dist/routes/repeatProfiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repeatProfiles.d.ts","sourceRoot":"","sources":["../../src/routes/repeatProfiles.ts"],"names":[],"mappings":"AAUA,QAAA,MAAM,MAAM,4CAAW,CAAC;AA+ExB,eAAe,MAAM,CAAC"}

backend/dist/routes/repeatProfiles.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const asyncHandler_1 = require("../utils/asyncHandler");
+const db_1 = require("../db");
+const schema_1 = require("../db/schema");
+const drizzle_orm_1 = require("drizzle-orm");
+const auth_1 = require("../utils/auth");
+const auth_2 = require("../utils/auth");
+const errorHandler_1 = require("../middleware/errorHandler");
+const validation_1 = require("../utils/validation");
+const router = (0, express_1.Router)();
+router.use(auth_1.authMiddleware);
+router.get('/', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
+    const profiles = await db_1.db
+        .select()
+        .from(schema_1.repeatProfiles)
+        .where((0, drizzle_orm_1.eq)(schema_1.repeatProfiles.userId, req.user.userId))
+        .orderBy((0, drizzle_orm_1.asc)(schema_1.repeatProfiles.createdAt));
+    res.json({ profiles });
+}));
+router.post('/', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
+    const data = validation_1.repeatProfileSchema.parse(req.body);
+    const userId = req.user.userId;
+    const now = Date.now();
+    const newProfile = {
+        id: (0, auth_2.generateId)('rp'),
+        userId,
+        name: data.name,
+        repeat: data.repeat,
+        repeatInterval: data.repeatInterval,
+        repeatDays: data.repeatDays,
+        createdAt: now,
+        updatedAt: now,
+    };
+    await db_1.db.insert(schema_1.repeatProfiles).values(newProfile);
+    res.status(201).json(newProfile);
+}));
+router.patch('/:id', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
+    const data = validation_1.repeatProfileUpdateSchema.parse(req.body);
+    const userId = req.user.userId;
+    const existing = await db_1.db
+        .select()
+        .from(schema_1.repeatProfiles)
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.repeatProfiles.id, req.params.id), (0, drizzle_orm_1.eq)(schema_1.repeatProfiles.userId, userId)))
+        .limit(1);
+    if (existing.length === 0) {
+        throw new errorHandler_1.AppError('NOT_FOUND', 'Repeat profile not found', 404);
+    }
+    const now = Date.now();
+    const updated = await db_1.db
+        .update(schema_1.repeatProfiles)
+        .set({ ...data, updatedAt: now })
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.repeatProfiles.id, req.params.id), (0, drizzle_orm_1.eq)(schema_1.repeatProfiles.userId, userId)))
+        .returning();
+    res.json(updated[0]);
+}));
+router.delete('/:id', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
+    const userId = req.user.userId;
+    const existing = await db_1.db
+        .select()
+        .from(schema_1.repeatProfiles)
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.repeatProfiles.id, req.params.id), (0, drizzle_orm_1.eq)(schema_1.repeatProfiles.userId, userId)))
+        .limit(1);
+    if (existing.length === 0) {
+        throw new errorHandler_1.AppError('NOT_FOUND', 'Repeat profile not found', 404);
+    }
+    await db_1.db
+        .delete(schema_1.repeatProfiles)
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.repeatProfiles.id, req.params.id), (0, drizzle_orm_1.eq)(schema_1.repeatProfiles.userId, userId)));
+    res.status(204).send();
+}));
+exports.default = router;
+//# sourceMappingURL=repeatProfiles.js.map

