@cachly-dev/mcp-server 0.10.55 → 0.10.57

package/apps/travel-chaos-organizer/backend/app/routers/admin.py

@@ -0,0 +1,237 @@
+"""
+Admin endpoints — Basic Auth protected, no JWT required.
+Mount at /admin (no /api/v1 prefix).
+"""
+import os
+import secrets
+from typing import Annotated
+from fastapi import APIRouter, Depends, HTTPException
+from fastapi.responses import HTMLResponse
+from fastapi.security import HTTPBasic, HTTPBasicCredentials
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import text
+from app.db.database import get_db
+from app.config import get_settings
+
+router = APIRouter(prefix="/admin", tags=["admin"])
+security = HTTPBasic()
+
+
+def _check_auth(credentials: Annotated[HTTPBasicCredentials, Depends(security)]) -> None:
+    s = get_settings()
+    ok_user = secrets.compare_digest(credentials.username.encode(), s.admin_user.encode())
+    ok_pass = secrets.compare_digest(credentials.password.encode(), s.admin_password.encode())
+    if not (ok_user and ok_pass):
+        raise HTTPException(status_code=401, headers={"WWW-Authenticate": "Basic"})
+
+
+@router.get("", response_class=HTMLResponse, include_in_schema=False,
+            dependencies=[Depends(_check_auth)])
+async def admin_dashboard():
+    html = """<!DOCTYPE html>
+<html lang="de">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>TCO Admin</title>
+<style>
+  * { box-sizing: border-box; margin: 0; padding: 0; }
+  body { font-family: system-ui, sans-serif; background: #0f0f1a; color: #ccc; }
+  #login { display: flex; flex-direction: column; gap: 12px; max-width: 320px; margin: 15vh auto; padding: 32px; background: #1a1a2e; border-radius: 16px; }
+  #login h1 { color: #fff; font-size: 20px; }
+  input { padding: 10px 14px; border-radius: 8px; border: 1px solid #2a2a4a; background: #0f0f1a; color: #fff; font-size: 14px; }
+  button { padding: 10px; background: #4f46e5; color: #fff; border: none; border-radius: 8px; cursor: pointer; font-weight: 700; }
+  button:hover { background: #4338ca; }
+  #dash { display: none; padding: 24px; max-width: 1100px; margin: 0 auto; }
+  h2 { color: #fff; font-size: 22px; margin-bottom: 20px; }
+  .cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(160px, 1fr)); gap: 16px; margin-bottom: 32px; }
+  .card { background: #1a1a2e; border-radius: 12px; padding: 20px; text-align: center; }
+  .card .n { font-size: 36px; font-weight: 800; color: #4f46e5; }
+  .card .l { font-size: 12px; color: #6666aa; margin-top: 4px; }
+  .section { background: #1a1a2e; border-radius: 12px; padding: 20px; margin-bottom: 24px; }
+  .section h3 { color: #fff; margin-bottom: 14px; font-size: 15px; }
+  table { width: 100%; border-collapse: collapse; font-size: 13px; }
+  th { text-align: left; color: #6666aa; padding: 6px 8px; border-bottom: 1px solid #2a2a4a; font-weight: 600; }
+  td { padding: 6px 8px; border-bottom: 1px solid #1a1a2e; color: #ccc; max-width: 220px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+  .badge { display: inline-block; padding: 2px 8px; border-radius: 6px; font-size: 11px; font-weight: 700; }
+  .badge-pro { background: #4f46e522; color: #818cf8; }
+  .badge-free { background: #ffffff11; color: #6666aa; }
+  .top-bar { display: flex; justify-content: space-between; align-items: center; margin-bottom: 28px; }
+  .top-bar h2 { margin: 0; }
+  #logout { background: transparent; color: #6666aa; font-size: 13px; padding: 6px 12px; border: 1px solid #2a2a4a; }
+  #err { color: #ff8888; font-size: 13px; }
+  #plan-form { display: flex; gap: 8px; margin-top: 6px; flex-wrap: wrap; }
+  #plan-form input { flex: 1; min-width: 120px; }
+  #plan-form select { padding: 10px; background: #0f0f1a; border: 1px solid #2a2a4a; color: #fff; border-radius: 8px; }
+</style>
+</head>
+<body>
+<div id="login">
+  <h1>✈️ TCO Admin</h1>
+  <input id="u" placeholder="Username" autocomplete="username">
+  <input id="p" type="password" placeholder="Password" autocomplete="current-password">
