From 8c0b46f8e4c3ff415726cd57b1fa765008d37bd4 Mon Sep 17 00:00:00 2001
From: Robin Dittmar <robindittmar@gmail.com>
Date: Thu, 20 Aug 2026 15:43:59 +0200
Subject: [PATCH] feat: list functions now validate user has access to list

---
 internal/domain/list.go | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/internal/domain/list.go b/internal/domain/list.go
index 9e353df..8434148 100644
--- a/internal/domain/list.go
+++ b/internal/domain/list.go
@@ -14,6 +14,7 @@ var (
 	ErrUserIDsEmpty       = errors.New("user ids must not be empty")
 	ErrListItemIDEmpty    = errors.New("list item id must not be empty")
 	ErrListItemTitleEmpty = errors.New("list item title must not be empty")
+	ErrUserNotInList      = errors.New("user not in list")
 )
 
 type List struct {
@@ -74,6 +75,14 @@ func (s *ListService) AddUserToList(ctx context.Context, authUserID string, list
 		return ErrUserIDEmpty
 	}
 
+	inList, err := s.repo.IsUserInList(ctx, listID, authUserID)
+	if err != nil {
+		return err
+	}
+	if !inList {
+		return ErrUserNotInList
+	}
+
 	return s.repo.AddUserToList(ctx, listID, userID)
 }
 
@@ -85,6 +94,14 @@ func (s *ListService) RemoveUserFromList(ctx context.Context, authUserID string,
 		return ErrUserIDEmpty
 	}
 
+	inList, err := s.repo.IsUserInList(ctx, listID, authUserID)
+	if err != nil {
+		return err
+	}
+	if !inList {
+		return ErrUserNotInList
+	}
+
 	return s.repo.RemoveUserFromList(ctx, listID, userID)
 }
 
@@ -96,6 +113,14 @@ func (s *ListService) CreateListItem(ctx context.Context, authUserID string, lis
 		return nil, ErrListItemTitleEmpty
 	}
 
+	inList, err := s.repo.IsUserInList(ctx, listID, authUserID)
+	if err != nil {
+		return nil, err
+	}
+	if !inList {
+		return nil, ErrUserNotInList
+	}
+
 	return s.repo.CreateListItem(ctx, listID, title)
 }
 
@@ -107,5 +132,13 @@ func (s *ListService) UpdateListItem(ctx context.Context, authUserID string, lis
 		return ErrListItemTitleEmpty
 	}
 
+	inList, err := s.repo.IsUserInListByItemID(ctx, listItemID, authUserID)
+	if err != nil {
+		return err
+	}
+	if !inList {
+		return ErrUserNotInList
+	}
+
 	return s.repo.UpdateListItem(ctx, listItemID, title, isCompleted)
 }