fix: tighten sharing and shadcn composition

tests/unit/share-authorization.test.ts

@@ -0,0 +1,50 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { ensureEntityShareAuthorized } from "../../src/modules/_core/share-authorization";
+import type { EntityTypeRegistration, ShareContext } from "../../src/modules/_core/module";
+
+const ctx: ShareContext = {
+  householdId: "household-1",
+  userId: "user-1",
+};
+
+function registration(
+  canShareEntity?: EntityTypeRegistration["canShareEntity"],
+): EntityTypeRegistration {
+  return {
+    type: "notes.note",
+    label: { singular: "Note", plural: "Notes" },
+    share: { canShare: true },
+    resolveUrl: (id) => `/notes/${id}`,
+    canShareEntity,
+  };
+}
+
+describe("ensureEntityShareAuthorized", () => {
+  it("rejects shareable entity types that do not provide entity authorization", async () => {
+    await assert.rejects(
+      () => ensureEntityShareAuthorized(registration(), "note-1", ctx),
+      /does not support share authorization/,
+    );
+  });
+
+  it("rejects entities denied by their module authorization callback", async () => {
+    await assert.rejects(
+      () =>
+        ensureEntityShareAuthorized(
+          registration(async () => false),
+          "note-1",
+          ctx,
+        ),
+      /not allowed to share this entity/,
+    );
+  });
+
+  it("allows entities approved by their module authorization callback", async () => {
+    await ensureEntityShareAuthorized(
+      registration(async () => true),
+      "note-1",
+      ctx,
+    );
+  });
+});