Merge branch 'master' of https://gitea.nas.culak.sk/roman/CalendarReminder

.dockerignore

@@ -0,0 +1,5 @@
+./CalendarReminder.Api/appsettings.json
+./CalendarReminder.Api/appsettings.Development.json
+.gitea
+Dockerfile
+docker-compose.yml

.env.example

@@ -1,6 +1,10 @@
 # Skopíruj tento súbor ako .env a vyplň hodnoty
 # cp .env.example .env
 
+# Docker Hub
+DOCKERHUB_USERNAME=
+WATCHTOWER_TOKEN=
+
 # Databáza
 DB_SERVER=192.168.1.68
 DB_PORT=3306

.gitea/workflows/docker-build.yaml

@@ -0,0 +1,37 @@
+name: Build and Push Docker Image
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and Push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ${{ secrets.DOCKERHUB_USERNAME }}/calendarreminder-app:latest
+          cache-from: type=registry,ref=${{ secrets.DOCKERHUB_USERNAME }}/calendarreminder-app:buildcache
+          cache-to: type=registry,ref=${{ secrets.DOCKERHUB_USERNAME }}/calendarreminder-app:buildcache,mode=max
+
+      - name: Trigger Watchtower deploy
+        run: |
+          curl -sf \
+            -H "Authorization: Bearer ${{ secrets.WATCHTOWER_TOKEN }}" \
+            http://${{ secrets.TRUENAS_IP }}:8085/v1/update

.idea/.gitignore

@@ -0,0 +1,10 @@
+# Default ignored files
+/shelf/
+/workspace.xml
+# Ignored default folder with query files
+/queries/
+# Datasource local storage ignored files
+/dataSources/
+/dataSources.local.xml
+# Editor-based HTTP Client requests
+/httpRequests/

CalendarReminder.Api/Controllers/AdminController.cs

@@ -0,0 +1,176 @@
+using CalendarReminder.Api.Data;
+using CalendarReminder.Api.Services;
+using CalendarReminder.Domain.Entities;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace CalendarReminder.Api.Controllers;
+
+[Authorize]
+[ApiController]
+[Route("api/admin")]
+public class AdminController : ControllerBase
+{
+    private readonly AppDbContext _db;
+    private readonly EmailService _email;
+
+    public AdminController(AppDbContext db, EmailService email)
+    {
+        _db = db;
+        _email = email;
+    }
+
+    private bool IsAdmin => User.FindFirst("isAdmin")?.Value == "true";
+
+    // ══════════════════════════════
+    //  RODINY
+    // ══════════════════════════════
+
+    [HttpGet("families")]
+    public async Task<IActionResult> GetFamilies()
+    {
+        if (!IsAdmin) return Forbid();
+        var families = await _db.Families
+            .Include(f => f.Users)
+            .Select(f => new { f.Id, f.Name, MemberCount = f.Users.Count })
+            .ToListAsync();
+        return Ok(families);
+    }
+
+    [HttpPost("families")]
+    public async Task<IActionResult> CreateFamily([FromBody] FamilyRequest req)
+    {
+        if (!IsAdmin) return Forbid();
+        if (await _db.Families.AnyAsync(f => f.Name == req.Name))
+            return BadRequest("Rodina s týmto názvom už existuje.");
+        var family = new Family { Name = req.Name };
+        _db.Families.Add(family);
+        await _db.SaveChangesAsync();
+        return Ok(new { family.Id, family.Name, MemberCount = 0 });
+    }
+
+    [HttpPut("families/{id}")]
+    public async Task<IActionResult> UpdateFamily(int id, [FromBody] FamilyRequest req)
+    {
+        if (!IsAdmin) return Forbid();
+        var family = await _db.Families.FindAsync(id);
+        if (family is null) return NotFound();
+        if (await _db.Families.AnyAsync(f => f.Name == req.Name && f.Id != id))
+            return BadRequest("Názov je obsadený.");
+        family.Name = req.Name;
+        await _db.SaveChangesAsync();
+        return Ok(family);
+    }
+
+    [HttpDelete("families/{id}")]
+    public async Task<IActionResult> DeleteFamily(int id)
+    {
+        if (!IsAdmin) return Forbid();
+        var family = await _db.Families.Include(f => f.Users).FirstOrDefaultAsync(f => f.Id == id);
+        if (family is null) return NotFound();
+        if (family.Users.Any()) return BadRequest("Rodina má členov. Najprv presun alebo odstraň používateľov.");
+        _db.Families.Remove(family);
+        await _db.SaveChangesAsync();
+        return NoContent();
+    }
+
+    // ══════════════════════════════
+    //  POUŽÍVATELIA
+    // ══════════════════════════════
+
+    [HttpGet("users")]
+    public async Task<IActionResult> GetUsers()
+    {
+        if (!IsAdmin) return Forbid();
+        var users = await _db.Users
+            .Include(u => u.Family)
+            .Select(u => new {
+                u.Id, u.Username, u.Email, u.IsAdmin,
+                u.MustChangePassword, u.CreatedAt,
+                FamilyId   = u.FamilyId,
+                FamilyName = u.Family != null ? u.Family.Name : null
+            })
+            .ToListAsync();
+        return Ok(users);
+    }
+
+    [HttpPost("users")]
+    public async Task<IActionResult> CreateUser([FromBody] CreateUserRequest req)
+    {
+        if (!IsAdmin) return Forbid();
+        if (await _db.Users.AnyAsync(u => u.Email == req.Email))
+            return BadRequest("Email je už registrovaný.");
+        if (await _db.Users.AnyAsync(u => u.Username == req.Username))
+            return BadRequest("Meno je obsadené.");
+
+        var user = new User
+        {
+            Username = req.Username,
+            Email    = req.Email,
+            FamilyId = req.FamilyId,
+            PasswordHash = BCrypt.Net.BCrypt.HashPassword("user"),
+            MustChangePassword = true
+        };
+        _db.Users.Add(user);
+        await _db.SaveChangesAsync();
+
+        // Email notifikácia
+        await _email.SendAsync(req.Email, req.Username,
+            "👋 Vítaj v Calendar Reminder — bol ti vytvorený účet",
+            $"""
+            <div style="font-family:Segoe UI,sans-serif;max-width:520px;margin:auto;background:#161b22;color:#e1e4e8;border-radius:10px;overflow:hidden">
+              <div style="background:#238636;padding:1.2rem 1.5rem">
+                <h2 style="margin:0;color:#fff;font-size:1.1rem">👋 Bol ti vytvorený účet</h2>
+              </div>
+              <div style="padding:1.5rem">
+                <p style="margin:0 0 1rem">Ahoj <strong>{req.Username}</strong>, bol ti vytvorený účet v aplikácii <strong>Calendar Reminder</strong>.</p>
+                <table style="width:100%;border-collapse:collapse">
+                  <tr><td style="padding:0.4rem 0;color:#8b949e;width:80px">Meno</td><td style="padding:0.4rem 0;font-weight:600">{req.Username}</td></tr>
+                  <tr><td style="padding:0.4rem 0;color:#8b949e">Email</td><td style="padding:0.4rem 0;font-weight:600">{req.Email}</td></tr>
+                  <tr><td style="padding:0.4rem 0;color:#8b949e">Heslo</td><td style="padding:0.4rem 0;font-weight:600">user</td></tr>
+                </table>
+                <p style="margin:1.25rem 0 0;color:#8b949e;font-size:0.88rem">Po prvom prihlásení ťa aplikácia vyzve na zmenu hesla.</p>
+              </div>
+              <div style="padding:0.75rem 1.5rem;border-top:1px solid #30363d;font-size:0.78rem;color:#6e7681">Calendar Reminder</div>
+            </div>
+            """);
+
+        return Ok(new { user.Id, user.Username, user.Email, user.FamilyId, user.MustChangePassword });
+    }
+
+    [HttpPut("users/{id}")]
+    public async Task<IActionResult> UpdateUser(int id, [FromBody] UpdateUserRequest req)
+    {
+        if (!IsAdmin) return Forbid();
+        var user = await _db.Users.FindAsync(id);
+        if (user is null) return NotFound();
+        if (await _db.Users.AnyAsync(u => u.Email == req.Email && u.Id != id))
+            return BadRequest("Email je obsadený.");
+        if (await _db.Users.AnyAsync(u => u.Username == req.Username && u.Id != id))
+            return BadRequest("Meno je obsadené.");
+
+        user.Username = req.Username;
+        user.Email    = req.Email;
+        user.FamilyId = req.FamilyId;
+        await _db.SaveChangesAsync();
+        return Ok(new { user.Id, user.Username, user.Email, user.FamilyId });
+    }
+
+    [HttpDelete("users/{id}")]
+    public async Task<IActionResult> DeleteUser(int id)
+    {
+        if (!IsAdmin) return Forbid();
+        var myId = int.Parse(User.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)!.Value);
+        if (id == myId) return BadRequest("Nemôžeš zmazať sám seba.");
+        var user = await _db.Users.FindAsync(id);
+        if (user is null) return NotFound();
+        _db.Users.Remove(user);
+        await _db.SaveChangesAsync();
+        return NoContent();
+    }
+}
+
+public record FamilyRequest(string Name);
+public record CreateUserRequest(string Username, string Email, int? FamilyId);
+public record UpdateUserRequest(string Username, string Email, int? FamilyId);

