path: root/packages/trpc/routers/sharedLists.test.ts

import { beforeEach, describe, expect, test } from "vitest";

import { BookmarkTypes } from "@karakeep/shared/types/bookmarks";

import type { APICallerType, CustomTestContext } from "../testUtils";
import { defaultBeforeEach } from "../testUtils";

beforeEach<CustomTestContext>(defaultBeforeEach(true));

/**
 * Helper function to add a collaborator and have them accept the invitation
 */
async function addAndAcceptCollaborator(
  ownerApi: APICallerType,
  collaboratorApi: APICallerType,
  listId: string,
  role: "viewer" | "editor",
) {
  const collaboratorUser = await collaboratorApi.users.whoami();

  // Owner invites the collaborator
  const { invitationId } = await ownerApi.lists.addCollaborator({
    listId,
    email: collaboratorUser.email!,
    role,
  });

  // Collaborator accepts the invitation
  await collaboratorApi.lists.acceptInvitation({
    invitationId,
  });
}

describe("Shared Lists", () => {
  describe("List Collaboration Management", () => {
    test<CustomTestContext>("should allow owner to add a collaborator by email", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      // Create a list as owner
      const list = await ownerApi.lists.create({
        name: "Test Shared List",
        icon: "📚",
        type: "manual",
      });

      // Get collaborator email
      const collaboratorUser = await collaboratorApi.users.whoami();
      const collaboratorEmail = collaboratorUser.email!;

      // Add collaborator (creates pending invitation)
      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Verify collaborator was added
      const { collaborators, owner } = await ownerApi.lists.getCollaborators({
        listId: list.id,
      });

      expect(collaborators).toHaveLength(1);
      expect(collaborators[0].user.email).toBe(collaboratorEmail);
      expect(collaborators[0].role).toBe("viewer");

      // Verify owner is included
      const ownerUser = await ownerApi.users.whoami();
      expect(owner).toBeDefined();
      expect(owner?.email).toBe(ownerUser.email);
    });

    test<CustomTestContext>("should not allow adding owner as collaborator", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const ownerUser = await ownerApi.users.whoami();

      await expect(
        ownerApi.lists.addCollaborator({
          listId: list.id,
          email: ownerUser.email!,
          role: "viewer",
        }),
      ).rejects.toThrow("Cannot add the list owner as a collaborator");
    });

    test<CustomTestContext>("should not allow adding duplicate collaborator", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      const { invitationId } = await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // Try to add same collaborator again (should fail - pending invitation exists)
      await expect(
        ownerApi.lists.addCollaborator({
          listId: list.id,
          email: collaboratorEmail,
          role: "editor",
        }),
      ).rejects.toThrow("User already has a pending invitation for this list");

      // Accept the invitation
      await collaboratorApi.lists.acceptInvitation({
        invitationId,
      });

      // Try to add them again after they're a collaborator
      await expect(
        ownerApi.lists.addCollaborator({
          listId: list.id,
          email: collaboratorEmail,
          role: "editor",
        }),
      ).rejects.toThrow("User is already a collaborator on this list");
    });

    test<CustomTestContext>("should allow owner to update collaborator role", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorUser = await collaboratorApi.users.whoami();

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Update role to editor
      await ownerApi.lists.updateCollaboratorRole({
        listId: list.id,
        userId: collaboratorUser.id,
        role: "editor",
      });

      // Verify role was updated
      const { collaborators, owner } = await ownerApi.lists.getCollaborators({
        listId: list.id,
      });

      expect(collaborators[0].role).toBe("editor");
      expect(owner).toBeDefined();
    });

    test<CustomTestContext>("should allow owner to remove collaborator", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorUser = await collaboratorApi.users.whoami();

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Remove collaborator
      await ownerApi.lists.removeCollaborator({
        listId: list.id,
        userId: collaboratorUser.id,
      });

      // Verify collaborator was removed
      const { collaborators, owner } = await ownerApi.lists.getCollaborators({
        listId: list.id,
      });

      expect(collaborators).toHaveLength(0);
      expect(owner).toBeDefined();
    });

    test<CustomTestContext>("should include owner information in getCollaborators response", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const ownerUser = await ownerApi.users.whoami();

      const { collaborators, owner } = await ownerApi.lists.getCollaborators({
        listId: list.id,
      });

