Add assumptions, tradeoffs and future improvements section

README.md

@@ -71,6 +71,16 @@ JWT_SECRET=dev-secret-change-me-do-not-use-in-production mvn spring-boot:run
 - The API returns `404 Not Found` for another user's unshared note so callers cannot distinguish between a missing note and a note they are not allowed to see.
 - Production deployments should run behind HTTPS, avoid logging credentials or tokens, and consider token expiration, rotation, revocation, rate limiting, and audit logging.
 
+## Assumptions, tradeoffs, and future improvements
+
+- Usernames are treated as unique login identifiers. Email verification, password reset flows, and account recovery are outside the scope of this challenge.
+- Note sharing is user-to-user and read-only. The implementation does not include groups, roles, expiring shares, or write permissions for shared users.
+- H2 is used for fast local development and tests, while PostgreSQL is available through Docker Compose for a more production-like relational database.
+- JWT authentication keeps the API stateless, but this implementation does not include refresh tokens, token revocation, or a logout mechanism.
+- The API currently returns all visible notes from `GET /notes`. Pagination, sorting, filtering, and search would be important as the dataset grows.
+- Additional production-grade coverage would include update/delete/share mutation tests, PostgreSQL integration tests, and coverage reporting.
+- Future improvements could include OpenAPI documentation, audit logging, rate limiting, structured request logging, health checks, metrics, and CI/CD automation.
+
 ## Testing
 
 The automated tests run with Spring Boot, MockMvc, Spring Security, JPA, validation, and Flyway-backed H2 enabled. This keeps the tests close to real API behavior while still making them fast enough to run locally.