CalendarReminder.Api/Controllers/AuthController.cs

@@ -41,7 +41,7 @@ public class AuthController : ControllerBase
         await _db.SaveChangesAsync();
 
         var token = _tokenService.GenerateToken(user);
-        return Ok(new AuthResponse(token, user.Username, user.Email));
+        return Ok(new AuthResponse(token, user.Username, user.Email, user.IsAdmin, user.MustChangePassword));
     }
 
     // POST api/auth/login
@@ -56,7 +56,7 @@ public class AuthController : ControllerBase
             return Unauthorized("Nesprávny email/meno alebo heslo.");
 
         var token = _tokenService.GenerateToken(user);
-        return Ok(new AuthResponse(token, user.Username, user.Email));
+        return Ok(new AuthResponse(token, user.Username, user.Email, user.IsAdmin, user.MustChangePassword));
     }
 
     // POST api/auth/send-reset-code
@@ -126,7 +126,8 @@ public class AuthController : ControllerBase
             resetToken.Used = true;
         }
 
-        user.PasswordHash = BCrypt.Net.BCrypt.HashPassword(req.NewPassword);
+        user.PasswordHash       = BCrypt.Net.BCrypt.HashPassword(req.NewPassword);
+        user.MustChangePassword = false;
         await _db.SaveChangesAsync();
 
         return Ok("Heslo bolo úspešne zmenené.");

CalendarReminder.Api/Data/AppDbContext.cs

@@ -9,6 +9,7 @@ public class AppDbContext : DbContext
 
     public DbSet<Reminder> Reminders => Set<Reminder>();
     public DbSet<User> Users => Set<User>();
+    public DbSet<Family> Families => Set<Family>();
     public DbSet<ReminderShare> ReminderShares => Set<ReminderShare>();
     public DbSet<PasswordResetToken> PasswordResetTokens => Set<PasswordResetToken>();
 
@@ -32,6 +33,17 @@ public class AppDbContext : DbContext
             entity.HasIndex(e => e.Username).IsUnique();
             entity.Property(e => e.Email).IsRequired().HasMaxLength(200);
             entity.Property(e => e.Username).IsRequired().HasMaxLength(100);
+            entity.HasOne(e => e.Family)
+                  .WithMany(f => f.Users)
+                  .HasForeignKey(e => e.FamilyId)
+                  .OnDelete(DeleteBehavior.SetNull);
+        });
+
+        modelBuilder.Entity<Family>(entity =>
+        {
+            entity.HasKey(e => e.Id);
+            entity.HasIndex(e => e.Name).IsUnique();
+            entity.Property(e => e.Name).IsRequired().HasMaxLength(100);
         });
 
         modelBuilder.Entity<ReminderShare>(entity =>

CalendarReminder.Api/Migrations/20260611172823_AddFamilyAndAdminFields.Designer.cs

