feat: restructure into XFlow monorepo with Nuxt 4, Modular Onion Monolith, Android client, and Desktop CLI

apps/web/server/api/groups/[id]/add-member.post.ts

@@ -0,0 +1,53 @@
+import { requireAuth } from '~/server/utils/auth'
+import { prisma } from '~/server/utils/prisma'
+
+export default defineEventHandler(async (event) => {
+  const adminUser = requireAuth(event)
+  const groupId = getRouterParam(event, 'id')
+  const body = await readBody(event)
+  const { email, userId, role = 'member' } = body
+
+  if (!groupId || (!email && !userId)) {
+    throw createError({ statusCode: 400, message: 'Group ID and either Email or User ID are required' })
+  }
+
+  // 1. Проверяем права
+  const group = await prisma.group.findUnique({ where: { id: groupId } })
+  if (!group || (group.ownerId !== adminUser.id && adminUser.role !== 'admin')) {
+    throw createError({ statusCode: 403, message: 'Only group owners or admins can add members' })
+  }
+
+  // 2. Находим пользователя
+  let userToAdd = null
+  if (userId) {
+    userToAdd = await prisma.user.findUnique({ where: { id: userId } })
+  } else if (email) {
+    userToAdd = await prisma.user.findUnique({ where: { email } })
+  }
+
+  if (!userToAdd) {
+    throw createError({ statusCode: 404, message: 'User not found' })
+  }
+
+  // 3. Добавляем в группу
+  try {
+    const membership = await prisma.groupMember.upsert({
+      where: {
+        userId_groupId: {
+          userId: userToAdd.id,
+          groupId: groupId
+        }
+      },
+      update: { role },
+      create: {
+        userId: userToAdd.id,
+        groupId: groupId,
+        role
+      }
+    })
+
+    return { success: true, membership }
+  } catch (e) {
+    throw createError({ statusCode: 500, message: 'Failed to add member to group' })
+  }
+})

apps/web/server/api/groups/[id]/index.get.ts

@@ -0,0 +1,35 @@
+import { requireAuth } from '~/server/utils/auth'
+import { prisma } from '~/server/utils/prisma'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const id = getRouterParam(event, 'id')
+
+  const group = await prisma.group.findUnique({
+    where: { id },
+    include: {
+      members: {
+        include: {
+          user: {
+            select: { id: true, username: true, email: true }
+          }
+        }
+      },
+      canvases: {
+        select: { id: true, name: true, updatedAt: true }
+      }
+    }
+  })
+
+  if (!group) {
+    throw createError({ statusCode: 404, message: 'Group not found' })
+  }
+
+  // Проверяем, имеет ли пользователь право видеть детали группы
+  const isMember = group.members.some(m => m.userId === user.id)
+  if (!group.isPublic && !isMember && user.role !== 'admin') {
+    throw createError({ statusCode: 403, message: 'Access denied' })
+  }
+
+  return { group }
+})

apps/web/server/api/groups/[id]/join.post.ts

@@ -0,0 +1,22 @@
+import { requireAuth } from '~/server/utils/auth'
+import { prisma } from '~/server/utils/prisma'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const groupId = getRouterParam(event, 'id')!
+
+  const group = await prisma.group.findUnique({ where: { id: groupId } })
+  if (!group) throw createError({ statusCode: 404, message: 'Group not found' })
+  if (!group.isPublic) throw createError({ statusCode: 403, message: 'Group is private' })
+
+  const existing = await prisma.groupMember.findUnique({
+    where: { userId_groupId: { userId: user.id, groupId } }
+  })
+  if (existing) return { message: 'Already a member' }
+
+  await prisma.groupMember.create({
+    data: { userId: user.id, groupId, role: 'member' }
+  })
+
+  return { success: true, message: `Joined group "${group.name}"` }
+})

apps/web/server/api/groups/[id]/leave.post.ts

@@ -0,0 +1,20 @@
+import { requireAuth } from '~/server/utils/auth'
+import { prisma } from '~/server/utils/prisma'
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event)
+  const groupId = getRouterParam(event, 'id')!
+
+  const group = await prisma.group.findUnique({ where: { id: groupId } })
+  if (!group) throw createError({ statusCode: 404, message: 'Group not found' })
+  if (group.ownerId === user.id) throw createError({ statusCode: 400, message: 'Owner cannot leave group. Delete it instead.' })
+
+  const membership = await prisma.groupMember.findUnique({
+    where: { userId_groupId: { userId: user.id, groupId } }
+  })
+  if (!membership) throw createError({ statusCode: 400, message: 'Not a member' })
+
+  await prisma.groupMember.delete({ where: { id: membership.id } })
+
+  return { success: true, message: `Left group "${group.name}"` }
+})

apps/web/server/api/groups/[id]/members.patch.ts

@@ -0,0 +1,41 @@
+import { requireAuth } from '~/server/utils/auth'
+import { prisma } from '~/server/utils/prisma'
+
+export default defineEventHandler(async (event) => {
+  const adminUser = requireAuth(event)
+  const groupId = getRouterParam(event, 'id')
+  const body = await readBody(event)
+  const { userId, role } = body
+
+  if (!groupId || !userId || !role) {
+    throw createError({ statusCode: 400, message: 'Missing required fields' })
+  }
+
+  // 1. Проверяем права: только владелец группы или глобальный админ может менять роли
+  const group = await prisma.group.findUnique({
+    where: { id: groupId }
+  })
+
+  if (!group || (group.ownerId !== adminUser.id && adminUser.role !== 'admin')) {
+    throw createError({ statusCode: 403, message: 'Permission denied' })
+  }
+
+  // 2. Нельзя менять роль самому владельцу (он всегда админ)
+  if (userId === group.ownerId) {
+    throw createError({ statusCode: 400, message: 'Cannot change owner role' })
+  }
+
+  // 3. Обновляем роль
+  try {
+    const updated = await prisma.groupMember.update({
+      where: {
+        userId_groupId: { userId, groupId }
+      },
+      data: { role }
+    })
+
+    return { success: true, updated }
+  } catch (e) {
+    throw createError({ statusCode: 500, message: 'Failed to update member role' })
+  }
+})