Add PUT /users/:id endpoint to update a user

NOTES.md

@@ -0,0 +1,37 @@
+# NOTES
+
+## Plan I approved
+
+Add a `PUT /users/:id` endpoint to the users resource, following the patterns already
+in the repo. Two changes: a new `updateUser(id, { name, email })` helper in
+`db/store.js` that returns the updated user or `undefined` when the id is unknown, and
+a new route in `routes/users.js` that parses the id, validates the body, calls the
+helper, and maps the result to `200` / `404`. Validation runs before the store lookup,
+so a missing field returns `400` even for an existing id. I did not need to edit the
+plan before approving it — it already covered the not-found and invalid-input cases
+the tests check.
+
+## Model choice
+
+Claude Sonnet. The change is small and well-specified by the existing tests and code
+conventions, so a fast, capable model was the right fit; no need for a heavier model
+on a single-endpoint feature.
+
+## Commit split
+
+Three logical commits, each understandable without the diff:
+1. `updateUser` helper in the store — the data layer, in isolation.
+2. `PUT /users/:id` route with validation and 404 handling — the HTTP layer that uses
+   the helper.
+3. This `NOTES.md`.
+
+Keeping the store and route changes apart makes each commit reviewable on its own and
+mirrors the layering in the codebase.
+
+## What review caught
+
+Review confirmed the ordering of checks: validating the body before the store lookup
+is what makes `PUT /users/1` with a missing field return `400` rather than falling
+through. It also confirmed the endpoint follows the existing style — `Number(req.params.id)`,
+the same `{ error: ... }` shape, and going through `db/store.js` for data access. No
+bugs found; `npm test` and `npm run lint` are both green.

db/store.js

@@ -24,4 +24,15 @@ function createUser({ name, email }) {
   return user;
 }
 
-module.exports = { getAllUsers, getUserById, createUser };
+function updateUser(id, { name, email }) {
+  const user = getUserById(id);
+  if (!user) {
+    return undefined;
+  }
+
+  user.name = name;
+  user.email = email;
+  return user;
+}
+
+module.exports = { getAllUsers, getUserById, createUser, updateUser };

routes/users.js

@@ -32,4 +32,22 @@ router.post("/", (req, res) => {
   res.status(201).json(user);
 });
 
+// PUT /users/:id — update an existing user; name and email are required
+router.put("/:id", (req, res) => {
+  const id = Number(req.params.id);
+  const { name, email } = req.body;
+
+  if (!name || !email) {
+    return res.status(400).json({ error: "name and email are required" });
+  }
+
+  const user = store.updateUser(id, { name, email });
+
+  if (!user) {
+    return res.status(404).json({ error: "User not found" });
+  }
+
+  res.json(user);
+});
+
 module.exports = router;