@@ -0,0 +1,243 @@
+// <auto-generated />
+using System;
+using CalendarReminder.Api.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Metadata;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace CalendarReminder.Api.Migrations
+{
+    [DbContext(typeof(AppDbContext))]
+    [Migration("20260611172823_AddFamilyAndAdminFields")]
+    partial class AddFamilyAndAdminFields
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "9.0.0")
+                .HasAnnotation("Relational:MaxIdentifierLength", 64);
+
+            MySqlModelBuilderExtensions.AutoIncrementColumns(modelBuilder);
+
+            modelBuilder.Entity("CalendarReminder.Domain.Entities.Family", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("int");
+
+                    MySqlPropertyBuilderExtensions.UseMySqlIdentityColumn(b.Property<int>("Id"));
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("varchar(100)");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("Families");
+                });
+
+            modelBuilder.Entity("CalendarReminder.Domain.Entities.PasswordResetToken", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("int");
+
+                    MySqlPropertyBuilderExtensions.UseMySqlIdentityColumn(b.Property<int>("Id"));
+
+                    b.Property<string>("Code")
+                        .IsRequired()
+                        .HasColumnType("longtext");
+
+                    b.Property<string>("Email")
+                        .IsRequired()
+                        .HasColumnType("longtext");
+
+                    b.Property<DateTime>("ExpiresAt")
+                        .HasColumnType("datetime(6)");
+
+                    b.Property<bool>("Used")
+                        .HasColumnType("tinyint(1)");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("PasswordResetTokens");
+                });
+
+            modelBuilder.Entity("CalendarReminder.Domain.Entities.Reminder", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("int");
+
+                    MySqlPropertyBuilderExtensions.UseMySqlIdentityColumn(b.Property<int>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("datetime(6)");
+
+                    b.Property<string>("Description")
+                        .HasMaxLength(1000)
+                        .HasColumnType("varchar(1000)");
+
+                    b.Property<bool>("IsCompleted")
+                        .HasColumnType("tinyint(1)");
+
+                    b.Property<bool>("NotificationSent")
+                        .HasColumnType("tinyint(1)");
+
+                    b.Property<DateTime>("ReminderDate")
+                        .HasColumnType("datetime(6)");
+
+                    b.Property<string>("Title")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("varchar(200)");
+
+                    b.Property<int>("UserId")
+                        .HasColumnType("int");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("Reminders");
+                });
+
+            modelBuilder.Entity("CalendarReminder.Domain.Entities.ReminderShare", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("int");
+
+                    MySqlPropertyBuilderExtensions.UseMySqlIdentityColumn(b.Property<int>("Id"));
+
+                    b.Property<int>("ReminderId")
+                        .HasColumnType("int");
+
+                    b.Property<int>("SharedWithUserId")
+                        .HasColumnType("int");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("SharedWithUserId");
+
+                    b.HasIndex("ReminderId", "SharedWithUserId")
+                        .IsUnique();
+
+                    b.ToTable("ReminderShares");
+                });
+
+            modelBuilder.Entity("CalendarReminder.Domain.Entities.User", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("int");
+
+                    MySqlPropertyBuilderExtensions.UseMySqlIdentityColumn(b.Property<int>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("datetime(6)");
+
+                    b.Property<string>("Email")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("varchar(200)");
+
+                    b.Property<int?>("FamilyId")
+                        .HasColumnType("int");
+
+                    b.Property<bool>("IsAdmin")
+                        .HasColumnType("tinyint(1)");
+
+                    b.Property<bool>("MustChangePassword")
+                        .HasColumnType("tinyint(1)");
+
+                    b.Property<string>("PasswordHash")
+                        .IsRequired()
+                        .HasColumnType("longtext");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("varchar(100)");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Email")
+                        .IsUnique();
+
+                    b.HasIndex("FamilyId");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("CalendarReminder.Domain.Entities.Reminder", b =>
+                {
+                    b.HasOne("CalendarReminder.Domain.Entities.User", "User")
+                        .WithMany("Reminders")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("CalendarReminder.Domain.Entities.ReminderShare", b =>
+                {
+                    b.HasOne("CalendarReminder.Domain.Entities.Reminder", "Reminder")
+                        .WithMany("Shares")
+                        .HasForeignKey("ReminderId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("CalendarReminder.Domain.Entities.User", "SharedWithUser")
+                        .WithMany()
+                        .HasForeignKey("SharedWithUserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Reminder");
+
+                    b.Navigation("SharedWithUser");
+                });
+
+            modelBuilder.Entity("CalendarReminder.Domain.Entities.User", b =>
+                {
+                    b.HasOne("CalendarReminder.Domain.Entities.Family", "Family")
+                        .WithMany("Users")
+                        .HasForeignKey("FamilyId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.Navigation("Family");
+                });
+
+            modelBuilder.Entity("CalendarReminder.Domain.Entities.Family", b =>
+                {
+                    b.Navigation("Users");
+                });
+
+            modelBuilder.Entity("CalendarReminder.Domain.Entities.Reminder", b =>
+                {
+                    b.Navigation("Shares");
+                });
+
+            modelBuilder.Entity("CalendarReminder.Domain.Entities.User", b =>
+                {
+                    b.Navigation("Reminders");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

CalendarReminder.Api/Migrations/20260611172823_AddFamilyAndAdminFields.cs

@@ -0,0 +1,96 @@
+using Microsoft.EntityFrameworkCore.Metadata;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace CalendarReminder.Api.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddFamilyAndAdminFields : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<int>(
+                name: "FamilyId",
+                table: "Users",
+                type: "int",
+                nullable: true);
+
+            migrationBuilder.AddColumn<bool>(
+                name: "IsAdmin",
+                table: "Users",
+                type: "tinyint(1)",
+                nullable: false,
+                defaultValue: false);
+
+            migrationBuilder.AddColumn<bool>(
+                name: "MustChangePassword",
+                table: "Users",
+                type: "tinyint(1)",
+                nullable: false,
+                defaultValue: false);
+
+            migrationBuilder.CreateTable(
+                name: "Families",
+                columns: table => new
+                {
+                    Id = table.Column<int>(type: "int", nullable: false)
+                        .Annotation("MySql:ValueGenerationStrategy", MySqlValueGenerationStrategy.IdentityColumn),
+                    Name = table.Column<string>(type: "varchar(100)", maxLength: 100, nullable: false)
+                        .Annotation("MySql:CharSet", "utf8mb4")
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_Families", x => x.Id);
+                })
+                .Annotation("MySql:CharSet", "utf8mb4");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_Users_FamilyId",
+                table: "Users",
+                column: "FamilyId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_Families_Name",
+                table: "Families",
+                column: "Name",
+                unique: true);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_Users_Families_FamilyId",
+                table: "Users",
+                column: "FamilyId",
+                principalTable: "Families",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.SetNull);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_Users_Families_FamilyId",
+                table: "Users");
+
+            migrationBuilder.DropTable(
+                name: "Families");
+
+            migrationBuilder.DropIndex(
+                name: "IX_Users_FamilyId",
+                table: "Users");
+
+            migrationBuilder.DropColumn(
+                name: "FamilyId",
+                table: "Users");
+
+            migrationBuilder.DropColumn(
+                name: "IsAdmin",
+                table: "Users");
+
+            migrationBuilder.DropColumn(
+                name: "MustChangePassword",
+                table: "Users");
+        }
+    }
+}

