Catherine Renelle
2f398711c8
Complete Phase 1 foundation with working board, column, and card CRUD: - SvelteKit + TypeScript + Tailwind CSS v4 + adapter-node - Full Prisma schema with 18 tables (tenants, users, boards, columns, cards, etc.) - Multi-tenant architecture with hostname-based tenant resolution - Email/password auth with bcrypt + session cookies - Board/Column/Card API routes with full CRUD - Fractional indexing for drag-and-drop ordering - Board view with svelte-dnd-action for column and card drag-and-drop - Card modal with inline editing - Auth pages (login, register) - Board listing with create form - RLS policies SQL script for tenant isolation - Prisma RLS client extensions (forTenant/bypassRLS) - Permission helpers (canEditBoard, canManageMembers, etc.) - Socket.IO server setup (dev Vite plugin + production Express server) - Client-side socket store for real-time updates - Docker Compose (app + PostgreSQL 16) + multi-stage Dockerfile - Database seed script (default tenant + admin user) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
72 lines
2.6 KiB
TypeScript
72 lines
2.6 KiB
TypeScript
import { json, error } from '@sveltejs/kit';
|
|
import type { RequestHandler } from './$types.js';
|
|
import { prisma } from '$lib/server/db.js';
|
|
import { columnSchema, moveColumnSchema } from '$lib/server/validation.js';
|
|
|
|
// Update column title
|
|
export const PATCH: RequestHandler = async ({ params, request, locals }) => {
|
|
const tenant = locals.tenant;
|
|
if (!tenant) throw error(400, 'Unknown tenant');
|
|
if (!locals.user) throw error(401, 'Not authenticated');
|
|
|
|
const column = await prisma.column.findFirst({
|
|
where: { id: params.columnId, board: { id: params.boardId, tenantId: tenant.id } },
|
|
include: { board: { include: { members: true } } }
|
|
});
|
|
if (!column) throw error(404, 'Column not found');
|
|
|
|
const member = column.board.members.find((m) => m.userId === locals.user!.id);
|
|
const isAdmin = locals.user.globalRole === 'SITE_ADMIN' || locals.user.tenantRole === 'ADMIN';
|
|
if (!member && !isAdmin) throw error(403, 'Access denied');
|
|
if (member && member.role === 'VIEWER') throw error(403, 'Viewers cannot edit columns');
|
|
|
|
const body = await request.json();
|
|
|
|
// Allow both title update and position update
|
|
if (body.position !== undefined) {
|
|
const result = moveColumnSchema.safeParse(body);
|
|
if (!result.success) {
|
|
return json({ error: result.error.issues[0].message }, { status: 400 });
|
|
}
|
|
const updated = await prisma.column.update({
|
|
where: { id: params.columnId },
|
|
data: { position: result.data.position }
|
|
});
|
|
return json({ column: updated });
|
|
}
|
|
|
|
const result = columnSchema.safeParse(body);
|
|
if (!result.success) {
|
|
return json({ error: result.error.issues[0].message }, { status: 400 });
|
|
}
|
|
|
|
const updated = await prisma.column.update({
|
|
where: { id: params.columnId },
|
|
data: { title: result.data.title }
|
|
});
|
|
|
|
return json({ column: updated });
|
|
};
|
|
|
|
// Delete column
|
|
export const DELETE: RequestHandler = async ({ params, locals }) => {
|
|
const tenant = locals.tenant;
|
|
if (!tenant) throw error(400, 'Unknown tenant');
|
|
if (!locals.user) throw error(401, 'Not authenticated');
|
|
|
|
const column = await prisma.column.findFirst({
|
|
where: { id: params.columnId, board: { id: params.boardId, tenantId: tenant.id } },
|
|
include: { board: { include: { members: true } } }
|
|
});
|
|
if (!column) throw error(404, 'Column not found');
|
|
|
|
const member = column.board.members.find((m) => m.userId === locals.user!.id);
|
|
const isAdmin = locals.user.globalRole === 'SITE_ADMIN' || locals.user.tenantRole === 'ADMIN';
|
|
if (member?.role === 'VIEWER' && !isAdmin) throw error(403, 'Viewers cannot delete columns');
|
|
if (!member && !isAdmin) throw error(403, 'Access denied');
|
|
|
|
await prisma.column.delete({ where: { id: params.columnId } });
|
|
|
|
return json({ ok: true });
|
|
};
|