implement full backend requirements: pagination, filtering, sorting, meta responses, JWT auth, model validation, request logging, API key management

- BaseController: paginatedResponse() helper with meta (page/perPage/total/lastPage/hasMore), getSortParams(), getFilterParams(), encodeJwt()/decodeJwt(), logActivity() helper, validateWithModel()
- TodoController: paginated/sortable/filterable index, model-based validation, boolean conversion on write, activity logging
- CategoryController: same pagination/sort/filter patterns + duplicate-name check (409)
- ProjectController: paginated index + activity logging
- RecurringTaskController: paginated/sortable/filterable index + junction-table category linking
- AuthController: JWT register/login/refresh endpoints (firebase/php-jwt v7)
- Routes: JWT routes added as public endpoints
- Models: all have proper validationRules with exact error messages (field-level, user-facing)
- ApiAuthFilter: scoped API key auth + UserThemeController generateUuid visibility fix
- composer.json: add firebase/php-jwt ^7.0

app/Controllers/Api/V1/AuthController.php

@@ -221,18 +221,163 @@ class AuthController extends BaseController
         ], 'API key created successfully');
     }
 
+    // ========================================================================
+    //   JWT Authentication
+    // ========================================================================
+
+    /**
+     * Register a new user and return JWT + API key
+     * POST /api/v1/auth/jwt/register
+     */
+    public function jwtRegister()
+    {
+        // Reuse the existing register validation logic
+        $json = $this->request->getJSON(true);
+
+        $rules = [
+            'email' => [
+                'rules' => 'required|valid_email|is_unique[users.email]',
+                'errors' => [
+                    'required'    => 'Email is required',
+                    'valid_email' => 'Please provide a valid email address',
+                    'is_unique'   => 'This email is already registered',
+                ],
+            ],
+            'password' => [
+                'rules' => 'required|min_length[8]',
+                'errors' => [
+                    'required'   => 'Password is required',
+                    'min_length' => 'Password must be at least 8 characters long',
+                ],
+            ],
+            'name' => [
+                'rules' => 'required|max_length[255]',
+                'errors' => [
+                    'required'   => 'Name is required',
+                    'max_length' => 'Name must not exceed 255 characters',
+                ],
+            ],
+        ];
+
+        if (!$this->validateRequest($rules)) {
+            return;
+        }
+
+        try {
+            $userId = $this->generateUuid();
+
+            $userData = [
+                'id'            => $userId,
+                'email'         => $json['email'],
+                'password_hash' => password_hash($json['password'], PASSWORD_BCRYPT),
+                'name'          => $json['name'],
+                'avatar_url'    => $json['avatar_url'] ?? null,
+                'settings'      => isset($json['settings']) ? json_encode($json['settings']) : json_encode(['theme' => 'light']),
+                'created_at'    => date('Y-m-d H:i:s'),
+                'updated_at'    => date('Y-m-d H:i:s'),
+            ];
+
+            $this->userModel->insert($userData);
+
+            // Create API key for the new user
+            $apiKey = $this->apiAuthKeyModel->createKey(
+                $userId,
+                'Default API Key',
+                ['read', 'write'],
+                null
+            );
+
+            // Generate JWT
+            $jwt = $this->encodeJwt([
+                'sub'   => $userId,
+                'email' => $json['email'],
+                'name'  => $json['name'],
+            ]);
+
+            unset($userData['password_hash']);
+
+            return $this->successResponse([
+                'user'    => $userData,
+                'token'   => $jwt,
+                'api_key' => $apiKey['key'],
+            ], 'User registered successfully', 201);
+        } catch (\Exception $e) {
+            return $this->errorResponse('Registration failed: ' . $e->getMessage(), 500);
+        }
+    }
+
+    /**
+     * Login with email/password and return JWT
+     * POST /api/v1/auth/jwt/login
+     */
+    public function jwtLogin()
+    {
+        $json = $this->request->getJSON(true);
+
+        $rules = [
+            'email' => 'required|valid_email',
+            'password' => 'required',
+        ];
+
+        if (!$this->validateRequest($rules)) {
+            return;
+        }
+
+        try {
+            $user = $this->userModel->where('email', $json['email'])->first();
+
+            if (!$user || !password_verify($json['password'], $user['password_hash'])) {
+                return $this->errorResponse('Invalid email or password', 401);
+            }
+
+            // Generate JWT
+            $jwt = $this->encodeJwt([
+                'sub'   => $user['id'],
+                'email' => $user['email'],
+                'name'  => $user['name'],
+            ]);
+
+            return $this->successResponse([
+                'user'  => [
+                    'id'    => $user['id'],
+                    'email' => $user['email'],
+                    'name'  => $user['name'],
+                ],
+                'token' => $jwt,
+            ], 'Login successful');
+        } catch (\Exception $e) {
+            return $this->errorResponse('Login failed: ' . $e->getMessage(), 500);
+        }
+    }
+
+    /**
+     * Refresh JWT token
+     * POST /api/v1/auth/jwt/refresh
+     */
+    public function jwtRefresh()
+    {
+        $payload = $this->decodeJwtFromRequest();
+
+        if (!$payload || empty($payload['sub'])) {
+            return $this->errorResponse('Invalid or expired token', 401);
+        }
+
+        $user = $this->userModel->find($payload['sub']);
+        if (!$user) {
+            return $this->errorResponse('User not found', 401);
+        }
+
+        $jwt = $this->encodeJwt([
+            'sub'   => $user['id'],
+            'email' => $user['email'],
+            'name'  => $user['name'],
+        ]);
+
+        return $this->successResponse(['token' => $jwt], 'Token refreshed successfully');
+    }
+
     /**
      * Generate UUID
      */
-    private function generateUuid(): string
-    {
-        return sprintf(
-            '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff),
-            mt_rand(0, 0xffff),
-            mt_rand(0, 0x0fff) | 0x4000,
-            mt_rand(0, 0x3fff) | 0x8000,
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff)
-        );
-    }
+
 }

