# Technical documentation — reactjs-nodejs-tutorial

Evidence date: 2026-10-05. Revision: `master` `1500676cdcf9880c1f9369565bd6fe7683c3342e` (2020-04-20, JacquesOverdrive `<jacques@overdrive.co.za>`, message `ini commit`).

`serverless.yml` points the provider at AWS `us-east-1`, stage `prod`, runtime `nodejs12.x`. No account id, secret, or deployed stack id is in git. The README demo URL is quoted as documentation, not as a verified endpoint.

## What this repository is

A Bitbucket Git repository with one commit on `master` and nine tracked files. The README, MIT licence, and `package.json` `repository` URL identify the tree as the Anomaly Innovations Serverless Node.js Starter (`https://github.com/AnomalyInnovations/serverless-nodejs-starter`). The npm package name and the Serverless service name are `notes-app-api` version `1.1.0`. The Bitbucket project name is `reactjs-nodejs-tutorial`.

There is no React code. There is no notes resource. Application logic is `handler.js` only.

`sonar-project.properties` and `sonarqube_scan.bat` were listed by the onboarding scan and are not in git.

## Repository layout

```text
reactjs-nodejs-tutorial/
  handler.js              export hello
  tests/handler.test.js   one test, callback-shaped asserts
  serverless.yml          service notes-app-api, no functions key
  package.json            name, scripts, dependency ranges
  package-lock.json       lockfileVersion 1
  env.example             SAMPLE_ENV_VAR
  README.md               upstream starter readme
  LICENSE                 MIT, Anomaly Innovations, 2017
  .gitignore              node_modules, .env, .serverless, .webpack, coverage
```

Not in the tree: `functions` in the Serverless file, `.env`, `.eslintrc.json`, `.eslintignore`, Babel or Webpack config files, `bitbucket-pipelines.yml`, Docker, SQL, React, and a Serverless Framework dependency.

## Runtime and language

| Item | Value | Evidence |
|---|---|---|
| Handler language | JavaScript, ES module `export` / `import` | `handler.js`, `tests/handler.test.js` |
| Lambda runtime pin | `nodejs12.x` | `serverless.yml` `provider.runtime` |
| Package manager lock | npm lockfileVersion 1 | `package-lock.json` |
| Module entry | `"main": "handler.js"` | `package.json` |
| Test runner command | `serverless-bundle test` | `package.json` scripts |
| Serverless CLI | Required by the README, not listed in `package.json` | `README.md` |

No `.nvmrc`, `engines` field, or Node version for the developer workstation is committed. Whether `nodejs12.x` can still be deployed was not checked against AWS. **Unknown / Requires Confirmation.**

`handler.js` uses `export`, object rest (`...rest`), async/await, and a template string. The README says `serverless-bundle` supplies Babel and Webpack so the author does not commit those configs. No babel or webpack file is in git, which matches that claim. A bundle was not produced in this investigation.

## Handler

`handler.js` in full behaviour:

1. `export const hello = async (event, context) => { ... }`.
2. `context` is unused. A third argument is not declared, so a callback passed by the test is discarded.
3. `message({ time, ...rest })` returns a Promise that resolves `` `${rest.copy} (with a delay)` `` after `time * 1000` ms.
4. The call site passes `time: 1` and `copy: 'Your function executed successfully!'`.
5. Return value:

```javascript
{
  statusCode: 200,
  body: JSON.stringify({
    message: "Go Serverless v1.0! Your function executed successfully! (with a delay)"
  })
}
```

No `headers`, `isBase64Encoded`, or multi-value headers. The README demo adds `input: event` beside `message`. This file does not.

## Serverless configuration

`serverless.yml` is 16 lines.

| Key | Value |
|---|---|
| `service` | `notes-app-api` |
| `package.individually` | `true` |
| `plugins` | `serverless-bundle`, `serverless-offline`, `serverless-dotenv-plugin` |
| `provider.name` | `aws` |
| `provider.runtime` | `nodejs12.x` |
| `provider.stage` | `prod` |
| `provider.region` | `us-east-1` |

Absent: `functions`, `custom`, `environment`, IAM `role` or `iamRoleStatements`, `apiGateway`, VPC, layers, resources, and `org` / `app` (Serverless Dashboard).

Consequence for the README commands: `--function hello` has no matching key. `serverless offline start` has no `http` event to bind. `serverless-dotenv-plugin` is loaded, and no `${env:...}` or `environment` block consumes variables. These commands were not executed.

