Add a feature · 60 minutes · use any AI tool

Practice round 3: Note sharing for a notes app

Add sharing, read only or with edit rights, to the API behind a team's notes app. Designing access rules, keeping existing routes working, and thinking like a security reviewer.

Time
60 minutes
Task
Add a feature
Language
Python 3.10 or newer, standard library only
In the zip
8 files of existing code, 13 visible tests, 8 extra checks

Download sharing.zip 12.4 KB

The brief

Jot is the notes API behind a small team's web app. The most requested feature is sharing.

Add sharing. The owner of a note can share it with another user, either to read or to edit, and can stop sharing it later. People see the notes shared with them in their notes list, marked as shared, alongside their own. Add these two routes:

POST   /notes/<id>/share              {"username": "bob", "permission": "read"}   or "edit"
DELETE /notes/<id>/share/<username>

Keep the existing routes working for the web app. You decide the details the brief leaves open; write down the decisions you made in NOTES.md as you go, as you would in a pull request description.

Ground rules

  • Set a timer for 60 minutes before you open your AI tool, and stop when it rings.
  • Use your own agent (Claude Code, Codex, Cursor or any other). Work the way you would at work.
  • Python 3.10 or newer, standard library only. No installs.
  • Do not open the checks folder until your timer has stopped.

Running it

python -m unittest

tests/test_sharing.py fails until the work is done. tests/test_api.py passes today and should keep passing. The demo users are alice, bob and carol; their tokens are in notes/auth.py.

The existing code

  • notes/api.py routes and access rules
  • notes/store.py storage
  • notes/models.py users and notes
  • notes/auth.py sign in tokens
  • notes/http.py request and response types
  • notes/errors.py errors and their status codes
  • notes/seed.py demo data

When the timer stops

Run the extra checks first. Then start a new session of your agent in the same folder and paste the review prompt from REVIEW.md, filling in the path to the transcript of the session you just finished. The full rubric descriptions are in the file; this is the shape of the prompt:

You are reviewing my coding session from a 60 minute practice round. The brief is in README.md. Read the
session transcript at <path to this session's transcript> and judge how I worked, not how the code looks.

For each of the five dimensions below:
1. Quote two or three exact lines from my prompts, or name exact actions (a rejected edit, a command I ran, a
   file I opened), as evidence. Give the time or position in the transcript for each.
2. Say whether the evidence reads as strong, middling or weak, using the descriptions below, and why.
3. If the transcript does not show enough to judge, say "not enough evidence" instead of guessing.

1. Breaking the problem down: Turning a loose brief into a plan you own, then handing the AI one well defined step at a time.
2. Context given to the AI: Supplying the facts the AI cannot guess: the constraint in a config file, the rule in a document, how the system is deployed, the helper that already exists.
3. Verifying output: Checking that what the AI produced is right before relying on it.
4. Correcting the AI: Noticing when the AI goes wrong, stopping it, and steering it back precisely, or doing the small fix by hand.
5. Tradeoff reasoning: Naming the options, choosing one for a reason tied to this system, and saying what was given up.

Then list the three moments that most helped me and the three that most cost me, each with its quote, and one
thing to do differently in the next round. Do not invent quotes. If you cannot find a line, say so. Do not give
an overall score.

For counts such as prompts, rejected edits and test runs, drop the transcript on the transcript stats tool. It reads the file in your browser and uploads nothing.

Every file in the zip
  • openbook_sharing/README.md
  • openbook_sharing/REVIEW.md
  • openbook_sharing/checks/__init__.py
  • openbook_sharing/checks/check_sharing.py
  • openbook_sharing/notes/__init__.py
  • openbook_sharing/notes/api.py
  • openbook_sharing/notes/auth.py
  • openbook_sharing/notes/errors.py
  • openbook_sharing/notes/http.py
  • openbook_sharing/notes/models.py
  • openbook_sharing/notes/seed.py
  • openbook_sharing/notes/store.py
  • openbook_sharing/tests/__init__.py
  • openbook_sharing/tests/helpers.py
  • openbook_sharing/tests/test_api.py
  • openbook_sharing/tests/test_sharing.py