🛠️ Weekend Project: Backend Fundamentals

The Mission

Reading about backends teaches you the vocabulary. Building one teaches you the reflexes. This weekend project is a deliberate rep: you'll construct a small but complete API — a Task Manager supporting create, read, update, and delete — and then rebuild it, feature for feature, in two more languages.

Why three times? Because the third build is where it clicks. The first server feels like learning; the second feels like translation; by the third you're just filling in the same boxes with different syntax. That transfer — recognizing the shape of a backend beneath any language — is the real deliverable of Module 15.

💡 Treat this like a real ticket. Don't copy-paste blindly. Type the code, break it on purpose, read the error, fix it. The debugging is the class.

Before you start — prerequisites

• Node.js 18+ installed (node --version)
• Python 3.10+ installed (python --version)
• PHP 8.1+ installed (php --version)
• A terminal and a way to send HTTP requests — curl is built in on macOS/Linux and modern Windows; Postman is a friendly GUI alternative
• Comfort with basic HTTP verbs and JSON (covered earlier in this module)

The Spec You're Building

A good backend starts from a clear contract. Here's the exact API all three servers must implement. Build to this spec and your frontend never has to care which language answered.

Endpoints

The Task object

{
  "id": "string",           // server-generated unique id
  "title": "string",        // required, non-empty
  "description": "string",  // optional, defaults to ""
  "status": "string",       // "pending" | "in-progress" | "completed"
  "created_at": "string"    // ISO 8601 timestamp
}

The rules every server must follow

The whole request lifecycle you'll build looks like this — identical across all three languages:

Milestones & Timeline

Ship it in stages. Each milestone is independently runnable and testable, so you always have something working to fall back on. Don't move on until the current server passes all five requests.

Recommended project layout so the three servers never collide:

weekend-project/
├── nodejs-server/
│   ├── package.json
│   └── index.js
├── python-server/
│   ├── requirements.txt
│   └── app.py
└── php-server/
    └── index.php

Milestone 1 — Node.js / Express

Express is the most popular Node.js web framework. Its routing reads almost like the spec table above, which makes it a great first build.

Setup

mkdir -p weekend-project/nodejs-server
cd weekend-project/nodejs-server
npm init -y
npm install express

index.js

const express = require('express');
const { randomUUID } = require('crypto');

const app = express();
const PORT = process.env.PORT || 3000;

app.use(express.json()); // parse JSON request bodies

// In-memory store (resets when the server restarts)
let tasks = [];
const VALID_STATUS = ['pending', 'in-progress', 'completed'];
const findTask = (id) => tasks.find((t) => t.id === id);

// GET all
app.get('/api/tasks', (req, res) => {
  res.json(tasks);
});

// GET one
app.get('/api/tasks/:id', (req, res) => {
  const task = findTask(req.params.id);
  if (!task) return res.status(404).json({ error: 'Task not found' });
  res.json(task);
});

// CREATE
app.post('/api/tasks', (req, res) => {
  const { title, description } = req.body ?? {};
  if (!title) return res.status(400).json({ error: 'Title is required' });

  const task = {
    id: randomUUID(),
    title,
    description: description ?? '',
    status: 'pending',
    created_at: new Date().toISOString(),
  };
  tasks.push(task);
  res.status(201).json(task);
});

// UPDATE
app.put('/api/tasks/:id', (req, res) => {
  const task = findTask(req.params.id);
  if (!task) return res.status(404).json({ error: 'Task not found' });

  const { title, description, status } = req.body ?? {};
  if (status && !VALID_STATUS.includes(status)) {
    return res.status(400).json({ error: 'Invalid status value' });
  }
  if (title !== undefined) task.title = title;
  if (description !== undefined) task.description = description;
  if (status !== undefined) task.status = status;
  res.json(task);
});

// DELETE
app.delete('/api/tasks/:id', (req, res) => {
  const index = tasks.findIndex((t) => t.id === req.params.id);
  if (index === -1) return res.status(404).json({ error: 'Task not found' });
  tasks.splice(index, 1);
  res.json({ message: 'Task deleted successfully' });
});

app.listen(PORT, () => {
  console.log(`Node server running at http://localhost:${PORT}`);
});

Run it

node index.js
# → Node server running at http://localhost:3000

Milestone 2 — Python / Flask

Now translate. Notice how Flask's @app.route decorators map to the same five endpoints — the structure is identical, only the syntax changes.

