FREE NODE.JS API DEVELOPMENT LEARNING PATH

WikiFree original practice workbook

The API dispatch

CASE STATUS: fictional/synthetic teaching material. Do not present the example as real research, employment experience or measured business performance.

OUTCOME
Build and test a local Node.js JSON API for a small in-memory task list, including validation and predictable HTTP responses.

BEFORE YOU START
JavaScript functions, arrays, objects and basic async concepts. Complete the JavaScript path first if needed.

CASE
The fictional Spruce Workshop needs a local task API. Each task has a numeric ID, a nonblank title of at most 80 characters and a done flag. Data is deliberately held in memory and disappears when the process restarts; this is a learning server, not a deployed service.

INPUTS
Request,Expected behavior
GET /tasks,200 and a JSON array
POST /tasks with valid title,201 and the created task
POST /tasks with blank title,400 and an error
GET /missing,404
Malformed JSON body,400


ENTRY CHECK

Question: Is an HTTP 200 appropriate for every outcome?

Self-check: No. The status should reflect the result.

Question: Does JSON parsing validate the business rules?

Self-check: No.

Question: Will an in-memory list survive a restart?

Self-check: No.

STAGE 1: Set up a local runtime

Prerequisite: JavaScript functions, arrays, objects and basic async concepts. Complete the JavaScript path first if needed.

Instruction: Node.js runs JavaScript outside the browser. Start with a small project and a documented run command. The supplied reference uses the built-in HTTP module to keep dependencies minimal; provider videos also introduce npm and later demonstrate Express. Both approaches involve requests and responses, but their routing code is different. Bind the practice server to localhost only.

Practice task: Create the project folder, inspect the supplied package file and run the local health endpoint. Record your Node version.

Deliverable: A reproducible local project and run note.

Acceptance check: The server listens on 127.0.0.1 and returns the documented health response.

If stuck: Do not expose this unauthenticated teaching server on a public interface.

Record your work, decisions and evidence:




Record your result against the acceptance check:



STAGE 2: Define routes and response contracts

Prerequisite: Bring your previous output: A reproducible local project and run note.

Instruction: A route combines method and path. Define the success body and likely failure responses before implementing it. GET /tasks reads; POST /tasks creates. A JSON response needs a matching content type and valid serialization. Keep route handling separate from task validation so tests can isolate each behavior.

Practice task: Write a route table, then implement list and create handlers using the supplied scaffold.

Deliverable: A two-route API and response contract.

Acceptance check: List returns an array with 200; successful creation returns the new task with 201.

If stuck: Do not return an HTML error page while advertising application/json.

Record your work, decisions and evidence:




Record your result against the acceptance check:



STAGE 3: Validate incoming data

Prerequisite: Bring your previous output: A two-route API and response contract.

Instruction: Treat request bodies as untrusted input. Limit the accepted body size, catch malformed JSON and validate title type and length. A valid JSON object can still contain an empty title or the wrong type. Reject unsupported fields or ignore them according to an explicit contract; never let a client choose internal IDs by accident.

Practice task: Implement title validation and a small request-body limit. Test blank, numeric, oversized and malformed inputs.

Deliverable: Validated creation with predictable errors.

Acceptance check: Invalid requests create no task and receive the documented 400 or size-limit response.

If stuck: Check the list after a rejected request to prove no partial record was added.

Record your work, decisions and evidence:




Record your result against the acceptance check:



STAGE 4: Add an update and test failures

Prerequisite: Bring your previous output: Validated creation with predictable errors.

Instruction: An update needs an existing ID and an allowed field. For this project, PATCH /tasks/:id accepts only a boolean done value. Missing tasks return 404, malformed updates return 400 and unsupported methods return a documented error. Debug with a reproducible request and a useful log message rather than changing several branches at once.

Practice task: Implement the done update and run requests for an existing ID, missing ID and invalid boolean.

Deliverable: A tested update route and failure log.

Acceptance check: Only the addressed task changes, and invalid updates preserve the previous state.

If stuck: Do not treat the string false as the boolean false through generic truthiness.

Record your work, decisions and evidence:




Record your result against the acceptance check:



STAGE 5: Document the API and its limits

Prerequisite: Bring your previous output: A tested update route and failure log.

Instruction: A handover should include install/run steps, routes, example requests and known limits. A lockfile matters when dependencies are used; the reference avoids third-party packages. The local server has no authentication, durable storage or production rate limiting. State these limits clearly so a working demo is not mistaken for a service ready to hold real user data.

Practice task: Write the README and run the provided HTTP smoke checks from a fresh process. Verify that restart clears the list as documented.

Deliverable: A local API package with contract tests and limitations.

Acceptance check: A reviewer can reproduce success, rejection, missing-resource and restart behavior.

If stuck: Do not claim persistence or deployment when the project uses only process memory.

