fix: SQLite boolean binding, CSS brace, race condition, 0 npm vulns, code-splitting

backend/src/database/DatabaseInterface.ts

@@ -79,6 +79,26 @@ export interface DBSession {
   created_at: string;
 }
 
+export interface DBNotification {
+  id: string;
+  user_id: string;
+  type: string;
+  title: string;
+  message: string;
+  read: number;
+  created_at: string;
+}
+
+export interface DBProjectShare {
+  id: string;
+  project_id: string;
+  shared_with_email: string;
+  shared_by: string;
+  permission: string;
+  share_token: string | null;
+  created_at: string;
+}
+
 export interface DatabaseInterface {
   init(): Promise<void>;
   close(): void;
@@ -132,4 +152,17 @@ export interface DatabaseInterface {
   getSession(token: string): DBSession | null;
   deleteSession(token: string): boolean;
   deleteExpiredSessions(): void;
+
+  // Notifications
+  listNotifications(userId: string): DBNotification[];
+  getNotification(id: string): DBNotification | null;
+  createNotification(data: Partial<DBNotification>): DBNotification;
+  markNotificationRead(id: string): boolean;
+  deleteNotification(id: string): boolean;
+
+  // Project Shares
+  listProjectShares(projectId: string): DBProjectShare[];
+  getProjectShare(id: string): DBProjectShare | null;
+  createProjectShare(data: Partial<DBProjectShare>): DBProjectShare;
+  deleteProjectShare(id: string): boolean;
 }

