feat: list functions now validate user has access to list

internal/domain/list.go

@@ -14,6 +14,7 @@ var (
 	ErrUserIDsEmpty       = errors.New("user ids must not be empty")
 	ErrListItemIDEmpty    = errors.New("list item id must not be empty")
 	ErrListItemTitleEmpty = errors.New("list item title must not be empty")
+	ErrUserNotInList      = errors.New("user not in list")
 )
 
 type List struct {
@@ -74,6 +75,14 @@ func (s *ListService) AddUserToList(ctx context.Context, authUserID string, list
 		return ErrUserIDEmpty
 	}
 
+	inList, err := s.repo.IsUserInList(ctx, listID, authUserID)
+	if err != nil {
+		return err
+	}
+	if !inList {
+		return ErrUserNotInList
+	}
+
 	return s.repo.AddUserToList(ctx, listID, userID)
 }
 
@@ -85,6 +94,14 @@ func (s *ListService) RemoveUserFromList(ctx context.Context, authUserID string,
 		return ErrUserIDEmpty
 	}
 
+	inList, err := s.repo.IsUserInList(ctx, listID, authUserID)
+	if err != nil {
+		return err
+	}
+	if !inList {
+		return ErrUserNotInList
+	}
+
 	return s.repo.RemoveUserFromList(ctx, listID, userID)
 }
 
@@ -96,6 +113,14 @@ func (s *ListService) CreateListItem(ctx context.Context, authUserID string, lis
 		return nil, ErrListItemTitleEmpty
 	}
 
+	inList, err := s.repo.IsUserInList(ctx, listID, authUserID)
+	if err != nil {
+		return nil, err
+	}
+	if !inList {
+		return nil, ErrUserNotInList
+	}
+
 	return s.repo.CreateListItem(ctx, listID, title)
 }
 
@@ -107,5 +132,13 @@ func (s *ListService) UpdateListItem(ctx context.Context, authUserID string, lis
 		return ErrListItemTitleEmpty
 	}
 
+	inList, err := s.repo.IsUserInListByItemID(ctx, listItemID, authUserID)
+	if err != nil {
+		return err
+	}
+	if !inList {
+		return ErrUserNotInList
+	}
+
 	return s.repo.UpdateListItem(ctx, listItemID, title, isCompleted)
 }