Best Practices - Ollie Shop

Leverage these proven patterns and best practices to build production-ready functions that are secure, performant, and maintainable.

Code Quality

Follow consistent naming conventions
Implement proper error handling
Use TypeScript for better type safety
Keep functions focused and small

Security & Performance

Validate all input data
Use environment variables for secrets
Implement proper authentication
Optimize for cold start performance

Request Function Patterns

HTTP Method Handling

export const handler = async (event) => {
  const { httpMethod, body } = event;
  const data = body ? JSON.parse(body) : {};
  
  switch (httpMethod) {
    case 'GET':
      return {
        statusCode: 200,
        body: JSON.stringify({ users: await getUsers() })
      };
      
    case 'POST':
      const newUser = await createUser(data);
      return {
        statusCode: 201,
        body: JSON.stringify({ id: newUser.id, message: 'User created' })
      };
      
    case 'PUT':
      const updatedUser = await updateUser(data);
      return {
        statusCode: 200,
        body: JSON.stringify(updatedUser)
      };
      
    case 'DELETE':
      await deleteUser(data.id);
      return {
        statusCode: 204,
        body: ''
      };
      
    default:
      return {
        statusCode: 405,
        body: JSON.stringify({ error: 'Method not allowed' })
      };
  }
};

Input Validation

export const handler = async (event) => {
  const { body } = event;
  
  try {
    const data = JSON.parse(body || '{}');
    
    // Validate required fields
    const errors = [];
    if (!data.email) errors.push('Email is required');
    if (!data.password) errors.push('Password is required');
    if (data.password && data.password.length < 8) {
      errors.push('Password must be at least 8 characters');
    }
    
    // Return validation errors
    if (errors.length > 0) {
      return {
        statusCode: 400,
        body: JSON.stringify({ 
          error: 'Validation failed',
          details: errors 
        })
      };
    }
    
    // Process valid data
    const result = await processUser(data);
    return {
      statusCode: 200,
      body: JSON.stringify(result)
    };
  } catch (error) {
    return {
      statusCode: 400,
      body: JSON.stringify({ error: 'Invalid JSON' })
    };
  }
};

Error Handling

export const handler = async (event) => {
  try {
    const result = await processRequest(event);
    return {
      statusCode: 200,
      body: JSON.stringify({ success: true, data: result })
    };
  } catch (error) {
    console.error('Request processing error:', error);
    
    // Handle validation errors
    if (error.name === 'ValidationError') {
      return {
        statusCode: 400,
        body: JSON.stringify({ 
          error: 'Invalid input',
          details: error.message 
        })
      };
    }
    
    // Handle not found errors
    if (error.name === 'NotFoundError') {
      return {
        statusCode: 404,
        body: JSON.stringify({ error: 'Resource not found' })
      };
    }
    
    // Handle unexpected errors
    return {
      statusCode: 500,
      body: JSON.stringify({ 
        error: 'Internal server error',
        requestId: event.requestContext?.requestId
      })
    };
  }
};

Security Best Practices

Authentication & Authorization

import jwt from 'jsonwebtoken';

export const handler = async (event) => {
  try {
    // Extract token from header
    const authHeader = event.headers.Authorization || event.headers.authorization;
    if (!authHeader?.startsWith('Bearer ')) {
      return {
        statusCode: 401,
        body: JSON.stringify({ error: 'Missing or invalid authorization header' })
      };
    }
    
    const token = authHeader.substring(7);
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    
    // Check user permissions
    if (!decoded.permissions?.includes('admin')) {
      return {
        statusCode: 403,
        body: JSON.stringify({ error: 'Insufficient permissions' })
      };
    }
    
    // Continue with authenticated request
    const result = await processAuthenticatedRequest(decoded, event);
    return {
      statusCode: 200,
      body: JSON.stringify(result)
    };
  } catch (error) {
    return {
      statusCode: 401,
      body: JSON.stringify({ error: 'Invalid token' })
    };
  }
};