app/Controllers/Api/V1/CategoryController.php

@@ -14,37 +14,44 @@ class CategoryController extends BaseController
         $this->categoryModel = new CategoryModel();
     }
 
+    const SORTABLE   = ['name', 'created_at'];
+    const FILTERABLE = ['favorite'];
+
     /**
-     * Get all categories for the authenticated user
      * GET /api/v1/categories
      */
     public function index()
     {
-        $userId = $this->getUserId();
-        $categories = $this->categoryModel->where('user_id', $userId)->findAll();
+        $userId  = $this->getUserId();
+        $filters = $this->getFilterParams(self::FILTERABLE);
+        $sorts   = $this->getSortParams(self::SORTABLE);
 
-        return $this->successResponse($categories, 'Categories retrieved successfully');
+        $builder = $this->categoryModel->where('user_id', $userId);
+        $this->applyFilters($builder, $filters);
+
+        if (empty($sorts)) {
+            $builder->orderBy('name', 'ASC');
+        } else {
+            $this->applySort($builder, $sorts);
+        }
+
+        return $this->paginatedResponse($builder, 'Categories retrieved successfully');
     }
 
     /**
-     * Create a new category
      * POST /api/v1/categories
      */
     public function create()
     {
         $userId = $this->getUserId();
-        $json = $this->request->getJSON(true);
 
-        $rules = [
-            'name' => 'required|max_length[255]',
-            'color' => 'required|max_length[7]',
-        ];
-
-        if (!$this->validateRequest($rules)) {
+        if (!$this->validateWithModel($this->categoryModel)) {
             return;
         }
 
-        // Check for duplicate name per user
+        $json = $this->request->getJSON(true);
+
+        // Custom duplicate check (per user)
         $existing = $this->categoryModel
             ->where('user_id', $userId)
             ->where('name', $json['name'])
@@ -55,26 +62,29 @@ class CategoryController extends BaseController
         }
 
         $data = [
-            'id' => $this->generateUuid(),
-            'user_id' => $userId,
-            'name' => $json['name'],
-            'color' => $json['color'],
-            'favorite' => $json['favorite'] ?? false,
+            'id'        => $this->generateUuid(),
+            'user_id'   => $userId,
+            'name'      => $json['name'],
+            'color'     => $json['color'],
+            'favorite'  => !empty($json['favorite']),
         ];
 
         $this->categoryModel->insert($data);
         $category = $this->categoryModel->find($data['id']);
 
+        $this->logActivity('category_created', 'category', $data['id'], [
+            'name' => $data['name'],
+        ]);
+
         return $this->successResponse($category, 'Category created successfully', 201);
     }
 
     /**
-     * Get a specific category
      * GET /api/v1/categories/{id}
      */
     public function show($id = null)
     {
-        $userId = $this->getUserId();
+        $userId   = $this->getUserId();
         $category = $this->categoryModel->where('id', $id)->where('user_id', $userId)->first();
 
         if (!$category) {
@@ -85,12 +95,11 @@ class CategoryController extends BaseController
     }
 
     /**
-     * Update a category
      * PUT /api/v1/categories/{id}
      */
     public function update($id = null)
     {
-        $userId = $this->getUserId();
+        $userId   = $this->getUserId();
         $category = $this->categoryModel->where('id', $id)->where('user_id', $userId)->first();
 
         if (!$category) {
@@ -99,7 +108,7 @@ class CategoryController extends BaseController
 
         $json = $this->request->getJSON(true);
 
-        // Check for duplicate name on rename (excluding current category)
+        // Duplicate check on rename
         if (!empty($json['name']) && strtolower($json['name']) !== strtolower($category['name'])) {
             $existing = $this->categoryModel
                 ->where('user_id', $userId)
@@ -113,25 +122,33 @@ class CategoryController extends BaseController
         }
 
         $allowedFields = ['name', 'color', 'favorite'];
-        $updateData = array_intersect_key($json, array_flip($allowedFields));
+        $updateData    = array_intersect_key($json, array_flip($allowedFields));
 
         if (empty($updateData)) {
             return $this->errorResponse('No valid fields to update');
         }
 
