refactor(storage): one definition of task list access (FLAW-20)

accessibleTaskListsSQL in tasklists.go defines which task lists a user
can see; GetTaskLists, GetTaskListByID and the task queries use it
instead of three copies of the same subquery.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/storage/tasklists.go

@@ -214,6 +214,21 @@ func (s *Store) queryUserIDs(query string, args ...interface{}) []string {
 	return ids
 }
 
+// accessibleTaskListsSQL selects the IDs of every task list a user can see: own lists and lists shared
+// with the user directly or through a group. It takes the user ID three times (accessibleTaskListArgs).
+// This is the one definition of task list access for reading; GetTaskListPermission adds the role.
+const accessibleTaskListsSQL = `SELECT id FROM task_lists
+		 WHERE user_id = ?
+		    OR id IN (
+		        SELECT task_list_id FROM task_list_shares
+		        WHERE (target_type = 'user' AND target_id = ?)
+		           OR (target_type = 'team' AND target_id IN (SELECT team_id FROM team_members WHERE user_id = ?))
+		    )`
+
+func accessibleTaskListArgs(userID string) []interface{} {
+	return []interface{}{userID, userID, userID}
+}
+
 // taskListAccessSQL selects every user ID with access to a task list: owner, direct shares and members of
 // shared groups. %[1]s is the list ID expression ("?" or a correlated column).
 const taskListAccessSQL = `SELECT user_id FROM task_lists WHERE id = %[1]s
@@ -412,14 +427,9 @@ func (s *Store) GetTaskLists(userID string) ([]domain.TaskList, error) {
 	rows, err := s.db.Query(
 		`SELECT id, user_id, space_id, title, icon, color, COALESCE(columns, '[]'), created_at, updated_at
 		 FROM task_lists
-		 WHERE user_id = ? 
-		    OR id IN (
-		        SELECT task_list_id FROM task_list_shares 
-		        WHERE (target_type = 'user' AND target_id = ?) 
-		           OR (target_type = 'team' AND target_id IN (SELECT team_id FROM team_members WHERE user_id = ?))
-		    )
+		 WHERE id IN (`+accessibleTaskListsSQL+`)
 		 ORDER BY updated_at DESC`,
-		userID, userID, userID,
+		accessibleTaskListArgs(userID)...,
 	)
 	if err != nil {
 		return []domain.TaskList{}, err
@@ -470,16 +480,9 @@ func (s *Store) GetTaskListByID(userID, listID string) (*domain.TaskList, error)
 	var colsJSON string
 	err := s.db.QueryRow(
 		`SELECT id, user_id, space_id, title, icon, color, COALESCE(columns, '[]'), created_at, updated_at
-		 FROM task_lists 
-		 WHERE id = ? AND (
-		    user_id = ? 
-		    OR id IN (
-		        SELECT task_list_id FROM task_list_shares 
-		        WHERE (target_type = 'user' AND target_id = ?) 
-		           OR (target_type = 'team' AND target_id IN (SELECT team_id FROM team_members WHERE user_id = ?))
-		    )
-		 )`,
-		listID, userID, userID, userID,
+		 FROM task_lists
+		 WHERE id = ? AND id IN (`+accessibleTaskListsSQL+`)`,
+		append([]interface{}{listID}, accessibleTaskListArgs(userID)...)...,
 	).Scan(&tl.ID, &tl.UserID, &tl.SpaceID, &tl.Title, &tl.Icon, &tl.Color, &colsJSON, &tl.CreatedAt, &tl.UpdatedAt)
 	if err != nil {
 		return nil, err

internal/storage/thoughts.go

@@ -131,13 +131,7 @@ func scanThought(rows interface {
 }
 
 func (s *Store) accessibleTaskListIDsQuery() string {
-	return `SELECT id FROM task_lists 
-		   WHERE user_id = ? 
-		   OR id IN (
-		       SELECT task_list_id FROM task_list_shares 
-		       WHERE (target_type = 'user' AND target_id = ?) 
-		          OR (target_type = 'team' AND target_id IN (SELECT team_id FROM team_members WHERE user_id = ?))
-		   )`
+	return accessibleTaskListsSQL
 }
 
 func (s *Store) GetThoughtByID(userID, thoughtID string) (*domain.Thought, error) {