feat: enforce trip membership and role authorization

backend/libs/trips/src/index.ts

@@ -1,4 +1,7 @@
 export * from './trip.types';
 export * from './trips.service';
 export * from './trip-settings.service';
+export * from './trip-members.service';
+export * from './trip-membership.guard';
+export * from './trip-roles.decorator';
 export * from './trips.module';

backend/libs/trips/src/trip-members.repository.ts

@@ -0,0 +1,108 @@
+import { Inject, Injectable } from '@nestjs/common';
+import type { Kysely } from 'kysely';
+import { KYSELY_DB } from '../../database/src';
+import type { Database } from '../../database/src';
+import type {
+  TripMember,
+  TripMemberRole,
+  TripMemberStatus,
+} from './trip.types';
+
+function toTripMember(row: {
+  id: string;
+  trip_id: string;
+  user_id: string;
+  role: string;
+  status: string;
+  joined_at: Date | null;
+  created_at: Date;
+  updated_at: Date;
+}): TripMember {
+  return {
+    id: row.id,
+    tripId: row.trip_id,
+    userId: row.user_id,
+    role: row.role as TripMemberRole,
+    status: row.status as TripMemberStatus,
+    joinedAt: row.joined_at,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+  };
+}
+
+@Injectable()
+export class TripMembersRepository {
+  constructor(@Inject(KYSELY_DB) private readonly db: Kysely<Database>) {}
+
+  async findByTripAndUser(
+    tripId: string,
+    userId: string,
+  ): Promise<TripMember | undefined> {
+    const row = await this.db
+      .selectFrom('trip_members')
+      .selectAll()
+      .where('trip_id', '=', tripId)
+      .where('user_id', '=', userId)
+      .executeTakeFirst();
+    return row ? toTripMember(row) : undefined;
+  }
+
+  async listByTrip(tripId: string): Promise<TripMember[]> {
+    const rows = await this.db
+      .selectFrom('trip_members')
+      .selectAll()
+      .where('trip_id', '=', tripId)
+      .execute();
+    return rows.map(toTripMember);
+  }
+
+  async upsertActiveMember(
+    tripId: string,
+    userId: string,
+    role: TripMemberRole = 'MEMBER',
+  ): Promise<TripMember> {
+    const row = await this.db
+      .insertInto('trip_members')
+      .values({
+        trip_id: tripId,
+        user_id: userId,
+        role,
+        status: 'ACTIVE',
+        joined_at: new Date().toISOString(),
+      })
+      .onConflict((oc) =>
+        oc.columns(['trip_id', 'user_id']).doUpdateSet({
+          status: 'ACTIVE',
+          joined_at: new Date().toISOString(),
+          updated_at: new Date().toISOString(),
+        }),
+      )
+      .returningAll()
+      .executeTakeFirstOrThrow();
+
+    return toTripMember(row);
+  }
+
+  async updateRoleOrStatus(
+    tripId: string,
+    memberId: string,
+    patch: { role?: TripMemberRole; status?: TripMemberStatus },
+  ): Promise<TripMember | undefined> {
+    const row = await this.db
+      .updateTable('trip_members')
+      .set({ ...patch, updated_at: new Date().toISOString() })
+      .where('trip_id', '=', tripId)
+      .where('id', '=', memberId)
+      .returningAll()
+      .executeTakeFirst();
+    return row ? toTripMember(row) : undefined;
+  }
+
+  async remove(tripId: string, memberId: string): Promise<void> {
+    await this.db
+      .deleteFrom('trip_members')
+      .where('trip_id', '=', tripId)
+      .where('id', '=', memberId)
+      .execute();
+  }
+}

