feat: prisma schema, groups API, deploy workflow

app/server/api/achievements/index.get.ts

@@ -0,0 +1,18 @@
+import { requireAuth } from '~/server/utils/auth'
+import { getUserAchievements, achievements } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+
+  // Calculate stats
+  const userAchievements = getUserAchievements(user.id)
+  const totalCompleted = userAchievements.filter((a: any) => a.id?.startsWith('completed-')).length
+
+  return {
+    achievements: userAchievements,
+    stats: {
+      total: userAchievements.length,
+      completedTasks: totalCompleted
+    }
+  }
+})

app/server/api/admin/stats.get.ts

@@ -0,0 +1,28 @@
+import { requireAuth } from '~/server/utils/auth'
+import { users, canvases, pushSubscriptions } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  if (user.role !== 'admin') {
+    throw createError({ statusCode: 403, message: 'Admin access required' })
+  }
+
+  const usersList = Array.from(users.values())
+  const canvasesList = Array.from(canvases.values()).map(c => ({
+    id: c.id,
+    name: c.name,
+    nodeCount: c.nodes.length,
+    updatedAt: c.updatedAt
+  }))
+
+  return {
+    users: usersList,
+    canvases: canvasesList,
+    stats: {
+      users: usersList.length,
+      canvases: canvasesList.length,
+      nodes: canvasesList.reduce((sum, c) => sum + c.nodeCount, 0),
+      pushes: pushSubscriptions.size
+    }
+  }
+})  

app/server/api/auth/google.post.ts

@@ -0,0 +1,85 @@
+import { generateToken } from '~/server/utils/auth'
+import { users } from '~/server/utils/db'
+
+interface FirebaseUser {
+  localId: string
+  email: string
+  displayName?: string
+  photoUrl?: string
+}
+
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event)
+  const { idToken } = body
+
+  if (!idToken) {
+    throw createError({ statusCode: 400, message: 'Firebase ID token required' })
+  }
+
+  const config = useRuntimeConfig()
+  const apiKey = config.firebaseApiKey || config.public.firebaseApiKey
+
+  if (!apiKey) {
+    throw createError({ statusCode: 500, message: 'Firebase API key not configured' })
+  }
+
+  // Verify token via Firebase Auth REST API
+  const verifyRes = await $fetch<any>(
+    `https://identitytoolkit.googleapis.com/v1/accounts:lookup?key=${apiKey}`,
+    {
+      method: 'POST',
+      body: { idToken }
+    }
+  ).catch(() => null)
+
+  if (!verifyRes?.users?.[0]) {
+    throw createError({ statusCode: 401, message: 'Invalid Firebase token' })
+  }
+
+  const fbUser: FirebaseUser = verifyRes.users[0]
+
+  const email = fbUser.email
+  const existing = users.get(email)
+
+  let role = 'user'
+  let userId = fbUser.localId
+
+  if (existing) {
+    // Update existing
+    users.set(email, {
+      ...existing,
+      id: userId,
+      email,
+      username: fbUser.displayName || email.split('@')[0]
+    })
+    role = existing.role || 'user'
+  } else {
+    // Create new user
+    users.set(email, {
+      id: userId,
+      email,
+      username: fbUser.displayName || email.split('@')[0],
+      password: 'firebase-managed',
+      role: 'user'
+    })
+  }
+
+  const token = generateToken({
+    id: userId,
+    email,
+    username: fbUser.displayName || email.split('@')[0],
+    role
+  })
+
+  return {
+    message: 'Google sign-in successful',
+    token,
+    user: {
+      id: userId,
+      email,
+      username: fbUser.displayName || email.split('@')[0],
+      role,
+      photoUrl: fbUser.photoUrl
+    }
+  }
+})