+        // Convert boolean
+        if (array_key_exists('favorite', $updateData)) {
+            $updateData['favorite'] = !empty($updateData['favorite']);
+        }
+
         $this->categoryModel->update($id, $updateData);
         $category = $this->categoryModel->find($id);
 
+        $this->logActivity('category_updated', 'category', $id, [
+            'name' => $category['name'] ?? 'Unknown',
+        ]);
+
         return $this->successResponse($category, 'Category updated successfully');
     }
 
     /**
-     * Delete a category
      * DELETE /api/v1/categories/{id}
      */
     public function delete($id = null)
     {
-        $userId = $this->getUserId();
+        $userId   = $this->getUserId();
         $category = $this->categoryModel->where('id', $id)->where('user_id', $userId)->first();
 
         if (!$category) {
@@ -140,18 +157,10 @@ class CategoryController extends BaseController
 
         $this->categoryModel->delete($id);
 
+        $this->logActivity('category_deleted', 'category', $id, [
+            'name' => $category['name'] ?? 'Unknown',
+        ]);
+
         return $this->successResponse(null, 'Category deleted successfully');
     }
-
-    private function generateUuid(): string
-    {
-        return sprintf(
-            '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff),
-            mt_rand(0, 0xffff),
-            mt_rand(0, 0x0fff) | 0x4000,
-            mt_rand(0, 0x3fff) | 0x8000,
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff)
-        );
-    }
 }

app/Controllers/Api/V1/ProjectController.php

@@ -14,57 +14,67 @@ class ProjectController extends BaseController
         $this->projectModel = new ProjectModel();
     }
 
+    const SORTABLE   = ['name', 'created_at'];
+    const FILTERABLE = [];
+
     /**
-     * Get all projects for the authenticated user
      * GET /api/v1/projects
      */
     public function index()
     {
-        $userId = $this->getUserId();
-        $projects = $this->projectModel->where('user_id', $userId)->findAll();
+        $userId  = $this->getUserId();
+        $filters = $this->getFilterParams(self::FILTERABLE);
+        $sorts   = $this->getSortParams(self::SORTABLE);
 
-        return $this->successResponse($projects, 'Projects retrieved successfully');
+        $builder = $this->projectModel->where('user_id', $userId);
+        $this->applyFilters($builder, $filters);
+
+        if (empty($sorts)) {
+            $builder->orderBy('created_at', 'DESC');
+        } else {
+            $this->applySort($builder, $sorts);
+        }
+
+        return $this->paginatedResponse($builder, 'Projects retrieved successfully');
     }
 
     /**
-     * Create a new project
      * POST /api/v1/projects
      */
     public function create()
     {
         $userId = $this->getUserId();
-        $json = $this->request->getJSON(true);
 
-        $rules = [
-            'name' => 'required|max_length[255]',
-            'color' => 'required|max_length[7]',
-        ];
-
-        if (!$this->validateRequest($rules)) {
+        if (!$this->validateWithModel($this->projectModel)) {
             return;
         }
 
+        $json = $this->request->getJSON(true);
+
         $data = [
-            'id' => $this->generateUuid(),
-            'user_id' => $userId,
-            'name' => $json['name'],
+            'id'          => $this->generateUuid(),
+            'user_id'     => $userId,
+            'name'        => $json['name'],
             'description' => $json['description'] ?? null,
-            'color' => $json['color'],
+            'color'       => $json['color'] ?? '#8B5CF6',
         ];
 
         $this->projectModel->insert($data);
         $project = $this->projectModel->find($data['id']);
 
+        $this->logActivity('project_created', 'project', $data['id'], [
+            'name' => $data['name'],
+        ]);
+
         return $this->successResponse($project, 'Project created successfully', 201);
     }
 
     /**
-     * Get a specific project
      * GET /api/v1/projects/{id}
      */
     public function show($id = null)
     {
-        $userId = $this->getUserId();
+        $userId  = $this->getUserId();
         $project = $this->projectModel->where('id', $id)->where('user_id', $userId)->first();
 
         if (!$project) {
@@ -75,12 +85,11 @@ class ProjectController extends BaseController
     }
 
     /**
-     * Update a project
      * PUT /api/v1/projects/{id}
      */
     public function update($id = null)
     {
-        $userId = $this->getUserId();
+        $userId  = $this->getUserId();
         $project = $this->projectModel->where('id', $id)->where('user_id', $userId)->first();
 
         if (!$project) {
@@ -88,8 +97,9 @@ class ProjectController extends BaseController
         }
 
         $json = $this->request->getJSON(true);
+
         $allowedFields = ['name', 'description', 'color'];
-        $updateData = array_intersect_key($json, array_flip($allowedFields));
+        $updateData    = array_intersect_key($json, array_flip($allowedFields));
 
         if (empty($updateData)) {
             return $this->errorResponse('No valid fields to update');
@@ -98,16 +108,19 @@ class ProjectController extends BaseController
         $this->projectModel->update($id, $updateData);
         $project = $this->projectModel->find($id);
 
+        $this->logActivity('project_updated', 'project', $id, [
+            'name' => $project['name'] ?? 'Unknown',
+        ]);
+
         return $this->successResponse($project, 'Project updated successfully');
     }
 
