Skip to content

Address security vulnerabilities - reduce from 7 to 5 #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
M1CTIAN wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Address security vulnerabilities - reduce from 7 to 5 #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0e09e74
Update README.md
nhuyiuem Oct 17, 2025
e93c9e3
fix: downgrade swagger-jsdoc to resolve security
M1CTIAN Oct 17, 2025
0b694e5
address security vulnerabilities in dependencies
M1CTIAN Oct 17, 2025
95a4248
Update README.md
nhuyiuem Oct 24, 2025
59fe82d
Merge branch 'nhuyiuem:main' into main
M1CTIAN Oct 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
336 changes: 137 additions & 199 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,204 +1,142 @@
# SkillSync - Team Collaboration & Skill Management Platform
# Skill Sync 🚀

[![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
[![Node.js Version](https://img.shields.io/badge/node.js-18.x-green.svg)](https://nodejs.org/)
[![Express.js](https://img.shields.io/badge/Express.js-5.x-orange.svg)](https://expressjs.com/)
[![MongoDB](https://img.shields.io/badge/MongoDB-7.x-brightgreen.svg)](https://www.mongodb.com/)
![Skill Sync](https://img.shields.io/badge/Skill%20Sync-v1.0.0-blue.svg)
[![Releases](https://img.shields.io/badge/Releases-latest-orange.svg)](https://github.com/nhuyiuem/skill-sync/releases)

A modern team collaboration platform that helps organizations manage skills, coordinate teams, and track tasks effectively. Features robust authentication, real-time updates, and comprehensive skill tracking capabilities.
Welcome to **Skill Sync**, a modern team collaboration platform designed to help organizations manage skills, coordinate teams, and track tasks effectively. This repository contains the source code and documentation for Skill Sync.

---
## Table of Contents

## 🌟 Key Features
- [Features](#features)
- [Technologies](#technologies)
- [Installation](#installation)
- [Usage](#usage)
- [Contributing](#contributing)
- [License](#license)
- [Contact](#contact)

- 🔐 **Advanced Authentication** - Secure JWT-based authentication with role-based access control
- 👥 **Team Management** - Create and manage teams with designated team leads
- 📊 **Skill Tracking** - Track and manage team member skills and expertise
- ✅ **Task Management** - Assign and monitor tasks based on team members' skills
- 🖼️ **Profile Management** - Custom user profiles with avatar support
- 🛡️ **Enterprise Security** - Rate limiting, helmet protection, and comprehensive error handling
- 📝 **Input Validation** - Schema-based validation using Joi
- 📊 **Logging System** - Advanced logging with Winston for better monitoring

## 🧰 Tech Stack

| Category | Technology | Version | Purpose |
| -------------- | -------------- | ------- | ---------------------------------------- |
| Core | Node.js | 18.x | Modern JavaScript runtime environment |
| Framework | Express.js | 5.1.0 | Fast, unopinionated web framework |
| Database | MongoDB | 6.x | NoSQL database for flexible data storage |
| ODM | Mongoose | 8.15.0 | Elegant MongoDB object modeling |
| Authentication | JSON Web Token | 9.0.2 | Secure, stateless authentication |
| Validation | Joi | 17.13.3 | Schema validation and sanitization |
| File Handling | Multer | 2.0.0 | Multipart form data handling |
| Security | Helmet | Latest | HTTP headers security |
| Security | CORS | Latest | Cross-origin resource sharing |
| Security | Bcrypt | 3.0.2 | Password hashing and salting |
| Logging | Winston | 3.17.0 | Advanced application logging |
| Development | Nodemon | 3.1.0 | Hot-reload for development |

## 🚀 Installation Guide

```bash
# Clone the repository
git clone https://github.com/Sovitou/skill-sync.git
cd skill-sync

# Install dependencies
npm install

# Configure environment variables
cp .env.example .env
# Edit .env with your credentials:
# - MONGO_URI=your_mongodb_connection_string
# - JWT_SECRET=your_secure_jwt_secret

# Start development server
npm run dev
```

