Add PUT /users/:id (update a user) endpoint

NOTES.md

@@ -0,0 +1,36 @@
+## Plan
+
+Add a `PUT /users/:id` endpoint to update an existing user, following the
+conventions already established by `GET /users/:id` (404 handling) and
+`POST /users` (input validation). Data access goes through `db/store.js`,
+matching the existing `getUserById`/`createUser` pattern. The plan matched
+the existing code closely enough that it was approved without changes.
+
+## Model
+
+Chose Sonnet for the task, because it is not so complex — a single new
+route mirroring two existing handlers in the same file, with a red test
+suite already defining the exact contract.
+
+## Commits
+
+Split the commits into two logical units:
+1. `db/store.js` — add `updateUser(id, { name, email })`, returning
+   `undefined` on a missing id (mirrors `getUserById`'s no-throw convention).
+2. `routes/users.js` — add the `PUT /:id` route handler that validates the
+   body (400) and handles not-found (404).
+
+## Review
+
+Reviewed the diff for bugs, edge cases, the not-found path, and validation.
+Correctness holds: no crashes on non-numeric ids, no partial mutation before
+validation fails, and the store mutates the same object referenced by
+`GET /users/:id` so reads reflect the update immediately.
+
+Two lower-severity observations, both left as-is since they mirror existing
+conventions rather than being regressions:
+- Validation runs before the existence check, so `PUT` on an unknown id with
+  a missing field returns 400 instead of 404.
+- Only presence is validated (`!name || !email`), not type or format — same
+  gap as the existing `POST /users` validation, so fixing it here alone
+  would be inconsistent with the rest of the resource.

db/store.js

@@ -24,4 +24,16 @@ function createUser({ name, email }) {
   return user;
 }
 
-module.exports = { getAllUsers, getUserById, createUser };
+function updateUser(id, { name, email }) {
+  const user = users.find((user) => user.id === id);
+
+  if (!user) {
+    return undefined;
+  }
+
+  user.name = name;
+  user.email = email;
+  return user;
+}
+
+module.exports = { getAllUsers, getUserById, createUser, updateUser };

routes/users.js

@@ -32,4 +32,22 @@ router.post("/", (req, res) => {
   res.status(201).json(user);
 });
 
+// PUT /users/:id — update an existing user; name and email are required
+router.put("/:id", (req, res) => {
+  const id = Number(req.params.id);
+  const { name, email } = req.body;
+
+  if (!name || !email) {
+    return res.status(400).json({ error: "name and email are required" });
+  }
+
+  const user = store.updateUser(id, { name, email });
+
+  if (!user) {
+    return res.status(404).json({ error: "User not found" });
+  }
+
+  res.json(user);
+});
+
 module.exports = router;