Skip to content

README.md

Latest commit

 

History

History
118 lines (84 loc) · 4.78 KB

README.md

File metadata and controls

118 lines (84 loc) · 4.78 KB
Raw

todo-api-auth

Built by NOUMENON, an AI build engine. One prompt to a production-ready API. Follow the build: @noumenon.ai

What this is

A fully authenticated REST API for todo management: JWT auth, per-user data isolation, server-side input validation, parameterized SQL (injection-safe), secret hygiene, and a health endpoint.

Built from one prompt, then tested and gate-checked before shipping.

The prompt

NOUMENON: build a simple todo list API with auth. Node.js.
Show me the phases, run the tests, enforce the gates.

What NOUMENON produced

  • A working authenticated API
  • 40 tests, 40 passing
  • 7 security gates, all verified in code
  • A phased build with git checkpoints (b1 p1 through p4)
  • A broken security gate caught and fixed during the build
  • Scope drift flagged, disclosed, then removed to match the spec

Security gates (all passing)

Gate Status Evidence
Data isolation PASS Every todo query is WHERE user_id = ? bound to req.userId; all parameterized prepared statements
user_id server-derived PASS req.userId is set only from the jwt.verify() payload; a client-supplied value is never trusted
Auth rejection PASS Missing token returns 401; cross-user access returns 404; both tested
Input validation PASS src/validate.js, bounded and allow-listed, parameterized SQL only
Secret hygiene PASS .gitignore blocks .env*, *.db, and keys; nothing sensitive tracked; secrets fail fast on boot
Health and bind guard PASS /health requires no auth; loopback-only bind enforced in src/config.js
Data map PASS docs/DATA_MAP.md shipped

Test results

40/40 passing (Jest + supertest)

Coverage includes:
- Every endpoint happy path
- Bad-input and 404 error paths
- SQL injection stored as data, not executed
- No token -> 401
- Valid token, wrong user -> 404

One gate was broken; NOUMENON caught it

The secret-scan pre-commit hook hard-required ripgrep and ran the matcher inside an if condition. With set -e, a missing rg made the condition evaluate false, so the hook passed silently. A fail-open: it could never block a secret if ripgrep was absent.

The fix makes the scanner tool-agnostic: prefer rg, fall back to GNU grep -P, and exit non-zero if neither exists (fail closed). Verified with a real commit containing a planted AKIA... key, which is now rejected; a clean tree still passes.

Scope drift, flagged then removed

The engine added three things that were not in the original spec:

  • Idempotency-Key handling for POST /todos
  • express-rate-limit on the auth routes
  • a pino logging dependency

They were flagged to the operator rather than shipped silently. The operator chose to bring the build back to the bare spec, so the idempotency feature and the two extra dependencies were removed. Structured request logging was kept, because the spec called for observability, but it now uses a small built-in JSON logger with no third-party dependency. This is the reviewer-implementer loop completing: drift surfaced, decision made, build corrected.

Stack

  • Node.js and Express 5
  • better-sqlite3
  • jsonwebtoken (JWT)
  • bcrypt
  • built-in JSON structured logging (no logging dependency)
  • Jest and supertest

Run it

Requires Node.js >= 22.13.1.

npm install
npm run setup    # creates .env with a freshly generated JWT_SECRET
npm test         # 40/40
npm start        # binds to 127.0.0.1:3000 by default

npm run setup writes a local .env (gitignored) from .env.example with a secure random JWT_SECRET. It will not overwrite an existing .env. The server refuses to start with the placeholder secret by design.

The server binds to a loopback interface by default and refuses non-loopback hosts unless explicitly configured. If port 3000 is already in use on your machine, set a different PORT in .env (for example PORT=4010); the server prints a clear message instead of crashing.

Endpoints

Method Path Auth Description
POST /auth/register None Register a user
POST /auth/login None Log in, returns a JWT
GET /todos JWT List your todos
POST /todos JWT Create a todo
GET /todos/:id JWT Get one of your todos
PUT /todos/:id JWT Update your todo
DELETE /todos/:id JWT Delete your todo
GET /health None Health check

What NOUMENON is

NOUMENON is an AI build engine. You describe what you want; it architects it, writes it, tests it, enforces security gates, flags scope drift, and ships it.

Follow the build: @noumenon.ai

This repo is a proof of concept. Every gate is real and every test is real. Read the code and verify it yourself.