refactor: update event and organizer routes to use user context for authorization; enhance API token validation and migration for api_tokens table

Author: Robert27

.gitignore

@@ -0,0 +1 @@
+.cursor/mcp.json

backend/migrations/20260502120000_api_tokens.up.sql

@@ -1,11 +1,26 @@
-CREATE TABLE api_tokens (
-    id BIGSERIAL PRIMARY KEY,
-    account_id BIGINT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
-    token_hmac BYTEA NOT NULL UNIQUE,
-    label TEXT NOT NULL DEFAULT '',
-    token_last_four TEXT NOT NULL,
-    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-    last_used_at TIMESTAMPTZ
-);
+DO $$
+BEGIN
+    IF EXISTS (
+        SELECT 1
+        FROM information_schema.columns
+        WHERE table_schema = 'public'
+          AND table_name = 'api_tokens'
+          AND column_name = 'token'
+    ) THEN
+        ALTER TABLE api_tokens DROP CONSTRAINT IF EXISTS api_tokens_token_key;
+        ALTER TABLE api_tokens DROP COLUMN token;
+        TRUNCATE api_tokens RESTART IDENTITY;
+    END IF;
+END $$;
 
-CREATE INDEX idx_api_tokens_account_id ON api_tokens(account_id);
+ALTER TABLE api_tokens ADD COLUMN IF NOT EXISTS account_id BIGINT REFERENCES accounts(id) ON DELETE CASCADE;
+ALTER TABLE api_tokens ADD COLUMN IF NOT EXISTS token_hmac BYTEA;
+ALTER TABLE api_tokens ADD COLUMN IF NOT EXISTS label TEXT NOT NULL DEFAULT '';
+ALTER TABLE api_tokens ADD COLUMN IF NOT EXISTS token_last_four TEXT NOT NULL DEFAULT '';
+ALTER TABLE api_tokens ADD COLUMN IF NOT EXISTS last_used_at TIMESTAMPTZ;
+
+ALTER TABLE api_tokens ALTER COLUMN account_id SET NOT NULL;
+ALTER TABLE api_tokens ALTER COLUMN token_hmac SET NOT NULL;
+
+CREATE UNIQUE INDEX IF NOT EXISTS api_tokens_token_hmac_key ON api_tokens (token_hmac);
+CREATE INDEX IF NOT EXISTS idx_api_tokens_account_id ON api_tokens (account_id);

backend/src/error.rs

@@ -50,6 +50,22 @@ impl AppError {
         Self::ServiceUnavailable(msg.into())
     }
 
+    pub(crate) fn http_status(&self) -> StatusCode {
+        self.status_code()
+    }
+
+    pub(crate) fn safe_jsonrpc_message(&self) -> String {
+        match self {
+            AppError::NotFound { message } => message.clone(),
+            AppError::Validation(message) => message.clone(),
+            AppError::Unauthorized(message) => message.clone(),
+            AppError::ServiceUnavailable(_) => "service unavailable".to_string(),
+            AppError::Internal(_) | AppError::Sqlx(_) | AppError::Serde(_) | AppError::Email(_) => {
+                "request failed".to_string()
+            }
+        }
+    }
+
     fn status_code(&self) -> StatusCode {
         match self {
             AppError::NotFound { .. } => StatusCode::NOT_FOUND,

backend/src/main.rs

@@ -256,6 +256,7 @@ async fn main() {
 
     let app = Router::new()
         .merge(api)
+        .merge(routes::mcp::router())
         .layer(cors)
         .layer(SetResponseHeaderLayer::overriding(
             header::X_FRAME_OPTIONS,