enable kids todos

frontend/src/routes/api/todos/+server.ts

@@ -0,0 +1,47 @@
+import { json, error } from '@sveltejs/kit';
+import type { RequestEvent } from '@sveltejs/kit';
+import { pbAdmin } from '$lib/server/pocketbase';
+import { weekStart, addDaysStr, todayInTz, resolveTz } from '@shared/timezone';
+
+// Kids can create todos for THEMSELVES only. Writes go through the superuser
+// client because `assigned_chores.createRule` is parent-only — but every
+// privileged field is forced server-side: memberId = session user, emoji type
+// with zero value (so nobody can mint cash/points for themselves), weekly
+// frequency, this-week start/completeBy (so it expires and purges naturally).
+export async function POST(event: RequestEvent) {
+	const u = event.locals.user;
+	if (!u) throw error(401, 'Unauthorized');
+	const body = await event.request.json().catch(() => ({}));
+	const name = typeof body.name === 'string' ? body.name.trim().slice(0, 80) : '';
+	if (!name) throw error(400, 'Give your todo a name');
+
+	let payday = 1;
+	let tz = 'UTC';
+	try {
+		const fam: any = await pbAdmin.getOne('fams', u.famId);
+		if (fam.payday !== undefined && fam.payday !== null) payday = Number(fam.payday);
+		tz = resolveTz(fam.timezone || 'auto');
+	} catch {
+		tz = resolveTz('auto');
+	}
+	const today = todayInTz(tz);
+	const completeBy = addDaysStr(weekStart(payday, tz), 6);
+
+	try {
+		const record = await pbAdmin.create('assigned_chores', {
+			famId: u.famId,
+			memberId: u.id,
+			frequency: 'weekly',
+			type: 'emoji',
+			value: 0,
+			customName: name,
+			isTodo: true,
+			emoji: '🎯',
+			startDate: today,
+			completeBy
+		});
+		return json({ record });
+	} catch (e) {
+		throw error(400, e instanceof Error ? e.message : 'Could not add todo');
+	}
+}