Spending time upfront to imagine the unintended consequences of your actions can help improve your odds of success.

![second order](//images.ctfassets.net/vwq10xzbe6iz/55cXw6iO2S2ID6Lr33dSSW/29cbbaea3dd56578fc396da3db3656f1/second-order.png)

## Here are four ways you can apply second order thinking:
1. __There is no such thing as a free lunch.__ Accepting that few things in life are free can help you pause before jumping into what may seem like a win win outcome.
2. __And then what?__ Always ask yourself what could happen next.
3. __How will others feel?__ Examine how your actions would influence others. Imagine you assign someone a task they weren’t able to solve, you now consider getting someone else to step in to attempt to solve the problem - how would that make the original person feel? Worse yet if someone else isn’t able to solve it, you’ve wasted time and risk demoralising your teammate.
4. __Chersterton’s Fence.__ An analogy popularised by G.K. Chesteron (see below) which states that reformers should understand why an existing way of doing things exists before removing it.

## Chesterton’s Fence
> There exists…a fence or gate erected across a road. The more modern type of reformer goes gaily up to it and says “I don’t see the use of this; let us clear it away”. To which the more intelligent type of reformer will do well to answer: “If you don’t see the use of it, I certainly won’t let you clear it away. Go away and think. Then, when you can come back and tell me that you do see the use of it, I may allow you to destroy it.”
[G.K. Chesterton (1929) The Thing - Chap 4. The Drift from Domesticity](https://d2y1pz2y630308.cloudfront.net/15471/documents/2016/10/G.K.Chesterton-The%20Thing.pdf)

This principle was recently made apparent to me during a walk with my wife. I noticed a laughably poor design of an automatic water sprinkler blocked by a waste bin next to multiple other sprinklers servicing one small area. 

I laughed and instinctively took a photo of this thinking I would share it as a real world example of poor functional design.

![sprinkler-bin](//images.ctfassets.net/vwq10xzbe6iz/4Bkg5SzbUFHaj1LFwei4VZ/1b258280949f2d6fa814924ec1af8b8d/sprinkler-poor-funny.jpg)

As we were walking away, my wife pointed out to me a sign which indicated that this was a designated smoking area on top of bushland.

![sprinkler-fire-safety](//images.ctfassets.net/vwq10xzbe6iz/5qsfqc8PxU8QXYaaMsA9Pv/3ef1b918bf8d76058169555ce2e6423f/fire-safety.jpg)

If I had paused to ask why someone would apply so many sprinklers on one small area rather than laugh and take a photograph, I may have been better able to address both water wastage and fire safety concerns. 

Tips to help you examine the second and nth order consequences of your actions. Apply the principles of Chesterton’s Fence to be a proactive planner vs reactive responder.

Second Order Thinking: Unintended Consequences

People drawn to startups are often attracted to the rapid build and growth phase. But, the associated tax that comes with this is __*uncertainty*__, with common symptoms being decision making paralysis, poor incident response and unconsidered risk taking.

![decision-making](//images.ctfassets.net/vwq10xzbe6iz/65MLYg8MZeUGcK4kerw2nz/644cfc8087154f28267fad6fbdfa1f56/decision-making.png)

Here are 3 useful decision making frameworks startups can use to tackle each of these scenarios:

1. 🤷‍♂️ __What Next?__ -> [Peer Plus One Framework](#1)
2. 😱 __Oh Crap!__ -> [Incident Response Framework](#2)
3. ⚠️ __Should/ Shouldn't We?__ -> [Risk Assessment Framework](#3)

### <a name="1"></a>1. What Next? -> Peer Plus One Framework
Decision making paralysis causes people to go back and forth on the same problem and can create anxiety, animosity and demotivate teams.

![peer](//images.ctfassets.net/vwq10xzbe6iz/3CI9Usyz8VOQY0CjFM5f4q/7acc50bb9a2ca810c955adcaa1d9f833/peer.png)

The late Andy Grove (Intel CEO) in his seminal 1983 book [High Output Management](https://www.amazon.com.au/High-Output-Management-Andrew-Grove/dp/0679762884) laid out two decision making frameworks to help drive a decision and break paralysis under two scenarios:
a. Technical/ Operational decisions
b. Complicated/ Strategic decisions

#### A. Technical/ Operational decisions
Andy made the syllogism that: 
1. People are most technical when they start their careers and are on the frontline engaging with customers or problems daily;
2. Managers who make decisions are further away from technical expertise and customers;
3. Peer groups are bad at coming to consensus and paralysed by fear of accountability

__Solution (Peer Plus One):__
To solve this, Andy supported having technical peer groups come up with solutions and options but someone one level senior to ratify or veto the decision. He coined this “Peer Plus One”.

#### B. Complicated/ Strategic decisions
For bigger, more complicated decisions (e.g. strategic or high risk), Andy proposed following a decision making framework all teams could use and answering 6 key questions in advance. It is summarised below with a problem scenario:

__Problem:__
Intel decided to expand its Philippine manufacturing plant but did not know where. Options included a more expensive space next to the existing site to take advantage of existing infrastructure or purchasing a new cheaper plot of land nearby that would require more construction. 

They were stuck in decision making paralysis. Let’s apply the framework below:

| Question | Example |
| ----- | ----- |
| 1. What decision needs to be made? |  Build a site next to an existing plant or purchase and build a new building in a new location? |
| 2. When does it have to be made? | Plant needs to be operational in 2 years so construction must begin within a month |
| 3. Who will decide? | A team that comprised project managers of the construction and operations team. Decision heavily impacted both teams so getting key representatives to evaluate options was important.  |
| 4. Who will need to be consulted prior to making the decision? | Key staff from both teams to be consulted on both options and implications |
| 5. Who will ratify or veto the decision? | Common report in this case being the CEO. Again this follows the “Peer Plus One” solution to drive the teams to come up with a solution | 
| 6. Who will need to be informed of the decision? | Chairman |

In addition to expedited decision making, a consistent framework gives the teams that come up with the options comfort that their decisions are assessed based on merit with key people consulted.

### <a name="2"></a>2. Oh Crap! -> An Incident Response Framework
Incidents are inevitable. But, reactionary decisions can be ineffective, create further unintended negative consequences and demotivate people.

![incident](//images.ctfassets.net/vwq10xzbe6iz/12c5E3mrpkiuonYX8SXd2c/17eb65bb40385cafe5b99212cc4bc15d/incident.png)

An effective incident response should seek to solve the real problem in a timely manner. Here is an framework applied to a scenario problem:

__Problem:__
The Head of Marketing signed a multiyear $2m marketing software license without seeking CEO/ Board approval. The Head of Marketing is also a sibling of the CEO/ Founder. While within the marketing teams budget, the software was deemed to be non-critical and an unjustified business expense at this stage.

| Stage | Question | Example |
| ----- | ----- | ----- |
| 1. Define Problem  | What incident needs to be resolved? | Significant unauthorised procurement by a member of the leadership team |
| 2. Investigate | What is the scope of the investigation required and who will lead? | Find out who authorised what and why. What frameworks were in place. Decide whether CEO should be removed from investigation due to conflict | 
| 3. Freeze | What immediate action should be done to minimise the impact? | Curtail delegations in procurement across all teams? Not clear if this is one-off or systemic | 
| 4. Remediate | How can we remediate/ resolve the incident? | Seek legal advice on validity of software license |
| 5. Action | What action should be taken following investigation findings? | What action should be taken on the Head of Marketing (formal notice/ termination)? Is an overhaul of the procurement procedure warranted? |
| 6. Message | What message should be communicated and to whom? | Does this warrant an all staff message on procurement policy and outcome of investigation or just to the marketing team? |

Following a consistent framework can help people remain calm and assess the underlying problem. Across all stages it is important to be clear on timeline and assign clear responsibilities and next steps. 

### <a name="3"></a>3. Should We/ Shouldn’t We? -> Risk Assessment Framework
Poor risk taking can lead to negative consequences and similarly missed growth opportunities. Upside gains and downside risks from decisions are often shared disproportionately across teams. This can lead to poor communication and resentment.

![risk](//images.ctfassets.net/vwq10xzbe6iz/1PJ39gRZFbxpICuLz5pNS6/ed103945ebca7553f5602ffa46adbff1/risk.png)

Risk is often associated with danger and hazards. Risk management should not be confused with risk avoidance. The word “Risk” has its origins in the early Italian verb “riscare” meaning “to dare or to venture upon and take a chance”. A clear risk assessment framework can help teams make informed decisions in pursuit of growth.

Here is a simple risk assessment framework with an applied problem:

__Problem:__
The sales team wants to offer a guarantee of software uptime delivery for an enterprise account and will promise a refund and added technical support if not achieved. The sales team believes this will help get the deal over the line. The delivery team is not confident of achieving the uptime and does not currently have resourcing for technical support. The teams are at an impasse.


| Stage | Question | Example |
| ---- | ---- | ----- |
|1. Identify | What are the key risks? | Uptime is not achieved. | 
| 2. Consequence | What is the consequence of the risk occurring? | 1) Customer requests refund. 2) Reputational damage from customer telling market about inability to deliver uptime | 
| 3. Likelihood | Assuming the risk occurs what is the likelihood of the consequence? | 1) Medium: customer may ask for refund but unlikely to need technical support. 2) Low: unlikely customer would tell broader industry | 
| 4. Controls | What controls can we put in place to limit the consequence? | Split the financial refund (if any) across the cost centres across the sales and delivery team. | 
| 5. Assessment | Assess the residual risk with controls in place and determine if risk/ reward is acceptable. | Financial risk is lowered as sales team agrees to take less future commission if delivery team unable to achieve result. Reputational risk is low and customer deemed unlikely to tell broader industry. The gain of signing this enterprise account will have a greater upside on brand. |

Beyond minimising downside risk, an effective risk assessment framework can benefit startups with increased:
- __Confidence__: provides entire company with greater confidence towards strategic objectives while managing blind spots
- __Communication__: carefully considering and communicating risks/ reward helps improve team collaboration and drives faster decision making 
- __Compliance__: being aware of and meeting legal and regulatory requirements of relevant decisions


3 useful decision making frameworks startups leaders and boards can use to tackle uncertainty in startups: 1) Peer Plus One Framework; 2) Incident Response Framework; 3) Risk Assessment Framework.


3 Decision Making Frameworks Startups can use to Navigate Uncertainty

A Director is a person generally appointed by a company’s shareholders to attend, participate and vote in Board meetings and oversee [the role and function of a Board](https://mannhowie.com/board-role).

## 5 Basic Fiduciary Duties of a Director
> A Director has a ‘fiduciary relationship’ with a company which is a duty of fidelity and trust to always act in the best interests of the company as a whole and not oneself or a third party. 

In performing their role, a Director is subject to five key duties and obligations under corporation law, and the company’s constitution:

1. ✅Good Faith & Best Interests
2. ✅Act for Proper Purpose
3. ✅Avoid Conflicts of Interest
4. ✅No Misuse of Position or Information
5. ✅Exercise Care & Diligence
  
## Acting with Loyalty and Good Faith
The first four fiduciary duties relate to acting with loyalty and good faith. Below is a summary with breach examples:

| 	Fiduciary Duty	 | 	Description	|	Breach Example	|
| ------------------ | --------------------------	| ------------------------------------ 	|
| __1. Good Faith & Best Interests__ | Decision making on behalf of the best interests of the company as a whole | ❌ Vote influenced by an appointee or major shareholder |
| __2. Act for Proper Purpose__ | Doing things for their intended purpose in the interests of the company as a whole rather than a collateral benefit | ❌ Issuing shares to dilute a shareholder vs raising proceeds for a valid purpose |
| __3. Avoid Conflicts of Interest__ | Must not place oneself in actual or potential possibility of conflict | ❌Not disclosing material interests in a takeover company or competitor |
| __4. No Misuse of Position or Information__ | Must not misuse position to gain an advantage for oneself or someone else or to cause detriment to the company | ❌Insider trading. Setting up a competing company. Phoenix activities |

## Exercising Care and Diligence
Simply acting with loyalty and good faith is not a sufficient liability defence. A Director must also act with skill, care and diligence in overseeing strategy, risk and management of a company. 

