Major rework: multi-user accounts (register/login, per-user data isolation), new layout with sidebar/dashboard/profile menu, matrix phase view with collapsible category columns, life timeline with ages per phase, live budget capping, collapsible transitions, mobile support

src/app/api/plans/[planId]/export/route.ts

@@ -1,19 +1,23 @@
 import { NextRequest, NextResponse } from "next/server";
-import { prisma } from "@/lib/db";
-import { planInclude, toHouseholdInput, toPlanInput, getHouseholdOrNull } from "@/lib/queries";
+import { toHouseholdInput, toPlanInput, getHouseholdOrNull, getOwnedPlan } from "@/lib/queries";
+import { getCurrentUserId } from "@/lib/session";
 import { computePlan, planToCsv } from "@/lib/calculations";
 
 export async function GET(
   _request: NextRequest,
   { params }: { params: Promise<{ planId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { planId } = await params;
-  const household = await getHouseholdOrNull();
+  const household = await getHouseholdOrNull(userId);
   if (!household) {
     return NextResponse.json({ error: "Kein Haushalt vorhanden." }, { status: 400 });
   }
 
-  const plan = await prisma.plan.findUnique({ where: { id: planId }, include: planInclude });
+  const plan = await getOwnedPlan(planId, userId);
   if (!plan) {
     return NextResponse.json({ error: "Plan nicht gefunden." }, { status: 404 });
   }

src/app/api/plans/[planId]/phases/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { prisma } from "@/lib/db";
 import { phaseInclude } from "@/lib/queries";
+import { getCurrentUserId } from "@/lib/session";
 
 const createPhaseSchema = z.object({
   name: z.string().min(1).max(120),
@@ -16,6 +17,10 @@ export async function POST(
   request: NextRequest,
   { params }: { params: Promise<{ planId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { planId } = await params;
   const body = await request.json();
   const parsed = createPhaseSchema.safeParse(body);
@@ -23,7 +28,7 @@ export async function POST(
     return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
   }
 
-  const plan = await prisma.plan.findUnique({ where: { id: planId } });
+  const plan = await prisma.plan.findFirst({ where: { id: planId, household: { userId } } });
   if (!plan) {
     return NextResponse.json({ error: "Plan nicht gefunden." }, { status: 404 });
   }

src/app/api/plans/[planId]/route.ts

@@ -1,19 +1,24 @@
 import { NextRequest, NextResponse } from "next/server";
 import { prisma } from "@/lib/db";
-import { planInclude, toHouseholdInput, toPlanInput, getHouseholdOrNull } from "@/lib/queries";
+import { toHouseholdInput, toPlanInput, getHouseholdOrNull, getOwnedPlan } from "@/lib/queries";
+import { getCurrentUserId } from "@/lib/session";
 import { computePlan } from "@/lib/calculations";
 
 export async function GET(
   _request: NextRequest,
   { params }: { params: Promise<{ planId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { planId } = await params;
-  const household = await getHouseholdOrNull();
+  const household = await getHouseholdOrNull(userId);
   if (!household) {
     return NextResponse.json({ error: "Kein Haushalt vorhanden." }, { status: 400 });
   }
 
-  const plan = await prisma.plan.findUnique({ where: { id: planId }, include: planInclude });
+  const plan = await getOwnedPlan(planId, userId);
   if (!plan) {
     return NextResponse.json({ error: "Plan nicht gefunden." }, { status: 404 });
   }
@@ -29,7 +34,15 @@ export async function DELETE(
   _request: NextRequest,
   { params }: { params: Promise<{ planId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { planId } = await params;
-  await prisma.plan.delete({ where: { id: planId } });
+  const plan = await prisma.plan.findFirst({ where: { id: planId, household: { userId } } });
+  if (!plan) {
+    return NextResponse.json({ error: "Plan nicht gefunden." }, { status: 404 });
+  }
+  await prisma.plan.delete({ where: { id: plan.id } });
   return NextResponse.json({ ok: true });
 }

src/app/api/plans/[planId]/scenario/route.ts

@@ -1,7 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { prisma } from "@/lib/db";
-import { phaseInclude, planInclude } from "@/lib/queries";
+import { phaseInclude, getOwnedPlan } from "@/lib/queries";
+import { getCurrentUserId } from "@/lib/session";
 
 const scenarioSchema = z.object({
   name: z.string().min(1).max(120),
@@ -15,6 +16,10 @@ export async function POST(
   request: NextRequest,
   { params }: { params: Promise<{ planId: string }> }
 ) {
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
   const { planId } = await params;
   const body = await request.json();
   const parsed = scenarioSchema.safeParse(body);
@@ -22,7 +27,7 @@ export async function POST(
     return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
   }
 
-  const sourcePlan = await prisma.plan.findUnique({ where: { id: planId }, include: planInclude });
+  const sourcePlan = await getOwnedPlan(planId, userId);
   if (!sourcePlan) {
     return NextResponse.json({ error: "Ursprungsplan nicht gefunden." }, { status: 404 });
   }

src/app/api/plans/route.ts

@@ -2,13 +2,18 @@ import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { prisma } from "@/lib/db";
 import { getHouseholdOrNull } from "@/lib/queries";
+import { getCurrentUserId } from "@/lib/session";
 
 const createPlanSchema = z.object({
   name: z.string().min(1).max(120),
 });
 
 export async function GET() {
-  const household = await getHouseholdOrNull();
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
+  const household = await getHouseholdOrNull(userId);
   if (!household) {
     return NextResponse.json({ plans: [] });
   }
@@ -31,7 +36,11 @@ export async function GET() {
 }
 
 export async function POST(request: NextRequest) {
-  const household = await getHouseholdOrNull();
+  const userId = await getCurrentUserId();
+  if (!userId) {
+    return NextResponse.json({ error: "Nicht authentifiziert." }, { status: 401 });
+  }
+  const household = await getHouseholdOrNull(userId);
   if (!household) {
     return NextResponse.json(
       { error: "Bitte zuerst das Grundprofil (Onboarding) anlegen." },