u

README.md

@@ -12,12 +12,14 @@ const client = await new LibDashStore(pool); // runs initialize() (ensure schema
 
 SQL lives in `src/sql/<table>.js`. Schema DDL: `src/schema.js` / `import 'libdashstore/schema'`.
 
-ID fields in the JS API use camelCase `…Id` (DB columns stay snake_case).
+ID fields in the JS API use camelCase `…Id` (DB columns stay snake_case). `googleAuthId` is always `google_auth.id` (the logged-in user), not `companyuser.id`.
 
 ---
 
 ## Schema
 
+**Kein Migrations-Code:** Wir gehen von einer frischen DB aus (`npm run reset-db`). Schema nur in `src/schema.js`; Anpassungen an einer laufenden DB manuell per `sqlcmd`, nicht im Repo.
+
 | Method | Description |
 | --- | --- |
 | `initialize()` | Runs all `SCHEMA_SCRIPTS` (`IF NOT EXISTS`). Does **not** purge. |
@@ -29,10 +31,10 @@ ID fields in the JS API use camelCase `…Id` (DB columns stay snake_case).
 
 | Method | Signature | Returns |
 | --- | --- | --- |
-| `create` | `({ iso639, name, taxrate, reducedtaxrate, authId })` | `{ id, rootCategoryId, languageId, taxrateId, reducedtaxrateId, taxfreerateId }` |
+| `create` | `({ iso639, name, taxrate, reducedtaxrate, googleAuthId })` | `{ id, rootCategoryId, languageId, taxrateId, reducedtaxrateId, taxfreerateId }` |
 | `update` | `(id, { iso639, name, taxrate, reducedtaxrate })` | `{ id, rootCategoryId, languageId, taxrateId, reducedtaxrateId, taxfreerateId }` |
 | `delete` | `(companyId)` | `void` |
-| `list` | `(authId)` | `{ id, name, rootCategoryId, languageId, taxrate, reducedtaxrate, taxfreerate }[]` |
+| `list` | `(googleAuthId)` | `{ id, name, rootCategoryId, languageId, taxrate, reducedtaxrate, taxfreerate }[]` |
 
 ### `create` (transaction)
 
@@ -43,11 +45,13 @@ For `POST /api/company`:
 3. Ensures tax rows for `taxrate`, `reducedtaxrate`, and `0` → `taxfreerateId`
 4. Creates root category (`parentId = null`)
 5. Inserts company with all FKs set
-6. Links creator as `companyuser` (`authId` → `company_id`)
+6. Links creator as `companyuser` (`googleAuthId` → `company_id`)
+
+`company.poscustomergroup_id` (optional) points at the `customergroup` used for POS pricing in `getTreeForCompany` articles.
 
 ### `list`
 
-Returns only companies where `authId` has a `companyuser` row.
+Returns only companies where `googleAuthId` has a `companyuser` row.
 
 ### `update` (transaction)
 
@@ -68,13 +72,13 @@ For `PATCH /api/company/:id`:
 | `getByEmail` | `(email)` | `{ id, email, createdAt, selectedCompanyId } \| undefined` |
 | `listAllowedEmails` | `()` | `{ id, email, createdAt, selectedCompanyId }[]` |
 | `removeAllowedEmail` | `(email)` | `void` |
-| `setSelectedCompany` | `(authId, companyId)` | `void` |
+| `setSelectedCompany` | `(googleAuthId, companyId)` | `void` |
 
 Backend mapping:
 
 - Login: `getByEmail(email)`
 - CLI user manager: `listAllowedEmails()` / `removeAllowedEmail(email)` / `add(email)`
-- `PUT /api/auth/selected-company`: `setSelectedCompany(authId, companyId)`
+- `PUT /api/auth/selected-company`: `setSelectedCompany(googleAuthId, companyId)`
 
 ---
 
@@ -82,7 +86,7 @@ Backend mapping:
 
 | Method | Signature | Returns |
 | --- | --- | --- |
-| `add` | `(companyId, authId)` | `id` |
+| `add` | `(companyId, googleAuthId)` | `id` |
 | `getByEmail` | `(email)` | `id[]` |
 | `delete` | `(id)` | `void` |
 
@@ -115,15 +119,21 @@ Backend mapping:
 
 | Method | Signature | Returns |
 | --- | --- | --- |
-| `create` | `({ parentId, sort })` | `id` |
+| `createUnderParent` | `({ googleAuthId, parentId, name })` | `{ id, parentId, sort, name }` |
 | `updateParentId` | `(id, parentId)` | `void` |
 | `delete` | `(id)` | `void` — blocked by FK if `categoryarticle` (or child categories) still reference it |
-| `getTree` | `(rootId)` | `{ id, parentId, sort }[]` |
-| `getTreeForCompany` | `(authId, companyId)` | `{ id, parentId, sort }[]` — membership check + company root |
+| `getTreeForCompany` | `(googleAuthId, companyId)` | `{ languageId, tree, articles }` |
 
-`getTreeForCompany` throws `Not authorized` if `authId` is not a `companyuser` of `companyId`, and `Company not found` if the company is missing or has no `root_category_id`. Reuses `GET_TREE` after access check.
+### `createUnderParent` (transaction)
 
-`getTree(rootId)` stays for low-level use (tests, internal) when the root id is already known.
+1. `parentId` exists, else `Parent not found`
+2. Walk ancestors to root; find `company` with `root_category_id` = root
+3. `companyuser` for `(googleAuthId, companyId)`, else `Not authorized`
+4. Insert `category` (next sibling `sort`) + `categorytext` (`name`, slugified `slug`, company default language)
+
+`resolveCategoryAccess(googleAuthId, categoryId)` is internal — reusable for future update/delete/move.
+
+`getTreeForCompany` throws `Not authorized` if `googleAuthId` is not a `companyuser` of `companyId`, and `Company not found` if the company is missing, has no `root_category_id`, or no `default_language_id`.
 
 ---
 
@@ -131,12 +141,13 @@ Backend mapping:
 
 | Route | Store call |
 | --- | --- |
-| `POST /api/company` | `company.create({ iso639, name, taxrate, reducedtaxrate, authId })` |
-| `GET /api/company` | `company.list(authId)` |
+| `POST /api/company` | `company.create({ iso639, name, taxrate, reducedtaxrate, googleAuthId })` |
+| `GET /api/company` | `company.list(googleAuthId)` |
 | `PATCH /api/company/:id` | `company.update(id, { iso639, name, taxrate, reducedtaxrate })` |
 | `DELETE /api/company/:id` | `company.delete(id)` |
-| `PUT /api/auth/selected-company` | `google_auth.setSelectedCompany(authId, companyId)` |
-| `GET /api/category/tree?companyId=` | `category.getTreeForCompany(authId, companyId)` |
+| `PUT /api/auth/selected-company` | `google_auth.setSelectedCompany(googleAuthId, companyId)` |
+| `GET /api/category/tree?companyId=` | `category.getTreeForCompany(googleAuthId, companyId)` |
+| `POST /api/category` | `category.createUnderParent({ googleAuthId, parentId, name })` |
 
 ---