AI For Developers With GitHub Copilot, Cursor AI & ChatGPT - Chapter 5. Practice Project: Creating a REST API with AI

The user plans to build a REST API using Node and Express that allows authenticated users to create, share, and register/unregister for events. They want to leverage AI (specifically ChatGPT) initially to help plan the application structure and core features without generating code yet. The AI provides helpful suggestions including:

Overall, the AI helps confirm and expand the user’s initial requirements and provides a solid planning foundation. The user will next move to using AI-assisted coding tools like Cursor and GitHub Copilot to build the actual application code based on this plan.

The user is setting up a new Node.js REST API project using Cursor in an empty folder. They start by creating a package.json file with npm init -y, then manually edit it to set the main entry file to app.js, add their name and company, specify "type": "module" for ES module support, and add a dev script using Node.js’s built-in watch mode instead of nodemon. They create a .env file for environment variables like JWT secrets and a .gitignore file to exclude .env, node_modules, and Mac-specific files. They install Express.js as the main dependency for building the API. The user organizes the project structure by adding root-level folders: controllers, models, routes, and a public/images folder for uploads. Up to this point, all setup is manual since the user knows what they want, but next they plan to use Cursor’s AI features to generate code and files to build out the API.

The user is working on building an application with multiple requirements and is using ChatGPT and CursorComposer to generate code and files. They emphasize breaking down the app development into smaller steps rather than one big prompt to improve results. The first step tackled is user registration and login, focusing on generating a user model (without classes or OOP), sign-up and login routes, and linking routes to controllers. They requested no JWT or database code yet. CursorComposer generated a user.js model with an object containing two methods (though the user prefers separate functions), routes for sign-up and login pointing to controller functions, and integration of these routes in app.js with JSON body parser middleware. Overall, the generated structure looks reasonable but the user has some reservations about certain suggestions and wants to refine the code further.

The user describes their preferences and workflow for organizing JavaScript code, focusing on two main points:

They provide feedback to an AI coding assistant (Cursor) to adjust the code accordingly. Cursor updates the code to have standalone functions like createUser and findUserByEmail, and switches all import/export statements to ESM syntax. The user accepts these changes, rejects unnecessary ones (like redundant package.json or gitignore edits), and manually renames files to their preferred naming convention.

Additionally, the user prefers defining functions with the traditional function keyword rather than arrow functions assigned to constants. Cursor helps convert arrow functions to this style with export keywords, speeding up the process by suggesting similar changes for multiple functions.

Overall, the user achieves a clean, modular codebase with standalone exported functions using modern ESM syntax and traditional function declarations, setting a solid foundation for further development of user registration features with AI assistance.

The user is enhancing a Node.js Express REST API by integrating a SQLite database to store user data. They use an AI chat tool within their code editor (Cursor) to help generate code for database setup, including creating a database.js file to initialize the database and update user-related model functions to interact with the database. Initially, the AI suggests using the sqlite3 package, but the user prefers the better-sqlite3 package for improved performance and requests updated instructions accordingly.

The user encounters some workflow issues with applying AI-generated code snippets directly to the correct files, so they manually create the database.js file and then apply the changes. They review and tweak the generated code, such as removing unnecessary "auto increment" from the table schema for better performance. The user updates the user.js model to import the database functions and implement user creation and lookup by email using the database. Finally, they modify app.js to import and call the database initialization function, ensuring the server shuts down if initialization fails.

Overall, the process involves using AI-assisted code generation combined with manual adjustments and testing to integrate a SQLite database into the existing Node Express application for persistent user data storage.

The user explains improvements made to their app.js code: instead of exporting the app object directly, they now start the server with app.listen and initialize the database inside the listen callback. This ensures the database only initializes if the server starts successfully. They also modify the port configuration to use an environment variable (PORT) with a fallback to 3000, making the app more flexible. The updated app.js handles requests to /users by routing them to user routes, which invoke controller functions that interact with the user model to perform database operations like creating users. Overall, the changes improve server startup flow and configuration.

