Internal Project Management Tool

Overview

An internal project-management tool (Horizon) used to coordinate cross-team work across the Mike Sport group. It started lightweight and security-hardened, and has grown into a full work-management app: portfolios, task dependencies and subtasks, real-time notifications, Asana sync, a theme system, and a native desktop wrapper, all verified by Playwright tests. Live at horizon.mikesport.tech.

Problem

The team needed a single source of truth for project status across multiple tracks (e-commerce, marketing, operations) without paying for an enterprise SaaS that nobody would adopt.

Approach

Build it small. Express on the backend with strong security defaults (JWT, rate limiting, helmet headers, bcrypt) and a clean route surface. Smoke-test the critical flows in Playwright so refactors don't silently break the team's daily tool.

Architecture

• Backend: Node.js + Express 4.22 with JWT-based auth, on better-sqlite3 with WAL journaling for crash-safe durability.
• Security middleware: helmet for CSP and headers, express-rate-limit for brute-force and abuse, bcryptjs for passwords, HTTPS redirect in prod.
• Notifications: in-app plus email (SMTP) via an SSE stream, with @mention, dependency, and daily-digest events.
• Desktop: an Electron 33 wrapper (MikeSport Horizon) with auto-updater, GitHub-releases distribution, and OS notifications.
• Tests: Playwright (67 tests across auth, tasks, portfolios, notifications, and modals), run on every deploy.
• Deploy: Railway (nixpacks) with GitHub Actions CI/CD.

Tech stack

• Backend: Node.js, Express 4.22, JWT, bcryptjs, better-sqlite3 (WAL)
• Security: Helmet, express-rate-limit
• Notifications: SSE, nodemailer (SMTP)
• Desktop: Electron 33, electron-builder, auto-updater
• Testing: Playwright 1.58.2 (67 tests)
• Deploy: Railway, GitHub Actions

Engineering highlights

• Security-first defaults: helmet, rate limiting, JWT, bcrypt all wired by default, not retrofitted. Strict CSP and HTTPS redirect in prod.
• Durability: switched from sql.js to better-sqlite3 with WAL journaling to fix "disk image is malformed" crashes on hard process kills.
• Zero-downtime deploys: build-ID polling in the frontend detects a server restart and auto-refreshes within seconds, no manual reload.
• Playwright coverage: 67 tests guard the critical flows and have caught real bugs (modal overflow, invite-accept screen) before prod.
• Portfolios: cross-team project grouping with stats roll-up, drag-to-reorder, and team or workspace scoping.

Recent feature wave (2026)

• Light / dark / auto themes: full token-driven palette remap with no flash on load and theme-aware charts.
• Task notifications: @mention, dependency-unblocked, and completion events with an activity timeline, comment edit/delete, emoji reactions, and per-project mute. Delivered in-app, over email, and as a daily digest.
• Task dependencies and subtasks: cycle-guarded dependencies, subtask roll-up, bulk actions, and per-project custom fields.
• Invite-by-link: admins generate a URL, the invitee sets their own password, with a desktop-app download link included.
• Asana sync: bidirectional task and project import with soft-delete support.

Outcome

In active use across the team and live at horizon.mikesport.tech, with a desktop app shipping to GitHub releases. Never had a security incident; never had a Playwright-breaking regression ship to prod.