merge: combine all features from both codebases - mobile dashboard + layer panel + notifications + shares + all fixes

backend/src/routes/blocks.ts

@@ -3,26 +3,43 @@
  */
 import type { FastifyInstance } from 'fastify';
 import type { DatabaseInterface, DBBlock } from '../database/DatabaseInterface.js';
+import { requireAuth } from '../auth/authMiddleware.js';
+import type { AuthService } from '../auth/AuthService.js';
+import { validateName, validateIdParam } from '../utils/validation.js';
 
-export function registerBlockRoutes(fastify: FastifyInstance, db: DatabaseInterface) {
+export function registerBlockRoutes(fastify: FastifyInstance, db: DatabaseInterface, authService: AuthService) {
   // List all blocks for a drawing
-  fastify.get('/api/drawings/:drawingId/blocks', async (request) => {
+  fastify.get('/api/drawings/:drawingId/blocks', async (request, reply) => {
+    if (!requireAuth(request, reply, authService)) return;
     const { drawingId } = request.params as { drawingId: string };
+    const idErr = validateIdParam(drawingId, 'drawingId');
+    if (idErr) return reply.code(400).send({ error: idErr });
     return db.listBlocks(drawingId);
   });
 
   // Create a new block
   fastify.post('/api/drawings/:drawingId/blocks', async (request, reply) => {
+    if (!requireAuth(request, reply, authService)) return;
     const { drawingId } = request.params as { drawingId: string };
+    const idErr = validateIdParam(drawingId, 'drawingId');
+    if (idErr) return reply.code(400).send({ error: idErr });
     const body = request.body as Partial<DBBlock>;
-    if (!body.name) return reply.code(400).send({ error: 'Name is required' });
+    const nameErr = validateName(body.name, 'name');
+    if (nameErr) return reply.code(400).send({ error: nameErr });
     return reply.code(201).send(db.createBlock({ ...body, drawing_id: drawingId }));
   });
 
   // Update a block
   fastify.patch('/api/blocks/:id', async (request, reply) => {
+    if (!requireAuth(request, reply, authService)) return;
     const { id } = request.params as { id: string };
+    const idErr = validateIdParam(id, 'id');
+    if (idErr) return reply.code(400).send({ error: idErr });
     const body = request.body as Partial<DBBlock>;
+    if (body.name !== undefined) {
+      const nameErr = validateName(body.name, 'name');
+      if (nameErr) return reply.code(400).send({ error: nameErr });
+    }
     const updated = db.updateBlock(id, body);
     if (!updated) return reply.code(404).send({ error: 'Block not found' });
     return updated;
@@ -30,7 +47,10 @@ export function registerBlockRoutes(fastify: FastifyInstance, db: DatabaseInterf
 
   // Delete a block
   fastify.delete('/api/blocks/:id', async (request, reply) => {
+    if (!requireAuth(request, reply, authService)) return;
     const { id } = request.params as { id: string };
+    const idErr = validateIdParam(id, 'id');
+    if (idErr) return reply.code(400).send({ error: idErr });
     const ok = db.deleteBlock(id);
     if (!ok) return reply.code(404).send({ error: 'Block not found' });
     return reply.code(204).send();