Major rework: multi-user accounts (register/login, per-user data isolation), new layout with sidebar/dashboard/profile menu, matrix phase view with collapsible category columns, life timeline with ages per phase, live budget capping, collapsible transitions, mobile support

src/app/api/auth/change-password/route.ts

@@ -0,0 +1,34 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { getCurrentUserId } from "@/lib/session";
+import { changeUserPassword } from "@/lib/users";
+
+const changePasswordSchema = z.object({
+  currentPassword: z.string().min(1),
+  newPassword: z.string().min(6, "Das neue Passwort muss mindestens 6 Zeichen lang sein."),
+});
+
+export async function POST(request: NextRequest) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
+
+  const body = await request.json();
+  const parsed = changePasswordSchema.safeParse(body);
+  if (!parsed.success) {
+    const message = parsed.error.issues[0]?.message ?? "Ungueltige Eingabe.";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+
+  try {
+    await changeUserPassword(userId, parsed.data.currentPassword, parsed.data.newPassword);
+  } catch (e) {
+    return NextResponse.json(
+      { error: e instanceof Error ? e.message : "Passwort aendern fehlgeschlagen." },
+      { status: 400 }
+    );
+  }
+
+  return NextResponse.json({ ok: true });
+}

src/app/api/auth/login/route.ts

@@ -1,24 +1,27 @@
 import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
 import { createSessionToken, SESSION_COOKIE_NAME } from "@/lib/auth";
-import { getAppCredential, verifyAppPassword } from "@/lib/credentials";
+import { verifyUserCredentials } from "@/lib/users";
+
+const loginSchema = z.object({
+  username: z.string().min(1),
+  password: z.string().min(1),
+});
 
 export async function POST(request: NextRequest) {
-  const { password } = await request.json();
-
-  const credential = await getAppCredential();
-  if (!credential) {
-    return NextResponse.json(
-      { error: "Es ist noch kein Passwort gesetzt. Bitte zuerst ein Passwort festlegen." },
-      { status: 409 }
-    );
+  const body = await request.json();
+  const parsed = loginSchema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json({ error: "Bitte Benutzername und Passwort angeben." }, { status: 400 });
   }
 
-  if (typeof password !== "string" || password.length === 0 || !(await verifyAppPassword(password))) {
-    return NextResponse.json({ error: "Falsches Passwort." }, { status: 401 });
+  const user = await verifyUserCredentials(parsed.data.username, parsed.data.password);
+  if (!user) {
+    return NextResponse.json({ error: "Benutzername oder Passwort falsch." }, { status: 401 });
   }
 
-  const token = await createSessionToken();
-  const response = NextResponse.json({ ok: true });
+  const token = await createSessionToken(user.id);
+  const response = NextResponse.json({ ok: true, username: user.username });
   response.cookies.set(SESSION_COOKIE_NAME, token, {
     httpOnly: true,
     secure: process.env.NODE_ENV === "production",

src/app/api/auth/me/route.ts

@@ -0,0 +1,18 @@
+import { NextResponse } from "next/server";
+import { prisma } from "@/lib/db";
+import { getCurrentUserId } from "@/lib/session";
+
+export async function GET() {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
+  const user = await prisma.user.findUnique({
+    where: { id: userId },
+    select: { id: true, username: true, createdAt: true },
+  });
+  if (!user) {
+    return NextResponse.json({ error: "Benutzer nicht gefunden." }, { status: 404 });
+  }
+  return NextResponse.json({ user });
+}