      // Verify owner information is present
      expect(owner).toBeDefined();
      expect(owner?.id).toBe(ownerUser.id);
      expect(owner?.name).toBe(ownerUser.name);
      expect(owner?.email).toBe(ownerUser.email);

      // List with no collaborators should still have owner
      expect(collaborators).toHaveLength(0);
    });

    test<CustomTestContext>("should remove collaborator's bookmarks when they are removed", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      // Owner adds a bookmark
      const ownerBookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Owner's bookmark",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: ownerBookmark.id,
      });

      const collaboratorUser = await collaboratorApi.users.whoami();

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "editor",
      );

      // Collaborator adds their own bookmark
      const collabBookmark = await collaboratorApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Collaborator's bookmark",
      });

      await collaboratorApi.lists.addToList({
        listId: list.id,
        bookmarkId: collabBookmark.id,
      });

      // Verify both bookmarks are in the list
      const bookmarksBefore = await ownerApi.bookmarks.getBookmarks({
        listId: list.id,
      });
      expect(bookmarksBefore.bookmarks).toHaveLength(2);

      // Remove collaborator
      await ownerApi.lists.removeCollaborator({
        listId: list.id,
        userId: collaboratorUser.id,
      });

      // Verify only owner's bookmark remains in the list
      const bookmarksAfter = await ownerApi.bookmarks.getBookmarks({
        listId: list.id,
      });
      expect(bookmarksAfter.bookmarks).toHaveLength(1);
      expect(bookmarksAfter.bookmarks[0].id).toBe(ownerBookmark.id);

      // Verify collaborator's bookmark still exists (just not in the list)
      const collabBookmarkStillExists =
        await collaboratorApi.bookmarks.getBookmark({
          bookmarkId: collabBookmark.id,
        });
      expect(collabBookmarkStillExists.id).toBe(collabBookmark.id);
    });

    test<CustomTestContext>("should allow collaborator to leave list", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Collaborator leaves the list
      await collaboratorApi.lists.leaveList({
        listId: list.id,
      });

      // Verify collaborator was removed
      const { collaborators, owner } = await ownerApi.lists.getCollaborators({
        listId: list.id,
      });

      expect(collaborators).toHaveLength(0);
      expect(owner).toBeDefined();

      // Verify list no longer appears in shared lists
      const { lists: allLists } = await collaboratorApi.lists.list();
      const sharedLists = allLists.filter(
        (l) => l.userRole === "viewer" || l.userRole === "editor",
      );
      expect(sharedLists.find((l) => l.id === list.id)).toBeUndefined();
    });

    test<CustomTestContext>("should remove collaborator's bookmarks when they leave list", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      // Owner adds a bookmark
      const ownerBookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Owner's bookmark",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: ownerBookmark.id,
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "editor",
      );

      // Collaborator adds their own bookmark
      const collabBookmark = await collaboratorApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Collaborator's bookmark",
      });

      await collaboratorApi.lists.addToList({
        listId: list.id,
        bookmarkId: collabBookmark.id,
      });

      // Verify both bookmarks are in the list
      const bookmarksBefore = await ownerApi.bookmarks.getBookmarks({
        listId: list.id,
      });
      expect(bookmarksBefore.bookmarks).toHaveLength(2);

      // Collaborator leaves the list
      await collaboratorApi.lists.leaveList({
        listId: list.id,
      });

      // Verify only owner's bookmark remains in the list
      const bookmarksAfter = await ownerApi.bookmarks.getBookmarks({
        listId: list.id,
      });
      expect(bookmarksAfter.bookmarks).toHaveLength(1);
      expect(bookmarksAfter.bookmarks[0].id).toBe(ownerBookmark.id);

