feat: multi-link files to multiple bookings and places — closes #23

Files can now be linked to multiple bookings and places simultaneously
via a new file_links junction table. Booking modal includes a file picker
to link existing uploads. Unlinking removes the association without
deleting the file.

server/src/db/migrations.ts

@@ -307,6 +307,20 @@ function runMigrations(db: Database.Database): void {
         db.prepare("INSERT INTO addons (id, name, type, icon, enabled, sort_order) VALUES (?, ?, ?, ?, ?, ?)").run('memories', 'Photos', 'trip', 'Image', 0, 7);
       } catch {}
     },
+    () => {
+      // Allow files to be linked to multiple reservations/assignments
+      db.exec(`CREATE TABLE IF NOT EXISTS file_links (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        file_id INTEGER NOT NULL REFERENCES trip_files(id) ON DELETE CASCADE,
+        reservation_id INTEGER REFERENCES reservations(id) ON DELETE CASCADE,
+        assignment_id INTEGER REFERENCES day_assignments(id) ON DELETE CASCADE,
+        place_id INTEGER REFERENCES places(id) ON DELETE CASCADE,
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        UNIQUE(file_id, reservation_id),
+        UNIQUE(file_id, assignment_id),
+        UNIQUE(file_id, place_id)
+      )`);
+    },
   ];
 
   if (currentVersion < migrations.length) {

server/src/routes/files.ts

@@ -82,7 +82,27 @@ router.get('/', authenticate, (req: Request, res: Response) => {
 
   const where = showTrash ? 'f.trip_id = ? AND f.deleted_at IS NOT NULL' : 'f.trip_id = ? AND f.deleted_at IS NULL';
   const files = db.prepare(`${FILE_SELECT} WHERE ${where} ORDER BY f.starred DESC, f.created_at DESC`).all(tripId) as TripFile[];
-  res.json({ files: files.map(formatFile) });
+
+  // Get all file_links for this trip's files
+  const fileIds = files.map(f => f.id);
+  let linksMap: Record<number, number[]> = {};
+  if (fileIds.length > 0) {
+    const placeholders = fileIds.map(() => '?').join(',');
+    const links = db.prepare(`SELECT file_id, reservation_id, place_id FROM file_links WHERE file_id IN (${placeholders})`).all(...fileIds) as { file_id: number; reservation_id: number | null; place_id: number | null }[];
+    for (const link of links) {
+      if (!linksMap[link.file_id]) linksMap[link.file_id] = [];
+      linksMap[link.file_id].push(link);
+    }
+  }
+
+  res.json({ files: files.map(f => {
+    const fileLinks = linksMap[f.id] || [];
+    return {
+      ...formatFile(f),
+      linked_reservation_ids: fileLinks.filter(l => l.reservation_id).map(l => l.reservation_id),
+      linked_place_ids: fileLinks.filter(l => l.place_id).map(l => l.place_id),
+    };
+  })});
 });
 
 // Upload file
@@ -239,4 +259,55 @@ router.delete('/trash/empty', authenticate, (req: Request, res: Response) => {
   res.json({ success: true, deleted: trashed.length });
 });
 
+// Link a file to a reservation (many-to-many)
+router.post('/:id/link', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId, id } = req.params;
+  const { reservation_id, assignment_id, place_id } = req.body;
+
+  const trip = verifyTripOwnership(tripId, authReq.user.id);
+  if (!trip) return res.status(404).json({ error: 'Trip not found' });
+
+  const file = db.prepare('SELECT * FROM trip_files WHERE id = ? AND trip_id = ?').get(id, tripId);
+  if (!file) return res.status(404).json({ error: 'File not found' });
+
+  try {
+    db.prepare('INSERT OR IGNORE INTO file_links (file_id, reservation_id, assignment_id, place_id) VALUES (?, ?, ?, ?)').run(
+      id, reservation_id || null, assignment_id || null, place_id || null
+    );
+  } catch {}
+
+  const links = db.prepare('SELECT * FROM file_links WHERE file_id = ?').all(id);
+  res.json({ success: true, links });
+});
+
+// Unlink a file from a reservation
+router.delete('/:id/link/:linkId', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId, id, linkId } = req.params;
+
+  const trip = verifyTripOwnership(tripId, authReq.user.id);
+  if (!trip) return res.status(404).json({ error: 'Trip not found' });
+
+  db.prepare('DELETE FROM file_links WHERE id = ? AND file_id = ?').run(linkId, id);
+  res.json({ success: true });
+});
+
+// Get all links for a file
+router.get('/:id/links', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId, id } = req.params;
+
+  const trip = verifyTripOwnership(tripId, authReq.user.id);
+  if (!trip) return res.status(404).json({ error: 'Trip not found' });
+
+  const links = db.prepare(`
+    SELECT fl.*, r.title as reservation_title
+    FROM file_links fl
+    LEFT JOIN reservations r ON fl.reservation_id = r.id
+    WHERE fl.file_id = ?
+  `).all(id);
+  res.json({ links });
+});
+
 export default router;