Added endpoint for shares

- Roles are not hardcoded anymore (closes #4)

.gitignore

@@ -2,3 +2,4 @@ appdata
 .idea
 *.exe
 *.cmd
+.run

Dockerfile

@@ -1,24 +1,19 @@
-# Wir sagen Docker: Der Builder soll IMMER auf der Architektur deines PCs laufen (schnell!)
 FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS builder
 
 RUN apk add --no-cache git
 WORKDIR /app
 
-# Cache für Module nutzen
 COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
 
-# buildx übergibt diese Variablen automatisch
 ARG TARGETOS
 ARG TARGETARCH
 
-# Hier passiert die Magie: Go kompiliert NATIV für das Ziel (Cross-Compilation)
 RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
     go build -ldflags "-s -w" -o shap-planner-backend .
 
-# Final Stage (bleibt gleich klein)
 FROM scratch
 COPY --from=builder /app/shap-planner-backend /shap-planner-backend
 ENTRYPOINT ["/shap-planner-backend"]

auth/jwt.go

@@ -1,7 +1,6 @@
 package auth
 
 import (
-	"os"
 	"time"
 
 	"github.com/golang-jwt/jwt/v5"
@@ -13,8 +12,6 @@ type Claims struct {
 	jwt.RegisteredClaims
 }
 
-var secret = os.Getenv("SHAP_JWT_SECRET")
-
 func GenerateJWT(userID, role string, secret []byte) (string, error) {
 	claims := Claims{
 		UserID: userID,

config/config.go

@@ -12,6 +12,8 @@ type Config struct {
 	HouseholdName   string `yaml:"household_name"`
 	Port            string `yaml:"port"`
 	DatabasePath    string `yaml:"database_path"`
+	CertificatePath string `yaml:"certificate_path"`
+	PrivateKeyPath  string `yaml:"private_key_path"`
 }
 
 const configPath = "./appdata/config.yaml"
@@ -36,6 +38,8 @@ func CheckIfExists() error {
 		Port:            "8080",
 		DatabasePath:    "./appdata/database.db",
 		HouseholdName:   "Example-Household",
+		CertificatePath: "./appdata/cert.pem",
+		PrivateKeyPath:  "./appdata/key.pem",
 	}
 
 	data, err := yaml.Marshal(defaultConfig)

handlers/account.go

@@ -18,35 +18,35 @@ var cfg, _ = config.LoadConfig()
 func Register(w http.ResponseWriter, r *http.Request) {
 	var user models.User
 	if err := json.NewDecoder(r.Body).Decode(&user); err != nil {
-		log.Println("[api/register] " + r.RemoteAddr + ": " + err.Error())
+		log.Println("POST [api/register] " + r.RemoteAddr + ": " + err.Error())
 		http.Error(w, "Invalid request body", http.StatusBadRequest)
 		return
 	}
 
 	if user.Username == "" || user.Password == "" {
-		log.Println("[api/register] " + r.RemoteAddr + ": Username or Password is empty")
+		log.Println("POST [api/register] " + r.RemoteAddr + ": Username or Password is empty")
 		http.Error(w, "username and password required", http.StatusBadRequest)
 		return
 	}
 
 	hashed, err := auth.HashPassword(user.Password)
 	if err != nil {
-		log.Println("[api/register] " + r.RemoteAddr + ": " + err.Error())
+		log.Println("POST [api/register] " + r.RemoteAddr + ": " + err.Error())
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
 	user.Password = hashed
 	user.ID = utils.GenerateUUID()
-	user.Role = "user"
+	user.Role = models.RoleUser
 
 	if err := storage.AddUser(&user); err != nil {
-		log.Println("[api/register] " + r.RemoteAddr + ": " + err.Error())
+		log.Println("POST [api/register] " + r.RemoteAddr + ": " + err.Error())
 		http.Error(w, "user already exists", http.StatusBadRequest)
 		return
 	}
 