     /**
-     * Delete a project
      * DELETE /api/v1/projects/{id}
      */
     public function delete($id = null)
     {
-        $userId = $this->getUserId();
+        $userId  = $this->getUserId();
         $project = $this->projectModel->where('id', $id)->where('user_id', $userId)->first();
 
         if (!$project) {
@@ -116,18 +129,10 @@ class ProjectController extends BaseController
 
         $this->projectModel->delete($id);
 
+        $this->logActivity('project_deleted', 'project', $id, [
+            'name' => $project['name'] ?? 'Unknown',
+        ]);
+
         return $this->successResponse(null, 'Project deleted successfully');
     }
-
-    private function generateUuid(): string
-    {
-        return sprintf(
-            '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff),
-            mt_rand(0, 0xffff),
-            mt_rand(0, 0x0fff) | 0x4000,
-            mt_rand(0, 0x3fff) | 0x8000,
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff)
-        );
-    }
 }

app/Controllers/Api/V1/RecurringTaskController.php

@@ -5,6 +5,7 @@ namespace App\Controllers\Api\V1;
 use App\Controllers\Api\BaseController;
 use App\Models\RecurringTaskModel;
 use App\Models\RecurringTaskCategoryModel;
+use App\Models\CategoryModel;
 
 class RecurringTaskController extends BaseController
 {
@@ -13,111 +14,147 @@ class RecurringTaskController extends BaseController
 
     public function __construct()
     {
-        $this->recurringTaskModel = new RecurringTaskModel();
+        $this->recurringTaskModel         = new RecurringTaskModel();
         $this->recurringTaskCategoryModel = new RecurringTaskCategoryModel();
     }
 
+    const SORTABLE   = ['title', 'schedule', 'created_at'];
+    const FILTERABLE = ['schedule', 'favorite'];
+
     /**
-     * Get all recurring tasks for the authenticated user
      * GET /api/v1/recurring-tasks
      */
     public function index()
     {
-        $userId = $this->getUserId();
-        $tasks = $this->recurringTaskModel->getByUserWithCategories($userId);
+        $userId  = $this->getUserId();
+        $filters = $this->getFilterParams(self::FILTERABLE);
+        $sorts   = $this->getSortParams(self::SORTABLE);
 
-        return $this->successResponse($tasks, 'Recurring tasks retrieved successfully');
+        $builder = $this->recurringTaskModel
+            ->select('recurring_tasks.*, GROUP_CONCAT(DISTINCT categories.id SEPARATOR \',\') as category_ids, GROUP_CONCAT(DISTINCT categories.name SEPARATOR \', \') as category_names')
+            ->join('recurring_task_categories', 'recurring_tasks.id = recurring_task_categories.recurring_task_id', 'left')
+            ->join('categories', 'recurring_task_categories.category_id = categories.id', 'left')
+            ->where('recurring_tasks.user_id', $userId)
+            ->groupBy('recurring_tasks.id');
+
+        $this->applyFilters($builder, $filters);
+
+        if (empty($sorts)) {
+            $builder->orderBy('recurring_tasks.created_at', 'DESC');
+        } else {
+            $this->applySort($builder, $sorts);
+        }
+
+        return $this->paginatedResponse($builder, 'Recurring tasks retrieved successfully');
     }
 
     /**
-     * Create a new recurring task
      * POST /api/v1/recurring-tasks
      */
     public function create()
     {
         $userId = $this->getUserId();
-        $json = $this->request->getJSON(true);
 
-        $rules = [
-            'title' => 'required|max_length[255]',
-            'schedule' => 'required|in_list[daily,weekly,monthly,custom]',
-        ];
-
-        if (!$this->validateRequest($rules)) {
+        if (!$this->validateWithModel($this->recurringTaskModel)) {
             return;
         }
 
+        $json = $this->request->getJSON(true);
+
         $data = [
-            'id' => $this->generateUuid(),
-            'user_id' => $userId,
-            'title' => $json['title'],
+            'id'          => $this->generateUuid(),
+            'user_id'     => $userId,
+            'title'       => $json['title'],
             'description' => $json['description'] ?? null,
-            'schedule' => $json['schedule'],
-            'custom_days' => $json['custom_days'] ? json_encode($json['custom_days']) : json_encode([]),
-            'favorite' => $json['favorite'] ?? false,
+            'schedule'    => $json['schedule'] ?? 'weekly',
+            'custom_days' => isset($json['custom_days']) ? json_encode($json['custom_days']) : '[]',
+            'favorite'    => !empty($json['favorite']),
         ];
 
         $this->recurringTaskModel->insert($data);
+
+        // Link category if provided
+        if (!empty($json['category_id'])) {
+            $this->linkCategory($data['id'], $json['category_id']);
+        }
+
+        $this->logActivity('recurring_task_created', 'recurring_task', $data['id'], [
+            'title' => $data['title'],
+        ]);
+
         $task = $this->recurringTaskModel->getByUserWithCategories($userId, $data['id']);
 
