Lab · Full-Stack Development
Lab: the backend of the Notes app
The brief
Build the backend half of the Notes app: the migration that creates the notes table with its rules and index, the query behind the "my notes" screen, and the create and update handlers with validation, the standard error shape and owner checks.
Why it matters
Every full-stack feature is a vertical slice like this one: a table, a query and a couple of route handlers that follow the API contract. Getting the owner check right is the difference between a working app and a data leak, and it is the first thing a code reviewer looks for.
Skills you practise
- CREATE TABLE with constraints and defaults
- an index for the main query
- ORDER BY two columns
- validation with field errors
- 201, 400, 401 and 404
- owner checks on every record
What you will have at the end
db.sql (migration, seed and main query) and notes.js (create and update handlers with validation and owner checks).
How it is marked (rubric, 100 points)
| Correct resultsEvery check passes. | 45 |
|---|---|
| SecureThe owner always comes from req.user; other people's notes give 404; only allowed fields can change. | 25 |
| Follows the contractStatus codes and the { error: { code, message, fields } } shape match the API contract. | 20 |
| Can explainYou can explain why the index has two columns and why 404 is safer than 403 here. | 10 |
0/4 steps done
Step 1 of 4
The migration
db.sql creates notes (id, user_id, title, body, pinned, created_at, updated_at) with every column but id NOT NULL, a foreign key to users, and an index idx_notes_user_updated on (user_id, updated_at).
A migration is a numbered SQL file that changes the database one step at a time; every developer and every server runs the same files in the same order. Put the rules in it: a title of 1 to 120 characters, body defaulting to '', pinned only 0 or 1.
The main screen asks "this user's notes, newest first" thousands of times a day. An index on (user_id, updated_at) lets the database jump straight to one user's notes instead of reading the whole table.
Run shows what your code prints. Check runs the step's tests. Ctrl+Enter checks too.