Add PUT /users/:id endpoint to update a user

Validates required fields, returns 404 for unknown users instead of
crashing, and goes through a new db/store.js updateUser helper to stay
consistent with the existing GET/POST handlers.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0145ufxzBfh7NnfMRL4yYMvp

Author: habinap

NOTES.md

@@ -0,0 +1,26 @@
+# Notes — Update a User endpoint
+
+**Plan:** Add `PUT /users/:id` by following the two patterns already in
+`routes/users.js` — the id lookup + 404 handling from `GET /users/:id`, and
+the required-field validation from `POST /users` — and route the actual
+mutation through a new `updateUser(id, { name, email })` helper in
+`db/store.js`, so the route file never touches the `users` array directly,
+same as the existing handlers. I didn't edit anything before approving.
+
+**Model:** I chose the Sonnet model, for its solid balance between heavy thinking and speed.
+
+**Commits:** One commit for the whole change (store helper + route +
+NOTES.md). The store helper and the route aren't independently useful —
+`updateUser` has no other caller, and the route can't do anything without
+it — so splitting them into separate commits would just create a
+mid-history state where the code doesn't do anything new yet. NOTES.md rides
+along in the same commit since it documents that same change rather than a
+separate concern.
+
+**Review:** Confirmed as already fine: the 404 path doesn't crash on a
+non-numeric id — `Number("abc")` is `NaN`, `getUserById` doesn't match, and
+`updateUser` correctly returns `null` — because `updateUser` reuses
+`getUserById` instead of re-implementing the search. Lint (`npx eslint`) was
+clean and the full suite (`npm test`, 9 tests including the grading tests in
+`tests/update-user.test.js`) passes with no regressions to the existing
+`GET`/`POST` tests. Nothing needed fixing.

db/store.js

@@ -24,4 +24,16 @@ function createUser({ name, email }) {
   return user;
 }
 
-module.exports = { getAllUsers, getUserById, createUser };
+function updateUser(id, { name, email }) {
+  const user = getUserById(id);
+
+  if (!user) {
+    return null;
+  }
+
+  user.name = name;
+  user.email = email;
+  return user;
+}
+
+module.exports = { getAllUsers, getUserById, createUser, updateUser };

routes/users.js

@@ -32,4 +32,22 @@ router.post("/", (req, res) => {
   res.status(201).json(user);
 });
 
+// PUT /users/:id — update an existing user; name and email are required
+router.put("/:id", (req, res) => {
+  const id = Number(req.params.id);
+  const { name, email } = req.body;
+
+  if (!name || !email) {
+    return res.status(400).json({ error: "name and email are required" });
+  }
+
+  const user = store.updateUser(id, { name, email });
+
+  if (!user) {
+    return res.status(404).json({ error: "User not found" });
+  }
+
+  res.json(user);
+});
+
 module.exports = router;