refactor: remove legacy spaces and migrate lists to standalone resources with direct sharing

internal/api/server.go

@@ -63,6 +63,7 @@ func (s *Server) Router() http.Handler {
 	r.Post("/api/v1/webhooks/ingest", s.handleWebhookIngest)
 	r.Get("/api/v1/ws", s.handleWebSocket)
 	r.Get("/api/v1/ws/spaces/{spaceId}", s.handleWebSocket)
+	r.Get("/api/v1/ws/lists/{listId}", s.handleWebSocket)
 
 	// Authenticated API Routes
 	r.Group(func(r chi.Router) {
@@ -125,18 +126,14 @@ func (s *Server) Router() http.Handler {
 		r.Post("/api/v1/documents/{id}/lock/heartbeat", s.handleHeartbeatDocLock)
 		r.Delete("/api/v1/documents/{id}/lock", s.handleUnlockDoc)
 
-		// Shared Spaces & Realtime Lists
-		r.Get("/api/v1/spaces", s.handleGetSpaces)
-		r.Post("/api/v1/spaces", s.handleCreateSpace)
-		r.Post("/api/v1/spaces/join", s.handleJoinSpace)
-		r.Get("/api/v1/spaces/{id}/shares", s.handleGetSpaceShares)
-		r.Post("/api/v1/spaces/{id}/members", s.handleAddSpaceMember)
-		r.Delete("/api/v1/spaces/{id}/members/{userId}", s.handleRemoveSpaceMember)
-		r.Get("/api/v1/spaces/{id}/lists", s.handleGetSpaceLists)
-		r.Post("/api/v1/spaces/{id}/lists", s.handleCreateList)
-
+		// Shared Lists & Realtime Collaboration
 		r.Get("/api/v1/lists", s.handleGetAllLists)
+		r.Post("/api/v1/lists", s.handleCreateList)
+		r.Get("/api/v1/lists/{id}", s.handleGetListByID)
 		r.Delete("/api/v1/lists/{id}", s.handleDeleteList)
+		r.Get("/api/v1/lists/{id}/shares", s.handleGetListShares)
+		r.Post("/api/v1/lists/{id}/shares", s.handleCreateListShare)
+		r.Delete("/api/v1/lists/{id}/shares/{shareId}", s.handleDeleteListShare)
 		r.Post("/api/v1/lists/{id}/items", s.handleCreateListItem)
 		r.Patch("/api/v1/lists/{id}/items/{itemId}", s.handleToggleListItem)
 		r.Delete("/api/v1/lists/{id}/items/{itemId}", s.handleDeleteListItem)
@@ -584,8 +581,8 @@ func (s *Server) handleCaptureInbox(w http.ResponseWriter, r *http.Request) {
 		if converted, convErr := s.store.UpdateThoughtTriage(userID, thought.ID, "keep", target, targetListID, dueDate, taskListID); convErr == nil && converted != nil {
 			thought = converted
 			if target == "list_item" && targetListID != "" {
-				if lst, lErr := s.store.GetListByID(targetListID); lErr == nil && lst != nil {
-					s.wsHub.Broadcast(lst.SpaceID, lst.ID, "ITEM_CREATED", lst)
+				if lst, lErr := s.store.GetListByID(userID, targetListID); lErr == nil && lst != nil {
+					s.wsHub.BroadcastListEvent(lst.ID, "ITEM_CREATED", lst)
 				}
 			}
 		}
@@ -661,8 +658,8 @@ func (s *Server) handleTriageAction(w http.ResponseWriter, r *http.Request) {
 
 	// If converted to a list item, broadcast via WebSocket to the space
 	if convertTo == "list_item" && targetListID != "" {
-		if lst, err := s.store.GetListByID(targetListID); err == nil && lst != nil {
-			s.wsHub.Broadcast(lst.SpaceID, lst.ID, "ITEM_CREATED", lst)
+		if lst, err := s.store.GetListByID(userID, targetListID); err == nil && lst != nil {
+			s.wsHub.BroadcastListEvent(lst.ID, "ITEM_CREATED", lst)
 		}
 	}
 
@@ -1073,151 +1070,7 @@ func (s *Server) handleUnlockDoc(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]bool{"unlocked": released})
 }
 