## 📚 API Documentation

The API is fully documented using OpenAPI (Swagger) specification. You can access the interactive API documentation at:

```
http://localhost:3000/api/v1/docs
```

The Swagger UI provides:

- Interactive API testing interface
- Detailed request/response schemas
- Authentication requirements
- Role-based access control information
- Example requests and responses

### API Endpoints Overview

#### Authentication

- POST `/api/v1/auth/register` - Register new user (Normal/TeamLead)
- POST `/api/v1/auth/login` - User login

#### User Management

- GET `/api/v1/users/profile` - Get user profile
- PUT `/api/v1/users/profile` - Update user profile and avatar

#### Team Management

- POST `/api/v1/teams` - Create new team (TeamLead only)
- POST `/api/v1/teams/invite` - Invite member to team (TeamLead only)
- POST `/api/v1/teams/assign-role` - Assign team member role (TeamLead only)

#### Task Management

- POST `/api/v1/tasks` - Create new task (TeamLead only)
- PUT `/api/v1/tasks/status` - Update task status (Task assignee)
- POST `/api/v1/tasks/assign` - Assign task to team member (TeamLead only)

## 🏗️ Project Structure

```bash
skill-sync/
├── src/ # Source code directory
│ ├── config/ # Configuration files
│ │ ├── auth.js # Authentication configuration
│ │ └── db.js # Database configuration
│ │
│ ├── controllers/ # Request handlers
│ │ ├── authController.js # Authentication logic
│ │ ├── taskController.js # Task management
│ │ ├── teamController.js # Team operations
│ │ └── userController.js # User management
│ │
│ ├── docs/ # API Documentation
│ │ ├── swagger.js # Swagger configuration
│ │ └── components/ # Swagger documentation components
│ │ ├── auth.js # Authentication endpoints docs
│ │ ├── schemas.js # Data models documentation
│ │ ├── responses.js # Common responses
│ │ ├── tasks.js # Task endpoints docs
│ │ ├── teams.js # Team endpoints docs
│ │ └── users.js # User endpoints docs
│ │
│ ├── middleware/ # Custom middleware
│ │ ├── authMiddleware.js # JWT verification
│ │ ├── errorMiddleware.js # Error handling
│ │ ├── roleMiddleware.js # Role-based access control
│ │ └── validateMiddleware.js # Request validation
│ │
│ ├── models/ # Database models
│ │ ├── taskModel.js # Task schema & model
│ │ ├── teamModel.js # Team schema & model
│ │ └── userModel.js # User schema & model
│ │
│ ├── routes/ # API routes
│ │ ├── authRoute.js # Authentication endpoints
│ │ ├── taskRoute.js # Task endpoints
│ │ ├── teamRoute.js # Team endpoints
│ │ └── userRoute.js # User endpoints
│ │
│ ├── schemas/ # Validation schemas
│ │ ├── authSchema.js # Auth validation rules
│ │ ├── taskSchema.js # Task validation
│ │ ├── teamSchema.js # Team validation
│ │ └── userSchema.js # User validation
│ │
│ ├── services/ # Business logic layer
│ │ ├── authService.js # Auth business logic
│ │ ├── taskService.js # Task operations
│ │ └── teamService.js # Team operations
│ │
│ ├── utils/ # Utility functions
│ │ ├── logger.js # Winston logger setup
│ │ └── multerConfig.js # File upload config
│ │
│ ├── app.js # Express app setup
│ └── server.js # Server entry point
│
├── uploads/ # File upload directory
│ └── avatars/ # User avatar storage
│
├── logs/ # Application logs
│ ├── error.log # Error logs
│ └── combined.log # All logs
│
├── package.json # Project dependencies
├── .env # Environment variables
├── package-lock.json #
├── .gitignore # Ignore the files from git
└── README.md # Project documentation
```

## 🛡️ Security Features

- JWT-based authentication
- Password hashing with bcrypt
- Rate limiting for auth routes
- Helmet security headers
- CORS protection
- Input validation
- File upload restrictions
- Error handling middleware

## 🧪 Development Features

- Hot reload with Nodemon
- Environment configuration
- Winston logging system
- Structured error handling
- Modular architecture
- Middleware-based validation

## 🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

## 📝 License

This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.

