# PRD — interview-code

Evidence date: 2026-10-12.

Source: `git@bitbucket.org:overdrive/interview-code.git`, `master` at `cc4eee7` (2020-10-29).

There is no prior PRD in the source repository or in Silicon Ark. The only product text is `README.md`. Requirements below are recovered from that file, the JavaScript, the lockfiles, and the six commits on `master`. Provenance is labelled.

## Product purpose

**Documented.** `README.md` titles the work "Silicon Overdrive Technical review" and sets "Time: 1 - 2 hours". The person doing the review is asked to build a React file upload with a preview, split that upload into a component, comment the code, record CLI commands, optionally list images already uploaded "even in cognito", write test instructions, and open a pull request to `jaco@overdrive.co.za`.

**Implemented.** The committed application is the starter those tasks sit on: the Create React App sample page, plus `POST /upload` on port 8000.

**Unknown / Requires Confirmation:** whether candidates still receive this repository, and whether any completed review lives outside `master`.

## Users and interactions

| Actor | Evidence | Status |
|---|---|---|
| Person doing the technical review | README task list | **Documented**. No login, role, or account exists in code |
| Reviewer named on the pull request | README task 8, address `jaco@overdrive.co.za` | **Documented** as the PR recipient. The same address is the git author of every commit |
| Person opening the React page | `src/App.js` | **Implemented**. They see the CRA logo, the "Edit src/App.js" sentence, and a "Learn React" link. They cannot choose a file |
| Client calling the upload URL | `server/server.js`, `server/upload.js` | **Implemented** as an HTTP handler. The React app does not call it |

No permission model is implemented.

## Systems the product talks to

1. The browser, for the React page served by `react-scripts start` (script name in root `package.json`). The repository does not set `PORT` and does not set a `proxy` to the upload server.
2. HTTP clients that `POST` to port `8000` path `/upload`. CORS allows `origin: "*"`.
3. The local filesystem only to the extent Formidable parses the request. The handler never reads `file.path` and never writes a destination. **Implemented** as comments that name `file.path` and "save it to the database", and as code that does neither.
4. npm and Yarn registries, via the committed lockfiles. Not a runtime integration.

No database client, AWS SDK, Cognito config, queue, cache, or mailer is present.

The React app and the Express process do not reference each other. **Implemented.** A candidate would have to connect them. That connection is **Planned** only in the sense that the README asks for an upload UI; the README does not name port 8000.

## Major workflows

### WF-1 — Read the brief

**Documented** in `README.md`. The file is the whole brief: time box, repo URL, three "code provided" lines, eight tasks. It does not describe screen layout, accepted file types, size limits, or error copy.

### WF-2 — Start the React app

**Documented** command strings: `npm ci` and `yarn start`.

**Implemented** scripts in root `package.json`: `start` → `react-scripts start`, `build` → `react-scripts build`, `test` → `react-scripts test`, `eject` → `react-scripts eject`.

`npm ci` requires a `package-lock.json`. The React root has `yarn.lock` and no `package-lock.json`. **Implemented** layout. The README command and the lockfile that was committed do not match. `yarn start` matches the Yarn lock that is present.

What the dev server prints, and which port it binds when `PORT` is unset, is the behaviour of `react-scripts` 4.0.0. This repository does not configure that port.

### WF-3 — Open the page

**Implemented** in `src/index.js` and `src/App.js`:

1. `index.js` renders `<App />` into `#root` under `React.StrictMode`.
2. `reportWebVitals()` is called with no argument. The function only measures when its argument is a function, so this call does not record metrics.
3. `App` shows `logo.svg`, the edit-and-save sentence, and a link to `https://reactjs.org` (`target="_blank"`, `rel="noopener noreferrer"`).

`public/index.html` sets the title to `React App` and the description to "Web site created using create-react-app". `public/manifest.json` names the app "Create React App Sample".

### WF-4 — Start the upload server

**Documented** command strings: `/server` and `node server.js`.

**Implemented** in `server/server.js`:

1. Create an Express app.
2. Apply `cors` with `origin: "*"` and `optionsSuccessStatus: 200`.
3. `POST /upload` uses the function exported from `server/upload.js`.
4. `listen(8000)` logs `Server started!`.

`server/package.json` has no `start` script. Its `main` is `index.js`. No `server/index.js` exists. The file the README names is `server.js`.

`npm test` in that package echoes an error and exits 1. **Implemented.**

### WF-5 — Post a file

**Implemented** in `server/upload.js`:

1. Construct `formidable.IncomingForm` with no options.
2. On `file`, the handler parameters are unused. Comments say to do something with the file, for example save it to the database, and that `file.path` is available.
3. On `end`, call `res.json()` with no argument.
4. `form.parse(req)` is invoked after those listeners are attached.