-// --- SPACES & REALTIME LISTS ---
-
-func (s *Server) handleGetSpaces(w http.ResponseWriter, r *http.Request) {
-	userID := auth.GetUserID(r.Context())
-	spaces, err := s.store.GetSpacesForUser(userID)
-	if err != nil {
-		writeError(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, spaces)
-}
-
-func (s *Server) handleCreateSpace(w http.ResponseWriter, r *http.Request) {
-	userID := auth.GetUserID(r.Context())
-	var req struct {
-		Name        string `json:"name"`
-		Icon        string `json:"icon"`
-		Description string `json:"description"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
-		return
-	}
-
-	sp, err := s.store.CreateSpace(userID, req.Name, req.Icon, req.Description, false)
-	if err != nil {
-		writeError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-	writeJSON(w, http.StatusCreated, sp)
-}
-
-func (s *Server) handleJoinSpace(w http.ResponseWriter, r *http.Request) {
-	userID := auth.GetUserID(r.Context())
-	var req struct {
-		InviteCode string `json:"inviteCode"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
-		return
-	}
-
-	sp, err := s.store.JoinSpaceByInviteCode(userID, req.InviteCode)
-	if err != nil {
-		writeError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-	s.wsHub.BroadcastToUser(userID, "SPACE_JOINED", map[string]interface{}{"spaceId": sp.ID})
-	s.wsHub.Broadcast(sp.ID, "", "MEMBER_ADDED", map[string]interface{}{"spaceId": sp.ID, "userId": userID})
-
-	writeJSON(w, http.StatusOK, sp)
-}
-
-func (s *Server) handleAddSpaceMember(w http.ResponseWriter, r *http.Request) {
-	currentUserID := auth.GetUserID(r.Context())
-	spaceID := chi.URLParam(r, "id")
-	var req struct {
-		UserID string `json:"userId"`
-		Email  string `json:"email"`
-		TeamID string `json:"teamId"`
-		Role   string `json:"role"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
-		return
-	}
-
-	if req.Role != "owner" && req.Role != "editor" && req.Role != "viewer" {
-		req.Role = "editor"
-	}
-
-	if req.TeamID != "" {
-		share, err := s.store.CreateSpaceTeamShare(currentUserID, spaceID, req.TeamID, req.Role)
-		if err != nil {
-			writeError(w, http.StatusBadRequest, err.Error())
-			return
-		}
-		members, _ := s.store.GetTeamMembers(req.TeamID)
-		for _, tm := range members {
-			s.wsHub.BroadcastToUser(tm.UserID, "SPACE_JOINED", map[string]interface{}{"spaceId": spaceID})
-		}
-		s.wsHub.Broadcast(spaceID, "", "SPACE_SHARED", share)
-		writeJSON(w, http.StatusCreated, share)
-		return
-	}
-
-	target := req.UserID
-	if target == "" {
-		target = req.Email
-	}
-	if target == "" {
-		writeError(w, http.StatusBadRequest, "Benutzer-ID, Benutzername, E-Mail oder Team erforderlich")
-		return
-	}
-
-	member, err := s.store.AddSpaceMember(currentUserID, spaceID, target, req.Role)
-	if err != nil {
-		writeError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-
-	s.wsHub.BroadcastToUser(member.UserID, "SPACE_JOINED", map[string]interface{}{"spaceId": spaceID})
-	s.wsHub.Broadcast(spaceID, "", "MEMBER_ADDED", member)
-
-	writeJSON(w, http.StatusCreated, member)
-}
-
-func (s *Server) handleGetSpaceShares(w http.ResponseWriter, r *http.Request) {
-	spaceID := chi.URLParam(r, "id")
-	shares, err := s.store.GetSpaceShares(spaceID)
-	if err != nil {
-		writeError(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, shares)
-}
-
-func (s *Server) handleRemoveSpaceMember(w http.ResponseWriter, r *http.Request) {
-	currentUserID := auth.GetUserID(r.Context())
-	spaceID := chi.URLParam(r, "id")
-	targetUserID := chi.URLParam(r, "userId")
-
-	// If prefixed with sm_, strip it for individual space member removal
-	cleanTargetID := strings.TrimPrefix(targetUserID, "sm_")
-
-	if err := s.store.RemoveSpaceMember(currentUserID, spaceID, cleanTargetID); err != nil {
-		writeError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-
-	s.wsHub.BroadcastToUser(cleanTargetID, "SPACE_LEFT", map[string]interface{}{"spaceId": spaceID})
-	s.wsHub.Broadcast(spaceID, "", "MEMBER_REMOVED", map[string]interface{}{"spaceId": spaceID, "userId": cleanTargetID})
-
-	writeJSON(w, http.StatusOK, map[string]bool{"success": true})
-}
-
-func (s *Server) handleGetSpaceLists(w http.ResponseWriter, r *http.Request) {
-	spaceID := chi.URLParam(r, "id")
-	lists, err := s.store.GetListsForSpace(spaceID)
-	if err != nil {
-		writeError(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, lists)
-}
+// --- REALTIME LISTS & SHARING ---
 