Individual packaging applies when functions exist. With an empty function set, what `serverless deploy` uploads was not observed. **Unknown.**

## Dependencies

Direct dependencies and the versions locked at `1500676`:

| Package | package.json | Locked | Declared as | Used by source in this repo |
|---|---|---|---|---|
| `uuid` | `^7.0.3` | 7.0.3 | dependency | No import |
| `aws-sdk` | `^2.658.0` | 2.658.0 | devDependency | No import |
| `serverless-bundle` | `^1.2.5` | 1.2.5 | devDependency | Named by YAML and by the test script |
| `serverless-dotenv-plugin` | `^2.1.1` | 2.1.1 | devDependency | Named by YAML |
| `serverless-offline` | `^5.3.3` | 5.8.0 | devDependency | Named by YAML |

`package.json` `repository.url` is `https://github.com/AnomalyInnovations/serverless-nodejs-starter.git`. `author` is `""`.

Transitive packages (Babel 7.6.x, webpack pieces, Jest via `serverless-bundle`) are in the lockfile. They are not configured by a file in this repository. Listing every transitive package would not change the product behaviour above.

## Tests

`tests/handler.test.js`:

```javascript
import * as handler from '../handler';

test('hello', async () => {
  const event = 'event';
  const context = 'context';
  const callback = (error, response) => {
    expect(response.statusCode).toEqual(200);
    expect(typeof response.body).toBe("string");
  };

  await handler.hello(event, context, callback);
});
```

The import style needs the bundle test runner (or another compiler). Plain `node tests/handler.test.js` is not the documented command.

The expects do not run unless `hello` calls `callback`. It does not. There is no `expect.assertions(2)`. The test does not await a timer assertion of its own; the one-second wait still happens inside `hello` before the returned promise resolves, and the return value is ignored.

`npm test` was not run. Exit code on a current Node with these 2020 packages is **Unknown**.

## Environment and secrets

| File | Committed | Contents |
|---|---|---|
| `env.example` | Yes | Comment block plus `SAMPLE_ENV_VAR=i-am-an-environment-variable` |
| `.env` | No (gitignored) | Not in the revision |
| `env.yml` | No (gitignored) | Not in the revision |

No AWS keys, database passwords, or tokens are in the tracked files. The README says to configure the AWS CLI outside the repo.

`serverless-dotenv-plugin` is present so a local `.env` would be loaded when the Serverless CLI runs. Nothing in YAML references a variable, so a loaded value would not be copied into a function environment by this file.

## Auth, data, jobs, and operations

| Area | In this revision |
|---|---|
| Authentication | None |
| Database | None |
| Queues and workers | None |
| Cron | None |
| Object storage | None |
| Monitoring | README mentions CloudWatch only as the place sourcemaps would apply. No alarm, log subscription, or dashboard is defined |
| CI | No pipeline file |
| Deployment | README documents `serverless deploy`. No pipeline runs it. No evidence of a completed deploy is in git |

## Security notes from the tree

These are observations, not a pentest.

- `hello` returns 200 for every input it is given, and it reflects nothing from `event` (BR-003, BR-004 in `business-rules.md`).
- No secret material is committed. The sample variable is a placeholder string.
- `uuid` and `aws-sdk` are installed by a full `npm install` and are unused by the handler. They enlarge the tree a packaging step would see if `node_modules` were zipped. `serverless-bundle` is the intended packager; it was not run.
- Runtime `nodejs12.x` is the pin. Current AWS acceptance is **Unknown / Requires Confirmation**.

## Development process

Documented commands, from `README.md`, aimed at the upstream starter:

1. Install the Serverless Framework and configure the AWS CLI.
2. `npm install`.
3. `serverless invoke local --function hello`.
4. `serverless offline start`.
5. `serverless deploy` or `serverless deploy function --function hello`.
6. `npm test`.
7. Optional: copy `env.example` to `.env`.

Steps 3 to 5 depend on a `functions.hello` entry this YAML does not have. Step 7's "uncomment `environment`" depends on a block this YAML does not have.

Git process visible here: one author, one commit, message `ini commit`, no branch other than `master`. No pull-request template, issue template, or contribution file beyond the README "Support" section, which links to the GitHub starter's issue tracker.

## Open technical questions

- Whether `serverless deploy` on this file creates an empty stack, fails, or no-ops. Not run.
- Whether `npm test` exits 0. Not run.
- Whether the demo URL `z6pv80ao4l` is related to this commit.
- The GitHub revision this tree was copied from. It is not recorded in the Bitbucket commit.
- Why the scan host listed Sonar files that git does not contain.