+  <button onclick="doLogin()">Login</button>
+  <span id="err"></span>
+</div>
+<div id="dash">
+  <div class="top-bar"><h2>✈️ TCO Admin</h2><button id="logout" onclick="doLogout()">Logout</button></div>
+  <div class="cards" id="cards"></div>
+  <div class="section">
+    <h3>Plan-Upgrade</h3>
+    <div id="plan-form">
+      <input id="pu-uid" placeholder="User ID (Keycloak sub)">
+      <select id="pu-plan"><option value="pro">pro</option><option value="free">free</option></select>
+      <input id="pu-days" placeholder="Tage (leer = unbegrenzt)" type="number" style="max-width:180px">
+      <button onclick="upgradePlan()">Setzen</button>
+    </div>
+  </div>
+  <div class="section"><h3>Top Events</h3><table id="t-events"><thead><tr><th>Event</th><th>Count</th><th>Zuletzt</th></tr></thead><tbody></tbody></table></div>
+  <div class="section"><h3>Benutzer</h3><table id="t-users"><thead><tr><th>ID</th><th>Plan</th><th>Events</th><th>Seit</th></tr></thead><tbody></tbody></table></div>
+  <div class="section"><h3>Waitlist</h3><table id="t-wl"><thead><tr><th>Email</th><th>Source</th><th>Datum</th></tr></thead><tbody></tbody></table></div>
+</div>
+<script>
+  let _creds = '';
+  function b64(u,p){ return btoa(u+':'+p); }
+  function fmt(s){ return s ? new Date(s).toLocaleString('de') : '-'; }
+  async function api(path, opts={}){
+    const r = await fetch(path, { headers: { Authorization: 'Basic '+_creds }, ...opts });
+    if (!r.ok) throw new Error(r.status);
+    return r.json();
+  }
+  async function doLogin(){
+    _creds = b64(document.getElementById('u').value, document.getElementById('p').value);
+    try {
+      const h = await api('/admin/health');
+      document.getElementById('login').style.display='none';
+      document.getElementById('dash').style.display='block';
+      load(h);
+    } catch { document.getElementById('err').textContent='Falsche Zugangsdaten'; _creds=''; }
+  }
+  function doLogout(){ _creds=''; document.getElementById('dash').style.display='none'; document.getElementById('login').style.display='flex'; }
+  async function load(health){
+    const c = document.getElementById('cards');
+    c.innerHTML = [
+      [health.events_total,'Events gesamt'],
+      [health.waitlist_total,'Waitlist'],
+      [health.users_total,'Benutzer'],
+      [health.pro_users,'Pro-User'],
+    ].map(([n,l])=>`<div class="card"><div class="n">${n??0}</div><div class="l">${l}</div></div>`).join('');
+    const [ev, users, wl] = await Promise.all([api('/admin/events/summary'), api('/admin/users'), api('/admin/waitlist')]);
+    const tb = (id, rows) => { document.querySelector('#'+id+' tbody').innerHTML = rows; };
+    tb('t-events', ev.events.map(e=>`<tr><td>${e.event_name}</td><td>${e.count}</td><td>${fmt(e.last_seen)}</td></tr>`).join(''));
+    tb('t-users', users.users.map(u=>`<tr><td title="${u.id}">${u.id.slice(0,12)}…</td><td><span class="badge badge-${u.plan}">${u.plan}</span></td><td>${u.event_count}</td><td>${fmt(u.created_at)}</td></tr>`).join(''));
+    tb('t-wl', wl.signups.map(s=>`<tr><td>${s.email}</td><td>${s.source||'-'}</td><td>${fmt(s.created_at)}</td></tr>`).join(''));
+  }
+  async function upgradePlan(){
+    const uid = document.getElementById('pu-uid').value.trim();
+    const plan = document.getElementById('pu-plan').value;
+    const days = document.getElementById('pu-days').value;
+    if (!uid) { alert('User ID fehlt'); return; }
+    const q = days ? `?plan=${plan}&expires_days=${days}` : `?plan=${plan}`;
+    try { await api('/admin/users/'+uid+'/plan'+q, {method:'PATCH'}); alert('Plan gesetzt'); }
+    catch { alert('Fehler'); }
+  }
+  document.getElementById('p').addEventListener('keydown', e => { if(e.key==='Enter') doLogin(); });
+</script>
+</body>
+</html>"""
+    return HTMLResponse(html)
+
+
+@router.get("/events/summary", dependencies=[Depends(_check_auth)])
+async def events_summary(db: Annotated[AsyncSession, Depends(get_db)]):
+    rows = await db.execute(text("""
