fix: tighten sharing and shadcn composition

src/modules/_core/module.ts

@@ -17,6 +17,15 @@ export type ShareCapabilities = {
   defaultCapabilities?: string[];
 };
 
+export type ShareContext = {
+  householdId: string;
+  userId: string;
+};
+
+export type PublicShareContext = {
+  householdId: string;
+};
+
 export type ReminderCapabilities = {
   canRemind: boolean;
 };
@@ -68,7 +77,8 @@ export type EntityTypeRegistration = {
   reminder?: ReminderCapabilities;
   search?: SearchAdapter;
   resolveUrl: (id: string) => string;
-  loadForShare?: (id: string) => Promise<unknown>;
+  canShareEntity?: (id: string, ctx: ShareContext) => Promise<boolean>;
+  loadForShare?: (id: string, ctx: PublicShareContext) => Promise<unknown>;
   renderSharedView?: (props: {
     data: unknown;
     capabilities: { read: boolean; write: boolean };

src/modules/_core/share-authorization.ts

@@ -0,0 +1,16 @@
+import type { EntityTypeRegistration, ShareContext } from "./module";
+
+export async function ensureEntityShareAuthorized(
+  registration: EntityTypeRegistration,
+  entityId: string,
+  ctx: ShareContext,
+): Promise<void> {
+  if (!registration.canShareEntity) {
+    throw new Error(`Entity type "${registration.type}" does not support share authorization`);
+  }
+
+  const allowed = await registration.canShareEntity(entityId, ctx);
+  if (!allowed) {
+    throw new Error("You are not allowed to share this entity");
+  }
+}

src/modules/_core/share.ts

@@ -6,6 +6,7 @@ import { db } from "@/lib/db";
 import { getCurrentSession } from "@/lib/session";
 import { getEntityType } from "./registry";
 import { shareLinks } from "./schema";
+import { ensureEntityShareAuthorized } from "./share-authorization";
 
 export type ShareLinkCapabilities = { read: boolean; write: boolean };
 
@@ -36,6 +37,10 @@ export async function createShareLink(
   }
 
   const { user, household } = await getCurrentSession();
+  await ensureEntityShareAuthorized(registration, entityId, {
+    householdId: household.id,
+    userId: user.id,
+  });
 
   const rawToken = randomBytes(32).toString("base64url");
   const tokenHash = hashToken(rawToken);