Full-Stack Questions cheat sheet

• Cascade: importance and layers, then specificity (IDs, classes, types), then order. Unlayered CSS beats layers.
• :where() scores zero; :is() takes its strongest argument. border-box makes width include padding and border.
• Flex item overflows: min-width: 0. Margin collapse is vertical only; display: flow-root stops it.

Watch out: z-index only works inside a stacking context, and opacity or transform on a parent traps it. Sticky fails under overflow: hidden.

• Tailwind reads files as plain text: write full class names. bg-${color}-500 is never generated.
• cn() = clsx (join, skip falsy) + twMerge (last conflicting class wins). cva builds variant props.
• @theme inline when a token points at another variable. hover: only fires on hover-capable devices.

noUncheckedIndexedAccess

arr[0] is T | undefined

exactOptionalPropertyTypes

x?: T means missing, not undefined

verbatimModuleSyntax

Needs import type (error TS1484)

erasableSyntaxOnly

No enum or parameter properties

Tip: unknown = check before use, any = skip checks, never = impossible. Prefer an as const object plus union over enum.

useEffect(() => setX(f(y)), [y])

Derived state: compute during render

fetch in effect, no cleanup

Race: AbortController or a data library

Context value `{{ a, b }}` inline

New object every render: memoize or split

`key={i}` on a changing list

State moves to the wrong row: stable id

`{n && <A/>}` with `n = 0`

Renders 0: use n > 0 &&

`items.sort()` on state

Mutates: [...items].sort() or toSorted()

Watch out: useFormStatus only sees a parent form element. Actions reset uncontrolled fields: return the submitted values.

• Server Components by default. A Client Component also runs on the server when prerendering.
• params, searchParams, cookies() are Promises: await them. middleware.ts is now proxy.ts (Node runtime).
• Turbopack is the default. Caching is opt-in with use cache; fetch is not cached by default.

export async function getProducts() {
  "use cache";
  cacheLife("hours");
  cacheTag("products");
  return db.product.findMany();
}

Watch out: A Server Action is a public POST. Authenticate, validate, and authorize inside it. NEXT_PUBLIC_ values are frozen at build.

• Order: sync code, nextTick, promises, timers, I/O, setImmediate. In ES modules, promises run before nextTick.
• The libuv pool has 4 threads by default (fs, dns.lookup, zlib, some crypto). Network I/O does not use it.
• Respect write() returning false, or use pipeline().

• One document is always atomic. Limit is 16 MiB, so unbounded arrays are the top anti-pattern.
• Compound index order: Equality, Sort, Range. TTL index needs a date; it runs about every 60 s.
• Only one text index per collection. Multikey: at most one array field per compound index.
• ObjectId is 12 bytes (time, random, counter). Never compare it with a plain string.

Tip: Use w: "majority" for important writes. Transactions are for multi-document work, not one order with embedded items.

• In v7, migrate dev no longer runs generate or seed. The URL lives in prisma.config.ts.
• Sequential $transaction([...]) vs interactive async (tx): only the second can use earlier results.
• include runs 2 queries by default; relationJoins makes it 1.
• Use tagged $queryRaw. $queryRawUnsafe with joined strings is an injection hole.

Watch out: SQL traps: NOT IN with NULL, LEFT JOIN plus WHERE, join fan-out, window frames. Set a pool timeout.

• Hasura compiles GraphQL to one SQL statement, so DB relations avoid N+1. Index your columns.
• Permissions per role, table and operation use session variables (JWT claims or webhook).
• Event triggers are at least once; retries are off by default. Make handlers idempotent.
• Plain GraphQL: per-request DataLoader, ! bubbles to the nearest nullable parent, cursors beat offset on deep pages.

Watch out: Community Edition (v2) has no API limits, @cached or per-role introspection control.

Workflow

Code decides the path (chain, route, parallel, evaluator)

Agent

Model uses tools in a loop with a stop rule

MCP tools

Model calls them (get_order)

MCP resources

App reads them (URI)

MCP prompts

User picks them (slash command)

Tip: Prompt first, RAG for your changing data, fine-tune for style. Measure recall@k, MRR, faithfulness. AI SDK: set stopWhen or the loop stops after one step.

Hash

A session or user's fields

Sorted set

Leaderboard, delayed jobs, rate window

Stream

Reliable queue with consumer groups

HyperLogLog

Approximate unique count

• Stampede: single-flight, SET k v NX PX, early refresh, or serve stale. Always a TTL with jitter.
• RDB = snapshot; AOF = log (everysec loses about 1 s). Neither is a backup.
• Default eviction is noeviction. Caches want allkeys-lru or allkeys-lfu.

• Build at-least-once plus idempotent handlers. Retries: attempts, backoff with jitter, dead-letter queue.
• Outbox: event row and business row in one transaction, then a relay publishes.
• Webhooks: raw body, HMAC with constant-time compare, timestamp check, fast 2xx, dedupe by event id.

`state`

Stops login CSRF

PKCE verifier

Stops code theft

`nonce`

Stops ID token replay

• OAuth = what may this app do; OIDC = who is this user. Use code flow with PKCE; no implicit or password grant.
• Database sessions revoke at once. JWT sessions cannot before expiry.
• Link accounts only on a verified email. Passkeys are phishing-resistant; TOTP is phishable.

Watch out: proxy.ts is an optimistic check only. Check again in the data layer, every action, and inside the query.

getBy...

Throws if missing: must be there

queryBy...

Returns null: assert it is absent

findBy...

Waits: it appears soon

• Vitest globals are off; vi.mock is hoisted (vi.hoisted). MSW fakes the network, not fetch.
• Playwright: use retrying expect, never waitForTimeout. Test the DB with the real engine.
• Coverage shows untested code, not tested behaviour.

• Dockerfile: multi-stage, copy the lockfile first, npm ci, .dockerignore, non-root USER, start node directly.
• Migrations: expand then contract. Never drop or rename in the same release.
• Logs say what, metrics say that something is wrong, traces say where.