 	w.WriteHeader(http.StatusCreated)
-	log.Println("[api/register] " + r.RemoteAddr + ": Successfully created user")
+	log.Println("POST [api/register] " + r.RemoteAddr + ": Successfully created user")
 }
 func Login(w http.ResponseWriter, r *http.Request) {
 	var creds struct {
@@ -54,41 +54,41 @@ func Login(w http.ResponseWriter, r *http.Request) {
 		Password string `json:"password"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&creds); err != nil {
-		log.Println("[api/login] " + r.RemoteAddr + ": " + err.Error())
+		log.Println("POST [api/login] " + r.RemoteAddr + ": " + err.Error())
 		http.Error(w, "Invalid request", http.StatusBadRequest)
 		return
 	}
 
 	user, err := storage.GetUserByUsername(creds.Username)
 	if err != nil {
-		log.Println("[api/login] " + r.RemoteAddr + ": " + err.Error())
+		log.Println("POST [api/login] " + r.RemoteAddr + ": " + err.Error())
 		http.Error(w, "Invalid credentials", http.StatusUnauthorized)
 		return
 	}
 
 	if !auth.CheckPasswordHash(creds.Password, user.Password) {
-		log.Println("[api/login] " + r.RemoteAddr + ": Invalid credentials")
+		log.Println("POST [api/login] " + r.RemoteAddr + ": Invalid credentials")
 		http.Error(w, "Invalid credentials", http.StatusUnauthorized)
 		return
 	}
 
 	secret := []byte(os.Getenv("SHAP_JWT_SECRET"))
 	if len(secret) == 0 {
-		log.Println("[api/login] " + r.RemoteAddr + ": Server misconfiguration")
+		log.Println("POST [api/login] " + r.RemoteAddr + ": Server misconfiguration")
 		http.Error(w, "Server misconfiguration", http.StatusInternalServerError)
 		return
 	}
 
 	accessToken, err := auth.GenerateJWT(user.ID, user.Role, secret)
 	if err != nil {
-		log.Println("[api/login] " + r.RemoteAddr + ": " + err.Error())
+		log.Println("POST [api/login] " + r.RemoteAddr + ": " + err.Error())
 		http.Error(w, "Could not generate token", http.StatusInternalServerError)
 		return
 	}
 
 	refreshTokenPlain, err := utils.GenerateRefreshToken()
 	if err != nil {
-		log.Println("[api/login] " + r.RemoteAddr + ": " + err.Error())
+		log.Println("POST [api/login] " + r.RemoteAddr + ": " + err.Error())
 		http.Error(w, "could not generate refresh token", http.StatusInternalServerError)
 		return
 	}
@@ -107,7 +107,7 @@ func Login(w http.ResponseWriter, r *http.Request) {
 		CreatedAt:  time.Now().Unix(),
 		Revoked:    false,
 	}); err != nil {
-		log.Println("[api/login] " + r.RemoteAddr + ": " + err.Error())
+		log.Println("POST [api/login] " + r.RemoteAddr + ": " + err.Error())
 		http.Error(w, "could not save refresh token", http.StatusInternalServerError)
 		return
 	}
@@ -127,17 +127,17 @@ func Login(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
 	err = json.NewEncoder(w).Encode(resp)
 	if err != nil {
-		log.Println("[api/login] " + r.RemoteAddr + ": " + err.Error())
+		log.Println("POST [api/login] " + r.RemoteAddr + ": " + err.Error())
 		http.Error(w, "Something went wrong", http.StatusInternalServerError)
 		return
 	}
-	log.Println("[api/login] " + r.RemoteAddr + ": Successfully logged in")
+	log.Println("POST [api/login] " + r.RemoteAddr + ": Successfully logged in")
 }
 func Logout(w http.ResponseWriter, r *http.Request) {
 	claims := r.Context().Value(auth.UserContextKey).(*auth.Claims)
 	err := storage.RevokeAllRefreshTokensForUser(claims.UserID)
 	if err != nil {
-		log.Println("[api/logout] " + r.RemoteAddr + ": " + err.Error())
+		log.Println("GET [api/logout] " + r.RemoteAddr + ": " + err.Error())
 		http.Error(w, "Internal server error", http.StatusInternalServerError)
 		return
 	}
@@ -150,20 +150,20 @@ func TestHandler(w http.ResponseWriter, r *http.Request) {
 	err := json.NewEncoder(w).Encode(map[string]interface{}{
 		"user_id": claims.UserID,
 		"role":    claims.Role,
-		"msg":     "access granted to protected endpoint",
+		"msg":     "Authentication successful",
 	})
 	if err != nil {
-		log.Println("[api/ping] " + r.RemoteAddr + ": " + err.Error())
+		log.Println("GET [api/ping] " + r.RemoteAddr + ": " + err.Error())
 		return
 	}
-	log.Println("[api/login] " + r.RemoteAddr + ": Successfully tested connection")
+	log.Println("GET [api/login] " + r.RemoteAddr + ": Successfully tested connection")
 }
 func RefreshToken(w http.ResponseWriter, r *http.Request) {
 	var req struct {
 		RefreshToken string `json:"refresh_token"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		log.Println("[api/refresh] " + r.RemoteAddr + ": " + err.Error())
+		log.Println("POST [api/refresh] " + r.RemoteAddr + ": " + err.Error())
 		http.Error(w, "Invalid request", http.StatusBadRequest)
 		return
 	}
@@ -172,7 +172,7 @@ func RefreshToken(w http.ResponseWriter, r *http.Request) {
 
