familysync

Files

T

Lucas Berger 00a0454514 fix(260607-l6l): scope GET /api/events to current user + shared calendars

BUG 3: GET / had no ownership predicate — it returned all users' events.
Second household member would see other member's private events.

- Resolve currentUserId at top of GET handler (same resolveUserId helper
  as write endpoints); return 401 if unauthenticated.
- Add ownership predicate to WHERE: AND (calendars.userId = currentUserId
  OR calendars.isShared = true). Combined with and() around the existing
  date-window or() block. Mirrors the /writable-calendars idiom (D-03).

2026-06-07 15:28:54 -04:00

src

fix(260607-l6l): scope GET /api/events to current user + shared calendars

2026-06-07 15:28:54 -04:00

tests

fix(260607-l6l): add missing innerJoin to PATCH+DELETE event lookups

2026-06-07 15:25:31 -04:00

Dockerfile

chore(03): Gate 2 stack bring-up — serve PWA from API image, prod env, credential seed

2026-06-06 21:30:58 -04:00

drizzle.config.ts

feat(01-01): Drizzle schema + DB client + /health slice (GREEN)