fix: tighten sharing and shadcn composition

src/modules/notes/manifest.tsx

@@ -1,7 +1,7 @@
 import type { ModuleManifest, WidgetContext } from "../_core/module";
 import { z } from "zod";
 import { listWidgetNotes, searchNotes } from "./server/queries";
-import { loadNoteForShare, type NoteShareData } from "./server/share-queries";
+import { canShareNote, loadNoteForShare, type NoteShareData } from "./server/share-queries";
 import { NoteSharedView } from "./components/shared-view";
 
 const notesWidgetConfigSchema = z.object({
@@ -72,7 +72,8 @@ const manifest: ModuleManifest = {
       reminder: { canRemind: true },
       search: { search: searchNotes },
       resolveUrl: (id) => `/notes/${id}`,
-      loadForShare: (id) => loadNoteForShare(id),
+      canShareEntity: canShareNote,
+      loadForShare: loadNoteForShare,
       renderSharedView: ({ data }) => <NoteSharedView data={data as NoteShareData} />,
       renderActivity: (entry) => {
         const title = entry.payload?.title as string | undefined;

src/modules/notes/server/share-queries.ts

@@ -1,5 +1,6 @@
-import { eq } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 import { db } from "@/lib/db";
+import type { PublicShareContext, ShareContext } from "@/modules/_core/module";
 import { notes } from "../schema";
 
 export type NoteShareData = {
@@ -10,7 +11,20 @@ export type NoteShareData = {
   updatedAt: string;
 };
 
-export async function loadNoteForShare(id: string): Promise<NoteShareData | null> {
+export async function canShareNote(id: string, ctx: ShareContext): Promise<boolean> {
+  const [note] = await db
+    .select({ id: notes.id })
+    .from(notes)
+    .where(and(eq(notes.id, id), eq(notes.householdId, ctx.householdId)))
+    .limit(1);
+
+  return !!note;
+}
+
+export async function loadNoteForShare(
+  id: string,
+  ctx: PublicShareContext,
+): Promise<NoteShareData | null> {
   const [note] = await db
     .select({
       id: notes.id,
@@ -20,7 +34,7 @@ export async function loadNoteForShare(id: string): Promise<NoteShareData | null
       updatedAt: notes.updatedAt,
     })
     .from(notes)
-    .where(eq(notes.id, id))
+    .where(and(eq(notes.id, id), eq(notes.householdId, ctx.householdId)))
     .limit(1);
 
   if (!note) return null;