 	tokenRow, err := storage.GetRefreshToken(hashed)
 	if err != nil || tokenRow.Revoked || tokenRow.ExpiresAt < time.Now().Unix() {
-		log.Println("[api/refresh] " + r.RemoteAddr + ": Invalid refresh token")
+		log.Println("POST [api/refresh] " + r.RemoteAddr + ": Invalid refresh token")
 		http.Error(w, "Invalid refresh token", http.StatusUnauthorized)
 		return
 	}
@@ -195,19 +195,52 @@ func RefreshToken(w http.ResponseWriter, r *http.Request) {
 		Revoked:    false,
 		DeviceInfo: deviceInfo,
 	}); err != nil {
-		log.Println("[api/refresh] " + r.RemoteAddr + ": " + err.Error())
+		log.Println("POST [api/refresh] " + r.RemoteAddr + ": " + err.Error())
 		http.Error(w, "Could not generate new refresh token", http.StatusInternalServerError)
 		return
 	}
 
-	accessToken, _ := auth.GenerateJWT(tokenRow.UserID, "", []byte(os.Getenv("SHAP_JWT_SECRET")))
+	user, err := storage.GetUserById(tokenRow.UserID)
+	if err != nil {
+		log.Println("POST [api/refresh] " + r.RemoteAddr + ": " + err.Error())
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+		return
+	}
+	accessToken, _ := auth.GenerateJWT(tokenRow.UserID, user.Role, []byte(os.Getenv("SHAP_JWT_SECRET")))
 
 	if err = json.NewEncoder(w).Encode(map[string]string{
 		"access_token":  accessToken,
 		"refresh_token": newToken,
 	}); err != nil {
-		log.Println("[api/refresh] " + r.RemoteAddr + ": " + err.Error())
+		log.Println("POST [api/refresh] " + r.RemoteAddr + ": " + err.Error())
 		http.Error(w, "Internal server error", http.StatusInternalServerError)
 		return
 	}
+	log.Println("POST [api/refresh] " + r.RemoteAddr + ": Successfully refreshed token")
+}
+func UserInfo(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		log.Println("GET [api/userinfo] " + r.RemoteAddr + ": Method " + r.Method + " not allowed")
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	query := r.URL.Query()
+	idParam := query.Get("id")
+	user, err := storage.GetUserById(idParam)
+	if err != nil {
+		log.Println("GET [api/userinfo] " + r.RemoteAddr + ": User " + idParam + " not found")
+		http.Error(w, "User not found", http.StatusNotFound)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	err = json.NewEncoder(w).Encode(map[string]interface{}{
+		"id":         user.ID,
+		"name":       user.Username,
+		"avatar_url": "",
+	})
+	if err != nil {
+		log.Println("GET [api/userinfo] " + r.RemoteAddr + ": " + err.Error())
+		return
+	}
+	log.Println("GET [api/userinfo] " + r.RemoteAddr + ": Successfully retrieved user info")
 }