backend/libs/trips/src/trip-members.service.ts

@@ -0,0 +1,34 @@
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { TripMembersRepository } from './trip-members.repository';
+import type {
+  TripMember,
+  TripMemberRole,
+  TripMemberStatus,
+} from './trip.types';
+
+@Injectable()
+export class TripMembersService {
+  constructor(private readonly repository: TripMembersRepository) {}
+
+  listMembers(tripId: string): Promise<TripMember[]> {
+    return this.repository.listByTrip(tripId);
+  }
+
+  async updateMember(
+    tripId: string,
+    memberId: string,
+    patch: { role?: TripMemberRole; status?: TripMemberStatus },
+  ): Promise<TripMember> {
+    const updated = await this.repository.updateRoleOrStatus(
+      tripId,
+      memberId,
+      patch,
+    );
+    if (!updated) throw new NotFoundException('Trip member not found');
+    return updated;
+  }
+
+  removeMember(tripId: string, memberId: string): Promise<void> {
+    return this.repository.remove(tripId, memberId);
+  }
+}

backend/libs/trips/src/trip-membership.guard.spec.ts

@@ -0,0 +1,94 @@
+import { ExecutionContext, ForbiddenException } from '@nestjs/common';
+import { TripMembershipGuard } from './trip-membership.guard';
+
+describe('TripMembershipGuard', () => {
+  function context(
+    params: Record<string, string>,
+    user: { id: string },
+  ): ExecutionContext {
+    const req = { params, user };
+    return {
+      switchToHttp: () => ({ getRequest: () => req }),
+      getHandler: () => ({}),
+      getClass: () => ({}),
+    } as unknown as ExecutionContext;
+  }
+
+  it('denies a user who has no trip_members row for the trip', async () => {
+    const members = {
+      findByTripAndUser: jest.fn().mockResolvedValue(undefined),
+    };
+    const reflector = {
+      getAllAndOverride: jest.fn().mockReturnValue(undefined),
+    };
+    const guard = new TripMembershipGuard(members as never, reflector as never);
+
+    await expect(
+      guard.canActivate(context({ tripId: 't1' }, { id: 'u1' })),
+    ).rejects.toThrow(ForbiddenException);
+  });
+
+  it('denies an ACTIVE MEMBER when the route requires OWNER', async () => {
+    const members = {
+      findByTripAndUser: jest
+        .fn()
+        .mockResolvedValue({ role: 'MEMBER', status: 'ACTIVE' }),
+    };
+    const reflector = {
+      getAllAndOverride: jest.fn().mockReturnValue(['OWNER']),
+    };
+    const guard = new TripMembershipGuard(members as never, reflector as never);
+
+    await expect(
+      guard.canActivate(context({ tripId: 't1' }, { id: 'u1' })),
+    ).rejects.toThrow(ForbiddenException);
+  });
+
+  it('denies an INVITED (not yet ACTIVE) member', async () => {
+    const members = {
+      findByTripAndUser: jest
+        .fn()
+        .mockResolvedValue({ role: 'MEMBER', status: 'INVITED' }),
+    };
+    const reflector = {
+      getAllAndOverride: jest.fn().mockReturnValue(undefined),
+    };
+    const guard = new TripMembershipGuard(members as never, reflector as never);
+
+    await expect(
+      guard.canActivate(context({ tripId: 't1' }, { id: 'u1' })),
+    ).rejects.toThrow(ForbiddenException);
+  });
+
+  it('allows an ACTIVE OWNER through an OWNER-only route', async () => {
+    const members = {
+      findByTripAndUser: jest
+        .fn()
+        .mockResolvedValue({ role: 'OWNER', status: 'ACTIVE' }),
+    };
+    const reflector = {
+      getAllAndOverride: jest.fn().mockReturnValue(['OWNER']),
+    };
+    const guard = new TripMembershipGuard(members as never, reflector as never);
+
+    await expect(
+      guard.canActivate(context({ tripId: 't1' }, { id: 'u1' })),
+    ).resolves.toBe(true);
+  });
+
+  it('allows an ACTIVE MEMBER through a route with no role restriction', async () => {
+    const members = {
+      findByTripAndUser: jest
+        .fn()
+        .mockResolvedValue({ role: 'MEMBER', status: 'ACTIVE' }),
+    };
+    const reflector = {
+      getAllAndOverride: jest.fn().mockReturnValue(undefined),
+    };
+    const guard = new TripMembershipGuard(members as never, reflector as never);
+
+    await expect(
+      guard.canActivate(context({ tripId: 't1' }, { id: 'u1' })),
+    ).resolves.toBe(true);
+  });
+});