backend/dist/routes/repeatProfiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repeatProfiles.js","sourceRoot":"","sources":["../../src/routes/repeatProfiles.ts"],"names":[],"mappings":";;AAAA,qCAAoD;AACpD,wDAAqD;AACrD,8BAA2B;AAC3B,yCAA8C;AAC9C,6CAA2C;AAC3C,wCAA+C;AAC/C,wCAA2C;AAC3C,6DAAsD;AACtD,oDAAqF;AAErF,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;AAExB,MAAM,CAAC,GAAG,CAAC,qBAAc,CAAC,CAAC;AAE3B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAA,2BAAY,EAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACjE,MAAM,QAAQ,GAAG,MAAM,OAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,uBAAc,CAAC;SACpB,KAAK,CAAC,IAAA,gBAAE,EAAC,uBAAc,CAAC,MAAM,EAAE,GAAG,CAAC,IAAK,CAAC,MAAM,CAAC,CAAC;SAClD,OAAO,CAAC,IAAA,iBAAG,EAAC,uBAAc,CAAC,SAAS,CAAC,CAAC,CAAC;IAE1C,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAA,2BAAY,EAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAClE,MAAM,IAAI,GAAG,gCAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAK,CAAC,MAAM,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,MAAM,UAAU,GAAG;QACjB,EAAE,EAAE,IAAA,iBAAU,EAAC,IAAI,CAAC;QACpB,MAAM;QACN,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;IAEF,MAAM,OAAE,CAAC,MAAM,CAAC,uBAAc,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAA,2BAAY,EAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACtE,MAAM,IAAI,GAAG,sCAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAK,CAAC,MAAM,CAAC;IAEhC,MAAM,QAAQ,GAAG,MAAM,OAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,uBAAc,CAAC;SACpB,KAAK,CAAC,IAAA,iBAAG,EAAC,IAAA,gBAAE,EAAC,uBAAc,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAA,gBAAE,EAAC,uBAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;SACnF,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,uBAAQ,CAAC,WAAW,EAAE,0BAA0B,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,MAAM,OAAE;SACrB,MAAM,CAAC,uBAAc,CAAC;SACtB,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SAChC,KAAK,CAAC,IAAA,iBAAG,EAAC,IAAA,gBAAE,EAAC,uBAAc,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAA,gBAAE,EAAC,uBAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;SACnF,SAAS,EAAE,CAAC;IAEf,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAA,2BAAY,EAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAK,CAAC,MAAM,CAAC;IAEhC,MAAM,QAAQ,GAAG,MAAM,OAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,uBAAc,CAAC;SACpB,KAAK,CAAC,IAAA,iBAAG,EAAC,IAAA,gBAAE,EAAC,uBAAc,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAA,gBAAE,EAAC,uBAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;SACnF,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,uBAAQ,CAAC,WAAW,EAAE,0BAA0B,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,OAAE;SACL,MAAM,CAAC,uBAAc,CAAC;SACtB,KAAK,CAAC,IAAA,iBAAG,EAAC,IAAA,gBAAE,EAAC,uBAAc,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAA,gBAAE,EAAC,uBAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAEvF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC,CAAC,CAAC,CAAC;AAEJ,kBAAe,MAAM,CAAC"}

backend/dist/routes/subtasks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subtasks.d.ts","sourceRoot":"","sources":["../../src/routes/subtasks.ts"],"names":[],"mappings":"AASA,QAAA,MAAM,MAAM,4CAAW,CAAC;AAmIxB,eAAe,MAAM,CAAC"}
+{"version":3,"file":"subtasks.d.ts","sourceRoot":"","sources":["../../src/routes/subtasks.ts"],"names":[],"mappings":"AASA,QAAA,MAAM,MAAM,4CAAW,CAAC;AAoKxB,eAAe,MAAM,CAAC"}

backend/dist/routes/subtasks.js

@@ -10,6 +10,16 @@ const errorHandler_1 = require("../middleware/errorHandler");
 const validation_1 = require("../utils/validation");
 const router = (0, express_1.Router)();
 router.use(auth_1.authMiddleware);
+// Helper to build nested subtask tree
+const buildSubtaskTree = (allSubtasks, parentId = null) => {
+    return allSubtasks
+        .filter((s) => s.parentSubtaskId === parentId)
+        .sort((a, b) => a.order - b.order)
+        .map((s) => ({
+        ...s,
+        subtasks: buildSubtaskTree(allSubtasks, s.id),
+    }));
+};
 router.get('/task/:taskId', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
     const userId = req.user.userId;
     // Verify task exists and belongs to user
@@ -26,7 +36,8 @@ router.get('/task/:taskId', (0, asyncHandler_1.asyncHandler)(async (req, res) =>