Record your work, decisions and evidence:




Record your result against the acceptance check:



WORKED CASE
Creating a task returns 201 and a generated ID. A blank title returns 400 and leaves the list unchanged. Updating an unknown ID returns 404. Restarting the process resets the teaching data; that behavior is an explicit limitation.

FINAL PROJECT
Deliver the server, run instructions, route contract, request examples and test results. Add a maximum-title boundary test at 80 and 81 characters and show that failed creation leaves the task count unchanged.

REQUIRED CRITICAL CHECK
Rejected requests cannot change state, and the API is clearly identified as a local in-memory demo.

SCORING
Score each of the five stage acceptance checks from 0–16 (0 missing/incorrect; 8 partially supported; 16 complete and evidenced). Score the final integrated project from 0–20 (0 missing; 10 incomplete handover; 20 complete, reproducible and consistent with the case). Target: at least 80/100 AND the critical check must pass. A total score never overrides a failed critical check.

SCOPE LIMIT
This does not include authentication, a database, deployment or production hardening. Express concepts in the provider course are adapted to the dependency-free reference.

SOURCES AND ACCESS
Public videos and Node.js are free. The reference uses built-in modules and runs locally; no hosting, paid API or cloud account is required.

Free Node.js Course: Learn Server-Side JavaScript
WikiFree: https://wikifree.com/courses/microsoft-node-js-for-beginners/
Official source: https://www.youtube.com/playlist?list=PLlrxD0HtieHje-_287YJKhY8tDeSItwtg
Why selected: Microsoft Node lessons supply runtime, npm, API routing, JSON, updates and debugging concepts. The small built-in HTTP server and its tests are original WikiFree practice.

Stage 1 selected lessons:

1. What is Node.js and why you should learn it (2:30)
https://www.youtube.com/watch?v=FeJVdCz_uco&list=PLlrxD0HtieHje-_287YJKhY8tDeSItwtg&index=1

4. How to run JavaScript code in Node.js using files or REPL (2:19)
https://www.youtube.com/watch?v=g_34i8vfGZA&list=PLlrxD0HtieHje-_287YJKhY8tDeSItwtg&index=4

6. How to create a new Node.js project (3:36)
https://www.youtube.com/watch?v=EBxsKGdIWaE&list=PLlrxD0HtieHje-_287YJKhY8tDeSItwtg&index=6

7. How to use NPM scripts for your development task automation (2:17)
https://www.youtube.com/watch?v=amSVXzDiVuk&list=PLlrxD0HtieHje-_287YJKhY8tDeSItwtg&index=7

Stage 2 selected lessons:

17. How to create a web API with Node.js and Express (4:27)
https://www.youtube.com/watch?v=X2bHZ7R_4Kk&list=PLlrxD0HtieHje-_287YJKhY8tDeSItwtg&index=17

18. How to create a GET API with Node.js and Express (4:36)
https://www.youtube.com/watch?v=fdq0V7uIXtc&list=PLlrxD0HtieHje-_287YJKhY8tDeSItwtg&index=18

19. How to handle API routing with Node.js and Express (3:51)
https://www.youtube.com/watch?v=e_aNOyeqsAU&list=PLlrxD0HtieHje-_287YJKhY8tDeSItwtg&index=19

Stage 3 selected lessons:

20. How to create an API that receives JSON with Node.js and Express (4:43)
https://www.youtube.com/watch?v=hapS6wpKuX8&list=PLlrxD0HtieHje-_287YJKhY8tDeSItwtg&index=20

Stage 4 selected lessons:

21. How to create update and delete APIs with Node.js and Express (4:50)
https://www.youtube.com/watch?v=cqapa6mI3jE&list=PLlrxD0HtieHje-_287YJKhY8tDeSItwtg&index=21

22. How to run your code step by step in Node.js built-in debugger (5:58)
https://www.youtube.com/watch?v=w4Uz06b8BOE&list=PLlrxD0HtieHje-_287YJKhY8tDeSItwtg&index=22

25. How to read a stack trace in VS Code to debug a Node.js app (3:37)
https://www.youtube.com/watch?v=9AZReNXoC1E&list=PLlrxD0HtieHje-_287YJKhY8tDeSItwtg&index=25

Stage 5 selected lessons:

9. What is a lockfile and why you should commit it (2:00)
https://www.youtube.com/watch?v=DWgZQiFJSzY&list=PLlrxD0HtieHje-_287YJKhY8tDeSItwtg&index=9

11. How to manage Node.js vulnerabilities (2:17)
https://www.youtube.com/watch?v=kr9G2UXtOh4&list=PLlrxD0HtieHje-_287YJKhY8tDeSItwtg&index=11

Node.js official introduction
https://nodejs.org/learn/getting-started/introduction-to-nodejs

REUSE
Original WikiFree teaching text and synthetic fixtures are supplied for personal learning and adaptation with attribution. Provider lessons remain on their original sites and retain their own terms. No provider certificate is included.