feat(tasks): enable sharing task lists with teams and users

internal/api/server.go

@@ -89,11 +89,14 @@ func (s *Server) Router() http.Handler {
 		r.Patch("/api/v1/triage/{id}", s.handleTriageAction)
 		r.Get("/api/v1/tasks", s.handleGetTasks)
 
-		// Task Lists
+		// Task Lists & Shares
 		r.Get("/api/v1/task-lists", s.handleGetTaskLists)
 		r.Post("/api/v1/task-lists", s.handleCreateTaskList)
 		r.Put("/api/v1/task-lists/{id}", s.handleUpdateTaskList)
 		r.Delete("/api/v1/task-lists/{id}", s.handleDeleteTaskList)
+		r.Get("/api/v1/task-lists/{id}/shares", s.handleGetTaskListShares)
+		r.Post("/api/v1/task-lists/{id}/shares", s.handleCreateTaskListShare)
+		r.Delete("/api/v1/task-lists/{id}/shares/{shareId}", s.handleDeleteTaskListShare)
 
 		// Workspace Documents & Folders
 		r.Get("/api/v1/folders", s.handleGetFolders)
@@ -698,7 +701,7 @@ func (s *Server) handleUpdateThought(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
-	s.wsHub.BroadcastTaskEvent(updated.UserID, "TASK_UPDATED", updated)
+	s.wsHub.BroadcastToAll("TASK_UPDATED", updated)
 	writeJSON(w, http.StatusOK, updated)
 }
 
@@ -709,7 +712,7 @@ func (s *Server) handleDeleteThought(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	s.wsHub.BroadcastTaskEvent(userID, "TASK_DELETED", map[string]string{"id": thoughtID})
+	s.wsHub.BroadcastToAll("TASK_DELETED", map[string]string{"id": thoughtID})
 	writeJSON(w, http.StatusOK, map[string]bool{"deleted": true})
 }
 
@@ -1566,6 +1569,7 @@ func (s *Server) handleCreateTaskList(w http.ResponseWriter, r *http.Request) {
 	userID := auth.GetUserID(r.Context())
 	var req struct {
 		SpaceID string `json:"spaceId"`
+		TeamID  string `json:"teamId"`
 		Title   string `json:"title"`
 		Icon    string `json:"icon"`
 		Color   string `json:"color"`
@@ -1574,7 +1578,7 @@ func (s *Server) handleCreateTaskList(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
 		return
 	}
-	tl, err := s.store.CreateTaskList(userID, req.SpaceID, req.Title, req.Icon, req.Color)
+	tl, err := s.store.CreateTaskList(userID, req.SpaceID, req.TeamID, req.Title, req.Icon, req.Color)
 	if err != nil {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
@@ -1589,17 +1593,19 @@ func (s *Server) handleUpdateTaskList(w http.ResponseWriter, r *http.Request) {
 		Title   *string `json:"title"`
 		Icon    *string `json:"icon"`
 		Color   *string `json:"color"`
+		TeamID  *string `json:"teamId"`
 		SpaceID *string `json:"spaceId"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
 		return
 	}
-	tl, err := s.store.UpdateTaskList(userID, listID, req.Title, req.Icon, req.Color, req.SpaceID)
+	tl, err := s.store.UpdateTaskList(userID, listID, req.Title, req.Icon, req.Color, req.TeamID, req.SpaceID)
 	if err != nil {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
+	s.wsHub.BroadcastToAll("TASK_LIST_UPDATED", tl)
 	writeJSON(w, http.StatusOK, tl)
 }
 
@@ -1610,6 +1616,74 @@ func (s *Server) handleDeleteTaskList(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
+	s.wsHub.BroadcastToAll("TASK_LIST_DELETED", map[string]string{"id": listID})
+	writeJSON(w, http.StatusOK, map[string]bool{"deleted": true})
+}
+
+func (s *Server) handleGetTaskListShares(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	listID := chi.URLParam(r, "id")
+	if _, err := s.store.GetTaskListByID(userID, listID); err != nil {
+		writeError(w, http.StatusNotFound, "Aufgabenliste nicht gefunden oder kein Zugriff")
+		return
+	}
+	shares, err := s.store.GetTaskListShares(listID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, shares)
+}
+
+func (s *Server) handleCreateTaskListShare(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	listID := chi.URLParam(r, "id")
+	tl, err := s.store.GetTaskListByID(userID, listID)
+	if err != nil || tl == nil {
+		writeError(w, http.StatusNotFound, "Aufgabenliste nicht gefunden")
+		return
+	}
+	if tl.UserID != userID {
+		writeError(w, http.StatusForbidden, "Nur der Eigentümer kann die Liste freigeben")
+		return
+	}
+	var req struct {
+		TargetType string `json:"targetType"` // team | user
+		TargetID   string `json:"targetId"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
+		return
+	}
+	share, err := s.store.AddTaskListShare(listID, req.TargetType, req.TargetID, userID)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	updatedList, _ := s.store.GetTaskListByID(userID, listID)
+	s.wsHub.BroadcastToAll("TASK_LIST_UPDATED", updatedList)
+	writeJSON(w, http.StatusCreated, share)
+}
+
+func (s *Server) handleDeleteTaskListShare(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	listID := chi.URLParam(r, "id")
+	shareID := chi.URLParam(r, "shareId")
+	tl, err := s.store.GetTaskListByID(userID, listID)
+	if err != nil || tl == nil {
+		writeError(w, http.StatusNotFound, "Aufgabenliste nicht gefunden")
+		return
+	}
+	if tl.UserID != userID {
+		writeError(w, http.StatusForbidden, "Nur der Eigentümer kann Freigaben entfernen")
+		return
+	}
+	if err := s.store.RemoveTaskListShare(listID, shareID); err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	updatedList, _ := s.store.GetTaskListByID(userID, listID)
+	s.wsHub.BroadcastToAll("TASK_LIST_UPDATED", updatedList)
 	writeJSON(w, http.StatusOK, map[string]bool{"deleted": true})
 }