Auth v2: Register/Login/Profile, Households, per-user Favorites/Notes/Shopping, Frontend Auth Pages

2026-02-18 15:47:13 +00:00
parent b0bd3e533f
commit 30e44370a1
32 changed files with 3561 additions and 113 deletions
--- a/backend/src/services/auth.service.ts
+++ b/backend/src/services/auth.service.ts
@@ -0,0 +1,200 @@
+import bcrypt from 'bcrypt';
+import jwt from 'jsonwebtoken';
+import { ulid } from 'ulid';
+import { getDb } from '../db/connection.js';
+
+const JWT_SECRET = process.env.JWT_SECRET || 'your-super-secret-jwt-key-change-in-production';
+const JWT_REFRESH_SECRET = process.env.JWT_REFRESH_SECRET || 'your-super-secret-refresh-key-change-in-production';
+
+const BCRYPT_ROUNDS = 12;
+const ACCESS_TOKEN_EXPIRES_IN = '15m';
+const REFRESH_TOKEN_EXPIRES_IN = '7d';
+
+export interface User {
+  id: string;
+  email: string;
+  display_name: string;
+  avatar_url?: string;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface AuthTokens {
+  accessToken: string;
+  refreshToken: string;
+}
+
+export interface AuthResult {
+  user: User;
+  tokens: AuthTokens;
+}
+
+class AuthService {
+  private db = getDb();
+
+  async register(email: string, password: string, displayName: string): Promise<AuthResult> {
+    // Check if user already exists
+    const existingUser = this.db.prepare('SELECT id FROM users WHERE email = ?').get(email);
+    if (existingUser) {
+      throw new Error('EMAIL_EXISTS');
+    }
+
+    // Hash password
+    const passwordHash = await bcrypt.hash(password, BCRYPT_ROUNDS);
+
+    // Create user
+    const userId = ulid();
+    const now = new Date().toISOString();
+    
+    this.db.prepare(`
+      INSERT INTO users (id, email, password_hash, display_name, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?)
+    `).run(userId, email, passwordHash, displayName, now, now);
+
+    // Get created user
+    const user = this.db.prepare(`
+      SELECT id, email, display_name, avatar_url, created_at, updated_at 
+      FROM users WHERE id = ?
+    `).get(userId) as User;
+
+    // Generate tokens
+    const tokens = this.generateTokens(user);
+
+    return { user, tokens };
+  }
+
+  async login(email: string, password: string): Promise<AuthResult> {
+    // Get user by email
+    const userWithPassword = this.db.prepare(`
+      SELECT id, email, password_hash, display_name, avatar_url, created_at, updated_at
+      FROM users WHERE email = ?
+    `).get(email) as any;
+
+    if (!userWithPassword) {
+      throw new Error('INVALID_CREDENTIALS');
+    }
+
+    // Check password
+    const passwordValid = await bcrypt.compare(password, userWithPassword.password_hash);
+    if (!passwordValid) {
+      throw new Error('INVALID_CREDENTIALS');
+    }
+
+    // Remove password from user object
+    const { password_hash, ...user } = userWithPassword;
+
+    // Generate tokens
+    const tokens = this.generateTokens(user);
+
+    return { user, tokens };
+  }
+
+  async getProfile(userId: string): Promise<User | null> {
+    const user = this.db.prepare(`
+      SELECT id, email, display_name, avatar_url, created_at, updated_at 
+      FROM users WHERE id = ?
+    `).get(userId) as User | undefined;
+
+    return user || null;
+  }
+
+  async updateProfile(userId: string, data: { display_name?: string; avatar_url?: string }): Promise<User> {
+    const updates: string[] = [];
+    const values: any[] = [];
+
+    if (data.display_name !== undefined) {
+      updates.push('display_name = ?');
+      values.push(data.display_name);
+    }
+
+    if (data.avatar_url !== undefined) {
+      updates.push('avatar_url = ?');
+      values.push(data.avatar_url);
+    }
+
+    if (updates.length === 0) {
+      throw new Error('NO_UPDATES_PROVIDED');
+    }
+
+    updates.push('updated_at = ?');
+    values.push(new Date().toISOString());
+    values.push(userId);
+
+    this.db.prepare(`
+      UPDATE users SET ${updates.join(', ')} WHERE id = ?
+    `).run(...values);
+
+    const user = await this.getProfile(userId);
+    if (!user) {
+      throw new Error('USER_NOT_FOUND');
+    }
+
+    return user;
+  }
+
+  async changePassword(userId: string, currentPassword: string, newPassword: string): Promise<boolean> {
+    // Get current password hash
+    const userWithPassword = this.db.prepare(`
