fix: tighten sharing and shadcn composition

src/modules/lists/manifest.tsx

@@ -1,7 +1,7 @@
 import type { ModuleManifest, WidgetContext } from "../_core/module";
 import { z } from "zod";
 import { listLists, listWidgetItems, searchItems, searchLists } from "./server/queries";
-import { loadListForShare, type ListShareData } from "./server/share-queries";
+import { canShareList, loadListForShare, type ListShareData } from "./server/share-queries";
 import { ListSharedView } from "./components/shared-view";
 import { ListWidget } from "./components/list-widget";
 
@@ -34,7 +34,8 @@ const manifest: ModuleManifest = {
       share: { canShare: true, defaultCapabilities: ["read", "write"] },
       search: { search: searchLists },
       resolveUrl: (id) => `/lists/${id}`,
-      loadForShare: (id) => loadListForShare(id),
+      canShareEntity: canShareList,
+      loadForShare: loadListForShare,
       renderSharedView: ({ data, capabilities, token }) => (
         <ListSharedView data={data as ListShareData} canWrite={capabilities.write} token={token} />
       ),

src/modules/lists/server/share-queries.ts

@@ -1,5 +1,6 @@
-import { asc, eq } from "drizzle-orm";
+import { and, asc, eq } from "drizzle-orm";
 import { db } from "@/lib/db";
+import type { PublicShareContext, ShareContext } from "@/modules/_core/module";
 import { listItems, lists } from "../schema";
 
 export type ListShareItem = {
@@ -19,7 +20,20 @@ export type ListShareData = {
   items: ListShareItem[];
 };
 
-export async function loadListForShare(id: string): Promise<ListShareData | null> {
+export async function canShareList(id: string, ctx: ShareContext): Promise<boolean> {
+  const [list] = await db
+    .select({ id: lists.id })
+    .from(lists)
+    .where(and(eq(lists.id, id), eq(lists.householdId, ctx.householdId)))
+    .limit(1);
+
+  return !!list;
+}
+
+export async function loadListForShare(
+  id: string,
+  ctx: PublicShareContext,
+): Promise<ListShareData | null> {
   const [list] = await db
     .select({
       id: lists.id,
@@ -28,7 +42,7 @@ export async function loadListForShare(id: string): Promise<ListShareData | null
       householdId: lists.householdId,
     })
     .from(lists)
-    .where(eq(lists.id, id))
+    .where(and(eq(lists.id, id), eq(lists.householdId, ctx.householdId)))
     .limit(1);
 
   if (!list) return null;