0
showcase
Shipped: A service somebody else could run
A reading-list API with JWT-based accounts. Unauthenticated requests
to /books return 401. Every book query is scoped to the caller's
user_id, and GET/DELETE on another user's book returns the same 404
as a nonexistent id -- so ownership can't be probed for. This is
proven with node test-isolation.js, which registers two users, has
user A create a book, and shows user B getting 404 on it while user
A still gets 200.
POST /books accepts an optional Idempotency-Key header: retrying the
same key returns the original book instead of creating a second row
-- node test-idempotency.js demonstrates this with real output (same
id returned twice, list shows exactly one row). All 400 errors name
the specific field that was wrong. No secret is committed --
JWT_SECRET is read from an environment variable, with only a
.env.example checked in.
Reviewer steps: npm install, cp .env.example .env (set JWT_SECRET),
npm start, then run the two test scripts above in another terminal.
Repository: https://github.com/GhulamMustafaAnsari/reading-list-service
Live: https://reading-list-service.bonto.run/health
Built for the Verified Backend Internship · Final project
Add a comment
0/2000