merge: combine all features from both codebases - mobile dashboard + layer panel + notifications + shares + all fixes

backend/src/routes/drawings.ts

@@ -3,17 +3,26 @@
  */
 import type { FastifyInstance } from 'fastify';
 import type { DatabaseInterface, DBDrawing } from '../database/DatabaseInterface.js';
+import { requireAuth } from '../auth/authMiddleware.js';
+import type { AuthService } from '../auth/AuthService.js';
+import { validateName, validateIdParam } from '../utils/validation.js';
 
-export function registerDrawingRoutes(fastify: FastifyInstance, db: DatabaseInterface) {
+export function registerDrawingRoutes(fastify: FastifyInstance, db: DatabaseInterface, authService: AuthService) {
   // List drawings for a project
-  fastify.get('/api/projects/:projectId/drawings', async (request) => {
+  fastify.get('/api/projects/:projectId/drawings', async (request, reply) => {
+    if (!requireAuth(request, reply, authService)) return;
     const { projectId } = request.params as { projectId: string };
+    const idErr = validateIdParam(projectId, 'projectId');
+    if (idErr) return reply.code(400).send({ error: idErr });
     return db.listDrawings(projectId);
   });
 
   // Get single drawing
   fastify.get('/api/drawings/:id', async (request, reply) => {
+    if (!requireAuth(request, reply, authService)) return;
     const { id } = request.params as { id: string };
+    const idErr = validateIdParam(id, 'id');
+    if (idErr) return reply.code(400).send({ error: idErr });
     const drawing = db.getDrawing(id);
     if (!drawing) return reply.code(404).send({ error: 'Drawing not found' });
     return drawing;
@@ -21,15 +30,29 @@ export function registerDrawingRoutes(fastify: FastifyInstance, db: DatabaseInte
 
   // Create drawing
   fastify.post('/api/projects/:projectId/drawings', async (request, reply) => {
+    if (!requireAuth(request, reply, authService)) return;
     const { projectId } = request.params as { projectId: string };
+    const idErr = validateIdParam(projectId, 'projectId');
+    if (idErr) return reply.code(400).send({ error: idErr });
     const body = request.body as Partial<DBDrawing>;
+    if (body.name !== undefined) {
+      const nameErr = validateName(body.name);
+      if (nameErr) return reply.code(400).send({ error: nameErr });
+    }
     return reply.code(201).send(db.createDrawing({ ...body, project_id: projectId }));
   });
 
   // Update drawing
   fastify.patch('/api/drawings/:id', async (request, reply) => {
+    if (!requireAuth(request, reply, authService)) return;
     const { id } = request.params as { id: string };
+    const idErr = validateIdParam(id, 'id');
+    if (idErr) return reply.code(400).send({ error: idErr });
     const body = request.body as Partial<DBDrawing>;
+    if (body.name !== undefined) {
+      const nameErr = validateName(body.name);
+      if (nameErr) return reply.code(400).send({ error: nameErr });
+    }
     const updated = db.updateDrawing(id, body);
     if (!updated) return reply.code(404).send({ error: 'Drawing not found' });
     return updated;
@@ -37,7 +60,10 @@ export function registerDrawingRoutes(fastify: FastifyInstance, db: DatabaseInte
 
   // Delete drawing
   fastify.delete('/api/drawings/:id', async (request, reply) => {
+    if (!requireAuth(request, reply, authService)) return;
     const { id } = request.params as { id: string };
+    const idErr = validateIdParam(id, 'id');
+    if (idErr) return reply.code(400).send({ error: idErr });
     const ok = db.deleteDrawing(id);
     if (!ok) return reply.code(404).send({ error: 'Drawing not found' });
     return reply.code(204).send();