At a minimum a Director should exercise care and diligence across these four areas:
1. ✅Familiarity with business
2. ✅Read Board papers
3. ✅Make enquiries
4. ✅Board approvals

| 	Care & Diligence	 | 	Description	|	Breach Example	|
| ------------------ | --------------------------	| ------------------------------------ 	|
| __Familiar with business__ | Become and stay on top of the business and financials | ❌Not understanding how business operates. Insufficient accounting knowledge. |
| __Read Board papers__ | Request and read all Board papers in advance, carefully review Board minutes | ❌Relying on opinions of other Directors. Disputing minutes in hindsight. |
| __Make enquiries__ | Question management and seek external advice on issues that have significant potential to harm company | ❌Relying on management reports. Lack of reported risks |
| __Board approval__ | Important strategic decisions, contracts and announcements should be brought to Board  | ❌No risk appetite framework. Not reviewing material market announcements |

## Statutory Duties & Liabilities
In addition a Director faces statutory duties and liabilities dependent on the legal jurisdiction:

| Statutory Duty/ Liability | Breach Example |
| --------- | ---------- |
| __Insolvent Trading__ | ❌Incurring further debts of any kind if a company is unable to pay all its debts as and when they become due and payable (including employee pay) |
| __Continuous Disclosure__ | ❌For listed companies not immediately disclosing a material contract loss |  
| __Tax Laws__ | ❌Un-remitted employee withholding tax or retirement contributions | 
| __Competition & Consumer Law__ | ❌Cartel behaviour. Truth in advertising |
| __Work Health & Safety Law__ | ❌Breach of work health and safety regulation (face imprisonment for reckless breaches) |
| __Anti-Discrimination Law__ | ❌Discrimination in relation to age, disability, union, race, sex etc |
| __Environmental Law__ | ❌Federal and state environment protection legislation |

## What are the Consequences of Breach of Directors’ Duties and Laws?
#### __Criminal sanctions__  👮
Imprisonment dependent on the severity of the outcome and if directors found to have acted dishonestly or recklessly in failing to comply with duties. Not protected under insurance and indemnification

#### __Civil sanctions/ Disqualification__ ⚖️
Liable for civil penalties including fines, class action lawsuits and disqualification as a director for long periods of time 

#### __Commercial/ Brand damage__ 📰
Reputational damage can damage the company as a whole well beyond the penalties imposed on its directors 

## How can Directors Best Protect Themselves Against Liability?
A Director should at a minimum follow these seven steps:

- ✅Always act in __good faith__ and best interests of the company as a whole and for proper purpose
- ✅Avoid/ disclose __conflicts of interest__
- ✅Exercise __care and diligence__ by reading Board papers, making proper enquiries and staying up to date with the business and industry
- ✅Engage __external advice__ where required but always make independent assessments
- ✅Avoid __insolvent trading__
- ✅Be familiar with the __laws of your industry__
- ✅Obtain __insurance and indemnification__



Five basic fiduciary duties of a Board member with breach examples. What are the consequences of a breach of Directors' duties and laws? How can Directors best protect themselves against liability?

What are the Fiduciary Duties of a Director?

![Be Kind](//images.ctfassets.net/vwq10xzbe6iz/78sYaFCUwcf69nSbCQi40s/db946e2bc139cb2454ad38e102a434a6/Screen_Shot_2020-04-07_at_4.59.05_pm.png)

















































.

How can you support yourself and others during the current Coronavirus pandemic?

How to Get Through the Coronavirus?

This walkthrough will show you how to deploy a containerized Node.js app to Amazon Web Services and also assign a secure custom domain. We will be applying the following technologies and tools:
- Application: Node.js Express
- Container: Docker and Github
- Cloud Compute: AWS EC2 Ubuntu
- Domain: AWS ElasticIP, AWS Route53 and Namecheap Domains
- HTTPS: Nginx and Let's Encrypt

Click here for a [link to the github repo](https://github.com/howardmann/express_ec2)

## Summary Steps
1. [Create Node App with Dockerfile and deploy to Github](#1)
2. [Create EC2 Instance](#2)
3. [SSH into EC2 Instance](#3)
4. [Setup and Install EC2 Dependencies](#4)
5. [Create Route 53](#5)
6. [Purchase Namecheap Domain](#6)
7. [Setup Nginx and HTTPS](#7)

## <a name="1"></a>1. Create Node App with Dockerfile and deploy to Github
Create a simple Node Express app with the following folder structure
```bash
src
  L index.js
Dockerfile
package.json
```
Create a simple hello world web app.
```javascript
// src/index.js
let express = require('express')
const PORT = process.env.PORT || 3000

let app = express()

app.get('/', (req, res) => {
  res.send('hi')
})

// Custom 404 route not found handler
app.use((req, res) => {
  res.status(404).send('404 not found')
})

app.listen(PORT, () => {
  console.log(`Listening on PORT ${PORT}`);
})
```
Create Dockerfile which will install specific version of node, install dependencies, expose relevant port and run start command.
```Dockerfile
# // Dockerfile

# Select node version and set working directory
FROM node:8-alpine
RUN mkdir -p /usr/src/app
WORKDIR /usr/src/app

# Install app dependencies
COPY package.json /usr/src/app
RUN npm install

# Bundle app source
COPY . /usr/src/app

# Expose publc port and run npm command
EXPOSE 3000
CMD ["npm", "start"]
```
Test locally by building the Docker image (check Docker desktop app is running).
```
docker build . -t <YOUR_APP_NAME>
```
Test locally by running the app. Expose port 3000 (we will later use Nginx reverse proxy to send HTTPS port 80 requests to localhost:3000)
```
docker run -p 3000:3000 <YOUR_APP_NAME>
```
Commit and deploy to a Github repo where we will later clone from our EC2 Instance.
```bash
git add .
git commit -m "initial commit"
git remote add origin "<YOUR_GITHUB_REPO_URL>"
git push origin master
```

## <a name="2"></a>2. Create EC2 Instance
Create a new AWS EC2 Instance and set a fixed public IP.
- Login to AWS Management Console
- Select EC2 and select Launch Instance
- Choose latest Ubuntu Server
- Setup security groups including HTTP port 80 and HTTPS
![security](//images.ctfassets.net/vwq10xzbe6iz/5dRssqwYvnxOMyFVIOLnX/ba405930771458831715c7e1bfacfceb/security.png)
- Create instance and create name of private key and download (you will need this to ssh login to your cloud instance)
- Create Elastic IP and associate to your instance. This will keep a fixed public IP address for your instance
![elasticIP](//images.ctfassets.net/vwq10xzbe6iz/5AVVA2E0UzUqhGcQfDmWBa/f2c18d8996125fe2534695aac49ed83d/elasticIP.png)

## <a name="3"></a>3. SSH into EC2 Instance
Login to our newly created EC2 Instance via SSH.
- Find and select your running EC2 instance and click Connect then follow the instructions
![ssh](//images.ctfassets.net/vwq10xzbe6iz/226QhCsKBmdu81LQdB2mqF/ad12eddc2891009eb7e04b1732b9b660/ssh.png)
- Download your private key and run the following command to allow read ownership `chmod 400 <YOUR_PRIVATE_KEY_NAME>.pem`
- If you forget your private key you will not be able to easily SSH back in
- To asssist workflow create a folder named SSH in your local directory and include in .gitignore. You can keep your private key here and a textline of the SSH script. Then come back to this folder whenever you need to SSH in.

## <a name="4"></a>4. Setup and Install EC2 Dependencies
Clone github repo, install Docker, build image and run new image.
- SSH into instance (follow instructions by clicking on "Connect" in the instance). See AWS console to find exact ssh command, ensure you are in the root directory with your private key
```
ssh -i "<YOUR_PRIVATE_KEY_LOCATION_FILE.pem> <YOUR_USER>@<YOUR_AWS_PUBLIC_DNS>
```
- Once login successful, clone your github repo
```
git clone <YOUR_GITHUB_REPO_URL>
```
- Install Docker
```
curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh
```
- Run Docker without sudo in ubuntu
```
cat /etc/passwd | grep ubuntu
sudo usermod -aG docker ubuntu
```
- Exit EC2 Instance and SSH back in and check you can run docker without sudo
```
docker ps
```
- Rebuild the Docker image (similar to what we did when testing locally)
```
docker build . -t <YOUR_APP_NAME>
```
- Run the Docker image in detatched mode `-d` which will let it continue to run in the background. Set restart as always so it will run when the EC2 instance is restarted.
```
docker run --restart always -d -p 3000:3000 -t <YOUR_APP_NAME>
```
- If you exposed port 3000 in the EC2 instance you should now be able to see the application if you visit the public DNS
- To get the container id
```
docker ps
```
- To see container logs
```
docker logs <YOUR_CONTAINER_ID>
```
- To stop the container
```
docker stop <YOUR_CONTAINER_ID>
```

## <a name="5"></a>5. Create Route 53
Setup AWS Route53 for DNS forwarding from our custom domain to relevant EC2 Instances.
- Search for Route53 Service in AWS Management Console
- Get started and create a hosted zone
- Create the hosted zone and enter the domain name you wil purchase from namecheap
- Once clicked you will see the `NS` records. Copy a record of these
![ns](//images.ctfassets.net/vwq10xzbe6iz/6LJAjqKCGYpuSuZlf3WjbB/fffb15c71174129a88101511f1835974/ns.png)

## <a name="6"></a>6. Purchase Namecheap Domain
Purchase custom domain and point to AWS Route 53.
- Purchase domain from namecheap and then set the Custom DNS to each of the `NS` records from Route53
![namecheap-dns](//images.ctfassets.net/vwq10xzbe6iz/1JwQpYnZCGr0qHnfNqq18G/4e156a31c53eddf89e57491a67c74c89/namecheap-dns.png)
- Connect your Route 53 to Namecheap. Copy the public "IPv4 Public IP" of your EC2 Instance. Hit create record set button and create 2 records below. One set name as empty while latter prefi with *. Copy into value the IPv4 Public IP address into reach
![recordset](//images.ctfassets.net/vwq10xzbe6iz/5HDmGeJ5OnLA7DRSZfF0Qe/adf6dac31f91435eecebf221a509d3fa/recordset.png)

## <a name="7"></a>7. Setup Nginx and HTTPS
Nginx reverse proxy port 80 to our Docker instance and setup secure HTTPS.
- SSH into EC2 Instance and setup nginx webserver
```
sudo apt-get install nginx
```
- Install certbot and build certificate
```
sudo apt-get install software-properties-common
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get install python-certbot-nginx
```
- Make the certificate with the given domain names you have purchased. It may prompt for email
```
sudo certbot --nginx -d example.com -d www.example.com
```
- Remove default config file
```
sudo rm /etc/nginx/sites-enabled/default
```
- Create new file 
```
cd /etc/nginx/sites-available/
sudo touch node
sudo vim /etc/nginx/sites-available/node
```
- Paste the following code in the file and replace example.com with your purchased domain and 3000 with your Node port
```
server {
  listen 80;
  listen [::]:80;
  server_name example.com www.example.com;
  return 301 https://$server_name$request_uri;
}

server {
  listen 443 ssl http2 default_server;
  listen [::]:443 ssl http2 default_server;
  server_name example.com www.example.com;

  location / {
    proxy_pass http://localhost:3000;
  }

  ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
  ssl_session_cache shared:SSL:5m;
  ssl_session_timeout 1h;
  add_header Strict-Transport-Security “max-age=15768000” always;
}
```
- Symlink config file to sites-enabled 
```
sudo ln -s /etc/nginx/sites-available/node /etc/nginx/sites-enabled/node
```
- Restart nginx and apply
```
sudo service nginx restart
```
- If nginx error due to port 80 already in use. Find, kill and restart nginx
```
sudo fuser -k 80/tcp
sudo service nginx start
```

That's it. 

