⚙️ Backend Dev

Testing an async workflow that spans DB and message queue

Assert the DB row, then verify the queue message via a test consumer or spy, polling with a timeout rather than fixed sleeps.

Testing code that calls a third-party API

Intercept at the HTTP boundary (nock) or run a local mock server; cover success, errors, timeouts, and assert request shape.

Managing clean test state across API integration tests

Compare seed-and-truncate, per-test transaction rollback, and in-memory or containerized databases, weighing fidelity, speed, and isolation.

Testing async Promise-returning code in Jest

Return or await the promise; use await expect(...).resolves/rejects, or await the value directly.

Mocking the database layer in Jest unit tests

A live DB makes tests slow, flaky, and order-dependent; use jest.mock on the model so methods return controlled fakes.

Integration testing a POST endpoint with Supertest

Pass the Express app to supertest, send a POST with a body, then assert status 201, the response shape, and the persisted side effect; also test validation failures.

Writing a basic Jest unit test

Import the function, group cases with describe, define each case with it or test, assert with expect and a matcher like toBe, covering normal and edge inputs.

Unit, integration, and E2E tests explained

Unit tests isolate one function with dependencies mocked, integration tests exercise several units together (route plus DB), E2E tests drive the whole running system.

Handling uncaughtException and unhandledRejection

Listen on process for uncaughtException and unhandledRejection, log the error, stop accepting new work, drain in-flight requests, then exit non-zero for a supervisor to restart.

Operational versus programmer errors in Node.js

Operational errors are expected runtime conditions you handle and respond to; programmer errors are bugs that may corrupt state, so you log and gracefully restart.

Custom Error classes and centralized handling

Custom Error subclasses carry a statusCode and flag, the central handler inspects instanceof or statusCode to set the HTTP code and JSON shape, defaulting unknown errors to 500.

Reusable schema validation middleware with Zod or Joi

Define a schema (email, password min 8, optional firstName), write a factory middleware that validates req.body, returns 400 with messages on failure, and assigns the parsed value on success.

Propagating async errors to Express error handlers

Express does not auto-catch rejected promises, so catch and call next(err), or wrap handlers in an asyncHandler that forwards rejections; Express 5 awaits handlers automatically.

Basic presence validation on a POST login route

Ensure the JSON body parser runs, destructure email and password from req.body, return 400 early if either is missing, then proceed.

JWT storage: localStorage versus httpOnly cookies

LocalStorage is readable by JS so XSS can steal the token but no CSRF; httpOnly cookies block XSS theft but are auto-sent, enabling CSRF unless mitigated.

Strategies for revoking stateless JWTs

Short-lived access tokens with refresh-token rotation, or a server-side denylist of revoked token ids, weighing statelessness against immediacy.

Role-based access control middleware in Express

Authenticate first to set req.user, then a parameterized role-check middleware that compares req.user.role and returns 403 if it fails, applied to protected routes.

Securing Express with Passport local strategy

Configure LocalStrategy with a verify callback, call passport.authenticate as route middleware, and set up serializeUser/deserializeUser for sessions.

Session-based versus token-based authentication

Sessions store server-side state with a cookie id, tokens carry self-contained claims with no server store, weigh revocation versus scalability, especially across services.