Environment Variables & Secrets

// Use environment variables for sensitive data
const config = {
  database: {
    host: process.env.DB_HOST,
    username: process.env.DB_USERNAME,
    password: process.env.DB_PASSWORD,
    ssl: process.env.NODE_ENV === 'production'
  },
  jwt: {
    secret: process.env.JWT_SECRET,
    expiresIn: process.env.JWT_EXPIRES_IN || '24h'
  },
  external: {
    apiKey: process.env.EXTERNAL_API_KEY,
    webhookSecret: process.env.WEBHOOK_SECRET
  }
};

// Validate required environment variables
const requiredEnvVars = ['DB_HOST', 'JWT_SECRET', 'EXTERNAL_API_KEY'];
const missingVars = requiredEnvVars.filter(varName => !process.env[varName]);

if (missingVars.length > 0) {
  throw new Error(`Missing required environment variables: ${missingVars.join(', ')}`);
}

Performance Optimization

Cold Start Optimization

// Initialize outside handler for reuse across invocations
import { createConnection } from './database';
import { initializeCache } from './cache';

let dbConnection;
let cache;

// Initialize on first import
const initializeResources = async () => {
  if (!dbConnection) {
    dbConnection = await createConnection();
  }
  if (!cache) {
    cache = await initializeCache();
  }
};

export const handler = async (event) => {
  // Ensure resources are initialized
  await initializeResources();
  
  // Use cached resources
  const result = await dbConnection.query('SELECT * FROM users');
  await cache.set('users', result, 300); // Cache for 5 minutes
  
  return {
    statusCode: 200,
    body: JSON.stringify(result)
  };
};

Database Optimization

import { Pool } from 'pg';

// Create connection pool outside handler
const pool = new Pool({
  host: process.env.DB_HOST,
  database: process.env.DB_NAME,
  user: process.env.DB_USER,
  password: process.env.DB_PASSWORD,
  max: 10, // Maximum pool size
  idleTimeoutMillis: 30000,
  connectionTimeoutMillis: 2000,
});

export const handler = async (event) => {
  const client = await pool.connect();
  
  try {
    // Use parameterized queries to prevent SQL injection
    const result = await client.query(
      'SELECT * FROM users WHERE email = $1 AND status = $2',
      [event.body.email, 'active']
    );
    
    return {
      statusCode: 200,
      body: JSON.stringify(result.rows)
    };
  } finally {
    client.release(); // Always release the client back to pool
  }
};

Testing Best Practices

Unit Testing

import { handler } from '../src/user-handler';

describe('User Handler', () => {
  test('should create user with valid data', async () => {
    // Arrange
    const event = {
      httpMethod: 'POST',
      body: JSON.stringify({
        name: 'John Doe',
        email: 'john@example.com',
        password: 'securePassword123'
      })
    };
    
    // Act
    const response = await handler(event);
    const body = JSON.parse(response.body);
    
    // Assert
    expect(response.statusCode).toBe(201);
    expect(body).toHaveProperty('id');
    expect(body.message).toBe('User created');
  });
  
  test('should return validation error for invalid email', async () => {
    // Arrange
    const event = {
      httpMethod: 'POST',
      body: JSON.stringify({
        name: 'John Doe',
        email: 'invalid-email',
        password: 'securePassword123'
      })
    };
    
    // Act
    const response = await handler(event);
    const body = JSON.parse(response.body);
    
    // Assert
    expect(response.statusCode).toBe(400);
    expect(body.error).toBe('Validation failed');
    expect(body.details).toContain('Valid email is required');
  });
});

Response Function Patterns

Conditional Enhancement

export const handler = async (event) => {
  const { request, response } = event;
  const responseBody = JSON.parse(response.body);
  
  // Only enhance specific endpoints
  if (request.path.includes('/api/')) {
    // Add API-specific enhancements
    return {
      ...response,
      headers: {
        ...response.headers,
        'X-API-Version': '1.0',
        'X-Rate-Limit': '1000'
      },
      body: JSON.stringify({
        ...responseBody,
        meta: {
          version: '1.0',
          timestamp: new Date().toISOString()
        }
      })
    };
  }
  
  return response; // Return unchanged for other endpoints
};

