From 2d98b76da133fd6cd44e83a1ac7cc1e80e1ead84 Mon Sep 17 00:00:00 2001 From: Sean Starkey Date: Tue, 2 Jun 2026 10:50:48 -0600 Subject: [PATCH] Add assumptions, tradeoffs and future improvements section --- README.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/README.md b/README.md index eb051bd..135b542 100644 --- a/README.md +++ b/README.md @@ -71,6 +71,16 @@ JWT_SECRET=dev-secret-change-me-do-not-use-in-production mvn spring-boot:run - The API returns `404 Not Found` for another user's unshared note so callers cannot distinguish between a missing note and a note they are not allowed to see. - Production deployments should run behind HTTPS, avoid logging credentials or tokens, and consider token expiration, rotation, revocation, rate limiting, and audit logging. +## Assumptions, tradeoffs, and future improvements + +- Usernames are treated as unique login identifiers. Email verification, password reset flows, and account recovery are outside the scope of this challenge. +- Note sharing is user-to-user and read-only. The implementation does not include groups, roles, expiring shares, or write permissions for shared users. +- H2 is used for fast local development and tests, while PostgreSQL is available through Docker Compose for a more production-like relational database. +- JWT authentication keeps the API stateless, but this implementation does not include refresh tokens, token revocation, or a logout mechanism. +- The API currently returns all visible notes from `GET /notes`. Pagination, sorting, filtering, and search would be important as the dataset grows. +- Additional production-grade coverage would include update/delete/share mutation tests, PostgreSQL integration tests, and coverage reporting. +- Future improvements could include OpenAPI documentation, audit logging, rate limiting, structured request logging, health checks, metrics, and CI/CD automation. + ## Testing The automated tests run with Spring Boot, MockMvc, Spring Security, JPA, validation, and Flyway-backed H2 enabled. This keeps the tests close to real API behavior while still making them fast enough to run locally.