Add PUT /users/:id to update a user

[RFrams]

What changed

Adds the "update a user" endpoint to the users resource.

• routes/users.js — new PUT /users/:id. Validates that name and email are both present (400 if not), coerces the :id param to a number, updates the user via the store, returns 404 when no user has that id, and responds 200 with the updated user.
• db/store.js — new updateUser(id, { name, email }) helper. Looks the user up with the existing getUserById, updates the fields in place, and returns undefined when there's no match so callers branch on a falsy result the same way they do for getUserById.
• NOTES.md — write-up of the plan, model choice, commit split, and review.

Three commits: store helper, then the route that calls it, then the notes.

Why

The endpoint was specified but not implemented, so PUT requests fell through to Express's default handler and always returned 404. The change follows the existing patterns in the file: the // VERB /path — description comment, return res.status(N).json({ error }) for failures, error strings reused verbatim from the POST and GET handlers, and all data access going through db/store.js rather than touching the users array directly. server.js needed no changes — the users router is already mounted there.

Validation is deliberately the same truthiness check as POST /users — nothing stricter — so the two routes on the same resource stay consistent. A whitespace-only or non-string value is not rejected; if that's wanted it should be added to both routes together.

What a reviewer should test

npm test (all 9 green) and npm run lint (clean). Then against a running server (npm run dev):

• Happy path: PUT /users/1 with {"name":"Ada L.","email":"ada@new.com"} → 200 and the updated user in the body. A follow-up GET /users/1 shows the change persisted.
• Not found: PUT /users/9999 with a valid body → 404 {"error":"User not found"}.
• Not found, non-numeric id: PUT /users/abc with a valid body → 404, no crash (Number("abc") is NaN, which never matches an id).
• Invalid input, missing field: PUT /users/1 with {"name":"Only a name"} → 400 {"error":"name and email are required"}.
• Invalid input, empty / no body: PUT /users/1 with no body → 400.
• Invalid input, array body: PUT /users/1 with [1,2,3] → 400, no crash.
• Extra fields ignored: PUT /users/1 with {"name":"a","email":"b","id":999} → 200, id stays 1.

🤖 Generated with Claude Code

[mateacademy-ai-mentor]

Review Summary

Your implementation fully satisfies all task requirements. The PUT /users/:id endpoint correctly validates name/email presence (returning 400), returns 404 for non-existent users, and delegates all data access through db/store.js with the new updateUser helper. The one documented design decision — accepting empty strings as valid values to stay consistent with the existing POST /users behavior — is intentional and well-reasoned, not a blocker. All 9 tests pass, npm run lint is clean, and the three logical commits (helper → route → docs) follow a clean dependency order. Well done on the thorough self-review and for catching the non-numeric id edge case before opening the PR.

---

✨ Please rate this review in the Platform's notification center¹. I will be grateful for your feedback! ✨

Footnotes

1. Rate AI review example ↩