No route lists stored files. No code mentions Cognito. The React tree has no `<input type="file">`, no preview, and no `fetch` or `XMLHttpRequest`.

The response body produced by `res.json()` with no argument is **Unknown / Requires Confirmation** against a running Express process. The source does not pass a payload.

### WF-6 — Deliver the review

**Documented** and not present on `master`:

1. Work on a new branch.
2. Add the upload UI, preview, and a component.
3. Comment the code.
4. Put CLI commands in the readme.
5. Optionally list already-uploaded images, "even in cognito".
6. Write test instructions.
7. Open a pull request to `jaco@overdrive.co.za`.

Git history on the inspected remote is six commits on `master`, all by the person who wrote the brief. No candidate branch is in this clone.

## Functional requirements

### FR-001 — Publish the review brief

The repository root README states the exercise title, a 1–2 hour time box, the Bitbucket URL, the starter commands, and the eight tasks.

- Provenance: **Documented** and **Implemented** as `README.md` at `cc4eee7`.
- The file does not state acceptance criteria for a correct preview, a maximum file size, or allowed types.

### FR-002 — Serve the sample React page

A visitor of the dev server sees the Create React App sample: spinning logo (when the browser allows the animation), instructional sentence, and the Learn React link.

- Trigger: load the page.
- Output: the markup in `src/App.js`, styled by `src/App.css` and `src/index.css`.
- Provenance: **Implemented**. This is the scaffold from commit `c0a9856`. It is not the upload UI the README asks the candidate to create.

### FR-003 — Keep the sample test green against that page

`src/App.test.js` renders `App` and expects an element whose text matches `/learn react/i`.

- Provenance: **Implemented**. `src/setupTests.js` imports `@testing-library/jest-dom`.
- Changing `App` to an upload screen without updating this test would fail the test. That coupling is **Inferred** from the test and the component; the README does not mention it.

### FR-004 — Accept a multipart post

`POST /upload` parses the request with Formidable and ends by calling `res.json()` with no argument.

- Trigger: HTTP POST to port 8000, path `/upload`.
- Inputs: whatever Formidable reads from the request. The code does not name a field.
- Persistence: none.
- Provenance: **Implemented**.

### FR-005 — Allow any browser origin to call the server

CORS middleware is mounted with `origin: "*"` and `optionsSuccessStatus: 200` before the route.

- Provenance: **Implemented**. No `credentials` option is set in that object.

### FR-006 — Upload UI with preview, as a component

The candidate builds a React upload that previews the file and is split into a component.

- Provenance: **Planned** (`README.md` task 3). Not implemented on `master`.

### FR-007 — Comments, CLI notes, and test instructions

The candidate comments the code, copies CLI commands into the readme, and writes instructions for testing their result.

- Provenance: **Planned** (tasks 4, 5, and 7).
- The starter README already contains three command strings. It does not list `build`, `test`, or `eject`. Comments in `server/upload.js` are the two placeholders in the `file` listener. `server.js` has no comments. CRA files keep the generator's comments.

### FR-008 — List images already uploaded

Nice to have, in the README's words: "list of images already uploaded even in cognito."

- Provenance: **Planned**. Not implemented.
- Which store "cognito" means is **Unknown / Requires Confirmation**.

### FR-009 — Return the work as a pull request

The candidate opens a pull request to `jaco@overdrive.co.za`.

- Provenance: **Documented**. Not a behaviour of the application. No pull-request template is in git.

## Constraints

- The time box is text in the README. Nothing in code enforces it. **Documented**.
- The upload route has no authentication middleware. **Implemented**.
- The upload route does not set Formidable options for directory, max size, or file type. **Implemented**.
- The React package is `"private": true`, name `code`, version `0.1.0`. **Implemented**.
- `public/robots.txt` allows all user agents (`Disallow:` empty). **Implemented**.

## Discrepancies

| Topic | What the README says | What the tree contains |
|---|---|---|
| Material UI | "MaterialUI component" is code provided | Dependency `@material-ui/core` 4.11.0 only. No import in `src/` or `server/` |
| React install | `npm ci` | No root `package-lock.json`. Root lockfile is `yarn.lock` |
| Server entry | `node server.js` | `server/package.json` `main` is `index.js`, and that file is absent. `server.js` is the file that listens |
| Upload behaviour | Starter includes a Node server | The server parses a post and does not save or return the file |
| Image list / cognito | Nice to have | No list endpoint, no image store, no Cognito client |
| Candidate delivery | New branch and a pull request | Inspected remote has only `master` |

## Out of scope in this tree

No backlog file exists beyond the README tasks. The following are absent, not scheduled in code:

- A database or file archive.
- Authentication.
- A React call to `POST /upload`.
- Tests for `server/`.
- CI, containers, and environment files.
- Tracked Sonar configuration (`sonar-project.properties`, `sonarqube_scan.bat` were named in the OVER-164 scan listing and are not in git).