feat: restructure into XFlow monorepo with Nuxt 4, Modular Onion Monolith, Android client, and Desktop CLI

apps/web/server/api/canvas/[id].delete.ts

@@ -0,0 +1,34 @@
+import { requireAuth } from '~/server/utils/auth'
+import { prisma } from '~/server/utils/prisma'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const id = getRouterParam(event, 'id')
+  if (!id) throw createError({ statusCode: 400, message: 'Canvas ID is required' })
+
+  const canvas = await prisma.canvas.findUnique({ where: { id } })
+  if (!canvas) throw createError({ statusCode: 404, message: 'Canvas not found' })
+  
+  // 1. Проверка прав
+  let canDelete = canvas.ownerId === user.id || user.role === 'admin'
+
+  if (!canDelete && canvas.groupId) {
+    const membership = await prisma.groupMember.findUnique({
+      where: {
+        userId_groupId: { userId: user.id, groupId: canvas.groupId }
+      }
+    })
+    // Только админ группы может удалять чужие карты внутри группы
+    if (membership && membership.role === 'admin') {
+      canDelete = true
+    }
+  }
+
+  if (!canDelete) {
+    throw createError({ statusCode: 403, message: 'Удалять карты может только владелец или администратор группы.' })
+  }
+
+  await prisma.canvas.delete({ where: { id } })
+
+  return { success: true, message: 'Canvas deleted' }
+})

apps/web/server/api/canvas/[id].get.ts

@@ -0,0 +1,31 @@
+import { requireAuth } from '~/server/utils/auth'
+import { prisma } from '~/server/utils/prisma'
+
+export default defineEventHandler(async (event) => {
+  const id = getRouterParam(event, 'id')
+  if (!id) throw createError({ statusCode: 400, message: 'Canvas ID is required' })
+
+  const canvas = await prisma.canvas.findUnique({ where: { id } })
+  if (!canvas) throw createError({ statusCode: 404, message: 'Canvas not found' })
+
+  let user = { id: null, role: 'guest' } as any
+  try {
+    user = requireAuth(event)
+  } catch (e) {}
+
+  // Определение роли
+  let userRole = 'viewer'
+  if (user.id === canvas.ownerId) userRole = 'owner'
+  else if (user.role === 'admin') userRole = 'admin'
+  else if (canvas.groupId) {
+    const membership = user.id ? await prisma.groupMember.findUnique({
+      where: { userId_groupId: { userId: user.id as string, groupId: canvas.groupId } }
+    }) : null
+    if (membership) userRole = membership.role
+    else if (!canvas.isPublic) throw createError({ statusCode: 403, message: 'Access denied' })
+  } else if (!canvas.isPublic) {
+    throw createError({ statusCode: 403, message: 'Access denied' })
+  }
+
+  return { canvas, role: userRole }
+})

apps/web/server/api/canvas/[id].put.ts

@@ -0,0 +1,46 @@
+import { requireAuth } from '~/server/utils/auth'
+import { prisma } from '~/server/utils/prisma'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const id = getRouterParam(event, 'id')
+  if (!id) throw createError({ statusCode: 400, message: 'Canvas ID is required' })
+
+  const body = await readBody(event)
+
+  const existing = await prisma.canvas.findUnique({ where: { id } })
+  if (!existing) throw createError({ statusCode: 404, message: 'Canvas not found' })
+  
+  // 1. Проверка прав
+  let canEdit = existing.ownerId === user.id || user.role === 'admin' || existing.isPublic
+
+  if (!canEdit && existing.groupId) {
+    const membership = await prisma.groupMember.findUnique({
+      where: {
+        userId_groupId: { userId: user.id, groupId: existing.groupId }
+      }
+    })
+    // Редакторы и админы группы могут править
+    if (membership && (membership.role === 'admin' || membership.role === 'editor')) {
+      canEdit = true
+    }
+  }
+
+  if (!canEdit) {
+    throw createError({ statusCode: 403, message: 'У вас недостаточно прав для редактирования этой карты' })
+  }
+
+  const { name, nodes, edges, isPublic, groupId } = body
+  const canvas = await prisma.canvas.update({
+    where: { id },
+    data: {
+      ...(name !== undefined && { name }),
+      ...(nodes !== undefined && { nodes }),
+      ...(edges !== undefined && { edges }),
+      ...(isPublic !== undefined && { isPublic }),
+      ...(groupId !== undefined && { groupId: groupId || null })
+    }
+  })
+
+  return { canvas }
+})