handlers/balance.go

@@ -1,12 +1,32 @@
 package handlers
 
-import "net/http"
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"shap-planner-backend/storage"
+)
 
 func GetBalance(w http.ResponseWriter, r *http.Request) {
 	query := r.URL.Query()
 	userParam := query.Get("user")
 
-	if userParam == "" {
+	if userParam == "all" {
-
+		// TODO: add later
+	} else {
+		balance, err := storage.ComputeBalance(userParam)
+		if err != nil {
+			log.Println("GET [api/balance] " + r.RemoteAddr + ": " + err.Error())
+			http.Error(w, "Invalid request query", http.StatusBadRequest)
+			return
+		}
+		err = json.NewEncoder(w).Encode(map[string]interface{}{
+			"balance": balance,
+		})
+		if err != nil {
+			log.Println("GET [api/balance] " + r.RemoteAddr + ": " + err.Error())
+			return
+		}
+		log.Println("GET [api/balance] " + r.RemoteAddr + ": Successfully retrieved balance")
 	}
 }

handlers/expenses.go

@@ -2,10 +2,13 @@ package handlers
 
 import (
 	"encoding/json"
+	"log"
 	"net/http"
 	"shap-planner-backend/models"
 	"shap-planner-backend/storage"
 	"shap-planner-backend/utils"
+	"strings"
+	"time"
 )
 
 func Expenses(w http.ResponseWriter, r *http.Request) {
@@ -13,6 +16,20 @@ func Expenses(w http.ResponseWriter, r *http.Request) {
 