CalendarReminder.Api/Migrations/AppDbContextModelSnapshot.cs

@@ -22,6 +22,27 @@ namespace CalendarReminder.Api.Migrations
 
             MySqlModelBuilderExtensions.AutoIncrementColumns(modelBuilder);
 
+            modelBuilder.Entity("CalendarReminder.Domain.Entities.Family", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("int");
+
+                    MySqlPropertyBuilderExtensions.UseMySqlIdentityColumn(b.Property<int>("Id"));
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("varchar(100)");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("Families");
+                });
+
             modelBuilder.Entity("CalendarReminder.Domain.Entities.PasswordResetToken", b =>
                 {
                     b.Property<int>("Id")
@@ -128,6 +149,15 @@ namespace CalendarReminder.Api.Migrations
                         .HasMaxLength(200)
                         .HasColumnType("varchar(200)");
 
+                    b.Property<int?>("FamilyId")
+                        .HasColumnType("int");
+
+                    b.Property<bool>("IsAdmin")
+                        .HasColumnType("tinyint(1)");
+
+                    b.Property<bool>("MustChangePassword")
+                        .HasColumnType("tinyint(1)");
+
                     b.Property<string>("PasswordHash")
                         .IsRequired()
                         .HasColumnType("longtext");
@@ -142,6 +172,8 @@ namespace CalendarReminder.Api.Migrations
                     b.HasIndex("Email")
                         .IsUnique();
 
+                    b.HasIndex("FamilyId");
+
                     b.HasIndex("Username")
                         .IsUnique();
 
@@ -178,6 +210,21 @@ namespace CalendarReminder.Api.Migrations
                     b.Navigation("SharedWithUser");
                 });
 
+            modelBuilder.Entity("CalendarReminder.Domain.Entities.User", b =>
+                {
+                    b.HasOne("CalendarReminder.Domain.Entities.Family", "Family")
+                        .WithMany("Users")
+                        .HasForeignKey("FamilyId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.Navigation("Family");
+                });
+
+            modelBuilder.Entity("CalendarReminder.Domain.Entities.Family", b =>
+                {
+                    b.Navigation("Users");
+                });
+
             modelBuilder.Entity("CalendarReminder.Domain.Entities.Reminder", b =>
                 {
                     b.Navigation("Shares");

CalendarReminder.Api/Models/AuthModels.cs

@@ -2,4 +2,4 @@ namespace CalendarReminder.Api.Models;
 
 public record RegisterRequest(string Username, string Email, string Password);
 public record LoginRequest(string Email, string Password);
-public record AuthResponse(string Token, string Username, string Email);
+public record AuthResponse(string Token, string Username, string Email, bool IsAdmin, bool MustChangePassword);

CalendarReminder.Api/Program.cs

@@ -52,8 +52,9 @@ using (var scope = app.Services.CreateScope())
         db.Users.Add(new CalendarReminder.Domain.Entities.User
         {
             Username = "admin",
-            Email    = "admin@local",
-            PasswordHash = BCrypt.Net.BCrypt.HashPassword("admin")
+            Email    = "nas@culak.sk",
+            PasswordHash = BCrypt.Net.BCrypt.HashPassword("Admin@2025"),
+            IsAdmin  = true
         });
         db.SaveChanges();
     }

CalendarReminder.Api/Services/TokenService.cs

@@ -24,7 +24,9 @@ public class TokenService
         {
             new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
             new Claim(ClaimTypes.Name, user.Username),
-            new Claim(ClaimTypes.Email, user.Email)
+            new Claim(ClaimTypes.Email, user.Email),
+            new Claim("isAdmin", user.IsAdmin.ToString().ToLower()),
+            new Claim("mustChangePassword", user.MustChangePassword.ToString().ToLower())
         };
 
         var token = new JwtSecurityToken(

CalendarReminder.Api/wwwroot/index.html

@@ -102,6 +102,114 @@
     }
     .btn-logout:hover { border-color: #f85149; color: #f85149; }
 