The application is progressing steadily, with a focus on improving user data validation during account creation. Instead of blindly accepting input, the developer wants to ensure the email is valid, unique in the database, and the password meets a minimum length (at least six characters) and is not just blank spaces. They use inline AI-assisted code editing to enhance the validation logic in the user controller, adding checks for trimmed input, regex-based email validation, password length, and duplicate email detection. While AI helped generate this improved validation, the developer notes that sometimes manual coding might be faster and cautions against over-reliance on AI. They also plan lighter validation for login inputs and acknowledge that currently passwords are stored in plain text, which will be addressed later. Overall, this is an iterative step toward a more robust and secure user signup process.

The content explains how to test a REST API during development using the npm run dev command to start the server and Postman as a tool to send requests. Specifically, it demonstrates sending a POST request to the /users/signup endpoint with JSON data containing an email and password. The server responds with a success message and user details, which are stored in a SQLite database file. However, the password is stored in plain text, which is a security risk. The author notes the need to fix this by hashing the password before storage, as storing unencrypted passwords can lead to serious vulnerabilities if the database is compromised. They mention that while Cursor suggested code that hashes passwords, their current setup does not, so they plan to update it accordingly.

The user is updating their application to securely handle passwords by hashing them before storage using the bcryptjs package. They manually install bcryptjs, then modify the code to hash passwords asynchronously before saving them. They add a new function to verify user credentials by comparing a plaintext password with the stored hashed password. This verification function is integrated into the login controller, which is updated to handle asynchronous calls and return appropriate success or error responses.

After implementing these changes, they clear the existing database to remove plaintext passwords and restart the server. Testing signup confirms that passwords are now stored as hashes. However, they encounter two issues: the signup response returns an empty object instead of user data, and login attempts produce errors. These problems are identified for further debugging and fixing in subsequent steps.

The content describes using AI assistance to debug and fix errors in a coding project. Initially, a "reference error" occurs because a function (verifyUserCredentials) is called but not defined or imported. The AI suggests adding the correct import statement, which resolves the issue quickly.

Next, the user encounters a problem where a sign-up route returns an empty user object instead of actual user data. By providing the AI with relevant code files (controller, model, routes) and the error context, the AI identifies that the asynchronous createUser function was not awaited. The fix involves marking the controller function as async and adding await before the createUser call. Applying these changes fixes the issue, and subsequent user creation and login attempts work correctly, including proper error handling for duplicate emails or invalid credentials.

Overall, the example highlights how combining developer knowledge with AI tools can speed up debugging and development, making it easier to identify and fix issues efficiently.

The application is progressing, currently focusing on user management before starting on events. A key missing feature is authentication using JSON Web Tokens (JWTs), a common method for securing REST APIs. JWTs serve as proof of authentication, allowing a frontend to store and send tokens with requests to verify user identity.

To implement this, the developer plans to install the JSON Web Token package via npm. Instead of placing token generation code directly in the user controller, utility functions for creating and verifying JWTs will be added in a new util/auth.js file. These tokens will include the user’s ID and email and are signed with a secret key known only to the backend, ensuring token authenticity.

After setting up these utility functions, they will be used in the user controller to generate and send JWTs upon successful signup or login. The frontend can then store these tokens and include them in future requests to access protected routes. The next step is to implement routes that require authenticated access using these tokens.

The speaker discusses expanding their application by adding event-related routes (such as creating, editing, and deleting events) after already having sign-up and login routes. They switch to Visual Studio Code with GitHub Copilot to demonstrate both tools, though they usually stick to one. They create an events.js file in the routes folder and use Copilot to generate event-specific route code with ESM imports/exports. However, Copilot’s suggestions include unnecessary or incorrect database-related code because it lacks full context of the project in the inline chat mode. The speaker then manually simplifies and cleans up the generated code, removing irrelevant parts and planning to add more functionality later.

The user is working on adding database functionality to their project, specifically for managing event data. They plan to create a new events controller and a model file (event.js) to handle CRUD operations like creating, finding, updating, and deleting events with fields such as title, description, address, and date (image handling to be added later). Initially, the AI suggested using an in-memory events array, which was not helpful, so the user explicitly specified using a SQLite database. They then updated the database.js file to include an events table with appropriate columns. After that, they applied changes to the event.js model file to interact with this SQLite database for event operations. The user is manually integrating AI-generated code with GitHub Copilot assistance and ensuring the database schema and model functions align properly.