         .from(schema_1.subtasks)
         .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.subtasks.taskId, req.params.taskId), (0, drizzle_orm_1.eq)(schema_1.subtasks.userId, userId)))
         .orderBy((0, drizzle_orm_1.asc)(schema_1.subtasks.order));
-    res.json({ subtasks: taskSubtasks });
+    const nestedSubtasks = buildSubtaskTree(taskSubtasks);
+    res.json({ subtasks: nestedSubtasks });
 }));
 router.post('/task/:taskId', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
     const data = validation_1.subtaskCreateSchema.parse(req.body);
@@ -40,10 +51,11 @@ router.post('/task/:taskId', (0, asyncHandler_1.asyncHandler)(async (req, res) =
         throw new errorHandler_1.AppError('NOT_FOUND', 'Task not found', 404);
     }
     const now = Date.now();
+    const parentSubtaskId = data.parentSubtaskId || null;
     const maxOrder = await db_1.db
         .select({ order: schema_1.subtasks.order })
         .from(schema_1.subtasks)
-        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.subtasks.taskId, req.params.taskId), (0, drizzle_orm_1.eq)(schema_1.subtasks.userId, userId)))
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.subtasks.taskId, req.params.taskId), (0, drizzle_orm_1.eq)(schema_1.subtasks.userId, userId), parentSubtaskId ? (0, drizzle_orm_1.eq)(schema_1.subtasks.parentSubtaskId, parentSubtaskId) : (0, drizzle_orm_1.isNull)(schema_1.subtasks.parentSubtaskId)))
         .orderBy((0, drizzle_orm_1.desc)(schema_1.subtasks.order))
         .limit(1);
     const subtaskId = `sub_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`;
@@ -51,8 +63,22 @@ router.post('/task/:taskId', (0, asyncHandler_1.asyncHandler)(async (req, res) =
         id: subtaskId,
         userId,
         taskId: req.params.taskId,
+        parentSubtaskId,
         title: data.title,
+        description: data.description ?? '',
+        priority: data.priority ?? 'none',
         completed: false,
+        dueDate: data.dueDate ?? 0,
+        dueTime: data.dueTime ?? '',
+        endTime: data.endTime ?? '',
+        allDay: data.allDay ?? false,
+        repeat: data.repeat ?? 'none',
+        repeatInterval: data.repeatInterval ?? 1,
+        repeatDays: data.repeatDays ?? '',
+        seriesId: data.seriesId ?? '',
+        reminder: data.reminder ?? 'none',
+        reminders: data.reminders ?? '',
+        assigneeId: data.assigneeId ?? null,
         order: data.order ?? (maxOrder[0]?.order ?? -1) + 1,
         createdAt: now,
         updatedAt: now,

backend/dist/routes/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/routes/sync.ts"],"names":[],"mappings":"AASA,QAAA,MAAM,MAAM,4CAAW,CAAC;AA8SxB,eAAe,MAAM,CAAC"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/routes/sync.ts"],"names":[],"mappings":"AASA,QAAA,MAAM,MAAM,4CAAW,CAAC;AA2lBxB,eAAe,MAAM,CAAC"}

backend/dist/routes/sync.js

@@ -27,9 +27,8 @@ router.get('/', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
         .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.tasks.userId, userId), (0, drizzle_orm_1.gte)(schema_1.tasks.updatedAt, sinceDate)))
         .orderBy((0, drizzle_orm_1.asc)(schema_1.tasks.updatedAt));
     // Fetch subtasks changed since timestamp
-    const taskIds = changedTasks.map(t => t.id);
     let changedSubtasks = [];
-    if (taskIds.length > 0) {
+    if (changedTasks.length > 0) {
         changedSubtasks = await db_1.db
             .select()
             .from(schema_1.subtasks)
@@ -37,7 +36,7 @@ router.get('/', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
             .orderBy((0, drizzle_orm_1.asc)(schema_1.subtasks.updatedAt));
     }
     else {
-        // Also fetch subtasks for tasks that might have been deleted (we track by updatedAt)
+        // Also fetch subtasks for tasks that might have been deleted