Setup

mkdir -p weekend-project/python-server
cd weekend-project/python-server
python -m venv venv

# Activate — macOS/Linux:
source venv/bin/activate
# Windows (PowerShell):
# venv\Scripts\Activate.ps1

pip install flask
pip freeze > requirements.txt

app.py

from flask import Flask, request, jsonify
from datetime import datetime, timezone
import uuid

app = Flask(__name__)

tasks = []  # in-memory store
VALID_STATUS = {'pending', 'in-progress', 'completed'}


def find_task(task_id):
    return next((t for t in tasks if t['id'] == task_id), None)


@app.get('/api/tasks')
def get_all_tasks():
    return jsonify(tasks)


@app.get('/api/tasks/<task_id>')
def get_task(task_id):
    task = find_task(task_id)
    if task is None:
        return jsonify(error='Task not found'), 404
    return jsonify(task)


@app.post('/api/tasks')
def create_task():
    data = request.get_json(silent=True) or {}
    if not data.get('title'):
        return jsonify(error='Title is required'), 400

    task = {
        'id': str(uuid.uuid4()),
        'title': data['title'],
        'description': data.get('description', ''),
        'status': 'pending',
        'created_at': datetime.now(timezone.utc).isoformat(),
    }
    tasks.append(task)
    return jsonify(task), 201


@app.put('/api/tasks/<task_id>')
def update_task(task_id):
    task = find_task(task_id)
    if task is None:
        return jsonify(error='Task not found'), 404

    data = request.get_json(silent=True) or {}
    if 'status' in data and data['status'] not in VALID_STATUS:
        return jsonify(error='Invalid status value'), 400

    for field in ('title', 'description', 'status'):
        if field in data:
            task[field] = data[field]
    return jsonify(task)


@app.delete('/api/tasks/<task_id>')
def delete_task(task_id):
    global tasks
    if find_task(task_id) is None:
        return jsonify(error='Task not found'), 404
    tasks = [t for t in tasks if t['id'] != task_id]
    return jsonify(message='Task deleted successfully')


if __name__ == '__main__':
    app.run(debug=True, port=5000)

Run it

python app.py
# → Running on http://127.0.0.1:5000

Milestone 3 — Plain PHP

The third build is the most revealing because PHP has no framework here — you write the router yourself. Doing routing by hand once makes you appreciate what Express and Flask do for free.

Setup

mkdir -p weekend-project/php-server
cd weekend-project/php-server
touch index.php

index.php

<?php
header('Content-Type: application/json');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(204);
    exit;
}

// --- Persistence (JSON file so data survives between requests) ---
const STORE = __DIR__ . '/tasks.json';
function load_tasks(): array {
    return file_exists(STORE)
        ? (json_decode(file_get_contents(STORE), true) ?: [])
        : [];
}
function save_tasks(array $tasks): void {
    file_put_contents(STORE, json_encode($tasks, JSON_PRETTY_PRINT));
}
function send($data, int $status = 200): void {
    http_response_code($status);
    echo json_encode($data);
    exit;
}

$valid = ['pending', 'in-progress', 'completed'];

// --- Parse method + path ---
$method = $_SERVER['REQUEST_METHOD'];
$path   = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
$parts  = array_values(array_filter(explode('/', $path)));

// Expect /api/tasks or /api/tasks/{id}
if (($parts[0] ?? '') !== 'api' || ($parts[1] ?? '') !== 'tasks') {
    send(['error' => 'Not Found'], 404);
}
$id = $parts[2] ?? null;

$tasks = load_tasks();
$body  = json_decode(file_get_contents('php://input'), true) ?? [];

switch ($method) {
    case 'GET':
        if ($id === null) send($tasks);
        foreach ($tasks as $t) if ($t['id'] === $id) send($t);
        send(['error' => 'Task not found'], 404);

    case 'POST':
        if (empty($body['title'])) send(['error' => 'Title is required'], 400);
        $task = [
            'id'          => bin2hex(random_bytes(8)),
            'title'       => $body['title'],
            'description' => $body['description'] ?? '',
            'status'      => 'pending',
            'created_at'  => date('c'),
        ];
        $tasks[] = $task;
        save_tasks($tasks);
        send($task, 201);

