feat: migrate Canvas and Groups API to Prisma ORM

app/server/api/canvas/[id].delete.ts

@@ -1,15 +1,16 @@
 import { requireAuth } from '~/server/utils/auth'
-import { canvases } from '~/server/utils/db'
+import { prisma } from '~/server/utils/prisma'
 
 export default defineEventHandler(async (event) => {
-  requireAuth(event)
+  const user = requireAuth(event)
   const id = getRouterParam(event, 'id')
+  if (!id) throw createError({ statusCode: 400, message: 'Canvas ID is required' })
 
-  if (!canvases.has(id || '')) {
-    throw createError({ statusCode: 404, message: 'Canvas not found' })
-  }
+  const canvas = await prisma.canvas.findUnique({ where: { id } })
+  if (!canvas) throw createError({ statusCode: 404, message: 'Canvas not found' })
+  if (canvas.ownerId !== user.id) throw createError({ statusCode: 403, message: 'Access denied' })
 
-  canvases.delete(id || '')
+  await prisma.canvas.delete({ where: { id } })
 
   return { success: true, message: 'Canvas deleted' }
-})  
+})

app/server/api/canvas/[id].get.ts

@@ -1,61 +1,24 @@
 import { requireAuth } from '~/server/utils/auth'
-import { canvases, userGroups } from '~/server/utils/db'
+import { prisma } from '~/server/utils/prisma'
 
 export default defineEventHandler(async (event) => {
   const id = getRouterParam(event, 'id')
+  if (!id) throw createError({ statusCode: 400, message: 'Canvas ID is required' })
 
-  if (!id) {
-    throw createError({ statusCode: 400, message: 'Canvas ID is required' })
-  }
+  const canvas = await prisma.canvas.findUnique({ where: { id } })
+  if (!canvas) throw createError({ statusCode: 404, message: 'Canvas not found' })
 
-  const canvas = canvases.get(id)
-  if (!canvas) {
-    throw createError({ statusCode: 404, message: 'Canvas not found' })
-  }
+  if (canvas.isPublic) return canvas
 
-  // Check if canvas is public
-  if (canvas.isPublic) {
-    return {
-      id: canvas.id,
-      name: canvas.name,
-      nodes: canvas.nodes,
-      edges: canvas.edges,
-      isPublic: true,
-      ownerId: canvas.ownerId
-    }
-  }
-
-  // For private canvases, require authentication and check permissions
   const user = requireAuth(event)
 
-  // Check if user owns the canvas
-  if (canvas.ownerId === user.id) {
-    return {
-      id: canvas.id,
-      name: canvas.name,
-      nodes: canvas.nodes,
-      edges: canvas.edges,
-      isPublic: false,
-      ownerId: canvas.ownerId
-    }
-  }
+  if (canvas.ownerId === user.id) return canvas
 
-  // Check if user has access through group membership
   if (canvas.groupId) {
-    const membership = Array.from(userGroups.values()).find(
-      m => m.userId === user.id && m.groupId === canvas.groupId
-    )
-    if (membership) {
-      return {
-        id: canvas.id,
-        name: canvas.name,
-        nodes: canvas.nodes,
-        edges: canvas.edges,
-        isPublic: false,
-        ownerId: canvas.ownerId,
-        groupId: canvas.groupId
-      }
-    }
+    const membership = await prisma.groupMember.findUnique({
+      where: { userId_groupId: { userId: user.id, groupId: canvas.groupId } }
+    })
+    if (membership) return canvas
   }
 
   throw createError({ statusCode: 403, message: 'Access denied' })

app/server/api/canvas/[id].put.ts

@@ -1,24 +1,28 @@
 import { requireAuth } from '~/server/utils/auth'
-import { canvases } from '~/server/utils/db'
+import { prisma } from '~/server/utils/prisma'
 
 export default defineEventHandler(async (event) => {
-  requireAuth(event)
+  const user = requireAuth(event)
   const id = getRouterParam(event, 'id')
+  if (!id) throw createError({ statusCode: 400, message: 'Canvas ID is required' })
+
   const body = await readBody(event)
 
-  const existing = canvases.get(id || '')
-  if (!existing) {
-    throw createError({ statusCode: 404, message: 'Canvas not found' })
-  }
+  const existing = await prisma.canvas.findUnique({ where: { id } })
+  if (!existing) throw createError({ statusCode: 404, message: 'Canvas not found' })
+  if (existing.ownerId !== user.id) throw createError({ statusCode: 403, message: 'Access denied' })
 