      // Verify collaborator's bookmark still exists (just not in the list)
      const collabBookmarkStillExists =
        await collaboratorApi.bookmarks.getBookmark({
          bookmarkId: collabBookmark.id,
        });
      expect(collabBookmarkStillExists.id).toBe(collabBookmark.id);
    });

    test<CustomTestContext>("should not allow owner to leave their own list", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      await expect(
        ownerApi.lists.leaveList({
          listId: list.id,
        }),
      ).rejects.toThrow(
        "List owners cannot leave their own list. Delete the list instead.",
      );
    });

    test<CustomTestContext>("should not allow non-collaborator to manage collaborators", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const thirdUserApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const thirdUser = await thirdUserApi.users.whoami();

      // Third user tries to add themselves as collaborator
      await expect(
        thirdUserApi.lists.addCollaborator({
          listId: list.id,
          email: thirdUser.email!,
          role: "viewer",
        }),
      ).rejects.toThrow("List not found");
    });
  });

  describe("List Access and Visibility", () => {
    test<CustomTestContext>("should show shared list in list endpoint", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      const { lists: allLists } = await collaboratorApi.lists.list();
      const sharedLists = allLists.filter(
        (l) => l.userRole === "viewer" || l.userRole === "editor",
      );

      expect(sharedLists).toHaveLength(1);
      expect(sharedLists[0].id).toBe(list.id);
      expect(sharedLists[0].name).toBe("Shared List");
    });

    test<CustomTestContext>("should allow collaborator to get list details", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      const retrievedList = await collaboratorApi.lists.get({
        listId: list.id,
      });

      expect(retrievedList.id).toBe(list.id);
      expect(retrievedList.name).toBe("Shared List");
      expect(retrievedList.userRole).toBe("viewer");
    });

    test<CustomTestContext>("should not allow non-collaborator to access list", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];
      const thirdUserApi = apiCallers[2];

      const list = await ownerApi.lists.create({
        name: "Private List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      await expect(
        thirdUserApi.lists.get({
          listId: list.id,
        }),
      ).rejects.toThrow("List not found");
    });

    test<CustomTestContext>("should show correct userRole for owner", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];

      const list = await ownerApi.lists.create({
        name: "My List",
        icon: "📚",
        type: "manual",
      });

      const retrievedList = await ownerApi.lists.get({
        listId: list.id,
      });

      expect(retrievedList.userRole).toBe("owner");
    });

    test<CustomTestContext>("should show correct userRole for editor", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "editor",
      );

      const retrievedList = await collaboratorApi.lists.get({
        listId: list.id,
      });

      expect(retrievedList.userRole).toBe("editor");
    });
  });

  describe("Bookmark Access in Shared Lists", () => {
    test<CustomTestContext>("should allow collaborator to view bookmarks in shared list", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      // Owner creates list and bookmark
      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      const bookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Shared bookmark",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Collaborator fetches bookmarks from shared list
      const bookmarks = await collaboratorApi.bookmarks.getBookmarks({
        listId: list.id,
      });

      expect(bookmarks.bookmarks).toHaveLength(1);
      expect(bookmarks.bookmarks[0].id).toBe(bookmark.id);
    });

    test<CustomTestContext>("should hide owner-specific bookmark state from collaborators", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      const bookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Shared bookmark",
      });

      await ownerApi.bookmarks.updateBookmark({
        bookmarkId: bookmark.id,
        archived: true,
        favourited: true,
        note: "Private note",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      const ownerView = await ownerApi.bookmarks.getBookmarks({
        listId: list.id,
      });

      const collaboratorView = await collaboratorApi.bookmarks.getBookmarks({
        listId: list.id,
      });

      const ownerBookmark = ownerView.bookmarks.find(
        (b) => b.id === bookmark.id,
      );
      expect(ownerBookmark?.favourited).toBe(true);
      expect(ownerBookmark?.archived).toBe(true);
      expect(ownerBookmark?.note).toBe("Private note");

      const collaboratorBookmark = collaboratorView.bookmarks.find(
        (b) => b.id === bookmark.id,
      );
      expect(collaboratorBookmark?.favourited).toBe(false);
      expect(collaboratorBookmark?.archived).toBe(false);
      expect(collaboratorBookmark?.note).toBeNull();
    });

