starkey/notesvault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add assumptions, tradeoffs and future improvements section

Browse Source
This commit is contained in:
Sean Starkey
2026-06-02 10:50:48 -06:00
parent ff70912e31
commit 2d98b76da1
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
README.md
View File

@@ -71,6 +71,16 @@ JWT_SECRET=dev-secret-change-me-do-not-use-in-production mvn spring-boot:run
- The API returns `404 Not Found` for another user's unshared note so callers cannot distinguish between a missing note and a note they are not allowed to see. - The API returns `404 Not Found` for another user's unshared note so callers cannot distinguish between a missing note and a note they are not allowed to see.
- Production deployments should run behind HTTPS, avoid logging credentials or tokens, and consider token expiration, rotation, revocation, rate limiting, and audit logging. - Production deployments should run behind HTTPS, avoid logging credentials or tokens, and consider token expiration, rotation, revocation, rate limiting, and audit logging.
## Assumptions, tradeoffs, and future improvements
- Usernames are treated as unique login identifiers. Email verification, password reset flows, and account recovery are outside the scope of this challenge.
- Note sharing is user-to-user and read-only. The implementation does not include groups, roles, expiring shares, or write permissions for shared users.
- H2 is used for fast local development and tests, while PostgreSQL is available through Docker Compose for a more production-like relational database.
- JWT authentication keeps the API stateless, but this implementation does not include refresh tokens, token revocation, or a logout mechanism.
- The API currently returns all visible notes from `GET /notes`. Pagination, sorting, filtering, and search would be important as the dataset grows.
- Additional production-grade coverage would include update/delete/share mutation tests, PostgreSQL integration tests, and coverage reporting.
- Future improvements could include OpenAPI documentation, audit logging, rate limiting, structured request logging, health checks, metrics, and CI/CD automation.
## Testing ## Testing
The automated tests run with Spring Boot, MockMvc, Spring Security, JPA, validation, and Flyway-backed H2 enabled. This keeps the tests close to real API behavior while still making them fast enough to run locally. The automated tests run with Spring Boot, MockMvc, Spring Security, JPA, validation, and Flyway-backed H2 enabled. This keeps the tests close to real API behavior while still making them fast enough to run locally.