         changedSubtasks = await db_1.db
             .select()
             .from(schema_1.subtasks)
@@ -56,6 +55,12 @@ router.get('/', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
         .from(schema_1.friendships)
         .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.or)((0, drizzle_orm_1.eq)(schema_1.friendships.userId, userId), (0, drizzle_orm_1.eq)(schema_1.friendships.friendId, userId)), (0, drizzle_orm_1.gte)(schema_1.friendships.updatedAt, sinceDate)))
         .orderBy((0, drizzle_orm_1.asc)(schema_1.friendships.updatedAt));
+    // Fetch tombstones (deletions) changed since timestamp
+    const changedTombstones = await db_1.db
+        .select()
+        .from(schema_1.tombstones)
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.tombstones.userId, userId), (0, drizzle_orm_1.gte)(schema_1.tombstones.updatedAt, sinceDate)))
+        .orderBy((0, drizzle_orm_1.asc)(schema_1.tombstones.updatedAt));
     const timestamp = Date.now();
     res.json({
         categories: changedCategories,
@@ -63,6 +68,7 @@ router.get('/', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
         subtasks: changedSubtasks,
         repeatProfiles: changedRepeatProfiles,
         friendships: changedFriendships,
+        deleted: changedTombstones.map((t) => ({ entity: t.entity, id: t.entityId, updatedAt: t.updatedAt })),
         timestamp,
     });
 }));
@@ -73,6 +79,65 @@ router.post('/push', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
     const timestamp = Date.now();
     try {
         await db_1.db.transaction(async (tx) => {
+            // Ensure every referenced category exists (FK integrity) so a stale or
+            // never-synced category reference cannot fail the entire push. Missing
+            // categories are recreated as a fallback and the client heals on pull.
+            const referencedCategoryIds = new Set();
+            for (const task of data.changes.tasks ?? []) {
+                if (task.categoryId)
+                    referencedCategoryIds.add(task.categoryId);
+            }
+            for (const sub of data.changes.subtasks ?? []) {
+                const task = (data.changes.tasks ?? []).find((t) => t.id === sub.taskId);
+                if (task?.categoryId)
+                    referencedCategoryIds.add(task.categoryId);
+            }
+            if (referencedCategoryIds.size > 0) {
+                const existing = await tx
+                    .select({ id: schema_1.categories.id })
+                    .from(schema_1.categories)
+                    .where((0, drizzle_orm_1.inArray)(schema_1.categories.id, [...referencedCategoryIds]));
+                const existingIds = new Set(existing.map((c) => c.id));
+                const missing = [...referencedCategoryIds].filter((id) => !existingIds.has(id));
+                if (missing.length > 0) {
+                    const rows = await tx
+                        .select({ max: (0, drizzle_orm_1.sql) `max(${schema_1.categories.order})` })
+                        .from(schema_1.categories)
+                        .where((0, drizzle_orm_1.eq)(schema_1.categories.userId, userId));
+                    const startOrder = (rows[0]?.max ?? -1) + 1;
+                    await tx.insert(schema_1.categories).values(missing.map((id, i) => ({
+                        id,
+                        userId,
+                        name: 'Default',
+                        color: '#9E9E9E',
+                        order: startOrder + i,
+                        createdAt: Date.now(),
+                        updatedAt: Date.now(),
+                    })));
+                }
+            }
+            // Sanitize assignee references: only real user ids may be stored (FK).
+            // Stale/unknown assignee ids are silently dropped to null instead of
+            // failing the whole push transaction.
