Merge feature/public-private-carts: per-cart public/private visibility

New carts.visibility (public|private, default public; legacy is_public=false
backfilled to private). Private carts 404 for non-owners (fail-closed gate in
GetPublicCart, before items/view-bump; identical 404 to a missing slug — no
leak, incl. generateMetadata). Bidirectional Public/Private toggle in the editor
Settings + a Private badge on dashboard cards. Migration 0007.

Author: mayur-tolexo

internal/carts/handlers.go

@@ -131,14 +131,20 @@ func updateCart(svc *Service) http.HandlerFunc {
 			Description   *string `json:"description,omitempty"`
 			CoverImageURL *string `json:"cover_image_url,omitempty"`
 			IsPublic      *bool   `json:"is_public,omitempty"`
+			Visibility    *string `json:"visibility,omitempty"`
 		}
 		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
 			http.Error(w, "bad body", http.StatusBadRequest)
 			return
 		}
+		if body.Visibility != nil && *body.Visibility != "public" && *body.Visibility != "private" {
+			http.Error(w, `visibility must be "public" or "private"`, http.StatusBadRequest)
+			return
+		}
 		cart, err := svc.UpdateCart(r.Context(), uid, id, UpdatePatch{
 			Title: body.Title, Description: body.Description,
 			CoverImageURL: body.CoverImageURL, IsPublic: body.IsPublic,
+			Visibility: body.Visibility,
 		})
 		if errors.Is(err, ErrForbidden) {
 			http.Error(w, "forbidden", http.StatusForbidden)

internal/carts/marshal.go

@@ -20,6 +20,7 @@ type CartJSON struct {
 	CoverImageURL    string        `json:"coverImageUrl"`
 	AccentHex        string        `json:"accentHex"`
 	Products         []ProductJSON `json:"products"`
+	Visibility       string        `json:"visibility"`
 	ViewsLast7d      int           `json:"viewsLast7d"`
 	ClicksLast7d     int           `json:"clicksLast7d"`
 	ReachLast7d      int           `json:"reachLast7d"`
@@ -70,6 +71,7 @@ func MarshalCart(c sqlcgen.Cart, owner sqlcgen.User, items []sqlcgen.ListCartIte
 		Title:            c.Title,
 		Bio:              pgTextStr(c.Description),
 		CoverImageURL:    pgTextStr(c.CoverImageUrl),
+		Visibility:       c.Visibility,
 		AccentHex:        "#B5532A",
 		ViewsLast7d:      viewsLast7d,
 		ClicksLast7d:     clicksLast7d,

internal/carts/service.go

@@ -110,6 +110,12 @@ func (s *Service) GetPublicCart(ctx context.Context, slug string, viewerUserID i
 	if err != nil {
 		return sqlcgen.Cart{}, nil, sqlcgen.User{}, err
 	}
+	// Private carts are visible only to their owner; everyone else gets a
+	// not-found (same as a nonexistent cart — no "this is private" leak).
+	// Fail closed: anything not explicitly "public" is treated as owner-only.
+	if cart.Visibility != "public" && viewerUserID != cart.UserID {
+		return sqlcgen.Cart{}, nil, sqlcgen.User{}, ErrNotFound
+	}
 	items, err := s.q.ListCartItems(ctx, cart.ID)
 	if err != nil {
 		return sqlcgen.Cart{}, nil, sqlcgen.User{}, err
@@ -140,6 +146,7 @@ type UpdatePatch struct {
 	Description   *string
 	CoverImageURL *string
 	IsPublic      *bool
+	Visibility    *string
 }
 
 // UpdateCart applies a partial patch to an owned cart and returns the updated row.
@@ -161,6 +168,7 @@ func (s *Service) UpdateCart(ctx context.Context, userID, cartID int64, patch Up
 		Description:   cart.Description,
 		CoverImageUrl: cart.CoverImageUrl,
 		IsPublic:      cart.IsPublic,
+		Visibility:    cart.Visibility,
 	}
 	if patch.Title != nil {
 		params.Title = *patch.Title
@@ -174,6 +182,9 @@ func (s *Service) UpdateCart(ctx context.Context, userID, cartID int64, patch Up
 	if patch.IsPublic != nil {
 		params.IsPublic = *patch.IsPublic
 	}
+	if patch.Visibility != nil {
+		params.Visibility = *patch.Visibility
+	}
 	return s.q.UpdateCart(ctx, params)
 }
 