You should now be able to visit your custom domain and be pointed to your Dockerized Node App on HTTPS.


Walkthrough to deploy an Express.js app to AWS EC2 with HTTPS and custom domain using Express, Docker, AWS EC2, AWS Route53, Namecheap, Nnginx and Let's Encrypt. 

How to Deploy a Node App to AWS EC2

Understanding the role of the Board of Directors and their interplay with Management can help you as an Executive make better strategic decisions.
1. [What is the role of the Board of Directors?](#role)
2. [What are the functions and responsibilities of the Board?](#function)
3. [What are the differences between Governance and Management?](#management)

## <a name="role"></a>1. What is the role of the Board of Directors?
To oversee and direct a company to deliver long term value for shareholders while meeting stakeholder expectations.
![board-role](//images.ctfassets.net/vwq10xzbe6iz/521sSM4bGcv8dMlcfIoeCi/27dead702d9ade7376f59a9631ebf909/board-role.JPG)

Companies basically consist of three parts:
1. Shareholders who provide the money and own the company;
2. Directors of a Board who act on behalf of shareholders to oversee and direct management; and
3. Management who perform day-to-day work and execution

![company-three-groups](//images.ctfassets.net/vwq10xzbe6iz/55boJ2GxC8gklHTYvEROis/b7812e8ac792ba8192686d42fadcaf94/company-three-groups.JPG)

A Board works to achieve its stated objectives through what is known as corporate governance. Corporate governance involves a set of systems, frameworks, strategies and processes to direct and control a company to meet the reasonable expectations of stakeholders.

![corporate-governance](//images.ctfassets.net/vwq10xzbe6iz/2UcDT2Y55Tlai9BDim0dBS/c077e68ed75f483ea2a75386f57a1399/corporate-governance.JPG)

The first known example of a Board was the East India Company in the 1600s which began with 218 shareholders following Royal Charter from Queen Elizabeth I. Its corporate governance structure consisted of a General Court which had voting rights and a Court of Directors made responsible for the running of the company with policy decisions requiring ratification by the General Court ([reference](https://www.kozminski.edu.pl/fileadmin/Kadra_i_Badania/Upowszechnienie_Nauki/Working_papers/dobija_d04_2009.pdf)).

#### East India Company Organizational Structure 1600
![eic3](//images.ctfassets.net/vwq10xzbe6iz/5ltb50L3mYMlf0yGyWlrpF/5f75d8cd9db1ff4a3e4e86d62db57257/eic3.jpg)
*[Source: shrimpamongwhales - organizational structure and army of the east india company](https://shrimpamongwhales.com/2018/01/07/organizational-structure-and-army-of-the-east-india-company/)*

## <a name="function"></a>2. Functions and Responsibilities of the Board
The Board is responsible for overseeing 2 main functions:
1. 💵Strategy and Performance; and
2. 💣Compliance and Risk

![board-function](//images.ctfassets.net/vwq10xzbe6iz/48Nm3cufQJhhP6KMPbqch8/9f8ae3c6c55852819289b069c4353202/board-function.JPG)

## <a name="management"></a>3. Governance vs Management
The role of management is to run the company and that of the Board is to see that it is being run well and in the right direction. This line is often blurred.

Directors should act only as a group and make joint decisions which are communicated to management and stakeholders (as they are all individually and collectively liable).



|    Area  | Management     | Board     |
| ---------- | ---------- | ---------- |
| __Strategy__      | Develop and recommend strategies and initaitives supported by research       | Work with and through CEO and management to develop high level strategy and goals       |
| __Performance__       | Execute, measure performance and deliver timely information to Board       | Oversight of management and company performance vs expectations set for shareholders       |
| __Resources__       | Identify and request resourcing/ budget to achieve targets       | Appoint,evaluate, guide and support CEO       |
| __Risk__       | Ensure risks are managed and reported       | Set risk appetite, framework and enquire vs management       |
| __Accountability__       | Keep Board informed, present options and recommendations       | Shareholder and stakeholder engagement. Act as external advocates e.g. fundraising and investor relations       |




What is the role of the Board? What are their functions and responsibilities? What are the differences between Governance and Management? Understanding the role of the Board of Directors and their interplay with Management can help you as an Executive make better strategic decisions.

The Role and Functions of Board of Directors

Cognitive biases can negatively impact your ability to think critically and make informed decisions. Once you are aware of them, it will help you identify and navigate them.

Here is an explanation of the 4 main types of cognitive bias, some examples and how you can navigate them:
1. [Survivorship Bias](#survivorship)
2. [Confirmation Bias](#confirmation)
3. [Framing Bias](#framing)
4. [Groupthink](#groupthink)

## <a name="survivorship"></a>1. Survivorship Bias
> Focus on the traits of the successful whilst ignoring the failures.

![survivorship-bias](//images.ctfassets.net/vwq10xzbe6iz/t9fd2snGayd6dZM2Dn9Js/5e615d3df42fa017582a58b9f06a0e57/survivorship.JPG)
This involves limiting our analysis to instances that have passed a success hurdle and not analysing those that didn’t pass the hurdle. This commonly occurs when we adopt key learnings from successful case studies yet remain blind to the unsuccessful instances who may have also followed the same learnings. 

### Examples
The famous [WWII case study](https://www.researchgate.net/publication/254286514_Abraham_Wald's_Work_on_Aircraft_Survivability) involves mathematician Abraham Wald who was tasked with identifying where to place more armour on fighter planes. The officers data of bullet holes in returning planes supported placing more amour on the fuselage vs the engine. However, Wald’s insight was to ask where the bullet holes weren’t - i.e. the engine. The surviving planes had fewer hits to the engine because those that were hit didn’t return.

A modern example would be to look at a customer acquisition funnel with a 10% activation rate. Common analysis would be to take key learnings from the behaviour and personas of this group to further lift activation. However, the greater insight would be to analyse the other 90% and ask why aren’t they activating? The latter is more challenging and often involves less access to data, but the payoff is greater.
 
### How to Navigate?
Ask questions about what other data and groups are missing. Identify the success hurdle and ask why others have not passed it.

## <a name="confirmation"></a>2. Confirmation Bias
> Focus on data to promote our existing beliefs.

![confirmation-bias](//images.ctfassets.net/vwq10xzbe6iz/3Fwt3vluPTrXkA41Yfj6Dx/585fec98fc5647b58a14f4d568b973c7/confirmation.JPG)
This involves seeking out information that validates our existing views and prior commitments. We also discount other information that may invalidate our views. Confirming evidence makes us feel good and people do what makes them feel good. The counter approach is the scientific method, which attempts to ask questions first before gathering evidence to either support or reject a hypothesis. The former is easier and faster, the latter is harder and time consuming.

### Examples
The CEO has a new idea to launch a new product and instructs a team to conduct market research and competitor analysis on the feasibility of this product. The market research team is limited in scope and risks being urged to validate the success of the CEO’s new product idea. A better task for the team would be to investigate what the best product would be to solve a particular problem.
 
### How to Navigate? 
Try and identify if there is a pre-existing belief (yours or otherwise). Reflect on information you have rejected. Ask others with a different viewpoint.

## <a name="framing"></a>3. Framing Bias
> Solving a problem based on the context it is presented.

![framing-bias](//images.ctfassets.net/vwq10xzbe6iz/1RJWOsPkQawJKKxYk8oIQM/6ee3c51d2e488ae5ecd40e1abd233596/framing.JPG)
The specific context a problem is framed/ presented can influence the options and choices available.

### Examples
The problem of low company profitability can be either framed as a need to cut costs or to increase revenue. The way the problem is framed will influence the options available (i.e. fire and restructure or enter new markets).

### How to Navigate? 
Ask what is the ultimate problem we are trying to solve. For example, ask what the outcome would be if we solved this problem. See if there are other solutions to achieving the same outcome.

## <a name="groupthink"></a>4. Groupthink
> The desire for group harmony leads to poor decision making.

![groupthink](//images.ctfassets.net/vwq10xzbe6iz/3BvESluOEJuRmYVODq44U1/12de08589e23649ad287ff3abba0912b/groupthink.JPG)
People tend to avoid conflict, particularly in the presence of a majority and people of authority. People assume others have made informed decisions and fear the risk of looking un-knowledgable in front of others. 

### Examples
The term groupthink arose from the [case study](https://www.bassberry.com/wp-content/uploads/Effective_SEC_Rulemaking_Letters2.pdf) of the failed US Cuba Bay of Pigs invasion. In 1961, the CIA presented to President Kennedy a Cuba invasion plan formulated under the previous administration. Kennedy accepted it and early objections were dismissed and eventually no objections or alternatives arose. Kennedy learnt from this and a year later during the Cuban Missile Crisis intentionally absented himself from initial meetings to encourage free discussion. Two teams were created to evaluate the options before presenting to Kennedy. 

### How to navigate? 
Be clear on the objective and values. Encourage other views to solve the objective.



Cognitive biases can negatively impact your ability to think critically and make informed decisions. Here is an explanation of the 4 main types of cognitive bias, some examples and how you can navigate them.

4 Types of Bias Affecting Your Decision Making

> [Click here for github repo of todoapp](https://github.com/howardmann/react-projects/tree/master/todoapp) and [here for live demo of app](http://mannhowietodoapp.surge.sh/)

A visual framework to use for applying React & Redux using the classic Todo App teaching exercise. 
## 1. Overview of TodoApp
While simple, our Todo App covers all the core frontend features of: CRUD, filtering and live reload.
![1. TodoApp](//images.ctfassets.net/vwq10xzbe6iz/1lAWM6TneRs77W6nNoELbK/4b6d1ff28385d2e3e1019160b0cf82da/1._TodoApp.png)

## 2. Break Into Components
Our root App component will contain all the state and logic and will pass this down to its child components.
![2. Components](//images.ctfassets.net/vwq10xzbe6iz/56Zz924eNEdkXu56HSX6Aj/2e6a7456392eaf86bb6e34560a624677/2._Components.png)
Separate each child component by a given responsibility:
1. `<APP/>` Stores our state, actions and renders all immediate children
2. `<NEW_TODO_FORM/>` Accepts text input and triggers "ADD" todo action
3. `<FILTER/>` Changes what items we want to display ("SHOW_ALL" or "SHOW_DONE")

> *Optional: Do not separate out `<NEW_TODO_FORM/>` and `<FILTER/>` into children components if logic is simple and instead keep within `<APP/>`*

4. `<TODOLIST/>` maps over filtered todo items and renders either `<TODO_ITEM/>` or `<EDIT_TODO_FORM/>`
5. `<TODO_ITEM/>` renders the item and includes key action handlers such as mark as done, edit and delete
6. `<EDIT_TODO_FORM/>` renders the input as an input form with its own internal state. Note: we create this as a separate component as we require the feature to undo the edit and only update the state if "Update" button is clicked

## 3. Data Down Actions Up (DDAU)
React follows the principle of Data Down Actions Up (DDAU):
![3. DDAU](//images.ctfassets.net/vwq10xzbe6iz/6LpqSeupvNnkf6xbZahPwr/c5fcafdcebed3460fbcc418ccfe519e2/3._DDAU.png)
1. All/ Majority of application state is stored in a root parent component as a POJO. Also, action callbacks to change state are stored in the parent component
2. Parent then passes down the relevant state and action callbacks to its children as `props`
3. Children components render the `props` and listen for UI events to trigger action callbacks
4. Parent components then execute the callback functions to change state
5. React then does the heavy-lifting to update the UI only for the state that has changed


## 4. Create our State (aka: the source of truth)
All dynamically rendered content should be kept in the state:
![4. State](//images.ctfassets.net/vwq10xzbe6iz/3qe9e2C2w5xq5eCbI8b25C/5b397126cbf13ba0cd118e11fb782060/4._State.png)
All items should be kept in an items array as a single source of truth. 

