Cursor Rules File: Complete .cursorrules Syntax Reference

---
description: "Project coding standards and patterns"
alwaysApply: true
---

# Project Rules

## Tech Stack
- Framework: Next.js 14 (App Router)
- Language: TypeScript (strict mode)
- Database: Supabase with RLS
- Styling: Tailwind CSS

## Code Patterns
- Use server components by default
- Client components only when needed (interactivity)
- Validate all inputs with Zod schemas

## Security
- NEVER hardcode API keys or secrets
- ALWAYS use parameterized queries
- Check authentication on every API route

---
description: "TypeScript-specific rules for type safety"
alwaysApply: false
globs: ["**/*.ts", "**/*.tsx"]
---

# TypeScript Rules

## Type Safety
- No `any` types - use `unknown` and narrow
- Export types from dedicated /types folder
- Use Zod for runtime validation

## Patterns
```typescript
// Good: Explicit return types
function getUser(id: string): Promise<User | null> {
  return db.user.findUnique({ where: { id } })
}

// Bad: Implicit any
function getUser(id) {
  return db.user.findUnique({ where: { id } })
}
```

---
description: "Security patterns to prevent common vulnerabilities"
alwaysApply: true
---

# Security Rules

## Database Queries
NEVER use string concatenation for SQL:
```typescript
// WRONG - SQL injection risk
db.query(`SELECT * FROM users WHERE id = ${userId}`)

// CORRECT - parameterized query
db.query('SELECT * FROM users WHERE id = $1', [userId])
```

## Authentication
Check auth on EVERY API route:
```typescript
export async function POST(request: Request) {
  const session = await getServerSession()
  if (!session) {
    return new Response('Unauthorized', { status: 401 })
  }
  // Process request...
}
```

## Input Validation
Validate ALL user input:
```typescript
const schema = z.object({
  email: z.string().email(),
  name: z.string().min(1).max(100)
})

const result = schema.safeParse(input)
if (!result.success) {
  return new Response('Invalid input', { status: 400 })
}
```