More in Node.js & Express — page 7
The three states of a JavaScript Promise
WHAT IT TESTS: fundamentals of Promise lifecycle. OUTLINE: pending, fulfilled, rejected; settle is one-way and final; create with the executor calling resolve or reject, consume with then and catch.
Monorepo workspaces vs private npm packages
WHAT IT TESTS: tradeoffs of code-sharing strategies. OUTLINE: workspaces give atomic cross-service changes and instant local linking but couple release cadence; private packages give versioned isolation but add publish overhead and version drift.
Diamond dependencies and nested node_modules
WHAT IT TESTS: understanding npm's nested install layout. OUTLINE: npm hoists one version to the top and nests the conflicting version under the dependent package; both coexist on disk.
Circular dependencies in CommonJS modules
WHAT IT TESTS: deep understanding of CommonJS loading. OUTLINE: when A requires B which requires A, the cache returns A's partial exports; fields defined later are undefined at that moment.
SemVer and the caret vs tilde range operators
WHAT IT TESTS: understanding version ranges. OUTLINE: MAJOR.MINOR.PATCH signals breaking/feature/fix; caret allows minor and patch updates, tilde allows only patch; use tilde for tighter control.
Layered structure for a scalable Express API
WHAT IT TESTS: separation of concerns and testability. OUTLINE: routes map URLs, controllers handle HTTP, services hold business logic, data layer talks to the DB; keep each layer ignorant of HTTP except controllers.
Choosing between CommonJS and ES Modules
WHAT IT TESTS: knowing the two module systems and their config. OUTLINE: ESM is the standard with static import/export and top-level await; set type to module; CJS uses require and module.exports and is synchronous.
Why package-lock.json must be committed
WHAT IT TESTS: understanding reproducible installs. OUTLINE: lockfile pins exact versions of the whole dependency tree including transitive deps; guarantees identical installs across machines and CI.
Resolving core vs relative module specifiers
WHAT IT TESTS: knowledge of module resolution rules. OUTLINE: 'fs' is a built-in core module loaded by name with top priority; './my-file.js' is a relative path resolved from the current file.
dependencies vs devDependencies in package.json
WHAT IT TESTS: understanding runtime versus build/test tooling. OUTLINE: dependencies ship and run in production; devDependencies are only for development; omitted with npm install --production.
Offloading CPU-bound work with Worker Threads
WHAT IT TESTS: knowing the single thread blocks on CPU work. OUTLINE: synchronous CPU work freezes the loop and all requests; offload to a Worker, communicate via messages or SharedArrayBuffer, use a pool. RED FLAG: suggesting async I/O fixes CPU blocking.
nextTick vs setImmediate vs setTimeout(fn, 0)
WHAT IT TESTS: precise ordering of deferral mechanisms. OUTLINE: nextTick is a microtask that drains before the loop continues; setImmediate runs in check; setTimeout(0) in timers.
Order of the Node.js event loop phases
WHAT IT TESTS: understanding of libuv's loop, not just async vibes. OUTLINE: timers, pending callbacks, poll, check, close phases in order; I/O completion runs in poll. RED FLAG: claiming Node is single-phase or fully multithreaded.
The WebSocket Protocol
WebSocket (RFC 6455) is a protocol providing full-duplex, persistent communication over a single TCP connection. It begins as an HTTP request that upgrades, then both client and server can send messages anytime, enabling real-time apps without HTTP's…
How does Node.js handle thousands of connections on one thread?
This tests non-blocking I/O: Node.js runs one thread for an event loop while the OS handles sockets via epoll or IOCP, resuming callbacks when data arrives. Mention the thread pool for DNS and fs work. A red flag is claiming threads spawn per request.
express-validator: Validate at the Edge
express-validator stops garbage before it hits your logic. Use it on any route that accepts user input like form data, query strings, or JSON payloads. The biggest mistake is validating but forgetting to check validationResult, so invalid requests pass.
Operational vs Programmer Errors in Node
Operational errors are expected problems like a failed network request; programmer errors are bugs like reading undefined. Handle the first gracefully, crash the second. The footgun is catching programmer errors and continuing, which corrupts process state.
Validation Checks Rules; Sanitization Cleans Input
Validation checks if input fits your rules and rejects failures. Sanitization cleans allowed input so it cannot cause harm. Validate at the boundary to enforce shape, then sanitize before rendering. Never swap them; scrubbing a bad date does not make it valid.
Bcrypt: Hash Passwords with Salt and Slowness
Bcrypt salts and slows every password hash so identical passwords never look the same and brute force stays expensive. Use it in register and login routes before the database. Never compare hashes with plain string equality; always call bcrypt.compare().
MongoDB Aggregation Pipeline: Server-Side Assembly Line
MongoDB's aggregation pipeline reshapes documents stage by stage on the server. Use it for reports, joins, or analytics without pulling whole collections into your app. Running $sort or $group before $match scans excess documents and kills performance.