+        SELECT event_name, COUNT(*) as count,
+               MAX(created_at) as last_seen
+        FROM events
+        GROUP BY event_name
+        ORDER BY count DESC
+        LIMIT 50
+    """))
+    return {"events": [dict(r._mapping) for r in rows.fetchall()]}
+
+
+@router.get("/events/recent", dependencies=[Depends(_check_auth)])
+async def events_recent(db: Annotated[AsyncSession, Depends(get_db)], limit: int = 50):
+    rows = await db.execute(text("""
+        SELECT id, user_id, event_name, properties, platform, app_version, created_at
+        FROM events ORDER BY created_at DESC LIMIT :limit
+    """), {"limit": min(limit, 200)})
+    return {"events": [dict(r._mapping) for r in rows.fetchall()]}
+
+
+@router.get("/waitlist", dependencies=[Depends(_check_auth)])
+async def waitlist(db: Annotated[AsyncSession, Depends(get_db)]):
+    rows = await db.execute(text(
+        "SELECT id, email, source, created_at FROM waitlist ORDER BY created_at DESC"
+    ))
+    return {"signups": [dict(r._mapping) for r in rows.fetchall()]}
+
+
+@router.get("/health", dependencies=[Depends(_check_auth)])
+async def admin_health(db: Annotated[AsyncSession, Depends(get_db)]):
+    event_count = await db.execute(text("SELECT COUNT(*) FROM events"))
+    waitlist_count = await db.execute(text("SELECT COUNT(*) FROM waitlist"))
+    user_count = await db.execute(text("SELECT COUNT(*) FROM users"))
+    from datetime import datetime, timezone
+    pro_count = await db.execute(
+        text("SELECT COUNT(*) FROM users WHERE plan != 'free' AND (plan_expires_at IS NULL OR plan_expires_at > :now)"),
+        {"now": datetime.now(timezone.utc)},
+    )
+    return {
+        "events_total": event_count.scalar(),
+        "waitlist_total": waitlist_count.scalar(),
+        "users_total": user_count.scalar(),
+        "pro_users": pro_count.scalar(),
+    }
+
+
+@router.get("/users", dependencies=[Depends(_check_auth)])
+async def list_users(db: Annotated[AsyncSession, Depends(get_db)], limit: int = 100):
+    rows = await db.execute(text("""
+        SELECT u.id, u.email, u.plan, u.plan_expires_at, u.created_at,
+               COUNT(e.id) AS event_count
+        FROM users u
+        LEFT JOIN events e ON e.user_id = u.id
+        GROUP BY u.id, u.email, u.plan, u.plan_expires_at, u.created_at
+        ORDER BY u.created_at DESC
+        LIMIT :limit
+    """), {"limit": min(limit, 500)})
+    return {"users": [dict(r._mapping) for r in rows.fetchall()]}
+
+
+@router.patch("/users/{uid}/plan", dependencies=[Depends(_check_auth)])
+async def set_user_plan(
+    uid: str,
+    plan: str,
+    db: Annotated[AsyncSession, Depends(get_db)],
+    expires_days: int | None = None,
+):
+    if plan not in ("free", "pro"):
+        raise HTTPException(status_code=400, detail="plan must be 'free' or 'pro'")
+    from datetime import datetime, timedelta, timezone
+    now = datetime.now(timezone.utc)
+    expires_at = (now + timedelta(days=expires_days)) if expires_days else None
+    await db.execute(
+        text("""
+            INSERT INTO users (id, plan, plan_expires_at, updated_at)
+            VALUES (:uid, :plan, :expires_at, :now)
+            ON CONFLICT (id) DO UPDATE
+              SET plan = EXCLUDED.plan,
+                  plan_expires_at = EXCLUDED.plan_expires_at,
+                  updated_at = EXCLUDED.updated_at
+        """),
+        {"uid": uid, "plan": plan, "expires_at": expires_at, "now": now},
+    )
+    await db.commit()
+    return {"ok": True, "uid": uid, "plan": plan}
+
+
+@router.post("/drip/run", dependencies=[Depends(_check_auth)])
+async def run_drip_sequence(
+    db: Annotated[AsyncSession, Depends(get_db)],
+    dry_run: bool = False,
+):
+    from app.services.drip import run_drip
+    result = await run_drip(db, dry_run=dry_run)
+    return result

package/apps/travel-chaos-organizer/backend/app/routers/cache.py

@@ -0,0 +1,13 @@
+"""Cache stats endpoint — exposes Cachly Redis metrics to the frontend and MCP tools."""
