feat(backend): Prisma schema, Express routes, audit middleware, error handling

backend/src/routes/experiments.js

@@ -0,0 +1,94 @@
+const router = require('express').Router();
+const { body } = require('express-validator');
+const prisma = require('../lib/prisma');
+const auditMiddleware = require('../middleware/auditMiddleware');
+const { validateRequest } = require('../middleware/errorHandler');
+
+const experimentValidation = [
+  body('title').trim().notEmpty().withMessage('Title is required').isLength({ max: 255 }).withMessage('Title must be ≤255 characters'),
+];
+
+// GET /api/experiments — list all
+router.get('/', async (req, res, next) => {
+  try {
+    const experiments = await prisma.experiment.findMany({
+      orderBy: { created_at: 'desc' },
+      include: { _count: { select: { animals: true } } },
+    });
+    res.json(experiments);
+  } catch (err) {
+    next(err);
+  }
+});
+
+// GET /api/experiments/:id — get one with animals
+router.get('/:id', async (req, res, next) => {
+  try {
+    const experiment = await prisma.experiment.findUnique({
+      where: { id: req.params.id },
+      include: { animals: true },
+    });
+    if (!experiment) return res.status(404).json({ error: 'Experiment not found' });
+    res.json(experiment);
+  } catch (err) {
+    next(err);
+  }
+});
+
+// POST /api/experiments — create
+router.post('/', experimentValidation, validateRequest, async (req, res, next) => {
+  try {
+    const { title } = req.body;
+    const experiment = await prisma.experiment.create({ data: { title } });
+
+    // Write CREATE audit log
+    await prisma.auditLog.create({
+      data: {
+        table_name: 'experiments',
+        record_id: experiment.id,
+        action: 'CREATE',
+        changes: { before: null, after: experiment },
+      },
+    });
+
+    res.status(201).json(experiment);
+  } catch (err) {
+    next(err);
+  }
+});
+
+// PUT /api/experiments/:id — update
+router.put(
+  '/:id',
+  auditMiddleware('experiments', prisma.experiment),
+  experimentValidation,
+  validateRequest,
+  async (req, res, next) => {
+    try {
+      const { title } = req.body;
+      const experiment = await prisma.experiment.update({
+        where: { id: req.params.id },
+        data: { title },
+      });
+      res.json(experiment);
+    } catch (err) {
+      next(err);
+    }
+  }
+);
+
+// DELETE /api/experiments/:id — delete
+router.delete(
+  '/:id',
+  auditMiddleware('experiments', prisma.experiment),
+  async (req, res, next) => {
+    try {
+      await prisma.experiment.delete({ where: { id: req.params.id } });
+      res.status(204).send();
+    } catch (err) {
+      next(err);
+    }
+  }
+);
+
+module.exports = router;