Summary

A logged-in coach can keep gymnasts, their lists of elements and their routines through the API. Closes #73.

Stacked. The base is 70-session-tokens (#82, the session), which is on #78 (codegen), #77 (calculator) and #65 (server). This branch also contains a merge of the branch of #49 (the schema fields it needs), so until #49 is merged into dev the diff of this PR includes #49's changes. Change the base to dev when the others are merged. It does not depend on the Google login (#71, draft): it only needs to know who is asking, which the access token from #82 gives.

What's in it

• Ownership: every operation needs a login and only reaches the coach's own data. Another coach's gymnast or routine gives NOT_FOUND with the same message as an unknown id, and nothing changes (tested for all ten operations).
• Gymnasts: create, rename, delete (the routines and the list go with it). Names are trimmed and 1–70 characters (an emoji counts as one). At most 200 per coach.
• The gymnast's list: adding an item that is already there, or removing one that is not, changes nothing and gives no error. Unknown item: NOT_FOUND. Removed item: cannot be added (INVALID_ITEMS), can be taken out. At most 100.
• Routines: create, rename, delete, NAME_TAKEN per gymnast and apparatus, at most 50 per gymnast.
• setRoutineItems: replaces the list in one transaction and sets updatedAt. Items must be on the routine's apparatus, at most one vault on vault, a removed item may stay but not be added. The first statement of the transaction updates the routine row, which locks it, so two saves at the same moment follow each other (last one wins, tested). A failed save changes nothing.
• Routine.dScore: the calculator's function; null while the routine has a removed item.
• Loaders for routines, lists, items, gymnast and apparatus, cleared by the mutations. A coach with 25 gymnasts costs the same number of queries as one with 2 (tested).
• New error classes NOT_FOUND, NAME_TAKEN, LIMIT_REACHED. A DateTime scalar (ISO 8601). The login resolvers moved to resolvers/auth.ts.
• Docs: "The user data" in docs/API.md replaces "What is not built yet"; README and docs/AI_USAGE.md updated.

Things to know

• The limits are checked before the row is written, so several requests at the same moment can go over a limit by the number of requests. The unique name is guarded by the database. This is written in docs/API.md.
• The query count is 10 for the overview (coach, gymnasts, routines, lists, items and their elements/vaults, apparatus), because Prisma sends one query for each include.

Testing

• Lint, tsc --noEmit and 192 tests pass against a database (0 skipped); 40 are new (userData.test.ts, with two test coaches that are deleted afterwards, and one element that is marked removed and restored).

🤖 Generated with Claude Code