+      SELECT password_hash FROM users WHERE id = ?
+    `).get(userId) as any;
+
+    if (!userWithPassword) {
+      throw new Error('USER_NOT_FOUND');
+    }
+
+    // Verify current password
+    const currentPasswordValid = await bcrypt.compare(currentPassword, userWithPassword.password_hash);
+    if (!currentPasswordValid) {
+      throw new Error('INVALID_CURRENT_PASSWORD');
+    }
+
+    // Hash new password
+    const newPasswordHash = await bcrypt.hash(newPassword, BCRYPT_ROUNDS);
+
+    // Update password
+    this.db.prepare(`
+      UPDATE users SET password_hash = ?, updated_at = ? WHERE id = ?
+    `).run(newPasswordHash, new Date().toISOString(), userId);
+
+    return true;
+  }
+
+  async refreshTokens(refreshToken: string): Promise<AuthResult> {
+    try {
+      const decoded = jwt.verify(refreshToken, JWT_REFRESH_SECRET) as any;
+      const user = await this.getProfile(decoded.sub);
+      
+      if (!user) {
+        throw new Error('USER_NOT_FOUND');
+      }
+
+      const tokens = this.generateTokens(user);
+      return { user, tokens };
+    } catch (error) {
+      throw new Error('INVALID_REFRESH_TOKEN');
+    }
+  }
+
+  verifyAccessToken(token: string): any {
+    try {
+      return jwt.verify(token, JWT_SECRET);
+    } catch (error) {
+      throw new Error('INVALID_ACCESS_TOKEN');
+    }
+  }
+
+  private generateTokens(user: User): AuthTokens {
+    const payload = {
+      sub: user.id,
+      email: user.email,
+      display_name: user.display_name,
+    };
+
+    const accessToken = jwt.sign(payload, JWT_SECRET, { expiresIn: ACCESS_TOKEN_EXPIRES_IN });
+    const refreshToken = jwt.sign({ sub: user.id }, JWT_REFRESH_SECRET, { expiresIn: REFRESH_TOKEN_EXPIRES_IN });
+
+    return { accessToken, refreshToken };
+  }
+}
+
+export const authService = new AuthService();
--- a/backend/src/services/household.service.ts
+++ b/backend/src/services/household.service.ts
@@ -0,0 +1,218 @@
+import { ulid } from 'ulid';
+import { getDb } from '../db/connection.js';
+
+export interface Household {
+  id: string;
+  name: string;
+  invite_code: string;
+  created_at: string;
+}
+
+export interface HouseholdMember {
+  user_id: string;
+  email: string;
+  display_name: string;
+  avatar_url?: string;
+  role: 'owner' | 'member';
+  joined_at: string;
+}
+
+export interface HouseholdWithMembers extends Household {
+  members: HouseholdMember[];
+}
+
+class HouseholdService {
+  private db = getDb();
+
+  // Generate a random 8-character invite code
+  private generateInviteCode(): string {
+    const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
+    let result = '';
+    for (let i = 0; i < 8; i++) {
+      result += chars.charAt(Math.floor(Math.random() * chars.length));
+    }
+    return result;
+  }
+
+  // Ensure invite code is unique
+  private generateUniqueInviteCode(): string {
+    let code: string;
+    let attempts = 0;
+    do {
+      code = this.generateInviteCode();
+      attempts++;
+      if (attempts > 100) {
+        throw new Error('Could not generate unique invite code');
+      }
+    } while (this.db.prepare('SELECT id FROM households WHERE invite_code = ?').get(code));
+    
+    return code;
+  }
+
+  async createHousehold(userId: string, name: string): Promise<HouseholdWithMembers> {
+    // Check if user is already in a household
+    const existingMembership = this.db.prepare(`
+      SELECT household_id FROM household_members WHERE user_id = ?
+    `).get(userId);
+
+    if (existingMembership) {
+      throw new Error('USER_ALREADY_IN_HOUSEHOLD');
+    }
+
+    const householdId = ulid();
+    const inviteCode = this.generateUniqueInviteCode();
+
+    // Create household
+    this.db.prepare(`
+      INSERT INTO households (id, name, invite_code)
+      VALUES (?, ?, ?)
+    `).run(householdId, name, inviteCode);
+
+    // Add user as owner
+    this.db.prepare(`
+      INSERT INTO household_members (household_id, user_id, role)
+      VALUES (?, ?, 'owner')
+    `).run(householdId, userId);
+
+    // Return household with members
+    const household = await this.getMyHousehold(userId);
+    if (!household) {
+      throw new Error('Failed to create household');
+    }
+
+    return household;
+  }
+
+  async joinHousehold(userId: string, inviteCode: string): Promise<HouseholdWithMembers> {
