The Odin Project Databases, Ruby on Rails & Node.js Syllabus

What is a Rails migration?

A Ruby class that describes an incremental, reversible change to the database schema (creating tables, adding columns, indexes, etc.); migrations are run in order with `rails db:migrate` and can be rolled back with `rails db:rollback`.

What are Active Record validations and when do they run?

Rules declared in the model (e.g., validates :name, presence: true, uniqueness: true) that check data before it is written to the database; they run on save/create/update, and failures add messages to the object's `errors` collection and prevent saving.

What is the difference between `find` and `find_by` in Active Record?

`find(id)` looks up by primary key and raises ActiveRecord::RecordNotFound if nothing matches; `find_by(attribute: value)` returns the first record matching arbitrary conditions and returns nil if none is found.

What does it mean that Active Record queries are 'lazy', and what is an ActiveRecord::Relation?

Methods like `where`, `order`, and `limit` return an ActiveRecord::Relation instead of hitting the database immediately; the SQL only executes when the results are actually needed (e.g., iteration, `.to_a`, `.first`), which allows chaining queries efficiently.

What is the N+1 query problem and how do you fix it in Rails?

It occurs when you load N records and then run one extra query per record for an association (1 + N queries total), e.g. looping over posts and calling post.author. Fix it with eager loading: Post.includes(:author), which loads the association in a fixed number of queries.

Why should you use `where("name = ?", params[:name])` instead of string interpolation in Active Record?

The `?` placeholder creates a parameterized query that escapes user input, preventing SQL injection; interpolating user input directly into the query string lets attackers inject arbitrary SQL.

Why must you use Rails form helpers (like form_with) instead of hand-writing HTML forms?

Rails helpers automatically insert the CSRF authenticity token (without which Rails rejects non-GET submissions), set correct action/method attributes (including the _method override for PATCH/DELETE), and name fields so params arrive nested (e.g., params[:user][:name]).

In Rails form parameters, what does input name `user[email]` produce in the controller?

A nested hash in params: params[:user][:email]. The bracket naming convention groups related fields into one sub-hash so the whole set can be passed to a model at once.

What are strong parameters in Rails and how are they used?

A security mechanism requiring you to explicitly whitelist mass-assignable attributes, e.g. params.require(:user).permit(:name, :email); unpermitted attributes are dropped, preventing attackers from setting fields like `admin` via forged form data.

In a Rails controller, what is the difference between `render` and `redirect_to`?

`render` builds a response body from a view template within the current request (URL unchanged, instance variables available); `redirect_to` sends a 302 response telling the browser to make a brand-new request to another URL, discarding current instance variables.

How does data get from a Rails controller to its view?

Through instance variables: any @variable set in the controller action (e.g., @posts = Post.all) is automatically made available inside the corresponding view template.

In ERB templates, what is the difference between <%= %> and <% %>?

<%= %> evaluates the Ruby code and outputs the result into the HTML; <% %> evaluates the code without printing anything (used for logic like if statements and loops).

What are Rails partials and how are they rendered?

Reusable view fragments whose filenames start with an underscore (e.g., _form.html.erb); they are rendered with `render 'form'` or `render partial: 'user', locals: { user: @user }`, and collections can be rendered with `render @users`.

How do you declare a one-to-many association in Rails, and what does each model need?

The parent declares `has_many :posts` and the child declares `belongs_to :user`; the child's table must contain the foreign key column (user_id). The model with `belongs_to` is always the one holding the foreign key.

What are the two ways to set up a many-to-many association in Rails, and how do they differ?

`has_and_belongs_to_many` uses a bare join table with no model, while `has_many :through` uses a full join model (e.g., Appointment joining Physician and Patient). has_many :through is preferred when you need validations, callbacks, or extra attributes on the relationship.

What problem do the :class_name and :foreign_key options solve in Rails associations?

They let association names differ from model names, e.g. a Post with `belongs_to :author, class_name: "User", foreign_key: "author_id"` — Rails can no longer infer the model or key from the association name, so you specify them explicitly.