To filter data, create a helper function to render the items array based on what filter type is in the state - ***Do not duplicate state data***.

Decide whether a `<TODO_ITEM/>` vs. `<EDIT_TODO_FORM>`is rendered by creating an array of items that are marked as edit `isEdit: [4...]`.

## 5. Identify Action Handlers
Identify key UI locations where we will trigger changes to state:
![5. Actions](//images.ctfassets.net/vwq10xzbe6iz/57rSFI8h4I07xjsV3IHqzB/f55ba6cca39dfa591ebe13d1a9f4e182/5._Actions.png)

## 6. Separate out Business Logic
Create a reducer which will be the black box handling our business logic. This is the basic principle of Redux:
![6.Reducer](//images.ctfassets.net/vwq10xzbe6iz/43yPgsyUVgpOfNGuLAsOPF/c1f81dac738207400f6235ebe9548d91/6.Reducer.png)
The reducer accepts three paramaters:
1. `prevState`: the entire state that this reducer is responsible for handling
2. `action.type`: simple text instruction for our reducer to execute relevant function e.g. `"ADD_TODO"`
3. `action.payload`: payload options our action.type and function requires to modify state

A new state is then created without mutating previous state. This business logic is easy to unit test and independent of framework. We then require the reducer to update the state of our components.

*Fin*
***

#### Further reading materials with code:
- [React tutorial](https://reactjs.org/docs/hello-world.html)
- [Redux tutorial](https://redux.js.org/basics/basic-tutorial)
- [You don't need redux](https://medium.com/@dan_abramov/you-might-not-need-redux-be46360cf367)
- [Code your own combineReducer](https://blog.jakoblind.no/code-your-own-combinereducers/)




How to structure your next web project using React and Redux principles. A visual framework template you can use. 

Learn React - A Visual Explanation

Uncle Bob's famous [Clean Architecture](https://blog.cleancoder.com/uncle-bob/2012/08/13/the-clean-architecture.html) is a way to write resilient software.

Resilient software is divided into layers, underpinned by business logic and is independent of technologies. It should be:
1. **Independent of Frameworks**. Libraries and frameworks should be treated as tools and not dependencies.
2. **Testable**. Can be tested without external dependencies.
3. **Independent of UI**. You can easily switch CLI for Web or RasberryPi.
4. **Independent of Database**. Switch out SQL for MongoDB.
5. **Independent of any external agency**. Business rules don't know anything about outside world.

![The Clean Architecture diagram](https://blog.cleancoder.com/uncle-bob/images/2012-08-13-the-clean-architecture/CleanArchitecture.jpg)

In practice, choice of technology should be the last decision you make or code you write (e.g. database, platform, framework).

By following clean architecture, you can write software today that can be easily switched out for different technologies in the future.

## Practical Example of Clean Architecture in Node.js
This is an example of a simple CRUD application with layered software and separation of business logic vs technology. 

It is a simple API for creating `students` and `teachers` and includes validation, persistence and UI. It includes examples using different interfaces (CLI and Web), databases (in memory, MongoDB), and libraries (validation).

[Click here for github repo.](https://github.com/howardmann/clean-node)

*Note: this application is different to the Clean Architecture diagram above but attempts to achieve the same outcome.*

### Software layer overview
The application is separated into three layers. Inner layers cannot depend on outer layers and outer layers should only depend one layer in:

- **Inner Layer**
  - **Models**. Handles the creation, validation and reading of our entities (students and teachers). Note that this should be custom logic and not include the DB implementation of models (e.g. in Mongoose DB ORM, their models should be encapsulated in the DB layer below). Our model schemas live here. 
  - **DB**. Our choice of DB (in memory, MongoDB, SQL), this is independent of the model. Note that in Clean Architecture this is considered an outer layer framework, but for practical applications I find it easier to place it inner and have the data-access layer depend on it rather than injecting it in.
- **Middle Layer**
  - **Data-Access**. Handles transfer between the DB (like an ORM). Depends on the model to validate and create the entity in DB. The key is to have a consistent & custom API that all outer layers communicate with. Testing here will ensure that replacing or using multiple DBs doesn't break anything further upstream. 
- **Outer Layer**
  - **Drivers**. Represents the UI or interface (Web or CLI). It communicates only with the data-access layer.

### Example application structure
```bash
============= INNER LAYER =====================================================================
models                    // create new entity by validating payload and returning new read only object 
  L student
    L index.js            // dependency inject schema/ validation library
    L index.test.js       // tests makeStudent()
    L student.js          // simple model takes info, validates and returns read only object
    L student-schema.js   // student validation schema
  L teacher
    L index.js
    L teacher.js
    L teacher-schema.js
  L validator             // wrapper around JOI validation library
    L index.js            // consistent API if ever to switch out a new validation library
    L index.test.js       // tests for validation schema for all models

db                        // db connection and adapter
  L memory                // in memory JSON
    L students.js         
    L teachers.js         
  L mongodb               // mongodb alternative
    L connection.js       // connection library
    L seeds               // seed library
      L students-seeds.js // async seed students db
    L models
      L student.js        // models specific to mongodb. this is different to our business logic models which handle tests and validation

============= MIDDLE LAYER =====================================================================
data-access               // think of it as our internal ORM (logic for our use-cases lies here)
  L students-db           
    L index.js            // other controllers and drivers rely on this API (findStudent, listStudents, addStudent)
    L memory              // in memory
      L index.js          // expose the memory implementation of findStudent, listStudents, addStudents
      L serializer.js     // serializes to DB specific properties (e.g. serial > id, year > grade)
    L mongodb             // mongodb ORM
      L index.js          // uses mongoose implementation of findStudent, listStudents, dropAll etc.
      L serializer.js     // serializes _id to id
    L postgresql          // TODO: Illustrative
    L airtable            // TODO: Illustrative
  L teachers-db           // per students-db above

============= OUTER LAYER =====================================================================
drivers
  L cli                   // cli driver depends on data-access students-db
  L webserver             // express web-server
    L routes
      L index.js          // routes paths
      L students.js       // requires our data-access students-db
      L teachers.js       // per above
    L server.js
```

### Practical approach
In practice, we can defer technology decisions by writing our application in the following order:
1. Start with models, schema and validation. Write test spec.
2. Defer DB decision by using in-memory JSON store
3. Create a data-access API that depends on model and in-memory DB. Write test spec.
4. First tech decision: UI interface (e.g. web or CLI). Depend on above data-access layer. Write integration test spec. 
5. Second tech decision: DB choice (MongoDB, SQL). Replace in-memory DB store. Write data-access methods specific to the DB choice. Ensure previously written test specs pass.

### Models
Our model is a simple factory function that validates a payload (dependency injected validator) and returns a new object with getters.

```javascript
// models/student/student.js
let buildMakeStudent = function(studentValidator) {
  return ({
    name,
    age,
    grade,
    prefect = false
  } = {}) => {
    let {error} = studentValidator({name, age, grade, prefect})
    if (error) throw new Error(error)

    return {
      getName: () => name,
      getAge: () => age,
      getGrade: () => grade,
      isPrefect: () => prefect
    }
  }
}

module.exports = buildMakeStudent
```
While the model schema is dependent on a validation library and breaks the Clean rules, I find it easier to understand the model by having the schema inside the model. (Note: see the repo for an example of how the validator could be separated into its own software entity).

```javascript
// models/student/student-schema.js
let Joi = require('joi')

module.exports = Joi.object().keys({
  name: Joi.string().required().error(() => 'must have name as string'),
  age: Joi.number().error(() => 'age must be a number'),
  grade: Joi.number().error(() => 'grade must be a number'),
  prefect: Joi.boolean().error(() => 'prefect must be a boolean')
})
```

We then dependency inject the validation library into the model. Note we use a wrapper for the validation library to make it easier to switch out libraries in future.

```javascript
// models/student/index.js
let buildMakeStudent = require('./student')
let studentSchema = require('./student-schema')
let studentValidator = require('../validator/')(studentSchema)

let makeStudent = buildMakeStudent(studentValidator)

module.exports = makeStudent
```

Write two sets of unit tests for our model. First testing the validation library for valid vs invalid payloads and relevant error messages. And second testing the creation and read only of the model entity.

```javascript
// models/validator/index.test.js
studentValidator
  [] validates name:string:required, grade:number, age:number, prefect:boolean 
  [] returns error messages if invalid

teacherValidator
  [] validates name:string:required, subject:string, tenure:boolean
  [] returns error messages if invalid
```

```javascript
// models/student/index.test.js
makeStudent
  [] throws error if invalid payload
  [] must have name
  [] can have grade
  [] can have age
  [] sets prefect to false by default
```
### Data-Access
The data-access layer is one of the most important. We should feel confident to easily replace DBs.

Here we need three key components
1. API and test spec
2. Serializers to adapt custom DB to our model schema
3. DB implementation of the API and passing of test

Start with how we think the outer layers will communicate with the data-access layer and what they should expect to get.

```javascript
// data-access/students-db/index.test.js
// example test spec
studentsDb
  - listStudents() lists students
  - findStudent() find single student by id
  - findStudentsBy() finds all students by property
  - addStudent() inserts a student
  - throws error if student payload invalid
  - deleteStudent() deletes a student
  - dropAll() drops students database
```

Write a serializer which adapts the custom DB schema with our model schema.

```javascript
// data-access/students-db/mongodb/serializer.js
// e.g. mongodb stores property id as _id
const _serializeSingle = (student) => {
  return {
    'id': student._id,
    'grade': student.grade,
    'name': student.name,
    'age': student.age,
    'prefect': student.prefect
  };
};

const serializer = (data) => {
  if (!data) {
    return null
  }
  if (Array.isArray(data)) {
    return data.map(_serializeSingle)
  }
  return _serializeSingle(data)
}

module.exports = serializer
```
Write custom DB implementation of the test spec API. Here is an example of an in-memory implementation (which you should start with) and a MongoDB version. Note: the advantage of writing a test spec is you can focus on simply writing code that just has to work.
#### In-memory data-access:
```javascript
// data-access/students-db/memory/index.js
let STUDENTS = require('../../../db/memory/students') // DB
let makeStudent = require('../../../models/student/index') // model
let serialize = require('./serializer') // serializer custom to db

let listStudents = () => {
  return Promise.resolve(serialize(STUDENTS))
}

let findStudent = (prop, val) => {
  if (prop === 'id') { prop = 'serial' }
  let student = STUDENTS.find(student => student[prop] == val)
  return Promise.resolve(serialize(student))
}

let findStudentsBy = (prop, val) => {
  let student = STUDENTS.filter(student => student[prop] == val)
  return Promise.resolve(serialize(student))
}


let addStudent = (studentInfo) => {
  let student = makeStudent(studentInfo)
  let newStudent = {
    serial: STUDENTS.length + 1,
    year: student.getGrade(),
    name: student.getName(),
    age: student.getAge(),
    prefect: student.isPrefect()
  }
  STUDENTS.push(newStudent)
  return findStudent('serial', newStudent.serial)
}

let deleteStudent = (id) => {
  return findStudent({id})
    .then(student => {
      if (student.id == id) {
        STUDENTS = STUDENTS.filter(student => student.serial != id)
        return {
          id,
          status: 'success'
        }
      }
      return {
        status: 'fail'
      }
    })
}

let dropAll = () => {
  STUDENTS = [];
  return STUDENTS;
}

module.exports = {
  listStudents,
  findStudent,
  findStudentsBy,
  addStudent,
  deleteStudent,
  dropAll
}
```
#### MongoDB data-access:
Note for our MongoDB data-access implementation we depend on the DB from the inner layer. The DB includes MongoDB specific implementation of the model and DB connection.