+from fastapi import APIRouter, Depends
+from typing import Annotated
+from app.auth.keycloak import user_id
+from app.services.cache import cache_stats
+
+router = APIRouter(prefix="/cache", tags=["cache"])
+
+
+@router.get("/stats")
+async def get_cache_stats(_uid: Annotated[str, Depends(user_id)]):
+    """Return Cachly Redis cache statistics for the current deployment."""
+    return await cache_stats()

package/apps/travel-chaos-organizer/backend/app/routers/events.py

@@ -0,0 +1,29 @@
+from typing import Annotated
+from fastapi import APIRouter, Depends, Request
+from pydantic import BaseModel
+from sqlalchemy.ext.asyncio import AsyncSession
+from app.auth.keycloak import user_id
+from app.db.database import get_db
+from app.services import telemetry
+from app.limiter import limiter
+
+router = APIRouter(prefix="/events", tags=["events"])
+
+
+class EventBody(BaseModel):
+    event_name: str
+    properties: dict | None = None
+    platform: str | None = None
+    app_version: str | None = None
+
+
+@limiter.limit("30/minute")
+@router.post("")
+async def log_event(
+    request: Request,
+    body: EventBody,
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    await telemetry.track(db, uid, body.event_name, body.properties, body.platform, body.app_version)
+    return {"ok": True}

package/apps/travel-chaos-organizer/backend/app/routers/export.py

@@ -0,0 +1,122 @@
+"""
+Export trip as PDF itinerary.
+GET /api/v1/trips/{trip_id}/export/pdf
+"""
+from typing import Annotated
+from uuid import UUID
+from fastapi import APIRouter, Depends, HTTPException
+from fastapi.responses import StreamingResponse
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import text
+from io import BytesIO
+from app.auth.keycloak import user_id
+from app.db.database import get_db
+
+router = APIRouter(tags=["export"])
+
+
+@router.get("/trips/{trip_id}/export/pdf")
+async def export_trip_pdf(
+    trip_id: UUID,
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    trip_row = await db.execute(
+        text("SELECT * FROM trips WHERE id = :id AND user_id = :uid"),
+        {"id": str(trip_id), "uid": uid},
+    )
+    trip = trip_row.fetchone()
+    if not trip:
+        raise HTTPException(status_code=404, detail="Trip not found")
+    trip = dict(trip._mapping)
+
+    items_row = await db.execute(
+        text("SELECT * FROM trip_items WHERE trip_id = :id ORDER BY event_at ASC NULLS LAST"),
+        {"id": str(trip_id)},
+    )
+    items = [dict(r._mapping) for r in items_row.fetchall()]
+
+    from app.services import telemetry
+    await telemetry.track(db, uid, "pdf_export", {"trip_id": str(trip_id), "item_count": len(items)})
+
+    pdf_bytes = _build_pdf(trip, items)
+    filename = f"trip-{trip['name'].replace(' ', '_')[:40]}.pdf"
+    return StreamingResponse(
+        BytesIO(pdf_bytes),
+        media_type="application/pdf",
+        headers={"Content-Disposition": f'attachment; filename="{filename}"'},
+    )
+
+
+def _build_pdf(trip: dict, items: list[dict]) -> bytes:
+    from reportlab.lib.pagesizes import A4
+    from reportlab.lib.styles import getSampleStyleSheet, ParagraphStyle
+    from reportlab.lib.units import cm
+    from reportlab.lib import colors
+    from reportlab.platypus import SimpleDocTemplate, Paragraph, Spacer, Table, TableStyle, HRFlowable
+    from reportlab.lib.enums import TA_LEFT
+
+    buf = BytesIO()
