Chapter 34: Building a Complete App#

tina4 init taskflow --lang rubycd taskflowbundle install

TINA4_DEBUG=trueJWT_SECRET=taskflow-dev-secret-change-in-productionJWT_EXPIRY=86400

-- UPCREATE TABLE users (    id INTEGER PRIMARY KEY AUTOINCREMENT,    name TEXT NOT NULL,    email TEXT NOT NULL UNIQUE,    password_hash TEXT NOT NULL,    role TEXT NOT NULL DEFAULT 'user',    created_at TEXT DEFAULT CURRENT_TIMESTAMP);​CREATE INDEX idx_users_email ON users(email);​-- DOWNDROP TABLE IF EXISTS users;

-- UPCREATE TABLE tasks (    id INTEGER PRIMARY KEY AUTOINCREMENT,    title TEXT NOT NULL,    description TEXT DEFAULT '',    status TEXT NOT NULL DEFAULT 'todo',    priority TEXT NOT NULL DEFAULT 'medium',    created_by INTEGER NOT NULL,    assigned_to INTEGER,    due_date TEXT,    completed_at TEXT,    created_at TEXT DEFAULT CURRENT_TIMESTAMP,    updated_at TEXT DEFAULT CURRENT_TIMESTAMP,    FOREIGN KEY (created_by) REFERENCES users(id),    FOREIGN KEY (assigned_to) REFERENCES users(id));​CREATE INDEX idx_tasks_status ON tasks(status);CREATE INDEX idx_tasks_assigned_to ON tasks(assigned_to);CREATE INDEX idx_tasks_created_by ON tasks(created_by);​-- DOWNDROP TABLE IF EXISTS tasks;

tina4 migrate

Running migrations...  [UP] 20260322150000_create_users_table.sql  [UP] 20260322150100_create_tasks_table.sql​  2 migrations applied

curl http://localhost:7147/health

{"status": "ok", "database": "connected"}

class User < Tina4::ORM  integer_field :id, primary_key: true  string_field :name  string_field :email  string_field :password_hash  string_field :role, default: "user"  string_field :created_at​  table_name "users"​  has_many :created_tasks, class_name: "Task", foreign_key: "created_by"  has_many :assigned_tasks, class_name: "Task", foreign_key: "assigned_to"end

class Task < Tina4::ORM  integer_field :id, primary_key: true  string_field :title  string_field :description, default: ""  string_field :status, default: "todo"  string_field :priority, default: "medium"  integer_field :created_by  integer_field :assigned_to  string_field :due_date  string_field :completed_at  string_field :created_at  string_field :updated_at​  table_name "tasks"​  belongs_to :creator, class_name: "User", foreign_key: "created_by"  belongs_to :assignee, class_name: "User", foreign_key: "assigned_to"end

def auth_middleware(request, response, next_handler)  auth_header = request.headers["Authorization"] || ""​  if auth_header.empty? || !auth_header.start_with?("Bearer ")    return response.json({ error: "Authorization required" }, 401)  end​  token = auth_header.sub("Bearer ", "")​  unless Tina4::Auth.valid_token(token)    return response.json({ error: "Invalid or expired token" }, 401)  end​  request.user = Tina4::Auth.get_payload(token)  next_handler.call(request, response)end

