feat: enforce trip membership and role authorization

backend/libs/trips/src/trip-members.service.ts

@@ -0,0 +1,34 @@
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { TripMembersRepository } from './trip-members.repository';
+import type {
+  TripMember,
+  TripMemberRole,
+  TripMemberStatus,
+} from './trip.types';
+
+@Injectable()
+export class TripMembersService {
+  constructor(private readonly repository: TripMembersRepository) {}
+
+  listMembers(tripId: string): Promise<TripMember[]> {
+    return this.repository.listByTrip(tripId);
+  }
+
+  async updateMember(
+    tripId: string,
+    memberId: string,
+    patch: { role?: TripMemberRole; status?: TripMemberStatus },
+  ): Promise<TripMember> {
+    const updated = await this.repository.updateRoleOrStatus(
+      tripId,
+      memberId,
+      patch,
+    );
+    if (!updated) throw new NotFoundException('Trip member not found');
+    return updated;
+  }
+
+  removeMember(tripId: string, memberId: string): Promise<void> {
+    return this.repository.remove(tripId, memberId);
+  }
+}