Web Engineering: architecture, security and team practice

Before this course: Full-Stack Basics: servers, databases and deployment (course 7.7.3). You should already have built and deployed "Study Notes": a Node.js JSON API with input checks and a body size limit, a SQLite database with prepared statements, scrypt password hashing, session cookies with HttpOnly and SameSite, ownership checks on every note, 9 automated tests, and settings in environment variables. Now you stop being the only developer. In this course you design, secure, test and run an app the way a professional team does, and you learn to teach those habits to others.

// Service layer: business rules only. No HTTP, no SQL.
// The repository (data layer) is passed in, so tests can use a fake one.
function createNotesService({ repo }) {
 function cleanText(text) {
  if (typeof text !== "string") return null;
  const t = text.trim();
  if (t.length < 1 || t.length > 2000) return null;
  return t;
 }
 return {
  list(userId) {
   return repo.findByOwner(userId);
  },
  create(userId, text) {
   const t = cleanText(text);
   if (!t) return { ok: false, error: "Note must be 1 to 2000 characters." };
   return { ok: true, note: repo.insert(userId, t) };
  },
  remove(userId, noteId) {
   // Ownership is checked here, once, for every caller.
   return repo.deleteOwned(userId, noteId) === 1;
  },
 };
}

// A tiny in-memory repository with the same methods as the SQL one.
function memoryRepo() {
 const rows = []; let nextId = 1;
 return {
  findByOwner: (u) => rows.filter((r) => r.userId === u),
  insert(u, text) { const r = { id: nextId++, userId: u, text }; rows.push(r); return r; },
  deleteOwned(u, id) {
   const i = rows.findIndex((r) => r.id === id && r.userId === u);
   if (i === -1) return 0;
   rows.splice(i, 1); return 1;
  },
 };
}

module.exports = { createNotesService, memoryRepo };

const test = require("node:test");
const assert = require("node:assert");
const { createNotesService, memoryRepo } = require("../src/notes-service");

test("creates a note for its owner", () => {
 const s = createNotesService({ repo: memoryRepo() });
 const r = s.create(1, " buy milk ");
 assert.strictEqual(r.ok, true);
 assert.strictEqual(r.note.text, "buy milk");
 assert.strictEqual(s.list(1).length, 1);
});

test("rejects empty and huge notes", () => {
 const s = createNotesService({ repo: memoryRepo() });
 assert.strictEqual(s.create(1, "  ").ok, false);
 assert.strictEqual(s.create(1, "x".repeat(2001)).ok, false);
 assert.strictEqual(s.create(1, 42).ok, false);
});

test("a user cannot delete someone else's note", () => {
 const s = createNotesService({ repo: memoryRepo() });
 const n = s.create(1, "mine").note;
 assert.strictEqual(s.remove(2, n.id), false);
 assert.strictEqual(s.list(1).length, 1);
 assert.strictEqual(s.remove(1, n.id), true);
 assert.strictEqual(s.list(1).length, 0);
});

Test result: all 3 tests passed. The HTTP layer from course 7.7.3 now only calls service.remove(user.id, id) and turns false into a 404. The ownership rule lives in one place.