Rails API for a Recipe Sharing Service

Project roadmap

1. 01

   Create the app and models

   ~2h

   Create an app with rails new --api using PostgreSQL. Generate User (email unique, password digest via has_secure_password), Recipe (user, title, description, servings, minutes), Ingredient (recipe, name, quantity, unit, position) and Rating (user, recipe, score 1 to 5, with a unique index on user plus recipe). Add associations, validations and dependent: :destroy. Seed some data. Done when: the models and seeds work in the Rails console.

2. 02

   Add token authentication

   ~2h

   Add POST /signup and POST /login returning a JWT (with the jwt gem) signed with a secret from credentials, containing the user id and an expiry. Add an authenticate_user! before_action that reads the Authorization: Bearer header, verifies the token and sets current_user, returning 401 with a JSON error otherwise. Done when: signing up and logging in return a token, and protected routes reject missing or expired tokens.

3. 03

   Build the recipe endpoints

   ~2.5h

   Add GET /recipes (public, paginated, with ?q= searching titles and ingredient names), GET /recipes/:id, and POST, PATCH and DELETE for logged-in users. Accept ingredients as a nested array with accepts_nested_attributes_for, and use strong parameters. Only the author can update or delete a recipe (return 403 otherwise). Done when: recipes with ingredients can be created and edited only by their authors.

4. 04

   Add ratings

   ~1.5h

   Add PUT /recipes/:id/rating, which creates or updates the current user's rating (a user can't rate their own recipe). Include each recipe's average rating and rating count in responses, calculated in the query (with a join and AVG, or counter columns updated when ratings change) rather than per recipe. Done when: ratings update the average, and rating twice changes the rating instead of adding another.

5. 05

   Serialize efficiently

   ~1.5h

   Shape the JSON with serializers (for example the Alba or Blueprinter gem, or jbuilder): recipes include the author's name, ingredients in order and rating info, never password digests. Use includes to avoid N+1 queries, and confirm with the bullet gem or by counting queries in the log. Return errors in one consistent format. Done when: listing 20 recipes runs a small, fixed number of queries.

6. 06

   Write request specs

   ~2h

   Write RSpec request specs with factory_bot: sign up and login (valid and invalid), recipe CRUD with nested ingredients, author-only updates and deletes, search, pagination, rating rules and averages, and 401 and 403 responses. Done when: bundle exec rspec passes.

Resources

• DocsRails guides: API-only applications
• DocsActive Record associations
• Docsruby-jwt
• DocsActive Record query interface: eager loading
• DocsRSpec Rails