src/app/api/auth/register/route.ts

@@ -0,0 +1,44 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { createSessionToken, SESSION_COOKIE_NAME } from "@/lib/auth";
+import { registerUser, validateUsername } from "@/lib/users";
+
+const registerSchema = z.object({
+  username: z.string().min(1),
+  password: z.string().min(6, "Das Passwort muss mindestens 6 Zeichen lang sein."),
+});
+
+export async function POST(request: NextRequest) {
+  const body = await request.json();
+  const parsed = registerSchema.safeParse(body);
+  if (!parsed.success) {
+    const message = parsed.error.issues[0]?.message ?? "Ungueltige Eingabe.";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+
+  const usernameError = validateUsername(parsed.data.username);
+  if (usernameError) {
+    return NextResponse.json({ error: usernameError }, { status: 400 });
+  }
+
+  let user;
+  try {
+    user = await registerUser(parsed.data.username, parsed.data.password);
+  } catch (e) {
+    return NextResponse.json(
+      { error: e instanceof Error ? e.message : "Registrierung fehlgeschlagen." },
+      { status: 409 }
+    );
+  }
+
+  const token = await createSessionToken(user.id);
+  const response = NextResponse.json({ ok: true, username: user.username }, { status: 201 });
+  response.cookies.set(SESSION_COOKIE_NAME, token, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    maxAge: 60 * 60 * 24 * 30,
+  });
+  return response;
+}

src/app/api/auth/setup/route.ts

@@ -1,37 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { z } from "zod";
-import { createSessionToken, SESSION_COOKIE_NAME } from "@/lib/auth";
-import { getAppCredential, setAppPassword } from "@/lib/credentials";
-
-const setupSchema = z.object({
-  password: z.string().min(4, "Das Passwort muss mindestens 4 Zeichen lang sein."),
-});
-
-// Legt das Login-Passwort einmalig fest. Nur solange noch keine AppCredential-Zeile
-// existiert (d. h. beim allerersten Login) erreichbar -- danach ausschliesslich
-// ueber /api/auth/login.
-export async function POST(request: NextRequest) {
-  const existing = await getAppCredential();
-  if (existing) {
-    return NextResponse.json({ error: "Es ist bereits ein Passwort gesetzt." }, { status: 409 });
-  }
-
-  const body = await request.json();
-  const parsed = setupSchema.safeParse(body);
-  if (!parsed.success) {
-    return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
-  }
-
-  await setAppPassword(parsed.data.password);
-
-  const token = await createSessionToken();
-  const response = NextResponse.json({ ok: true });
-  response.cookies.set(SESSION_COOKIE_NAME, token, {
-    httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
-    sameSite: "lax",
-    path: "/",
-    maxAge: 60 * 60 * 24 * 30,
-  });
-  return response;
-}

src/app/api/auth/status/route.ts

@@ -1,7 +0,0 @@
-import { NextResponse } from "next/server";
-import { getAppCredential } from "@/lib/credentials";
-
-export async function GET() {
-  const credential = await getAppCredential();
-  return NextResponse.json({ passwordSet: credential != null });
-}

src/app/api/household/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { prisma } from "@/lib/db";
 import { getHouseholdOrNull, toHouseholdInput } from "@/lib/queries";
+import { getCurrentUserId } from "@/lib/session";
 
 const personSchema = z.object({
   role: z.enum(["PERSON_A", "PERSON_B"]),
@@ -26,12 +27,21 @@ function validatePersonsForType(data: z.infer<typeof householdSchema>) {
 }
 
 export async function GET() {
-  const household = await getHouseholdOrNull();
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
+  const household = await getHouseholdOrNull(userId);
   return NextResponse.json({ household: household ? toHouseholdInput(household) : null });
 }
 
 export async function POST(request: NextRequest) {
-  const existing = await getHouseholdOrNull();
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
+
+  const existing = await getHouseholdOrNull(userId);
   if (existing) {
     return NextResponse.json(
       { error: "Es existiert bereits ein Haushalt. Bitte PATCH verwenden, um ihn zu bearbeiten." },
@@ -51,6 +61,7 @@ export async function POST(request: NextRequest) {
 
   const household = await prisma.household.create({
     data: {
+      userId,
       householdType: parsed.data.householdType,
       inflationRateDefault: parsed.data.inflationRateDefault,
       persons: { create: parsed.data.persons },
@@ -62,7 +73,12 @@ export async function POST(request: NextRequest) {
 }
 
 export async function PATCH(request: NextRequest) {
-  const existing = await getHouseholdOrNull();
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
+
+  const existing = await getHouseholdOrNull(userId);
   if (!existing) {
     return NextResponse.json({ error: "Kein Haushalt vorhanden." }, { status: 404 });
   }

src/app/api/phases/[phaseId]/route.ts

@@ -1,7 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { prisma } from "@/lib/db";
-import { phaseInclude } from "@/lib/queries";
+import { phaseInclude, getOwnedPhase } from "@/lib/queries";
+import { getCurrentUserId } from "@/lib/session";
 
 const incomeEntrySchema = z.object({
   personId: z.string().nullable().optional(),
@@ -61,6 +62,10 @@ export async function PUT(
   request: NextRequest,
   { params }: { params: Promise<{ phaseId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { phaseId } = await params;
   const body = await request.json();
   const parsed = updatePhaseSchema.safeParse(body);
@@ -69,7 +74,7 @@ export async function PUT(
   }
   const data = parsed.data;
 