backend/libs/trips/src/trip-membership.guard.ts

@@ -0,0 +1,59 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { TripMembersRepository } from './trip-members.repository';
+import { TRIP_ROLES_KEY } from './trip-roles.decorator';
+import type { TripRole } from './trip-roles.decorator';
+
+interface RequestWithTripMembership {
+  params: Record<string, string>;
+  user: { id: string };
+  tripMembership?: { role: string; status: string };
+}
+
+@Injectable()
+export class TripMembershipGuard implements CanActivate {
+  constructor(
+    private readonly tripMembers: TripMembersRepository,
+    private readonly reflector: Reflector,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const requiredRoles = this.reflector.getAllAndOverride<
+      TripRole[] | undefined
+    >(TRIP_ROLES_KEY, [context.getHandler(), context.getClass()]);
+
+    const request = context
+      .switchToHttp()
+      .getRequest<RequestWithTripMembership>();
+    const tripId = request.params.tripId;
+    const membership = await this.tripMembers.findByTripAndUser(
+      tripId,
+      request.user.id,
+    );
+
+    if (!membership || membership.status !== 'ACTIVE') {
+      throw new ForbiddenException('You are not an active member of this trip');
+    }
+
+    if (
+      requiredRoles &&
+      requiredRoles.length > 0 &&
+      !requiredRoles.includes(membership.role)
+    ) {
+      throw new ForbiddenException(
+        'You do not have the required role for this action',
+      );
+    }
+
+    request.tripMembership = {
+      role: membership.role,
+      status: membership.status,
+    };
+    return true;
+  }
+}

backend/libs/trips/src/trip-roles.decorator.ts

@@ -0,0 +1,8 @@
+import { SetMetadata } from '@nestjs/common';
+
+export type TripRole = 'OWNER' | 'MEMBER';
+
+export const TRIP_ROLES_KEY = 'tripRoles';
+
+export const TripRoles = (...roles: TripRole[]) =>
+  SetMetadata(TRIP_ROLES_KEY, roles);

backend/libs/trips/src/trip.types.ts

@@ -64,6 +64,20 @@ export interface UpdateTripSettingsDto {
   defaultPlanningStyle: TripPlanningStyle | null;
 }
 
+export type TripMemberRole = 'OWNER' | 'MEMBER';
+export type TripMemberStatus = 'INVITED' | 'ACTIVE' | 'DECLINED';
+
+export interface TripMember {
+  id: string;
+  tripId: string;
+  userId: string;
+  role: TripMemberRole;
+  status: TripMemberStatus;
+  joinedAt: Date | null;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
 export const DEFAULT_TRIP_SETTINGS: Omit<TripSettings, 'tripId'> = {
   webResearchEnabled: false,
   periodicAgentReviewEnabled: false,

backend/libs/trips/src/trips.module.ts

@@ -4,6 +4,9 @@ import { TripsRepository } from './trips.repository';
 import { TripsService } from './trips.service';
 import { TripSettingsRepository } from './trip-settings.repository';
 import { TripSettingsService } from './trip-settings.service';
+import { TripMembersRepository } from './trip-members.repository';
+import { TripMembersService } from './trip-members.service';
+import { TripMembershipGuard } from './trip-membership.guard';
 
 @Module({
   imports: [DatabaseModule],
@@ -12,7 +15,15 @@ import { TripSettingsService } from './trip-settings.service';
     TripsService,
     TripSettingsRepository,
     TripSettingsService,
+    TripMembersRepository,
+    TripMembersService,
+    TripMembershipGuard,
+  ],
+  exports: [
+    TripsService,
+    TripSettingsService,
+    TripMembersService,
+    TripMembershipGuard,
   ],
-  exports: [TripsService, TripSettingsService],
 })
 export class TripsLibModule {}