    // Note: Asset handling for shared bookmarks is tested via the REST API in e2e tests
    // This is because tRPC tests don't have easy access to file upload functionality

    test<CustomTestContext>("should allow collaborator to view individual shared bookmark", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      const bookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Shared bookmark",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Collaborator gets individual bookmark
      const response = await collaboratorApi.bookmarks.getBookmark({
        bookmarkId: bookmark.id,
      });

      expect(response.id).toBe(bookmark.id);
    });

    test<CustomTestContext>("should not show shared bookmarks on collaborator's homepage", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      const sharedBookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Shared bookmark",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: sharedBookmark.id,
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Collaborator creates their own bookmark
      const ownBookmark = await collaboratorApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "My own bookmark",
      });

      // Fetch all bookmarks (no listId filter)
      const allBookmarks = await collaboratorApi.bookmarks.getBookmarks({});

      // Should only see own bookmark, not shared one
      expect(allBookmarks.bookmarks).toHaveLength(1);
      expect(allBookmarks.bookmarks[0].id).toBe(ownBookmark.id);
    });

    test<CustomTestContext>("should not allow non-collaborator to access shared bookmark", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];
      const thirdUserApi = apiCallers[2]; // User 3 will be the non-collaborator

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      const bookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Shared bookmark",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Don't add thirdUserApi as a collaborator
      // Third user tries to access the bookmark
      await expect(
        thirdUserApi.bookmarks.getBookmark({
          bookmarkId: bookmark.id,
        }),
      ).rejects.toThrow("Bookmark not found");
    });

    test<CustomTestContext>("should show all bookmarks in shared list regardless of owner", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      // Owner adds a bookmark
      const ownerBookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Owner's bookmark",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: ownerBookmark.id,
      });

      // Share list with collaborator as editor
      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "editor",
      );

      // Collaborator adds their own bookmark
      const collabBookmark = await collaboratorApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Collaborator's bookmark",
      });

      await collaboratorApi.lists.addToList({
        listId: list.id,
        bookmarkId: collabBookmark.id,
      });

      // Both users should see both bookmarks in the list
      const ownerView = await ownerApi.bookmarks.getBookmarks({
        listId: list.id,
      });

      const collabView = await collaboratorApi.bookmarks.getBookmarks({
        listId: list.id,
      });

      expect(ownerView.bookmarks).toHaveLength(2);
      expect(collabView.bookmarks).toHaveLength(2);
    });
  });

  describe("Bookmark Editing Permissions", () => {
    test<CustomTestContext>("should not allow viewer to add bookmarks to list", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Viewer creates their own bookmark
      const bookmark = await collaboratorApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "My bookmark",
      });

      // Viewer tries to add it to shared list
      await expect(
        collaboratorApi.lists.addToList({
          listId: list.id,
          bookmarkId: bookmark.id,
        }),
      ).rejects.toThrow("User is not allowed to edit this list");
    });

    test<CustomTestContext>("should allow editor to add bookmarks to list", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "editor",
      );

      // Editor creates their own bookmark
      const bookmark = await collaboratorApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "My bookmark",
      });

      // Editor adds it to shared list
      await collaboratorApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      // Verify bookmark was added
      const bookmarks = await ownerApi.bookmarks.getBookmarks({
        listId: list.id,
      });

      expect(bookmarks.bookmarks).toHaveLength(1);
      expect(bookmarks.bookmarks[0].id).toBe(bookmark.id);
    });

    test<CustomTestContext>("should not allow viewer to remove bookmarks from list", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      const bookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Test bookmark",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Viewer tries to remove bookmark
      await expect(
        collaboratorApi.lists.removeFromList({
          listId: list.id,
          bookmarkId: bookmark.id,
        }),
      ).rejects.toThrow("User is not allowed to edit this list");
    });

    test<CustomTestContext>("should allow editor to remove bookmarks from list", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      const bookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Test bookmark",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "editor",
      );

      // Editor removes bookmark
      await collaboratorApi.lists.removeFromList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      // Verify bookmark was removed
      const bookmarks = await ownerApi.bookmarks.getBookmarks({
        listId: list.id,
      });

      expect(bookmarks.bookmarks).toHaveLength(0);
    });

    test<CustomTestContext>("should not allow collaborator to edit bookmark they don't own", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      const bookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Owner's bookmark",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "editor",
      );

