A prototype, taken to production standards.

Sessions are verified, not merely decoded

A JWT signature proves a token was issued; it doesn't prove the account still exists or is still permitted. The auth middleware loads the user on every authenticated request, so deletion and suspension take effect immediately rather than up to seven days later at token expiry. It costs nothing extra — the middleware already writes lastActiveAt per request.

passwordChangedAt extends this into real revocation: a reset invalidates every token issued before it — which matters, because a reset is usually performed because an account is believed compromised.

One cleanup path, not six

Deleting a note or a user touches versions, flashcards, resurfacing history, notification references, wikilink back-references, and object storage. Six call sites each implementing that cascade independently is six chances to forget one.

Observed symptomflashcards that kept quizzing users on notes they had permanently deleted.

All six now funnel through services/dataCleanup.js, and the test suite asserts zero orphans per path.

Signed asset URLs, per file

<img> can't send an Authorization header, and this app authenticates with bearer tokens, not cookies — so putting /uploads behind auth middleware would break every image in every note.

Instead, a protected endpoint verifies ownership and returns per-file HMAC signatures with a one-hour expiry; the public route only verifies. Signing each file individually keeps a leaked URL worth exactly one image — as it was before — while adding an expiry it never had. Shared public notes reuse the same primitive.

Streak math survives Daylight Saving Time

Stepping backward through days with fixed 86,400,000ms arithmetic breaks twice a year: a spring-forward day is 23 hours of real time, so subtracting a full day skips a calendar day; a fall-back day is 25 hours and double-counts one.

Every streak calculation now steps using the Date object's own local-time setters, which the engine re-normalises across the transition. Proven with a test that pins the system clock to a real DST boundary and fails outright against the old implementation.

Metered AI needs per-user accounting

An IP-based rate limiter can't answer “who ran up this bill”, counts an office behind one NAT as a single user, and resets on deploy. AiUsage tracks calls per user per UTC day via an atomic upsert, so concurrent requests can't both slip through a stale read.

Note saves consume that quota softly: every save triggers a billed embedding call, but an exhausted quota degrades the note to keyword matching rather than blocking the save. “You've used your AI quota, so you can no longer write notes” is not a defensible product behaviour.

Fail fast on configuration

A mistyped JWT_SECRET used to bind the port, pass the health check, and then return 500 on every login — a total outage that looked like a healthy deploy. config/env.js validates everything at boot and exits with a readable message.

Paired variables are checked together, because half a feature's configuration is worse than none: a partially configured email backend silently falls back to logging, indistinguishable from working until a real user needs a password reset.