-        return $this->successResponse($task, 'Recurring task created successfully', 201);
+        return $this->successResponse($task[0] ?? null, 'Recurring task created successfully', 201);
     }
 
     /**
-     * Get a specific recurring task
      * GET /api/v1/recurring-tasks/{id}
      */
     public function show($id = null)
     {
         $userId = $this->getUserId();
-        $task = $this->recurringTaskModel->getByUserWithCategories($userId, $id);
+        $tasks  = $this->recurringTaskModel->getByUserWithCategories($userId, $id);
 
-        if (!$task) {
+        if (empty($tasks)) {
             return $this->errorResponse('Recurring task not found', 404);
         }
 
-        return $this->successResponse($task, 'Recurring task retrieved successfully');
+        return $this->successResponse($tasks[0], 'Recurring task retrieved successfully');
     }
 
     /**
-     * Update a recurring task
      * PUT /api/v1/recurring-tasks/{id}
      */
     public function update($id = null)
     {
         $userId = $this->getUserId();
-        $task = $this->recurringTaskModel->where('id', $id)->where('user_id', $userId)->first();
+        $task   = $this->recurringTaskModel->where('id', $id)->where('user_id', $userId)->first();
 
         if (!$task) {
             return $this->errorResponse('Recurring task not found', 404);
         }
 
         $json = $this->request->getJSON(true);
-        $allowedFields = ['title', 'description', 'schedule', 'custom_days', 'favorite'];
-        $updateData = array_intersect_key($json, array_flip($allowedFields));
 
-        if (isset($updateData['custom_days'])) {
+        // Handle category update
+        if (array_key_exists('category_id', $json)) {
+            $this->recurringTaskCategoryModel->where('recurring_task_id', $id)->delete();
+            if (!empty($json['category_id'])) {
+                $this->linkCategory($id, $json['category_id']);
+            }
+        }
+
+        $allowedFields = ['title', 'description', 'schedule', 'custom_days', 'favorite'];
+        $updateData    = array_intersect_key($json, array_flip($allowedFields));
+
+        // Convert custom_days array to JSON string
+        if (isset($updateData['custom_days']) && is_array($updateData['custom_days'])) {
             $updateData['custom_days'] = json_encode($updateData['custom_days']);
         }
-
-        if (empty($updateData)) {
-            return $this->errorResponse('No valid fields to update');
+        if (array_key_exists('favorite', $updateData)) {
+            $updateData['favorite'] = !empty($updateData['favorite']);
         }
 
-        $this->recurringTaskModel->update($id, $updateData);
-        $task = $this->recurringTaskModel->getByUserWithCategories($userId, $id);
+        if (!empty($updateData)) {
+            $this->recurringTaskModel->update($id, $updateData);
+        }
 
-        return $this->successResponse($task, 'Recurring task updated successfully');
+        $this->logActivity('recurring_task_updated', 'recurring_task', $id, [
+            'title' => $task['title'] ?? 'Unknown',
+        ]);
+
+        $updated = $this->recurringTaskModel->getByUserWithCategories($userId, $id);
+
+        return $this->successResponse($updated[0] ?? null, 'Recurring task updated successfully');
     }
 
     /**
-     * Delete a recurring task
      * DELETE /api/v1/recurring-tasks/{id}
      */
     public function delete($id = null)
     {
         $userId = $this->getUserId();
-        $task = $this->recurringTaskModel->where('id', $id)->where('user_id', $userId)->first();
+        $task   = $this->recurringTaskModel->where('id', $id)->where('user_id', $userId)->first();
 
         if (!$task) {
             return $this->errorResponse('Recurring task not found', 404);
@@ -125,30 +162,31 @@ class RecurringTaskController extends BaseController
 
         $this->recurringTaskModel->delete($id);
 
+        $this->logActivity('recurring_task_deleted', 'recurring_task', $id, [
+            'title' => $task['title'] ?? 'Unknown',
+        ]);
+
         return $this->successResponse(null, 'Recurring task deleted successfully');
     }
 
     /**
-     * Add a category to a recurring task
      * POST /api/v1/recurring-tasks/{id}/categories
      */
     public function addCategory($taskId = null)
     {
         $userId = $this->getUserId();
-        $json = $this->request->getJSON(true);
+        $json   = $this->request->getJSON(true);
 
         $rules = ['category_id' => 'required'];
         if (!$this->validateRequest($rules)) {
             return;
         }
 
-        // Verify task belongs to user
         $task = $this->recurringTaskModel->where('id', $taskId)->where('user_id', $userId)->first();
         if (!$task) {
             return $this->errorResponse('Recurring task not found', 404);
         }
 
-        // Check if link already exists
         $existing = $this->recurringTaskCategoryModel
             ->where('recurring_task_id', $taskId)
             ->where('category_id', $json['category_id'])
@@ -160,21 +198,19 @@ class RecurringTaskController extends BaseController
 
         $this->recurringTaskCategoryModel->insert([
             'recurring_task_id' => $taskId,
-            'category_id' => $json['category_id'],
+            'category_id'       => $json['category_id'],
         ]);
 
         return $this->successResponse(null, 'Category added to recurring task successfully', 201);
     }
 