    case 'PUT':
        if ($id === null) send(['error' => 'Task ID is required'], 400);
        if (isset($body['status']) && !in_array($body['status'], $valid, true)) {
            send(['error' => 'Invalid status value'], 400);
        }
        foreach ($tasks as $i => $t) {
            if ($t['id'] === $id) {
                foreach (['title', 'description', 'status'] as $f) {
                    if (array_key_exists($f, $body)) $tasks[$i][$f] = $body[$f];
                }
                save_tasks($tasks);
                send($tasks[$i]);
            }
        }
        send(['error' => 'Task not found'], 404);

    case 'DELETE':
        if ($id === null) send(['error' => 'Task ID is required'], 400);
        foreach ($tasks as $i => $t) {
            if ($t['id'] === $id) {
                array_splice($tasks, $i, 1);
                save_tasks($tasks);
                send(['message' => 'Task deleted successfully']);
            }
        }
        send(['error' => 'Task not found'], 404);

    default:
        send(['error' => 'Method not allowed'], 405);
}

Run it

php -S localhost:8000
# → PHP Development Server started on http://localhost:8000

Milestone 4 — Test & Compare

Now hammer each server with the same requests. These curl commands work against all three — just swap the port (Node 3000, Flask 5000, PHP 8000).

The five-request smoke test

# 1. Create a task
curl -X POST http://localhost:3000/api/tasks \
  -H "Content-Type: application/json" \
  -d '{"title":"Finish weekend project","description":"All three servers"}'

# 2. List all tasks
curl http://localhost:3000/api/tasks

# 3. Get one (paste the id from step 1)
curl http://localhost:3000/api/tasks/PASTE_ID_HERE

# 4. Update its status
curl -X PUT http://localhost:3000/api/tasks/PASTE_ID_HERE \
  -H "Content-Type: application/json" \
  -d '{"status":"in-progress"}'

# 5. Delete it
curl -X DELETE http://localhost:3000/api/tasks/PASTE_ID_HERE

Also test the failure paths

# Missing title → 400
curl -i -X POST http://localhost:3000/api/tasks \
  -H "Content-Type: application/json" -d '{}'

# Unknown id → 404
curl -i http://localhost:3000/api/tasks/does-not-exist

# Bad status → 400
curl -i -X PUT http://localhost:3000/api/tasks/PASTE_ID_HERE \
  -H "Content-Type: application/json" -d '{"status":"banana"}'

{
  "id": "3f2a…",
  "title": "Finish weekend project",
  "description": "All three servers",
  "status": "pending",
  "created_at": "2026-07-31T18:04:22.000Z"
}

Fill in this comparison table as you go

What Good Looks Like

Anyone can get a happy-path GET to return something. The difference between "it runs" and "it's good" lives in the edges. Hold your three servers to this rubric.

Completion Checklist

Tick these off before you call the weekend a win. If any box won't check, that's your next debugging session.

Stretch Goals

Finished early, or want to push further? Pick one — each maps to a real skill you'll use on the job.

1. A shared frontend

Build one small HTML page that lists tasks, adds them, and deletes them. Point API_BASE at any of your three servers and confirm it works unchanged — the clearest possible proof that a clean API contract decouples frontend from backend.

const API_BASE = 'http://localhost:3000/api/tasks'; // swap the port

async function loadTasks() {
  const res = await fetch(API_BASE);
  const tasks = await res.json();
  console.table(tasks);
}

async function addTask(title, description = '') {
  const res = await fetch(API_BASE, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ title, description }),
  });
  return res.json();
}

loadTasks();

2. Persist Node & Flask too

Swap the in-memory arrays for a JSON file (like PHP), or go further and wire up SQLite. Now data survives restarts everywhere.

3. Add proper error handling middleware

In Express, add a final app.use((err, req, res, next) => …) handler. In Flask, register an @app.errorhandler. Return consistent JSON for unexpected errors instead of stack traces.

Summary & Quiz

📚 Further Reading

• Express — Routing guide
• Flask — Quickstart
• PHP — Built-in web server
• MDN — HTTP status codes

🚀 What's Next?

You've now built raw backends by hand. Next we go deeper into the JavaScript stack with a proper framework tour, starting with an overview of Express.js — the same tool you used today, examined feature by feature.