feat: implement group member role management (Admin, Editor, Viewer)

app/server/api/groups/[id]/index.get.ts

@@ -11,13 +11,12 @@ export default defineEventHandler(async (event) => {
       members: {
         include: {
           user: {
-            select: {
-              id: true,
-              username: true,
-              email: true
-            }
+            select: { id: true, username: true, email: true }
           }
         }
+      },
+      canvases: {
+        select: { id: true, name: true, updatedAt: true }
       }
     }
   })

app/server/api/groups/[id]/members.patch.ts

@@ -0,0 +1,41 @@
+import { requireAuth } from '~/server/utils/auth'
+import { prisma } from '~/server/utils/prisma'
+
+export default defineEventHandler(async (event) => {
+  const adminUser = requireAuth(event)
+  const groupId = getRouterParam(event, 'id')
+  const body = await readBody(event)
+  const { userId, role } = body
+
+  if (!groupId || !userId || !role) {
+    throw createError({ statusCode: 400, message: 'Missing required fields' })
+  }
+
+  // 1. Проверяем права: только владелец группы или глобальный админ может менять роли
+  const group = await prisma.group.findUnique({
+    where: { id: groupId }
+  })
+
+  if (!group || (group.ownerId !== adminUser.id && adminUser.role !== 'admin')) {
+    throw createError({ statusCode: 403, message: 'Permission denied' })
+  }
+
+  // 2. Нельзя менять роль самому владельцу (он всегда админ)
+  if (userId === group.ownerId) {
+    throw createError({ statusCode: 400, message: 'Cannot change owner role' })
+  }
+
+  // 3. Обновляем роль
+  try {
+    const updated = await prisma.groupMember.update({
+      where: {
+        userId_groupId: { userId, groupId }
+      },
+      data: { role }
+    })
+
+    return { success: true, updated }
+  } catch (e) {
+    throw createError({ statusCode: 500, message: 'Failed to update member role' })
+  }
+})