-  const updated = {
-    ...existing,
-    ...body,
-    id: existing.id,
-    updatedAt: new Date().toISOString()
-  }
+  const { name, nodes, edges, isPublic, groupId } = body
+  const canvas = await prisma.canvas.update({
+    where: { id },
+    data: {
+      ...(name !== undefined && { name }),
+      ...(nodes !== undefined && { nodes }),
+      ...(edges !== undefined && { edges }),
+      ...(isPublic !== undefined && { isPublic }),
+      ...(groupId !== undefined && { groupId: groupId || null })
+    }
+  })
 
-  canvases.set(id || '', updated)
-
-  return { canvas: updated }
-})  
+  return { canvas }
+})

app/server/api/canvas/index.get.ts

@@ -1,34 +1,41 @@
 import { requireAuth } from '~/server/utils/auth'
-import { canvases, userGroups } from '~/server/utils/db'
+import { prisma } from '~/server/utils/prisma'
 
 export default defineEventHandler(async (event) => {
   const user = requireAuth(event)
 
-  // Get all canvases the user can access
-  const userGroupIds = Array.from(userGroups.values())
-    .filter(membership => membership.userId === user.id)
-    .map(membership => membership.groupId)
+  const userGroups = await prisma.groupMember.findMany({
+    where: { userId: user.id },
+    select: { groupId: true }
+  })
+  const groupIds = userGroups.map(m => m.groupId)
 
-  const accessibleCanvases = Array.from(canvases.values()).filter(canvas => {
-    // User can see their own canvases
-    if (canvas.ownerId === user.id) return true
-    // User can see public canvases
-    if (canvas.isPublic) return true
-    // User can see group canvases they're a member of
-    if (canvas.groupId && userGroupIds.includes(canvas.groupId)) return true
-    return false
+  const canvasList = await prisma.canvas.findMany({
+    where: {
+      OR: [
+        { ownerId: user.id },
+        { isPublic: true },
+        { groupId: { in: groupIds } }
+      ]
+    },
+    select: {
+      id: true,
+      name: true,
+      ownerId: true,
+      groupId: true,
+      isPublic: true,
+      createdAt: true,
+      updatedAt: true,
+      nodes: true
+    },
+    orderBy: { updatedAt: 'desc' }
   })
 
-  const canvasList = accessibleCanvases.map(canvas => ({
-    id: canvas.id,
-    name: canvas.name,
-    ownerId: canvas.ownerId,
-    createdAt: canvas.createdAt,
-    updatedAt: canvas.updatedAt,
-    isPublic: canvas.isPublic,
-    groupId: canvas.groupId,
-    nodeCount: canvas.nodes.length
-  }))
-
-  return { canvases: canvasList }
+  return {
+    canvases: canvasList.map(c => ({
+      ...c,
+      nodeCount: Array.isArray(c.nodes) ? (c.nodes as any[]).length : 0,
+      nodes: undefined
+    }))
+  }
 })

app/server/api/canvas/index.post.ts

@@ -1,36 +1,32 @@
 import { requireAuth } from '~/server/utils/auth'
-import { canvases, userGroups } from '~/server/utils/db'
-import type { CanvasData } from '~/server/utils/db'
+import { prisma } from '~/server/utils/prisma'
 
 export default defineEventHandler(async (event) => {
   const user = requireAuth(event)
   const body = await readBody(event)
   const { name = 'New Canvas', nodes = [], edges = [], isPublic = false, groupId } = body
 
-  // Check group permissions if groupId is provided
   if (groupId) {
-    const membership = Array.from(userGroups.values()).find(
-      m => m.userId === user.id && m.groupId === groupId
-    )
+    const membership = await prisma.groupMember.findUnique({
+      where: { userId_groupId: { userId: user.id, groupId } }
+    })
     if (!membership) {
       throw createError({ statusCode: 403, message: 'Not a member of this group' })
     }
   }
 
   const id = `canvas-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
-  const canvas: CanvasData = {
-    id,
-    name,
-    nodes,
-    edges,
-    createdAt: new Date().toISOString(),
-    updatedAt: new Date().toISOString(),
-    ownerId: user.id,
-    groupId,
-    isPublic
-  }
-
-  canvases.set(id, canvas)
+  const canvas = await prisma.canvas.create({
+    data: {
+      id,
+      name,
+      nodes,
+      edges,
+      isPublic,
+      ownerId: user.id,
+      groupId: groupId || null
+    }
+  })
 
   return { canvas }
-})  
+})