+    doc = SimpleDocTemplate(buf, pagesize=A4, leftMargin=2*cm, rightMargin=2*cm, topMargin=2*cm, bottomMargin=2*cm)
+    styles = getSampleStyleSheet()
+
+    PURPLE = colors.HexColor("#4f46e5")
+    GRAY   = colors.HexColor("#666688")
+
+    title_style = ParagraphStyle("title", parent=styles["Heading1"], textColor=PURPLE, fontSize=22, spaceAfter=4)
+    sub_style   = ParagraphStyle("sub",   parent=styles["Normal"],   textColor=GRAY,   fontSize=10, spaceAfter=16)
+    h3_style    = ParagraphStyle("h3",    parent=styles["Heading3"], textColor=PURPLE, fontSize=12, spaceBefore=12, spaceAfter=4)
+    body_style  = ParagraphStyle("body",  parent=styles["Normal"],   fontSize=9, leading=13)
+    label_style = ParagraphStyle("label", parent=styles["Normal"],   fontSize=8, textColor=GRAY)
+
+    story = []
+    story.append(Paragraph(f"✈ {trip['name']}", title_style))
+
+    date_range = ""
+    if trip.get("start_date") and trip.get("end_date"):
+        date_range = f"{trip['start_date']} – {trip['end_date']}"
+    elif trip.get("start_date"):
+        date_range = str(trip["start_date"])
+    if date_range:
+        story.append(Paragraph(date_range, sub_style))
+    if trip.get("description"):
+        story.append(Paragraph(trip["description"], body_style))
+    story.append(Spacer(1, 0.4*cm))
+    story.append(HRFlowable(width="100%", color=PURPLE, thickness=1))
+    story.append(Spacer(1, 0.3*cm))
+
+    if not items:
+        story.append(Paragraph("Keine Einträge vorhanden.", body_style))
+    else:
+        TYPE_EMOJI = {"flight": "✈", "train": "🚆", "bus": "🚌", "hotel": "🏨",
+                      "rental_car": "🚗", "activity": "🎯", "transfer": "🚕",
+                      "document": "📄", "other": "📌"}
+        for item in items:
+            emoji = TYPE_EMOJI.get(item.get("type", "other"), "📌")
+            story.append(Paragraph(f"{emoji} {item.get('title', '–')}", h3_style))
+
+            meta = []
+            if item.get("event_at"):
+                meta.append(["Datum/Zeit", str(item["event_at"])[:16]])
+            if item.get("provider"):
+                meta.append(["Anbieter", item["provider"]])
+            if item.get("booking_ref"):
+                meta.append(["Buchungs-Nr.", item["booking_ref"]])
+
+            if meta:
+                tbl = Table(meta, colWidths=[3.5*cm, 12*cm])
+                tbl.setStyle(TableStyle([
+                    ("TEXTCOLOR", (0,0), (0,-1), GRAY),
+                    ("FONTSIZE",  (0,0), (-1,-1), 8),
+                    ("BOTTOMPADDING", (0,0), (-1,-1), 2),
+                    ("TOPPADDING",    (0,0), (-1,-1), 2),
+                ]))
+                story.append(tbl)
+            story.append(Spacer(1, 0.2*cm))
+
+    story.append(Spacer(1, 1*cm))
+    story.append(Paragraph("Erstellt mit Travel Chaos Organizer · tco.app", label_style))
+
+    doc.build(story)
+    buf.seek(0)
+    return buf.read()

package/apps/travel-chaos-organizer/backend/app/routers/inbox.py

@@ -0,0 +1,122 @@
+import json
+from datetime import datetime
+from typing import Annotated
+from uuid import UUID
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy import text
+from sqlalchemy.ext.asyncio import AsyncSession
+from app.auth.keycloak import user_id
+from app.db.database import get_db
+from app.models.schemas import InboxItemOut, InboxAssign
+
+
+def _safe_dt(val: str | None) -> datetime | None:
+    """Convert an ISO 8601 string to datetime, returning None on failure."""
