feat(lists): add direct user invitation to shared lists and streamline live-sync indicator

internal/api/server_test.go

@@ -518,3 +518,104 @@ func TestLoginWithUsernameAndDemoMode(t *testing.T) {
 		t.Fatalf("expected 401 Unauthorized for wrong password, got %d", rec.Code)
 	}
 }
+
+func TestSpaceMembersDirectInvitationAPI(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "space_members_test.db")
+	store, err := storage.NewStore(dbPath)
+	if err != nil {
+		t.Fatalf("failed to create store: %v", err)
+	}
+	defer store.Close()
+
+	if err := store.EnsureDemoAccounts(); err != nil {
+		t.Fatalf("failed to seed demo accounts: %v", err)
+	}
+
+	cfg := &config.Config{
+		Port:         "8080",
+		DatabasePath: dbPath,
+		JWTSecret:    "test-secret",
+	}
+	srv := NewServer(cfg, store, ws.NewHub(), nil)
+	router := srv.Router()
+
+	adminUser, err := store.GetUserByLogin("admin")
+	if err != nil {
+		t.Fatalf("failed to get admin user: %v", err)
+	}
+	normalUser, err := store.GetUserByLogin("user")
+	if err != nil {
+		t.Fatalf("failed to get normal user: %v", err)
+	}
+
+	adminToken, err := auth.GenerateToken(cfg.JWTSecret, adminUser.ID, adminUser.Email, adminUser.DisplayName)
+	if err != nil {
+		t.Fatalf("failed to generate token: %v", err)
+	}
+	userToken, err := auth.GenerateToken(cfg.JWTSecret, normalUser.ID, normalUser.Email, normalUser.DisplayName)
+	if err != nil {
+		t.Fatalf("failed to generate token: %v", err)
+	}
+
+	// 1. Admin creates a space
+	createSpaceBody := []byte(`{"name":"Einkauf WG","icon":"🛒","description":"Gemeinsame Einkaufsliste"}`)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/spaces", bytes.NewReader(createSpaceBody))
+	req.Header.Set("Authorization", "Bearer "+adminToken)
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("expected 201 Created from /api/v1/spaces, got %d: %s", rec.Code, rec.Body.String())
+	}
+	var createdSpace domain.Space
+	_ = json.Unmarshal(rec.Body.Bytes(), &createdSpace)
+	if createdSpace.ID == "" {
+		t.Fatalf("expected created space with ID, got %+v", createdSpace)
+	}
+
+	// 2. Admin invites normalUser by username "user"
+	addMemberBody := []byte(`{"userId":"user","role":"editor"}`)
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/spaces/"+createdSpace.ID+"/members", bytes.NewReader(addMemberBody))
+	req.Header.Set("Authorization", "Bearer "+adminToken)
+	req.Header.Set("Content-Type", "application/json")
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("expected 201 Created from add space member, got %d: %s", rec.Code, rec.Body.String())
+	}
+	var newMember domain.SpaceMember
+	_ = json.Unmarshal(rec.Body.Bytes(), &newMember)
+	if newMember.UserID != normalUser.ID {
+		t.Fatalf("expected member userId %s, got %s", normalUser.ID, newMember.UserID)
+	}
+
+	// 3. User checks their spaces; the shared space must be listed
+	req = httptest.NewRequest(http.MethodGet, "/api/v1/spaces", nil)
+	req.Header.Set("Authorization", "Bearer "+userToken)
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200 OK for user spaces, got %d", rec.Code)
+	}
+	var userSpaces []domain.Space
+	_ = json.Unmarshal(rec.Body.Bytes(), &userSpaces)
+	found := false
+	for _, s := range userSpaces {
+		if s.ID == createdSpace.ID {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("expected space %s to be visible to user, got %+v", createdSpace.ID, userSpaces)
+	}
+
+	// 4. Admin removes user from space
+	req = httptest.NewRequest(http.MethodDelete, "/api/v1/spaces/"+createdSpace.ID+"/members/"+normalUser.ID, nil)
+	req.Header.Set("Authorization", "Bearer "+adminToken)
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200 OK for remove member, got %d: %s", rec.Code, rec.Body.String())
+	}
+}