Guidelines for developing and maintaining a CodeIgniter 4 backend with role-based task management, JWT auth, and shift tracking. Covers architecture, patterns, migrations, and common pitfalls.
Expert guidance for developing a CodeIgniter 4 task management and shift-tracking backend application.
This is a **CodeIgniter 4** backend with three user roles:
**Core Data Model**: Locations contain Items; Items require Actions (checklist); Operators submit TaskSubmissions tracking action completion.
```
app/
Controllers/ # Route handlers (Auth, Admin/*, Operator, Verifikator)
Models/ # CodeIgniter Models extending Model class (m_* = master, r_* = relational)
Database/Migrations/ # Timestamped migrations (migrations create tables, applied via spark migrate)
Database/Seeds/ # Data seeding (e.g., ActionSeeder)
Config/ # Routes.php defines URL groups, Database.php configures connections
Filters/ # MyCors for CORS handling
Libraries/ # JwtService for EdDSA JWT handling (encode/decode)
Commands/ # CLI commands: shift:initialize, status:clean, shift:rotate
Views/ # Not in backend—frontend is separate
```
When working with this codebase, follow these patterns and conventions:
- Master tables use `m_` prefix (m_users, m_locations, m_items, m_actions)
- Relational tables use `r_` prefix (r_task_submission, r_task_submission_detail)
- `$table` - table name
- `$primaryKey` - primary key field
- `$allowedFields` - fields allowed for mass assignment
- `$returnType = 'array'` - return arrays not objects
```bash
# Create migration
php spark make:migration create_table_name
# Run migrations
php spark migrate
# Rollback
php spark migrate --rollback
# Refresh
php spark migrate:refresh
# Seed data
php spark db:seed SeedName
```
**JWT Handling**:
Available commands:
**Pattern**: Extend `BaseCommand`; use `CLI::write()` for output
```bash
./vendor/bin/phpunit
./vendor/bin/phpunit --coverage-html=build/logs/html/
```
1. **JWT Expiration**: Always check `time() > $jwt['expire_time']` after decode
2. **Role Mapping**: JWT stores 'administrator', 'operator', 'verifikator' but routes use 'admin' directory—map in controller
3. **Protected Fields**: Models have `$protectFields = true`; only fields in `$allowedFields` can be mass-assigned
4. **CORS Origins**: Currently permissive; update MyCors if restricting to frontend domains
5. **Missing Database Config**: Database credentials must be set in `app/Config/Database.php` (hostname, username, password, database)
6. **EdDSA Requirement**: Requires sodium extension enabled in PHP
7. **Public Root**: Web root should point to `public/index.php`, not project root
1. Use migrations for all database changes
2. Store validation rules inline with Indonesian error messages
3. Return arrays from models (not objects)
4. Extend BaseController for all controllers
5. Use EdDSA for JWT signing
6. Check JWT expiration on every protected route
7. Use `php spark` for all CLI operations
8. Keep frontend separate from backend
9. Use RESTful conventions for routes
10. Apply CORS filters for cross-origin requests
Leave a review
No reviews yet. Be the first to review this skill!
# Download SKILL.md from killerskills.ai/api/skills/codeigniter-4-task-management-app/raw