Todo list manager

Overview

A task manager built as two deployments: a React frontend and an Express API, both on Vercel. It exists because a todo list is the smallest complete excuse to build real authentication. The list itself is trivial; “these tasks are mine and nobody else can read them” is not.

Sign-in goes through Google OAuth 2.0 using Passport. The callback mints a JWT, which the client stores and sends on every request; a verifyToken middleware resolves it to a user id before any route touches the database, and the Mongoose schema carries a userId reference so a query cannot span users. The API runs as a Vercel serverless function through serverless-http, so it costs nothing when nobody is using it.

What it does

• 01Google OAuth 2.0 sign-in through Passport, with no password ever stored
• 02A JWT minted at the OAuth callback, scoping every later request to one user
• 03Create, edit, complete and delete tasks, persisted in MongoDB through Mongoose
• 04Every /api/todos route behind a verifyToken middleware, so tasks are readable only by their owner
• 05Express wrapped by serverless-http and deployed as a Vercel function — no server to keep running
• 06React and Tailwind frontend deployed separately, talking to the API over CORS