1. Courses
  2. JavaScript in the Real World
  3. Capstone

Capstone project for JavaScript in the Real World

Harden the Mangrove store stock service

Mangrove Market wants a small stock service that store staff can trust during a festival rush. Build an API in TypeScript (NestJS, or Express if you prefer) with GET /stock/:siteId/:articleCode and POST /stock/receipts for goods received note (GRN) lines, plus a one-page browser screen where a store manager searches stock and records a delivery. Validate every request body with a schema shared between the API and the page, protect the POST with an API key, reject a GRN number the API has already seen with 409, allow CORS only for the page's origin, and put prices behind a bounded LRU cache. Pin Node and your dependencies so a teammate can clone the repo and run it with npm ci, then prove it all with tests, a short load run and a security review of your own code.

What you hand in

  1. A Git repository using npm workspaces with three packages (contracts, api, web), a committed lockfile, .nvmrc and engines
  2. Unit tests for the service and the cache, and end-to-end tests covering 201, 400, 401, 404 and 409
  3. A load script and its output showing cache entries capped and heapUsed flat after 40,000 requests with changing query parameters
  4. A one-page README: how to run it, each endpoint with its status codes, and the security checklist you applied

Check your work

Tick each item when your project meets it. Be strict: this is the rubric the reviewer uses.

  • npm ci followed by the start scripts works on a clean machine with the pinned Node version, with no manual steps
  • Bad bodies get a 400 that names every problem, unknown fields are rejected, and a wrong API key gets 401 before the body is checked
  • Request and response types come from one shared schema, and renaming a field breaks the build of both the API and the page
  • The page puts all data on screen as text, uses one delegated listener for row buttons, and shows loading, empty, error and offline states
  • CORS allows only the page's exact origin, and the preflight for the JSON POST succeeds
  • The price cache has a maximum size and a TTL, its key holds only site and article, and the load run shows flat memory
  • No secrets are committed: .env is ignored, .env.example lists every setting, and the API refuses to start when one is missing

0 of 7 checked

Model answer

The model answer opens once your capstone passes the review, so you can compare your work with an outline of a strong submission.

Hand in your capstone

Your links are checked automatically, then the work is scored against the rubric above, item by item, with comments. A pass counts toward the course certificate and shows on your profile.

Loading…