TaskMesh — Real-Time Collaborative Workspace
Enterprise Kanban workspace with real-time collaboration via Socket.IO, CQRS architecture with 24 domain events, multi-layer caching (in-memory + Redis), hash-chained immutable audit logs, AI assistant, and full-text search.
Domain Knowledge
What problem this project solves
Collaborative tools are concurrency problems disguised as CRUD apps. TaskMesh separates writes from reads so the read path stays fast and consistent under multi-user load, uses domain events to keep notifications, audit, and analytics in sync, and chains audit entries so any tampering breaks the hash chain — a verifiable trail of who did what, when.
Architecture
How the system is structured
CQRS: CommandRepository validates via Zod, publishes domain events after writes, invalidates cache, and returns the entity; ReadRepository uses a cache-aside getOrSet pattern with L1 in-memory Map (LRU, 1000 entries) and L2 Redis with TTL. A custom Socket.IO server streams 26 server-to-client and 19 client-to-server events for presence, typing, and live board updates.
Data Model
Schema design and data flow
24 Prisma models across 9 enums: users/auth, workspaces/members/invitations, boards/columns, tasks/assignees/labels/comments/subtasks, sprints, activity logs, notifications, hash-chained AuditEntry, feature flags and rules, API keys, webhooks.
Key Challenges
Hardest problems encountered
Real-time collaboration without data races required scoping every mutation to a workspace channel and using optimistic UI with server reconciliation. The audit chain had to be append-only and verifiable. The two-layer cache needed targeted invalidation on every write to avoid stale reads — each write publishes events that trigger cache invalidation.
Scaling Strategy
How the system grows
9 BullMQ workers (email, audit, analytics, notification, webhook, cleanup, search-index, presence, feature-flag) handle side effects asynchronously. Kubernetes manifests include HPA (2-10), PDB, StatefulSets, and PVCs. Docker multi-stage builds with HEALTHCHECK. Six GitHub Actions jobs run lint, typecheck, test, build, docker, and security.
Security
Defense-in-depth approach
RBAC with Owner/Admin/Member/Viewer roles, Redis sliding-window rate limiting with brute-force protection, NextAuth v5 credentials + OAuth, presigned S3 URLs, Zod validation everywhere, and an immutable hash-chained audit trail covering logins and session management.
Failure Handling
Resilience and recovery
BullMQ retries with exponential backoff and dead-letter queues. Socket.IO reconnects with presence reconciliation. Cache misses fall through to the database. Database and Redis health checks gate requests.
Observability
Monitoring and debugging
Prometheus metrics across 11 metric types — HTTP request counts/duration/errors, cache hit ratios, WebSocket connection counts, BullMQ queue depth and job duration, rate limit hits, auth attempts, and feature flag evaluations.
Trade-offs
Engineering decisions and alternatives
CQRS over plain repositories for read-path scalability. BullMQ events over synchronous side effects for decoupling. Two-layer cache over single-layer for sub-ms reads. dnd-kit over native DnD for accessibility and touch support.
Architecture Decisions
Key choices and what was rejected
Senior-Level Topics
Concepts this project explores