+    // Check if user is already in a household
+    const existingMembership = this.db.prepare(`
+      SELECT household_id FROM household_members WHERE user_id = ?
+    `).get(userId);
+
+    if (existingMembership) {
+      throw new Error('USER_ALREADY_IN_HOUSEHOLD');
+    }
+
+    // Find household by invite code
+    const household = this.db.prepare(`
+      SELECT id FROM households WHERE invite_code = ?
+    `).get(inviteCode) as { id: string } | undefined;
+
+    if (!household) {
+      throw new Error('INVALID_INVITE_CODE');
+    }
+
+    // Add user as member
+    this.db.prepare(`
+      INSERT INTO household_members (household_id, user_id, role)
+      VALUES (?, ?, 'member')
+    `).run(household.id, userId);
+
+    // Return household with members
+    const result = await this.getMyHousehold(userId);
+    if (!result) {
+      throw new Error('Failed to join household');
+    }
+
+    return result;
+  }
+
+  async getMyHousehold(userId: string): Promise<HouseholdWithMembers | null> {
+    // Get user's household
+    const householdMembership = this.db.prepare(`
+      SELECT h.*, hm.role
+      FROM households h
+      JOIN household_members hm ON h.id = hm.household_id
+      WHERE hm.user_id = ?
+    `).get(userId) as (Household & { role: 'owner' | 'member' }) | undefined;
+
+    if (!householdMembership) {
+      return null;
+    }
+
+    // Get all members of the household
+    const members = this.db.prepare(`
+      SELECT 
+        u.id as user_id,
+        u.email,
+        u.display_name,
+        u.avatar_url,
+        hm.role,
+        hm.joined_at
+      FROM household_members hm
+      JOIN users u ON hm.user_id = u.id
+      WHERE hm.household_id = ?
+      ORDER BY hm.role DESC, hm.joined_at ASC
+    `).all(householdMembership.id) as HouseholdMember[];
+
+    const { role, ...household } = householdMembership;
+
+    return {
+      ...household,
+      members
+    };
+  }
+
+  async leaveHousehold(userId: string, householdId: string): Promise<void> {
+    // Check if user is member of this household
+    const membership = this.db.prepare(`
+      SELECT role FROM household_members 
+      WHERE user_id = ? AND household_id = ?
+    `).get(userId, householdId) as { role: string } | undefined;
+
+    if (!membership) {
+      throw new Error('NOT_HOUSEHOLD_MEMBER');
+    }
+
+    // If user is owner, check if there are other members
+    if (membership.role === 'owner') {
+      const memberCount = this.db.prepare(`
+        SELECT COUNT(*) as count FROM household_members WHERE household_id = ?
+      `).get(householdId) as { count: number };
+
+      if (memberCount.count > 1) {
+        throw new Error('OWNER_CANNOT_LEAVE_WITH_MEMBERS');
+      }
+
+      // If owner is the only member, delete the entire household
+      this.db.prepare('DELETE FROM households WHERE id = ?').run(householdId);
+    } else {
+      // Remove member from household
+      this.db.prepare(`
+        DELETE FROM household_members 
+        WHERE user_id = ? AND household_id = ?
+      `).run(userId, householdId);
+    }
+  }
+
+  async regenerateInviteCode(userId: string, householdId: string): Promise<string> {
+    // Check if user is owner of this household
+    const membership = this.db.prepare(`
+      SELECT role FROM household_members 
+      WHERE user_id = ? AND household_id = ?
+    `).get(userId, householdId) as { role: string } | undefined;
+
+    if (!membership || membership.role !== 'owner') {
+      throw new Error('ONLY_OWNER_CAN_REGENERATE_INVITE');
+    }
+
+    const newInviteCode = this.generateUniqueInviteCode();
+
+    this.db.prepare(`
+      UPDATE households SET invite_code = ? WHERE id = ?
+    `).run(newInviteCode, householdId);
+
+    return newInviteCode;
+  }
+
+  async getHouseholdByInviteCode(inviteCode: string): Promise<Household | null> {
+    const household = this.db.prepare(`
+      SELECT id, name, invite_code, created_at
+      FROM households WHERE invite_code = ?
+    `).get(inviteCode) as Household | undefined;
+
+    return household || null;
+  }
+}
+
+export const householdService = new HouseholdService();
--- a/backend/src/services/note.service.ts
+++ b/backend/src/services/note.service.ts
@@ -1,26 +1,64 @@
 import { getDb } from '../db/connection.js';
 import { ulid } from 'ulid';