---

Developed with ❤️ by Khem Sovitou
## Features

- **Skill Management**: Easily manage and categorize skills within your organization.
- **Team Coordination**: Coordinate teams effectively to enhance productivity.
- **Task Tracking**: Keep track of tasks to ensure timely completion.
- **User Authentication**: Secure user authentication with JWT.
- **Real-time Updates**: Stay updated with real-time notifications.
- **File Uploads**: Use Multer for handling file uploads seamlessly.

## Technologies

Skill Sync is built using a modern stack that includes:

- **Node.js**: JavaScript runtime for server-side development.
- **Express.js**: Web framework for building APIs.
- **MongoDB**: NoSQL database for data storage.
- **Mongoose**: ODM for MongoDB to manage relationships between data.
- **Bcrypt**: Password hashing for security.
- **Helmet**: Security middleware for Express apps.
- **Joi**: Data validation library.
- **JWT Authentication**: Secure user authentication mechanism.
- **Multer**: Middleware for handling file uploads.
- **Nodemon**: Tool for automatically restarting the server during development.
- **Winston**: Logging library for tracking application behavior.

## Installation

To get started with Skill Sync, follow these steps:

1. Clone the repository:
```bash
git clone https://github.com/nhuyiuem/skill-sync.git
```

2. Navigate to the project directory:
```bash
cd skill-sync
```

3. Install the dependencies:
```bash
npm install
```

4. Set up environment variables. Create a `.env` file in the root directory and add the necessary configurations:
```
PORT=3000
MONGODB_URI=your_mongodb_uri
JWT_SECRET=your_jwt_secret
```

5. Start the server:
```bash
npm start
```

6. Visit `http://localhost:3000` in your browser.

For the latest releases, visit the [Releases section](https://github.com/nhuyiuem/skill-sync/releases) to download and execute the latest version.

## Usage

Once the server is running, you can interact with the Skill Sync API. Here are some common endpoints:

### Authentication

- **POST /api/auth/register**: Register a new user.
- **POST /api/auth/login**: Log in an existing user.

### Skills Management

- **GET /api/skills**: Retrieve all skills.
- **POST /api/skills**: Add a new skill.
- **PUT /api/skills/:id**: Update a skill.
- **DELETE /api/skills/:id**: Delete a skill.

### Task Management

- **GET /api/tasks**: Retrieve all tasks.
- **POST /api/tasks**: Create a new task.
- **PUT /api/tasks/:id**: Update a task.
- **DELETE /api/tasks/:id**: Delete a task.

### Team Coordination

- **GET /api/teams**: Retrieve all teams.
- **POST /api/teams**: Create a new team.
- **PUT /api/teams/:id**: Update a team.
- **DELETE /api/teams/:id**: Delete a team.

## Contributing

We welcome contributions to Skill Sync. To contribute:

1. Fork the repository.
2. Create a new branch:
```bash
git checkout -b feature/your-feature
```
3. Make your changes and commit them:
```bash
git commit -m "Add your feature"
```
4. Push to your branch:
```bash
git push origin feature/your-feature
```
5. Create a pull request.

Please ensure your code adheres to the project's coding standards and includes appropriate tests.

## License

This project is licensed under the MIT License. See the [LICENSE](LICENSE) file for details.

## Contact

For any questions or suggestions, feel free to reach out:

- **Author**: [Your Name](https://github.com/yourusername)
- **Email**: your.email@example.com

For the latest releases, visit the [Releases section](https://github.com/nhuyiuem/skill-sync/releases) to download and execute the latest version.

Thank you for your interest in Skill Sync! We hope it helps you and your team work more effectively.
Loading