 	switch r.Method {
 	case http.MethodGet: // -> Get Expenses
+		expenses, err := storage.GetAllExpenses()
+		if err != nil {
+			log.Println("GET [api/expense] " + r.RemoteAddr + ": " + err.Error())
+			http.Error(w, "Something went wrong", http.StatusInternalServerError)
+			return
+		}
+		err = json.NewEncoder(w).Encode(map[string]interface{}{
+			"expenses": expenses,
+		})
+		if err != nil {
+			log.Println("GET [api/expense] " + r.RemoteAddr + ": " + err.Error())
+			return
+		}
+		log.Println("GET [api/expense] " + r.RemoteAddr + ": Successfully retrieved expenses")
 		break
 	case http.MethodPost: // -> Create Expense
 		var body struct {
@@ -20,37 +37,54 @@ func Expenses(w http.ResponseWriter, r *http.Request) {
 			Shares  []models.ExpenseShare `json:"shares"`
 		}
 		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			log.Println("POST [api/expense] " + r.RemoteAddr + ": " + err.Error())
 			http.Error(w, "Invalid request body", http.StatusBadRequest)
 			return
 		}
 		if claims.UserID != body.Expense.PayerID { // You cannot create an expense in the name of another user
-			http.Error(w, "Invalid request", http.StatusUnauthorized)
+			log.Println("POST [api/expense] " + r.RemoteAddr + ": claims.UserID and expense.PayerID does not match")
+			http.Error(w, "Invalid request", http.StatusBadRequest)
 			return
 		}
+		// Set ExpenseID
 		if body.Expense.ID != "" {
-			http.Error(w, "Invalid request", http.StatusUnauthorized)
+			log.Println("POST [api/expense] " + r.RemoteAddr + ": Expense ID must be empty")
+			http.Error(w, "Invalid request", http.StatusBadRequest)
 			return
 		}
 		body.Expense.ID = utils.GenerateUUID()
+		if body.Expense.CreatedAt == 0 {
+			body.Expense.CreatedAt = time.Now().Unix()
+		}
+		if body.Expense.Amount <= 0 {
+			log.Println("POST [api/expense] " + r.RemoteAddr + ": Amount must be greater than zero")
+			http.Error(w, "Invalid request", http.StatusBadRequest)
+			return
+		}
+		// Set ShareIDs and save them
 		for _, share := range body.Shares {
 			if share.ID != "" {
-				http.Error(w, "Invalid request", http.StatusUnauthorized)
+				log.Println("POST [api/expense] " + r.RemoteAddr + ": Share ID must be empty")
+				http.Error(w, "Invalid request", http.StatusBadRequest)
 				return
 			}
 			if share.ExpenseID != "" {
-				http.Error(w, "Invalid request", http.StatusUnauthorized)
+				log.Println("POST [api/expense] " + r.RemoteAddr + ": Expense ID of Share must be empty")
+				http.Error(w, "Invalid request", http.StatusBadRequest)
 				return
 			}
 			share.ExpenseID = body.Expense.ID
 			share.ID = utils.GenerateUUID()
 			err := storage.AddShare(&share)
 			if err != nil {
+				log.Println("POST [api/expense] " + r.RemoteAddr + ": " + err.Error())
 				http.Error(w, "Error adding expense", http.StatusBadRequest) // Should never happen
 				return
 			}
 		}
 		err := storage.AddExpense(&body.Expense)
 		if err != nil {
+			log.Println("POST [api/expense] " + r.RemoteAddr + ": " + err.Error())
 			http.Error(w, "Error adding expense", http.StatusBadRequest)
 			return
 		}
@@ -59,13 +93,68 @@ func Expenses(w http.ResponseWriter, r *http.Request) {
 			"shares":  body.Shares,
 		})
 		if err != nil {
-			println(err.Error())
+			log.Println("POST [api/expense] " + r.RemoteAddr + ": " + err.Error())
 			return
 		}
+		log.Println("POST [api/expense] " + r.RemoteAddr + ": Successfully added expense and its shares")
 		break
 	case http.MethodPut: // -> Update Expense
 		break
 	case http.MethodDelete: // -> Delete Expense
+	default:
+		http.Error(w, "Invalid request method", http.StatusMethodNotAllowed)
+	}
+}
+func ExpenseShares(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		query := r.URL.Query()
+		idParam := query.Get("id")
+		idTypeParam := strings.ToLower(query.Get("idType"))
+		if idTypeParam == models.IDTypeEXPENSE {
+			println(idParam)
+			shares, err := storage.GetSharesByExpenseId(idParam)
+			if err != nil {
+				log.Println("GET [api/shares] " + r.RemoteAddr + ": " + err.Error())
+				http.Error(w, "Something went wrong", http.StatusInternalServerError)
+				return
+			}
+			w.Header().Set("Content-Type", "application/json")
+			err = json.NewEncoder(w).Encode(map[string]interface{}{
+				"shares": shares,
+			})
+			if err != nil {
+				log.Println("GET [api/shares] " + r.RemoteAddr + ": " + err.Error())
+				return
+			}
+			log.Println("GET [api/shares] " + r.RemoteAddr + ": Successfully retrieved shares")
+		} else if idTypeParam == models.IDTypeSHARE || idTypeParam == "" {
+			share, err := storage.GetShareById(idParam)
+			if err != nil {
+				log.Println("GET [api/shares] " + r.RemoteAddr + ": " + err.Error())
+				http.Error(w, "Something went wrong", http.StatusInternalServerError)
+				return
+			}
+			w.Header().Set("Content-Type", "application/json")
+			err = json.NewEncoder(w).Encode(map[string]interface{}{
+				"id":          share.ID,
+				"expense_id":  share.ExpenseID,
+				"user_id":     share.UserID,
+				"share_cents": share.ShareCents,
+			})
+			if err != nil {
+				log.Println("GET [api/shares] " + r.RemoteAddr + ": " + err.Error())
+				return
+			}
+			log.Println("GET [api/shares] " + r.RemoteAddr + ": Successfully retrieved shares")
+		}
+		break
+	case http.MethodPut:
+		break
+	case http.MethodDelete:
+		break
+	default:
+		http.Error(w, "Invalid request method", http.StatusMethodNotAllowed)
 	}
 }
 func AdminPanel(w http.ResponseWriter, r *http.Request) {}

main.go

@@ -7,17 +7,13 @@ import (
 )
 
 func main() {
-	var SERVER = server.InitServer()
+	var _server = server.InitServer()
 