-export function listNotes(recipeId: string) {
-  return getDb().prepare('SELECT * FROM notes WHERE recipe_id = ? ORDER BY created_at DESC').all(recipeId);
+export function listNotes(recipeId: string, userId?: string) {
+  const db = getDb();
+  
+  if (!userId) {
+    // Legacy: return all notes without user filtering
+    return db.prepare('SELECT * FROM notes WHERE recipe_id = ? AND user_id IS NULL ORDER BY created_at DESC').all(recipeId);
+  }
+  
+  // Return only user's notes
+  return db.prepare('SELECT * FROM notes WHERE recipe_id = ? AND user_id = ? ORDER BY created_at DESC').all(recipeId, userId);
 }

-export function createNote(recipeId: string, content: string) {
+export function createNote(recipeId: string, content: string, userId?: string) {
  const db = getDb();
  const recipe = db.prepare('SELECT id FROM recipes WHERE id = ?').get(recipeId);
  if (!recipe) return null;
+  
  const id = ulid();
-  db.prepare('INSERT INTO notes (id, recipe_id, content) VALUES (?, ?, ?)').run(id, recipeId, content);
+  db.prepare('INSERT INTO notes (id, recipe_id, content, user_id) VALUES (?, ?, ?, ?)').run(id, recipeId, content, userId || null);
  return db.prepare('SELECT * FROM notes WHERE id = ?').get(id);
 }