# @noauthTina4::Router.post("/api/auth/register") do |request, response|  body = request.body​  errors = []  errors << "Name is required" if body["name"].nil? || body["name"].empty?  errors << "Email is required" if body["email"].nil? || body["email"].empty?  errors << "Password must be at least 8 characters" if body["password"].nil? || body["password"].to_s.length < 8​  return response.json({ errors: errors }, 400) unless errors.empty?​  db = Tina4.database  existing = db.fetch_one("SELECT id FROM users WHERE email = ?", [body["email"]])  return response.json({ error: "Email already registered" }, 409) unless existing.nil?​  hash = Tina4::Auth.hash_password(body["password"])  db.execute("INSERT INTO users (name, email, password_hash) VALUES (?, ?, ?)",    [body["name"], body["email"], hash])​  user = db.fetch_one("SELECT id, name, email, role FROM users WHERE id = last_insert_rowid()")  response.json({ message: "Registration successful", user: user }, 201)end​# @noauthTina4::Router.post("/api/auth/login") do |request, response|  body = request.body​  db = Tina4.database  user = db.fetch_one("SELECT * FROM users WHERE email = ?", [body["email"]])​  if user.nil? || !Tina4::Auth.check_password(body["password"] || "", user["password_hash"])    return response.json({ error: "Invalid email or password" }, 401)  end​  token = Tina4::Auth.get_token({    user_id: user["id"], email: user["email"], name: user["name"], role: user["role"]  })​  response.json({    message: "Login successful",    token: token,    user: { id: user["id"], name: user["name"], email: user["email"], role: user["role"] }  })end​Tina4::Router.get("/api/profile", middleware: "auth_middleware") do |request, response|  db = Tina4.database  user = db.fetch_one("SELECT id, name, email, role, created_at FROM users WHERE id = ?",    [request.user["user_id"]])  response.json(user)end

# Start the servertina4 serve

# Register a usercurl -X POST http://localhost:7147/api/auth/register \  -H "Content-Type: application/json" \  -d '{"name": "Alice Johnson", "email": "alice@example.com", "password": "securepass123"}'

{  "message": "Registration successful",  "user": {    "id": 1,    "name": "Alice Johnson",    "email": "alice@example.com",    "role": "user"  }}

# Logincurl -X POST http://localhost:7147/api/auth/login \  -H "Content-Type: application/json" \  -d '{"email": "alice@example.com", "password": "securepass123"}'

{  "message": "Login successful",  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",  "user": {    "id": 1,    "name": "Alice Johnson",    "email": "alice@example.com",    "role": "user"  }}