      // Collaborator tries to edit owner's bookmark
      await expect(
        collaboratorApi.bookmarks.updateBookmark({
          bookmarkId: bookmark.id,
          title: "Modified title",
        }),
      ).rejects.toThrow("User is not allowed to access resource");
    });

    test<CustomTestContext>("should not allow collaborator to delete bookmark they don't own", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      const bookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Owner's bookmark",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "editor",
      );

      // Collaborator tries to delete owner's bookmark
      await expect(
        collaboratorApi.bookmarks.deleteBookmark({
          bookmarkId: bookmark.id,
        }),
      ).rejects.toThrow("User is not allowed to access resource");
    });
  });

  describe("List Management Permissions", () => {
    test<CustomTestContext>("should not allow collaborator to edit list metadata", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "editor",
      );

      // Collaborator tries to edit list
      await expect(
        collaboratorApi.lists.edit({
          listId: list.id,
          name: "Modified Name",
        }),
      ).rejects.toThrow("User is not allowed to manage this list");
    });

    test<CustomTestContext>("should not allow collaborator to delete list", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "editor",
      );

      // Collaborator tries to delete list
      await expect(
        collaboratorApi.lists.delete({
          listId: list.id,
        }),
      ).rejects.toThrow("User is not allowed to manage this list");
    });

    test<CustomTestContext>("should not allow collaborator to manage other collaborators", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];
      const thirdUserApi = apiCallers[2];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "editor",
      );

      const thirdUserEmail = (await thirdUserApi.users.whoami()).email!;

      // Collaborator tries to add another user
      await expect(
        collaboratorApi.lists.addCollaborator({
          listId: list.id,
          email: thirdUserEmail,
          role: "viewer",
        }),
      ).rejects.toThrow("User is not allowed to manage this list");
    });

    test<CustomTestContext>("should only allow collaborators to view collaborator list", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];
      const thirdUserApi = apiCallers[2];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Collaborator can view collaborators
      const { collaborators, owner } =
        await collaboratorApi.lists.getCollaborators({
          listId: list.id,
        });

      expect(collaborators).toHaveLength(1);
      expect(owner).toBeDefined();

      // Non-collaborator cannot view
      await expect(
        thirdUserApi.lists.getCollaborators({
          listId: list.id,
        }),
      ).rejects.toThrow("List not found");
    });
  });

  describe("Access After Removal", () => {
    test<CustomTestContext>("should revoke access after removing collaborator", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      const bookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Shared bookmark",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      const collaboratorUser = await collaboratorApi.users.whoami();

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Verify collaborator has access to list
      const bookmarksBefore = await collaboratorApi.bookmarks.getBookmarks({
        listId: list.id,
      });
      expect(bookmarksBefore.bookmarks).toHaveLength(1);

      // Verify collaborator has access to individual bookmark
      const bookmarkBefore = await collaboratorApi.bookmarks.getBookmark({
        bookmarkId: bookmark.id,
      });
      expect(bookmarkBefore.id).toBe(bookmark.id);

      // Remove collaborator
      await ownerApi.lists.removeCollaborator({
        listId: list.id,
        userId: collaboratorUser.id,
      });

      // Verify list access is revoked
      await expect(
        collaboratorApi.bookmarks.getBookmarks({
          listId: list.id,
        }),
      ).rejects.toThrow("List not found");

      // Verify bookmark access is revoked
      await expect(
        collaboratorApi.bookmarks.getBookmark({
          bookmarkId: bookmark.id,
        }),
      ).rejects.toThrow("Bookmark not found");
    });

    test<CustomTestContext>("should revoke access after leaving list", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Collaborator leaves
      await collaboratorApi.lists.leaveList({
        listId: list.id,
      });

