feat: real backend for notifications + project shares — no more mocks

backend/src/database/DatabaseInterface.ts

@@ -79,6 +79,27 @@ export interface DBSession {
   created_at: string;
 }
 
+export interface DBNotification {
+  id: string;
+  user_id: string;
+  project_id: string | null;
+  type: string;
+  title: string;
+  message: string | null;
+  read: number;
+  created_at: string;
+}
+
+export interface DBProjectShare {
+  id: string;
+  project_id: string;
+  shared_by_user_id: string;
+  shared_with_email: string;
+  token: string;
+  accepted: number;
+  created_at: string;
+}
+
 export interface DatabaseInterface {
   init(): Promise<void>;
   close(): void;
@@ -132,4 +153,18 @@ export interface DatabaseInterface {
   getSession(token: string): DBSession | null;
   deleteSession(token: string): boolean;
   deleteExpiredSessions(): void;
+
+  // Notifications
+  listNotifications(userId: string): DBNotification[];
+  createNotification(data: Partial<DBNotification>): DBNotification;
+  markNotificationRead(id: string): boolean;
+  markAllNotificationsRead(userId: string): boolean;
+  deleteNotification(id: string): boolean;
+
+  // Project Shares
+  createProjectShare(data: Partial<DBProjectShare>): DBProjectShare;
+  listProjectShares(projectId: string): DBProjectShare[];
+  getProjectShareByToken(token: string): DBProjectShare | null;
+  acceptProjectShare(token: string): boolean;
+  deleteProjectShare(id: string): boolean;
 }

backend/src/database/SqliteAdapter.ts

@@ -9,6 +9,7 @@ import { randomUUID } from 'crypto';
 import type {
   DatabaseInterface, DBProject, DBDrawing, DBLayer,
   DBElement, DBBlock, DBSetting, DBUser, DBSession,
+  DBNotification, DBProjectShare,
 } from './DatabaseInterface.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -265,4 +266,55 @@ export class SqliteAdapter implements DatabaseInterface {
   deleteExpiredSessions(): void {
     this.db.prepare('DELETE FROM sessions WHERE expires_at < ?').run(Date.now());
   }
+
+  // ─── Notifications ───────────────────────────────────
+  listNotifications(userId: string): DBNotification[] {
+    return this.db.prepare('SELECT * FROM notifications WHERE user_id = ? ORDER BY created_at DESC').all(userId) as DBNotification[];
+  }
+
+  createNotification(data: Partial<DBNotification>): DBNotification {
+    const id = data.id ?? `notif-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    this.db.prepare(
+      'INSERT INTO notifications (id, user_id, project_id, type, title, message, read) VALUES (?, ?, ?, ?, ?, ?, 0)',
+    ).run(id, data.user_id!, data.project_id ?? null, data.type ?? 'info', data.title!, data.message ?? null);
+    return this.db.prepare('SELECT * FROM notifications WHERE id = ?').get(id) as DBNotification;
+  }
+
+  markNotificationRead(id: string): boolean {
+    return this.db.prepare('UPDATE notifications SET read = 1 WHERE id = ?').run(id).changes > 0;
+  }
+
+  markAllNotificationsRead(userId: string): boolean {
+    return this.db.prepare('UPDATE notifications SET read = 1 WHERE user_id = ?').run(userId).changes > 0;
+  }
+
+  deleteNotification(id: string): boolean {
+    return this.db.prepare('DELETE FROM notifications WHERE id = ?').run(id).changes > 0;
+  }
+
+  // ─── Project Shares ──────────────────────────────────
+  createProjectShare(data: Partial<DBProjectShare>): DBProjectShare {
+    const id = data.id ?? `share-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    const token = data.token ?? randomUUID();
+    this.db.prepare(
+      'INSERT INTO project_shares (id, project_id, shared_by_user_id, shared_with_email, token, accepted) VALUES (?, ?, ?, ?, ?, 0)',
+    ).run(id, data.project_id!, data.shared_by_user_id!, data.shared_with_email!, token);
+    return this.db.prepare('SELECT * FROM project_shares WHERE id = ?').get(id) as DBProjectShare;
+  }
+
+  listProjectShares(projectId: string): DBProjectShare[] {
+    return this.db.prepare('SELECT * FROM project_shares WHERE project_id = ? ORDER BY created_at DESC').all(projectId) as DBProjectShare[];
+  }
+
+  getProjectShareByToken(token: string): DBProjectShare | null {
+    return (this.db.prepare('SELECT * FROM project_shares WHERE token = ?').get(token) as DBProjectShare) ?? null;
+  }
+
+  acceptProjectShare(token: string): boolean {
+    return this.db.prepare('UPDATE project_shares SET accepted = 1 WHERE token = ?').run(token).changes > 0;
+  }
+
+  deleteProjectShare(id: string): boolean {
+    return this.db.prepare('DELETE FROM project_shares WHERE id = ?').run(id).changes > 0;
+  }
 }