We write a dropAll function for the purposes of writing a test spec that can be used across any DB choice. E.g. beforeEach test we would drop the DB and seed items for testing.
```javascript
// data-access/students-db/mongod/index.js
let Student = require('../../../db/mongodb/models/student')
let makeStudent = require('../../../models/student/index') // model
let serialize = require('./serializer') // serializer custom to db

let listStudents = () => {
  return Student.find({})
    .then(serialize)
}

let findStudent = (prop, val) => {
  if (prop === 'id') {
    prop = '_id'
  }
  return Student.find({[prop]: val})
    .then(resp => {
      return serialize(resp[0])
    })
}

let findStudentsBy = (prop, val) => {
  return Student.find({[prop]: val})
    .then(serialize)
}

let addStudent = (studentInfo) => {
  let student = makeStudent(studentInfo)
  let newStudent = {
    name: student.getName(),
    grade: student.getGrade(),
    age: student.getAge(),
    prefect: student.isPrefect()
  }
  return Student.create(newStudent)
    .then(serialize)
}

let deleteStudent = (id) => {
  return Student.findByIdAndDelete(id)
    .then(resp => {
      return {
        id: resp._id.toString(),
        status: 'success'
      }
    })
    .catch(err => {
      return {
        status: 'fail'
      }
    })
}

let dropAll = () => {
  return Student.remove()
}

module.exports = {
  listStudents,
  findStudent,
  findStudentsBy,
  addStudent,
  deleteStudent,
  dropAll
}
```
### Drivers
Finally we write our drivers whose only dependency is our data-access layer. The drivers should not communicate directly with the model or db.

Any changes to the inner layer will cascade up and as a result there should be less testing done on the outer layers. E.g. if we were to test changes to the model schema in the driver layer we would need to rewrite our tests here as well.

```bash
drivers
  L cli
    L index.js
  L webserver         // express webserver
    L routes
      L index.js
      L students.js   // depends on students data-access layer
      L teachers.js   // depends on teachers data-access layer
    L server.js       // depends on routes
```

Writing Clean Architecture in Node.js. REST API Tutorial using MongoDB, Express and other best practices. How to write software that lasts and can be independent of technology choice.

Clean Architecture Node.js - Build a REST API

How to validate requests and handle errors in Express.js using [Joi](https://github.com/hapijs/joi) validation library. [Click here for a link to the repo](https://github.com/howardmann/validation).

1. [Gentle introduction to Joi validation](#1-joi)
2. [General route error handling in Express.js](#2-route)
3. [Three examples of handling request validations](#3-validation)
4. [Flash form validation errors](#4-flash)

## <a name="1-joi"></a>  1. Gentle introduction to Joi validation
Joi is an expressive validator library for JavaScript objects. It helps ensure inputs are checked before progressing (e.g. to a DB).

You first create a schema and then validate the payload against the schema. If invalid it will throw the relevant error message.
```javascript
let Joi = require('joi')

// Create schema
let createProductSchema = Joi.object().keys({
  description: Joi.string().required(),
  price: Joi.number().min(0.01).required()
})

let payload = {
  description: 'red book',
  price: 0.0001
}

Joi.validate(payload, createProductSchema)
  .then(validated => {
    console.log(validated);
  })
  .catch(err => {
    console.log(err);
    // [ { message: '"price" must be a number',
    // path: [ 'price' ],
    // type: 'number.base',
    // context: { value: null, key: 'price', label: 'price' } } ]
  })
```

We can DRY our code and refactor the schemas and validators into separate files
```javascript
// validation/schemas/productSchema.js
let Joi = require('joi')

// We can reuse schemas
let priceSchema = Joi.number().min(0.01)

// Schema for creating a product, all fields are required
let createProductSchema = Joi.object().keys({
  description: Joi.string().required(),
  price: priceSchema.required()
})

// Schema for editing a product, all fields are optional and we can have a custom error message
let editProductSchema = Joi.object().keys({
  description: Joi.string(),
  price: priceSchema.error(() => 'when editing price must be number greater than 0.01')
})

module.exports = { 
  createProductSchema, 
  editProductSchema
}
```

```javascript
//validation/createValidator.js
let Joi = require('joi')

// DRY our code with higher order function
const createValidator = (schema) => 
  (payload) => {
    return Joi.validate(payload, schema, {
      // shows all error messages instead of first error message
      abortEarly: false
    })
  }

module.exports = createValidator
```

## <a name="2-route"></a> 2. General route error handling in Express.js
We need to create two error handlers in our express application to handle all server errors and 404 route errors.

This way if we throw an error in any of our other routes the error handler will catch and display the relevant error message.

```javascript
let express = require('express')
let bodyParser = require('body-parser') // handle req.body
let app = express()
app.use(bodyParser.json())

// Require routes
app.use(require('./routes'))

// Custom server error handler
app.use((err, req, res, next) => {
  if (err) {
    console.error(err.message)
    if (!err.statusCode) {err.statusCode = 500} // Set 500 server code error if statuscode not set
    return res.status(err.statusCode).send({
      statusCode: err.statusCode,
      message: err.message
    })
  }

  next()
})

// Custom 404 route not found handler
app.use((req, res) => {
  res.status(404).send('404 not found')
})

const PORT = 3000
app.listen(PORT, () => {
  console.log(`Listening on PORT ${PORT}`);
})
```

## <a name="3-validation"></a> 3. Three examples of handling request validations
We can validate incoming Express payload requests using Joi in 3 ways:
1. We handle the payload within the route and catch error if its invalid
2. Create a custom middleware ([see next section](###Generic-Middleware)) to handle the validation and throw error if invalid
3. Use the [celebrate](https://github.com/arb/celebrate) library which does same as option 2 but with more features

```javascript
let express = require('express');
let router = express.Router();


// Validation
let createValidator = require('../validation/createValidator')
let { createProductSchema } = require('../validation/schemas/productSchema')
let validate = require('../validation/validateMiddleware')
let {celebrate} = require('celebrate')


// 1. Validation using Joi within route
let validateProductCreate = createValidator(createProductSchema)

router.post('/products', (req, res, next) => {
  validateProductCreate(req.body)
    .then(validatedProduct => {
      res.send({status: 'success', validatedProduct})
    })
    .catch(next)
})

// 2. Validation using Joi custom middleware
router.post('/products2', validate(createProductSchema), (req, res, next) => {
  let payload = req.body
  res.send({status: 'success', payload})
})

// 3. Validation using celebrate middleware library
router.post('/products3', celebrate({body: createProductSchema}), (req, res, next) => {
  let payload = req.body
  res.send({status: 'success', payload})
})

module.exports = router;
```
### Generic Middleware
For option 2 we can create a generic middleware to handle validations.
```javascript
// validation/validateMiddleware
let createValidator = require('./createValidator')

let validateMiddleware = (schema) =>
  (req, res, next) => {
    let payload = req.body
    let validate = createValidator(schema)

    // proceed next if validated otherwise catch error and pass onto express error handler
    validate(payload)
      .then(validated => {
        req.body = validated
        next()
      })
      .catch(next)
  }

module.exports = validateMiddleware
```

For option 3 we must also add the celebrate error handler in our server file above our custom error handlers. This gives us more verbose error handling messaging.
```javascript
//server.js
let {errors} = require('celebrate') // handle celebrate joi errors

let app = express()

// Require routes
app.use(require('./routes'))

// Celebrate library error handler
app.use(errors())

// Custom server error handler
app.use((err, req, res, next) => {
})

// Custom 404 route not found handler
app.use((req, res) => {
})

const PORT = 3000
app.listen(PORT, () => {
})
```

## <a name="4-flash"></a> 4. Flash form validation errors
The methods above handle API validation errors. However, we may also want to display form validation errors in the browser as a flash message:

![form validation](https://raw.githubusercontent.com/howardmann/validation/master/img/validation.png)

In this example we will have a signup form that requires three fields (email, name and password). It will validate and flash relevant validation errors.

We will achieve this in stages:
1. Setup express to  display flash messages
2. Create user schema and HTML form
3. Setup routes to handle validations
4. DRY using middleware

### 1. Display flash messages
To display flash messages we need two libraries:
- `connect-flash` for flashing messages; and
- `express-session` for storing sessions server-side in memory

We write a custom middleware to store the session message as a global variable in views in order to access it in any view template.

```javascript
// server.js
let session = require('express-session')
let flash = require('connect-flash')

// session and flash views
app.use(session({
  secret: 'ilikecats',
  cookie: {},
  resave: false,
  saveUninitialized: true
}));
app.use(flash())

// store three flash variables as global variables in views
app.use((req, res, next) => {
  res.locals.messageSuccess = req.flash('messageSuccess')
  res.locals.messageFailure = req.flash('messageFailure')
  res.locals.validationFailure = req.flash('validationFailure')
  next();
})
```

Then in our views layout we insert placeholders to be able to render these flash messages if they exist. For the `validationFailure` it will be passed an array of messages so we want to loop through and display as a bullet points.
```hbs


<div style="background-color: red">
  {{messageFailure}}
</div>

<div style="background-color: green">
  {{messageSuccess}}
</div>

<div style="background-color: red">
  {{#if validationFailure}}
  <p>Validation Errors</p>
  {{/if}}
  <ul>
    {{#each validationFailure}}
    <li>
      {{this}}
    </li>
    {{/each}}
  </ul>
</div>

{{{body}}}
```
### 2. User schema and form
As with our product schema above we will create a user schema to handle validation using `Joi`.

```javascript
//validation/schemas/userSchema
let Joi = require('joi')

module.exports = Joi.object().keys({
  email: Joi.string().email(),
  name: Joi.string(),
  password: Joi.string().min(7).alphanum()
})
```

Now create a simple HTML form in our view template
```handlebars

<form action="/signup" method="POST">
  <input type="email" placeholder="enter email" name="email">
  <input type="text" placeholder="enter name" name="name">
  <input type="password" placeholder="enter password" name="password">
  <input type="submit">
</form>
```

### 3. Setup signup routes
Use the validation helpers we used before along with the schema we created above. Create two routes: 1) for displaying the signup form and 2) for handling the form submission.

Validate the payload using Joi and if validation errors flash validation errors and redirect bac to form.
```javascript
//routes
let express = require('express');
let router = express.Router();
let createValidator = require('../validation/createValidator')
let {createUserSchema} = require('../validation/schemas/userSchema')
let validateUser = createValidator(createUserSchema)

// display signup form
router.get('/signup', (req, res, next)) => {
  res.render('signup')
}

// handle submit signup form 
router.post('/signup', (req, res, next)) => {
  let payload = req.body
  
  // Joi validation
  validateUser(payload)
    .then(data => {
      // If success; flash success message and redirect to form
      console.log(data)
      req.flash('messageSuccess', 'Success valid input')
      res.redirect('/signup')
    })
    .catch(err => {
      // If validation error flash array of messages and redirect
      let errorMessages = err.details.map(el => el.message)
      console.log(errorMessages)
      req.flash('validationFailure', errorMessages)
      res.redirect('/signup')
    })
}

module.exports = router
```

### 4. DRY with middleware
If we have many forms that require validating (e.g. for both edit and create) we can refactor our validation into a custom middleware.

