замечания 3

server/routers/procurement/routes/experience.js

@@ -1,12 +1,11 @@
 const express = require('express');
 const router = express.Router();
 const { verifyToken } = require('../middleware/auth');
-
-// In-memory хранилище для опыта работы (mock)
-let experiences = [];
+const Experience = require('../models/Experience');
+const { Types } = require('mongoose');
 
 // GET /experience - Получить список опыта работы компании
-router.get('/', verifyToken, (req, res) => {
+router.get('/', verifyToken, async (req, res) => {
   try {
     const { companyId } = req.query;
     
@@ -14,8 +13,18 @@ router.get('/', verifyToken, (req, res) => {
       return res.status(400).json({ error: 'companyId is required' });
     }
 
-    const companyExperiences = experiences.filter(exp => exp.companyId === companyId);
-    res.json(companyExperiences);
+    if (!Types.ObjectId.isValid(companyId)) {
+      return res.status(400).json({ error: 'Invalid company ID' });
+    }
+
+    const companyExperiences = await Experience.find({ 
+      companyId: new Types.ObjectId(companyId) 
+    }).sort({ createdAt: -1 });
+
+    res.json(companyExperiences.map(exp => ({
+      ...exp.toObject(),
+      id: exp._id
+    })));
   } catch (error) {
     console.error('Get experience error:', error);
     res.status(500).json({ error: 'Internal server error' });
@@ -23,7 +32,7 @@ router.get('/', verifyToken, (req, res) => {
 });
 
 // POST /experience - Создать запись опыта работы
-router.post('/', verifyToken, (req, res) => {
+router.post('/', verifyToken, async (req, res) => {
   try {
     const { companyId, data } = req.body;
 
@@ -31,28 +40,30 @@ router.post('/', verifyToken, (req, res) => {
       return res.status(400).json({ error: 'companyId and data are required' });
     }
 
+    if (!Types.ObjectId.isValid(companyId)) {
+      return res.status(400).json({ error: 'Invalid company ID' });
+    }
+
     const { confirmed, customer, subject, volume, contact, comment } = data;
 
     if (!customer || !subject) {
       return res.status(400).json({ error: 'customer and subject are required' });
     }
 
-    const newExperience = {
-      id: `exp-${Date.now()}`,
-      companyId,
+    const newExperience = await Experience.create({
+      companyId: new Types.ObjectId(companyId),
       confirmed: confirmed || false,
       customer,
       subject,
       volume: volume || '',
       contact: contact || '',
-      comment: comment || '',
-      createdAt: new Date().toISOString(),
-      updatedAt: new Date().toISOString()
-    };
+      comment: comment || ''
+    });
 
-    experiences.push(newExperience);
-
-    res.status(201).json(newExperience);
+    res.status(201).json({
+      ...newExperience.toObject(),
+      id: newExperience._id
+    });
   } catch (error) {
     console.error('Create experience error:', error);
     res.status(500).json({ error: 'Internal server error' });
@@ -60,7 +71,7 @@ router.post('/', verifyToken, (req, res) => {
 });
 
 // PUT /experience/:id - Обновить запись опыта работы
-router.put('/:id', verifyToken, (req, res) => {
+router.put('/:id', verifyToken, async (req, res) => {
   try {
     const { id } = req.params;
     const { data } = req.body;
@@ -69,21 +80,27 @@ router.put('/:id', verifyToken, (req, res) => {
       return res.status(400).json({ error: 'data is required' });
     }
 
-    const index = experiences.findIndex(exp => exp.id === id);
+    if (!Types.ObjectId.isValid(id)) {
+      return res.status(400).json({ error: 'Invalid experience ID' });
+    }
 
-    if (index === -1) {
+    const updatedExperience = await Experience.findByIdAndUpdate(
+      new Types.ObjectId(id),
+      {
+        ...data,
+        updatedAt: new Date()
+      },
+      { new: true }
+    );
+
+    if (!updatedExperience) {
       return res.status(404).json({ error: 'Experience not found' });
     }
 
-    const updatedExperience = {
-      ...experiences[index],
-      ...data,
-      updatedAt: new Date().toISOString()
-    };
-
-    experiences[index] = updatedExperience;
-
-    res.json(updatedExperience);
+    res.json({
+      ...updatedExperience.toObject(),
+      id: updatedExperience._id
+    });
   } catch (error) {
     console.error('Update experience error:', error);
     res.status(500).json({ error: 'Internal server error' });
@@ -91,17 +108,19 @@ router.put('/:id', verifyToken, (req, res) => {
 });
 
 // DELETE /experience/:id - Удалить запись опыта работы
-router.delete('/:id', verifyToken, (req, res) => {
+router.delete('/:id', verifyToken, async (req, res) => {
   try {
     const { id } = req.params;
 
-    const index = experiences.findIndex(exp => exp.id === id);
-
-    if (index === -1) {
-      return res.status(404).json({ error: 'Experience not found' });
+    if (!Types.ObjectId.isValid(id)) {
+      return res.status(400).json({ error: 'Invalid experience ID' });
     }
 
-    experiences.splice(index, 1);
+    const deletedExperience = await Experience.findByIdAndDelete(new Types.ObjectId(id));
+
+    if (!deletedExperience) {
+      return res.status(404).json({ error: 'Experience not found' });
+    }
 
     res.json({ message: 'Experience deleted successfully' });
   } catch (error) {