backend/src/database/schema.sql

@@ -99,6 +99,33 @@ CREATE TABLE IF NOT EXISTS settings (
   updated_at TEXT NOT NULL DEFAULT (datetime('now'))
 );
 
+-- ─── Notifications ───────────────────────────────────
+CREATE TABLE IF NOT EXISTS notifications (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL,
+  project_id TEXT,
+  type TEXT NOT NULL DEFAULT 'info',
+  title TEXT NOT NULL,
+  message TEXT,
+  read INTEGER NOT NULL DEFAULT 0,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+  FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+);
+
+-- ─── Project Shares ──────────────────────────────────
+CREATE TABLE IF NOT EXISTS project_shares (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
+  shared_by_user_id TEXT NOT NULL,
+  shared_with_email TEXT NOT NULL,
+  token TEXT NOT NULL UNIQUE,
+  accepted INTEGER NOT NULL DEFAULT 0,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE,
+  FOREIGN KEY (shared_by_user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
 -- ─── Indexes ────────────────────────────────────────
 CREATE INDEX IF NOT EXISTS idx_drawings_project ON drawings(project_id);
 CREATE INDEX IF NOT EXISTS idx_layers_drawing ON layers(drawing_id);

backend/src/routes/notifications.ts

@@ -0,0 +1,59 @@
+/**
+ * Notification Routes – user notifications
+ */
+import type { FastifyInstance } from 'fastify';
+import type { DatabaseInterface } from '../database/DatabaseInterface.js';
+import { requireAuth } from '../auth/authMiddleware.js';
+import type { AuthService } from '../auth/AuthService.js';
+
+export function registerNotificationRoutes(fastify: FastifyInstance, db: DatabaseInterface, authService: AuthService) {
+  // List notifications for current user
+  fastify.get('/api/notifications', async (request, reply) => {
+    const user = requireAuth(request, reply, authService);
+    if (!user) return;
+    return db.listNotifications(user.id);
+  });
+
+  // Create a notification
+  fastify.post('/api/notifications', async (request, reply) => {
+    const user = requireAuth(request, reply, authService);
+    if (!user) return;
+    const body = request.body as { type?: string; title: string; message?: string; project_id?: string };
+    if (!body.title) return reply.code(400).send({ error: 'Title is required' });
+    return db.createNotification({
+      user_id: user.id,
+      project_id: body.project_id ?? null,
+      type: body.type ?? 'info',
+      title: body.title,
+      message: body.message ?? null,
+    });
+  });
+
+  // Mark single notification as read
+  fastify.put('/api/notifications/:id/read', async (request, reply) => {
+    const user = requireAuth(request, reply, authService);
+    if (!user) return;
+    const { id } = request.params as { id: string };
+    const ok = db.markNotificationRead(id);
+    if (!ok) return reply.code(404).send({ error: 'Notification not found' });
+    return { success: true };
+  });
+
+  // Mark all notifications as read
+  fastify.put('/api/notifications/read-all', async (request, reply) => {
+    const user = requireAuth(request, reply, authService);
+    if (!user) return;
+    db.markAllNotificationsRead(user.id);
+    return { success: true };
+  });
+
+  // Delete a notification
+  fastify.delete('/api/notifications/:id', async (request, reply) => {
+    const user = requireAuth(request, reply, authService);
+    if (!user) return;
+    const { id } = request.params as { id: string };
+    const ok = db.deleteNotification(id);
+    if (!ok) return reply.code(404).send({ error: 'Notification not found' });
+    return { success: true };
+  });
+}

