Lucas Berger c0bd6d732d fix(04-07): add owner-only guard for isShared on PATCH /api/lists/:id (T-04-08) ...

- Immediately after access check, return 403 if patch.isShared !== undefined
  and !access.isOwner — blocks sharees from mutating list_shares
- Guard message: 'Only the list owner can change sharing settings'
- Sharees may still PATCH { name } (rename test stays green)
- Update stale comment: 'Reconcile list_shares on visibility change (owner only)'
- Closes T-04-08 (elevation of privilege) and T-04-05 (shared root cause)

2026-06-09 14:22:48 -04:00

..

src

fix(04-07): add owner-only guard for isShared on PATCH /api/lists/:id (T-04-08)

2026-06-09 14:22:48 -04:00

test

feat(04-01): install new deps + scaffold API test harness with Wave-0 RED stubs

2026-06-09 11:49:10 -04:00

tests

test(04-07): add failing sharee-403 tests for T-04-08 owner-only isShared guard

2026-06-09 14:22:21 -04:00

Dockerfile

chore(03): Gate 2 stack bring-up — serve PWA from API image, prod env, credential seed

2026-06-06 21:30:58 -04:00

drizzle.config.ts

feat(01-01): Drizzle schema + DB client + /health slice (GREEN)

2026-06-04 09:52:36 -04:00

package.json

feat(04-01): install new deps + scaffold API test harness with Wave-0 RED stubs

2026-06-09 11:49:10 -04:00

tsconfig.json

feat(04-01): add list tables to schema and apply via generate+migrate [BLOCKING]

2026-06-09 11:55:46 -04:00

vitest.config.ts

fix(04-02): use fileParallelism:false to prevent DB test race conditions

2026-06-09 12:23:13 -04:00