app/server/api/auth/validate.get.ts

@@ -0,0 +1,17 @@
+import { verifyToken } from '~/server/utils/auth'
+
+export default defineEventHandler(async (event) => {
+  const authHeader = getHeader(event, 'authorization')
+  const token = authHeader?.split(' ')[1]
+
+  if (!token) {
+    return { valid: false, error: 'No token provided' }
+  }
+
+  try {
+    const decoded = verifyToken(token)
+    return { valid: true, user: decoded }
+  } catch {
+    return { valid: false, error: 'Invalid token' }
+  }
+})

app/server/api/canvas/[id].delete.ts

@@ -0,0 +1,15 @@
+import { requireAuth } from '~/server/utils/auth'
+import { canvases } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  requireAuth(event)
+  const id = getRouterParam(event, 'id')
+
+  if (!canvases.has(id || '')) {
+    throw createError({ statusCode: 404, message: 'Canvas not found' })
+  }
+
+  canvases.delete(id || '')
+
+  return { success: true, message: 'Canvas deleted' }
+})  

app/server/api/canvas/[id].get.ts

@@ -0,0 +1,62 @@
+import { requireAuth } from '~/server/utils/auth'
+import { canvases, userGroups } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const id = getRouterParam(event, 'id')
+
+  if (!id) {
+    throw createError({ statusCode: 400, message: 'Canvas ID is required' })
+  }
+
+  const canvas = canvases.get(id)
+  if (!canvas) {
+    throw createError({ statusCode: 404, message: 'Canvas not found' })
+  }
+
+  // Check if canvas is public
+  if (canvas.isPublic) {
+    return {
+      id: canvas.id,
+      name: canvas.name,
+      nodes: canvas.nodes,
+      edges: canvas.edges,
+      isPublic: true,
+      ownerId: canvas.ownerId
+    }
+  }
+
+  // For private canvases, require authentication and check permissions
+  const user = requireAuth(event)
+
+  // Check if user owns the canvas
+  if (canvas.ownerId === user.id) {
+    return {
+      id: canvas.id,
+      name: canvas.name,
+      nodes: canvas.nodes,
+      edges: canvas.edges,
+      isPublic: false,
+      ownerId: canvas.ownerId
+    }
+  }
+
+  // Check if user has access through group membership
+  if (canvas.groupId) {
+    const membership = Array.from(userGroups.values()).find(
+      m => m.userId === user.id && m.groupId === canvas.groupId
+    )
+    if (membership) {
+      return {
+        id: canvas.id,
+        name: canvas.name,
+        nodes: canvas.nodes,
+        edges: canvas.edges,
+        isPublic: false,
+        ownerId: canvas.ownerId,
+        groupId: canvas.groupId
+      }
+    }
+  }
+
+  throw createError({ statusCode: 403, message: 'Access denied' })
+})

app/server/api/canvas/[id].put.ts

@@ -0,0 +1,24 @@
+import { requireAuth } from '~/server/utils/auth'
+import { canvases } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  requireAuth(event)
+  const id = getRouterParam(event, 'id')
+  const body = await readBody(event)
+
+  const existing = canvases.get(id || '')
+  if (!existing) {
+    throw createError({ statusCode: 404, message: 'Canvas not found' })
+  }
+
+  const updated = {
+    ...existing,
+    ...body,
+    id: existing.id,
+    updatedAt: new Date().toISOString()
+  }
+
+  canvases.set(id || '', updated)
+
+  return { canvas: updated }
+})  

