1
showcase
Shipped: A service somebody else could run
Deployed an accounts-backed habit tracker (Node.js, built-in http and node:sqlite, no external dependencies) at https://habit-tracker-1u6z.onrender.com, repo at https://github.com/mohammedoomatia-max/habit-tracker. Users sign up/log in and get a bearer token; every /habits... route requires Authorization: Bearer <token> and returns 401 with a named field if it's missing or invalid. Ownership is enforced by scoping every habit lookup to WHERE id = ? AND user_id = ? — a habit that exists but belongs to someone else returns 404, identical to a habit that doesn't exist, so IDs can't be enumerated by watching for 403 vs 404; test/acceptance.test.js proves this with a real two-account test. The retry-safe write path is check-ins: POST /habits/:id/checkins is keyed on (habit_id, date) with a UNIQUE constraint as the backstop, so the same check-in sent twice returns the existing row (200) instead of creating a duplicate — reasoning is in the README. All 400 errors return {error, field} naming exactly what was wrong. No secret is committed: password hashing reads a pepper from PASSWORD_PEPPER, set as an environment variable on Render, with only a placeholder in the committed .env.example. Run node test/acceptance.test.js to verify the first four reviewer checks automatically (18/18 passing)
Repository: https://github.com/mohammedoomatia-max/habit-tracker
Built for the Verified Backend Internship · Final project
Add a comment
0/2000