-export function updateNote(id: string, content: string) {
+export function updateNote(id: string, content: string, userId?: string) {
  const db = getDb();
-  const result = db.prepare('UPDATE notes SET content = ? WHERE id = ?').run(content, id);
+  
+  let query: string;
+  let params: any[];
+  
+  if (!userId) {
+    // Legacy: update notes without user filtering
+    query = 'UPDATE notes SET content = ? WHERE id = ? AND user_id IS NULL';
+    params = [content, id];
+  } else {
+    // Update only if note belongs to user
+    query = 'UPDATE notes SET content = ? WHERE id = ? AND user_id = ?';
+    params = [content, id, userId];
+  }
+  
+  const result = db.prepare(query).run(...params);
  if (result.changes === 0) return null;
  return db.prepare('SELECT * FROM notes WHERE id = ?').get(id);
 }

-export function deleteNote(id: string): boolean {
-  return getDb().prepare('DELETE FROM notes WHERE id = ?').run(id).changes > 0;
+export function deleteNote(id: string, userId?: string): boolean {
+  const db = getDb();
+  
+  let query: string;
+  let params: any[];
+  
+  if (!userId) {
+    // Legacy: delete notes without user filtering
+    query = 'DELETE FROM notes WHERE id = ? AND user_id IS NULL';
+    params = [id];
+  } else {
+    // Delete only if note belongs to user
+    query = 'DELETE FROM notes WHERE id = ? AND user_id = ?';
+    params = [id, userId];
+  }
+  
+  return db.prepare(query).run(...params).changes > 0;
 }
--- a/backend/src/services/recipe.service.ts
+++ b/backend/src/services/recipe.service.ts
@@ -63,7 +63,7 @@ function mapTimeFields(row: any) {

 export function listRecipes(opts: {
  page?: number; limit?: number; category_id?: string; category_slug?: string;
-  favorite?: boolean; difficulty?: string; maxTime?: number;
+  favorite?: boolean; difficulty?: string; maxTime?: number; userId?: string;
 }) {
  const db = getDb();
  const page = opts.page || 1;
@@ -74,15 +74,30 @@ export function listRecipes(opts: {

  if (opts.category_id) { conditions.push('r.category_id = ?'); params.push(opts.category_id); }
  if (opts.category_slug) { conditions.push('c.slug = ?'); params.push(opts.category_slug); }
-  if (opts.favorite !== undefined) { conditions.push('r.is_favorite = ?'); params.push(opts.favorite ? 1 : 0); }
+  if (opts.favorite !== undefined && opts.userId) { 
+    conditions.push('uf.user_id IS ' + (opts.favorite ? 'NOT NULL' : 'NULL')); 
+  }
  if (opts.difficulty) { conditions.push('r.difficulty = ?'); params.push(opts.difficulty); }
  if (opts.maxTime) { conditions.push('r.total_time <= ?'); params.push(opts.maxTime); }

+  let joins = 'LEFT JOIN categories c ON r.category_id = c.id';
+  if (opts.userId) {
+    joins += ' LEFT JOIN user_favorites uf ON r.id = uf.recipe_id AND uf.user_id = ?';
+    params.unshift(opts.userId);
+  }
+
  const where = conditions.length ? 'WHERE ' + conditions.join(' AND ') : '';
-  const countRow = db.prepare(`SELECT COUNT(*) as total FROM recipes r LEFT JOIN categories c ON r.category_id = c.id ${where}`).get(...params) as any;
+  
+  // Adjust parameter positions based on whether userId is included
+  const countParams = opts.userId ? [opts.userId, ...params.slice(1)] : params;
+  const dataParams = opts.userId ? [opts.userId, ...params.slice(1), limit, offset] : [...params, limit, offset];
+
+  const countRow = db.prepare(`SELECT COUNT(*) as total FROM recipes r ${joins} ${where}`).get(...countParams) as any;
  const rows = db.prepare(
-    `SELECT r.*, c.name as category_name, c.slug as category_slug FROM recipes r LEFT JOIN categories c ON r.category_id = c.id ${where} ORDER BY r.created_at DESC LIMIT ? OFFSET ?`
-  ).all(...params, limit, offset);
+    `SELECT r.*, c.name as category_name, c.slug as category_slug, 
+     ${opts.userId ? '(uf.user_id IS NOT NULL) as is_favorite' : 'r.is_favorite'}
+     FROM recipes r ${joins} ${where} ORDER BY r.created_at DESC LIMIT ? OFFSET ?`
+  ).all(...dataParams);

  const data = rows.map(mapTimeFields);
  return { data, total: countRow.total, page, limit, totalPages: Math.ceil(countRow.total / limit) };
@@ -205,13 +220,34 @@ export function deleteRecipe(id: string): boolean {
  return result.changes > 0;
 }