Tina4::Router.group("/api/tasks", middleware: "auth_middleware") do​  # List tasks with filters  Tina4::Router.get("") do |request, response|    db = Tina4.database    user_id = request.user["user_id"]​    status = request.params["status"]    priority = request.params["priority"]    assigned = request.params["assigned_to_me"]​    sql = "SELECT t.*, u1.name AS creator_name, u2.name AS assignee_name FROM tasks t LEFT JOIN users u1 ON t.created_by = u1.id LEFT JOIN users u2 ON t.assigned_to = u2.id"    conditions = []    params = {}​    if assigned == "true"      conditions << "t.assigned_to = :user_id"      params[:user_id] = user_id    end​    if status && !status.empty?      conditions << "t.status = :status"      params[:status] = status    end​    if priority && !priority.empty?      conditions << "t.priority = :priority"      params[:priority] = priority    end​    sql += " WHERE #{conditions.join(' AND ')}" unless conditions.empty?    sql += " ORDER BY t.created_at DESC"​    tasks = db.fetch(sql, params)    response.json({ tasks: tasks, count: tasks.length })  end​  # Get single task  Tina4::Router.get("/{id:int}") do |request, response|    db = Tina4.database    id = request.params["id"]​    task = db.fetch_one("SELECT t.*, u1.name AS creator_name, u2.name AS assignee_name FROM tasks t LEFT JOIN users u1 ON t.created_by = u1.id LEFT JOIN users u2 ON t.assigned_to = u2.id WHERE t.id = ?", [id])​    if task.nil?      return response.json({ error: "Task not found" }, 404)    end​    response.json(task)  end​  # Create task  Tina4::Router.post("") do |request, response|    body = request.body    user_id = request.user["user_id"]​    if body["title"].nil? || body["title"].empty?      return response.json({ error: "Title is required" }, 400)    end​    db = Tina4.database    db.execute(      "INSERT INTO tasks (title, description, status, priority, created_by, assigned_to, due_date) VALUES (?, ?, ?, ?, ?, ?, ?)",      [body["title"], body["description"] || "", body["status"] || "todo", body["priority"] || "medium", user_id, body["assigned_to"], body["due_date"]]    )​    task = db.fetch_one("SELECT * FROM tasks WHERE id = last_insert_rowid()")​    # Queue notification if assigned to someone else    if body["assigned_to"] && body["assigned_to"].to_i != user_id      assignee = db.fetch_one("SELECT name, email FROM users WHERE id = ?", [body["assigned_to"]])      if assignee        Tina4::Queue.produce("send-email", {          to: assignee["email"],          subject: "New task assigned: #{body['title']}",          template: "emails/task-assigned.html",          data: { task_title: body["title"], assignee_name: assignee["name"], assigner_name: request.user["name"] }        })      end    end​    # Notify dashboards: the client sends this change over its /ws/tasks    # socket, and the WebSocket handler (Step 6) relays it to every other    # connected client via connection.broadcast.    notification = {      type: "task_update",      action: "created",      task: task    }​    # Invalidate cache    Tina4.cache_delete("dashboard:stats:#{user_id}")​    response.json(task.merge(notify: notification), 201)  end​  # Update task  Tina4::Router.put("/{id:int}") do |request, response|    db = Tina4.database    id = request.params["id"]    body = request.body​    existing = db.fetch_one("SELECT * FROM tasks WHERE id = ?", [id])    return response.json({ error: "Task not found" }, 404) if existing.nil?​    completed_at = existing["completed_at"]    if body["status"] == "done" && existing["status"] != "done"      completed_at = Time.now.strftime("%Y-%m-%d %H:%M:%S")    elsif body["status"] && body["status"] != "done"      completed_at = nil    end​    db.execute(      "UPDATE tasks SET title = ?, description = ?, status = ?, priority = ?, assigned_to = ?, due_date = ?, completed_at = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?",      [        body["title"] || existing["title"],        body["description"] || existing["description"],        body["status"] || existing["status"],        body["priority"] || existing["priority"],        body.key?("assigned_to") ? body["assigned_to"] : existing["assigned_to"],        body["due_date"] || existing["due_date"],        completed_at,        id      ]    )​    # Notify dashboards over the /ws/tasks socket (relayed by the    # WebSocket handler in Step 6 via connection.broadcast).    task = db.fetch_one("SELECT * FROM tasks WHERE id = ?", [id])    notification = {      type: "task_update",      action: "updated",      task: task    }​    # Invalidate cache    Tina4.cache_delete("dashboard:stats:#{request.user['user_id']}")​    response.json(task.merge(notify: notification))  end​  # Delete task  Tina4::Router.delete("/{id:int}") do |request, response|    db = Tina4.database    id = request.params["id"]​    existing = db.fetch_one("SELECT * FROM tasks WHERE id = ?", [id])    return response.json({ error: "Task not found" }, 404) if existing.nil?​    db.execute("DELETE FROM tasks WHERE id = ?", [id])​    # Notify dashboards over the /ws/tasks socket (relayed by the    # WebSocket handler in Step 6 via connection.broadcast).    notification = {      type: "task_update",      action: "deleted",      task: { id: id }    }​    Tina4.cache_delete("dashboard:stats:#{request.user['user_id']}")​    response.json({ deleted: id, notify: notification }, 200)  end​end

# Set your token from the login stepTOKEN="eyJhbGciOiJIUzI1NiIs..."​# Create a taskcurl -X POST http://localhost:7147/api/tasks \  -H "Content-Type: application/json" \  -H "Authorization: Bearer $TOKEN" \  -d '{"title": "Design database schema", "priority": "high"}'

{  "id": 1,  "title": "Design database schema",  "priority": "high",  "status": "todo",  "created_by": 1,  "created_at": "2026-03-22 10:00:00"}

# Create more taskscurl -X POST http://localhost:7147/api/tasks \  -H "Content-Type: application/json" \  -H "Authorization: Bearer $TOKEN" \  -d '{"title": "Build API endpoints", "priority": "high"}'​curl -X POST http://localhost:7147/api/tasks \  -H "Content-Type: application/json" \  -H "Authorization: Bearer $TOKEN" \  -d '{"title": "Write documentation", "priority": "medium", "due_date": "2026-04-01"}'​# List all taskscurl http://localhost:7147/api/tasks \  -H "Authorization: Bearer $TOKEN"​# Update a task statuscurl -X PUT http://localhost:7147/api/tasks/1 \  -H "Content-Type: application/json" \  -H "Authorization: Bearer $TOKEN" \  -d '{"status": "done"}'​# Delete a taskcurl -X DELETE http://localhost:7147/api/tasks/3 \  -H "Authorization: Bearer $TOKEN"