backend/src/database/SqliteAdapter.ts

@@ -9,6 +9,7 @@ import { randomUUID } from 'crypto';
 import type {
   DatabaseInterface, DBProject, DBDrawing, DBLayer,
   DBElement, DBBlock, DBSetting, DBUser, DBSession,
+  DBNotification, DBProjectShare,
 } from './DatabaseInterface.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -146,7 +147,7 @@ export class SqliteAdapter implements DatabaseInterface {
     const id = data.id ?? `layer-${Date.now()}`;
     this.db.prepare(
       'INSERT INTO layers (id, drawing_id, name, visible, locked, color, line_type, transparency, sort_order, parent_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
-    ).run(id, data.drawing_id!, data.name ?? 'Layer', data.visible ?? 1, data.locked ?? 0,
+    ).run(id, data.drawing_id!, data.name ?? 'Layer', data.visible !== undefined ? (data.visible ? 1 : 0) : 1, data.locked !== undefined ? (data.locked ? 1 : 0) : 0,
       data.color ?? '#ffffff', data.line_type ?? 'solid', data.transparency ?? 0,
       data.sort_order ?? 0, data.parent_id ?? null);
     return this.db.prepare('SELECT * FROM layers WHERE id = ?').get(id) as DBLayer;
@@ -157,7 +158,7 @@ export class SqliteAdapter implements DatabaseInterface {
     const vals: any[] = [];
     for (const [k, v] of Object.entries(data)) {
       if (['name','visible','locked','color','line_type','transparency','sort_order','parent_id'].includes(k)) {
-        sets.push(`${k} = ?`); vals.push(v);
+        sets.push(`${k} = ?`); vals.push(k === 'visible' || k === 'locked' ? (v ? 1 : 0) : v);
       }
     }
     if (sets.length > 0) {
@@ -189,7 +190,7 @@ export class SqliteAdapter implements DatabaseInterface {
     const vals: any[] = [];
     for (const [k, v] of Object.entries(data)) {
       if (['layer_id','type','x','y','width','height','properties_json'].includes(k)) {
-        sets.push(`${k} = ?`); vals.push(v);
+        sets.push(`${k} = ?`); vals.push(k === 'visible' || k === 'locked' ? (v ? 1 : 0) : v);
       }
     }
     if (sets.length > 0) {
@@ -221,7 +222,7 @@ export class SqliteAdapter implements DatabaseInterface {
     const vals: any[] = [];
     for (const [k, v] of Object.entries(data)) {
       if (['name','description','category','elements_json','thumbnail'].includes(k)) {
-        sets.push(`${k} = ?`); vals.push(v);
+        sets.push(`${k} = ?`); vals.push(k === 'visible' || k === 'locked' ? (v ? 1 : 0) : v);
       }
     }
     if (sets.length > 0) {
@@ -265,4 +266,51 @@ export class SqliteAdapter implements DatabaseInterface {
   deleteExpiredSessions(): void {
     this.db.prepare('DELETE FROM sessions WHERE expires_at < ?').run(Date.now());
   }
+
+  // ─── Notifications ──────────────────────────────────
+  listNotifications(userId: string): DBNotification[] {
+    return this.db.prepare('SELECT * FROM notifications WHERE user_id = ? ORDER BY created_at DESC').all(userId) as DBNotification[];
+  }
+
+  getNotification(id: string): DBNotification | null {
+    return this.db.prepare('SELECT * FROM notifications WHERE id = ?').get(id) as DBNotification | null;
+  }
+
+  createNotification(data: Partial<DBNotification>): DBNotification {
+    const id = data.id ?? `notif-${Date.now()}`;
+    this.db.prepare(
+      'INSERT INTO notifications (id, user_id, type, title, message, read) VALUES (?, ?, ?, ?, ?, ?)',
+    ).run(id, data.user_id!, data.type ?? 'info', data.title!, data.message!, data.read ?? 0);
+    return this.db.prepare('SELECT * FROM notifications WHERE id = ?').get(id) as DBNotification;
+  }
+
+  markNotificationRead(id: string): boolean {
+    return this.db.prepare('UPDATE notifications SET read = 1 WHERE id = ?').run(id).changes > 0;
+  }
+
+  deleteNotification(id: string): boolean {
+    return this.db.prepare('DELETE FROM notifications WHERE id = ?').run(id).changes > 0;
+  }
+
+  // ─── Project Shares ─────────────────────────────────
+  listProjectShares(projectId: string): DBProjectShare[] {
+    return this.db.prepare('SELECT * FROM project_shares WHERE project_id = ? ORDER BY created_at DESC').all(projectId) as DBProjectShare[];
+  }
+
+  getProjectShare(id: string): DBProjectShare | null {
+    return this.db.prepare('SELECT * FROM project_shares WHERE id = ?').get(id) as DBProjectShare | null;
+  }
+
+  createProjectShare(data: Partial<DBProjectShare>): DBProjectShare {
+    const id = data.id ?? `share-${Date.now()}`;
+    const shareToken = data.share_token ?? randomUUID();
+    this.db.prepare(
+      'INSERT INTO project_shares (id, project_id, shared_with_email, shared_by, permission, share_token) VALUES (?, ?, ?, ?, ?, ?)',
+    ).run(id, data.project_id!, data.shared_with_email!, data.shared_by!, data.permission ?? 'view', shareToken);
+    return this.db.prepare('SELECT * FROM project_shares WHERE id = ?').get(id) as DBProjectShare;
+  }
+
+  deleteProjectShare(id: string): boolean {
+    return this.db.prepare('DELETE FROM project_shares WHERE id = ?').run(id).changes > 0;
+  }
 }

backend/src/database/schema.sql

@@ -105,3 +105,31 @@ CREATE INDEX IF NOT EXISTS idx_layers_drawing ON layers(drawing_id);
 CREATE INDEX IF NOT EXISTS idx_elements_drawing ON elements(drawing_id);
 CREATE INDEX IF NOT EXISTS idx_elements_layer ON elements(layer_id);
 CREATE INDEX IF NOT EXISTS idx_blocks_drawing ON blocks(drawing_id);
+ 
+ -- ─── Notifications ───────────────────────────────────
+ CREATE TABLE IF NOT EXISTS notifications (
+   id TEXT PRIMARY KEY,
+   user_id TEXT NOT NULL,
+   type TEXT NOT NULL DEFAULT 'info',
+   title TEXT NOT NULL,
+   message TEXT NOT NULL,
+   read INTEGER NOT NULL DEFAULT 0,
+   created_at TEXT NOT NULL DEFAULT (datetime('now')),
+   FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+ );
+ 
+ -- ─── Project Shares ──────────────────────────────────
+ CREATE TABLE IF NOT EXISTS project_shares (
+   id TEXT PRIMARY KEY,
+   project_id TEXT NOT NULL,
+   shared_with_email TEXT NOT NULL,
+   shared_by TEXT NOT NULL,
+   permission TEXT NOT NULL DEFAULT 'view' CHECK(permission IN ('view','edit','admin')),
+   share_token TEXT UNIQUE,
+   created_at TEXT NOT NULL DEFAULT (datetime('now')),
+   FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE,
+   FOREIGN KEY (shared_by) REFERENCES users(id) ON DELETE CASCADE
+ );
+ 
+ CREATE INDEX IF NOT EXISTS idx_notifications_user ON notifications(user_id);
+ CREATE INDEX IF NOT EXISTS idx_shares_project ON project_shares(project_id);