+            const assigneeIds = new Set();
+            for (const task of data.changes.tasks ?? []) {
+                if (task.assigneeId)
+                    assigneeIds.add(task.assigneeId);
+            }
+            for (const sub of data.changes.subtasks ?? []) {
+                if (sub.assigneeId)
+                    assigneeIds.add(sub.assigneeId);
+            }
+            const validAssignees = new Set();
+            if (assigneeIds.size > 0) {
+                const rows = await tx
+                    .select({ id: schema_1.users.id })
+                    .from(schema_1.users)
+                    .where((0, drizzle_orm_1.inArray)(schema_1.users.id, [...assigneeIds]));
+                for (const r of rows)
+                    validAssignees.add(r.id);
+            }
+            const sanitizeAssignee = (a) => a && validAssignees.has(a) ? a : null;
             // Process categories
             if (data.changes.categories && data.changes.categories.length > 0) {
                 for (const cat of data.changes.categories) {
@@ -131,6 +196,20 @@ router.post('/push', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
                             });
                             continue; // Server wins
                         }
+                        // Prevent completing tasks with future due dates
+                        if (task.completed === true) {
+                            const effectiveDueDate = task.dueDate ?? existing[0].dueDate;
+                            if (!(0, validation_1.canCompleteTask)(effectiveDueDate)) {
+                                conflicts.push({
+                                    entity: 'tasks',
+                                    id: task.id,
+                                    serverVersion: existing[0],
+                                    clientVersion: task,
+                                    resolution: 'server_wins',
+                                });
+                                continue;
+                            }
+                        }
                         await tx
                             .update(schema_1.tasks)
                             .set({
@@ -140,14 +219,17 @@ router.post('/push', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
                             priority: task.priority,
                             completed: task.completed,
                             dueDate: task.dueDate,
-                            dueTime: task.dueTime,
+                            dueTime: task.dueTime ?? '',
                             endTime: task.endTime ?? '',
+                            allDay: task.allDay ?? false,
                             repeat: task.repeat ?? 'none',
                             repeatInterval: task.repeatInterval ?? 1,
                             repeatDays: task.repeatDays ?? '',
                             seriesId: task.seriesId ?? '',
                             reminder: task.reminder ?? 'none',
-                            assigneeId: task.assigneeId ?? null,
+                            reminders: task.reminders ?? '',
+                            assigneeId: sanitizeAssignee(task.assigneeId),
+                            completedAt: task.completedAt ?? null,
                             updatedAt: task.updatedAt,
                         })
                             .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.tasks.id, task.id), (0, drizzle_orm_1.eq)(schema_1.tasks.userId, userId)));
@@ -155,6 +237,8 @@ router.post('/push', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
                     else {
                         await tx.insert(schema_1.tasks).values({
                             ...task,
+                            assigneeId: sanitizeAssignee(task.assigneeId),
+                            allDay: task.allDay ?? false,
                             userId,
                         });
                     }
@@ -184,8 +268,22 @@ router.post('/push', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
                             .update(schema_1.subtasks)
                             .set({
                             taskId: sub.taskId,
+                            parentSubtaskId: sub.parentSubtaskId ?? null,
                             title: sub.title,
+                            description: sub.description ?? '',
+                            priority: sub.priority ?? 'none',
                             completed: sub.completed,
+                            dueDate: sub.dueDate ?? 0,
+                            dueTime: sub.dueTime ?? '',
+                            endTime: sub.endTime ?? '',
+                            allDay: sub.allDay ?? false,
+                            repeat: sub.repeat ?? 'none',
+                            repeatInterval: sub.repeatInterval ?? 1,
+                            repeatDays: sub.repeatDays ?? '',
+                            seriesId: sub.seriesId ?? '',
+                            reminder: sub.reminder ?? 'none',
+                            reminders: sub.reminders ?? '',
+                            assigneeId: sanitizeAssignee(sub.assigneeId),
                             order: sub.order,
                             updatedAt: sub.updatedAt,
                         })
@@ -194,6 +292,7 @@ router.post('/push', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
                     else {
                         await tx.insert(schema_1.subtasks).values({
                             ...sub,
+                            assigneeId: sanitizeAssignee(sub.assigneeId),
                             userId,
                         });
                     }
@@ -273,6 +372,13 @@ router.post('/push', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
                     }
                 }
             }
+            // Process deletions (tombstones) - last so they see the state produced
+            // by the upserts above and resolve by last-writer-wins.
+            if (data.deleted && data.deleted.length > 0) {
+                for (const deleted of data.deleted) {
+                    await applyTombstone(tx, deleted.entity, deleted.id, deleted.updatedAt, userId, conflicts);
+                }
+            }
         });
     }
     catch (error) {
@@ -285,5 +391,175 @@ router.post('/push', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
         conflicts,
     });
 }));
+// Upsert a tombstone row, keeping the latest updatedAt.