+    if not val or not isinstance(val, str):
+        return None
+    try:
+        return datetime.fromisoformat(val.replace("Z", "+00:00"))
+    except ValueError:
+        return None
+
+router = APIRouter(prefix="/inbox", tags=["inbox"])
+
+
+def _parse_inbox_row(row: dict) -> dict:
+    if isinstance(row.get("parsed_data"), str):
+        try:
+            row["parsed_data"] = json.loads(row["parsed_data"])
+        except (json.JSONDecodeError, TypeError):
+            row["parsed_data"] = None
+    return row
+
+
+@router.get("", response_model=list[InboxItemOut])
+async def list_inbox(
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+    status_filter: str = "pending",
+):
+    result = await db.execute(
+        text("SELECT * FROM chaos_inbox WHERE user_id = :uid AND status = :status ORDER BY created_at DESC"),
+        {"uid": uid, "status": status_filter},
+    )
+    return [_parse_inbox_row(dict(r._mapping)) for r in result.fetchall()]
+
+
+@router.post("/{inbox_id}/assign", response_model=dict)
+async def assign_to_trip(
+    inbox_id: UUID,
+    body: InboxAssign,
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    iid = str(inbox_id)
+    row = await db.execute(
+        text("SELECT * FROM chaos_inbox WHERE id = :id AND user_id = :uid"),
+        {"id": iid, "uid": uid},
+    )
+    inbox_item = row.fetchone()
+    if not inbox_item:
+        raise HTTPException(status_code=404, detail="Inbox item not found")
+
+    # Verify the target trip belongs to this user (prevents assigning to other users' trips)
+    trip_check = await db.execute(
+        text("SELECT id FROM trips WHERE id = :tid AND user_id = :uid"),
+        {"tid": str(body.trip_id), "uid": uid},
+    )
+    if not trip_check.fetchone():
+        raise HTTPException(status_code=403, detail="Trip not found or access denied")
+
+    item = dict(inbox_item._mapping)
+    raw_pd = item.get("parsed_data") or {}
+    parsed = json.loads(raw_pd) if isinstance(raw_pd, str) else raw_pd
+    title = parsed.get("title", "Imported item") if isinstance(parsed, dict) else "Imported item"
+
+    result = await db.execute(
+        text("""
+            INSERT INTO trip_items (trip_id, user_id, type, title, raw_text, parsed_data,
+                                    event_at, event_end_at, booking_ref, provider)
+            VALUES (:trip_id, :uid, :type, :title, :raw, :pd,
+                    :event_at, :event_end_at, :booking_ref, :provider)
+            RETURNING id, title, event_at
+        """),
+        {
+            "trip_id": str(body.trip_id), "uid": uid, "type": body.type, "title": title,
+            "raw": item.get("raw_content"), "pd": json.dumps(parsed),
+            "event_at": _safe_dt(parsed.get("event_at") if isinstance(parsed, dict) else None),
+            "event_end_at": _safe_dt(parsed.get("event_end_at") if isinstance(parsed, dict) else None),
+            "booking_ref": parsed.get("booking_ref") if isinstance(parsed, dict) else None,
+            "provider": parsed.get("provider") if isinstance(parsed, dict) else None,
+        },
+    )
+    row = result.fetchone()
+    trip_item_id = row[0]
+    item_title = row[1]
+    event_at = row[2].isoformat() if row[2] else None
+
+    await db.execute(
+        text("UPDATE chaos_inbox SET status = 'assigned', updated_at = CURRENT_TIMESTAMP WHERE id = :id"),
+        {"id": iid},
+    )
+    await db.execute(
+        text("UPDATE attachments SET trip_item_id = :tid, inbox_id = NULL WHERE inbox_id = :iid"),
+        {"tid": trip_item_id, "iid": iid},
+    )
+    await db.commit()
+    return {"trip_item_id": str(trip_item_id), "title": item_title, "event_at": event_at}
+
+
+@router.delete("/{inbox_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def reject_inbox_item(
+    inbox_id: UUID,
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    result = await db.execute(
+        text("UPDATE chaos_inbox SET status = 'rejected', updated_at = CURRENT_TIMESTAMP WHERE id = :id AND user_id = :uid"),
+        {"id": str(inbox_id), "uid": uid},
+    )
+    await db.commit()
+    if result.rowcount == 0:
+        raise HTTPException(status_code=404, detail="Inbox item not found")

package/apps/travel-chaos-organizer/backend/app/routers/items.py

@@ -0,0 +1,130 @@
+import json
+from typing import Annotated
+from uuid import UUID
+from fastapi import APIRouter, Depends, HTTPException, Request, status
+from sqlalchemy import text
+from sqlalchemy.ext.asyncio import AsyncSession
+from app.auth.keycloak import user_id
+from app.db.database import get_db
+from app.limiter import limiter
+from app.models.schemas import TripItemCreate, TripItemOut, TripItemUpdate
+
+router = APIRouter(prefix="/trips/{trip_id}/items", tags=["items"])
+
+
+async def _assert_trip_owner(trip_id: str, uid: str, db: AsyncSession) -> None:
+    result = await db.execute(
+        text("SELECT id FROM trips WHERE id = :id AND user_id = :uid"),
+        {"id": trip_id, "uid": uid},
+    )
+    if not result.fetchone():
+        raise HTTPException(status_code=404, detail="Trip not found")
+
+
+def _parse_item_row(row: dict) -> dict:
+    """Deserialize parsed_data from JSON string (SQLite) or dict (PostgreSQL)."""
