Level 2: Mid-Level Developer

Implement user profile update endpoint following our patterns:

Context:
@api/users.js (existing user endpoints)
@middleware/auth.js (authentication)
@middleware/validation.js (request validation)
@services/UserService.js (business logic layer)

Requirements:
- PATCH /api/users/:id/profile
- Allow updates: name, bio, avatar_url
- Validate: name 3-50 chars, bio max 500 chars, avatar_url valid URL
- Authorization: users can only update own profile (admins can update any)
- Optimistic locking (use version field to prevent race conditions)
- Audit log all profile changes

Return 200 with updated profile or appropriate error (400/401/403/409)

Generate comprehensive documentation for the refactored checkout system:

1. Update function-level JSDoc for each extracted function
2. Create architecture diagram showing the flow
3. Write README section explaining:
   - How checkout works (sequence diagram)
   - Error handling strategy
   - Retry and idempotency guarantees
   - Testing approach
4. Update API documentation for the checkout endpoint

Review my changes for this PR and suggest improvements:

Files changed: [git diff --name-only]

Check for:
1. Unused imports or variables
2. Missing error handling
3. Inconsistent formatting
4. Incomplete JSDoc comments
5. Magic numbers that should be constants
6. Overly complex expressions that could be simplified

For each issue: show the fix, don't just describe it.

Review this PR as a senior engineer would:
@pull-request/diff

Focus on:
- Security vulnerabilities (injection, XSS, auth bypass)
- Performance issues (N+1 queries, unnecessary loops)
- Error handling gaps
- Testing coverage (what's missing?)
- Edge cases not considered

Be specific: cite line numbers, explain the issue, suggest fixes.

Summarize this PR for reviewers:
@pull-request/diff

Generate:
1. One-sentence summary of what changed
2. List of components modified (3-5 bullet points)
3. Testing approach and coverage
4. Top 3 areas needing careful review
5. Potential risks or breaking changes
6. Suggested review order (which files to read first)

Keep it concise—reviewers are busy.

# .github/workflows/ai-review.yml
name: AI Code Review

on: [pull_request]

jobs:
  ai-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        
      - name: AI Security Scan
        run: |
          cursor-cli review \
            --prompt "Scan for security vulnerabilities: \
              SQL injection, XSS, auth bypass, secrets exposure" \
            --pr ${{ github.event.number }} \
            --post-comment
        
      - name: AI Performance Check
        run: |
          cursor-cli analyze-performance \
            --pr ${{ github.event.number }} \
            --threshold "100ms p95" \
            --post-comment

# .cursorrules for API Backend

## Technology Stack
- TypeScript 5.0 with strict mode
- Express.js for HTTP
- PostgreSQL with TypeORM
- Jest for testing

## Code Standards

### Naming Conventions
- Functions and variables: camelCase
- Classes and interfaces: PascalCase
- Constants: UPPER_SNAKE_CASE
- Database tables: snake_case

### Error Handling
- Use custom error classes (UserNotFoundError, ValidationError)
- Never throw generic Error
- Always include error codes for API responses
- Log errors with structured context (requestId, userId)

### API Response Format
All endpoints return:
```json
{
  "success": boolean,
  "data": object | null,
  "error": { "code": string, "message": string } | null
}
```

### Testing Requirements
- Unit test coverage >80%
- Integration tests for all API endpoints
- Mock external services (Stripe, SendGrid)
- Test files colocated with source (same directory)

### Database Patterns
- Always use transactions for multi-step writes
- Parameterized queries only (prevent SQL injection)
- Include database indexes in migration files
- Soft delete by default (deleted_at column)

### Async/Await
- Always use async/await (never .then() chains)
- Wrap in try-catch for error handling
- Don't mix promises and async/await

### TypeScript
- Strict null checks enabled
- No 'any' type (use 'unknown' if type truly unknown)
- Define interfaces for all API request/response types
- Export types alongside implementations

## Security Requirements
- Rate limit all write endpoints (100 req/min per user)
- Validate all user input with Zod schemas
- Sanitize HTML content (use DOMPurify)
- Hash passwords with bcrypt (12 rounds)
- Use JWT with RS256 (not HS256)
- Set secure, httpOnly cookies
- Implement CSRF protection

## What to Never Do
- console.log in production code (use winston logger)
- Synchronous file operations
- SELECT * queries (list specific columns)
- Hardcoded secrets or configuration
- Catch errors without logging them

// .husky/pre-commit
#!/bin/sh

# Format code
npx prettier --write .

# Lint
npx eslint . --fix

# Type check
npx tsc --noEmit

# Run tests
npm test

# Check for common mistakes
node scripts/check-standards.js

// scripts/check-standards.js
const fs = require('fs');
const glob = require('glob');

const errors = [];

// Check 1: No console.log in source files
glob.sync('src/**/*.ts').forEach(file => {
  const content = fs.readFileSync(file, 'utf8');
  if (content.includes('console.log')) {
    errors.push(`${file}: contains console.log (use logger instead)`);
  }
});

// Check 2: All API routes have rate limiting
glob.sync('src/api/**/*.ts').forEach(file => {
  const content = fs.readFileSync(file, 'utf8');
  if (content.includes('router.post') && !content.includes('rateLimiter')) {
    errors.push(`${file}: POST route missing rate limiting`);
  }
});

// Check 3: Database queries use parameters
glob.sync('src/**/*.ts').forEach(file => {
  const content = fs.readFileSync(file, 'utf8');
  const hasStringInterpolation = /query\(`[^`]*\$\{/.test(content);
  if (hasStringInterpolation) {
    errors.push(`${file}: SQL query uses string interpolation (injection risk)`);
  }
});

if (errors.length > 0) {
  console.error('❌ Standards violations found:\n');
  errors.forEach(err => console.error(`  - ${err}`));
  process.exit(1);
}

Analyze changes from the last month:
@git-log/last-30-days

Identify:
1. Repeated patterns that should be abstracted
2. Architectural inconsistencies (some code uses pattern A, others pattern B)
3. Technical debt accumulation
4. Areas where AI suggestions diverge from our standards

For each issue, suggest a refactoring approach.