What does `dependent: :destroy` do on a has_many association?

When the parent record is destroyed, all its associated child records are also destroyed (running their callbacks), preventing orphaned rows that reference a deleted record.

What is `accepts_nested_attributes_for` used for in Rails?

Declared in a model (e.g., accepts_nested_attributes_for :addresses), it lets a parent record create/update associated records from a single form submission via a `addresses_attributes` parameter; the view uses `fields_for` to generate the nested inputs.

In a nested Rails form, what do the `_destroy` attribute and `reject_if` option do?

With allow_destroy: true, submitting `_destroy: 1` for a nested record deletes it; `reject_if` (e.g., :all_blank) skips creating nested records whose submitted fields are empty.

Why must passwords be stored as hashes rather than encrypted or plain text?

Hashing is one-way, so even if the database leaks, original passwords cannot be recovered (unlike encryption, which is reversible with a key). Rails uses bcrypt, a deliberately slow, salted hashing algorithm that resists brute-force and rainbow-table attacks.

What does `has_secure_password` give a Rails model?

Using the bcrypt gem and a `password_digest` column, it adds virtual `password` and `password_confirmation` attributes, validates their presence/match, stores only the bcrypt hash, and provides an `authenticate(password)` method that returns the user on success or false on failure.

Why does HTTP need sessions and cookies for authentication?

HTTP is stateless — each request is independent and the server retains nothing between them. Cookies are small key-value pairs the browser stores and sends with every request to that domain; sessions use a cookie (holding a session ID or signed data) to recognize the same user across requests, enabling 'staying logged in'.

In Rails, what is the difference between the `session` and `cookies` hashes?

`session` data is stored in an encrypted, tamper-proof cookie and is meant for temporary per-user state like the logged-in user's id (session[:user_id]); `cookies` writes plain browser cookies you control directly, which can persist long-term (cookies.permanent) and can be signed/encrypted explicitly.

What is Devise and what does it provide?

The most popular Rails authentication gem: a full engine providing sign-up, login/logout, password hashing, password reset emails, remember-me, account locking and confirmation, built from composable modules (database_authenticatable, recoverable, rememberable, etc.), plus helpers like current_user and authenticate_user!.

How does a Rails controller respond with either HTML or JSON from the same action?

With respond_to: e.g. `respond_to do |format| format.html; format.json { render json: @users } end` — Rails picks the block matching the request's requested format (URL extension or Accept header). `render json:` calls to_json on the object.

What is an Action Mailer in Rails and how do you send mail with it?

Mailers are classes (inheriting from ApplicationMailer) that work like controllers for email: methods set instance variables and call `mail(to:, subject:)`, views provide both HTML and plain-text templates, and you send with UserMailer.welcome_email(user).deliver_now (or deliver_later to queue it via Active Job).

What is the back end of a web application, and what are its three main components?

The server-side part the user never sees, responsible for storing, processing, and serving data. Its three core parts: the server (machine listening for requests), the application (server-side code handling requests and logic), and the database (organized persistent data storage).

What is Node.js?

Node.js is a JavaScript runtime built on Chrome's V8 engine that runs JavaScript outside the browser (on servers). It uses an event-driven, asynchronous, non-blocking I/O model: slow operations like file or network access are started, the program continues, and callbacks run via the event loop when the work completes.

What are the two module systems available in Node.js and their syntax?

CommonJS: require() to import and module.exports to export (Node's historical default). ES Modules (ESM): import/export syntax, enabled by using the .mjs extension or setting "type": "module" in package.json.

How do you debug a Node.js application beyond console.log?

Run `node inspect script.js` for the built-in terminal debugger, or `node --inspect` to open an inspector websocket that Chrome DevTools (chrome://inspect) or the VS Code debugger attach to; set breakpoints (or write `debugger;` in code), then step through and inspect variables. NODE_ENV/NODE_DEBUG and the util.debuglog utility help with log-based debugging.