feat: ST-501-ST-506 M5 todo-lijst en rolbeheer

- Todo-lijst met snelle invoer via Enter (ST-501)
- Todo afvinken met visuele doorstreping (ST-502)
- Archiveer afgeronde todos (ST-503)
- Promoveer todo naar PBI met product en prioriteit keuze (ST-504)
- Promoveer todo naar story met product, PBI en prioriteit keuze (ST-505)
- Rolbeheer in instellingen: Product Owner, Scrum Master, Developer (ST-506)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

actions/todos.ts

@@ -0,0 +1,166 @@
+'use server'
+
+import { revalidatePath } from 'next/cache'
+import { cookies } from 'next/headers'
+import { getIronSession } from 'iron-session'
+import { z } from 'zod'
+import { prisma } from '@/lib/prisma'
+import { SessionData, sessionOptions } from '@/lib/session'
+
+async function getSession() {
+  return getIronSession<SessionData>(await cookies(), sessionOptions)
+}
+
+export async function createTodoAction(_prevState: unknown, formData: FormData) {
+  const session = await getSession()
+  if (!session.userId) return { error: 'Niet ingelogd' }
+
+  const title = (formData.get('title') as string)?.trim()
+  if (!title) return { error: 'Titel is verplicht' }
+
+  await prisma.todo.create({ data: { user_id: session.userId, title } })
+  revalidatePath('/todos')
+  return { success: true }
+}
+
+export async function toggleTodoAction(id: string, done: boolean) {
+  const session = await getSession()
+  if (!session.userId) return { error: 'Niet ingelogd' }
+
+  const todo = await prisma.todo.findFirst({ where: { id, user_id: session.userId } })
+  if (!todo) return { error: 'Todo niet gevonden' }
+
+  await prisma.todo.update({ where: { id }, data: { done } })
+  revalidatePath('/todos')
+  return { success: true }
+}
+
+export async function archiveCompletedTodosAction() {
+  const session = await getSession()
+  if (!session.userId) return { error: 'Niet ingelogd' }
+
+  await prisma.todo.updateMany({
+    where: { user_id: session.userId, done: true, archived: false },
+    data: { archived: true },
+  })
+  revalidatePath('/todos')
+  return { success: true }
+}
+
+const promotePbiSchema = z.object({
+  todoId: z.string(),
+  productId: z.string(),
+  title: z.string().min(1).max(200),
+  priority: z.coerce.number().int().min(1).max(4),
+})
+
+export async function promoteTodoToPbiAction(_prevState: unknown, formData: FormData) {
+  const session = await getSession()
+  if (!session.userId) return { error: 'Niet ingelogd' }
+  if (session.isDemo) return { error: 'Niet beschikbaar in demo-modus' }
+
+  const parsed = promotePbiSchema.safeParse({
+    todoId: formData.get('todoId'),
+    productId: formData.get('productId'),
+    title: formData.get('title'),
+    priority: formData.get('priority'),
+  })
+  if (!parsed.success) return { error: parsed.error.flatten().fieldErrors }
+
+  const product = await prisma.product.findFirst({
+    where: { id: parsed.data.productId, user_id: session.userId },
+  })
+  if (!product) return { error: 'Product niet gevonden' }
+
+  const last = await prisma.pbi.findFirst({
+    where: { product_id: parsed.data.productId, priority: parsed.data.priority },
+    orderBy: { sort_order: 'desc' },
+  })
+
+  await prisma.$transaction([
+    prisma.pbi.create({
+      data: {
+        product_id: parsed.data.productId,
+        title: parsed.data.title,
+        priority: parsed.data.priority,
+        sort_order: (last?.sort_order ?? 0) + 1.0,
+      },
+    }),
+    prisma.todo.delete({ where: { id: parsed.data.todoId } }),
+  ])
+
+  revalidatePath('/todos')
+  revalidatePath(`/products/${parsed.data.productId}`)
+  return { success: true }
+}
+
+const promoteStorySchema = z.object({
+  todoId: z.string(),
+  productId: z.string(),
+  pbiId: z.string(),
+  title: z.string().min(1).max(200),
+  priority: z.coerce.number().int().min(1).max(4),
+})
+
+export async function promoteTodoToStoryAction(_prevState: unknown, formData: FormData) {
+  const session = await getSession()
+  if (!session.userId) return { error: 'Niet ingelogd' }
+  if (session.isDemo) return { error: 'Niet beschikbaar in demo-modus' }
+
+  const parsed = promoteStorySchema.safeParse({
+    todoId: formData.get('todoId'),
+    productId: formData.get('productId'),
+    pbiId: formData.get('pbiId'),
+    title: formData.get('title'),
+    priority: formData.get('priority'),
+  })
+  if (!parsed.success) return { error: parsed.error.flatten().fieldErrors }
+
+  const pbi = await prisma.pbi.findFirst({
+    where: { id: parsed.data.pbiId, product: { user_id: session.userId } },
+  })
+  if (!pbi) return { error: 'PBI niet gevonden' }
+
+  const last = await prisma.story.findFirst({
+    where: { pbi_id: parsed.data.pbiId, priority: parsed.data.priority },
+    orderBy: { sort_order: 'desc' },
+  })
+
+  await prisma.$transaction([
+    prisma.story.create({
+      data: {
+        pbi_id: parsed.data.pbiId,
+        product_id: parsed.data.productId,
+        title: parsed.data.title,
+        priority: parsed.data.priority,
+        sort_order: (last?.sort_order ?? 0) + 1.0,
+        status: 'OPEN',
+      },
+    }),
+    prisma.todo.delete({ where: { id: parsed.data.todoId } }),
+  ])
+
+  revalidatePath('/todos')
+  revalidatePath(`/products/${parsed.data.productId}`)
+  return { success: true }
+}
+
+export async function updateRolesAction(roles: string[]) {
+  const session = await getSession()
+  if (!session.userId) return { error: 'Niet ingelogd' }
+  if (session.isDemo) return { error: 'Niet beschikbaar in demo-modus' }
+
+  const validRoles = ['PRODUCT_OWNER', 'SCRUM_MASTER', 'DEVELOPER']
+  const filtered = roles.filter(r => validRoles.includes(r))
+  if (filtered.length === 0) return { error: 'Minimaal één rol is verplicht' }
+
+  await prisma.$transaction([
+    prisma.userRole.deleteMany({ where: { user_id: session.userId } }),
+    prisma.userRole.createMany({
+      data: filtered.map(role => ({ user_id: session.userId, role: role as 'PRODUCT_OWNER' | 'SCRUM_MASTER' | 'DEVELOPER' })),
+    }),
+  ])
+
+  revalidatePath('/settings')
+  return { success: true }
+}