Implement permission utilities (task 9)

- Created lib/permissions.ts with four utility functions:
  - canAccessList: Check if user can view a list
  - canEditList: Check if user can edit a list or its items
  - canDeleteList: Check if user can delete a list (owner only)
  - getPermission: Get user's permission level for a list
- Added comprehensive unit tests in lib/__tests__/permissions.test.ts
- All 24 tests passing
- Validates Requirements 4.3, 6.2, 6.3

lib/__tests__/permissions.test.ts

@@ -0,0 +1,268 @@
+/**
+ * Tests for permission utility functions
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { prisma } from '../db'
+import {
+  canAccessList,
+  canEditList,
+  canDeleteList,
+  getPermission,
+} from '../permissions'
+import bcrypt from 'bcryptjs'
+
+describe('Permission Utilities', () => {
+  let testUser1Id: string
+  let testUser2Id: string
+  let testListId: string
+
+  beforeEach(async () => {
+    // Create test users
+    const passwordHash = await bcrypt.hash('password123', 10)
+    
+    const user1 = await prisma.user.create({
+      data: {
+        email: `test-perm-user1-${Date.now()}@example.com`,
+        passwordHash,
+        name: 'Test User 1',
+      },
+    })
+    testUser1Id = user1.id
+
+    const user2 = await prisma.user.create({
+      data: {
+        email: `test-perm-user2-${Date.now()}@example.com`,
+        passwordHash,
+        name: 'Test User 2',
+      },
+    })
+    testUser2Id = user2.id
+
+    // Create a test list owned by user1
+    const list = await prisma.list.create({
+      data: {
+        title: 'Test List',
+        color: '#3B82F6',
+        ownerId: testUser1Id,
+      },
+    })
+    testListId = list.id
+  })
+
+  afterEach(async () => {
+    // Clean up test data
+    await prisma.list.deleteMany({
+      where: {
+        id: testListId,
+      },
+    })
+    await prisma.user.deleteMany({
+      where: {
+        id: {
+          in: [testUser1Id, testUser2Id],
+        },
+      },
+    })
+  })
+
+  describe('canAccessList', () => {
+    it('should return true for list owner', async () => {
+      const result = await canAccessList(testUser1Id, testListId)
+      expect(result).toBe(true)
+    })
+
+    it('should return false for non-owner without collaboration', async () => {
+      const result = await canAccessList(testUser2Id, testListId)
+      expect(result).toBe(false)
+    })
+
+    it('should return true for editor collaborator', async () => {
+      // Add user2 as editor
+      await prisma.collaborator.create({
+        data: {
+          userId: testUser2Id,
+          listId: testListId,
+          permission: 'editor',
+        },
+      })
+
+      const result = await canAccessList(testUser2Id, testListId)
+      expect(result).toBe(true)
+    })
+
+    it('should return true for viewer collaborator', async () => {
+      // Add user2 as viewer
+      await prisma.collaborator.create({
+        data: {
+          userId: testUser2Id,
+          listId: testListId,
+          permission: 'viewer',
+        },
+      })
+
+      const result = await canAccessList(testUser2Id, testListId)
+      expect(result).toBe(true)
+    })
+
+    it('should return false for invalid user ID', async () => {
+      const result = await canAccessList('', testListId)
+      expect(result).toBe(false)
+    })
+
+    it('should return false for invalid list ID', async () => {
+      const result = await canAccessList(testUser1Id, '')
+      expect(result).toBe(false)
+    })
+  })
+
+  describe('canEditList', () => {
+    it('should return true for list owner', async () => {
+      const result = await canEditList(testUser1Id, testListId)
+      expect(result).toBe(true)
+    })
+
+    it('should return false for non-owner without collaboration', async () => {
+      const result = await canEditList(testUser2Id, testListId)
+      expect(result).toBe(false)
+    })
+
+    it('should return true for editor collaborator', async () => {
+      // Add user2 as editor
+      await prisma.collaborator.create({
+        data: {
+          userId: testUser2Id,
+          listId: testListId,
+          permission: 'editor',
+        },
+      })
+
+      const result = await canEditList(testUser2Id, testListId)
+      expect(result).toBe(true)
+    })
+
+    it('should return false for viewer collaborator', async () => {
+      // Add user2 as viewer
+      await prisma.collaborator.create({
+        data: {
+          userId: testUser2Id,
+          listId: testListId,
+          permission: 'viewer',
+        },
+      })
+
+      const result = await canEditList(testUser2Id, testListId)
+      expect(result).toBe(false)
+    })
+
+    it('should return false for invalid user ID', async () => {
+      const result = await canEditList('', testListId)
+      expect(result).toBe(false)
+    })
+
+    it('should return false for invalid list ID', async () => {
+      const result = await canEditList(testUser1Id, '')
+      expect(result).toBe(false)
+    })
+  })
+
+  describe('canDeleteList', () => {
+    it('should return true for list owner', async () => {
+      const result = await canDeleteList(testUser1Id, testListId)
+      expect(result).toBe(true)
+    })
+
+    it('should return false for non-owner', async () => {
+      const result = await canDeleteList(testUser2Id, testListId)
+      expect(result).toBe(false)
+    })
+
+    it('should return false for editor collaborator', async () => {
+      // Add user2 as editor
+      await prisma.collaborator.create({
+        data: {
+          userId: testUser2Id,
+          listId: testListId,
+          permission: 'editor',
+        },
+      })
+
+      const result = await canDeleteList(testUser2Id, testListId)
+      expect(result).toBe(false)
+    })
+
+    it('should return false for viewer collaborator', async () => {
+      // Add user2 as viewer
+      await prisma.collaborator.create({
+        data: {
+          userId: testUser2Id,
+          listId: testListId,
+          permission: 'viewer',
+        },
+      })
+
+      const result = await canDeleteList(testUser2Id, testListId)
+      expect(result).toBe(false)
+    })
+
+    it('should return false for invalid user ID', async () => {
+      const result = await canDeleteList('', testListId)
+      expect(result).toBe(false)
+    })
+
+    it('should return false for invalid list ID', async () => {
+      const result = await canDeleteList(testUser1Id, '')
+      expect(result).toBe(false)
+    })
+  })
+
+  describe('getPermission', () => {
+    it('should return "owner" for list owner', async () => {
+      const result = await getPermission(testUser1Id, testListId)
+      expect(result).toBe('owner')
+    })
+
+    it('should return null for non-owner without collaboration', async () => {
+      const result = await getPermission(testUser2Id, testListId)
+      expect(result).toBeNull()
+    })
+
+    it('should return "editor" for editor collaborator', async () => {
+      // Add user2 as editor
+      await prisma.collaborator.create({
+        data: {
+          userId: testUser2Id,
+          listId: testListId,
+          permission: 'editor',
+        },
+      })
+
+      const result = await getPermission(testUser2Id, testListId)
+      expect(result).toBe('editor')
+    })
+
+    it('should return "viewer" for viewer collaborator', async () => {
+      // Add user2 as viewer
+      await prisma.collaborator.create({
+        data: {
+          userId: testUser2Id,
+          listId: testListId,
+          permission: 'viewer',
+        },
+      })
+
+      const result = await getPermission(testUser2Id, testListId)
+      expect(result).toBe('viewer')
+    })
+
+    it('should return null for invalid user ID', async () => {
+      const result = await getPermission('', testListId)
+      expect(result).toBeNull()
+    })
+
+    it('should return null for invalid list ID', async () => {
+      const result = await getPermission(testUser1Id, '')
+      expect(result).toBeNull()
+    })
+  })
+})