-export function toggleFavorite(id: string) {
+export function toggleFavorite(id: string, userId?: string) {
  const db = getDb();
-  const recipe = db.prepare('SELECT is_favorite FROM recipes WHERE id = ?').get(id) as any;
+  const recipe = db.prepare('SELECT id FROM recipes WHERE id = ?').get(id) as any;
  if (!recipe) return null;
-  const newVal = recipe.is_favorite ? 0 : 1;
-  db.prepare('UPDATE recipes SET is_favorite = ? WHERE id = ?').run(newVal, id);
-  return { id, is_favorite: newVal };
+
+  // If no user authentication, fallback to old is_favorite column
+  if (!userId) {
+    const recipeWithFavorite = db.prepare('SELECT is_favorite FROM recipes WHERE id = ?').get(id) as any;
+    const newVal = recipeWithFavorite.is_favorite ? 0 : 1;
+    db.prepare('UPDATE recipes SET is_favorite = ? WHERE id = ?').run(newVal, id);
+    return { id, is_favorite: newVal };
+  }
+
+  // Check if recipe is already favorited by user
+  const existing = db.prepare(
+    'SELECT id FROM user_favorites WHERE user_id = ? AND recipe_id = ?'
+  ).get(userId, id) as any;
+
+  if (existing) {
+    // Remove from favorites
+    db.prepare('DELETE FROM user_favorites WHERE user_id = ? AND recipe_id = ?').run(userId, id);
+    return { id, is_favorite: false };
+  } else {
+    // Add to favorites
+    const favoriteId = ulid();
+    db.prepare('INSERT INTO user_favorites (id, user_id, recipe_id) VALUES (?, ?, ?)').run(favoriteId, userId, id);
+    return { id, is_favorite: true };
+  }
 }

 export function getRandomRecipe() {
--- a/backend/src/services/shopping.service.ts
+++ b/backend/src/services/shopping.service.ts
@@ -1,14 +1,48 @@
 import { getDb } from '../db/connection.js';
 import { ulid } from 'ulid';

-export function listItems() {
+export type ShoppingScope = 'personal' | 'household';
+
+export function listItems(userId?: string, scope: ShoppingScope = 'personal') {
  const db = getDb();
-  const items = db.prepare(`
-    SELECT si.*, r.title as recipe_title
-    FROM shopping_items si
-    LEFT JOIN recipes r ON si.recipe_id = r.id
-    ORDER BY si.checked, si.created_at DESC
-  `).all() as any[];
+  
+  let query: string;
+  let params: any[];
+
+  if (!userId) {
+    // Legacy: no user authentication, return all items
+    query = `
+      SELECT si.*, r.title as recipe_title
+      FROM shopping_items si
+      LEFT JOIN recipes r ON si.recipe_id = r.id
+      WHERE si.user_id IS NULL AND si.household_id IS NULL
+      ORDER BY si.checked, si.created_at DESC
+    `;
+    params = [];
+  } else if (scope === 'household') {
+    // Get household shopping list
+    query = `
+      SELECT si.*, r.title as recipe_title
+      FROM shopping_items si
+      LEFT JOIN recipes r ON si.recipe_id = r.id
+      LEFT JOIN household_members hm ON si.household_id = hm.household_id
+      WHERE hm.user_id = ? AND si.household_id IS NOT NULL
+      ORDER BY si.checked, si.created_at DESC
+    `;
+    params = [userId];
+  } else {
+    // Get personal shopping list
+    query = `
+      SELECT si.*, r.title as recipe_title
+      FROM shopping_items si
+      LEFT JOIN recipes r ON si.recipe_id = r.id
+      WHERE si.user_id = ? AND si.household_id IS NULL
+      ORDER BY si.checked, si.created_at DESC
+    `;
+    params = [userId];
+  }
+
+  const items = db.prepare(query).all(...params) as any[];

