Cursor vs GitHub Copilot

Add JWT authentication to the existing API in this repo. Create POST /auth/register and POST /auth/login endpoints that hash passwords with bcrypt or argon2, never plaintext, then issue a short-lived access token (15 minutes) and a refresh token (7 days) stored as an httpOnly, Secure, SameSite=Strict cookie. Add middleware that verifies the access token signature and expiry, attaches the user to the request, and returns 401 with a WWW-Authenticate header on failure rather than 500. Include POST /auth/refresh with refresh token rotation and a revocation check against {{database}}. Read the signing secret from an environment variable and fail fast at startup if it is missing. Cover expired tokens, tampered signatures, and reuse of a rotated refresh token in tests, run them, and list changed files.

Add JWT authentication to this API. Use @workspace to locate the route registration file and the user model backed by {{database}} before touching anything. Implement POST /auth/login, verifying the password with the hashing library already in package.json, and POST /auth/refresh, which rotates a refresh token stored as an httpOnly, Secure, SameSite strict cookie. Access tokens live fifteen minutes, carry sub and role claims only, and are signed with a secret read from the environment, fail startup if it is missing rather than defaulting. Write middleware/requireAuth that returns 401 for absent or expired tokens and 403 when a role guard fails, with distinct machine-readable error codes. Do not store tokens in localStorage anywhere. List every changed file when done. I will verify with three curl calls: login, a protected route with the token, and the same route after tampering with one signature character, expecting 200, 200, 401.

Add a GraphQL API to this codebase in {{language}}. Define a schema with a {{resource}} type, queries for a single item by id and a paginated list using cursor-based connections (edges, nodes, pageInfo with hasNextPage and endCursor), and mutations for create, update, and delete that return the affected object plus a userErrors array instead of throwing on validation failures. Back the resolvers with {{database}} and add a dataloader for any nested field that would otherwise trigger N+1 queries. Reject queries deeper than 6 levels and cap the first argument at 100. Enable the playground only outside production. Write resolver tests that assert the batching actually happens by counting executed queries, run them, and summarize the schema and resolver files you touched.

Create a GraphQL API for a book catalog in {{language}}, schema first. Start in schema.graphql: types Book, Author, and Review, a books query with cursor pagination taking first and after, and an addReview mutation returning the updated Book. Then open src/resolvers/ and write one resolver file per type, reading from {{database}} through the existing db module, no raw connection strings. Wire a DataLoader for Author so resolving fifty books issues one author query, not fifty. Mutations must validate that rating sits between 1 and 5 and return a typed error in the payload rather than throwing. Reference #file:schema.graphql in follow-ups so the chat stays anchored to the contract. To verify, I will start the server and run a query fetching ten books with authors while logging SQL, expecting two statements.