Build one secure full-stack interaction
https://patrickz.ai/learn/full-stack-vertical-slice/

OUTCOME
Design and test one create-and-list flow with a server-side user boundary.

STACK
React · Express · TypeScript

YOU NEED
A coding agent and comfort with a local client/server project. Use fictional data and two test accounts.

1. Set your boundary
Build only create-habit and list-my-habits: a local API, two fictional test accounts and a server-side ownership check on every request. Leave deployment and cloud infrastructure until this slice passes its tests.

2. Pick one vertical slice
Build one vertical slice only: create and list habits.

3. Define the API contract
Define the API contract before wiring the interface.

4. Add two test accounts
Add authentication for two fictional test accounts and verify tokens on the server.

5. Store a user ID on every record
Store user IDs with every record and check ownership on every request.

6. Test cross-user access
Add tests for cross-user access: user B cannot list, fetch or change user A’s habits.

LATER (NOT TODAY)
- Deployment: Deploy only after this slice passes its tests, using current identity-provider guidance.
- Infrastructure automation: Add infrastructure automation after the local system works.

PROMPT
Help me build one secure full-stack interaction with [React and Express, or your stack] and TypeScript in a new practice folder. First version only: create-habit and list-my-habits, a local API, two fictional test accounts and a server-side ownership check on every request. No deployment or infrastructure automation yet. List the setup commands before changing any files. Then work in five checkpoints and, after each, tell me how to check it:
1. One vertical slice: create and list habits.
2. Request and response schemas, defined before wiring the interface.
3. Sign-in for the two test accounts, with tokens verified on the server.
4. A user ID stored with every record and checked on every request.
5. Tests proving user B cannot list, fetch or change user A’s habits by direct API calls, and that unauthenticated calls fail.
Follow current guidance for [your identity provider].

FOLLOW-UP PROMPT
Review this vertical slice for ownership leaks. Check that every route takes the user ID from the verified token, not the request body, that list, fetch and change all filter by owner, and that tests cover user B and unauthenticated calls. Flag complexity that is unnecessary for an early prototype.

EXAMPLE / EXPERIMENT
Create one record as user A. Confirm user B cannot list, fetch or modify it through direct API calls as well as the interface. Test an unauthenticated request.

CHECK YOUR RESULT
[ ] The server verifies identity and ownership.
[ ] Cross-user access is rejected.
[ ] Validation errors are visible and do not expose secrets.

IF IT FAILS
Hiding a button is not authorization. Enforce the boundary on the server, and choose current supported identity services before production.

MY RESULT / NEXT CHANGE