Create a validateForm middleware function that takes a Joi schema as an argument and redirects back with validationFailure flash message if error.

```javascript
//validation/middlewares/validateForm 
let createValidator = require('../createValidator.js')

module.exports = (schema) =>
  (req, res, next) => {
    let payload = req.body
    let validate = createValidator(schema)

    validate(payload)
      .then(validated => {
        req.body = validated
        next()
      })
      .catch(err => {
        let errorMessages = err.details.map(el => el.message)
        console.log(errorMessages)
        req.flash('validationFailure', errorMessages)
        res.redirect('back')
      })
  }
```

We can now use it as reusable middleware for any route.
```javascript
//routes/index.js
let validateForm = require('../validation/middlewares/validateForm')

// middleware handles redirect back with validationFailure flash message
// route then only has to deal with success outcome
router.post('/signup', validateForm(createUserSchema), (req, res, next) => {
  let payload = req.body
  // handle payload etc. in db
  console.log(payload);
  req.flash('messageSuccess', 'woohoo')
  res.redirect('/signup')
})

```

Learn how to validate requests and handle errors using Node Express.js with Joi validation library. Validate API requests and display HTML form errors using custom middleware.

Express Validation and Error Handling

Tutorial and demo app using passport.js for basic principles of authentication and authorization.

[Click here for a live demo of the app.](https://authdemo.now.sh)
You can use the example admin credentials (email: howie@email.com password: chicken)

[Click here for the github repo](https://github.com/howardmann/authentication)

### Overview of demo app:
As a public user, I can:
- view the homepage
- visit the signup page and create a new account
- visit the login page

As a logged in user, I can:
- view my private profile page
- view special pages only visible to logged in users
- logout

As a logged in user with admin privileges, I can do all of the above plus:
- view all users
- view admin pages

Here is an overview of pages and permissions.
```shell
PAGES
page              permission
/                 public homepage
/special          restricted to signed up and logged in users
/users/profile    restricted to profile of logged in user
/admin            restricted to loggedin admin users
/users            restricted to loggedin admin users

AUTH
method    path             description
GET       /login           render login view form page
POST      /login           authenticate email and password and redirects to profile page if success and login page again if fail
GET       /signup          render signup view form page
POST      /signup          create user and redirect to profile page if success and signup page with flash message if fail
GET       /logout          clears session and redirects to login page


```

Dependency descriptions
```javascript
  "dependencies": {
    "bcrypt": "^3.0.6", // for hashing passwords 
    "body-parser": "^1.19.0", // to capture form post data in req.body
    "connect-flash": "^0.1.1", // flash messages 
    "dotenv": "^8.0.0", // environment variables
    "express": "^4.17.1", // http web server
    "express-handlebars": "^3.1.0", // template engine
    "express-session": "^1.16.1", // track sessions
    "mongoose": "^5.5.12", // mongodb ORM
    "passport": "^0.4.0", // authentication
    "passport-local": "^1.0.0" // passport strategy for local DB auth (e.g. username and password)
  }

```

This is a summary of the relevant directories
```shell
auth // where all the authorization and authentication logic lives
  L middleware
    L flashMessageInViews.js  // enables all views to access {{messageSuccess}} and {{messageFailure}}
    L userInViews.js // enables all views to check if user session exists, e.g. enables us to flash login or logout link
  L authorization.js // middleware to gate routes (e.g. loginRequired, adminRequired, signupRequired)
  L index.js // entry point
  L logInOut.js // login and out pages and passport authentication logic
  L register.js // signup page and create user passport logic
  L serializer.js // serializes session user_id via passport
routes // where routes live
  L index.js // calls auth methods
  L pages.js // other pages
  L users.js // users pages
views
  L auth // templates for login and signup page
    L login.hbs
    L signup.hbs
  L pages
  L users
  L layouts
repositories // applying clean programming principles (separation of concerns) to make it easier to switch out DBs
  L userRepository.js // model wrapper for user CRUD operations
  L memory // user in memory (start off for dev purposes)
  L mongodb // user in mongodb db (for persistence)
model
  L monbodb // mongodb model and schema
db
  L mongodb // mongodb connection and seeds
  L memory // simple array for dev purposes
server.js // express webserver and dependencies 
```
### Tutorial
We will approach authentication and authorization via the following steps:
1. Register user
2. Login and logout authentication
3. Flash messages
4. Authorization
5. Using it in routes

## 1. Register User
Passport.js is a library that makes it easier to handle session serialization, redirects and other aspects of authentication.

We will be using the `passport-local` strategy which is your vanilla username and password login strategy.

In the code below we we first start with the functionality to sign up a user. The local-signup strategy is middleware that our route will pass through. 

The first options that are passed tell passportJs that the email and password fields we are using differ from the default username field (in our case we use the name `email` in our form for username). The final field `passReqToCallback` lets us access the req object in the callback (which we will need to find other properties in the req.body e.g. the phone number).

The callback queries our DB to check if the user already exists, if it does then we return `done(null, false)` which will trigger the `failureRedirect`. If it doesn't then we create the user, hash the password using bcrypt and return `done(null, {id: newUser.id})`. By not passing false to the second param we trigger the `successRedirect` path. Here we pass the user_id to be serialized only into the session accessible via `req.user`, instead of passing the entire user object and passwordHash. You can pass anything you want, but we are passing only the id for security reasons.


```javascript
// auth/register.js
let register = module.exports = {}

// Dependecies
let bcrypt = require('bcrypt');
let passport = require('passport');
let LocalStrategy = require('passport-local').Strategy;
let User = require('../repositories/userRepository.js')

// =======USER SIGN UP AND HASH PASSWORD STRATEGY========
passport.use('local-signup', new LocalStrategy({
    usernameField: 'email', // map username to custom field, we call it email in our form
    passwordField: 'password',
    passReqToCallback: true // lets you access other params in req.body
  },
  async (req, email, password, done) => {
    // Return false if user already exists - failureRedirect
    let user = await User.findBy('email', email)
    if (user) { return done(null, false) }

    // Create new user and return the user - successRedirect
    let newUser = await User.create({
      email,
      passwordHash: bcrypt.hashSync(password, 10), // hash the password early
      phone: req.body.phone
    })

    // save the user_id to the req.user property
    return done(null, {id: newUser.id})
  }
))
```

Once we have our strategy we create two methods, 1 to render the signup form and the second to pass the forms payload to the passport signup strategy and handle the appropriate redirects.

```javascript
// auth/register.js

// GET route to render signup page
register.signupPage = (req, res, next) => {
  res.render('auth/signup')
}

// POST route to signup user and redirect 
register.signup = passport.authenticate('local-signup', {
  successRedirect: '/users/profile',
  failureRedirect: '/signup',
  failureFlash: {
    type: 'messageFailure',
    message: 'Email already taken.'
  },
  successFlash: {
    type: 'messageSuccess',
    message: 'Successfully signed up.'
  }
})

```
Later in our `routes/index.js` we will pass these two paths to:
```javascript
// routes/index.js
router
  .get('/signup', auth.signupPage)
  .post('/signup', auth.signup)

```

Visiting GET '/signup' will render the HTML signup form.

```html
// views/auth/signup
<h2>Signup</h2>

<form action="/signup" method="POST">
  <input type="email" placeholder="enter email" name="email" required>
  <br>
  <input type="password" placeholder="enter password" name="password" required>
  <br>
  <input type="tel" placeholder="enter phone" name="phone">
  <br>
  <input type="submit" value="Login">
</form>
```
Submitting the payload will then trigger the passport signup strategy and redirect accordingly. Passport.js enables us to set the success and failure flash messages in the passport.authenticate method. This is then accessible via `req.flash()`.

## 2. Login and Logout Authentication
Login and logout authentication follows the similar approach as registering new users.

We create a new `local-login` passport strategy which checks the DB if the user exists and if the submitted password matches the passwordHash in the DB (using bcrypt). If it does, we call done with the serialized user_id saved as a session in `req.user` and then trigger the `successRedirect` path. If not we call `done(null, false)` which triggers the `failureRedirect` path.

Similarly we create a loginPage path which renders the HTML login form and a method to handle the POST login request.

A logout path is straight forward, we call req.logout() which clears the session, we flash a message and redirect to a URL.

```javascript
//auth/logInOut.js
let logInOut = module.exports = {}

// Dependencies
let bcrypt = require('bcrypt');
let passport = require('passport');
let LocalStrategy = require('passport-local').Strategy;
let User = require('../repositories/userRepository.js')

// ======USER LOGIN AUTHENTICATION STRATEGY=======
passport.use('local-login', new LocalStrategy({
    // Fields to accept
    usernameField: 'email', // default is username, override to accept email
    passwordField: 'password',
    passReqToCallback: true // allows us to access req in the call back
  }, async (req, email, password, done) => {
    // Check if user and password is valid
    let user = await User.findBy('email', email)
    let passwordValid = user && bcrypt.compareSync(password, user.passwordHash)

    // If password valid call done and serialize user.id to req.user property
    if (passwordValid) {
      return done(null, {
        id: user.id
      })
    }
    // If invalid call done with false and flash message
    return done(null, false, {
      message: 'Invalid email and/or password'
    });
}))


// GET route to render login form view
logInOut.loginPage = (req, res, next) => {
  res.render('auth/login')
}

// POST route to handle req.body payload. Pass to passport login strategy with relevant redirects
logInOut.login = passport.authenticate('local-login', {
  successRedirect: '/',
  failureRedirect: '/login',
  failureFlash: {
    type: 'messageFailure',
    message: 'Invalid email and/ or password.'
  },
  successFlash: {
    type: 'messageSuccess',
    message: 'Successfully logged in.'
  }
})

// GET logout route, flash message and redirect
logInOut.logout = (req, res, next) => {
  req.logout();
  req.flash('messageSuccess', 'Successfully logged out')
  res.redirect('/login')
}

```

## 3. Flash messages
In order to display the flash messages we have been flashing above we need some middleware. This is a simple middleware that stores the success and failure flash messages in the gloal res.locals property. This makes it accessible in all our views via {{messageSuccess}} and {{messageFailure}}.

```javascript
//auth/middleware/flashMessageInviews.js
// global route middleware 
// success and failure flash message in views
module.exports = (req, res, next) => {
  res.locals.messageSuccess = req.flash('messageSuccess')
  res.locals.messageFailure = req.flash('messageFailure')
  next();
}
```

In addition in order to know if someone has logged in or not we use another middleware to check if the user is authenticated. This lets us be able to display either login or logout links depending if someone is logged in or out.

```javascript
//auth/middleware/userInViews.js
// global route middleware 
// user boolean accessible in views if authenticated
module.exports = (req, res, next) => {
  res.locals.user = req.isAuthenticated()
  next()
}
```

To use these we need to call it in our main server.js file.
```javascript
//server.js
// Custom middleware authentication and flash message view middleware
app.use(userInViews)
app.use(flashMessageInViews)

// Routes
app.use(require('./routes/index'))
const userInViews = require('./auth/middleware/userInViews.js')
const flashMessageInViews = require('./auth/middleware/flashMessageInViews.js')
```

Now in our view layout template we can display our flash messages and appropriate login or logout links.

```handlebars
//views/layouts/main.hbs
  <h1>Web App</h1>
  <div style="background-color: red">    
    {{messageFailure}}
  </div>
  <div style="background-color: green">    
    {{messageSuccess}}
  </div>
  
  <nav>
    <p>
      {{#if user}}
        <a href="/logout">Logout</a>
      {{else}}
        <a href="/login">Login</a>
      {{/if}}
      
      <a href="/signup">Signup</a>
    </p>
```

## 4. Authorization
Authorization middleware lets us gate certain routes depending on a users authentication and permission level. In addition it can then redirect to specific pages with appropriate flash messages.