-  const existing = await prisma.phase.findUnique({ where: { id: phaseId } });
+  const existing = await getOwnedPhase(phaseId, userId);
   if (!existing) {
     return NextResponse.json({ error: "Phase nicht gefunden." }, { status: 404 });
   }
@@ -111,8 +116,12 @@ export async function DELETE(
   _request: NextRequest,
   { params }: { params: Promise<{ phaseId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { phaseId } = await params;
-  const phase = await prisma.phase.findUnique({ where: { id: phaseId } });
+  const phase = await getOwnedPhase(phaseId, userId);
   if (!phase) {
     return NextResponse.json({ error: "Phase nicht gefunden." }, { status: 404 });
   }

src/app/api/phases/[phaseId]/transition/route.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { prisma } from "@/lib/db";
 import { computeMortgageYearly, computeSecurityYearlyValues } from "@/lib/calculations";
 import { floorToThousand } from "@/lib/format";
+import { getCurrentUserId } from "@/lib/session";
 
 const transitionItemSchema = z.object({
   positionType: z.enum(["SECURITY", "REAL_ESTATE"]),
@@ -25,9 +26,13 @@ export async function GET(
   _request: NextRequest,
   { params }: { params: Promise<{ phaseId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { phaseId } = await params;
-  const phase = await prisma.phase.findUnique({
-    where: { id: phaseId },
+  const phase = await prisma.phase.findFirst({
+    where: { id: phaseId, plan: { household: { userId } } },
     include: { securities: true, realEstates: true },
   });
   if (!phase) {
@@ -61,6 +66,10 @@ export async function PUT(
   request: NextRequest,
   { params }: { params: Promise<{ phaseId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { phaseId } = await params;
   const body = await request.json();
   const parsed = putTransitionSchema.safeParse(body);
@@ -68,8 +77,8 @@ export async function PUT(
     return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
   }
 
-  const phase = await prisma.phase.findUnique({
-    where: { id: phaseId },
+  const phase = await prisma.phase.findFirst({
+    where: { id: phaseId, plan: { household: { userId } } },
     include: { securities: true, realEstates: true },
   });
   if (!phase) {

src/app/api/plans/[planId]/export/route.ts

@@ -1,19 +1,23 @@
 import { NextRequest, NextResponse } from "next/server";
-import { prisma } from "@/lib/db";
-import { planInclude, toHouseholdInput, toPlanInput, getHouseholdOrNull } from "@/lib/queries";
+import { toHouseholdInput, toPlanInput, getHouseholdOrNull, getOwnedPlan } from "@/lib/queries";
+import { getCurrentUserId } from "@/lib/session";
 import { computePlan, planToCsv } from "@/lib/calculations";
 
 export async function GET(
   _request: NextRequest,
   { params }: { params: Promise<{ planId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { planId } = await params;
-  const household = await getHouseholdOrNull();
+  const household = await getHouseholdOrNull(userId);
   if (!household) {
     return NextResponse.json({ error: "Kein Haushalt vorhanden." }, { status: 400 });
   }
 
-  const plan = await prisma.plan.findUnique({ where: { id: planId }, include: planInclude });
+  const plan = await getOwnedPlan(planId, userId);
   if (!plan) {
     return NextResponse.json({ error: "Plan nicht gefunden." }, { status: 404 });
   }

src/app/api/plans/[planId]/phases/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { prisma } from "@/lib/db";
 import { phaseInclude } from "@/lib/queries";
+import { getCurrentUserId } from "@/lib/session";
 
 const createPhaseSchema = z.object({
   name: z.string().min(1).max(120),
@@ -16,6 +17,10 @@ export async function POST(
   request: NextRequest,
   { params }: { params: Promise<{ planId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { planId } = await params;
   const body = await request.json();
   const parsed = createPhaseSchema.safeParse(body);
@@ -23,7 +28,7 @@ export async function POST(
     return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
   }
 