Tina4::Router.get("/api/dashboard/stats", middleware: "auth_middleware") do |request, response|  user_id = request.user["user_id"]​  cache_key = "dashboard:stats:#{user_id}"  stats = Tina4.cache_get(cache_key)​  if stats.nil?    db = Tina4.database​    total = db.fetch_one("SELECT COUNT(*) AS count FROM tasks WHERE assigned_to = ? OR created_by = ?", [user_id, user_id])    todo = db.fetch_one("SELECT COUNT(*) AS count FROM tasks WHERE (assigned_to = ? OR created_by = ?) AND status = 'todo'", [user_id, user_id])    in_progress = db.fetch_one("SELECT COUNT(*) AS count FROM tasks WHERE (assigned_to = ? OR created_by = ?) AND status = 'in_progress'", [user_id, user_id])    done = db.fetch_one("SELECT COUNT(*) AS count FROM tasks WHERE (assigned_to = ? OR created_by = ?) AND status = 'done'", [user_id, user_id])    overdue = db.fetch_one("SELECT COUNT(*) AS count FROM tasks WHERE (assigned_to = ? OR created_by = ?) AND due_date < date('now') AND status != 'done'", [user_id, user_id])​    recent = db.fetch(      "SELECT t.*, u.name AS assignee_name FROM tasks t LEFT JOIN users u ON t.assigned_to = u.id ORDER BY t.created_at DESC LIMIT 10"    )​    stats = {      total_tasks: total["count"],      todo: todo["count"],      in_progress: in_progress["count"],      done: done["count"],      overdue: overdue["count"],      recent_tasks: recent    }​    Tina4.cache_set(cache_key, stats, 30)  end​  response.json(stats)end​Tina4::Router.get("/admin") do |request, response|  response.render("dashboard.html", {    title: "TaskFlow Dashboard"  })end

curl http://localhost:7147/api/dashboard/stats \  -H "Authorization: Bearer $TOKEN"

{  "total_tasks": 2,  "todo": 1,  "in_progress": 0,  "done": 1,  "overdue": 0,  "recent_tasks": [...]}

Tina4::Router.websocket("/ws/tasks") do |connection, event, data|  case event  when :open    connection.send({ type: "connected", message: "Listening for task updates" }.to_json)​  when :message    message = JSON.parse(data)    if message["type"] == "task_update"      # Relay a task change to every other client on /ws/tasks.      # connection.broadcast is path-scoped: only clients on /ws/tasks receive it.      connection.broadcast(data)    elsif message["type"] == "ping"      connection.send({ type: "pong" }.to_json)    end​  when :close    # Connection closed -- cleanup if needed  endend

Tina4::Queue.consume("send-email") do |job|  mail = Tina4::Messenger.new  mail.to = job.payload["to"]  mail.subject = job.payload["subject"]​  if job.payload["template"]    mail.html_template = job.payload["template"]    mail.template_data = job.payload["data"] || {}  else    mail.body = job.payload["body"] || ""  end​  mail.send  trueend

<!DOCTYPE html><html><head><meta charset="UTF-8"></head><body>    <div class="container">        <h2>New Task Assigned</h2>        <p>Hi {{ assignee_name }},</p>        <p><strong>{{ assigner_name }}</strong> assigned you a new task:</p>         <div class="card">            <div class="card-body">                <h3>{{ task_title }}</h3>            </div>        </div>         <p><a href="http://localhost:7147/admin">View Dashboard</a></p>    </div></body></html>