The user describes their process of integrating database model functions into an events controller and then wiring those controller functions into the events routes. They start by importing and exporting functions like insert, update, delete, and get events in the event.js model file. Then, in the events controller, they import these model functions, rename some for clarity (e.g., create, edit, deleteItem, getAll, getSingle), and remove aliases to simplify the code. They note that some manual edits were needed, which could be faster with smarter tooling like Cursor. Finally, they update the events routes file to import all controller functions as a single object (named "events") and use dot notation (e.g., events.create) for readability, manually adjusting the import and usage after an initial unsuccessful attempt by Copilot. Overall, the user successfully sets up the flow from models to controller to routes with clean, readable code.

The content describes setting up event routes in a Node.js app. The key steps include:

Overall, the setup works but requires additional validation and fine-tuning of the event controller logic.

The user wants to improve their event creation process by adding two main features: first, validating the submitted event data (title, description, address, date) before storing it in the database, ensuring fields are not empty or just blanks and that the date is valid; second, restricting access to event-related routes so only authenticated users with a valid JSON Web Token can use them. They used AI (Copilot) to add validation code that trims input, checks for empty or invalid fields, and returns error responses for invalid data. Testing showed the validation works as expected. The user acknowledges that further refinements (like max length checks) are possible but is satisfied with the current solution for the demo. The next planned steps are to add similar validation for event editing and to enforce authentication on event creation and modification routes.

The content describes adding validation to a new route, similar to previous event creation checks, using GitHub Copilot to assist with code updates. The next step involves protecting certain event routes so only authenticated users can access them. This is done using a utility function, verifyToken, located in an auth.js file, which validates tokens attached to incoming requests.

Additionally, a new utility function is introduced that extracts the token from the authorization header (following the "Bearer token" convention), verifies it using verifyToken, and either returns an error if invalid or stores the decoded user data (ID and email) in the request object. This function acts as middleware to authenticate requests before allowing access to route handlers, ensuring only requests with valid tokens proceed, while invalid ones receive error responses.

The summary explains how to selectively protect certain Express.js event routes (specifically create, update, and delete) using an authentication middleware called authenticate. The middleware is applied only to POST, PUT, and DELETE routes, while GET routes remain publicly accessible.

Key points:

The key topics and entities discussed are:

Overall, the focus is on implementing proper user-based authorization for event management in a web application by updating the database schema, models, controllers, and middleware accordingly.

The user tested their app’s authorization by deleting the database, restarting the server, and reinitializing it. They created a new user and received a token, then posted a new event. Next, they created a second user with a different token and tried to edit and delete the first user’s event, which correctly resulted in a "forbidden" error due to lack of authorization. Finally, using the original creator’s token, they successfully edited the event. This confirmed that the app properly restricts event modifications to the user who created them.

The user describes implementing event registration and unregistration functionality in a web app. They log in with a second user and create POST and DELETE requests to register and unregister for an event by targeting routes like /event/1/register and /event/1/unregister. The event ID is passed via the URL, and the user ID is extracted from an authorization token in the request header.

Initially, the registration code fails due to a missing database reference because database operations were handled in a separate model file (event.js). The user refactors the code by moving the register/unregister database functions into the model file and importing them into the controller. This separation keeps database logic centralized.

After refactoring, registration and unregistration requests work correctly, returning success or failure based on the user’s registration status. The user notes that while duplicate registrations or unregistering when not registered could be prevented with extra checks, they keep the app simple and functional as is. Overall, the process demonstrates setting up authenticated event registration endpoints with proper separation of concerns between controller and model layers.

The content describes adding image upload functionality to an event management app that already supports user signup/login and event CRUD operations. The goal is to allow attaching an image when creating or editing events, storing the image locally, and serving it later.

Key steps outlined:

This approach enables image upload, storage, validation, and database association for events, completing the app’s core functionality.

The user describes updating code to enable image upload functionality for events in their application. They use AI tools like GitHub Copilot and ChatGPT to assist with coding and generating dummy images. Key steps include:

Overall, the user successfully implements and tests image upload functionality integrated with event data storage, leveraging AI assistance and manual adjustments.

The demo REST API is mostly complete, but to enable interaction from decoupled front-end or mobile applications, two key additions are needed:

With these middleware additions, the API becomes fully accessible and usable by external front-end clients, allowing both API requests and image retrieval to work seamlessly.