Major rework: multi-user accounts (register/login, per-user data isolation), new layout with sidebar/dashboard/profile menu, matrix phase view with collapsible category columns, life timeline with ages per phase, live budget capping, collapsible transitions, mobile support

src/app/api/phases/[phaseId]/route.ts

@@ -1,7 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { prisma } from "@/lib/db";
-import { phaseInclude } from "@/lib/queries";
+import { phaseInclude, getOwnedPhase } from "@/lib/queries";
+import { getCurrentUserId } from "@/lib/session";
 
 const incomeEntrySchema = z.object({
   personId: z.string().nullable().optional(),
@@ -61,6 +62,10 @@ export async function PUT(
   request: NextRequest,
   { params }: { params: Promise<{ phaseId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { phaseId } = await params;
   const body = await request.json();
   const parsed = updatePhaseSchema.safeParse(body);
@@ -69,7 +74,7 @@ export async function PUT(
   }
   const data = parsed.data;
 
-  const existing = await prisma.phase.findUnique({ where: { id: phaseId } });
+  const existing = await getOwnedPhase(phaseId, userId);
   if (!existing) {
     return NextResponse.json({ error: "Phase nicht gefunden." }, { status: 404 });
   }
@@ -111,8 +116,12 @@ export async function DELETE(
   _request: NextRequest,
   { params }: { params: Promise<{ phaseId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { phaseId } = await params;
-  const phase = await prisma.phase.findUnique({ where: { id: phaseId } });
+  const phase = await getOwnedPhase(phaseId, userId);
   if (!phase) {
     return NextResponse.json({ error: "Phase nicht gefunden." }, { status: 404 });
   }

src/app/api/phases/[phaseId]/transition/route.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { prisma } from "@/lib/db";
 import { computeMortgageYearly, computeSecurityYearlyValues } from "@/lib/calculations";
 import { floorToThousand } from "@/lib/format";
+import { getCurrentUserId } from "@/lib/session";
 
 const transitionItemSchema = z.object({
   positionType: z.enum(["SECURITY", "REAL_ESTATE"]),
@@ -25,9 +26,13 @@ export async function GET(
   _request: NextRequest,
   { params }: { params: Promise<{ phaseId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { phaseId } = await params;
-  const phase = await prisma.phase.findUnique({
-    where: { id: phaseId },
+  const phase = await prisma.phase.findFirst({
+    where: { id: phaseId, plan: { household: { userId } } },
     include: { securities: true, realEstates: true },
   });
   if (!phase) {
@@ -61,6 +66,10 @@ export async function PUT(
   request: NextRequest,
   { params }: { params: Promise<{ phaseId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { phaseId } = await params;
   const body = await request.json();
   const parsed = putTransitionSchema.safeParse(body);
@@ -68,8 +77,8 @@ export async function PUT(
     return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
   }
 
-  const phase = await prisma.phase.findUnique({
-    where: { id: phaseId },
+  const phase = await prisma.phase.findFirst({
+    where: { id: phaseId, plan: { household: { userId } } },
     include: { securities: true, realEstates: true },
   });
   if (!phase) {