+    if isinstance(row.get("parsed_data"), str):
+        try:
+            row["parsed_data"] = json.loads(row["parsed_data"])
+        except (json.JSONDecodeError, TypeError):
+            row["parsed_data"] = None
+    return row
+
+
+@router.get("", response_model=list[TripItemOut])
+async def list_items(
+    trip_id: UUID,
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    tid = str(trip_id)
+    await _assert_trip_owner(tid, uid, db)
+    result = await db.execute(
+        text("SELECT * FROM trip_items WHERE trip_id = :tid ORDER BY event_at ASC"),
+        {"tid": tid},
+    )
+    return [_parse_item_row(dict(r._mapping)) for r in result.fetchall()]
+
+
+@limiter.limit("30/minute")
+@router.post("", response_model=TripItemOut, status_code=status.HTTP_201_CREATED)
+async def create_item(
+    request: Request,
+    trip_id: UUID,
+    body: TripItemCreate,
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    tid = str(trip_id)
+    await _assert_trip_owner(tid, uid, db)
+    pd_json = json.dumps(body.parsed_data) if body.parsed_data else None
+    result = await db.execute(
+        text("""
+            INSERT INTO trip_items
+              (trip_id, user_id, type, title, raw_text, parsed_data,
+               event_at, event_end_at, booking_ref, provider)
+            VALUES
+              (:trip_id, :uid, :type, :title, :raw_text, :parsed_data,
+               :event_at, :event_end_at, :booking_ref, :provider)
+            RETURNING *
+        """),
+        {
+            "trip_id": tid, "uid": uid, "type": body.type, "title": body.title,
+            "raw_text": body.raw_text, "parsed_data": pd_json,
+            "event_at": body.event_at, "event_end_at": body.event_end_at,
+            "booking_ref": body.booking_ref, "provider": body.provider,
+        },
+    )
+    await db.commit()
+    return _parse_item_row(dict(result.fetchone()._mapping))
+
+
+@limiter.limit("30/minute")
+@router.patch("/{item_id}", response_model=TripItemOut)
+async def update_item(
+    request: Request,
+    trip_id: UUID,
+    item_id: UUID,
+    body: TripItemUpdate,
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    tid, iid = str(trip_id), str(item_id)
+    await _assert_trip_owner(tid, uid, db)
+    updates = body.model_dump(exclude_none=True)
+    if not updates:
+        raise HTTPException(status_code=400, detail="Nothing to update")
+    if "parsed_data" in updates:
+        updates["parsed_data"] = json.dumps(updates["parsed_data"])
+
+    set_clauses = ", ".join(f"{k} = :{k}" for k in updates)
+    updates.update({"item_id": iid, "trip_id": tid})
+    result = await db.execute(
+        text(f"UPDATE trip_items SET {set_clauses}, updated_at = CURRENT_TIMESTAMP WHERE id = :item_id AND trip_id = :trip_id RETURNING *"),
+        updates,
+    )
+    row = result.fetchone()
+    if not row:
+        raise HTTPException(status_code=404, detail="Item not found")
+    await db.commit()
+    return _parse_item_row(dict(row._mapping))
+
+
+@limiter.limit("30/minute")
+@router.delete("/{item_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_item(
+    request: Request,
+    trip_id: UUID,
+    item_id: UUID,
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    tid, iid = str(trip_id), str(item_id)
+    await _assert_trip_owner(tid, uid, db)
+    result = await db.execute(
+        text("DELETE FROM trip_items WHERE id = :item_id AND trip_id = :trip_id"),
+        {"item_id": iid, "trip_id": tid},
+    )
+    await db.commit()
+    if result.rowcount == 0:
+        raise HTTPException(status_code=404, detail="Item not found")