  const grouped: Record<string, any> = {};
  for (const item of items) {
@@ -21,44 +55,183 @@ export function listItems() {
  return Object.values(grouped);
 }

-export function addFromRecipe(recipeId: string) {
+export function addFromRecipe(recipeId: string, userId?: string, scope: ShoppingScope = 'personal') {
  const db = getDb();
  const recipe = db.prepare('SELECT id FROM recipes WHERE id = ?').get(recipeId);
  if (!recipe) return null;
+
  const ingredients = db.prepare('SELECT * FROM ingredients WHERE recipe_id = ?').all(recipeId) as any[];
-  const insert = db.prepare('INSERT INTO shopping_items (id, name, amount, unit, recipe_id) VALUES (?, ?, ?, ?, ?)');
+  
+  let householdId = null;
+  if (userId && scope === 'household') {
+    // Get user's household
+    const membership = db.prepare(`
+      SELECT household_id FROM household_members WHERE user_id = ?
+    `).get(userId) as { household_id: string } | undefined;
+    
+    if (!membership) {
+      throw new Error('USER_NOT_IN_HOUSEHOLD');
+    }
+    householdId = membership.household_id;
+  }
+
+  const insert = db.prepare(`
+    INSERT INTO shopping_items (id, name, amount, unit, recipe_id, user_id, household_id) 
+    VALUES (?, ?, ?, ?, ?, ?, ?)
+  `);
+  
  const added: any[] = [];
  const txn = db.transaction(() => {
    for (const ing of ingredients) {
      const id = ulid();
-      insert.run(id, ing.name, ing.amount, ing.unit, recipeId);
-      added.push({ id, name: ing.name, amount: ing.amount, unit: ing.unit, recipe_id: recipeId, checked: 0 });
+      insert.run(id, ing.name, ing.amount, ing.unit, recipeId, userId || null, householdId);
+      added.push({ 
+        id, 
+        name: ing.name, 
+        amount: ing.amount, 
+        unit: ing.unit, 
+        recipe_id: recipeId, 
+        user_id: userId || null,
+        household_id: householdId,
+        checked: 0 
+      });
    }
  });
  txn();
  return added;
 }

-export function addItem(name: string, amount?: number, unit?: string) {
+export function addItem(name: string, amount?: number, unit?: string, userId?: string, scope: ShoppingScope = 'personal') {
  const db = getDb();
+  
+  let householdId = null;
+  if (userId && scope === 'household') {
+    // Get user's household
+    const membership = db.prepare(`
+      SELECT household_id FROM household_members WHERE user_id = ?
+    `).get(userId) as { household_id: string } | undefined;
+    
+    if (!membership) {
+      throw new Error('USER_NOT_IN_HOUSEHOLD');
+    }
+    householdId = membership.household_id;
+  }
+
  const id = ulid();
-  db.prepare('INSERT INTO shopping_items (id, name, amount, unit) VALUES (?, ?, ?, ?)').run(id, name, amount ?? null, unit ?? null);
+  db.prepare(`
+    INSERT INTO shopping_items (id, name, amount, unit, user_id, household_id) 
+    VALUES (?, ?, ?, ?, ?, ?)
+  `).run(id, name, amount ?? null, unit ?? null, userId || null, householdId);
+  
  return db.prepare('SELECT * FROM shopping_items WHERE id = ?').get(id);
 }