app/server/api/canvas/[id]/duplicate.post.ts

@@ -0,0 +1,46 @@
+import { requireAuth } from '~/server/utils/auth'
+import { canvases } from '~/server/utils/db'
+import type { CanvasData } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const id = getRouterParam(event, 'id')
+
+  if (!id) {
+    throw createError({ statusCode: 400, message: 'Canvas ID is required' })
+  }
+
+  const original = canvases.get(id)
+  if (!original) {
+    throw createError({ statusCode: 404, message: 'Canvas not found' })
+  }
+
+  // Check permissions
+  if (original.ownerId !== user.id && !original.isPublic) {
+    throw createError({ statusCode: 403, message: 'Access denied' })
+  }
+
+  const newId = `canvas-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
+  const duplicate: CanvasData = {
+    ...original,
+    id: newId,
+    name: `${original.name} (Copy)`,
+    ownerId: user.id,
+    groupId: undefined, // Duplicates are personal
+    isPublic: false,
+    createdAt: new Date().toISOString(),
+    updatedAt: new Date().toISOString(),
+    nodes: original.nodes.map(node => ({
+      ...node,
+      id: `${node.id}-copy-${Date.now()}`
+    })),
+    edges: original.edges.map(edge => ({
+      ...edge,
+      id: `${edge.id}-copy-${Date.now()}`
+    }))
+  }
+
+  canvases.set(newId, duplicate)
+
+  return { canvas: duplicate }
+})

app/server/api/canvas/index.get.ts

@@ -0,0 +1,34 @@
+import { requireAuth } from '~/server/utils/auth'
+import { canvases, userGroups } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+
+  // Get all canvases the user can access
+  const userGroupIds = Array.from(userGroups.values())
+    .filter(membership => membership.userId === user.id)
+    .map(membership => membership.groupId)
+
+  const accessibleCanvases = Array.from(canvases.values()).filter(canvas => {
+    // User can see their own canvases
+    if (canvas.ownerId === user.id) return true
+    // User can see public canvases
+    if (canvas.isPublic) return true
+    // User can see group canvases they're a member of
+    if (canvas.groupId && userGroupIds.includes(canvas.groupId)) return true
+    return false
+  })
+
+  const canvasList = accessibleCanvases.map(canvas => ({
+    id: canvas.id,
+    name: canvas.name,
+    ownerId: canvas.ownerId,
+    createdAt: canvas.createdAt,
+    updatedAt: canvas.updatedAt,
+    isPublic: canvas.isPublic,
+    groupId: canvas.groupId,
+    nodeCount: canvas.nodes.length
+  }))
+
+  return { canvases: canvasList }
+})

app/server/api/canvas/index.post.ts

@@ -0,0 +1,36 @@
+import { requireAuth } from '~/server/utils/auth'
+import { canvases, userGroups } from '~/server/utils/db'
+import type { CanvasData } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const body = await readBody(event)
+  const { name = 'New Canvas', nodes = [], edges = [], isPublic = false, groupId } = body
+
+  // Check group permissions if groupId is provided
+  if (groupId) {
+    const membership = Array.from(userGroups.values()).find(
+      m => m.userId === user.id && m.groupId === groupId
+    )
+    if (!membership) {
+      throw createError({ statusCode: 403, message: 'Not a member of this group' })
+    }
+  }
+
+  const id = `canvas-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
+  const canvas: CanvasData = {
+    id,
+    name,
+    nodes,
+    edges,
+    createdAt: new Date().toISOString(),
+    updatedAt: new Date().toISOString(),
+    ownerId: user.id,
+    groupId,
+    isPublic
+  }
+
+  canvases.set(id, canvas)
+
+  return { canvas }
+})  

app/server/api/git/auto-sync.post.ts

@@ -0,0 +1,36 @@
+import { requireAuth } from '~/server/utils/auth'
+import { saveCanvasToGitea } from '~/server/utils/giteaApi'
+import { canvases } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const body = await readBody(event)
+  const { canvasId, autoSync = true } = body
+
+  if (!canvasId) {
+    throw createError({ statusCode: 400, message: 'Canvas ID is required' })
+  }
+
+  // Check if canvas exists and user has access
+  const canvas = canvases.get(canvasId)
+  if (!canvas) {
+    throw createError({ statusCode: 404, message: 'Canvas not found' })
+  }
+
+  // Check permissions
+  if (canvas.ownerId !== user.id && !canvas.isPublic) {
+    throw createError({ statusCode: 403, message: 'Access denied' })
+  }
+
+  try {
+    const ok = await saveCanvasToGitea(canvasId, canvas, `Auto-sync: ${canvas.name}`)
+    return {
+      success: ok,
+      message: ok ? 'Canvas synchronized with Gitea' : 'Gitea sync failed',
+      autoSyncEnabled: autoSync
+    }
+  } catch (error) {
+    console.error('Failed to sync canvas to Gitea:', error)
+    throw createError({ statusCode: 500, message: 'Failed to sync canvas to Gitea' })
+  }
+})

