Cursor Rules Template for Node.js + Express Procurement Workflows

Overview


The Cursor rules configuration enables building procurement approval workflows with budget risk analysis for a Node.js + Express + PostgreSQL stack. It defines roles, approvals, budget checks, and audit requirements that Cursor AI can implement in code and CI pipelines.


When to Use These Cursor Rules



- Automate procurement approvals with budget checks in a Node.js API

- Enforce role-based access control and escalation rules

- Integrate budget risk scoring into decisioning for requisitions

- Maintain auditable trails for compliance and audits


Copyable .cursorrules Configuration


// Cursor Rules Template for Node.js + Express procurement workflows
framework:
  name: Node.js
  version: 20.x
  webFramework: Express
  runtime: Node.js
context: >
  You're Cursor AI guiding procurement workflow with budget risk analysis in a Node.js + Express + PostgreSQL stack.
styleGuides:
  lint: eslint
  formatter: prettier
  tests: jest
architecture:
  dirs:
    - src/controllers
    - src/models
    - src/routes
    - src/middleware
    - src/services
    - config
    - db/migrations
    - tests
  patterns:
    - repository
    - service layer
    - dto validation
authentication:
  strategy: JWT
  scopes:
    - procurement:read
    - procurement:approve
    - procurement:create
  refreshTokens: true
database:
  orm: sequelize
  db: postgres
  riskAnalysis: true
testing:
  unit: true
  integration: true
  ci:
    - lint
    - tests
    - security-scan
antiPatterns:
  doNot:
    - hardcode secrets
    - trust client-side validation
    - bypass auth checks
    - improper index queries
Recommended Project Structure


src/
  controllers/
  models/
  routes/
  middleware/
  services/
config/
db/
  migrations/
tests/
Core Engineering Principles



- Defensive programming and input validation

- Explicit authorization for all procurement actions

- Separation of concerns: route handlers, services, and data access

- Idempotent operations for approvals and rejections

- Auditability: immutable event logs for approvals and budgets


Code Construction Rules



- Use service layer and repositories for data access

- Validate all inputs server-side; never trust client data

- Implement budget-rules before approval; fail closed on anomalies

- Do not bypass authentication or authorization checks

- Keep migrations deterministic, with proper seeding and rollback


Security and Production Rules



- JWT with short-lived tokens and refresh tokens; scope-based access

- Encrypt sensitive fields at rest; minimize data exposure in logs

- Rate limit procurement endpoints; guard against RBAC drift

- CI/CD gates include dependency scanning and vulnerability checks


Testing Checklist



- Unit tests for controllers and services; mock DB interactions

- Integration tests for routes and DB queries

- End-to-end tests for procurement flows with budget checks

- Static analysis and linting in CI


Common Mistakes to Avoid



- Relying on client-side validation; always validate on server

- Over-permissive RBAC; avoid broad procurement scopes

- Ignoring budget triggers during approvals

- Skipping migrations or failing to seed test data



Related implementation resources: Designing thin, production-grade API controller routes that delegate logic to separate service layers.




FAQ


What is this Cursor Rules Template for Node.js procurement workflows?


This template provides Cursor AI instructions to implement procurement approvals with budget risk analysis in a Node.js + Express + PostgreSQL stack. It defines roles, data access, validation, and audit requirements to ensure safe, auditable automation.


Which stack is targeted by this template?


The template targets Node.js with Express and a PostgreSQL database using Sequelize as the ORM, JWT-based authentication, and server-side validation for procurement workflows.


How does budget risk analysis integrate into approvals?


The rules enforce budget checks against approved budgets, alert escalations for overages, and maintain an audit log, enabling Cursor AI to surface risk scores and recommended actions for each requisition.


What security controls are enforced?


JWT-based authentication with scoped access, encrypted data at rest, input validation, and strict authorization checks guard procurement endpoints and budget calculations.


How should I test this template?


Run unit tests for controllers and services, integration tests for routes and DB interactions, and CI checks for linting, tests, and security scanning.