apps/web/server/api/canvas/[id]/duplicate.post.ts

@@ -0,0 +1,46 @@
+import { requireAuth } from '~/server/utils/auth'
+import { canvases } from '~/server/utils/db'
+import type { CanvasData } from '~/server/utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const id = getRouterParam(event, 'id')
+
+  if (!id) {
+    throw createError({ statusCode: 400, message: 'Canvas ID is required' })
+  }
+
+  const original = canvases.get(id)
+  if (!original) {
+    throw createError({ statusCode: 404, message: 'Canvas not found' })
+  }
+
+  // Check permissions
+  if (original.ownerId !== user.id && !original.isPublic) {
+    throw createError({ statusCode: 403, message: 'Access denied' })
+  }
+
+  const newId = `canvas-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
+  const duplicate: CanvasData = {
+    ...original,
+    id: newId,
+    name: `${original.name} (Copy)`,
+    ownerId: user.id,
+    groupId: undefined, // Duplicates are personal
+    isPublic: false,
+    createdAt: new Date().toISOString(),
+    updatedAt: new Date().toISOString(),
+    nodes: original.nodes.map(node => ({
+      ...node,
+      id: `${node.id}-copy-${Date.now()}`
+    })),
+    edges: original.edges.map(edge => ({
+      ...edge,
+      id: `${edge.id}-copy-${Date.now()}`
+    }))
+  }
+
+  canvases.set(newId, duplicate)
+
+  return { canvas: duplicate }
+})

apps/web/server/api/canvas/index.get.ts

@@ -0,0 +1,46 @@
+import { requireAuth } from '~/server/utils/auth'
+import { prisma } from '~/server/utils/prisma'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+
+  const userGroups = await prisma.groupMember.findMany({
+    where: { userId: user.id },
+    select: { groupId: true }
+  })
+  const groupIds = userGroups.map(m => m.groupId)
+
+  const canvasList = await prisma.canvas.findMany({
+    where: {
+      OR: [
+        { ownerId: user.id },
+        { isPublic: true },
+        { groupId: { in: groupIds } }
+      ]
+    },
+    select: {
+      id: true,
+      name: true,
+      ownerId: true,
+      groupId: true,
+      isPublic: true,
+      createdAt: true,
+      updatedAt: true,
+      nodes: true
+    },
+    orderBy: { updatedAt: 'desc' }
+  })
+
+  const totalCount = await prisma.canvas.count()
+
+  const canvases = canvasList.map(c => ({
+    ...c,
+    nodeCount: Array.isArray(c.nodes) ? (c.nodes as any[]).length : 0,
+    nodes: undefined
+  }))
+
+  return {
+    canvases,
+    totalCount
+  }
+})

apps/web/server/api/canvas/index.post.ts

@@ -0,0 +1,32 @@
+import { requireAuth } from '~/server/utils/auth'
+import { prisma } from '~/server/utils/prisma'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const body = await readBody(event)
+  const { name = 'New Canvas', nodes = [], edges = [], isPublic = false, groupId } = body
+
+  if (groupId) {
+    const membership = await prisma.groupMember.findUnique({
+      where: { userId_groupId: { userId: user.id, groupId } }
+    })
+    if (!membership) {
+      throw createError({ statusCode: 403, message: 'Not a member of this group' })
+    }
+  }
+
+  const id = `canvas-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
+  const canvas = await prisma.canvas.create({
+    data: {
+      id,
+      name,
+      nodes,
+      edges,
+      isPublic,
+      ownerId: user.id,
+      groupId: groupId || null
+    }
+  })
+
+  return { canvas }
+})