feat: enforce trip membership and role authorization

backend/apps/api/src/trips/trip-members.controller.spec.ts

@@ -0,0 +1,47 @@
+import { TripMembersController } from './trip-members.controller';
+
+describe('TripMembersController', () => {
+  it('GET /trips/:tripId/members lists members', async () => {
+    const members = [
+      { id: 'm1', tripId: 't1', userId: 'u1', role: 'OWNER', status: 'ACTIVE' },
+    ];
+    const tripMembersService = {
+      listMembers: jest.fn().mockResolvedValue(members),
+    };
+    const controller = new TripMembersController(tripMembersService as never);
+
+    await expect(controller.list('t1')).resolves.toEqual(members);
+    expect(tripMembersService.listMembers).toHaveBeenCalledWith('t1');
+  });
+
+  it('PATCH /trips/:tripId/members/:memberId updates the member', async () => {
+    const updated = {
+      id: 'm1',
+      tripId: 't1',
+      userId: 'u2',
+      role: 'MEMBER',
+      status: 'ACTIVE',
+    };
+    const tripMembersService = {
+      updateMember: jest.fn().mockResolvedValue(updated),
+    };
+    const controller = new TripMembersController(tripMembersService as never);
+
+    await expect(
+      controller.update('t1', 'm1', { role: 'MEMBER' }),
+    ).resolves.toEqual(updated);
+    expect(tripMembersService.updateMember).toHaveBeenCalledWith('t1', 'm1', {
+      role: 'MEMBER',
+    });
+  });
+
+  it('DELETE /trips/:tripId/members/:memberId removes the member', async () => {
+    const tripMembersService = {
+      removeMember: jest.fn().mockResolvedValue(undefined),
+    };
+    const controller = new TripMembersController(tripMembersService as never);
+
+    await controller.remove('t1', 'm1');
+    expect(tripMembersService.removeMember).toHaveBeenCalledWith('t1', 'm1');
+  });
+});

backend/apps/api/src/trips/trip-members.controller.ts

@@ -0,0 +1,55 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Param,
+  Patch,
+  UseGuards,
+} from '@nestjs/common';
+import { OidcAuthGuard } from '../../../../libs/auth/src';
+import {
+  TripMembersService,
+  TripMembershipGuard,
+  TripRoles,
+} from '../../../../libs/trips/src';
+import type {
+  TripMember,
+  TripMemberRole,
+  TripMemberStatus,
+} from '../../../../libs/trips/src';
+
+interface UpdateTripMemberDto {
+  role?: TripMemberRole;
+  status?: TripMemberStatus;
+}
+
+@Controller('trips/:tripId/members')
+@UseGuards(OidcAuthGuard, TripMembershipGuard)
+export class TripMembersController {
+  constructor(private readonly tripMembersService: TripMembersService) {}
+
+  @Get()
+  list(@Param('tripId') tripId: string): Promise<TripMember[]> {
+    return this.tripMembersService.listMembers(tripId);
+  }
+
+  @Patch(':memberId')
+  @TripRoles('OWNER')
+  update(
+    @Param('tripId') tripId: string,
+    @Param('memberId') memberId: string,
+    @Body() dto: UpdateTripMemberDto,
+  ): Promise<TripMember> {
+    return this.tripMembersService.updateMember(tripId, memberId, dto);
+  }
+
+  @Delete(':memberId')
+  @TripRoles('OWNER')
+  remove(
+    @Param('tripId') tripId: string,
+    @Param('memberId') memberId: string,
+  ): Promise<void> {
+    return this.tripMembersService.removeMember(tripId, memberId);
+  }
+}

backend/apps/api/src/trips/trips.controller.spec.ts

@@ -9,13 +9,23 @@ describe('TripsController', () => {
     email: 'a@example.com',
   };
 
+  function controllerWith(
+    tripsService: object,
+    tripSettingsService: object = {},
+  ): TripsController {
+    return new TripsController(
+      tripsService as never,
+      tripSettingsService as never,
+    );
+  }
+
   it('GET /trips lists trips for the current user', async () => {
     const tripsService = {
       listTripsForUser: jest
         .fn()
         .mockResolvedValue([{ id: 't1', name: 'Slovenia 2027' }]),
     };
-    const controller = new TripsController(tripsService as never);
+    const controller = controllerWith(tripsService);
 
     await expect(controller.list(currentUser)).resolves.toEqual([
       { id: 't1', name: 'Slovenia 2027' },
@@ -31,7 +41,7 @@ describe('TripsController', () => {
       version: 1,
     };
     const tripsService = { createTrip: jest.fn().mockResolvedValue(created) };
-    const controller = new TripsController(tripsService as never);
+    const controller = controllerWith(tripsService);
 
     await expect(
       controller.create(currentUser, { name: 'Slovenia 2027' }),
@@ -44,7 +54,7 @@ describe('TripsController', () => {
   it('GET /trips/:tripId returns a single trip', async () => {
     const trip = { id: 't1', name: 'Slovenia 2027' };
     const tripsService = { getTrip: jest.fn().mockResolvedValue(trip) };
-    const controller = new TripsController(tripsService as never);
+    const controller = controllerWith(tripsService);
 
