beginnerValidation & Trust
Validate a Signup
Decide what you would build from the brief alone. Everything below it is available, but the exercise stops working if you open it first.
The brief you were given
POST /signup takes an email, a password and an optional referral code. Reject bad input with a clear, actionable error. The frontend already validates the same fields.
The trap — the wrong fix that looks right
Checking "does a user with this email exist" with a SELECT and returning a friendly error when it does — and treating that as the uniqueness guarantee. Two signups submitted at the same moment both see no row and both insert. Without the unique constraint, you now have two accounts on one email and every downstream lookup that assumes one row is broken. The SELECT is fine as a way to produce a nice message; it is not the mechanism.