PHP Capstone Project: Build a Secure Multi-User Task Application

Project Outcome

Build a server-rendered task application in which people register, sign in, create and complete their own tasks, upload an optional attachment, and never read or modify another account’s private data. The project is deliberately small enough to finish and broad enough to exercise production boundaries.

Completion means more than displaying pages: the database enforces integrity, requests are validated and authorized, failures are logged safely, tests protect key rules, quality commands pass, and a documented deployment can be rolled back.

Feature Contract

Register with a unique canonical email and password hash.
Log in, rotate session identity, log out, and expire authenticated state.
Create, list, edit, complete, and delete only owned tasks.
Upload one optional PDF attachment through controlled storage.
Filter task state and paginate with deterministic ordering.
Record a lightweight audit event for task completion.
Expose a protected account page and a minimal release health endpoint.

Project Structure

Suggested Directories

app/
  Application/
  Domain/
  Http/
  Infrastructure/
config/
public/index.php
storage/uploads/
templates/
tests/Unit/
tests/Integration/

Only public belongs under the web document root; uploads and application source remain outside it.

Data Model

Add foreign keys and indexes from actual ownership and feed queries. Keep the original upload name as escaped display metadata only if the feature needs it.

Table	Essential Data
users	id, canonical email, password hash, created timestamp
tasks	id, user_id, title, completion timestamp, created timestamp
attachments	id, task_id, generated path, MIME type, size
audit_events	id, user_id, event type, subject id, timestamp

HTTP Routes

Method and Path	Behavior
GET /tasks	List the authenticated owner’s tasks
POST /tasks	Validate CSRF and create one task
POST /tasks/{id}/complete	Authorize ownership and complete atomically
POST /tasks/{id}/attachment	Authorize, validate, and store one PDF
POST /logout	Validate CSRF and clear authenticated state

Ownership Query

Make ownership part of the query so another account’s row is not loaded and then accidentally exposed. Authorization still remains an explicit application decision.

Load an Owned Task

<?php
$statement = $pdo->prepare(
    'SELECT id, title, completed_at
     FROM tasks
     WHERE id = :task_id AND user_id = :user_id'
);
$statement->execute(['task_id' => $taskId, 'user_id' => $currentUserId]);
$task = $statement->fetch();

if ($task === false) {
    http_response_code(404);
    exit('Task not found');
}

The same not-found outcome covers a missing task and a task owned by another account.

Milestone Order

1. Bootstrap Composer, configuration, front controller, and quality command.
2. Create schema migrations and PDO repositories.
3. Implement registration, login, session rotation, logout, and CSRF.
4. Add task create, list, ownership checks, update, completion, and deletion.
5. Add upload validation and protected download.
6. Add unit tests for domain rules and integration tests for repositories and login.
7. Add pagination, audit job, logging, production configuration, and deployment runbook.

Acceptance Evidence

Every PHP file lints and the automated quality command succeeds.
A member cannot view or alter another member’s task by changing an id.
An invalid CSRF token changes no state.
A fake PDF and oversized upload are rejected without entering public storage.
Database constraint, invalid login, and duplicate submission paths have safe responses and diagnostic logs.
A fresh environment can install locked dependencies, migrate, run tests, and serve the health check.
The release identifier and rollback procedure are documented.

Stretch Features

Only begin stretch work after the acceptance evidence passes. Add email reminders through an idempotent queue, an API representation with token authentication and rate limiting, or administrator reporting with explicit authorization.

Review the Whole System

0 of 2 checked

Q1. Where should uploaded PDFs be stored?

Outside executable public paths Beside public/index.php Inside a cookie

Q2. What proves task isolation?

Ownership tests and owner-scoped queries A hidden form field alone A guessed URL

Capstone Delivery Boundary

Features without acceptance evidence
Do not call the project complete because pages render. Verify authorization boundaries, invalid inputs, transaction failures, and deployment configuration with repeatable tests.

Try this next

Deliver the Capstone

0 of 2 completed

Ship one vertical slice
Complete task creation from HTTP validation through service, transaction, repository, redirect, and test before adding more features. Keep authorization and validation decisions server-side throughout the slice.
Prove tenant and failure isolation
Test a second user attempting to read and edit the task, an invalid CSRF token, and a repository failure that must roll back the transaction. Record HTTP status, persisted rows, and audit evidence for every rejected path.

Previous Next