Capstone: Orders API

The orders router, step by step

Read the whole task first and plan the order of checks before writing code.

This router is close to what you'd write at work: authentication, validation, server-side business rules and persistence, each in its proper place, ready for a real database next.

The capstone router combines the course: an API-key middleware guards every route, validation rejects bad input with a 400, prices come from the server's own menu, orders are saved to a JSON file with careful reads and writes, and responses use the right status codes. Each piece is something you've already written — the work is fitting them together cleanly.

router.use((req, res, next) => {
  if (req.get("x-api-key") !== "cafe-secret") return res.status(401).json({ error: "Unauthorized" });
  next();
});

router.post("/", async (req, res) => {
  const items = req.body?.items;
  if (!Array.isArray(items) || items.length === 0) return res.status(400).json({ error: "items required" });
  const lines = items.map(({ slug, qty }) => ({ dish: MENU.find((d) => d.slug === slug), qty }));
  if (lines.some((l) => !l.dish || !Number.isInteger(l.qty) || l.qty < 1)) return res.status(400).json({ error: "invalid item" });
  const total = lines.reduce((s, l) => s + l.dish.price * l.qty, 0);
  // … save and respond 201 …
});