+    /* ── AVATAR DROPDOWN ── */
+    .avatar-wrap { position: relative; }
+    .topbar-avatar { cursor: pointer; transition: box-shadow 0.15s; }
+    .topbar-avatar:hover { box-shadow: 0 0 0 2px #388bfd; }
+    .avatar-menu {
+      display: none; position: absolute; top: calc(100% + 8px); right: 0;
+      background: #1c1f2e; border: 1px solid #30363d; border-radius: 9px;
+      min-width: 180px; z-index: 500;
+      box-shadow: 0 8px 24px rgba(0,0,0,0.55);
+      overflow: hidden;
+    }
+    .avatar-menu.open { display: block; }
+    .avatar-menu-item {
+      display: flex; align-items: center; gap: 0.6rem;
+      padding: 0.62rem 1rem; font-size: 0.85rem; color: #c9d1d9;
+      cursor: pointer; transition: background 0.12s; border: none;
+      background: none; width: 100%; text-align: left;
+    }
+    .avatar-menu-item:hover { background: #30363d; }
+    .avatar-menu-item .mi-icon { font-size: 1rem; }
+    .avatar-menu-sep { border: none; border-top: 1px solid #30363d; margin: 3px 0; }
+
+    /* ── ADMIN PANEL ── */
+    .admin-overlay {
+      display: none; position: fixed; inset: 0;
+      background: rgba(0,0,0,0.7); z-index: 600;
+      align-items: flex-start; justify-content: center;
+      overflow-y: auto; padding: 2rem 1rem;
+    }
+    .admin-overlay.open { display: flex; }
+    .admin-panel {
+      background: #161b22; border: 1px solid #30363d; border-radius: 14px;
+      width: 100%; max-width: 820px;
+      box-shadow: 0 12px 48px rgba(0,0,0,0.7);
+      display: flex; flex-direction: column;
+      min-height: 0;
+    }
+    .admin-head {
+      display: flex; align-items: center; gap: 1rem;
+      padding: 1rem 1.5rem; border-bottom: 1px solid #30363d; flex-shrink: 0;
+    }
+    .admin-head h2 { font-size: 1rem; color: #c9d1d9; margin: 0; flex: 1; }
+    .btn-admin-close {
+      background: none; border: none; color: #6e7681; cursor: pointer;
+      font-size: 1.2rem; line-height: 1; padding: 2px;
+      transition: color 0.12s;
+    }
+    .btn-admin-close:hover { color: #f85149; }
+    .admin-tabs {
+      display: flex; gap: 0; border-bottom: 1px solid #30363d; flex-shrink: 0;
+    }
+    .admin-tab {
+      padding: 0.62rem 1.25rem; font-size: 0.85rem; color: #8b949e;
+      cursor: pointer; background: none; border: none;
+      border-bottom: 2px solid transparent; transition: all 0.12s;
+      font-weight: 500;
+    }
+    .admin-tab:hover { color: #c9d1d9; }
+    .admin-tab.active { color: #58a6ff; border-bottom-color: #58a6ff; }
+    .admin-body { padding: 1.25rem 1.5rem; flex: 1; }
+    .admin-section { display: none; }
+    .admin-section.active { display: block; }
+    .admin-toolbar {
+      display: flex; align-items: center; justify-content: space-between;
+      margin-bottom: 1rem;
+    }
+    .admin-toolbar h3 { font-size: 0.9rem; color: #8b949e; font-weight: 700; text-transform: uppercase; letter-spacing: 0.5px; margin: 0; }
+    .btn-admin-add {
+      padding: 0.38rem 0.9rem; background: #238636; border: none; border-radius: 6px;
+      color: #fff; font-size: 0.82rem; font-weight: 600; cursor: pointer; transition: background 0.15s;
+    }
+    .btn-admin-add:hover { background: #2ea043; }
+    .admin-table { width: 100%; border-collapse: collapse; font-size: 0.85rem; }
+    .admin-table th {
+      text-align: left; color: #6e7681; font-size: 0.74rem; text-transform: uppercase;
+      letter-spacing: 0.4px; padding: 0.4rem 0.75rem; border-bottom: 1px solid #21262d;
+    }
+    .admin-table td { padding: 0.55rem 0.75rem; border-bottom: 1px solid #21262d; color: #c9d1d9; vertical-align: middle; }
+    .admin-table tr:last-child td { border-bottom: none; }
+    .admin-table tr:hover td { background: #1c1f2e; }
+    .td-actions { display: flex; gap: 0.4rem; }
+    .btn-tbl { padding: 0.22rem 0.6rem; border-radius: 5px; font-size: 0.76rem; cursor: pointer; border: 1px solid; transition: all 0.12s; }
+    .btn-tbl-edit { border-color: #1f6feb55; color: #58a6ff; background: #1f6feb10; }
+    .btn-tbl-edit:hover { background: #1f6feb33; }
+    .btn-tbl-del { border-color: #f8514955; color: #f85149; background: #f8514910; }
+    .btn-tbl-del:hover { background: #f8514930; }
+    .badge-admin { padding: 1px 7px; border-radius: 8px; font-size: 0.72rem; font-weight: 700; background: #1f6feb22; color: #388bfd; }
+    .badge-mustchange { padding: 1px 7px; border-radius: 8px; font-size: 0.72rem; font-weight: 700; background: #e3b34122; color: #e3b341; }
+
+    /* Mini form in admin */
+    .admin-form { background: #0d1117; border: 1px solid #30363d; border-radius: 9px; padding: 1rem; margin-bottom: 1.25rem; }
+    .admin-form h4 { font-size: 0.8rem; color: #8b949e; text-transform: uppercase; letter-spacing: 0.4px; margin-bottom: 0.75rem; }
+    .admin-form .row { display: flex; gap: 0.6rem; flex-wrap: wrap; }
+    .admin-form .row > * { flex: 1 1 140px; }
+    .admin-form input, .admin-form select {
+      width: 100%; padding: 0.48rem 0.65rem;
+      background: #161b22; border: 1px solid #30363d; border-radius: 6px;
+      color: #e1e4e8; font-size: 0.85rem; outline: none; font-family: inherit;
+      transition: border-color 0.15s;
+    }
+    .admin-form input:focus, .admin-form select:focus { border-color: #58a6ff; }
+    .admin-form select option { background: #161b22; }
+    .admin-form label { display: block; font-size: 0.75rem; color: #8b949e; margin-bottom: 0.28rem; text-transform: uppercase; letter-spacing: 0.3px; }
+    .admin-form-actions { display: flex; gap: 0.6rem; margin-top: 0.75rem; justify-content: flex-end; }
+    .btn-admin-save { padding: 0.42rem 1rem; background: #1f6feb; border: none; border-radius: 6px; color: #fff; cursor: pointer; font-weight: 600; font-size: 0.84rem; }
+    .btn-admin-cancel { padding: 0.42rem 0.9rem; background: transparent; border: 1px solid #30363d; border-radius: 6px; color: #8b949e; cursor: pointer; font-size: 0.84rem; }
+    .admin-err { color: #f85149; font-size: 0.8rem; min-height: 1.1rem; margin-top: 0.35rem; }
+
     /* ── APP BODY ── */
     .app-body {
       flex: 1;
@@ -404,9 +512,17 @@
     </div>
     <div class="topbar-spacer"></div>
     <div class="topbar-user">
-      <div class="topbar-avatar" id="hdr-avatar">?</div>
       <span class="topbar-username" id="hdr-user"></span>
-      <button class="btn-logout" onclick="doLogout()">Odhlásiť sa</button>
+      <div class="avatar-wrap" id="avatar-wrap">
+        <div class="topbar-avatar" id="hdr-avatar" onclick="toggleAvatarMenu()">?</div>
+        <div class="avatar-menu" id="avatar-menu">
+          <button class="avatar-menu-item" id="mi-users" onclick="openAdmin('users')" style="display:none"><span class="mi-icon">👥</span> Správca užívateľov</button>
+          <button class="avatar-menu-item" id="mi-families" onclick="openAdmin('families')" style="display:none"><span class="mi-icon">🏠</span> Správca rodín</button>
+          <button class="avatar-menu-item" id="mi-settings" onclick="openAdmin('settings')" style="display:none"><span class="mi-icon">⚙️</span> Nastavenia</button>
+          <hr class="avatar-menu-sep" id="mi-sep" style="display:none" />
+          <button class="avatar-menu-item" onclick="doLogout()"><span class="mi-icon">🚪</span> Odhlásiť sa</button>
+        </div>
+      </div>
     </div>
   </div>
 
