From 3f81b9daa31c5d99145d62b608ab2e3901dafc15 Mon Sep 17 00:00:00 2001
From: Henry <henry_ball@hotmail.co.uk>
Date: Mon, 26 Jan 2026 16:53:58 +0000
Subject: [PATCH] feat: assert permissions for lists

---
 apps/web/src/views/board/components/List.tsx | 4 +++-
 apps/web/src/views/board/index.tsx           | 6 +++---
 packages/api/src/routers/list.ts             | 8 ++++----
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/apps/web/src/views/board/components/List.tsx b/apps/web/src/views/board/components/List.tsx
index 18a3cb83..463dfeb6 100644
--- a/apps/web/src/views/board/components/List.tsx
+++ b/apps/web/src/views/board/components/List.tsx
@@ -40,7 +40,7 @@ export default function List({
   setSelectedPublicListId,
 }: ListProps) {
   const { openModal } = useModal();
-  const { canCreateCard, canDeleteList } = usePermissions();
+  const { canCreateCard, canEditList, canDeleteList } = usePermissions();
 
   const openNewCardForm = (publicListId: PublicListId) => {
     if (!canCreateCard) return;
@@ -62,6 +62,7 @@ export default function List({
   });
 
   const onSubmit = (values: FormValues) => {
+    if (!canEditList) return;
     updateList.mutate({
       listPublicId: values.listPublicId,
       name: values.name,
@@ -93,6 +94,7 @@ export default function List({
                 type="text"
                 {...register("name")}
                 onBlur={handleSubmit(onSubmit)}
+                readOnly={!canEditList}
                 className="w-full border-0 bg-transparent px-4 pt-1 text-sm font-medium text-neutral-900 focus:ring-0 focus-visible:outline-none dark:text-dark-1000"
               />
             </form>
diff --git a/apps/web/src/views/board/index.tsx b/apps/web/src/views/board/index.tsx
index 267c3067..46c1afec 100644
--- a/apps/web/src/views/board/index.tsx
+++ b/apps/web/src/views/board/index.tsx
@@ -64,7 +64,7 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
     direction: "horizontal",
   });
 
-  const { canCreateList } = usePermissions();
+  const { canCreateList, canEditList, canEditCard } = usePermissions();
 
   const { tooltipContent: createListShortcutTooltipContent } =
     useKeyboardShortcut({
@@ -263,14 +263,14 @@ export default function BoardPage({ isTemplate }: { isTemplate?: boolean }) {
       return;
     }
 
-    if (type === "LIST") {
+    if (type === "LIST" && canEditList) {
       updateListMutation.mutate({
         listPublicId: draggableId,
         index: destination.index,
       });
     }
 
-    if (type === "CARD") {
+    if (type === "CARD" && canEditCard) {
       updateCardMutation.mutate({
         cardPublicId: draggableId,
 
diff --git a/packages/api/src/routers/list.ts b/packages/api/src/routers/list.ts
index 8356238a..2f358dce 100644
--- a/packages/api/src/routers/list.ts
+++ b/packages/api/src/routers/list.ts
@@ -7,7 +7,7 @@ import * as activityRepo from "@kan/db/repository/cardActivity.repo";
 import * as listRepo from "@kan/db/repository/list.repo";
 
 import { createTRPCRouter, protectedProcedure } from "../trpc";
-import { assertUserInWorkspace } from "../utils/auth";
+import { assertPermission } from "../utils/permissions";
 
 export const listRouter = createTRPCRouter({
   create: protectedProcedure
@@ -48,7 +48,7 @@ export const listRouter = createTRPCRouter({
           code: "NOT_FOUND",
         });
 
-      await assertUserInWorkspace(ctx.db, userId, board.workspaceId);
+      await assertPermission(ctx.db, userId, board.workspaceId, "list:create");
 
       const result = await listRepo.create(ctx.db, {
         name: input.name,
@@ -101,7 +101,7 @@ export const listRouter = createTRPCRouter({
           code: "NOT_FOUND",
         });
 
-      await assertUserInWorkspace(ctx.db, userId, list.workspaceId);
+      await assertPermission(ctx.db, userId, list.workspaceId, "list:delete");
 
       const deletedAt = new Date();
 
@@ -183,7 +183,7 @@ export const listRouter = createTRPCRouter({
           code: "NOT_FOUND",
         });
 
-      await assertUserInWorkspace(ctx.db, userId, list.workspaceId);
+      await assertPermission(ctx.db, userId, list.workspaceId, "list:edit");
 
       let result: { name: string; publicId: string } | undefined;