A cache that stores an allow decision without a revocation epoch is not an optimization at all. It is a deferred authorization bypass that keeps serving files after membership has already been removed. Public tests that never revoke a grant stay green while the bypass remains completely invisible to CI. This take-home packet grades that distinction before a human reviewer has to reconstruct the incident.
Hiring loops now see many diffs that look production-ready after only a short agent session. Speed of that kind is not the defect under measurement in this take-home packet. The defect is treating a green suite as proof that authorization still holds after the grant is gone. Reviewers need a small artifact that encodes revoke, grant, and outage instead of another essay about engineering taste.
The repository under test is a small Node.js download service for internal documents and their access lists. Each successful GET must authenticate a bearer token and then confirm current membership before any byte of the file is written. Membership lives behind a slow remote client, and that delay is the lure that invites a cache. Agents that optimize the lure without a freshness rule usually ship a bypass.
The packet does not score latency theater, extra middleware layers, or a custom web framework. It scores whether allow and deny still track the source of truth on the very next request. A polished handler that serves a stale allow is a weaker result than a plain handler that re-checks membership. Green public tests are necessary here and still not sufficient evidence.
Reviewers should treat the following outcomes as first-class evidence during grading: A revoke followed by GET returns 403 without waiting for a cache TTL. A grant followed by GET returns 200 without waiting for a cache TTL. A membership outage fails closed and never serves a prior allow. File bytes are not read on 401, 403, or 503 responses. Logs never include access tokens, raw file bytes, or full Authorization headers.
Copy the block below into the assignment so humans and agents receive identical instructions. The prompt is the contract, and hidden tests are the enforcement.
The starter is intentionally complete around the slow membership client and intentionally incomplete around the HTTP handler. Candidates should spend time on freshness, not on scaffolding a token map.
Public tests cover the happy path only, and that gap is the point of the packet. Candidates who stop at a green public run have not finished the engineering work. Agents often stop at that same green run because the omitted invariant was never encoded as an assertion.
These modules are labeled starter code for the packet. They are not a production identity provider or object store.
setMode exists so hidden tests can force an outage. Candidates should leave the hook in place rather than deleting it to make local runs look simpler.
Those assertions never revoke a grant, and they never take the membership client down. An agent can cache allow forever and still look finished to anyone who only runs npm test.
Ship these tests in a second archive or a CI job the candidate cannot edit. The cases encode the invariant that the public suite omitted on purpose.
The readCount assertion is not decoration for the grader. A 403 that still opened the file store has already leaked existence and timing information about the object. Fail-closed also means no extra read after the membership client throws.
Score each row independently and write the number next to the diff. A passing public suite is a gate, not a recommendation to hire.
| Category | 0 | 1 | 2 | | --- | --- | --- | --- | | Authn | Missing bearer handling | 401 on bad token only | 401 on missing and unknown tokens | | Authz freshness | Positive cache or session-long allow | TTL still serves after revoke | Next request matches membership | | Fail closed | Cached allow during 503 or timeout | Generic 500 on outage | 503 and no file read | | Side effects | File read on deny | Extra reads on retry | No store access on 401/403/503 | | Hygiene | Token or bytes in logs | Ambiguous error bodies | No token or bytes in logs | | Tests | Only public tests run | Extra unit tests on a cache | Notes how hidden revoke cases would be written |
Advance a candidate who scores 2 on freshness and fail-closed, even with clumsy structure around routing. Reject a polished handler that scores 0 on freshness, even when the public suite is green and the commit message sounds careful. Do not award points for naming a cache after a famous paper if the hidden revoke case still fails.
The sample below is a reference implementation for graders. It is not claimed as production traffic history, and it is not the only passing shape.
This handler calls membership.check on every request, which is boring and correct for the size of the service. A cache is allowed only when the cache key includes a generation from the membership service and a miss revalidates before any file read. A TTL sitting on allowed: true cannot satisfy the hidden revoke test, no matter how short the interval looks in a comment.