@@ -502,6 +618,103 @@
   </div>
 </div>
 
+<!-- ══════════ ADMIN PANEL ══════════ -->
+<div class="admin-overlay" id="admin-overlay" onclick="onAdminOverlayClick(event)">
+  <div class="admin-panel">
+    <div class="admin-head">
+      <h2>⚙️ Administrácia</h2>
+      <button class="btn-admin-close" onclick="closeAdmin()">✕</button>
+    </div>
+    <div class="admin-tabs">
+      <button class="admin-tab" data-tab="users" onclick="switchAdminTab('users')">👥 Správca užívateľov</button>
+      <button class="admin-tab" data-tab="families" onclick="switchAdminTab('families')">🏠 Správca rodín</button>
+      <button class="admin-tab" data-tab="settings" onclick="switchAdminTab('settings')">⚙️ Nastavenia</button>
+    </div>
+    <div class="admin-body">
+
+      <!-- USERS TAB -->
+      <div class="admin-section" id="tab-users">
+        <div id="user-form-wrap" style="display:none">
+          <div class="admin-form">
+            <h4 id="user-form-title">Nový používateľ</h4>
+            <input type="hidden" id="uf-id" value="" />
+            <div class="row">
+              <div><label>Meno</label><input id="uf-username" placeholder="johndoe" /></div>
+              <div><label>Email</label><input id="uf-email" type="email" placeholder="john@example.com" /></div>
+              <div><label>Rodina</label>
+                <select id="uf-family"><option value="">— bez rodiny —</option></select>
+              </div>
+            </div>
+            <div class="admin-err" id="uf-err"></div>
+            <div class="admin-form-actions">
+              <button class="btn-admin-cancel" onclick="hideUserForm()">Zrušiť</button>
+              <button class="btn-admin-save" onclick="saveUser()">Uložiť</button>
+            </div>
+          </div>
+        </div>
+        <div class="admin-toolbar">
+          <h3>Používatelia</h3>
+          <button class="btn-admin-add" onclick="showUserForm()">+ Pridať</button>
+        </div>
+        <table class="admin-table">
+          <thead><tr><th>Meno</th><th>Email</th><th>Rodina</th><th>Roly</th><th></th></tr></thead>
+          <tbody id="admin-users-tbody"></tbody>
+        </table>
+      </div>
+
+      <!-- FAMILIES TAB -->
+      <div class="admin-section" id="tab-families">
+        <div id="family-form-wrap" style="display:none">
+          <div class="admin-form">
+            <h4 id="fam-form-title">Nová rodina</h4>
+            <input type="hidden" id="ff-id" value="" />
+            <div class="row" style="max-width:340px">
+              <div><label>Názov rodiny</label><input id="ff-name" placeholder="Moja rodina" /></div>
+            </div>
+            <div class="admin-err" id="ff-err"></div>
+            <div class="admin-form-actions">
+              <button class="btn-admin-cancel" onclick="hideFamilyForm()">Zrušiť</button>
+              <button class="btn-admin-save" onclick="saveFamily()">Uložiť</button>
+            </div>
+          </div>
+        </div>
+        <div class="admin-toolbar">
+          <h3>Rodiny</h3>
+          <button class="btn-admin-add" onclick="showFamilyForm()">+ Pridať</button>
+        </div>
+        <table class="admin-table">
+          <thead><tr><th>Názov</th><th>Počet členov</th><th></th></tr></thead>
+          <tbody id="admin-families-tbody"></tbody>
+        </table>
+      </div>
+
+      <!-- SETTINGS TAB -->
+      <div class="admin-section" id="tab-settings">
+        <p style="color:#8b949e;font-size:0.88rem;margin-top:0.5rem">Nastavenia budú dostupné čoskoro.</p>
+      </div>
+
+    </div>
+  </div>
+</div>
+
+<!-- MUST-CHANGE-PASSWORD MODAL -->
+<div class="modal-overlay" id="mcp-modal">
+  <div class="modal" style="max-width:380px">
+    <div class="modal-head">
+      <h2>🔐 Zmeň si heslo</h2>
+    </div>
+    <p style="font-size:0.84rem;color:#8b949e;margin-bottom:1rem">
+      Tvoj účet bol vytvorený administrátorom.<br>Prosím zmeň si heslo pred pokračovaním.
+    </p>
+    <div class="fg"><label>Nové heslo</label><input type="password" id="mcp-pass" placeholder="min. 6 znakov" /></div>
+    <div class="fg"><label>Potvrď heslo</label><input type="password" id="mcp-pass2" placeholder="zopakuj heslo" onkeydown="if(event.key==='Enter')doMcpChange()" /></div>
+    <div class="err" id="mcp-err"></div>
+    <div class="modal-actions">
+      <button class="btn-save" onclick="doMcpChange()">Zmeniť heslo</button>
+    </div>
+  </div>
+</div>
+
 <script>
 const API = '/api';
 const v    = id => document.getElementById(id).value;
@@ -621,10 +834,13 @@ function saveAuth(d) {
   token = d.token;
 }
 
+let isAdmin = false;
+
 function doLogout() {
-  localStorage.clear(); token = null; myId = 0;
+  localStorage.clear(); token = null; myId = 0; isAdmin = false;
   document.getElementById('auth-screen').style.display = 'flex';
   document.getElementById('app-screen').style.display  = 'none';
+  document.getElementById('avatar-menu').classList.remove('open');
 }
 
 function showApp() {
@@ -632,8 +848,23 @@ function showApp() {
   document.getElementById('app-screen').style.display  = 'flex';
   const u = JSON.parse(localStorage.getItem('user') || '{}');
   const name = u.username || '';
+  isAdmin = !!u.isAdmin;
   document.getElementById('hdr-user').textContent   = name;
   document.getElementById('hdr-avatar').textContent = name ? name[0].toUpperCase() : '?';
+
+  // Admin menu items
+  ['mi-users','mi-families','mi-settings','mi-sep'].forEach(id => {
+    const el = document.getElementById(id);
+    if (el) el.style.display = isAdmin ? '' : 'none';
+  });
+
+  // MustChangePassword check
+  if (u.mustChangePassword) {
+    setTimeout(() => {
+      document.getElementById('mcp-modal').classList.add('open');
+    }, 400);
+  }
+
   loadReminders();
 }
 
@@ -1006,12 +1237,222 @@ function removeUser(id) { selectedUsers = selectedUsers.filter(u=>u.id!==id); re
 document.addEventListener('click', e => {
   if (!document.getElementById('user-picker').contains(e.target))
     document.getElementById('picker-dropdown').classList.remove('open');
+  if (!document.getElementById('avatar-wrap').contains(e.target))
+    document.getElementById('avatar-menu').classList.remove('open');
 });
 
 window.addEventListener('resize', () => {
   requestAnimationFrame(() => trimCalendarCells());
 });
 