In our example we use three forms of authorization:
- loginRequired: needs to be logged in otherwise redirect to login page
- adminRequired: needs to be an admin: true user otherwise redirects to profile page
- signupRequired: same as loginRequired except redirects to signup page

```javascript
//auth/authorization.js
let authorization = module.exports = {}

let User = require('../repositories/userRepository')

// Higher order function to keep DRY
let authenticate = ({type, message, redirectPath}) => {
  return (req, res, next) => {
    let isAuthenticated = req.isAuthenticated()
    if (!isAuthenticated) {
      req.flash(type, message)
      return res.redirect(redirectPath)
    }
    next()
  }
}

// ===AUTHORIZATION MDDLEWARE
authorization.loginRequired = authenticate({
  type: 'messageFailure',
  message: 'Must be logged in',
  redirectPath: '/login'
})

authorization.signupRequired = authenticate({
  type: 'messageFailure',
  message: 'Must be signed up',
  redirectPath: '/signup'
})


authorization.adminRequired = async (req, res, next) => {
  let id = req.user && req.user.id
  let user = await User.findBy('id', id)
  let isAdmin = user && user.admin

  if (!isAdmin) {
    req.flash('messageFailure', 'Admin only')
    return res.redirect('/users/profile')
  }

  next();
}
```

## 5. Using it in routes
Now we have our logic and flash views ready we can integrate to our routes/index file. This should be self explanatory.

```javascript
const express = require('express')
let router = express.Router()

// === AUTH ENDPOINTS ===
const auth = require('../auth')
router
  .get('/login', auth.loginPage)
  .post('/login', auth.login)
  .get('/signup', auth.signupPage)
  .post('/signup', auth.signup)
  .get('/logout', auth.logout)

// === BOILERPLATE === 
// pages endpoints
let pages = require('./pages')

router
  .get('/', pages.home)
  .get('/admin', auth.loginRequired, auth.adminRequired, pages.admin)
  .get('/special', auth.signupRequired, pages.special)
  
// users endpoints
let users = require('./users')
router
  .get('/users/profile', auth.loginRequired, users.show)
  .get('/users', auth.loginRequired, auth.adminRequired, users.index)

module.exports = router
```

## How to use this demo app
This demo app can be used as boilerplate authentication for other apps.

To reuse follow these steps:
1. Ensure you have the minimum dependencies installed (see above)
2. Copy the entire auth folder
3. Create an auth folder in your views to render the appropriate login and signup page (customise depending on form fields)
4. Modify the userRepository in order to create and read user details
6. Update your routes/index file to include the auth routes and use the appropriate auth authorization middleware for your specific routes
7. Update your server.js file to include the relevant authentication dependencies (order matters)

Learn how to handle web authentication and authorization in Node using Passport.js. Create signup and login page, different types of users and handle authentication for specific pages.

Node.js Authentication Tutorial with Passport

> TLDR; valuing and investing in a company is based on understanding what drives future profits and discounting that by your own rate of return.

To understand the principles of valuation, imagine you are presented with an investment proposition. 

You can purchase a security that pays $100 per year over 3 years. At the end of the 3 year period you will be returned the purchase amount you paid. How much would you pay for this security?

#### Question: How much would you pay for this security?

![what would you pay](//images.ctfassets.net/vwq10xzbe6iz/4hI6KYT4dlAilQndBPVBiD/f072a0876d19d0273f7b871f1cd40819/Screen_Shot_2019-05-05_at_11.24.41_pm.png?h=300)

To answer this you must ask two questions:
1. How sure am I that I will get paid the total $300 plus my original amount?
2. What is my opportunity cost of purchasing this versus another investment?

To answer the first question, imagine that the counterparty is a reputable property manager and the cash payments are contingent on them making a profit for each of those 3 years.

The answer to the second question is a personal and subjective one. It is also the most important.

Let’s take two different people:
- __Person A__ has the opportunity to invest in bank term deposits that delivers 5% annual interest. They view the ability of the property manager to achieve profits as medium risk as many tenants are bricks and mortar retail. 
- __Person B__ for residency reasons cannot invest in local bank term deposits and can only invest in government bonds that deliver 2% annual interest. They in contrast, trust the track record of the property manager and view it as low risk.

__Person A__ may demand an annual rate of return of __10%__ given their perceived risk of the business and the comparable opportunity cost of investing in bank term deposits. From this we can calculate that __Person A would be willing to pay up to $1,000 for the security__ (i.e. $100 annual return divided by 10%).

__Person B__ on the other hand may only require a much lower rate of return of __5%__ given their trust in the property manager and that they do not have the same access to bank term deposits as Person A. Hence __Person B would be willing to pay up to $2,000 for the security__ (i.e. $100 annual return divided by 5%).

__Answer: This security is valued between $1,000 to $2,000. It depends on who’s buying.__

## What is the Discount Rate or WACC?
This rate of return is otherwise known as the *discount rate* or *Weighted Average Cost of Capital* (__WACC__) and is used to calculate company or asset valuations. It represents a theoretical aggregation of the rate of return all investors demand from investing in a company (both equity and debt holders). 

#### WACC Formula
![Screen Shot 2019-05-05 at 11.24.53 pm](//images.ctfassets.net/vwq10xzbe6iz/44HfXzVAZJcxTDCcK0676/86eccf1e2ae6e3b87ff0b98aef5a9067/Screen_Shot_2019-05-05_at_11.24.53_pm.png?h=300)

Without a discount rate you cannot calculate a valuation or price you should be willing to pay. Of course you can always determine a purchase price based on what you believe someone will pay for it in the future - that’s called speculation.

However, as an individual investor your rate of return is individual to you. Ignore the WACC formula. It is simpler to think of calculating your own discount rate as: 

> Your Discount Rate = the opportunity cost of investment in something safer + a premium to compensate you for the greater risk and uncertainty.

#### A Few Complications
In real life valuing companies are more complicated. Cash payments are derived from delivering a product or service of value to customers, managing resources cost effectively and management making good investment decisions. There is no certainty that the business will go on undisrupted in perpetuity. There is no guarantee that the amount you paid will be returned when you decide to sell. 

However, the principle remains the same. Effort should be spent on understanding the business, management and industry factors that drive future cash payments. Calculating the valuation is then a simple exercise of discounting those forecast cash payments by your own individual personal, highly subjective required rate of return. 



Understand the principles of intrinsic valuation. How to explain WACC to anyone. What are the most important factors when valuing a company. 

The Basics of Valuation

> *TLDR; Google’s job is to match the best content to the relevant question. If an answer is better, then it should outrank. Backlinks should be a reflection of, not a source of ranking.*

Do you need SEO backlinks to rank? The answer is no. Here is an SEO Content Template and framework to show you how. Without creating backlinks, we built SEO to be our largest acquisition channel for a world class B2B SaaS company.

By the end of this article you will learn:
- 👈[What are Backlinks?](#what-are-backlinks)
- 🚀[How we Built Huge SEO Traffic Without Backlinks](#how-we-built)
- ✔️[3 Simple Steps to Follow](#3-simple)
- 📥[Download SEO Content Template](#framework)
- ⌛[How Long Does it Take to Rank?](#how-long)
- 🤔[Do Backlinks Still Matter?](#do-backlinks-matter)

📥<a href="https://docs.google.com/document/d/1yq7iLrVDq5oWBLXzLw4ZftvnMHFrqYhzJ7amuK87is4/edit" target="_blank">Skip the article and download the SEO Content Template we use to write SEO content that ranks.</a>

## 👈<a name="what-are-backlinks"></a> What are Backlinks?
Let’s start with some background. Backlinks are external websites that link back to your webpages. They occur when others cite you or refer to you as something of interest to their readers through a hyperlink. 

Backlinks formed the basis of Google’s patented [PageRank algorithm](https://patentimages.storage.googleapis.com/37/a9/18/d7c46ea42c4b05/US6285999.pdf) (named after founder Larry Page). The invention ranked the importance of a webpage not just on the number of citations it had, but on the importance of those citing pages.

#### Google PageRank Patent Filed 9 Jan 1998
[![Google PageRank patent](//images.ctfassets.net/vwq10xzbe6iz/4fep3mpwZl6DRj1fZGtXNT/25e1f20de062f2c0d279811248c80056/unnamed.png?h=300)
](https://patentimages.storage.googleapis.com/37/a9/18/d7c46ea42c4b05/US6285999.pdf)
> The rank assigned to a document is calculated from the ranks of documents citing it. This implies a recursive definition of rank. In addition, the rank of a document is calculated from a constant representing the probability that a browser through the database will randomly jump to the document. 

Then the world changed forever. Fast forward 20 years and today Google answers over [3.5 billion](http://www.internetlivestats.com/google-search-statistics/) questions daily and has become the information portal for the human race (minus China). People globally are actively using Google to find information and make important decisions.

#### Google Year in Search 2019

<iframe width="560" height="315" src="https://www.youtube.com/embed/ZRCdORJiUgU" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>


How well you rank on Google can be a determining factor in your audience reach and success.

## 🚀<a name="how-we-built"></a> How we Built Huge SEO traffic Without Backlinks
I had the privilege and joy to build and lead the SEO team for [SafetyCulture](http://safetyculture.com/), a global B2B SaaS startup with a mission to improve safety and quality in the global workplace. 

Within 12 months we turned a virtually non-existent SEO presence into our largest and fastest growing customer acquisition channel and cut dependency on costly paid advertising to fuel growth. All without link building.

#### SEMrush organic US traffic for safetyculture.com (public)
![SEMrush organic traffic chart](//images.ctfassets.net/vwq10xzbe6iz/3sKDGJ1avIOLWzWonddpWY/8d09c396809791ac12afc250fb7b428f/Screen_Shot_2019-05-01_at_11.32.41_am.png?h=300)

With zero experience in marketing or SEO, I was overwhelmed by the countless guides, tools, hacks, tips and must-dos to rank in Google. I tried many link building strategies, but after  sending hundreds of spam emails only to get a handful of backlinks, I felt there must be a better way and went back to basics.

Google’s [stated mission](https://www.google.com/search/howsearchworks/mission/) is to: 

> organize the world’s information and make it universally accessible and useful. Today, people around the world turn to Search to find information, learn about topics of interest, and make important decisions.

Google makes public the factors that determine its search quality ranking in this [164 page document](https://static.googleusercontent.com/media/www.google.com/en//insidesearch/howsearchworks/assets/searchqualityevaluatorguidelines.pdf). Google contracts with over 10,000 search quality evaluators worldwide who use this document to rank the quality ranking of webpages to help power Google’s machine learning search algorithms.

Here are the 4 most important factors that Google uses to determine page quality ranking:
- __Purpose__ - how well does the page achieve its stated purpose vs the user intent
- __Quality of the content__ - is it factually accurate, well researched, clearly written and provides value
- __Authority__ - does the author and website have expertise and are they trustworthy
- __Functionality__ - is it mobile responsive, good UX, functionality and widgets all working

[PageRank](https://www.google.com/search/howsearchworks/algorithms/) remains an important factor, but namely from backlinks to high quality content that naturally gain popularity. 

[Google](https://support.google.com/webmasters/answer/66356?hl=en) has this to say about backlinks:

> The best way to get other sites to create high-quality, relevant links to yours is to create unique, relevant content that can naturally gain popularity in the Internet community. Creating good content pays off: Links are usually editorial votes given by choice, and the more useful content you have, the greater the chances someone else will find that content valuable to their readers and link to it.

The next section will provide a framework for how you can create unique, relevant content that readers want.

## ✔️<a name="3-simple"></a> 3 Simple Steps to Rank
Here are the 3 simple steps our SEO team still uses to write targeted and high quality content
1. Find the Right Keyword to Target - Know Your Audience
2. Competition - What Have Others Already Said on the Topic
3. Write Great Content

💡To illustrate how to apply these steps, we will use the preparation and writing of this article itself as an example.

### 1. Find the Right Keyword to Target - Know Your Audience
This is the most important step. In order to write high quality content that achieves its stated purpose we need to understand who we are writing for and their intent.