 func (s *Server) handleGetAllLists(w http.ResponseWriter, r *http.Request) {
 	userID := auth.GetUserID(r.Context())
@@ -1229,8 +1082,19 @@ func (s *Server) handleGetAllLists(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, lists)
 }
 
+func (s *Server) handleGetListByID(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	listID := chi.URLParam(r, "id")
+	lst, err := s.store.GetListByID(userID, listID)
+	if err != nil {
+		writeError(w, http.StatusNotFound, "Liste nicht gefunden")
+		return
+	}
+	writeJSON(w, http.StatusOK, lst)
+}
+
 func (s *Server) handleCreateList(w http.ResponseWriter, r *http.Request) {
-	spaceID := chi.URLParam(r, "id")
+	userID := auth.GetUserID(r.Context())
 	var req struct {
 		Title    string `json:"title"`
 		Icon     string `json:"icon"`
@@ -1241,28 +1105,96 @@ func (s *Server) handleCreateList(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	lst, err := s.store.CreateList(spaceID, req.Title, req.Icon, req.ListType)
+	lst, err := s.store.CreateList(userID, req.Title, req.Icon, req.ListType)
 	if err != nil {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
-	s.wsHub.Broadcast(spaceID, lst.ID, "LIST_CREATED", lst)
+	s.wsHub.BroadcastListEvent(lst.ID, "LIST_CREATED", lst)
 	writeJSON(w, http.StatusCreated, lst)
 }
 
 func (s *Server) handleDeleteList(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
 	listID := chi.URLParam(r, "id")
-	lst, _ := s.store.GetListByID(listID)
-	if err := s.store.DeleteList(listID); err != nil {
+	if err := s.store.DeleteList(userID, listID); err != nil {
 		writeError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	if lst != nil {
-		s.wsHub.Broadcast(lst.SpaceID, listID, "LIST_DELETED", map[string]string{"listId": listID})
-	}
+	s.wsHub.BroadcastListEvent(listID, "LIST_DELETED", map[string]string{"listId": listID})
 	writeJSON(w, http.StatusOK, map[string]bool{"deleted": true})
 }
 
+func (s *Server) handleGetListShares(w http.ResponseWriter, r *http.Request) {
+	listID := chi.URLParam(r, "id")
+	shares, err := s.store.GetListShares(listID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, shares)
+}
+
+func (s *Server) handleCreateListShare(w http.ResponseWriter, r *http.Request) {
+	currentUserID := auth.GetUserID(r.Context())
+	listID := chi.URLParam(r, "id")
+
+	var req struct {
+		TargetType string `json:"targetType"` // "user" or "team"
+		TargetID   string `json:"targetId"`   // userId/email or teamId
+		Role       string `json:"role"`       // "editor" or "viewer"
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
+		return
+	}
+
+	targetType := strings.ToLower(strings.TrimSpace(req.TargetType))
+	if targetType != "team" {
+		targetType = "user"
+	}
+
+	role := strings.ToLower(strings.TrimSpace(req.Role))
+	if role != "viewer" && role != "editor" {
+		role = "editor"
+	}
+
+	share, err := s.store.AddListShare(currentUserID, listID, targetType, req.TargetID, role)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	if targetType == "team" {
+		members, _ := s.store.GetTeamMembers(share.TargetID)
+		for _, tm := range members {
+			s.wsHub.BroadcastToUser(tm.UserID, "LIST_SHARED", share)
+		}
+	} else {
+		s.wsHub.BroadcastToUser(share.TargetID, "LIST_SHARED", share)
+	}
+	s.wsHub.BroadcastListEvent(listID, "LIST_SHARED", share)
+
+	writeJSON(w, http.StatusCreated, share)
+}
+
+func (s *Server) handleDeleteListShare(w http.ResponseWriter, r *http.Request) {
+	currentUserID := auth.GetUserID(r.Context())
+	listID := chi.URLParam(r, "id")
+	shareID := chi.URLParam(r, "shareId")
+
+	if err := s.store.RemoveListShare(currentUserID, listID, shareID); err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	s.wsHub.BroadcastListEvent(listID, "LIST_UNSHARED", map[string]string{
+		"listId":  listID,
+		"shareId": shareID,
+	})
+	writeJSON(w, http.StatusOK, map[string]bool{"success": true})
+}
+
 func (s *Server) handleCreateListItem(w http.ResponseWriter, r *http.Request) {
 	listID := chi.URLParam(r, "id")
 	var req struct {
@@ -1281,9 +1213,7 @@ func (s *Server) handleCreateListItem(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if lst, err := s.store.GetListByID(listID); err == nil && lst != nil {
-		s.wsHub.Broadcast(lst.SpaceID, listID, "ITEM_CREATED", item)
-	}
+	s.wsHub.BroadcastListEvent(listID, "ITEM_CREATED", item)
 	writeJSON(w, http.StatusCreated, item)
 }
 