+// ═══ AVATAR MENU ═══
+function toggleAvatarMenu() {
+  document.getElementById('avatar-menu').classList.toggle('open');
+}
+
+// ═══ MUST-CHANGE-PASSWORD ═══
+async function doMcpChange() {
+  const err = document.getElementById('mcp-err');
+  err.textContent = '';
+  const pass  = document.getElementById('mcp-pass').value;
+  const pass2 = document.getElementById('mcp-pass2').value;
+  const u = JSON.parse(localStorage.getItem('user') || '{}');
+  if (pass.length < 6) { err.textContent = 'Heslo musí mať aspoň 6 znakov.'; return; }
+  if (pass !== pass2)  { err.textContent = 'Heslá sa nezhodujú.'; return; }
+
+  // 1. Zmeniť heslo — server zároveň nastaví MustChangePassword = false
+  const res = await fetch(`${API}/auth/reset-password`, {
+    method:'POST', headers:{'Content-Type':'application/json'},
+    body: JSON.stringify({ email: u.email, newPassword: pass, code: null })
+  });
+  if (!res.ok) { err.textContent = await res.text(); return; }
+
+  // 2. Znovu prihlásiť — dostaneme nový token s mustChangePassword: false
+  const loginRes = await fetch(`${API}/auth/login`, {
+    method:'POST', headers:{'Content-Type':'application/json'},
+    body: JSON.stringify({ email: u.email, password: pass })
+  });
+  if (loginRes.ok) {
+    const d = await loginRes.json();
+    saveAuth(d);
+    // Aktualizuj meno/avatar v topbare (zostáva rovnaké, ale token je nový)
+    document.getElementById('hdr-user').textContent   = d.username;
+    document.getElementById('hdr-avatar').textContent = d.username ? d.username[0].toUpperCase() : '?';
+  }
+  document.getElementById('mcp-modal').classList.remove('open');
+}
+
+// ═══ ADMIN PANEL ═══
+let adminFamilies = [];
+
+function openAdmin(tab) {
+  document.getElementById('avatar-menu').classList.remove('open');
+  document.getElementById('admin-overlay').classList.add('open');
+  switchAdminTab(tab || 'users');
+}
+function closeAdmin() {
+  document.getElementById('admin-overlay').classList.remove('open');
+}
+function onAdminOverlayClick(e) {
+  if (e.target === document.getElementById('admin-overlay')) closeAdmin();
+}
+function switchAdminTab(tab) {
+  document.querySelectorAll('.admin-tab').forEach(t => t.classList.toggle('active', t.dataset.tab === tab));
+  document.querySelectorAll('.admin-section').forEach(s => s.classList.toggle('active', s.id === `tab-${tab}`));
+  if (tab === 'users')    loadAdminData();
+  if (tab === 'families') loadAdminFamilies();
+}
+
+async function loadAdminData() {
+  const [uRes, fRes] = await Promise.all([
+    fetch(`${API}/admin/users`,    { headers: auth() }),
+    fetch(`${API}/admin/families`, { headers: auth() })
+  ]);
+  const users    = uRes.ok    ? await uRes.json()    : [];
+  adminFamilies  = fRes.ok    ? await fRes.json()    : [];
+  renderAdminUsers(users);
+  populateFamilySelect('uf-family', null);
+}
+
+async function loadAdminFamilies() {
+  const res = await fetch(`${API}/admin/families`, { headers: auth() });
+  adminFamilies = res.ok ? await res.json() : [];
+  renderAdminFamilies(adminFamilies);
+}
+
+function renderAdminUsers(users) {
+  const tbody = document.getElementById('admin-users-tbody');
+  if (!users.length) { tbody.innerHTML = '<tr><td colspan="5" style="color:#484f58;text-align:center;padding:1.5rem">Žiadni používatelia</td></tr>'; return; }
+  tbody.innerHTML = users.map(u => `
+    <tr>
+      <td>${u.username}</td>
+      <td style="color:#8b949e">${u.email}</td>
+      <td>${u.familyName || '<span style="color:#484f58">—</span>'}</td>
+      <td>
+        ${u.isAdmin ? '<span class="badge-admin">Admin</span>' : ''}
+        ${u.mustChangePassword ? '<span class="badge-mustchange">Zmeniť heslo</span>' : ''}
+      </td>
+      <td><div class="td-actions">
+        <button class="btn-tbl btn-tbl-edit" onclick="editUser(${u.id})">✏️ Upraviť</button>
+        ${u.isAdmin ? '' : `<button class="btn-tbl btn-tbl-del" onclick="deleteUser(${u.id},'${u.username}')">🗑 Zmazať</button>`}
+      </div></td>
+    </tr>`).join('');
+}
+
+function renderAdminFamilies(families) {
+  const tbody = document.getElementById('admin-families-tbody');
+  if (!families.length) { tbody.innerHTML = '<tr><td colspan="3" style="color:#484f58;text-align:center;padding:1.5rem">Žiadne rodiny</td></tr>'; return; }
+  tbody.innerHTML = families.map(f => `
+    <tr>
+      <td>${f.name}</td>
+      <td style="color:#8b949e">${f.memberCount}</td>
+      <td><div class="td-actions">
+        <button class="btn-tbl btn-tbl-edit" onclick="editFamily(${f.id},'${f.name.replace(/'/g,"\\'")}')">✏️ Upraviť</button>
+        <button class="btn-tbl btn-tbl-del" onclick="deleteFamily(${f.id},'${f.name.replace(/'/g,"\\'")}')">🗑 Zmazať</button>
+      </div></td>
+    </tr>`).join('');
+}
+
+function populateFamilySelect(selectId, selectedId) {
+  const sel = document.getElementById(selectId);
+  sel.innerHTML = '<option value="">— bez rodiny —</option>' +
+    adminFamilies.map(f => `<option value="${f.id}" ${f.id == selectedId ? 'selected' : ''}>${f.name}</option>`).join('');
+}
+
+// USER FORM
+function showUserForm(clearId) {
+  document.getElementById('uf-id').value = '';
+  document.getElementById('uf-username').value = '';
+  document.getElementById('uf-email').value = '';
+  document.getElementById('uf-err').textContent = '';
+  document.getElementById('user-form-title').textContent = 'Nový používateľ';
+  populateFamilySelect('uf-family', null);
+  document.getElementById('user-form-wrap').style.display = '';
+  document.getElementById('uf-username').focus();
+}
+function hideUserForm() { document.getElementById('user-form-wrap').style.display = 'none'; }
+function editUser(id) {
+  // Find from table — reload users first
+  fetch(`${API}/admin/users`, { headers: auth() }).then(r => r.json()).then(users => {
+    const u = users.find(x => x.id === id); if (!u) return;
+    document.getElementById('uf-id').value = u.id;
+    document.getElementById('uf-username').value = u.username;
+    document.getElementById('uf-email').value = u.email;
+    document.getElementById('uf-err').textContent = '';
+    document.getElementById('user-form-title').textContent = 'Upraviť používateľa';
+    populateFamilySelect('uf-family', u.familyId);
+    document.getElementById('user-form-wrap').style.display = '';
+    document.getElementById('uf-username').focus();
+  });
+}
+async function saveUser() {
+  const id   = document.getElementById('uf-id').value;
+  const body = {
+    username: document.getElementById('uf-username').value.trim(),
+    email:    document.getElementById('uf-email').value.trim(),
+    familyId: document.getElementById('uf-family').value ? parseInt(document.getElementById('uf-family').value) : null
+  };
+  const err = document.getElementById('uf-err');
+  err.textContent = '';
+  if (!body.username || !body.email) { err.textContent = 'Meno a email sú povinné.'; return; }
+  const url    = id ? `${API}/admin/users/${id}` : `${API}/admin/users`;
+  const method = id ? 'PUT' : 'POST';
+  const res = await fetch(url, { method, headers: { ...auth(), 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
+  if (res.ok) {
+    hideUserForm();
+    loadAdminData();
+  } else {
+    err.textContent = await res.text();
+  }
+}
+async function deleteUser(id, name) {
+  if (!confirm(`Zmazať používateľa „${name}"?`)) return;
+  const res = await fetch(`${API}/admin/users/${id}`, { method: 'DELETE', headers: auth() });
+  if (res.ok) loadAdminData();
+  else alert(await res.text());
+}
+
+// FAMILY FORM
+function showFamilyForm() {
+  document.getElementById('ff-id').value = '';
+  document.getElementById('ff-name').value = '';
+  document.getElementById('ff-err').textContent = '';
+  document.getElementById('fam-form-title').textContent = 'Nová rodina';
+  document.getElementById('family-form-wrap').style.display = '';
+  document.getElementById('ff-name').focus();
+}
+function hideFamilyForm() { document.getElementById('family-form-wrap').style.display = 'none'; }
+function editFamily(id, name) {
+  document.getElementById('ff-id').value = id;
+  document.getElementById('ff-name').value = name;
+  document.getElementById('ff-err').textContent = '';
+  document.getElementById('fam-form-title').textContent = 'Upraviť rodinu';
+  document.getElementById('family-form-wrap').style.display = '';
+  document.getElementById('ff-name').focus();
+}
+async function saveFamily() {
+  const id   = document.getElementById('ff-id').value;
+  const name = document.getElementById('ff-name').value.trim();
+  const err  = document.getElementById('ff-err');
+  err.textContent = '';
+  if (!name) { err.textContent = 'Názov je povinný.'; return; }
+  const url    = id ? `${API}/admin/families/${id}` : `${API}/admin/families`;
+  const method = id ? 'PUT' : 'POST';
+  const res = await fetch(url, { method, headers: { ...auth(), 'Content-Type': 'application/json' }, body: JSON.stringify({ name }) });
+  if (res.ok) {
+    hideFamilyForm();
+    loadAdminFamilies();
+  } else {
+    err.textContent = await res.text();
+  }
+}
+async function deleteFamily(id, name) {
+  if (!confirm(`Zmazať rodinu „${name}"?`)) return;
+  const res = await fetch(`${API}/admin/families/${id}`, { method: 'DELETE', headers: auth() });
+  if (res.ok) loadAdminFamilies();
+  else alert(await res.text());
+}
+
 </script>
 </body>
 </html>

