🤖 TaskForge AI

Intelligent serverless task management, powered by AWS and optional generative AI.

TaskForge AI is a focused productivity workspace for creating, organizing, prioritizing and completing work. The product stays deliberately task-first: AI is an assistive layer, not a chatbot bolted onto a task list.

What changed

This repository has been upgraded from a fragile CRUD prototype into a cohesive serverless product with:

• Premium responsive workspace UI with design tokens and reusable interaction patterns
• Task lifecycle: create, edit, complete/reopen, delete, status, priority, due date and description
• Search and server-side filtering
• Cognito authentication with protected API routes
• Backend ownership derived from the authenticated Cognito sub claim — browser-supplied user IDs are not trusted
• DynamoDB single-partition-per-user access pattern with bounded queries and pagination tokens
• Optional Amazon Bedrock Converse integration for task breakdown, summaries, rewrites and daily focus plans
• Explicit AI suggestion semantics; AI never silently mutates tasks
• Private S3 frontend origin protected by CloudFront Origin Access Control
• AWS SAM/CloudFormation infrastructure as the deployment source of truth
• Bash and PowerShell deployment/validation/cleanup scripts
• CI validation for Python, SAM, credential patterns and security invariants

Architecture

flowchart LR
    U[User] --> CF[CloudFront]
    CF --> S3[S3 Private Frontend]
    U --> C[Cognito User Pool]
    U --> API[API Gateway REST]
    C --> API
    API --> L[Lambda Task API]
    L --> D[DynamoDB]
    L --> B[Amazon Bedrock]
    L --> CW[CloudWatch Logs]

Loading

Request flow

sequenceDiagram
    participant U as User
    participant F as CloudFront/S3
    participant C as Cognito
    participant A as API Gateway
    participant L as Lambda
    participant D as DynamoDB

    U->>F: Open TaskForge
    U->>C: Sign in
    C-->>U: Cognito tokens
    U->>A: Authenticated task request
    A->>L: Validate authorizer context
    L->>D: Query USER#<sub>
    D-->>L: User-owned tasks
    L-->>A: JSON response
    A-->>U: Updated workspace

Loading

AI flow

flowchart TD
    U[User] --> UI[AI action]
    UI --> API[POST /ai]
    API --> L[Lambda]
    L --> B[Bedrock Converse]
    B --> R[Suggestion]
    R --> U
    U --> C[Optional user confirmation]

Loading

Data model

The DynamoDB table uses:

Key	Shape	Purpose
Partition key	USER#<Cognito sub>	Hard ownership boundary
Sort key	TASK#<uuid>	Task identity and ordered query access

Task attributes include title, description, status, priority, dueDate, tags, createdAt, and updatedAt.

The API uses Query, not table scans. Search and filters are applied to the bounded result page returned for the authenticated user's partition.

AWS services

• Amazon Cognito User Pools — authentication
• Amazon API Gateway REST — protected API surface
• AWS Lambda Python 3.13 — business logic
• Amazon DynamoDB — task persistence
• Amazon Bedrock — optional explicit AI actions
• Amazon S3 — private frontend storage
• Amazon CloudFront — HTTPS delivery and S3 origin protection
• Amazon CloudWatch Logs — operational logging
• AWS CloudFormation via AWS SAM — infrastructure as code

Repository structure

TaskForge-AI/
├── .github/workflows/quality.yml
├── cloudformation/template.yaml
├── docs/architecture.md
├── frontend/
│   ├── dashboard.html
│   ├── index.html
│   ├── login.html
│   ├── signup.html
│   ├── styles.css
│   └── js/
│       ├── api.js
│       ├── auth.js
│       ├── config.js
│       └── dashboard.js
├── lambda/task-api/lambda_function.py
├── scripts/
│   ├── deploy.sh
│   ├── deploy.ps1
│   ├── validate.sh
│   ├── validate.ps1
│   ├── destroy.sh
│   └── destroy.ps1
├── tests/test_lambda.py
├── SECURITY.md
├── CHANGELOG.md
└── README.md

Local development

The frontend is plain HTML/CSS/ES modules. The application expects a deployed API and Cognito user pool.

1. Install AWS CLI and AWS SAM CLI.
2. Configure AWS credentials with an identity allowed to deploy the stack.
3. Validate the infrastructure:

./scripts/validate.sh

4. Deploy everything:

./scripts/deploy.sh

On Windows PowerShell:

.\scripts\validate.ps1
.\scripts\deploy.ps1

The deployment script builds the SAM/CloudFormation application, deploys the AWS resources, reads stack outputs, generates a temporary frontend configuration, uploads the frontend to the private S3 bucket, and invalidates CloudFront.

Configuration

frontend/js/config.js intentionally contains placeholders. Do not commit live access tokens or credentials. Deployment scripts replace these placeholders in a temporary staging copy using CloudFormation outputs.

The default AI model is amazon.nova-lite-v1:0. Change it at deployment time with BedrockModelId if the target AWS account/Region has access to another supported model.

AI is optional. If Bedrock is unavailable or not configured, core task CRUD continues to work.

AI features

• Break down — convert a complex task into actionable steps
• Summarize — compress task context into a short execution summary
• Rewrite clearly — improve title/description wording
• Daily focus — recommend priorities across the current task set

AI calls are explicit and bounded. They have input-size limits and do not perform destructive mutations. The UI labels returned content as suggestions.

Security model

The API is protected by a Cognito user-pool authorizer. Lambda derives the owner from requestContext.authorizer.claims.sub; it does not accept a browser-provided userId for authorization. DynamoDB keys are constructed from that authenticated subject.

IAM is scoped to the TaskForge table and the configured Bedrock foundation model. The frontend bucket is private and CloudFront reads it through Origin Access Control.

See SECURITY.md for the security checklist and credential-handling policy.

Testing

Run:

python -m unittest discover -s tests -v
python -m py_compile lambda/task-api/lambda_function.py
sam validate --template-file cloudformation/template.yaml

CI runs these checks on pushes and pull requests targeting master.

Cost awareness

TaskForge uses serverless/on-demand services, but serverless does not mean free. DynamoDB reads/writes, Lambda invocations, API Gateway requests, CloudFront transfer, S3 storage/requests, Cognito usage and Bedrock inference can incur charges. Bedrock is especially usage-sensitive; keep AI actions explicit and bounded.

Cleanup

Use the safety-confirmed destroy script:

./scripts/destroy.sh

or:

.\scripts\destroy.ps1

Review the stack and AWS account before deletion. Production environments should use an explicit backup/retention strategy before destructive cleanup.

Roadmap

• richer task relationships and dependencies
• calendar-aware planning
• activity history
• organization/workspace collaboration
• stronger automated browser E2E coverage
• optional GitHub/OIDC deployment pipeline

Author

Ibad Shaikh — Ibad84671

License

MIT. See the repository license file when present.