In one week you learned many separate things - REST design, structure, middleware, validation, JWT, refresh tokens, roles. Learning them separately is easy, but the real skill is weaving them all into one project. Today is for exactly that - not learning something new, but bringing all the old pieces into one line.
Today's work - one complete small API
Build a small API from scratch, where every concept from this week gets used. A users-based API is enough - signup, login, refresh, logout, viewing your own profile, a list of all users for admins. Follow this checklist:
- Structure: routes, controllers, services, middlewares in separate folders
- The same format and correct status codes in every response
- Zod validation on every write endpoint
- Passwords hashed with bcrypt, access tokens of 15 minutes
- Refresh token rotation + httpOnly cookie + cancellation on logout
- At least one admin-only route, with role middleware
- A global error handler at the very end - so no error crashes things strangely
When you finish building, ask yourself these questions: did any route miss validation? Does every error return the same format? Can you enter a protected route without a token? If the answers are 'no, yes, no', week 1 is a success.
One suggestion - do not delete this project. In week 2 the deep database work will happen here, in week 3 cache and queue will be added here. This is your learning notebook.
The mistake everyone makes
Trying to pick up a new topic on revision day. Today is for finding your weak spots - whichever concept you get stuck explaining out loud, that is the real gap. Interviews catch you exactly there.
Today's practice
Finish building the full API following the checklist above. Then turn on your camera or voice recorder and answer this week's three interview questions out loud - JWT vs session, why refresh tokens are needed, why middleware order matters. If you get stuck, read that chapter once more.
How to say it in an interview
Test yourself: 'This is how I arrange the full auth flow - Zod validation at the door, passwords hashed with bcrypt, short-lived access tokens, refresh tokens with rotation in httpOnly cookies, and role checks in middleware. Every decision has a security reason behind it.'