allow update for uploaded routes and implement creator id for routes

src/services/routes-service.js

@@ -50,6 +50,7 @@ function rowToRoute(row, includeDeleted = false, parsed = null) {
   return {
     id: row.id,
     slug: row.slug,
+    creator_id: row.creator_id,
     name: row.name,
     description: row.description,
     schoolName: row.school_name,
@@ -170,6 +171,10 @@ export function createRoute(db, fields, gpxFile) {
   if (!gpxFile) throw new HttpError(400, 'Eine GPX-Datei ist erforderlich.');
   let routeId;
   try {
+    const creatorId = fields.creator_id || null;
+    if (creatorId !== null && (typeof creatorId !== 'string' || !/^[a-f0-9]{64}$/.test(creatorId))) {
+      throw new HttpError(400, 'Ungültige Erstellerkennung.');
+    }
     const parsed = parseGpx(fs.readFileSync(gpxFile.path, 'utf8'));
     const name = String(fields.name || parsed.name || '').trim();
     if (!name) throw new HttpError(400, 'Ein Streckenname ist erforderlich.');
@@ -177,8 +182,8 @@ export function createRoute(db, fields, gpxFile) {
       const slug = uniqueSlug(db, fields.slug || name);
       const metrics = parsed.metrics;
       const result = db.prepare(`INSERT INTO routes
-        (slug, name, description, school_name, gpx_path, min_lat, min_lon, max_lat, max_lon)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
+        (slug, name, description, school_name, gpx_path, min_lat, min_lon, max_lat, max_lon, creator_id)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
         slug,
         name,
         fields.description || '',
@@ -187,7 +192,8 @@ export function createRoute(db, fields, gpxFile) {
         metrics.minLat,
         metrics.minLon,
         metrics.maxLat,
-        metrics.maxLon
+        metrics.maxLon,
+        creatorId
       );
       const id = Number(result.lastInsertRowid);
       return id;
@@ -207,13 +213,20 @@ export function createRoute(db, fields, gpxFile) {
 export function updateRoute(db, id, fields, gpxFile) {
   const existing = db.prepare("SELECT * FROM routes WHERE id = ? AND status = 'active'").get(id);
   if (!existing) throw new HttpError(404, 'Strecke nicht gefunden.');
+  if (fields.creator_id != null && (typeof fields.creator_id !== 'string' || !/^[a-f0-9]{64}$/.test(fields.creator_id))) {
+    throw new HttpError(400, 'Ungültige Erstellerkennung.');
+  }
+  if (existing.creator_id && fields.creator_id != null && fields.creator_id !== existing.creator_id) {
+    throw new HttpError(409, 'Die Erstellerzuordnung kann nicht geändert werden.');
+  }
   const parsed = gpxFile ? parseGpx(fs.readFileSync(gpxFile.path, 'utf8')) : null;
   transaction(db, () => {
-    db.prepare(`UPDATE routes SET name = ?, description = ?, school_name = ?, updated_at = CURRENT_TIMESTAMP
+    db.prepare(`UPDATE routes SET name = ?, description = ?, school_name = ?, creator_id = ?, updated_at = CURRENT_TIMESTAMP
       WHERE id = ?`).run(
       fields.name ?? existing.name,
       fields.description ?? existing.description,
       fields.schoolName ?? existing.school_name,
+      existing.creator_id || fields.creator_id || null,
       id
     );
   });