-	err := storage.InitDB(SERVER.DatabasePath)
+	err := storage.InitDB(_server.DatabasePath)
 	if err != nil {
 		log.Fatal(err)
 		return
 	}
 
-	SERVER.Run()
+	_server.Run()
-}
-
-func Setup() {
-	//TODO: first configuration
 }

models/constants.go

@@ -0,0 +1,14 @@
+package models
+
+// Roles
+const (
+	RoleUser  = "user"
+	RoleAdmin = "admin"
+)
+
+// ID-Types
+const (
+	IDTypeSHARE   = "share"
+	IDTypeEXPENSE = "expense"
+	IDTypeUSER    = "user"
+)

models/loginmodels.go

@@ -1,11 +1,11 @@
 package models
 
 type RefreshToken struct {
-	ID         string `json:id`
+	ID         string `json:"id"`
-	UserID     string `json:userid`
+	UserID     string `json:"user_id"`
-	Token      string `json:token`
+	Token      string `json:"token"`
-	ExpiresAt  int64  `json:expiresat`
+	ExpiresAt  int64  `json:"expires_at"`
-	CreatedAt  int64  `json:createdat`
+	CreatedAt  int64  `json:"created_at"`
-	Revoked    bool   `json:revoked`
+	Revoked    bool   `json:"revoked"`
-	DeviceInfo string `json:deviceinfo`
+	DeviceInfo string `json:"device_info"`
 }

server/server.go

@@ -13,10 +13,10 @@ type Server struct {
 	Port            string
 	JWTSecret       []byte
 	DatabasePath    string
+	CertificatePath string
+	PrivateKeyPath  string
 }
 
-var cfg, _ = config.LoadConfig()
-
 func InitServer() *Server {
 
 	err := config.CheckIfExists()
@@ -45,6 +45,8 @@ func InitServer() *Server {
 		Port:            cfg.Port,
 		JWTSecret:       []byte(jwtSecret),
 		DatabasePath:    cfg.DatabasePath,
+		CertificatePath: cfg.CertificatePath,
+		PrivateKeyPath:  cfg.PrivateKeyPath,
 	}
 }
 
@@ -60,12 +62,14 @@ func (server *Server) Run() {
 
 	// Login required
 	mux.Handle("/api/expenses", auth.AuthMiddleware(server.JWTSecret)(http.HandlerFunc(handlers.Expenses)))
+	mux.Handle("/api/shares", auth.AuthMiddleware(server.JWTSecret)(http.HandlerFunc(handlers.ExpenseShares)))
 	mux.Handle("/api/balance", auth.AuthMiddleware(server.JWTSecret)(http.HandlerFunc(handlers.GetBalance)))
 	mux.Handle("/api/ping", auth.AuthMiddleware(server.JWTSecret)(http.HandlerFunc(handlers.TestHandler)))
+	mux.Handle("/api/userinfo", auth.AuthMiddleware(server.JWTSecret)(http.HandlerFunc(handlers.UserInfo)))
 