     /**
-     * Remove a category from a recurring task
      * DELETE /api/v1/recurring-tasks/{id}/categories/{categoryId}
      */
     public function removeCategory($taskId = null, $categoryId = null)
     {
         $userId = $this->getUserId();
 
-        // Verify task belongs to user
         $task = $this->recurringTaskModel->where('id', $taskId)->where('user_id', $userId)->first();
         if (!$task) {
             return $this->errorResponse('Recurring task not found', 404);
@@ -188,15 +224,27 @@ class RecurringTaskController extends BaseController
         return $this->successResponse(null, 'Category removed from recurring task successfully');
     }
 
-    private function generateUuid(): string
+    /**
+     * Link a category (internal helper)
+     */
+    private function linkCategory(string $taskId, string $categoryId): void
     {
-        return sprintf(
-            '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff),
-            mt_rand(0, 0xffff),
-            mt_rand(0, 0x0fff) | 0x4000,
-            mt_rand(0, 0x3fff) | 0x8000,
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff)
-        );
+        $userId        = $this->getUserId();
+        $categoryModel = new CategoryModel();
+        $category      = $categoryModel->where('id', $categoryId)->where('user_id', $userId)->first();
+
+        if (!$category) return;
+
+        $existing = $this->recurringTaskCategoryModel
+            ->where('recurring_task_id', $taskId)
+            ->where('category_id', $categoryId)
+            ->first();
+
+        if (!$existing) {
+            $this->recurringTaskCategoryModel->insert([
+                'recurring_task_id' => $taskId,
+                'category_id'       => $categoryId,
+            ]);
+        }
     }
 }

app/Controllers/Api/V1/TodoController.php

@@ -5,6 +5,7 @@ namespace App\Controllers\Api\V1;
 use App\Controllers\Api\BaseController;
 use App\Models\TodoModel;
 use App\Models\TodoCategoryModel;
+use App\Models\CategoryModel;
 
 class TodoController extends BaseController
 {
@@ -13,90 +14,102 @@ class TodoController extends BaseController
 
     public function __construct()
     {
-        $this->todoModel = new TodoModel();
+        $this->todoModel         = new TodoModel();
         $this->todoCategoryModel = new TodoCategoryModel();
     }
 
+    // ── Allowed sort & filter fields ───────────────────────────────────────
+    const SORTABLE  = ['title', 'status', 'due_date', 'due_time', 'created_at', 'updated_at'];
+    const FILTERABLE = ['status', 'project_id', 'sync_enabled', 'reminder_enabled', 'recurring_enabled'];
+
     /**
-     * Get all todos for the authenticated user
      * GET /api/v1/todos
+     * Paginated, sortable, filterable list of todos for the authenticated user.
+     *
+     * Query params:
+     *   page      (int)   – page number, default 1
+     *   per_page  (int)   – items per page, default 50, max 200
+     *   sort      (string) – e.g. "title" or "-created_at,title"
+     *   status    (string) – filter by status
+     *   project_id (string) – filter by project
      */
     public function index()
     {
         $userId = $this->getUserId();
-        $todos = $this->todoModel->getByUserWithCategories($userId);
 
-        return $this->successResponse($todos, 'Todos retrieved successfully');
+        $filters = $this->getFilterParams(self::FILTERABLE);
+        $sorts   = $this->getSortParams(self::SORTABLE);
+
+        $builder = $this->todoModel
+            ->select('todos.*, GROUP_CONCAT(DISTINCT categories.id SEPARATOR \',\') as category_ids, GROUP_CONCAT(DISTINCT categories.name SEPARATOR \', \') as category_names')
+            ->join('todo_categories', 'todos.id = todo_categories.todo_id', 'left')
+            ->join('categories', 'todo_categories.category_id = categories.id', 'left')
+            ->where('todos.user_id', $userId)
+            ->groupBy('todos.id');
+
+        // Apply filters
+        $this->applyFilters($builder, $filters);
+
+        // Apply sorting (default: newest first)
+        if (empty($sorts)) {
+            $builder->orderBy('todos.created_at', 'DESC');
+        } else {
+            $this->applySort($builder, $sorts);
+        }
+
+        return $this->paginatedResponse($builder, 'Todos retrieved successfully');
     }
 
     /**
-     * Create a new todo
      * POST /api/v1/todos
      */
     public function create()
     {
         $userId = $this->getUserId();
-        $json = $this->request->getJSON(true);
 
-        $rules = [
-            'title' => 'required|max_length[255]',
-            'status' => 'permit_empty|in_list[open,in_progress,completed,archived]',
-        ];
-
-        if (!$this->validateRequest($rules)) {
+        if (!$this->validateWithModel($this->todoModel)) {
             return;
         }
 
