fix: HIGH issues #12,#15,#16,#17,#21 — backend persistence for import/layers/blocks + owner filtering

backend/src/database/DatabaseInterface.ts

@@ -112,7 +112,7 @@ export interface DatabaseInterface {
   listUsers(): DBUser[];
 
   // Projects
-  listProjects(): DBProject[];
+  listProjects(ownerId?: string): DBProject[];
   getProject(id: string): DBProject | null;
   createProject(data: Partial<DBProject>): DBProject;
   updateProject(id: string, data: Partial<DBProject>): DBProject | null;

backend/src/database/SqliteAdapter.ts

@@ -73,7 +73,10 @@ export class SqliteAdapter implements DatabaseInterface {
   }
 
   // ─── Projects ──────────────────────────────────────
-  listProjects(): DBProject[] {
+  listProjects(ownerId?: string): DBProject[] {
+    if (ownerId) {
+      return this.db.prepare('SELECT * FROM projects WHERE owner_id = ? ORDER BY updated_at DESC').all(ownerId) as DBProject[];
+    }
     return this.db.prepare('SELECT * FROM projects ORDER BY updated_at DESC').all() as DBProject[];
   }
 

backend/src/routes/projects.ts

@@ -7,10 +7,11 @@ import { requireAuth } from '../auth/authMiddleware.js';
 import type { AuthService } from '../auth/AuthService.js';
 
 export function registerProjectRoutes(fastify: FastifyInstance, db: DatabaseInterface, authService: AuthService) {
-  // List all projects
+  // List projects owned by the authenticated user
   fastify.get('/api/projects', async (request, reply) => {
-    if (!requireAuth(request, reply, authService)) return;
-    return db.listProjects();
+    const user = requireAuth(request, reply, authService);
+    if (!user) return;
+    return db.listProjects(user.id);
   });
 
   // Get single project
@@ -24,10 +25,11 @@ export function registerProjectRoutes(fastify: FastifyInstance, db: DatabaseInte
 
   // Create project
   fastify.post('/api/projects', async (request, reply) => {
-    if (!requireAuth(request, reply, authService)) return;
+    const user = requireAuth(request, reply, authService);
+    if (!user) return;
     const body = request.body as Partial<DBProject>;
     if (!body.name) return reply.code(400).send({ error: 'Name is required' });
-    return reply.code(201).send(db.createProject(body));
+    return reply.code(201).send(db.createProject({ ...body, owner_id: user.id }));
   });
 
   // Update project