+async function upsertTombstone(tx, entity, entityId, updatedAt, userId) {
+    const existing = await tx
+        .select({ updatedAt: schema_1.tombstones.updatedAt })
+        .from(schema_1.tombstones)
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.tombstones.entity, entity), (0, drizzle_orm_1.eq)(schema_1.tombstones.entityId, entityId)))
+        .limit(1);
+    const merged = Math.max(existing[0]?.updatedAt ?? 0, updatedAt);
+    if (existing.length > 0) {
+        await tx
+            .update(schema_1.tombstones)
+            .set({ updatedAt: merged })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.tombstones.entity, entity), (0, drizzle_orm_1.eq)(schema_1.tombstones.entityId, entityId)));
+    }
+    else {
+        await tx.insert(schema_1.tombstones).values({ entity, entityId, userId, updatedAt: merged });
+    }
+}
+// Apply a client deletion. LWW: if the server row is newer than the deletion
+// timestamp, the deletion is rejected (server_wins conflict) so the client
+// re-pulls the row. Accepted deletions cascade tombstones to every FK-cascaded
+// child so all devices remove them too.
+async function applyTombstone(tx, entity, id, deletedAt, userId, conflicts) {
+    const tombstoneOf = (e, ids) => ids.forEach((i) => upsertTombstone(tx, e, i, deletedAt, userId));
+    if (entity === 'tasks') {
+        const row = await tx
+            .select()
+            .from(schema_1.tasks)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.tasks.id, id), (0, drizzle_orm_1.eq)(schema_1.tasks.userId, userId)))
+            .limit(1);
+        if (row.length === 0) {
+            await upsertTombstone(tx, entity, id, deletedAt, userId);
+            return;
+        }
+        if (row[0].updatedAt > deletedAt) {
+            conflicts.push({
+                entity: 'tasks',
+                id,
+                serverVersion: row[0],
+                clientVersion: { id, updatedAt: deletedAt },
+                resolution: 'server_wins',
+            });
+            return;
+        }
+        const children = await tx
+            .select({ id: schema_1.subtasks.id })
+            .from(schema_1.subtasks)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.subtasks.taskId, id), (0, drizzle_orm_1.eq)(schema_1.subtasks.userId, userId)));
+        tombstoneOf('subtasks', children.map((c) => c.id));
+        await tx.delete(schema_1.tasks).where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.tasks.id, id), (0, drizzle_orm_1.eq)(schema_1.tasks.userId, userId)));
+        await upsertTombstone(tx, entity, id, deletedAt, userId);
+        return;
+    }
+    if (entity === 'categories') {
+        const row = await tx
+            .select()
+            .from(schema_1.categories)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.categories.id, id), (0, drizzle_orm_1.eq)(schema_1.categories.userId, userId)))
+            .limit(1);
+        if (row.length === 0) {
+            await upsertTombstone(tx, entity, id, deletedAt, userId);
+            return;
+        }
+        if (row[0].updatedAt > deletedAt) {
+            conflicts.push({
+                entity: 'categories',
+                id,
+                serverVersion: row[0],
+                clientVersion: { id, updatedAt: deletedAt },
+                resolution: 'server_wins',
+            });
+            return;
+        }
+        // Deleting the category cascades its tasks (and their subtasks) -
+        // tombstone all of them so every client removes them.
+        const catTasks = await tx
+            .select()
+            .from(schema_1.tasks)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.tasks.categoryId, id), (0, drizzle_orm_1.eq)(schema_1.tasks.userId, userId)));
+        for (const taskRow of catTasks) {
+            const subIds = await tx
+                .select({ id: schema_1.subtasks.id })
+                .from(schema_1.subtasks)
+                .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.subtasks.taskId, taskRow.id), (0, drizzle_orm_1.eq)(schema_1.subtasks.userId, userId)));
+            tombstoneOf('subtasks', subIds.map((s) => s.id));
+            tombstoneOf('tasks', [taskRow.id]);
+        }
+        await tx.delete(schema_1.categories).where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.categories.id, id), (0, drizzle_orm_1.eq)(schema_1.categories.userId, userId)));
+        await upsertTombstone(tx, entity, id, deletedAt, userId);
+        return;
+    }
+    if (entity === 'subtasks') {
+        const row = await tx
+            .select()
+            .from(schema_1.subtasks)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.subtasks.id, id), (0, drizzle_orm_1.eq)(schema_1.subtasks.userId, userId)))
+            .limit(1);
+        if (row.length === 0) {
+            await upsertTombstone(tx, entity, id, deletedAt, userId);
+            return;
+        }
+        if (row[0].updatedAt > deletedAt) {
+            conflicts.push({
+                entity: 'subtasks',
+                id,
+                serverVersion: row[0],
+                clientVersion: { id, updatedAt: deletedAt },
+                resolution: 'server_wins',
+            });
+            return;
+        }
+        // Deleting a parent subtask cascades its children in PG - tombstone them.