internal/carts/service_test.go

@@ -100,3 +100,58 @@ func TestService_GetPublicCart(t *testing.T) {
 	assert.Empty(t, items)
 	assert.Equal(t, "Test User", user.DisplayName)
 }
+
+func TestService_NewCartDefaultsPublic(t *testing.T) {
+	svc, uid := setupSvc(t)
+	ctx := context.Background()
+	cart, err := svc.CreateCart(ctx, uid, "Defaults")
+	require.NoError(t, err)
+	assert.Equal(t, "public", cart.Visibility)
+}
+
+func TestService_UpdateVisibility(t *testing.T) {
+	svc, uid := setupSvc(t)
+	ctx := context.Background()
+	cart, _ := svc.CreateCart(ctx, uid, "Toggle me")
+
+	priv := "private"
+	updated, err := svc.UpdateCart(ctx, uid, cart.ID, carts.UpdatePatch{Visibility: &priv})
+	require.NoError(t, err)
+	assert.Equal(t, "private", updated.Visibility)
+
+	pub := "public"
+	updated, err = svc.UpdateCart(ctx, uid, cart.ID, carts.UpdatePatch{Visibility: &pub})
+	require.NoError(t, err)
+	assert.Equal(t, "public", updated.Visibility)
+}
+
+func TestService_GetPublicCart_PrivateGate(t *testing.T) {
+	svc, uid := setupSvc(t)
+	ctx := context.Background()
+	cart, _ := svc.CreateCart(ctx, uid, "Secret")
+	priv := "private"
+	_, err := svc.UpdateCart(ctx, uid, cart.ID, carts.UpdatePatch{Visibility: &priv})
+	require.NoError(t, err)
+
+	// Owner sees their own private cart.
+	got, _, _, err := svc.GetPublicCart(ctx, cart.Slug, uid)
+	require.NoError(t, err)
+	assert.Equal(t, cart.ID, got.ID)
+
+	// Logged-out viewer (0) → not found.
+	_, _, _, err = svc.GetPublicCart(ctx, cart.Slug, 0)
+	assert.ErrorIs(t, err, carts.ErrNotFound)
+
+	// A different user → not found.
+	_, _, _, err = svc.GetPublicCart(ctx, cart.Slug, uid+99999)
+	assert.ErrorIs(t, err, carts.ErrNotFound)
+}
+
+func TestService_GetPublicCart_PublicVisibleToAnon(t *testing.T) {
+	svc, uid := setupSvc(t)
+	ctx := context.Background()
+	cart, _ := svc.CreateCart(ctx, uid, "Open")
+	got, _, _, err := svc.GetPublicCart(ctx, cart.Slug, 0)
+	require.NoError(t, err)
+	assert.Equal(t, cart.ID, got.ID)
+}

internal/db/migrations/0007_cart_visibility.down.sql

@@ -0,0 +1 @@
+ALTER TABLE carts DROP COLUMN visibility;

internal/db/migrations/0007_cart_visibility.up.sql

@@ -0,0 +1,10 @@
+-- Per-cart visibility: 'public' (anyone with the link) or 'private' (owner only).
+-- Defaults to 'public' so all existing carts keep their current behavior.
+ALTER TABLE carts
+  ADD COLUMN visibility TEXT NOT NULL DEFAULT 'public'
+    CHECK (visibility IN ('public', 'private'));
+
+-- Preserve legacy state: carts that were unpublished (is_public = false) were
+-- hidden from the public endpoint, so they become 'private' (the new source of
+-- truth). Without this, dropping the is_public filter would expose them.
+UPDATE carts SET visibility = 'private' WHERE is_public = false;

internal/db/queries.sql

@@ -28,7 +28,9 @@ RETURNING *;
 SELECT * FROM carts WHERE id = $1 AND archived_at IS NULL;
 
 -- name: GetCartBySlug :one
-SELECT * FROM carts WHERE slug = $1 AND archived_at IS NULL AND is_public = true;
+-- No is_public/visibility filter here: the service gates private carts so the
+-- OWNER can still fetch their own. archived carts remain excluded.
+SELECT * FROM carts WHERE slug = $1 AND archived_at IS NULL;
 
 -- name: ListCartsByUser :many
 SELECT * FROM carts
@@ -53,6 +55,7 @@ UPDATE carts SET
   description     = COALESCE($3, description),
   cover_image_url = COALESCE($4, cover_image_url),
   is_public       = COALESCE($5, is_public),
+  visibility      = COALESCE($6, visibility),
   updated_at      = now()
 WHERE id = $1
 RETURNING *;