app/server/api/git/real-sync.post.ts

@@ -0,0 +1,56 @@
+import { requireAuth } from '~/server/utils/auth'
+import { saveCanvasToGitea, loadCanvasFromGitea } from '~/server/utils/giteaApi'
+import { canvases } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const body = await readBody(event)
+  const { canvasId, action, commitMessage } = body
+
+  if (!canvasId || !action) {
+    throw createError({ statusCode: 400, message: 'Canvas ID and action are required' })
+  }
+
+  try {
+    switch (action) {
+      case 'init':
+      case 'sync': {
+        const canvas = canvases.get(canvasId)
+        if (!canvas) {
+          throw createError({ statusCode: 404, message: 'Canvas not found' })
+        }
+        if (canvas.ownerId !== user.id && !canvas.isPublic) {
+          throw createError({ statusCode: 403, message: 'Access denied' })
+        }
+
+        const ok = await saveCanvasToGitea(canvasId, canvas, commitMessage)
+        return {
+          success: ok,
+          message: ok
+            ? `Canvas ${canvasId} saved to Gitea`
+            : `Failed to save canvas ${canvasId} to Gitea`
+        }
+      }
+
+      case 'load': {
+        const gitCanvas = await loadCanvasFromGitea(canvasId)
+        if (!gitCanvas) {
+          return { success: false, message: 'Canvas not found in Gitea', needsInit: true }
+        }
+
+        const existing = canvases.get(canvasId)
+        if (existing) {
+          canvases.set(canvasId, { ...existing, nodes: gitCanvas.nodes || [], edges: gitCanvas.edges || [] })
+        }
+
+        return { success: true, canvas: gitCanvas, message: `Canvas ${canvasId} loaded from Gitea` }
+      }
+
+      default:
+        throw createError({ statusCode: 400, message: 'Invalid action' })
+    }
+  } catch (error: any) {
+    console.error('Gitea sync error:', error)
+    throw createError({ statusCode: 500, message: error?.message || 'Gitea operation failed' })
+  }
+})

app/server/api/git/repository.post.ts

@@ -0,0 +1,47 @@
+import { requireAuth } from '~/server/utils/auth'
+import { saveCanvasToGitea } from '~/server/utils/giteaApi'
+import { canvases, userGroups } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const body = await readBody(event)
+  const { canvasId, type } = body
+
+  if (!canvasId || !type) {
+    throw createError({ statusCode: 400, message: 'Canvas ID and repository type are required' })
+  }
+
+  // Check if canvas exists and user has access
+  const canvas = canvases.get(canvasId)
+  if (!canvas) {
+    throw createError({ statusCode: 404, message: 'Canvas not found' })
+  }
+
+  if (canvas.ownerId !== user.id && !canvas.isPublic) {
+    // Check group access
+    if (canvas.groupId) {
+      const membership = Array.from(userGroups.values()).find(
+        m => m.userId === user.id && m.groupId === canvas.groupId
+      )
+      if (!membership) {
+        throw createError({ statusCode: 403, message: 'Access denied' })
+      }
+    } else {
+      throw createError({ statusCode: 403, message: 'Access denied' })
+    }
+  }
+
+  try {
+    // Initial save to Gitea creates the canvas file in the repo
+    const ok = await saveCanvasToGitea(canvasId, canvas, `Init canvas ${canvasId}`)
+    return {
+      success: ok,
+      message: ok
+        ? `Canvas ${canvasId} initialized in Gitea`
+        : `Failed to initialize canvas ${canvasId} in Gitea`
+    }
+  } catch (error) {
+    console.error('Failed to initialize canvas in Gitea:', error)
+    throw createError({ statusCode: 500, message: 'Failed to initialize canvas in Gitea' })
+  }
+})