     await expect(controller.getOne('t1')).resolves.toEqual(trip);
   });
@@ -52,7 +62,7 @@ describe('TripsController', () => {
   it('PATCH /trips/:tripId forwards the update dto including version', async () => {
     const updated = { id: 't1', name: 'New name', version: 2 };
     const tripsService = { updateTrip: jest.fn().mockResolvedValue(updated) };
-    const controller = new TripsController(tripsService as never);
+    const controller = controllerWith(tripsService);
 
     await expect(
       controller.update('t1', { name: 'New name', version: 1 }),
@@ -65,9 +75,41 @@ describe('TripsController', () => {
 
   it('DELETE /trips/:tripId deletes the trip', async () => {
     const tripsService = { deleteTrip: jest.fn().mockResolvedValue(undefined) };
-    const controller = new TripsController(tripsService as never);
+    const controller = controllerWith(tripsService);
 
     await controller.remove('t1');
     expect(tripsService.deleteTrip).toHaveBeenCalledWith('t1');
   });
+
+  it('GET /trips/:tripId/settings returns the trip settings', async () => {
+    const settings = { tripId: 't1', webResearchEnabled: false };
+    const tripSettingsService = {
+      getSettings: jest.fn().mockResolvedValue(settings),
+    };
+    const controller = controllerWith({}, tripSettingsService);
+
+    await expect(controller.getSettings('t1')).resolves.toEqual(settings);
+    expect(tripSettingsService.getSettings).toHaveBeenCalledWith('t1');
+  });
+
+  it('PUT /trips/:tripId/settings replaces the trip settings', async () => {
+    const dto = {
+      webResearchEnabled: true,
+      periodicAgentReviewEnabled: false,
+      notificationEmailEnabled: true,
+      notificationPushEnabled: true,
+      defaultResearchDepth: null,
+      defaultPlanningStyle: null,
+    };
+    const updated = { tripId: 't1', ...dto };
+    const tripSettingsService = {
+      replaceSettings: jest.fn().mockResolvedValue(updated),
+    };
+    const controller = controllerWith({}, tripSettingsService);
+
+    await expect(controller.replaceSettings('t1', dto)).resolves.toEqual(
+      updated,
+    );
+    expect(tripSettingsService.replaceSettings).toHaveBeenCalledWith('t1', dto);
+  });
 });

backend/apps/api/src/trips/trips.controller.ts

@@ -6,22 +6,33 @@ import {
   Param,
   Patch,
   Post,
+  Put,
   UseGuards,
 } from '@nestjs/common';
 import { OidcAuthGuard } from '../../../../libs/auth/src';
 import type { AuthenticatedUser } from '../../../../libs/auth/src';
-import { TripsService } from '../../../../libs/trips/src';
+import {
+  TripMembershipGuard,
+  TripRoles,
+  TripSettingsService,
+  TripsService,
+} from '../../../../libs/trips/src';
 import type {
   CreateTripDto,
   Trip,
+  TripSettings,
   UpdateTripDto,
+  UpdateTripSettingsDto,
 } from '../../../../libs/trips/src';
 import { CurrentUser } from '../auth/current-user.decorator';
 
 @Controller('trips')
 @UseGuards(OidcAuthGuard)
 export class TripsController {
-  constructor(private readonly tripsService: TripsService) {}
+  constructor(
+    private readonly tripsService: TripsService,
+    private readonly tripSettingsService: TripSettingsService,
+  ) {}
 
   @Get()
   list(@CurrentUser() currentUser: AuthenticatedUser): Promise<Trip[]> {
@@ -37,11 +48,14 @@ export class TripsController {
   }
 
   @Get(':tripId')
+  @UseGuards(TripMembershipGuard)
   getOne(@Param('tripId') tripId: string): Promise<Trip> {
     return this.tripsService.getTrip(tripId);
   }
 
   @Patch(':tripId')
+  @UseGuards(TripMembershipGuard)
+  @TripRoles('OWNER')
   update(
     @Param('tripId') tripId: string,
     @Body() dto: UpdateTripDto,
@@ -50,7 +64,25 @@ export class TripsController {
   }
 
   @Delete(':tripId')
+  @UseGuards(TripMembershipGuard)
+  @TripRoles('OWNER')
   remove(@Param('tripId') tripId: string): Promise<void> {
     return this.tripsService.deleteTrip(tripId);
   }
+
+  @Get(':tripId/settings')
+  @UseGuards(TripMembershipGuard)
+  getSettings(@Param('tripId') tripId: string): Promise<TripSettings> {
+    return this.tripSettingsService.getSettings(tripId);
+  }
+
+  @Put(':tripId/settings')
+  @UseGuards(TripMembershipGuard)
+  @TripRoles('OWNER')
+  replaceSettings(
+    @Param('tripId') tripId: string,
+    @Body() dto: UpdateTripSettingsDto,
+  ): Promise<TripSettings> {
+    return this.tripSettingsService.replaceSettings(tripId, dto);
+  }
 }

backend/apps/api/src/trips/trips.module.ts

@@ -2,9 +2,10 @@ import { Module } from '@nestjs/common';
 import { AuthModule } from '../../../../libs/auth/src';
 import { TripsLibModule } from '../../../../libs/trips/src';
 import { TripsController } from './trips.controller';
+import { TripMembersController } from './trip-members.controller';
 
 @Module({
   imports: [AuthModule, TripsLibModule],
-  controllers: [TripsController],
+  controllers: [TripsController, TripMembersController],
 })
 export class TripsApiModule {}