- __Who - is the target audience?__ For this article, our audience is online and growth marketers and people working in tech startups
- __What - questions would they ask?__ How to create backlinks
- __Why - are they asking this question?__ What is the intent behind the question? What is the [Job To Be Done](https://hbr.org/2016/09/know-your-customers-jobs-to-be-done) from creating backlinks? In this case, it is to have content that ranks and drives traffic

From here we use Google’s [free keyword planner tool](https://ads.google.com/home/tools/keyword-planner/) to select the right keywords (questions) to target. In our case we know that users mostly search for `backlinks`, `seo backlinks`, `what are backlinks` etc. as opposed to `link building`. 

#### Google Keyword Planner Tool Snapshot
![Screen Shot 2019-05-01 at 4.44.47 pm](//images.ctfassets.net/vwq10xzbe6iz/34zMMRwzeV90S7ZydJks1I/f5dcd5ac29cba9fac639c273710db78c/Screen_Shot_2019-05-01_at_4.44.47_pm.png?h=300)
> ☝️General Rule of Thumb: Top ranking search results on average capture 30% of average monthly search volume (known as the Click Through Rate - __CTR__). So over time if this article were able to achieve a #1 ranking for the `backlinks` keyword that would represent a potential 15,000 global visits a month. The CTR falls exponentially as rankings drop. Very few visitors go beyond page 1 search results.

### 2. Competition - What Have Others Already Said on the Topic
To create a quality piece of content, we need to know what others have already said on the topic and determine if we can write something better. This is where many fall short and end up paraphrasing or writing content that is inferior to existing pages that rank. 

For our target keyword of `backlinks`, we must google and review the first page results to evaluate what has been said.

#### First Page Search Results for Target Keyword
![Google result for keyword backlinks](//images.ctfassets.net/vwq10xzbe6iz/QgLsTaayCrmL9bADStT1y/94796327e61195875a8dfe31ec6ad49b/Screen_Shot_2019-05-01_at_5.20.42_pm.png?h=300)

We see many definitive strategy guides on how to backlink and the importance of backlinking. As I have nothing more insightful to add to this topic I have opted for a contrarian response to the same question:

👉 *__How to Rank Without Backlinks: 3 Simple Steps [Free Framework]__*

### 3. Write Great Content
Now that we have a topic based on a target audience, intent and question, we can get to work. While it is still possible to write high quality content without being an authoritative expert (in fact it’s often easier) finding an author with expertise on the topic would rank content higher.

For this article I felt I have both the authority and experience to discuss this topic. There are basic online writing tips you can follow but never forget to empathize with the user. Don’t be selfish with your writing. Write for your user, deliver value, solve their problem.

## 📥<a name="framework"></a> Free SEO Content Template
On the topic of giving value to your users. I have created a Framework Template you can view, download and customize for your content. Our team uses this framework before researching and writing any piece of SEO content.

#### Download SEO Content Template
[![SEO Content Framework Template Screenshot](//images.ctfassets.net/vwq10xzbe6iz/5H9VRaQTV6pZrU1RCBVAj4/e9b849b2d8462a7bd5728d338b87219f/Screen_Shot_2019-05-01_at_6.26.34_pm.png?h=300)
](https://docs.google.com/document/d/1yq7iLrVDq5oWBLXzLw4ZftvnMHFrqYhzJ7amuK87is4/edit)

## ⌛<a name="how-long"></a> How Long Does it Take to Rank Without Backlinks?
The ability to rank for keywords will depend on the relative competitiveness of your content. A piece of content that is better researched, articulated and solves the user's problem should rank well even without backlinks.

Our experience was that high quality pages would begin to rank on page 1 globally within a month and achieve top 3 ranking within 3 months. If we didn’t rank page 1 within a month then we would revisit the content, competition and user problem.

#### Organic weekly traffic of pages published in December (redacted private data)
![Amplitude chart](//images.ctfassets.net/vwq10xzbe6iz/2jbNMVJbLPFob5wK2s7o4c/bfe8e57a46a652465520213df77392f3/Screen_Shot_2019-05-01_at_9.50.46_pm.png?h=300)

However, if the competing content is of higher quality and has greater backlinks and authority ([use a free tool to check](https://moz.com/products/pro/seo-toolbar)), then you are unlikely to outrank others.

## 🤔<a name="do-backlinks-matter"></a> Do Backlinks Still Matter?
Yes, while not the deciding factor, the PageRank algorithm remains an indicator of a page’s authority. It should be used as an outreach tool to amplify high quality content you have already written.

Remember, time spent understanding your user and solving their problems is always time better spent. 

---
*Final note: Thank you to the amazing SafetyCulture SEO team for giving me the opportunity to lead, teach and work alongside all you beautiful humans 💖.*
#### SafetyCulture SEO Team Photo

![SEO Team Photo](//images.ctfassets.net/vwq10xzbe6iz/6XoDFOg6jR7SPmHsRiLHWC/e11229b0e3b39b59184e08ffcd2aadd0/IMG_20190308_160804.jpg?h=300)


What are backlinks? Do you need SEO backlinks to rank? The answer is no. Here is a framework to show you how. Without creating backlinks, we built SEO to be our largest acquisition channel for a world class SaaS company.

How to Rank Without Backlinks [Free Template]

# Starcraft

## Table and associations
- Database: Starcraft
- Tables: `Races`, `Planets`, `Planets_Races` (join table), `Heroes`
- Associations:
  - `Races` many-to-many `Planets` 
    - 1 planet can be controlled by many races and similarly 1 race can control many planets)
  - `Races` one-to-many `Heroes`
    - 1 race has many heroes but 1 hero can only belong to a single race (no biracial)
  - `Planets` one-to-many `Heroes`
    - 1 planet can give birth to many heroes but 1 hero can only be born in a single homeworld 

![relational db](https://raw.githubusercontent.com/howardmann/sql_basics/master/draw.png)

## Postgresql commands
Create database. Ensure postgresql application is running
```bash
# run postgresql in terminal
psql
# create database
CREATE DATABASE {database_name};
# connect to database
\c {database_name}

# other useful terminal commands
\c {database_name}# connect to [database] 
\l # list all databases
\dt #list all tables in current database
\d {table_name} #list schema of table
```
## Create Tables

```sql
CREATE TABLE Races (
    id serial PRIMARY KEY,
    name varchar(225),
    description varchar(225)
);

CREATE TABLE Planets (
    id serial PRIMARY KEY,
    name varchar(225),
    moons int
);

CREATE TABLE Heroes (
    id serial PRIMARY KEY,
    planet_id int REFERENCES planets ON DELETE SET NULL,
    race_id int REFERENCES races ON DELETE SET NULL,
    alias varchar(225),
    level int
);

CREATE TABLE Planets_Races (
    planet_id int REFERENCES planets ON DELETE SET NULL,
    race_id int REFERENCES races ON DELETE SET NULL
);
```

## Drop tables
```sql
DROP TABLE Heroes CASCADE;
DROP TABLE Races CASCADE;
DROP TABLE Planets CASCADE;
DROP TABLE Planets_Races CASCADE;
```

## Seed Database
Seed `races`
```sql
-- Delete existing data
DELETE FROM Races;
-- RESET SERIAL PRIMARY KEY
ALTER SEQUENCE races_id_seq RESTART WITH 1;
-- SEED NEW DATA
INSERT INTO Races (id, name, description) VALUES
(1, 'Zerg', 'Eats humans'),
(2, 'Terran', 'Marine hoorah'),
(3, 'Protoss', 'For Aiur'),
(4, 'Xel Naga', '...');
```

Seed `planets`
```sql
-- Delete existing data
DELETE FROM Planets;
-- RESET SERIAL PRIMARY KEY
ALTER SEQUENCE planets_id_seq RESTART WITH 1;
-- SEED NEW DATA
INSERT INTO Planets (id, name, moons) VALUES
(1, 'Char', 0),
(2, 'Earth', 1),
(3, 'Aiur', 6),
(4, 'Korhal', 3);

```

Associate `planets` to `races`. Zerg controls Char (1,1) and shares control of Earth (2,1). Terran controls Korhal (4,2) and shares control of Earth (2,2). Protoss control Aiur (3,3).
```sql
-- Delete existing data
DELETE FROM Planets_Races;
-- SEED NEW DATA
INSERT INTO Planets_Races (planet_id, race_id) VALUES
(1, 1),
(2, 1),
(4, 2),
(2, 2),
(3, 3);
```

Seed `heroes` and associate them with planets and races
```sql
-- Delete existing data
DELETE FROM heroes;
-- RESET SERIAL PRIMARY KEY
ALTER SEQUENCE heroes_id_seq RESTART WITH 1;
-- SEED NEW DATA
INSERT INTO Heroes (id, planet_id, race_id, alias, level) VALUES
(1, 2, 2, 'Jim Raynor', 5),
(2, 1, 1, 'Queen of Blades', 20),
(3, 3, 3, 'Zeratul', 15),
(4, 4, 2, 'Arcturus Mensk', 5);
```

## QUERIES
Basic Queries
```sql
-- Find all planets
SELECT * FROM Planets;
-- id |  name  | moons
-- ----+--------+-------
--  1 | Char   |     0
--  2 | Earth  |     1
--  3 | Aiur   |     6
--  4 | Korhal |     3

-- Find all races only display id and name
SELECT id, name FROM Races;
-- id |   name
-- ----+----------
--  1 | Zerg
--  2 | Terran
--  3 | Protoss
--  4 | Xel Naga

-- Find all heroes
SELECT * FROM Heroes;
-- id | planet_id | race_id |      alias      | level
-- ----+-----------+---------+-----------------+-------
--  1 |         2 |       2 | Jim Raynor      |     5
--  2 |         1 |       1 | Queen of Blades |    20
--  3 |         3 |       3 | Zeratul         |    15
--  4 |         4 |       2 | Arcturus Mensk  |     5

-- Find all Heroes level 10 and above only displaying alias as "Boss Hero"
SELECT alias as "Boss Hero" , level FROM Heroes WHERE level > 10;
--    Boss Hero    | level
-- -----------------+-------
-- Queen of Blades |    20
-- Zeratul         |    15
```

INNER JOIN query: Race `has_many` Heroes
```sql
-- Find all heroes belonging to race:Terran
SELECT * 
FROM Heroes
INNER JOIN Races
ON Heroes.race_id = Races.id
WHERE Races.name = 'Terran';
-- id | planet_id | race_id |     alias      | level | id |  name  |  description
-- ----+-----------+---------+----------------+-------+----+--------+---------------
--  1 |         2 |       2 | Jim Raynor     |     5 |  2 | Terran | Marine hoorah
--  4 |         4 |       2 | Arcturus Mensk |     5 |  2 | Terran | Marine hoorah
```

INNER JOIN query: Race `has_and_belongs_to_many` Planets
```sql
-- Find all planets controlled by race: Zerg
SELECT *
FROM Planets
INNER JOIN Planets_Races
ON Planets.id = Planets_Races.planet_id
INNER JOIN Races
ON Planets_Races.race_id = Races.id
WHERE Races.name = 'Zerg';
-- id | name  | moons | planet_id | race_id | id | name | description
-- ----+-------+-------+-----------+---------+----+------+-------------
--  1 | Char  |     0 |         1 |       1 |  1 | Zerg | Eats humans
--   2 | Earth |     1 |         2 |       1 |  1 | Zerg | Eats humans

-- Find all races that control planet: Earth 
SELECT Races.id, Races.name as race_alias
FROM Races
INNER JOIN Planets_Races
ON Races.id = Planets_Races.race_id
INNER JOIN Planets
ON Planets_Races.planet_id = Planets.id
WHERE Planets.name = 'Earth';
-- id | race_alias
-- ----+------------
--  1 | Zerg
--  2 | Terran

```

SQL basic boilerplate using starcraft relational data model based on races, planets and heroes

Howie Mann Tech Blog

Ex-Banker -> Tech Startups Stock Prices 📈