app/server/api/git/sync.post.ts

@@ -0,0 +1,23 @@
+import { requireAuth } from '~/server/utils/auth'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const body = await readBody(event)
+  const { canvasId, action, commitMessage } = body
+
+  if (!canvasId || !action) {
+    throw createError({ statusCode: 400, message: 'Canvas ID and action are required' })
+  }
+
+  try {
+    // Git sync logic will be implemented here
+    // For now, return success response
+    return {
+      success: true,
+      message: `Git ${action} completed for canvas ${canvasId}`,
+      commitMessage: commitMessage || `Auto-sync canvas ${canvasId}`
+    }
+  } catch (error) {
+    throw createError({ statusCode: 500, message: 'Git sync failed' })
+  }
+})

app/server/api/git/test.get.ts

@@ -0,0 +1,45 @@
+// Test endpoint: GET /api/git/test
+// Verifies Gitea connection and repo access
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig()
+
+  const { giteaUrl, giteaToken, giteaOrg, giteaMindmapRepo } = config
+
+  if (!giteaUrl || !giteaToken) {
+    return { success: false, message: 'GITEA_URL or GITEA_TOKEN not set in .env' }
+  }
+
+  try {
+    // Test 1: check repo exists
+    const repo = await $fetch<any>(`${giteaUrl}/api/v1/repos/${giteaOrg}/${giteaMindmapRepo}`, {
+      headers: { 'Authorization': `token ${giteaToken}` }
+    })
+
+    // Test 2: check/create canvases folder by listing contents
+    let folderExists = false
+    try {
+      await $fetch(`${giteaUrl}/api/v1/repos/${giteaOrg}/${giteaMindmapRepo}/contents/canvases`, {
+        headers: { 'Authorization': `token ${giteaToken}` }
+      })
+      folderExists = true
+    } catch {
+      folderExists = false
+    }
+
+    return {
+      success: true,
+      repo: repo.full_name,
+      private: repo.private,
+      folderExists,
+      message: folderExists
+        ? '✅ Gitea connected, canvases/ folder exists'
+        : '✅ Gitea connected, canvases/ folder will be created on first save'
+    }
+  } catch (e: any) {
+    return {
+      success: false,
+      message: `❌ Gitea connection failed: ${e?.message || e}`,
+      hint: 'Check GITEA_URL, GITEA_TOKEN, GITEA_ORG, GITEA_MINDMAP_REPO in .env'
+    }
+  }
+})

app/server/api/groups/[id].delete.ts

@@ -0,0 +1,20 @@
+import { requireAuth } from '~/server/utils/auth'
+import { groups, userGroups } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const groupId = getRouterParam(event, 'id')!
+
+  const group = groups.get(groupId)
+  if (!group) throw createError({ statusCode: 404, message: 'Group not found' })
+  if (group.ownerId !== user.id && user.role !== 'admin') {
+    throw createError({ statusCode: 403, message: 'Only owner can delete group' })
+  }
+
+  groups.delete(groupId)
+  for (const [key] of userGroups) {
+    if (key.endsWith(`-${groupId}`)) userGroups.delete(key)
+  }
+
+  return { success: true }
+})

app/server/api/groups/[id]/join.post.ts

@@ -0,0 +1,17 @@
+import { requireAuth } from '~/server/utils/auth'
+import { groups, userGroups } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const groupId = getRouterParam(event, 'id')!
+
+  const group = groups.get(groupId)
+  if (!group) throw createError({ statusCode: 404, message: 'Group not found' })
+  if (!group.isPublic) throw createError({ statusCode: 403, message: 'Group is private' })
+
+  const key = `${user.id}-${groupId}`
+  if (userGroups.has(key)) return { message: 'Already a member' }
+
+  userGroups.set(key, { userId: user.id, groupId, role: 'member', joinedAt: new Date().toISOString() })
+  return { success: true, message: `Joined group "${group.name}"` }
+})

