Reference · 43 terms
Glossary
Every short form used across the series. Inside a lesson, hover or tap any dotted term to see the same entry in place.
Design
- controllerController
- The layer between HTTP and your logic. It reads the request, calls one service function and builds the response.Lesson 1 →
- dependency injectionDependency injection
- Give a function the things it needs (a repository, a clock) from outside. Do not let it import or create them itself.Lesson 0 →
- DRYDon't Repeat Yourself
- Keep one place for each piece of knowledge. It is about shared rules, not about code that only looks the same.Lesson 0 →
- DTOData Transfer Object
- A plain object that sets the shape of data that crosses a border, like a request body or response. It is separate from the database model.Lesson 3 →
- repositoryRepository
- The layer that owns data access. Only it knows about the ORM or the SQL.Lesson 1 →
- SOLIDSOLID principles
- Five design rules: single responsibility, open/closed, Liskov substitution, interface segregation and dependency inversion.Lesson 0 →
API
- DataLoaderDataLoader
- A tool that collects lookups made in the same moment and runs them as one query. Make one per request.Lesson 8 →
- GraphQLGraphQL
- An API style with one endpoint. The client asks for exactly the fields it wants. A typed schema describes the data.Lesson 9 →
- HasuraHasura
- A server that makes a GraphQL API from a Postgres database. It has role-based row permissions and turns nested queries into one SQL statement.Lesson 9 →
- idempotency keyIdempotency key
- A unique value the client sends with a POST. If the request is sent again, the server sees the key and returns the first result. It does not repeat the work.Lesson 2 →
- mass assignmentMass assignment
- A bug where a client sets fields it should not (like isAdmin) because the server saves the whole request body into the database.Lesson 3 →
- OpenAPIOpenAPI Specification
- A file that describes a REST API so machines can read it. It is used for docs, generated types and checks for breaking changes.Lesson 2 →
- persisted queriesPersisted queries
- GraphQL queries saved on the server in advance. The client sends only a hash. This makes them cacheable and lets the server allow only known queries.Lesson 9 →
- problem detailsProblem Details for HTTP APIs
- A standard JSON error format with type, title, status and detail. It is sent as application/problem+json.Lesson 2 →
- RESTRepresentational State Transfer
- An API style built on resources (nouns) with URLs. You use HTTP methods and status codes to work with them.Lesson 2 →
Errors and operations
- correlation IDCorrelation ID
- A unique ID for each request. It goes on every log line and every call to other services, so you can follow one request from start to end.Lesson 5 →
- graceful shutdownGraceful shutdown
- When the process gets SIGTERM: stop taking new connections, finish the running requests, close the database, then exit.Lesson 4 →
- OpenTelemetryOpenTelemetry
- A standard toolkit to create traces, metrics and logs and send them to the tool you choose.Lesson 5 →
- operational errorOperational error
- An expected failure in a correct program, like bad input, a missing record or a timeout. Handle it and report it.Lesson 4 →
- programmer errorProgrammer error
- A bug in the code, like reading a property of null. Log it with the stack trace and restart. Do not carry on in an unknown state.Lesson 4 →
- REDRate, Errors, Duration
- Three numbers to watch for every service: how many requests, how many fail, and how long they take (as percentiles).Lesson 5 →
- structured loggingStructured logging
- Writing each log event as a JSON object with fields (requestId, userId, durationMs). Tools can then search and count the logs.Lesson 5 →
Security
- ABACAttribute-Based Access Control
- Access rules use facts about the user, the resource and the situation. This allows finer rules than roles.Lesson 6 →
- Argon2idArgon2id
- The recommended way to hash passwords. It is slow and uses much memory on purpose, and it adds a salt (random extra data) by itself.Lesson 6 →
- BOLABroken Object Level Authorization
- OWASP's name for IDOR in APIs. The endpoint checks who the caller is, but not whether the caller may use that specific object.Lesson 6 →
- IDORInsecure Direct Object Reference
- Someone changes an ID in a URL and sees another person's data, because the server never checked who owns it. Also called BOLA.Lesson 6 →
- RBACRole-Based Access Control
- Permissions go to roles (like admin or editor). Users are given roles.Lesson 6 →
- session fixationSession fixation
- An attacker sets a known session ID before the user logs in. Stop it by creating a new ID at login.Lesson 6 →
Database
- ACIDAtomicity, Consistency, Isolation, Durability
- Four promises of a database transaction: all or nothing, always valid, separate from other transactions, and safe after a crash.Lesson 7 →
- B-treeB-tree index
- The default database index. Values are kept sorted in a tree, so finding a value, a range or a sort order is fast.Lesson 7 →
- connection poolConnection pool
- A fixed set of database connections that requests share and reuse. Opening a new connection costs a lot.Lesson 8 →
- EXPLAIN ANALYZEEXPLAIN ANALYZE
- A PostgreSQL command. It runs a query and shows the plan it used, with real times and row counts.Lesson 7 →
- isolation levelTransaction isolation level
- How much one running transaction can see of another. The levels are Read Committed, Repeatable Read and Serializable.Lesson 7 →
- N+1N+1 query problem
- One query for a list, then one more query for each row. With 100 users you make 101 queries. Fix it with eager loading or batching.Lesson 8 →
- PgBouncerPgBouncer
- A light tool that pools PostgreSQL connections. Many app copies connect to it, and it shares a few real connections between them.Lesson 8 →
- write skewWrite skew
- Two transactions read the same data and then write different rows. Together they break a rule that neither broke alone. Only Serializable prevents it.Lesson 7 →
Node
- backpressureBackpressure
- A slow reader tells the sender to pause, so data does not pile up in memory. Node streams do this for you.Lesson 10 →
- event loopEvent loop
- Node's single thread that runs JavaScript callbacks one at a time. If you block it, every request waits.Lesson 10 →
- ReDoSRegular-expression Denial of Service
- A regular expression that can take forever on some input (catastrophic backtracking). A small bad input can freeze the process.Lesson 10 →
- worker_threadsWorker threads
- Extra threads inside one Node process for heavy CPU work. The main event loop stays free.Lesson 10 →
Testing
- contract testContract test
- A test that checks the shape of requests and responses between two systems. A rename then cannot break the other side without a warning.Lesson 11 →
- SupertestSupertest
- A library that calls your Express app through HTTP in tests, without opening a real port.Lesson 11 →
- TestcontainersTestcontainers
- A library that starts a temporary Docker container (like Postgres) from your test code.Lesson 11 →