fix: security and UX improvements for notifications and shares

- Add ownership checks on all notification and share routes (403 Forbidden)
- Validate permission field (only view/edit/admin allowed)
- Remove user_id from POST notifications (only self-notifications)
- Add getNotification/getProjectShare to DB interface + adapter
- Add res.ok checks on all frontend API calls
- Add click-outside handler for notification dropdown
- Add initial notification load on mount for badge count
- Add email validation + duplicate check in ShareDialog
- Add Enter key handler in ShareDialog
- Add submitting state to prevent double-click
- Guard against null token in Dashboard

backend/src/routes/shares.ts

@@ -11,32 +11,41 @@ function extractToken(request: any): string | null {
   return null;
 }
 
+const VALID_PERMISSIONS = ['view', 'edit', 'admin'];
+
 export function registerShareRoutes(fastify: FastifyInstance, db: DatabaseInterface, authService: AuthService) {
-  // List shares for a project
+  // List shares for a project (owner only)
   fastify.get('/api/projects/:projectId/shares', async (request, reply) => {
     const token = extractToken(request);
     if (!token) return reply.code(401).send({ error: 'Authentication required' });
     const user = authService.getUserFromSession(token);
     if (!user) return reply.code(401).send({ error: 'Invalid or expired session' });
     const { projectId } = request.params as { projectId: string };
+    const project = db.getProject(projectId);
+    if (!project) return reply.code(404).send({ error: 'Project not found' });
+    if (project.owner_id !== user.id) return reply.code(403).send({ error: 'Forbidden' });
     return db.listProjectShares(projectId);
   });
 
-  // Create a project share
+  // Create a project share (owner only)
   fastify.post('/api/projects/:projectId/shares', async (request, reply) => {
     const token = extractToken(request);
     if (!token) return reply.code(401).send({ error: 'Authentication required' });
     const user = authService.getUserFromSession(token);
     if (!user) return reply.code(401).send({ error: 'Invalid or expired session' });
     const { projectId } = request.params as { projectId: string };
+    const project = db.getProject(projectId);
+    if (!project) return reply.code(404).send({ error: 'Project not found' });
+    if (project.owner_id !== user.id) return reply.code(403).send({ error: 'Forbidden' });
     const body = request.body as { shared_with_email?: string; permission?: string };
     if (!body.shared_with_email) return reply.code(400).send({ error: 'shared_with_email is required' });
+    const permission = VALID_PERMISSIONS.includes(body.permission ?? '') ? body.permission! : 'view';
 
     const share = db.createProjectShare({
       project_id: projectId,
       shared_with_email: body.shared_with_email,
       shared_by: user.id,
-      permission: body.permission ?? 'view',
+      permission,
     });
 
     // Create a notification for the shared user if they exist
@@ -46,20 +55,25 @@ export function registerShareRoutes(fastify: FastifyInstance, db: DatabaseInterf
         user_id: sharedUser.id,
         type: 'share',
         title: 'Projekt geteilt',
-        message: `${user.name} hat ein Projekt mit Ihnen geteilt: ${db.getProject(projectId)?.name ?? 'Unbenannt'}`,
+        message: `${user.name} hat ein Projekt mit Ihnen geteilt: ${project.name}`,
       });
     }
 
     return reply.code(201).send(share);
   });
 
-  // Delete a project share
+  // Delete a project share (owner only)
   fastify.delete('/api/shares/:id', async (request, reply) => {
     const token = extractToken(request);
     if (!token) return reply.code(401).send({ error: 'Authentication required' });
     const user = authService.getUserFromSession(token);
     if (!user) return reply.code(401).send({ error: 'Invalid or expired session' });
     const { id } = request.params as { id: string };
+    const share = db.getProjectShare(id);
+    if (!share) return reply.code(404).send({ error: 'Share not found' });
+    const project = db.getProject(share.project_id);
+    if (!project) return reply.code(404).send({ error: 'Project not found' });
+    if (project.owner_id !== user.id) return reply.code(403).send({ error: 'Forbidden' });
     const ok = db.deleteProjectShare(id);
     if (!ok) return reply.code(404).send({ error: 'Share not found' });
     return reply.code(204).send();