tina4 queue work

{% extends "base.html" %} {% block title %}TaskFlow Dashboard{% endblock %} {% block content %}<h1>Dashboard</h1> <div id="stats" class="row mb-4">    <div class="col-md-2"><div class="card"><div class="card-body">        <h6 class="text-muted">Total</h6><h2 id="stat-total">--</h2>    </div></div></div>    <div class="col-md-2"><div class="card"><div class="card-body">        <h6 class="text-muted">Todo</h6><h2 id="stat-todo">--</h2>    </div></div></div>    <div class="col-md-2"><div class="card"><div class="card-body">        <h6 class="text-muted">In Progress</h6><h2 id="stat-progress">--</h2>    </div></div></div>    <div class="col-md-2"><div class="card"><div class="card-body">        <h6 class="text-muted">Done</h6><h2 id="stat-done">--</h2>    </div></div></div>    <div class="col-md-2"><div class="card"><div class="card-body">        <h6 class="text-muted">Overdue</h6><h2 id="stat-overdue" class="text-danger">--</h2>    </div></div></div></div> <div class="row">    <div class="col-md-8">        <div class="card">            <div class="card-header d-flex justify-content-between">                <span>Recent Tasks</span>                <button class="btn btn-sm btn-primary" onclick="showNewTaskForm()">                    New Task                </button>            </div>            <div class="card-body">                <table class="table table-striped" id="task-table">                    <thead>                        <tr><th>Title</th><th>Assignee</th><th>Priority</th><th>Status</th></tr>                    </thead>                    <tbody id="task-list"></tbody>                </table>            </div>        </div>    </div>    <div class="col-md-4">        <div class="card">            <div class="card-header">Live Updates</div>            <div class="card-body" id="live-updates">                <p class="text-muted">Connecting...</p>            </div>        </div>    </div></div> <script src="/js/frond.min.js"></script><script>    var token = localStorage.getItem("token");    if (token) frond.setToken(token);     // Load dashboard stats    frond.get("/api/dashboard/stats", function (data) {        document.getElementById("stat-total").textContent = data.total_tasks;        document.getElementById("stat-todo").textContent = data.todo;        document.getElementById("stat-progress").textContent = data.in_progress;        document.getElementById("stat-done").textContent = data.done;        document.getElementById("stat-overdue").textContent = data.overdue;         var tbody = document.getElementById("task-list");        tbody.innerHTML = "";        (data.recent_tasks || []).forEach(function (task) {            var tr = document.createElement("tr");            var badgeColor = {todo: "secondary", in_progress: "warning",                             done: "success"};            tr.innerHTML = "<td>" + task.title + "</td>" +                "<td>" + (task.assignee_name || "Unassigned") + "</td>" +                "<td>" + task.priority + "</td>" +                "<td><span class='badge bg-" + (badgeColor[task.status] || "secondary") +                "'>" + task.status + "</span></td>";            tbody.appendChild(tr);        });    });     // WebSocket for live updates    var ws = frond.ws("/ws/tasks");    var updates = document.getElementById("live-updates");     ws.on("open", function () {        updates.innerHTML = "<p class='text-success'>Connected - listening for updates</p>";    });     ws.on("message", function (raw) {        var msg = JSON.parse(raw);        if (msg.type === "task_update") {            var div = document.createElement("div");            div.innerHTML = "<strong>" + msg.action + ":</strong> " + msg.task.title;            updates.prepend(div);             // Refresh stats            frond.get("/api/dashboard/stats", function () {});        }    });</script>{% endblock %}

