# Business rules — interview-code

Evidence date: 2026-10-12.

Source: `git@bitbucket.org:overdrive/interview-code.git`, `master` at `cc4eee7` (2020-10-29).

No business-rules document existed in the source repository or in Silicon Ark. The README is an interview brief. Rules taken from that file are **Documented**. Rules taken from JavaScript are **Implemented** or **Inferred**, as marked. None of these are a signed policy beyond the text in git.

## The exercise

### BR-001 — The work is a timed technical review

**Documented.** `README.md` heading: "Silicon Overdrive Technical review". Next line: "Time: 1 - 2 hours".

The time box is not enforced by the application. **Inferred** from the absence of any timer, token, or expiry in the code.

### BR-002 — The candidate delivers on a new branch by pull request

**Documented.** Tasks 2 and 8: create a new branch, and "do a pull rquest when done with code, jaco@overdrive.co.za".

The spelling "rquest" is the text in the file. No CODEOWNERS, branch permission, or pull-request template in git enforces the recipient.

### BR-003 — The upload UI must preview the file and be a component

**Documented.** Task 3: "Create a React App , that can do file uploads and preview the file being uploaded. Componitize the upload function."

**Implemented** on `master`: the React page does not upload or preview. The only component is `App`.

What "componitize" requires (one component or several, controlled props, where the HTTP call sits) is **Unknown / Requires Confirmation**. The README does not say.

### BR-004 — The candidate comments the code and documents commands and tests

**Documented.** Tasks 4, 5, and 7.

Task 5 says "Please copy all cli commands in readme". The starter readme itself does not list every script in `package.json`. **Inferred:** task 5 applies to the candidate's finished branch, not as a claim that the starter readme is already complete.

### BR-005 — Listing already-uploaded images is optional

**Documented.** Task 6 is introduced with "Nice to have". The line is "list of images already uploaded even in cognito."

**Inferred:** "nice to have" means the review can finish without that list. The README does not define a pass mark.

What "cognito" refers to is **Unknown / Requires Confirmation**. No other file uses the word.

## Who may call the server

### BR-006 — The upload URL does not identify the caller

**Implemented.** `server/server.js` registers `cors` and `POST /upload` only. There is no session, API key, cookie parser, or authorization header check in that file or in `server/upload.js`.

**Inferred:** any client that can reach port 8000 may post. The README does not state that rule; the code does.

### BR-007 — Any browser origin is allowed

**Implemented.** The CORS options object sets `origin` to `"*"` and `optionsSuccessStatus` to `200`. It does not set `credentials`.

### BR-008 — The React page is not an authenticated product

**Implemented.** `src/App.js` renders static sample content. There is no login form and no route table.

## What an upload does

### BR-009 — A post is parsed and not stored

**Implemented.** `upload.js` listens for Formidable's `file` event and does not use `field` or `file`. It does not set `uploadDir`, does not copy `file.path`, and does not insert a database row.

The comments in that handler ("Do something with the file", "e.g. save it to the database", "you can access it using file.path") describe an example. They are not executed.

### BR-010 — The handler answers when parsing ends

**Implemented.** The `end` listener calls `res.json()` with no argument. No success flag, file name, or error payload is passed.

There is no `error` listener on the form and no Express error middleware in `server.js`. What the client receives on a parse failure is **Unknown / Requires Confirmation**.

### BR-011 — No file type or size rule is coded

**Implemented.** `new IncomingForm()` is called with no arguments. The repository does not set a max size, an allowed extension, or an image-only check.

Formidable's own library defaults are not restated here. They were not copied into this repository.

### BR-012 — Only one route exists

**Implemented.** The only `server.*` registration is `server.post("/upload", upload)`. There is no GET for a file list, no health route, and no static file middleware.

### BR-013 — The sample page does not submit a file

**Implemented.** No module under `src/` references `/upload`, port `8000`, `FormData`, or an input of type file.

**Inferred:** the two processes are independent until a candidate connects them. The README does not name the URL the UI should call.

## Data

### BR-014 — This revision stores no product record

**Implemented.** No schema, migration, ORM, or environment variable for a database appears in git. The word "database" appears only in the comment in `server/upload.js`.

User accounts, uploaded-image rows, and Cognito identities are **not** modelled here.

## Validation the UI does perform

### BR-015 — The sample test requires the Learn React link

**Implemented.** `src/App.test.js` fails the assertion if the rendered text does not match `/learn react/i`.

This is a scaffold test, not a rule about uploads. **Inferred:** it guards the sample page only.

No server-side validation function exists. The server `test` script exits 1 because no test is specified (`server/package.json`).