CalendarReminder.Domain/Entities/Family.cs

@@ -0,0 +1,8 @@
+namespace CalendarReminder.Domain.Entities;
+
+public class Family
+{
+    public int Id { get; set; }
+    public string Name { get; set; } = "";
+    public ICollection<User> Users { get; set; } = [];
+}

CalendarReminder.Domain/Entities/User.cs

@@ -7,6 +7,11 @@ public class User
     public string Email { get; set; } = "";
     public string PasswordHash { get; set; } = "";
     public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+    public bool IsAdmin { get; set; }
+    public bool MustChangePassword { get; set; }
+
+    public int? FamilyId { get; set; }
+    public Family? Family { get; set; }
 
     public ICollection<Reminder> Reminders { get; set; } = [];
 }

create-admin.sql

@@ -4,16 +4,19 @@
 -- Spusti: mysql -h 192.168.1.68 -u mip -p"mip@2013" calendarreminder < create-admin.sql
 -- ============================================================
 
-INSERT INTO Users (Username, Email, PasswordHash, CreatedAt)
+INSERT INTO Users (Username, Email, PasswordHash, IsAdmin, MustChangePassword, CreatedAt)
 VALUES (
     'admin',
     'nas@culak.sk',
     '$2a$11$8yPi0lcuKsJH6/Ncvm2A6O4Nw9gZblkCZ23PxbibW5MVfG06syp5S',
+    1,
+    0,
     UTC_TIMESTAMP()
 )
 ON DUPLICATE KEY UPDATE
     Email        = VALUES(Email),
-    PasswordHash = VALUES(PasswordHash);
+    PasswordHash = VALUES(PasswordHash),
+    IsAdmin      = 1;
 
 -- Over výsledok
-SELECT id, Username, Email, CreatedAt FROM Users WHERE Username = 'admin';
+SELECT Id, Username, Email, IsAdmin, MustChangePassword FROM Users WHERE Username = 'admin';

docker-compose.yml

@@ -1,8 +1,13 @@
 services:
   app:
-    build: .
+    image: ${DOCKERHUB_USERNAME}/calendarreminder-app:latest
     ports:
       - "8080:8080"
+    depends_on:
+      db:
+        condition: service_healthy
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
     environment:
       - ASPNETCORE_ENVIRONMENT=Production
       - ConnectionStrings__Default=Server=${DB_SERVER};Port=${DB_PORT};Database=${DB_NAME};User=${DB_USER};Password=${DB_PASSWORD};
@@ -32,3 +37,16 @@ services:
       timeout: 5s
       retries: 5
     restart: unless-stopped
+
+  watchtower:
+    image: containrrr/watchtower
+    ports:
+      - "8085:8080"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      - WATCHTOWER_LABEL_ENABLE=true
+      - WATCHTOWER_CLEANUP=true
+      - WATCHTOWER_HTTP_API_UPDATE=true
+      - WATCHTOWER_HTTP_API_TOKEN=${WATCHTOWER_TOKEN}
+    restart: unless-stopped