Project two a Workers and D1 notes API

Build a reviewable CRUD API with migrations, bound SQL parameters, structured errors, and local D1.

PROJECT 02INTERMEDIATEAbout 55 minutesOutcome: Notes CRUD API

Done means

The local migration succeeds; mutations require a secret; list, create, read, delete, validation failure, and database failure have stable results; every user value enters SQL through prepare().bind().

Architecture and files

HTTP request → Worker validation/router → D1 prepared statement → JSON response

README.md

wrangler.jsonc

0001_create_notes.sql

index.mjs

The runnable source is in examples/workers-d1-api/. It protects POST/DELETE with WRITE_KEY, caps body size, title length, and list count, selects explicit columns instead of SELECT *, and never echoes SQL on internal failure.

Run locally

Apply the migration

pnpm wrangler d1 migrations apply orange-book-notes --local --config examples/workers-d1-api/wrangler.jsonc

Start the Worker

cp examples/workers-d1-api/.dev.vars.example examples/workers-d1-api/.dev.vars
pnpm wrangler dev --config examples/workers-d1-api/wrangler.jsonc

Replace the placeholder in local .dev.vars and never commit that file. Set the production secret separately only after confirming the target account.

Create and read

curl -i http://127.0.0.1:8787/api/notes \
  -H 'content-type: application/json' \
  -H 'x-write-key: <your-local-write-secret>' \
  --data '{"title":"First note","body":"Verified locally"}'
curl -i 'http://127.0.0.1:8787/api/notes?limit=10'

Verify error paths

curl -i 'http://127.0.0.1:8787/api/notes?limit=999'
curl -i -X PATCH http://127.0.0.1:8787/api/notes

Expect 400 invalid_limit and 405 method_not_allowed.

Remote boundary and rollback

d1 create, migrations apply --remote, production secret changes, and deploy mutate Cloudflare state and are not automated in this phase. Back up before a production migration, validate on preview D1, and keep old code able to read the new schema. Code rollback cannot undo written data. Rotate WRITE_KEY if it leaks. This shared key is only a server-to-server tutorial guard and must never enter browser code; a public editor needs real user authentication and authorization.

Next: Workers AI + Vectorize knowledge assistant.