+        const children = await tx
+            .select({ id: schema_1.subtasks.id })
+            .from(schema_1.subtasks)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.subtasks.parentSubtaskId, id), (0, drizzle_orm_1.eq)(schema_1.subtasks.userId, userId)));
+        tombstoneOf('subtasks', children.map((c) => c.id));
+        await tx.delete(schema_1.subtasks).where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.subtasks.id, id), (0, drizzle_orm_1.eq)(schema_1.subtasks.userId, userId)));
+        await upsertTombstone(tx, entity, id, deletedAt, userId);
+        return;
+    }
+    if (entity === 'repeatProfiles') {
+        const row = await tx
+            .select()
+            .from(schema_1.repeatProfiles)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.repeatProfiles.id, id), (0, drizzle_orm_1.eq)(schema_1.repeatProfiles.userId, userId)))
+            .limit(1);
+        if (row.length === 0) {
+            await upsertTombstone(tx, entity, id, deletedAt, userId);
+            return;
+        }
+        if (row[0].updatedAt > deletedAt) {
+            conflicts.push({
+                entity: 'repeatProfiles',
+                id,
+                serverVersion: row[0],
+                clientVersion: { id, updatedAt: deletedAt },
+                resolution: 'server_wins',
+            });
+            return;
+        }
+        await tx.delete(schema_1.repeatProfiles).where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.repeatProfiles.id, id), (0, drizzle_orm_1.eq)(schema_1.repeatProfiles.userId, userId)));
+        await upsertTombstone(tx, entity, id, deletedAt, userId);
+        return;
+    }
+    if (entity === 'friendships') {
+        const row = await tx
+            .select()
+            .from(schema_1.friendships)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.friendships.id, id), (0, drizzle_orm_1.or)((0, drizzle_orm_1.eq)(schema_1.friendships.userId, userId), (0, drizzle_orm_1.eq)(schema_1.friendships.friendId, userId))))
+            .limit(1);
+        if (row.length === 0) {
+            await upsertTombstone(tx, entity, id, deletedAt, userId);
+            return;
+        }
+        if (row[0].updatedAt > deletedAt) {
+            conflicts.push({
+                entity: 'friendships',
+                id,
+                serverVersion: row[0],
+                clientVersion: { id, updatedAt: deletedAt },
+                resolution: 'server_wins',
+            });
+            return;
+        }
+        await tx.delete(schema_1.friendships).where((0, drizzle_orm_1.eq)(schema_1.friendships.id, id));
+        await upsertTombstone(tx, entity, id, deletedAt, userId);
+        return;
+    }
+}
 exports.default = router;
 //# sourceMappingURL=sync.js.map

backend/dist/routes/tasks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tasks.d.ts","sourceRoot":"","sources":["../../src/routes/tasks.ts"],"names":[],"mappings":"AAUA,QAAA,MAAM,MAAM,4CAAW,CAAC;AA8RxB,eAAe,MAAM,CAAC"}
+{"version":3,"file":"tasks.d.ts","sourceRoot":"","sources":["../../src/routes/tasks.ts"],"names":[],"mappings":"AAUA,QAAA,MAAM,MAAM,4CAAW,CAAC;AA+TxB,eAAe,MAAM,CAAC"}

backend/dist/routes/tasks.js

@@ -97,14 +97,16 @@ router.post('/', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
     const data = validation_1.taskCreateSchema.parse(req.body);
     const userId = req.user.userId;
     const now = Date.now();
-    // Verify category exists and belongs to user
-    const cat = await db_1.db
-        .select()
-        .from(schema_1.categories)
-        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.categories.id, data.categoryId), (0, drizzle_orm_1.eq)(schema_1.categories.userId, userId)))
-        .limit(1);
-    if (cat.length === 0) {
-        throw new errorHandler_1.AppError('NOT_FOUND', 'Category not found', 404);
+    // Verify category exists and belongs to user (optional - tasks may be uncategorized)
+    if (data.categoryId) {
+        const cat = await db_1.db
+            .select()
+            .from(schema_1.categories)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.categories.id, data.categoryId), (0, drizzle_orm_1.eq)(schema_1.categories.userId, userId)))
+            .limit(1);
+        if (cat.length === 0) {