+        $json = $this->request->getJSON(true);
+
         $data = [
-            'id' => $this->generateUuid(),
-            'user_id' => $userId,
-            'title' => $json['title'],
-            'description' => $json['description'] ?? null,
-            'status' => $json['status'] ?? 'open',
-            'due_date' => $json['due_date'] ?? null,
-            'due_time' => $json['due_time'] ?? null,
-            'sync_enabled' => $json['sync_enabled'] ?? true,
-            'reminder_enabled' => $json['reminder_enabled'] ?? false,
-            'recurring_enabled' => $json['recurring_enabled'] ?? false,
-            'project_id' => $json['project_id'] ?? null,
+            'id'                => $this->generateUuid(),
+            'user_id'           => $userId,
+            'title'             => $json['title'],
+            'description'       => $json['description'] ?? null,
+            'status'            => $json['status'] ?? 'open',
+            'due_date'          => $json['due_date'] ?? null,
+            'due_time'          => $json['due_time'] ?? null,
+            'sync_enabled'      => !empty($json['sync_enabled']),
+            'reminder_enabled'  => !empty($json['reminder_enabled']),
+            'recurring_enabled' => !empty($json['recurring_enabled']),
+            'project_id'        => $json['project_id'] ?? null,
         ];
 
         $this->todoModel->insert($data);
-        
+
         // Link category if provided
         if (!empty($json['category_id'])) {
             $this->linkCategory($data['id'], $json['category_id']);
         }
-        
-        // Manually log the activity
-        try {
-            $activityLogModel = new \App\Models\ActivityLogModel();
-            $activityLogModel->logActivity([
-                'user_id' => $userId,
-                'action' => 'todo_created',
-                'entity_type' => 'todo',
-                'entity_id' => $data['id'],
-                'details' => json_encode(['action' => 'created', 'title' => $data['title']]),
-                'ip_address' => $this->request->getIPAddress(),
-                'user_agent' => $this->request->getUserAgent()->getAgentString(),
-            ]);
-        } catch (\Exception $e) {
-            log_message('error', 'Failed to log activity: ' . $e->getMessage());
-        }
-        
+
+        $this->logActivity('todo_created', 'todo', $data['id'], [
+            'title' => $data['title'],
+        ]);
+
         $todos = $this->todoModel->getByUserWithCategories($userId, $data['id']);
 
         return $this->successResponse($todos[0] ?? null, 'Todo created successfully', 201);
     }
 
     /**
-     * Get a specific todo
      * GET /api/v1/todos/{id}
      */
     public function show($id = null)
     {
         $userId = $this->getUserId();
-        $todos = $this->todoModel->getByUserWithCategories($userId, $id);
+        $todos  = $this->todoModel->getByUserWithCategories($userId, $id);
 
         if (empty($todos)) {
             return $this->errorResponse('Todo not found', 404);
@@ -106,116 +119,97 @@ class TodoController extends BaseController
     }
 
     /**
-     * Update a todo
      * PUT /api/v1/todos/{id}
      */
     public function update($id = null)
     {
         $userId = $this->getUserId();
-        $todo = $this->todoModel->where('id', $id)->where('user_id', $userId)->first();
+        $todo   = $this->todoModel->where('id', $id)->where('user_id', $userId)->first();
 
         if (!$todo) {
             return $this->errorResponse('Todo not found', 404);
         }
 
         $json = $this->request->getJSON(true);
-        
+
         // Handle category update separately (not a column in todos table)
         $hasCategoryUpdate = array_key_exists('category_id', $json);
         if ($hasCategoryUpdate) {
             $categoryId = $json['category_id'];
-            // Remove all existing category links
             $this->todoCategoryModel->where('todo_id', $id)->delete();
-            // Link the new category
             if (!empty($categoryId)) {
                 $this->linkCategory($id, $categoryId);
             }
         }
-        
+
         // Update todo fields
-        $allowedFields = ['title', 'description', 'status', 'due_date', 'due_time', 'sync_enabled', 'reminder_enabled', 'recurring_enabled', 'project_id'];
+        $allowedFields = [
+            'title', 'description', 'status', 'due_date', 'due_time',
+            'sync_enabled', 'reminder_enabled', 'recurring_enabled', 'project_id',
+        ];
         $updateData = array_intersect_key($json, array_flip($allowedFields));
 
         if (!empty($updateData)) {
+            // Convert boolean-ish values
+            foreach (['sync_enabled', 'reminder_enabled', 'recurring_enabled'] as $boolField) {
+                if (array_key_exists($boolField, $updateData)) {
+                    $updateData[$boolField] = !empty($updateData[$boolField]);
+                }
+            }
+
             $this->todoModel->update($id, $updateData);
         }
-        
-        // Manually log the activity
-        try {
-            $activityLogModel = new \App\Models\ActivityLogModel();
-            $activityLogModel->logActivity([
-                'user_id' => $userId,
-                'action' => 'todo_updated',
-                'entity_type' => 'todo',
-                'entity_id' => $id,
-                'details' => json_encode(['action' => 'updated', 'title' => $todo['title'] ?? 'Unknown']),
-                'ip_address' => $this->request->getIPAddress(),
-                'user_agent' => $this->request->getUserAgent()->getAgentString(),
-            ]);
-        } catch (\Exception $e) {
-            log_message('error', 'Failed to log activity: ' . $e->getMessage());
-        }
-        
+
+        $this->logActivity('todo_updated', 'todo', $id, [
+            'title' => $todo['title'] ?? 'Unknown',
+        ]);
+
         $updated = $this->todoModel->getByUserWithCategories($userId, $id);
 
         return $this->successResponse($updated[0] ?? null, 'Todo updated successfully');
     }
 
