Project: the quote API, end to end

Build one real API from the pieces of this course: a store with parameters and transactions, a write endpoint that refuses bad input, a read endpoint that cannot leak another person's data, and a router that logs everything and leaks nothing.

By the end you can

Write a data layer where values can never become instructions and partial writes cannot happen
Handle a write request through every branch: unauthenticated, malformed, invalid, created
Return the right status for a resource that exists but is not yours
Assemble a router with one error boundary and one log line per request

Easier if you did first

Shipping it, and running it

0 of 4 done

step 1 of 4

The store

Start at the bottom, with the only code allowed to touch the database. Everything above it will trust what this returns, so this is where the two data rules live.

First: values are never joined into query text. The pretend database here parses its query exactly as a real one does, so a value that closes its own quote really does become instruction. Parameters make that impossible.

Second: a quote and its line items are one write. Either both land or neither does, because a quote with no lines is a record nobody can price and nobody will notice until a customer asks.

Write the three functions. Keep them boring: the data layer is the one place where clever is a liability.

What these words mean

data layer: The only code that talks to the database. Everything else goes through it.
parameter: A placeholder filled after the query is understood.
transaction: Several writes that succeed or fail together.
row: One record, returned as a plain object.

Easy to get wrong

Returning the database row straight to the caller
Returning what the caller needs
Rows gain columns over time, and a column added for internal use is then in your API response. Decide what leaves this layer on purpose.

What we check

A quote is found by its id
A missing id gives null, not undefined
An injection attempt is just a value that matches nothing
A good create adds exactly one quote
A bad line rolls the whole thing back
And the failure is rethrown, not swallowed
No transaction is left open
The lookup uses a placeholder
Failures roll back

script.jsjavascript

// A pretend database that parses its own query, like a real one.
const quoteRows = [
  { id: 1, ownerId: "u1", pages: 3, urgent: false, total: 1350 },
  { id: 2, ownerId: "u2", pages: 8, urgent: true, total: 4500 },
];
const lineRows = [];
let nextId = 3;

function query(sql, params = []) {
  const match = sql.match(/WHERE id = (.+)$/);
  if (!match) return quoteRows.map((row) => ({ ...row }));
  const token = match[1].trim();

// A placeholder is filled in after the query is understood.
  if (token === "?") {
    return quoteRows.filter((row) => String(row.id) === String(params[0])).map((r) => ({ ...r }));
  }
  // Joined into the text, so the database has to parse it. 1=1 is always true.
  if (/OR\s+'?1'?\s*=\s*'?1'?/i.test(token)) return quoteRows.map((row) => ({ ...row }));
  return quoteRows
    .filter((row) => String(row.id) === token.replace(/^'|'$/g, ""))
    .map((r) => ({ ...r }));
}

// 1. findQuote(id): the one row, or null. Use a parameter.
function findQuote(id) {
}

// 2. createQuote(record, lines): insert the quote and every line inside
//    one transaction. Return the new quote. On any failure, roll back and
//    rethrow, leaving nothing behind.
function createQuote(record, lines) {
}

// 3. countQuotes(): how many quotes exist. Used by the checks.
function countQuotes() {
}

console.log(findQuote(1).total, countQuotes());

console

Nothing printed yet. Run your code.

cd ../labs/node

Node.jsadvancedabout 90 minutes

Node.js course · Part 9: The project · lab 9 of 9