-  const plan = await prisma.plan.findUnique({ where: { id: planId } });
+  const plan = await prisma.plan.findFirst({ where: { id: planId, household: { userId } } });
   if (!plan) {
     return NextResponse.json({ error: "Plan nicht gefunden." }, { status: 404 });
   }

src/app/api/plans/[planId]/route.ts

@@ -1,19 +1,24 @@
 import { NextRequest, NextResponse } from "next/server";
 import { prisma } from "@/lib/db";
-import { planInclude, toHouseholdInput, toPlanInput, getHouseholdOrNull } from "@/lib/queries";
+import { toHouseholdInput, toPlanInput, getHouseholdOrNull, getOwnedPlan } from "@/lib/queries";
+import { getCurrentUserId } from "@/lib/session";
 import { computePlan } from "@/lib/calculations";
 
 export async function GET(
   _request: NextRequest,
   { params }: { params: Promise<{ planId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { planId } = await params;
-  const household = await getHouseholdOrNull();
+  const household = await getHouseholdOrNull(userId);
   if (!household) {
     return NextResponse.json({ error: "Kein Haushalt vorhanden." }, { status: 400 });
   }
 
-  const plan = await prisma.plan.findUnique({ where: { id: planId }, include: planInclude });
+  const plan = await getOwnedPlan(planId, userId);
   if (!plan) {
     return NextResponse.json({ error: "Plan nicht gefunden." }, { status: 404 });
   }
@@ -29,7 +34,15 @@ export async function DELETE(
   _request: NextRequest,
   { params }: { params: Promise<{ planId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { planId } = await params;
-  await prisma.plan.delete({ where: { id: planId } });
+  const plan = await prisma.plan.findFirst({ where: { id: planId, household: { userId } } });
+  if (!plan) {
+    return NextResponse.json({ error: "Plan nicht gefunden." }, { status: 404 });
+  }
+  await prisma.plan.delete({ where: { id: plan.id } });
   return NextResponse.json({ ok: true });
 }

src/app/api/plans/[planId]/scenario/route.ts

@@ -1,7 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { prisma } from "@/lib/db";
-import { phaseInclude, planInclude } from "@/lib/queries";
+import { phaseInclude, getOwnedPlan } from "@/lib/queries";
+import { getCurrentUserId } from "@/lib/session";
 
 const scenarioSchema = z.object({
   name: z.string().min(1).max(120),
@@ -15,6 +16,10 @@ export async function POST(
   request: NextRequest,
   { params }: { params: Promise<{ planId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { planId } = await params;
   const body = await request.json();
   const parsed = scenarioSchema.safeParse(body);
@@ -22,7 +27,7 @@ export async function POST(
     return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
   }
 
-  const sourcePlan = await prisma.plan.findUnique({ where: { id: planId }, include: planInclude });
+  const sourcePlan = await getOwnedPlan(planId, userId);
   if (!sourcePlan) {
     return NextResponse.json({ error: "Ursprungsplan nicht gefunden." }, { status: 404 });
   }

src/app/api/plans/route.ts

@@ -2,13 +2,18 @@ import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { prisma } from "@/lib/db";
 import { getHouseholdOrNull } from "@/lib/queries";
+import { getCurrentUserId } from "@/lib/session";
 
 const createPlanSchema = z.object({
   name: z.string().min(1).max(120),
 });
 
 export async function GET() {
-  const household = await getHouseholdOrNull();
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
+  const household = await getHouseholdOrNull(userId);
   if (!household) {
     return NextResponse.json({ plans: [] });
   }
@@ -31,7 +36,11 @@ export async function GET() {
 }
 
 export async function POST(request: NextRequest) {
-  const household = await getHouseholdOrNull();
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
+  const household = await getHouseholdOrNull(userId);
   if (!household) {
     return NextResponse.json(
       { error: "Bitte zuerst das Grundprofil (Onboarding) anlegen." },