Task Function Patterns

Error Handling and Retries

export const handler = async (event) => {
  const maxRetries = 3;
  let attempt = 0;
  
  while (attempt < maxRetries) {
    try {
      const result = await performTask();
      return {
        statusCode: 200,
        body: JSON.stringify({
          success: true,
          attempt: attempt + 1,
          result
        })
      };
    } catch (error) {
      attempt++;
      console.error(`Task attempt ${attempt} failed:`, error);
      
      if (attempt >= maxRetries) {
        // Send notification on final failure
        await sendTaskFailureNotification(error);
        
        return {
          statusCode: 500,
          body: JSON.stringify({
            error: 'Task failed after maximum retries',
            attempts: attempt,
            lastError: error.message
          })
        };
      }
      
      // Wait before retrying (exponential backoff)
      await new Promise(resolve => setTimeout(resolve, Math.pow(2, attempt) * 1000));
    }
  }
};

Schedule Formats

// Every day at 2:30 AM
cron(30 2 * * ? *)

// Every weekday at 9:00 AM
cron(0 9 ? * MON-FRI *)

// Every 15 minutes
cron(*/15 * * * ? *)

// First day of every month at midnight
cron(0 0 1 * ? *)

// Every Sunday at 6:00 PM
cron(0 18 ? * SUN *)

General Development Tips

Function Design

Keep functions small and focused
Use TypeScript for better developer experience
Follow single responsibility principle
Return consistent response formats

Error Handling

Always use try-catch blocks
Return appropriate HTTP status codes
Log errors for debugging
Provide helpful error messages

Performance

Initialize resources outside the handler
Use connection pooling for databases
Implement caching where appropriate
Batch operations when possible

Security

Validate and sanitize all inputs
Use environment variables for secrets
Implement authentication and authorization
Add rate limiting to prevent abuse

Response Function Guidelines

Fail Gracefully

Always return the original response if your enhancement fails. Don’t break the user experience.

Keep It Fast

Response functions should be lightweight. Heavy processing can slow down responses.

Be Selective

Not every response needs enhancement. Use conditional logic to enhance only when needed.

Log Errors

Log enhancement errors for debugging, but don’t let them affect the user’s response.

Task Function Guidelines

Keep Tasks Idempotent

Design tasks to handle being run multiple times safely. Check for existing work before processing.

Process in Batches

For large datasets, process items in small batches to avoid timeouts and memory issues.

Monitor and Alert

Set up monitoring for task failures and send notifications when critical tasks fail.

Handle Failures Gracefully

Implement retry logic with exponential backoff. Store failed items for manual review.

Next Steps

Local Development

Set up your development environment

Deployment

Deploy your functions to production

Environment Variables

Manage configuration and secrets

Pro Tip: Start with simple patterns and gradually add complexity. Focus on getting the core functionality working before optimizing for performance.

Overview

Getting Started

Core Concepts

Development

Code Quality

Security & Performance

​Request Function Patterns

​HTTP Method Handling

​Input Validation

​Error Handling

​Security Best Practices

​Authentication & Authorization

​Environment Variables & Secrets

​Performance Optimization

​Cold Start Optimization

​Database Optimization

​Testing Best Practices

​Unit Testing

​Response Function Patterns

​Conditional Enhancement

​Task Function Patterns

​Error Handling and Retries

​Schedule Formats

​General Development Tips

Function Design

Error Handling

Performance

Security

​Response Function Guidelines

Fail Gracefully

Keep It Fast

Be Selective

Log Errors

​Task Function Guidelines

Keep Tasks Idempotent

Process in Batches

Monitor and Alert

Handle Failures Gracefully

​Next Steps

Local Development

Deployment

Environment Variables

Request Function Patterns

HTTP Method Handling

Input Validation

Error Handling

Security Best Practices

Authentication & Authorization

Environment Variables & Secrets

Performance Optimization

Cold Start Optimization

Database Optimization

Testing Best Practices

Unit Testing

Response Function Patterns

Conditional Enhancement

Task Function Patterns

Error Handling and Retries

Schedule Formats

General Development Tips

Response Function Guidelines

Task Function Guidelines

Next Steps