2.Pipes, Doors, Locks, Cameras and Alarms

The Problem in Real Life

Guessing Where Things Are vs. Searching for Their Fingerprints

Database, APIs, Authentication, Logging and Tests in a Codebase

• Database — the plumbing: search for the database library from package.json (pg, mysql2, prisma, sequelize, mongoose) and for query(, SELECT, INSERT. Here, backend/db/index.js creates one shared connection pool (Act 13) and exports a query function; every database call goes through it. The migrations folder (db/migrations/) is the history of the schema — read the files in order and you see every table being created and changed (Act 13). There's also db/seed.js, which fills a local database with fake events and orders.
• APIs — the doors: search for how routes are defined: router.get(, app.post( in Express; @app.route in Flask; @GetMapping in Spring. Here, backend/routes/ has events.js and sales.js, and server.js mounts them under /api. Anna lists every endpoint in her notes in two minutes — that's the API's real documentation, written by the code itself.
• Authentication — the locks: search for jwt, auth, session, passport, middleware. Here, backend/middleware/auth.js reads a JWT from the Authorization header (Act 22), checks its signature with AUTH_SECRET, and puts the organiser's ID on req.user. Every route in sales.js uses it. Important for her change: the counter must only show an organiser their own events (authorization, Act 22).
• Logging — the cameras: search for logger, console.log, winston, pino, morgan. Here, middleware/logger.js logs each request with its method, URL, status and time (Act 17). Knowing the log format means she'll know how to find her own requests later.
• Tests — the smoke alarms: look for tests/, __tests__/, files ending in .test.js or _test.py, and the test script in package.json. Here: backend/tests/sales.test.js with three tests — one marked as skipped (.skip), with a comment: // TODO fix after export change. She runs them: two pass. The safety net exists, but it has a hole.

grep -rn "router\.\(get\|post\|put\|delete\)" backend/routes   # every endpoint
grep -rn "db.query" backend                                      # every database call
grep -rn "process.env" backend config                            # every setting read
grep -rn "\.skip\|TODO" backend/tests                             # holes in the safety net

// backend/middleware/auth.js
module.exports = function requireOrganiser(req, res, next) {
  const token = (req.headers.authorization || "").replace("Bearer ", "");
  try {
    const payload = jwt.verify(token, process.env.AUTH_SECRET);
    req.user = { organiserId: payload.sub };
    next();
  } catch {
    res.status(401).json({ error: "unauthorized" });
  }
};