+            throw new errorHandler_1.AppError('NOT_FOUND', 'Category not found', 404);
+        }
     }
     const taskId = `task_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`;
     const newTask = {
@@ -118,7 +120,10 @@ router.post('/', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
         dueDate: data.dueDate ?? 0,
         dueTime: data.dueTime ?? '',
         endTime: data.endTime ?? '',
+        allDay: data.allDay ?? false,
         assigneeId: data.assigneeId ?? null,
+        reminder: data.reminder ?? 'none',
+        reminders: data.reminders ?? '',
         createdAt: now,
         updatedAt: now,
     };
@@ -166,6 +171,13 @@ router.patch('/:id', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
             throw new errorHandler_1.AppError('NOT_FOUND', 'Category not found', 404);
         }
     }
+    // Prevent completing tasks with future due dates
+    if (data.completed === true) {
+        const effectiveDueDate = data.dueDate ?? existing[0].dueDate;
+        if (!(0, validation_1.canCompleteTask)(effectiveDueDate)) {
+            throw new errorHandler_1.AppError('VALIDATION_ERROR', 'Cannot mark a task as completed if its due date is in the future', 400);
+        }
+    }
     const now = Date.now();
     const updated = await db_1.db
         .update(schema_1.tasks)
@@ -207,13 +219,15 @@ router.post('/batch', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
     for (const op of operations) {
         try {
             if (op.type === 'create') {
-                const cat = await db_1.db
-                    .select()
-                    .from(schema_1.categories)
-                    .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.categories.id, op.data.categoryId), (0, drizzle_orm_1.eq)(schema_1.categories.userId, userId)))
-                    .limit(1);
-                if (cat.length === 0)
-                    throw new errorHandler_1.AppError('NOT_FOUND', 'Category not found', 404);
+                if (op.data.categoryId) {
+                    const cat = await db_1.db
+                        .select()
+                        .from(schema_1.categories)
+                        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.categories.id, op.data.categoryId), (0, drizzle_orm_1.eq)(schema_1.categories.userId, userId)))
+                        .limit(1);
+                    if (cat.length === 0)
+                        throw new errorHandler_1.AppError('NOT_FOUND', 'Category not found', 404);
+                }
                 const taskId = `task_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`;
                 const now = Date.now();
                 await db_1.db.insert(schema_1.tasks).values({
@@ -227,6 +241,25 @@ router.post('/batch', (0, asyncHandler_1.asyncHandler)(async (req, res) => {
                 results.push({ id: taskId, success: true });
             }
             else if (op.type === 'update') {
+                if (op.data.completed === true) {
+                    let effectiveDueDate;
+                    if (op.data.dueDate !== undefined) {
+                        effectiveDueDate = op.data.dueDate;
+                    }
+                    else {
+                        const existingTask = await db_1.db
+                            .select({ dueDate: schema_1.tasks.dueDate })
+                            .from(schema_1.tasks)
+                            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.tasks.id, op.id), (0, drizzle_orm_1.eq)(schema_1.tasks.userId, userId)))
+                            .limit(1);
+                        if (existingTask.length === 0)
+                            throw new errorHandler_1.AppError('NOT_FOUND', 'Task not found', 404);
+                        effectiveDueDate = existingTask[0].dueDate;
+                    }
+                    if (!(0, validation_1.canCompleteTask)(effectiveDueDate)) {
+                        throw new errorHandler_1.AppError('VALIDATION_ERROR', 'Cannot mark a task as completed if its due date is in the future', 400);
+                    }
+                }
                 await db_1.db
                     .update(schema_1.tasks)
                     .set({ ...op.data, updatedAt: Date.now() })