Skip to content

README.md

Latest commit

 

History

History
76 lines (61 loc) · 5.32 KB

README.md

File metadata and controls

76 lines (61 loc) · 5.32 KB
Raw

SWEXP Module 06 — Backend Engineering & API Design

Theme: Powering Project Forge — build the production backend that supports the frontend created in Module 05.

You are a Backend Software Engineer on the Platform Team. The Forge frontend runs against a mock at api.forge.dev; now you build the real service it depends on. Across 10 ticket-driven lessons you replace the mock with a real REST API, organize it into layers, validate the untrusted boundary, authenticate and authorize every request, harden the API into a platform (consistent errors, pagination, idempotency, rate limiting), move slow work to background jobs, make it operationally ready (health, logging, graceful shutdown), and ship it.

The ethos, in every lesson: the boundary is untrusted; layers with clear contracts; make illegal states unrepresentable; fail safe, not open; least privilege; and measure first, design for failure. AI is used as draft → verify (type-check + test/run + measure) → log.

How You Work Here

Step What it means
Pick up a ticket Each lesson is an engineering ticket (AUTH-3001, API-4001, …) with acceptance criteria
Build in layers Controller (HTTP) / service (logic) / repository (data), with clear contracts
Type-check tsc --noEmit against @types/node — broken contracts are compile errors
Test the logic Service rules, validators, policy, auth (real node:crypto), jobs, ops run in Node
Verify endpoints A real in-process HTTP server hit with fetch — status codes, idempotency, 401/403, 429, readiness
Verify AI Draft → verify (type-check + test/run + measure) → log

Learning Outcomes

By the end you will be able to:

  • Design resource-oriented REST APIs with honest status codes and typed contracts.
  • Structure a backend into controller / service / repository layers with logic testable without HTTP.
  • Validate every request at the boundary and reject bad input with structured errors.
  • Authenticate requests with salted/slow-hashed passwords and signed, expiring tokens, failing safe.
  • Authorize with role- and ownership-based rules under least privilege (403 vs 401).
  • Establish API platform standards: a consistent error envelope, pagination, idempotency, rate limiting.
  • Move slow work to a background queue with bounded retries, backoff, idempotency, and dead-lettering.
  • Make a service operationally ready: liveness/readiness, structured logs, env config, graceful shutdown.
  • Ship a coherent, strict-typed backend platform with evidence for each quality bar.

Lesson Index

# Lesson Competency Ticket
0 Welcome to the Backend Engineering Team Backend Orientation BE-1000
1 Replace the Mock API REST APIs & Controllers API-1010
2 Organize the Service Layer Layered Architecture ARCH-2001
3 Stop Invalid Requests at the Door Validation VAL-2010
4 Authenticate Every Request Authentication AUTH-3001
5 Stop Unauthorized Access Authorization AUTHZ-3010
6 Build a Reliable API Platform API Platform Standards API-4001
7 Move Work Off the Request Background Processing JOB-4010
8 Pass the Production Readiness Review Operational Readiness OPS-5001
9 Project Forge Platform Release Platform Release FORGE-9400

Phases: Foundations (0) → API Foundations (1–3) → Security (4–5) → Platform (6–7) → Quality & Production (8) → Capstone (9).

Repository Layout

.
├── README.md                      # this file
├── MODULE_SYLLABUS.md             # pacing, structure, deliverables
├── LEARNER_GUIDE.md               # how to operate as a backend engineer here
├── INSTRUCTOR_GUIDE.md            # facilitation and assessment
├── COMPETENCY_MATRIX.md           # lesson → competency → skills
├── ASSESSMENT_RUBRIC.md           # grading weights and performance levels
├── dashboard.html                 # interactive progress dashboard (open in a browser)
├── Lesson_00.md … Lesson_09.md    # the 10 lessons
├── labs/                          # hands-on labs (type-checked; logic + auth Node-tested; endpoints verified)
├── solutions/                     # worked solutions / answer keys
├── resources/                     # setup, REST, architecture, validation, auth, authz, platform, jobs, ops + more
├── assignments/                   # submission templates + capstone brief
└── instructor-notes/              # per-lesson facilitation notes

Getting Started

  1. Read resources/backend-setup-guide.md; set up the Node + TypeScript toolchain and the verify loop (Lesson 0 / labs/lab-00-setup.md).
  2. Start your engineering notebook from resources/engineering-notebook-template.md.
  3. Open dashboard.html in your browser to track progress through the lessons and phases.
  4. Open Lesson_00.md and pick up your first ticket. Keep the relevant resources/ references open as you build.

Verification. Type-check contracts with tsc --noEmit (+@types/node); run pure logic and auth with node file.mjs (real node:crypto); exercise endpoints with a real in-process HTTP server hit by fetch — no external services needed. Note tsc file.ts ignores tsconfig.json — use --noEmit or -p.