app/server/api/groups/[id]/leave.post.ts

@@ -0,0 +1,17 @@
+import { requireAuth } from '~/server/utils/auth'
+import { groups, userGroups } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const groupId = getRouterParam(event, 'id')!
+
+  const group = groups.get(groupId)
+  if (!group) throw createError({ statusCode: 404, message: 'Group not found' })
+  if (group.ownerId === user.id) throw createError({ statusCode: 400, message: 'Owner cannot leave group. Delete it instead.' })
+
+  const key = `${user.id}-${groupId}`
+  if (!userGroups.has(key)) throw createError({ statusCode: 400, message: 'Not a member' })
+
+  userGroups.delete(key)
+  return { success: true, message: `Left group "${group.name}"` }
+})

app/server/api/groups/index.get.ts

@@ -0,0 +1,8 @@
+import { requireAuth } from '~/server/utils/auth'
+import { groups } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  requireAuth(event)
+  const allGroups = Array.from(groups.values()).filter(g => g.isPublic)
+  return { groups: allGroups }
+})

app/server/api/groups/index.post.ts

@@ -0,0 +1,27 @@
+import { requireAuth } from '~/server/utils/auth'
+import { groups, userGroups } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const body = await readBody(event)
+  const { name, description = '', isPublic = true } = body
+
+  if (!name?.trim()) {
+    throw createError({ statusCode: 400, message: 'Group name is required' })
+  }
+
+  const id = `group-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`
+  const now = new Date().toISOString()
+
+  const group = { id, name: name.trim(), description, isPublic, createdAt: now, updatedAt: now, ownerId: user.id }
+  groups.set(id, group)
+
+  userGroups.set(`${user.id}-${id}`, {
+    userId: user.id,
+    groupId: id,
+    role: 'admin',
+    joinedAt: now
+  })
+
+  return { group }
+})

app/server/api/nodes/[id].put.ts

@@ -0,0 +1,26 @@
+import { requireAuth } from '~/server/utils/auth'
+import { nodes, addAchievement } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const id = getRouterParam(event, 'id')
+  const body = await readBody(event)
+
+  const existing = nodes.get(id || '') || { id, state: 'pending', assigned_to: user.id }
+
+  // Update state
+  const updated = { ...existing, ...body, updatedAt: new Date().toISOString() }
+  nodes.set(id || '', updated)
+
+  // Gamification: achievement on completion
+  if (body.state === 'completed' && existing.state !== 'completed') {
+    addAchievement(user.id, {
+      id: `completed-${id}`,
+      title: 'Задача выполнена',
+      description: `Нода ${id} завершена`,
+      icon: '✅'
+    })
+  }
+
+  return { node: updated }
+})

app/server/api/nodes/index.get.ts

@@ -0,0 +1,14 @@
+import { requireAuth } from '~/server/utils/auth'
+import { nodes } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+
+  // RBAC: filter nodes by assigned_to or role
+  const allNodes = Array.from(nodes.values())
+  const filtered = user.role === 'admin'
+    ? allNodes
+    : allNodes.filter((n: any) => n.assigned_to === user.id || n.assigned_to === 'all')
+
+  return { nodes: filtered }
+})

app/server/api/push/send.post.ts

@@ -0,0 +1,21 @@
+import { requireRole } from '~/server/utils/auth'
+import { pushSubscriptions } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  requireRole(event, 'admin')
+  const body = await readBody(event)
+  const { title, message, userId } = body
+
+  const targets = userId
+    ? [pushSubscriptions.get(userId)].filter(Boolean)
+    : Array.from(pushSubscriptions.values())
+
+  // In production, use web-push library with VAPID keys
+  const results = targets.map((sub: any) => ({
+    userId: sub.userId,
+    sent: true,
+    notification: { title, message, timestamp: new Date().toISOString() }
+  }))
+
+  return { sent: results.length, results }
+})