require "tina4"​RSpec.describe "TaskFlow" do  let(:client) { Tina4::TestClient.new }  let(:token) do    email = "test#{rand(100000)}@example.com"    client.post("/api/auth/register", {      name: "Test User", email: email, password: "password123"    })    result = client.post("/api/auth/login", {      email: email, password: "password123"    })    result.json["token"]  end​  it "registers a user" do    result = client.post("/api/auth/register", {      name: "Alice", email: "alice#{rand(100000)}@example.com", password: "securePass123"    })    expect(result.status).to eq(201)  end​  it "rejects duplicate email" do    email = "dup#{rand(100000)}@example.com"    client.post("/api/auth/register", {      name: "First", email: email, password: "password123"    })    result = client.post("/api/auth/register", {      name: "Second", email: email, password: "password123"    })    expect(result.status).to eq(409)  end​  it "creates a task" do    result = client.post("/api/tasks", { title: "Test Task" },      headers: { "Authorization" => "Bearer #{token}" })    expect(result.status).to eq(201)    expect(result.json["title"]).to eq("Test Task")    expect(result.json["status"]).to eq("todo")  end​  it "lists tasks" do    client.post("/api/tasks", { title: "Task 1" }, headers: { "Authorization" => "Bearer #{token}" })    client.post("/api/tasks", { title: "Task 2" }, headers: { "Authorization" => "Bearer #{token}" })​    result = client.get("/api/tasks", headers: { "Authorization" => "Bearer #{token}" })    expect(result.status).to eq(200)    expect(result.json["tasks"]).to be_an(Array)  end​  it "updates a task status" do    created = client.post("/api/tasks", { title: "Update Me" },      headers: { "Authorization" => "Bearer #{token}" })    id = created.json["id"]​    result = client.put("/api/tasks/#{id}", { status: "done" },      headers: { "Authorization" => "Bearer #{token}" })    expect(result.status).to eq(200)    expect(result.json["status"]).to eq("done")    expect(result.json["completed_at"]).not_to be_nil  end​  it "deletes a task" do    created = client.post("/api/tasks", { title: "Delete Me" },      headers: { "Authorization" => "Bearer #{token}" })    id = created.json["id"]​    result = client.delete("/api/tasks/#{id}",      headers: { "Authorization" => "Bearer #{token}" })    expect(result.status).to eq(204)  end​  it "returns dashboard stats" do    client.post("/api/tasks", { title: "Stats Task" },      headers: { "Authorization" => "Bearer #{token}" })​    result = client.get("/api/dashboard/stats",      headers: { "Authorization" => "Bearer #{token}" })    expect(result.status).to eq(200)    expect(result.json["total_tasks"]).to be >= 1  end​  it "requires authentication for tasks" do    result = client.get("/api/tasks")    expect(result.status).to eq(401)  endend

tina4 test

Running tests...​  TaskFlow    registers a user    rejects duplicate email    creates a task    lists tasks    updates a task status    deletes a task    returns dashboard stats    requires authentication for tasks​  8 examples, 0 failures (0.84s)

TINA4_DEBUG=falseTINA4_LOG_LEVEL=WARNINGJWT_SECRET=your-production-secret-at-least-32-charactersTINA4_DATABASE_URL=sqlite:///data/app.dbTINA4_CACHE_BACKEND=redisTINA4_CACHE_URL=redis://redis:6379

docker compose up -d --build

curl http://localhost:7147/health

{"status": "ok", "version": "1.0.0", "database": "connected"}

taskflow/├── .env├── .env.example├── .gitignore├── Gemfile├── Gemfile.lock├── app.rb├── Dockerfile├── docker-compose.yml├── config/│   └── puma.rb├── src/│   ├── routes/│   │   ├── auth.rb                # Registration, login│   │   ├── tasks.rb               # Task CRUD│   │   ├── dashboard.rb           # Dashboard stats + page│   │   ├── middleware.rb          # Auth middleware│   │   └── task_ws.rb             # WebSocket event handlers│   ├── orm/│   │   ├── user.rb                # User model with relationships│   │   └── task.rb                # Task model with relationships│   ├── migrations/│   │   ├── 20260322150000_create_users_table.sql│   │   └── 20260322150100_create_tasks_table.sql│   ├── templates/│   │   ├── base.html              # Base layout│   │   ├── dashboard.html         # Dashboard page│   │   ├── emails/│   │   │   └── task-assigned.html # Assignment notification│   │   └── errors/│   │       ├── 404.html│   │       └── 500.html│   ├── public/│   │   ├── css/│   │   │   └── tina4.css│   │   └── js/│   │       ├── tina4.min.js│   │       └── frond.min.js│   └── locales/│       └── en.json├── data/│   └── app.db├── logs/├── secrets/└── tests/    └── taskflow_spec.rb