fix: username sanitization, canvas creation modal fixes, and auth headers for tasks

app/server/api/auth/google.post.ts

@@ -34,7 +34,8 @@ export default defineEventHandler(async (event) => {
 
   const fbUser: FirebaseUser = verifyRes.users[0]
   const email = fbUser.email
-  const username = email.split('@')[0]
+  // Очищаем username: заменяем пробелы на дефисы и убираем спецсимволы
+  const username = email.split('@')[0].toLowerCase().replace(/\s+/g, '-').replace(/[^a-z0-9-_]/g, '')
   const userId = fbUser.localId
 
   const user = await prisma.user.upsert({

app/server/api/groups/[id]/add-member.post.ts

@@ -5,28 +5,28 @@ export default defineEventHandler(async (event) => {
   const adminUser = requireAuth(event)
   const groupId = getRouterParam(event, 'id')
   const body = await readBody(event)
-  const { email, role = 'member' } = body
+  const { email, userId, role = 'member' } = body
 
-  if (!groupId || !email) {
-    throw createError({ statusCode: 400, message: 'Group ID and Email are required' })
+  if (!groupId || (!email && !userId)) {
+    throw createError({ statusCode: 400, message: 'Group ID and either Email or User ID are required' })
   }
 
-  // 1. Проверяем, является ли текущий пользователь админом группы или глобальным админом
-  const group = await prisma.group.findUnique({
-    where: { id: groupId }
-  })
-
+  // 1. Проверяем права
+  const group = await prisma.group.findUnique({ where: { id: groupId } })
   if (!group || (group.ownerId !== adminUser.id && adminUser.role !== 'admin')) {
     throw createError({ statusCode: 403, message: 'Only group owners or admins can add members' })
   }
 
-  // 2. Ищем пользователя по email
-  const userToAdd = await prisma.user.findUnique({
-    where: { email }
-  })
+  // 2. Находим пользователя
+  let userToAdd = null
+  if (userId) {
+    userToAdd = await prisma.user.findUnique({ where: { id: userId } })
+  } else if (email) {
+    userToAdd = await prisma.user.findUnique({ where: { email } })
+  }
 
   if (!userToAdd) {
-    throw createError({ statusCode: 404, message: 'User with this email not found in system' })
+    throw createError({ statusCode: 404, message: 'User not found' })
   }
 
   // 3. Добавляем в группу