Vishal.dev
Back
3 users editing live
Full-Stack

TaskMesh — Real-Time Collaborative Workspace

Enterprise Kanban workspace with real-time collaboration via Socket.IO, CQRS architecture with 24 domain events, multi-layer caching (in-memory + Redis), hash-chained immutable audit logs, AI assistant, and full-text search.

Next.js 14TypeScriptReact 18PostgreSQLPrismaRedisBullMQSocket.IONextAuth v5dnd-kitZustandTanStack QueryOpenAI GPT-4o-miniAWS S3VitestKubernetes
24
Domain events
9
Workers
45
Socket events
11
Metric types

Domain Knowledge

What problem this project solves

Collaborative tools are concurrency problems disguised as CRUD apps. TaskMesh separates writes from reads so the read path stays fast and consistent under multi-user load, uses domain events to keep notifications, audit, and analytics in sync, and chains audit entries so any tampering breaks the hash chain — a verifiable trail of who did what, when.

Architecture

How the system is structured

CQRS: CommandRepository validates via Zod, publishes domain events after writes, invalidates cache, and returns the entity; ReadRepository uses a cache-aside getOrSet pattern with L1 in-memory Map (LRU, 1000 entries) and L2 Redis with TTL. A custom Socket.IO server streams 26 server-to-client and 19 client-to-server events for presence, typing, and live board updates.

Data Model

Schema design and data flow

24 Prisma models across 9 enums: users/auth, workspaces/members/invitations, boards/columns, tasks/assignees/labels/comments/subtasks, sprints, activity logs, notifications, hash-chained AuditEntry, feature flags and rules, API keys, webhooks.

Key Challenges

Hardest problems encountered

Real-time collaboration without data races required scoping every mutation to a workspace channel and using optimistic UI with server reconciliation. The audit chain had to be append-only and verifiable. The two-layer cache needed targeted invalidation on every write to avoid stale reads — each write publishes events that trigger cache invalidation.

Scaling Strategy

How the system grows

9 BullMQ workers (email, audit, analytics, notification, webhook, cleanup, search-index, presence, feature-flag) handle side effects asynchronously. Kubernetes manifests include HPA (2-10), PDB, StatefulSets, and PVCs. Docker multi-stage builds with HEALTHCHECK. Six GitHub Actions jobs run lint, typecheck, test, build, docker, and security.

Security

Defense-in-depth approach

RBAC with Owner/Admin/Member/Viewer roles, Redis sliding-window rate limiting with brute-force protection, NextAuth v5 credentials + OAuth, presigned S3 URLs, Zod validation everywhere, and an immutable hash-chained audit trail covering logins and session management.

Failure Handling

Resilience and recovery

BullMQ retries with exponential backoff and dead-letter queues. Socket.IO reconnects with presence reconciliation. Cache misses fall through to the database. Database and Redis health checks gate requests.

Observability

Monitoring and debugging

Prometheus metrics across 11 metric types — HTTP request counts/duration/errors, cache hit ratios, WebSocket connection counts, BullMQ queue depth and job duration, rate limit hits, auth attempts, and feature flag evaluations.

Trade-offs

Engineering decisions and alternatives

CQRS over plain repositories for read-path scalability. BullMQ events over synchronous side effects for decoupling. Two-layer cache over single-layer for sub-ms reads. dnd-kit over native DnD for accessibility and touch support.

Architecture Decisions

Key choices and what was rejected

Decision
Chosen
Rejected
Read/write paths
CQRS repositories
Single repository (read contention)
Side effects
24 domain events via BullMQ
Inline side effects
Audit integrity
SHA-256 hash chain
Append-only log (tamperable)
Caching
L1 in-memory + L2 Redis
Redis only (1ms latency)

Senior-Level Topics

Concepts this project explores

CQRS ArchitectureEvent-Driven DesignReal-Time CollaborationMulti-Layer CachingHash-Chained Audit LogsFeature FlagsFull-Text SearchKubernetes Deployment