@@ -1301,7 +1231,7 @@ func (s *Server) handleToggleListItem(w http.ResponseWriter, r *http.Request) {
 	}
 
 	user, _ := s.store.GetUserByID(userID)
-	userName := "Familie"
+	userName := "Mitglied"
 	if user != nil {
 		userName = user.DisplayName
 	}
@@ -1312,9 +1242,7 @@ func (s *Server) handleToggleListItem(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if lst, err := s.store.GetListByID(listID); err == nil && lst != nil {
-		s.wsHub.Broadcast(lst.SpaceID, listID, "ITEM_TOGGLED", item)
-	}
+	s.wsHub.BroadcastListEvent(listID, "ITEM_TOGGLED", item)
 	writeJSON(w, http.StatusOK, item)
 }
 
@@ -1328,12 +1256,10 @@ func (s *Server) handleDeleteListItem(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if lst, err := s.store.GetListByID(listID); err == nil && lst != nil {
-		s.wsHub.Broadcast(lst.SpaceID, listID, "ITEM_DELETED", map[string]string{
-			"itemId": itemID,
-			"listId": listID,
-		})
-	}
+	s.wsHub.BroadcastListEvent(listID, "ITEM_DELETED", map[string]string{
+		"itemId": itemID,
+		"listId": listID,
+	})
 	writeJSON(w, http.StatusOK, map[string]bool{"deleted": true})
 }
 
@@ -1345,14 +1271,25 @@ func (s *Server) handleClearCompletedItems(w http.ResponseWriter, r *http.Reques
 		return
 	}
 
-	if lst, err := s.store.GetListByID(listID); err == nil && lst != nil {
-		s.wsHub.Broadcast(lst.SpaceID, listID, "LIST_CLEARED", lst)
-	}
+	s.wsHub.BroadcastListEvent(listID, "LIST_CLEARED", map[string]interface{}{
+		"listId":  listID,
+		"removed": removed,
+	})
 	writeJSON(w, http.StatusOK, map[string]int64{"removed": removed})
 }
 
 func (s *Server) handleWebSocket(w http.ResponseWriter, r *http.Request) {
-	spaceID := chi.URLParam(r, "spaceId")
+	roomID := chi.URLParam(r, "listId")
+	if roomID == "" {
+		roomID = chi.URLParam(r, "spaceId")
+	}
+	if roomID == "" {
+		roomID = r.URL.Query().Get("listId")
+	}
+	if roomID == "" {
+		roomID = r.URL.Query().Get("spaceId")
+	}
+
 	token := r.URL.Query().Get("token")
 	if token == "" {
 		if authHdr := r.Header.Get("Authorization"); strings.HasPrefix(authHdr, "Bearer ") {
@@ -1365,7 +1302,7 @@ func (s *Server) handleWebSocket(w http.ResponseWriter, r *http.Request) {
 			userID = claims.UserID
 		}
 	}
-	s.wsHub.ServeWS(w, r, spaceID, userID)
+	s.wsHub.ServeWS(w, r, roomID, userID)
 }
 
 // --- API KEYS & WEBHOOK INGESTION ---