Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Build a small REST API (any Node framework): CRUD over Postgres, schema validation on every input, session or JWT auth, ownership checks on every object access, and an OpenAPI-ish endpoint table in the README. Containerized with compose (app + db).
Correct methods/status codes; consistent error envelope; pagination on lists.
Hashed credentials or OAuth; object-level ownership enforced (no IDOR).
Schema-validated input at every endpoint; unknown fields rejected; bounds everywhere.
Sane schema with constraints; migrations; no N+1 on list endpoints.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# REST API with auth and a real database ## Goal Build a small REST API (any Node framework): CRUD over Postgres, schema validation on every input, session or JWT auth, ownership checks on every object access, and an OpenAPI-ish endpoint table in the README. Containerized with compose (app + db). ## Acceptance criteria - [ ] API contract: Correct methods/status codes; consistent error envelope; pagination on lists. - [ ] Auth & access control: Hashed credentials or OAuth; object-level ownership enforced (no IDOR). - [ ] Validation: Schema-validated input at every endpoint; unknown fields rejected; bounds everywhere. - [ ] Data layer: Sane schema with constraints; migrations; no N+1 on list endpoints. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.