 	// Admin-only
 	mux.Handle("/api/admin", auth.AuthMiddleware(server.JWTSecret)(auth.RequireRole("admin")(http.HandlerFunc(handlers.AdminPanel))))
 
 	log.Printf("Listening on port %s", server.Port)
-	log.Fatal(http.ListenAndServe(":"+server.Port, mux))
+	log.Fatal(http.ListenAndServeTLS(":"+server.Port, server.CertificatePath, server.PrivateKeyPath, mux))
 }

storage/storage.go

@@ -120,7 +120,35 @@ func GetExpensesByUserId(userId string) ([]models.Expense, error) {
 	return nil, nil
 }
 func GetAllExpenses() ([]models.Expense, error) {
-	return nil, nil
+	query := "SELECT * FROM expenses"
+	rows, err := DB.Query(query)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var expenses []models.Expense
+
+	for rows.Next() {
+		var expense models.Expense
+		var attachmentsJSON []byte
+
+		err := rows.Scan(&expense.ID, &expense.PayerID, &expense.Amount, &expense.Title, &expense.Description, &attachmentsJSON, &expense.CreatedAt, &expense.LastUpdatedAt)
+		if err != nil {
+			return nil, err
+		}
+		if len(attachmentsJSON) > 0 {
+			err := json.Unmarshal(attachmentsJSON, &expense.Attachments)
+			if err != nil {
+				return nil, err
+			}
+		}
+		expenses = append(expenses, expense)
+	}
+	if err = rows.Err(); err != nil {
+		return nil, err
+	}
+	return expenses, nil
 }
 
 // Expense Shares
@@ -132,6 +160,84 @@ func AddShare(share *models.ExpenseShare) error {
 		share.ShareCents)
 	return err
 }
+func GetShareById(id string) (models.ExpenseShare, error) {
+	row := DB.QueryRow("SELECT * FROM expense_shares WHERE id = ?", id)
+	var share models.ExpenseShare
+	err := row.Scan(&share.ID, &share.ExpenseID, &share.UserID, &share.ShareCents)
+	return share, err
+}
+func GetSharesByExpenseId(id string) ([]models.ExpenseShare, error) {
+	query := "SELECT * FROM expense_shares WHERE expense_id = ?"
+	rows, err := DB.Query(query, id)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var shares []models.ExpenseShare
+
+	for rows.Next() {
+		var share models.ExpenseShare
+
+		err := rows.Scan(&share.ID, &share.ExpenseID, &share.UserID, &share.ShareCents)
+		if err != nil {
+			return nil, err
+		}
+		shares = append(shares, share)
+	}
+	if err = rows.Err(); err != nil {
+		return nil, err
+	}
+	return shares, nil
+}
+
+// Balances
+func ComputeBalance(userId string) (float64, error) {
+	var balance float64
+	query := `
+		SELECT 
+			COALESCE(p.paid, 0) - COALESCE(s.shared, 0) AS balance
+		FROM (SELECT ? AS id) u
+		LEFT JOIN (
+			SELECT payer_id, SUM(amount_cents) AS paid 
+			FROM expenses 
+			WHERE payer_id = ?
+			GROUP BY payer_id
+		) p ON u.id = p.payer_id
+		LEFT JOIN (
+			SELECT user_id, SUM(share_cents) AS shared 
+			FROM expense_shares 
+			WHERE user_id = ?
+			GROUP BY user_id
+		) s ON u.id = s.user_id`
+	err := DB.QueryRow(query, userId, userId, userId).Scan(&balance)
+	if err != nil {
+		return 0, err
+	}
+	return balance, nil
+}
+func ComputeWGBalance() (float64, error) {
+	var balance float64
+	query := `SELECT u.id AS user_id,
+       COALESCE(p.paid_cents,0) - COALESCE(s.share_cents,0) AS balance_cents
+FROM users u
+LEFT JOIN (
+    SELECT payer_id, SUM(amount_cents) AS paid_cents
+    FROM expenses
+    GROUP BY payer_id
+) p ON u.id = p.payer_id
+LEFT JOIN (
+    SELECT es.user_id, SUM(es.share_cents) AS share_cents
+    FROM expense_shares es
+    JOIN expenses e ON es.expense_id = e.id
+    GROUP BY es.user_id
+) s ON u.id = s.user_id)`
+	err := DB.QueryRow(query).Scan(&balance)
+	if err != nil {
+		return 0, err
+	}
+	return balance, nil
+}
 
 // Users
 func AddUser(user *models.User) error {