backend/src/routes/shares.ts

@@ -0,0 +1,71 @@
+/**
+ * Project Share Routes – invite users to projects
+ */
+import type { FastifyInstance } from 'fastify';
+import type { DatabaseInterface } from '../database/DatabaseInterface.js';
+import { requireAuth } from '../auth/authMiddleware.js';
+import type { AuthService } from '../auth/AuthService.js';
+
+export function registerShareRoutes(fastify: FastifyInstance, db: DatabaseInterface, authService: AuthService) {
+  // List shares for a project
+  fastify.get('/api/projects/:projectId/shares', async (request, reply) => {
+    const user = requireAuth(request, reply, authService);
+    if (!user) return;
+    const { projectId } = request.params as { projectId: string };
+    return db.listProjectShares(projectId);
+  });
+
+  // Create a share / invite by email
+  fastify.post('/api/projects/:projectId/shares', async (request, reply) => {
+    const user = requireAuth(request, reply, authService);
+    if (!user) return;
+    const { projectId } = request.params as { projectId: string };
+    const body = request.body as { email: string };
+    if (!body.email) return reply.code(400).send({ error: 'Email is required' });
+    const share = db.createProjectShare({
+      project_id: projectId,
+      shared_by_user_id: user.id,
+      shared_with_email: body.email,
+    });
+    // Create a notification for the invited user if they exist
+    const invitedUser = db.getUserByEmail(body.email);
+    if (invitedUser) {
+      db.createNotification({
+        user_id: invitedUser.id,
+        project_id: projectId,
+        type: 'share',
+        title: 'Projekt-Einladung',
+        message: `${user.name} hat Sie zum Projekt eingeladen`,
+      });
+    }
+    return share;
+  });
+
+  // Get share by token (public, no auth required)
+  fastify.get('/api/shares/:token', async (request, reply) => {
+    const { token } = request.params as { token: string };
+    const share = db.getProjectShareByToken(token);
+    if (!share) return reply.code(404).send({ error: 'Share not found' });
+    return share;
+  });
+
+  // Accept a share by token
+  fastify.put('/api/shares/:token/accept', async (request, reply) => {
+    const user = requireAuth(request, reply, authService);
+    if (!user) return;
+    const { token } = request.params as { token: string };
+    const ok = db.acceptProjectShare(token);
+    if (!ok) return reply.code(404).send({ error: 'Share not found' });
+    return { success: true };
+  });
+
+  // Revoke a share
+  fastify.delete('/api/shares/:id', async (request, reply) => {
+    const user = requireAuth(request, reply, authService);
+    if (!user) return;
+    const { id } = request.params as { id: string };
+    const ok = db.deleteProjectShare(id);
+    if (!ok) return reply.code(404).send({ error: 'Share not found' });
+    return { success: true };
+  });
+}

backend/src/server.ts

@@ -57,6 +57,8 @@ export async function createServer(opts: ServerOptions) {
   const { registerAuthRoutes } = await import('./routes/auth.js');
   const { registerUserRoutes } = await import('./routes/users.js');
   const { registerAIRoutes } = await import('./routes/ai.js');
+  const { registerNotificationRoutes } = await import('./routes/notifications.js');
+  const { registerShareRoutes } = await import('./routes/shares.js');
 
   const authService = new AuthService(opts.db);
 
@@ -69,6 +71,8 @@ export async function createServer(opts: ServerOptions) {
   registerSettingsRoutes(fastify, opts.db, authService);
   registerUserRoutes(fastify, opts.db, authService);
   registerAIRoutes(fastify, authService);
+  registerNotificationRoutes(fastify, opts.db, authService);
+  registerShareRoutes(fastify, opts.db, authService);
 
   // Yjs collaboration WebSocket
   registerYjsWebSocket(fastify);