Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Build a Node service on MongoDB using the official driver (or Mongoose) with a single POOLED client (mongodb+srv:// or a local replica-set URI). Model for access patterns, then implement an operation that genuinely needs a MULTI-DOCUMENT transaction (e.g. place an order: decrement inventory AND insert the order atomically) using a session over a REPLICA SET, with an appropriate write concern — and explain why a single-document atomic update wasn't sufficient here. Apply security basics: authentication enabled, a least-privilege application user, and no unauthenticated exposure (Atlas IP allowlist or local auth).
One reused pooled client; schema modeled for access patterns; clean CRUD/aggregation from code.
A correct multi-document transaction (session, commit/abort) over a replica set with a sensible write concern; justifies why single-doc atomicity was insufficient.
Auth enabled + least-privilege user; never exposed unauthenticated; secrets/URI not hardcoded.
Handles transaction retry/abort paths; connection errors handled; no resource leaks.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A Node app on MongoDB with a transaction over a replica set ## Goal Build a Node service on MongoDB using the official driver (or Mongoose) with a single POOLED client (mongodb+srv:// or a local replica-set URI). Model for access patterns, then implement an operation that genuinely needs a MULTI-DOCUMENT transaction (e.g. place an order: decrement inventory AND insert the order atomically) using a session over a REPLICA SET, with an appropriate write concern — and explain why a single-document atomic update wasn't sufficient here. Apply security basics: authentication enabled, a least-privilege application user, and no unauthenticated exposure (Atlas IP allowlist or local auth). ## Acceptance criteria - [ ] Driver & modeling: One reused pooled client; schema modeled for access patterns; clean CRUD/aggregation from code. - [ ] Transaction & replica set: A correct multi-document transaction (session, commit/abort) over a replica set with a sensible write concern; justifies why single-doc atomicity was insufficient. - [ ] Security: Auth enabled + least-privilege user; never exposed unauthenticated; secrets/URI not hardcoded. - [ ] Robustness: Handles transaction retry/abort paths; connection errors handled; no resource leaks. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.