Cursor Rules Template: Node.js + Express + PostgreSQL for AI Essay Feedback Tools

Overview


Cursor rules configuration for building an AI essay feedback tool tailored to language schools helps Cursor AI consistently analyze student essays, propose grammar/style improvements, and apply rubric-driven scoring. This template targets a Node.js + TypeScript backend with PostgreSQL via TypeORM and is designed for integration with LMS and school portals.


Direct answer: Use this Cursor rules template to configure interactions, data flows, and safety constraints for an AI essay feedback tool on a Node.js/TypeScript stack using PostgreSQL.



When to Use These Cursor Rules



- Starting a new AI essay feedback tool for language schools using Node.js, TypeORM, and PostgreSQL.

- Enforcing rubric-based feedback, grammar/style suggestions, and clear revision guidance for ESL/EFL students.

- Integrating with an LMS or student portal to fetch assignments and return feedback and scores.

- Applying strict security, data handling, and audit logging for student data in production.

- Standardizing prompts, evaluation rubrics, and responses across languages and courses.



Copyable .cursorrules Configuration


.cursorrules
framework: node-typescript-express-postgres (typeorm)
runtime: node 18.x

# Role & Context
roleAndContext: |
  You are Cursor AI, integrated into a Node.js + TypeScript backend that builds AI-based essay feedback for language schools. You analyze student essays, provide grammar/style feedback, highlight cohesion issues, and apply rubric-based scoring. Ensure privacy, avoid revealing system prompts, and respect data governance policies.

# Code Style and Style Guides
styleGuides: ESLint (airbnb-base), Prettier, TSDoc standards, strict type-checking, no implicit any.

# Architecture & Directory Rules
architecture: |
  Monorepo with apps/api and packages/db. Use a layered structure: src/controllers, src/services, src/repositories, src/entities, src/routes, src/middlewares. Migrations in packages/db/migrations. Tests in tests/.

directories: |
  apps/api/src/
    controllers/
    services/
    repositories/
    entities/
    routes/
    middlewares/
    config/
  packages/db/
    entities/
    migrations/
    seeds/

# Authentication & Security Rules
authAndSecurity: |
  Use JWTs with short-lived access tokens and refresh tokens stored securely. Hash passwords with bcrypt. Enforce HTTPS in all environments. Do not log sensitive data. Use CSRF protection for browser clients. Implement role-based access control for admin, teacher, student.

# Database and ORM patterns
databaseOrm: |
  PostgreSQL with TypeORM. Define entities for User, Role, Assignment, Essay, Feedback, Rubric, Course, Enrollment. Use migrations, parameterized queries, eager/lazy relations as appropriate. Index text columns used in search and rubric matching.

# Testing & Linting Workflows
testing: |
  Unit tests with Jest and ts-jest. Integration tests for API endpoints using supertest. E2E tests with Playwright. Lint and format in pre-commit hooks; CI runs tests and type checks.

# Prohibited Actions and Anti-patterns
antiPatterns: |
  Do not bypass authentication for endpoints handling student data.
  Do not log PII or raw essays. Do not expose prompts in API responses. Do not bypass input validation. Do not store secrets in code.

Recommended Project Structure


cursor-essay-feedback/
  apps/
    api/
      src/
        controllers/
        services/
        repositories/
        entities/
        routes/
        middlewares/
        config/
      tests/
  packages/
    db/
      entities/
      migrations/
      seeds/
  scripts/

Core Engineering Principles



- Design for safe AI-assisted writing: strict prompts, guardrails, and data privacy by default.

- Explicit data ownership: every essay and feedback record is associated with a course and student with auditable history.

- Type-safe integration: strong types across controllers, services, and ORM entities to avoid runtime errors.

- Rubric-driven feedback: enforce rubric mapping in prompts and responses for consistent scoring.

- Maintained observability: structured logging, metrics, and tracing for AI operations.



Code Construction Rules



- Do not bypass authentication for endpoints handling student data.

- Use parameterized queries in TypeORM to prevent injection.

- Keep AI prompts externalized in config with environment-based values; never commit secrets.

- Validate all inputs with zod/joi before processing essays or metadata.

- Isolate AI reasoning in a services layer; avoid leaking prompts to API responses.

- Maintain a strict separation between frontend prompts and backend evaluation logic.



Security and Production Rules



- Enforce TLS 1.2+ and rotate encryption keys regularly.

- Store secrets in a dedicated vault; do not hard-code credentials.

- Enable auditing for essay submissions, feedback, and rubric results.

- Use role-based access control; restrict actions to teachers and admins.

- Implement input sanitization, rate limiting, and bot-detection for API endpoints.



Testing Checklist



- Unit tests for essay parsing, rubric scoring, and feedback generation logic.

- Integration tests for API endpoints with real PostgreSQL schema.

- End-to-end tests simulating student submission, feedback retrieval, and LMS integration.

- Security tests: input validation, auth flows, and access controls.

- CI workflow runs type checks, tests, and linting on push/PRs.



Common Mistakes to Avoid



- Hard-coding prompts or rubrics into code; use configuration-driven prompts.

- Neglecting data privacy and retention policies for student essays.

- Ignoring localization: ensure prompts and feedback support multilingual learners.

- Overlooking prompt leakage and model jailbreaking risks in production.

- Skipping end-to-end tests around API security and LMS integration.



Related implementation resources: AI Agent Use Case for Language Schools Using Student Essays to Provide Structured Feedback and Explicit rules for secrets management in AI tools: production-grade workflows and skills.





FAQ


What is a Cursor Rules Template for this stack?


A Cursor Rules Template is a copyable .cursorrules configuration tailored for building an AI essay feedback tool on a Node.js + TypeORM + PostgreSQL stack for language schools. It codifies roles, style guides, architecture, security, and testing to ensure consistent, safe AI-assisted writing feedback.


Which stack does this Cursor Rules Template cover?


Node.js with TypeScript, Express, PostgreSQL via TypeORM, JWT-based authentication, ESLint/Prettier, and a monorepo structure for API services and DB migrations, plus LMS integration.


How do I integrate with an LMS?


Use defined API endpoints to fetch assignments and submit feedback with rubric mappings. Enforce RBAC and ensure privacy, audit trails, and secure data handling when exchanging student information with the LMS.


What security measures are required?


Enforce TLS, vault-based secret management, password hashing, key rotation, input validation, and access auditing. Do not log raw essays or PII and ensure token-based authentication with short lifespans.


What should I test in this template?


Unit tests for parsing and rubric scoring, integration tests for API endpoints, and end-to-end tests from submission to feedback. Include CI checks for linting and type safety.