-export function toggleCheck(id: string) {
+export function toggleCheck(id: string, userId?: string) {
  const db = getDb();
-  const item = db.prepare('SELECT * FROM shopping_items WHERE id = ?').get(id) as any;
+  
+  let query: string;
+  let params: any[];
+
+  if (!userId) {
+    // Legacy: no user authentication
+    query = 'SELECT * FROM shopping_items WHERE id = ? AND user_id IS NULL AND household_id IS NULL';
+    params = [id];
+  } else {
+    // Check if item belongs to user (personal) or their household
+    query = `
+      SELECT si.* FROM shopping_items si
+      LEFT JOIN household_members hm ON si.household_id = hm.household_id
+      WHERE si.id = ? AND (si.user_id = ? OR hm.user_id = ?)
+    `;
+    params = [id, userId, userId];
+  }
+
+  const item = db.prepare(query).get(...params) as any;
  if (!item) return null;
+  
  const newVal = item.checked ? 0 : 1;
  db.prepare('UPDATE shopping_items SET checked = ? WHERE id = ?').run(newVal, id);
  return { ...item, checked: newVal };
 }

-export function deleteItem(id: string): boolean {
-  return getDb().prepare('DELETE FROM shopping_items WHERE id = ?').run(id).changes > 0;
+export function deleteItem(id: string, userId?: string): boolean {
+  const db = getDb();
+  
+  let query: string;
+  let params: any[];
+
+  if (!userId) {
+    // Legacy: no user authentication
+    query = 'DELETE FROM shopping_items WHERE id = ? AND user_id IS NULL AND household_id IS NULL';
+    params = [id];
+  } else {
+    // Delete only if item belongs to user (personal) or their household
+    query = `
+      DELETE FROM shopping_items 
+      WHERE id = ? AND id IN (
+        SELECT si.id FROM shopping_items si
+        LEFT JOIN household_members hm ON si.household_id = hm.household_id
+        WHERE si.user_id = ? OR hm.user_id = ?
+      )
+    `;
+    params = [id, userId, userId];
+  }
+
+  return db.prepare(query).run(...params).changes > 0;
 }

-export function deleteChecked(): number {
-  return getDb().prepare('DELETE FROM shopping_items WHERE checked = 1').run().changes;
+export function deleteAll(userId?: string, scope: ShoppingScope = 'personal'): number {
+  const db = getDb();
+  
+  let query: string;
+  let params: any[];
+
+  if (!userId) {
+    // Legacy: no user authentication
+    query = 'DELETE FROM shopping_items WHERE user_id IS NULL AND household_id IS NULL';
+    params = [];
+  } else if (scope === 'household') {
+    // Delete all household items
+    query = `
+      DELETE FROM shopping_items 
+      WHERE household_id IN (
+        SELECT household_id FROM household_members WHERE user_id = ?
+      )
+    `;
+    params = [userId];
+  } else {
+    // Delete all personal items
+    query = 'DELETE FROM shopping_items WHERE user_id = ? AND household_id IS NULL';
+    params = [userId];
+  }
+
+  return db.prepare(query).run(...params).changes;
+}
+
+export function deleteChecked(userId?: string, scope: ShoppingScope = 'personal'): number {
+  const db = getDb();
+  
+  let query: string;
+  let params: any[];
+
+  if (!userId) {
+    // Legacy: no user authentication
+    query = 'DELETE FROM shopping_items WHERE checked = 1 AND user_id IS NULL AND household_id IS NULL';
+    params = [];
+  } else if (scope === 'household') {
+    // Delete checked household items
+    query = `
+      DELETE FROM shopping_items 
+      WHERE checked = 1 AND household_id IN (
+        SELECT household_id FROM household_members WHERE user_id = ?
+      )
+    `;
+    params = [userId];
+  } else {
+    // Delete checked personal items
+    query = 'DELETE FROM shopping_items WHERE checked = 1 AND user_id = ? AND household_id IS NULL';
+    params = [userId];
+  }
+
+  return db.prepare(query).run(...params).changes;
 }