backend/src/routes/notifications.ts

@@ -0,0 +1,71 @@
+/**
+ * Notifications Routes – List, create, mark read, delete notifications
+ */
+import type { FastifyInstance } from 'fastify';
+import type { DatabaseInterface } from '../database/DatabaseInterface.js';
+import type { AuthService } from '../auth/AuthService.js';
+
+function extractToken(request: any): string | null {
+  const auth = request.headers?.authorization;
+  if (auth && auth.startsWith('Bearer ')) return auth.slice(7);
+  return null;
+}
+
+export function registerNotificationRoutes(fastify: FastifyInstance, db: DatabaseInterface, authService: AuthService) {
+  // List notifications for current user
+  fastify.get('/api/notifications', async (request, reply) => {
+    const token = extractToken(request);
+    if (!token) return reply.code(401).send({ error: 'Authentication required' });
+    const user = authService.getUserFromSession(token);
+    if (!user) return reply.code(401).send({ error: 'Invalid or expired session' });
+    return db.listNotifications(user.id);
+  });
+
+  // Create notification (only for self)
+  fastify.post('/api/notifications', async (request, reply) => {
+    const token = extractToken(request);
+    if (!token) return reply.code(401).send({ error: 'Authentication required' });
+    const user = authService.getUserFromSession(token);
+    if (!user) return reply.code(401).send({ error: 'Invalid or expired session' });
+    const body = request.body as { type?: string; title?: string; message?: string };
+    if (!body.title || !body.message) return reply.code(400).send({ error: 'title and message are required' });
+    const validTypes = ['info', 'share', 'warning', 'error'];
+    const type = validTypes.includes(body.type ?? '') ? body.type! : 'info';
+    return reply.code(201).send(db.createNotification({
+      user_id: user.id,
+      type,
+      title: body.title,
+      message: body.message,
+    }));
+  });
+
+  // Mark notification as read (ownership check)
+  fastify.patch('/api/notifications/:id/read', async (request, reply) => {
+    const token = extractToken(request);
+    if (!token) return reply.code(401).send({ error: 'Authentication required' });
+    const user = authService.getUserFromSession(token);
+    if (!user) return reply.code(401).send({ error: 'Invalid or expired session' });
+    const { id } = request.params as { id: string };
+    const notif = db.getNotification(id);
+    if (!notif) return reply.code(404).send({ error: 'Notification not found' });
+    if (notif.user_id !== user.id) return reply.code(403).send({ error: 'Forbidden' });
+    const ok = db.markNotificationRead(id);
+    if (!ok) return reply.code(404).send({ error: 'Notification not found' });
+    return reply.code(204).send();
+  });
+
+  // Delete notification (ownership check)
+  fastify.delete('/api/notifications/:id', async (request, reply) => {
+    const token = extractToken(request);
+    if (!token) return reply.code(401).send({ error: 'Authentication required' });
+    const user = authService.getUserFromSession(token);
+    if (!user) return reply.code(401).send({ error: 'Invalid or expired session' });
+    const { id } = request.params as { id: string };
+    const notif = db.getNotification(id);
+    if (!notif) return reply.code(404).send({ error: 'Notification not found' });
+    if (notif.user_id !== user.id) return reply.code(403).send({ error: 'Forbidden' });
+    const ok = db.deleteNotification(id);
+    if (!ok) return reply.code(404).send({ error: 'Notification not found' });
+    return reply.code(204).send();
+  });
+}

