Cursor Rule: Back End

1---
2description: Rules for back-end development
3globs: *.js, *.jsx, *.ts, *.tsx
4alwaysApply: false
5---
6# Backend Development Rules
7 
8## Languages and Frameworks
9 
10Expert in Node.js, Express, Next.js API Routes, Server Actions, Route Handlers, Fastify, Prisma, Drizzle.
11 
12Use JavaScript by default. Use TypeScript when explicitly requested or when project requires it.
13 
14For monolithic Next.js apps, prefer Server Actions over API Routes when possible for better type safety and reduced boilerplate.
15 
16## Next.js Backend Patterns
17 
18Server Actions are the preferred way to handle mutations in Next.js 16:
19```javascript
20'use server'
21export async function createUser(formData) {
22  // Validate, process, return result
23}
24```
25 
26Use Route Handlers (app/api) for:
27- External API consumption
28- Webhooks
29- Non-form mutations
30- Integrations with third-party services
31 
32Server Actions provide automatic serialization, type safety, and progressive enhancement.
33 
34Use "use cache" directive for caching expensive computations or data fetching.
35 
36Always revalidate or update cache after mutations using updateTag() or revalidateTag().
37 
38## Error Handling
39 
40Wrap all async operations in try-catch blocks. Never let errors crash the server.
41 
42Return structured error responses with appropriate HTTP status codes and messages.
43 
44Create custom error classes for different error types (ValidationError, AuthError, NotFoundError).
45 
46Good:
47```javascript
48try {
49  const user = await db.user.findUnique({ where: { id } })
50  if (!user) throw new NotFoundError('User not found')
51  return user
52} catch (error) {
53  if (error instanceof NotFoundError) {
54    return { error: error.message, status: 404 }
55  }
56  return { error: 'Internal server error', status: 500 }
57}
58```
59 
60Log errors properly with context (user ID, request ID, timestamp) but never expose stack traces to clients.
61 
62## Input Validation
63 
64Validate all incoming data at the entry point. Never trust client input.
65 
66Use validation libraries like Zod or Yup for schema validation:
67```javascript
68const userSchema = z.object({
69  email: z.string().email(),
70  age: z.number().min(18)
71})
72 
73const result = userSchema.safeParse(data)
74if (!result.success) {
75  return { error: result.error.flatten(), status: 400 }
76}
77```
78 
79Validate types, formats, lengths, and business rules before processing.
80 
81Sanitize HTML and SQL inputs to prevent injection attacks.
82 
83Return clear validation errors that help clients fix issues without exposing system internals.
84 
85## Authentication and Authorization
86 
87// … truncated