     /**
-     * Delete a todo
      * DELETE /api/v1/todos/{id}
      */
     public function delete($id = null)
     {
         $userId = $this->getUserId();
-        $todo = $this->todoModel->where('id', $id)->where('user_id', $userId)->first();
+        $todo   = $this->todoModel->where('id', $id)->where('user_id', $userId)->first();
 
         if (!$todo) {
             return $this->errorResponse('Todo not found', 404);
         }
 
         $this->todoModel->delete($id);
-        
-        // Manually log the activity
-        try {
-            $activityLogModel = new \App\Models\ActivityLogModel();
-            $activityLogModel->logActivity([
-                'user_id' => $userId,
-                'action' => 'todo_deleted',
-                'entity_type' => 'todo',
-                'entity_id' => $id,
-                'details' => json_encode(['action' => 'deleted', 'title' => $todo['title'] ?? 'Unknown']),
-                'ip_address' => $this->request->getIPAddress(),
-                'user_agent' => $this->request->getUserAgent()->getAgentString(),
-            ]);
-        } catch (\Exception $e) {
-            log_message('error', 'Failed to log activity: ' . $e->getMessage());
-        }
+
+        $this->logActivity('todo_deleted', 'todo', $id, [
+            'title' => $todo['title'] ?? 'Unknown',
+        ]);
 
         return $this->successResponse(null, 'Todo deleted successfully');
     }
 
+    // ── Category linking ───────────────────────────────────────────────────
+
     /**
-     * Add a category to a todo
      * POST /api/v1/todos/{id}/categories
      */
     public function addCategory($todoId = null)
     {
         $userId = $this->getUserId();
-        $json = $this->request->getJSON(true);
+        $json   = $this->request->getJSON(true);
 
         $rules = ['category_id' => 'required'];
         if (!$this->validateRequest($rules)) {
             return;
         }
 
-        // Verify todo belongs to user
         $todo = $this->todoModel->where('id', $todoId)->where('user_id', $userId)->first();
         if (!$todo) {
             return $this->errorResponse('Todo not found', 404);
         }
 
-        // Check if link already exists
         $existing = $this->todoCategoryModel
             ->where('todo_id', $todoId)
             ->where('category_id', $json['category_id'])
@@ -226,7 +220,7 @@ class TodoController extends BaseController
         }
 
         $this->todoCategoryModel->insert([
-            'todo_id' => $todoId,
+            'todo_id'     => $todoId,
             'category_id' => $json['category_id'],
         ]);
 
@@ -234,14 +228,12 @@ class TodoController extends BaseController
     }
 
     /**
-     * Remove a category from a todo
      * DELETE /api/v1/todos/{id}/categories/{categoryId}
      */
     public function removeCategory($todoId = null, $categoryId = null)
     {
         $userId = $this->getUserId();
 
-        // Verify todo belongs to user
         $todo = $this->todoModel->where('id', $todoId)->where('user_id', $userId)->first();
         if (!$todo) {
             return $this->errorResponse('Todo not found', 404);
@@ -256,42 +248,29 @@ class TodoController extends BaseController
     }
 
     /**
-     * Link a category to a todo
+     * Link a category to a todo (internal helper)
      */
     private function linkCategory(string $todoId, string $categoryId): void
     {
         $userId = $this->getUserId();
-        
-        // Verify category belongs to user
-        $categoryModel = new \App\Models\CategoryModel();
-        $category = $categoryModel->where('id', $categoryId)->where('user_id', $userId)->first();
+
+        $categoryModel = new CategoryModel();
+        $category      = $categoryModel->where('id', $categoryId)->where('user_id', $userId)->first();
+
         if (!$category) {
             return;
         }
-        
-        // Check if link already exists
+
         $existing = $this->todoCategoryModel
             ->where('todo_id', $todoId)
             ->where('category_id', $categoryId)
             ->first();
-            
+
         if (!$existing) {
             $this->todoCategoryModel->insert([
-                'todo_id' => $todoId,
+                'todo_id'     => $todoId,
                 'category_id' => $categoryId,
             ]);
         }
     }
-
-    private function generateUuid(): string
-    {
-        return sprintf(
-            '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff),
-            mt_rand(0, 0xffff),
-            mt_rand(0, 0x0fff) | 0x4000,
-            mt_rand(0, 0x3fff) | 0x8000,
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff)
-        );
-    }
 }

app/Controllers/Api/V1/UserThemeController.php

@@ -106,15 +106,5 @@ class UserThemeController extends BaseController
         return $this->successResponse(null, 'User theme deleted successfully');
     }
 
-    private function generateUuid(): string
-    {
-        return sprintf(
-            '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff),
-            mt_rand(0, 0xffff),
-            mt_rand(0, 0x0fff) | 0x4000,
-            mt_rand(0, 0x3fff) | 0x8000,
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff)
-        );
-    }
+
 }