backend/src/routes/shares.ts

@@ -0,0 +1,81 @@
+/**
+ * Project Shares Routes – List, create, delete project shares
+ */
+import type { FastifyInstance } from 'fastify';
+import type { DatabaseInterface } from '../database/DatabaseInterface.js';
+import type { AuthService } from '../auth/AuthService.js';
+
+function extractToken(request: any): string | null {
+  const auth = request.headers?.authorization;
+  if (auth && auth.startsWith('Bearer ')) return auth.slice(7);
+  return null;
+}
+
+const VALID_PERMISSIONS = ['view', 'edit', 'admin'];
+
+export function registerShareRoutes(fastify: FastifyInstance, db: DatabaseInterface, authService: AuthService) {
+  // List shares for a project (owner only)
+  fastify.get('/api/projects/:projectId/shares', async (request, reply) => {
+    const token = extractToken(request);
+    if (!token) return reply.code(401).send({ error: 'Authentication required' });
+    const user = authService.getUserFromSession(token);
+    if (!user) return reply.code(401).send({ error: 'Invalid or expired session' });
+    const { projectId } = request.params as { projectId: string };
+    const project = db.getProject(projectId);
+    if (!project) return reply.code(404).send({ error: 'Project not found' });
+    if (project.owner_id !== user.id) return reply.code(403).send({ error: 'Forbidden' });
+    return db.listProjectShares(projectId);
+  });
+
+  // Create a project share (owner only)
+  fastify.post('/api/projects/:projectId/shares', async (request, reply) => {
+    const token = extractToken(request);
+    if (!token) return reply.code(401).send({ error: 'Authentication required' });
+    const user = authService.getUserFromSession(token);
+    if (!user) return reply.code(401).send({ error: 'Invalid or expired session' });
+    const { projectId } = request.params as { projectId: string };
+    const project = db.getProject(projectId);
+    if (!project) return reply.code(404).send({ error: 'Project not found' });
+    if (project.owner_id !== user.id) return reply.code(403).send({ error: 'Forbidden' });
+    const body = request.body as { shared_with_email?: string; permission?: string };
+    if (!body.shared_with_email) return reply.code(400).send({ error: 'shared_with_email is required' });
+    const permission = VALID_PERMISSIONS.includes(body.permission ?? '') ? body.permission! : 'view';
+
+    const share = db.createProjectShare({
+      project_id: projectId,
+      shared_with_email: body.shared_with_email,
+      shared_by: user.id,
+      permission,
+    });
+
+    // Create a notification for the shared user if they exist
+    const sharedUser = db.getUserByEmail(body.shared_with_email);
+    if (sharedUser) {
+      db.createNotification({
+        user_id: sharedUser.id,
+        type: 'share',
+        title: 'Projekt geteilt',
+        message: `${user.name} hat ein Projekt mit Ihnen geteilt: ${project.name}`,
+      });
+    }
+
+    return reply.code(201).send(share);
+  });
+
+  // Delete a project share (owner only)
+  fastify.delete('/api/shares/:id', async (request, reply) => {
+    const token = extractToken(request);
+    if (!token) return reply.code(401).send({ error: 'Authentication required' });
+    const user = authService.getUserFromSession(token);
+    if (!user) return reply.code(401).send({ error: 'Invalid or expired session' });
+    const { id } = request.params as { id: string };
+    const share = db.getProjectShare(id);
+    if (!share) return reply.code(404).send({ error: 'Share not found' });
+    const project = db.getProject(share.project_id);
+    if (!project) return reply.code(404).send({ error: 'Project not found' });
+    if (project.owner_id !== user.id) return reply.code(403).send({ error: 'Forbidden' });
+    const ok = db.deleteProjectShare(id);
+    if (!ok) return reply.code(404).send({ error: 'Share not found' });
+    return reply.code(204).send();
+  });
+}

backend/src/server.ts

@@ -57,6 +57,8 @@ export async function createServer(opts: ServerOptions) {
   const { registerAuthRoutes } = await import('./routes/auth.js');
   const { registerUserRoutes } = await import('./routes/users.js');
   const { registerAIRoutes } = await import('./routes/ai.js');
+  const { registerNotificationRoutes } = await import('./routes/notifications.js');
+  const { registerShareRoutes } = await import('./routes/shares.js');
 
   const authService = new AuthService(opts.db);
 
@@ -69,6 +71,8 @@ export async function createServer(opts: ServerOptions) {
   registerSettingsRoutes(fastify, opts.db);
   registerUserRoutes(fastify, opts.db, authService);
   registerAIRoutes(fastify, authService);
+  registerNotificationRoutes(fastify, opts.db, authService);
+  registerShareRoutes(fastify, opts.db, authService);
 
   // Yjs collaboration WebSocket
   registerYjsWebSocket(fastify);