app/server/api/push/subscribe.post.ts

@@ -0,0 +1,16 @@
+import { requireAuth } from '~/server/utils/auth'
+import { pushSubscriptions } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const body = await readBody(event)
+  const { subscription } = body
+
+  if (!subscription?.endpoint) {
+    throw createError({ statusCode: 400, message: 'Invalid subscription' })
+  }
+
+  pushSubscriptions.set(user.id, { userId: user.id, subscription, createdAt: new Date().toISOString() })
+
+  return { success: true }
+})

app/server/api/user/groups.get.ts

@@ -0,0 +1,18 @@
+import { requireAuth } from '~/server/utils/auth'
+import { userGroups, groups } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  
+  // Get all groups the user is a member of
+  const userGroupMemberships = Array.from(userGroups.values()).filter(
+    membership => membership.userId === user.id
+  )
+  
+  const userGroupsData = userGroupMemberships.map(membership => {
+    const group = groups.get(membership.groupId)
+    return group ? { ...group, membershipRole: membership.role } : null
+  }).filter(Boolean)
+  
+  return { groups: userGroupsData }
+})

app/server/api/users/[id]/activity.get.ts

@@ -0,0 +1,17 @@
+import { activities } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const userId = getRouterParam(event, 'id')
+
+  if (!userId) {
+    throw createError({ statusCode: 400, message: 'User ID is required' })
+  }
+
+  // Get user's recent activities
+  const userActivities = Array.from(activities.values())
+    .filter(activity => activity.userId === userId)
+    .sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime())
+    .slice(0, 50) // Limit to 50 most recent
+
+  return { activities: userActivities }
+})

app/server/api/users/[id]/canvases.get.ts

@@ -0,0 +1,36 @@
+import { canvases, userGroups } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const userId = getRouterParam(event, 'id')
+
+  if (!userId) {
+    throw createError({ statusCode: 400, message: 'User ID is required' })
+  }
+
+  // Get user's group memberships
+  const userGroupIds = Array.from(userGroups.values())
+    .filter(membership => membership.userId === userId)
+    .map(membership => membership.groupId)
+
+  // Get canvases owned by user or shared with user's groups
+  const userCanvases = Array.from(canvases.values()).filter(canvas => {
+    // User's own canvases
+    if (canvas.ownerId === userId) return true
+    // Group canvases
+    if (canvas.groupId && userGroupIds.includes(canvas.groupId)) return true
+    return false
+  })
+
+  const canvasList = userCanvases.map(canvas => ({
+    id: canvas.id,
+    name: canvas.name,
+    ownerId: canvas.ownerId,
+    createdAt: canvas.createdAt,
+    updatedAt: canvas.updatedAt,
+    isPublic: canvas.isPublic,
+    groupId: canvas.groupId,
+    nodeCount: canvas.nodes.length
+  }))
+
+  return { canvases: canvasList }
+})

app/server/api/users/[id]/profile.get.ts

@@ -0,0 +1,40 @@
+import { profiles, canvases, follows } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const userId = getRouterParam(event, 'id')
+
+  if (!userId) {
+    throw createError({ statusCode: 400, message: 'User ID is required' })
+  }
+
+  const profile = profiles.get(userId)
+  if (!profile) {
+    throw createError({ statusCode: 404, message: 'Profile not found' })
+  }
+
+  // Count user's canvases
+  const userCanvases = Array.from(canvases.values()).filter(
+    canvas => canvas.ownerId === userId
+  )
+
+  // Count followers and following
+  const followers = Array.from(follows.values()).filter(
+    follow => follow.followingId === userId
+  ).length
+
+  const following = Array.from(follows.values()).filter(
+    follow => follow.followerId === userId
+  ).length
+
+  // Update profile with current stats
+  const updatedProfile = {
+    ...profile,
+    canvasCount: userCanvases.length,
+    followerCount: followers,
+    followingCount: following
+  }
+
+  profiles.set(userId, updatedProfile)
+
+  return { profile: updatedProfile }
+})