add: user lock on reservations

src/routes/wishlist/[token]/+page.server.ts

@@ -43,12 +43,13 @@ export const load: PageServerLoad = async ({ params, locals }) => {
 		isSaved,
 		isClaimed,
 		savedWishlistId,
-		isAuthenticated: !!session?.user
+		isAuthenticated: !!session?.user,
+		currentUserId: session?.user?.id || null
 	};
 };
 
 export const actions: Actions = {
-	reserve: async ({ request }) => {
+	reserve: async ({ request, locals }) => {
 		const formData = await request.formData();
 		const itemId = formData.get('itemId') as string;
 		const reserverName = formData.get('reserverName') as string;
@@ -57,6 +58,8 @@ export const actions: Actions = {
 			return { success: false, error: 'Item ID is required' };
 		}
 
+		const session = await locals.auth();
+
 		const existingReservation = await db.query.reservations.findFirst({
 			where: eq(reservations.itemId, itemId)
 		});
@@ -68,6 +71,7 @@ export const actions: Actions = {
 		await db.transaction(async (tx) => {
 			await tx.insert(reservations).values({
 				itemId,
+				userId: session?.user?.id || null,
 				reserverName: reserverName?.trim() || null
 			});
 
@@ -80,7 +84,7 @@ export const actions: Actions = {
 		return { success: true };
 	},
 
-	unreserve: async ({ request }) => {
+	unreserve: async ({ request, locals }) => {
 		const formData = await request.formData();
 		const itemId = formData.get('itemId') as string;
 
@@ -88,6 +92,25 @@ export const actions: Actions = {
 			return { success: false, error: 'Item ID is required' };
 		}
 
+		const session = await locals.auth();
+
+		const reservation = await db.query.reservations.findFirst({
+			where: eq(reservations.itemId, itemId)
+		});
+
+		if (!reservation) {
+			return { success: false, error: 'Reservation not found' };
+		}
+
+		if (reservation.userId) {
+			if (!session?.user?.id || session.user.id !== reservation.userId) {
+				return {
+					success: false,
+					error: 'You can only cancel your own reservations'
+				};
+			}
+		}
+
 		await db.transaction(async (tx) => {
 			await tx.delete(reservations).where(eq(reservations.itemId, itemId));
 

src/routes/wishlist/[token]/+page.svelte

@@ -115,6 +115,8 @@
 						itemId={item.id}
 						isReserved={item.isReserved}
 						reserverName={item.reservations?.[0]?.reserverName}
+						reservationUserId={item.reservations?.[0]?.userId}
+						currentUserId={data.currentUserId}
 					/>
 				</WishlistItem>
 			{/each}