# Prompt for the vt-api agent — let any signed-in user list a booking place

> Paste everything below the line into the Claude session working on `vt-api`.

---

You are working on **vt-api**, the Node.js + Express + MongoDB backend of **Viață la Țară**. The Flutter
client follows `FLUTTER_ALIGNMENT.md` as the contract. Read the whole brief before changing anything.

## 1. Problem

A person who signs up to rent out a cabin or a guesthouse cannot list it. `/my-locations` is 🏪
(`business` or `admin` only), and the only way to become `business` is a **producer** application
(`POST /partner/apply`) — which asks for a farm, categories, etc. Hosts aren't producers, so they are stuck
as `client`.

Every booking place already goes through admin moderation on its own (`pending` → `approved` /
`rejected`, request-info, per-section review), so the business role adds no protection here.

## 2. Change

**Open `/my-locations` to every signed-in user** (`client`, `business`, `admin`). The role does not change.

| Method & path | Auth today | Auth after |
|---|---|---|
| `GET /my-locations` | 🏪 | 🔑 any signed-in user — returns the caller's own places (`[]` if none) |
| `POST /my-locations` | 🏪 | 🔑 — creates a place owned by the caller, `status: pending` |
| `PUT /my-locations/:id` | 🏪 | 🔑 — own places only (404 `Cazarea nu a fost găsită.` otherwise, as today) |
| `DELETE /my-locations/:id` | 🏪 | 🔑 — own places only |

Everything else stays as it is: request/response bodies, validation, moderation, `moderationNote` and
`sections` on these responses, admin endpoints.

Check that the rest of the booking flow keys on **ownership (`userId`), not on the role**, and fix any spot
that doesn't:

- `GET /booking-places/:id` — the owner can preview a non-approved place (§3) even as a `client`.
- Reviews — a `client` owner can't review their own place (403 as for business owners).
- Chat — `POST /chat/threads` with `participantType: "bookingPlace"` reaches the owner whatever their role;
  the owner can't open a thread with their own place.
- Admin approve / reject / request-info / sections on booking places — unchanged; the owner (any role)
  gets the push/notification the same way.

Do **not** promote hosts to `business`: that role unlocks `/shop/*` (producer features), which they
shouldn't get.

## 3. Contract rules — do not break these

- Envelope `{ data, error }` on every response; `error.message` in Romanian, shown verbatim.
- Additive only: existing business/admin behaviour on `/my-locations` is unchanged.

## 4. Tests to add

1. `client` → `GET /my-locations` → 200 `[]`.
2. `client` → `POST /my-locations` (valid body) → 201, `status: pending`, `userId` = caller.
3. `client` → `PUT` / `DELETE` own place → 200; someone else's place → 404.
4. `client` owner → `GET /booking-places/:id` of their pending place → 200; another `client` → 404.
5. `client` owner → `POST /reviews` on own place → 403.
6. Anonymous → `/my-locations` → 401.
7. `business` and `admin` behaviour unchanged (existing tests stay green).

## 5. Documentation

Update `FLUTTER_ALIGNMENT.md`:

- §5.15 heading: `/my-locations` 🔑 (any signed-in user), with one line saying hosts stay `client`.
- §2 roles: `client` can host booking places; `business` = approved producer.
- §9 changelog row and a §10 checklist line ("Profile shows 'Listează o cazare' to clients").

## 6. Report back

Reply with what you changed, any place that keyed on the role and how you fixed it, and the test results.