fix: allow creating campaign drafts without lists assigned

[Danimarqz]

Lists are now only required when starting or scheduling a campaign, not when saving a draft. This unblocks the content editor tab for non-admin users who previously could not save a campaign (and thus access the editor) without first selecting a list.

Fixes #3014

[github-actions]

Issues Found

Critical (P0/P1)

• [P1] Avoid creating drafts with no lists due to permission checks (cmd/campaigns.go:705-714)
  • Removing the ListIDs non-empty validation lets a user create a draft campaign with zero lists, but most subsequent endpoints (eg UpdateCampaign, UpdateCampaignStatus, delete) call checkCampaignPerm, which authorizes access by verifying the campaign belongs to one of the user’s permitted lists; a campaign with no lists will fail CampaignHasLists and return 403 for non-*_all users, effectively making the draft uneditable/unusable after creation.
• [P1] Enforce non-empty lists when editing scheduled campaigns (cmd/campaigns.go:368-377)
  • List validation is now only done in UpdateCampaignStatus, so a campaign that is already scheduled can be updated via UpdateCampaign to clear all lists without triggering this check (no status transition). When the scheduler runs, store.NextSubscribers() builds list IDs from campaign_lists; with none it returns nil, nil, causing the pipeline to treat it as “no subscribers” and mark the campaign finished with 0 sends (silent failure) and also makes later permission checks fail because the campaign no longer belongs to any list.

Summary

Total issues: 2 critical, 0 important, 0 minor.

Overall Verdict

Status: Patch has blocking issues

Explanation: The change allows campaigns to exist without any list association, but the authorization model and the sending pipeline assume campaigns belong to at least one list. This can make drafts inaccessible to non-admin users and allows scheduled campaigns to be emptied of lists and then silently complete with zero recipients.

---

Review generated by Hodor (model: gpt-5.2)

Review Metrics — 30 turns, 29 tool calls, 2m 45s

• Tokens: in 22.8K | cached 363.6K | out 6.7K (total 393.2K)
• Cost: $0.1972

[filipesmedeiros]

My opiníon regarding the AI's review is that no-list campaigns can be accessible to anyone (who can manage all lists). For people that have only list-based permissions, I think they should not be able to manage these lists.

Also, if a campaign is scheduled, it should not be possible to remove all lists from it. First you should have to change it back to draft.