      // Verify access is revoked
      await expect(
        collaboratorApi.lists.get({
          listId: list.id,
        }),
      ).rejects.toThrow("List not found");
    });
  });

  describe("Smart Lists", () => {
    test<CustomTestContext>("should not allow adding collaborators to smart lists", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Smart List",
        icon: "🔍",
        type: "smart",
        query: "is:fav",
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      await expect(
        ownerApi.lists.addCollaborator({
          listId: list.id,
          email: collaboratorEmail,
          role: "viewer",
        }),
      ).rejects.toThrow("Only manual lists can have collaborators");
    });
  });

  describe("List Operations Privacy", () => {
    test<CustomTestContext>("should not allow collaborator to merge lists", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list1 = await ownerApi.lists.create({
        name: "List 1",
        icon: "📚",
        type: "manual",
      });

      const list2 = await ownerApi.lists.create({
        name: "List 2",
        icon: "📖",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list1.id,
        "editor",
      );
      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list2.id,
        "editor",
      );

      // Collaborator tries to merge the shared list into another list
      await expect(
        collaboratorApi.lists.merge({
          sourceId: list1.id,
          targetId: list2.id,
          deleteSourceAfterMerge: false,
        }),
      ).rejects.toThrow("User is not allowed to manage this list");
    });

    test<CustomTestContext>("should not allow collaborator to access RSS token operations", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "editor",
      );

      // Collaborator tries to generate RSS token
      await expect(
        collaboratorApi.lists.regenRssToken({
          listId: list.id,
        }),
      ).rejects.toThrow("User is not allowed to manage this list");

      // Collaborator tries to get RSS token
      await expect(
        collaboratorApi.lists.getRssToken({
          listId: list.id,
        }),
      ).rejects.toThrow("User is not allowed to manage this list");

      // Owner generates token first
      await ownerApi.lists.regenRssToken({
        listId: list.id,
      });

      // Collaborator tries to clear RSS token
      await expect(
        collaboratorApi.lists.clearRssToken({
          listId: list.id,
        }),
      ).rejects.toThrow("User is not allowed to manage this list");
    });

    test<CustomTestContext>("should not allow collaborator to access getListsOfBookmark for bookmark they don't own", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      const bookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Owner's bookmark",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Collaborator cannot use getListsOfBookmark for owner's bookmark
      // This is expected - only bookmark owners can query which lists contain their bookmarks
      await expect(
        collaboratorApi.lists.getListsOfBookmark({
          bookmarkId: bookmark.id,
        }),
      ).rejects.toThrow("User is not allowed to access resource");
    });

    test<CustomTestContext>("should allow collaborator to use getListsOfBookmark for their own bookmarks in shared lists", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "editor",
      );

      // Collaborator creates their own bookmark and adds it to the shared list
      const bookmark = await collaboratorApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Collaborator's bookmark",
      });

      await collaboratorApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      // Collaborator can see the shared list in getListsOfBookmark for their own bookmark
      const { lists } = await collaboratorApi.lists.getListsOfBookmark({
        bookmarkId: bookmark.id,
      });

      expect(lists).toHaveLength(1);
      expect(lists[0].id).toBe(list.id);
      expect(lists[0].userRole).toBe("editor");
      expect(lists[0].hasCollaborators).toBe(true);
    });

    test<CustomTestContext>("should show hasCollaborators=true for owner when their bookmark is in a list with collaborators", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      // Owner creates a list
      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      // Owner creates and adds a bookmark
      const bookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Owner's bookmark",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      // Add a collaborator
      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Owner queries which lists contain their bookmark
      const { lists } = await ownerApi.lists.getListsOfBookmark({
        bookmarkId: bookmark.id,
      });

      expect(lists).toHaveLength(1);
      expect(lists[0].id).toBe(list.id);
      expect(lists[0].userRole).toBe("owner");
      expect(lists[0].hasCollaborators).toBe(true);
    });

    test<CustomTestContext>("should show hasCollaborators=false for owner when their bookmark is in a list without collaborators", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];

      // Owner creates a list
      const list = await ownerApi.lists.create({
        name: "Private List",
        icon: "📚",
        type: "manual",
      });

      // Owner creates and adds a bookmark
      const bookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Owner's bookmark",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      // Owner queries which lists contain their bookmark
      const { lists } = await ownerApi.lists.getListsOfBookmark({
        bookmarkId: bookmark.id,
      });

      expect(lists).toHaveLength(1);
      expect(lists[0].id).toBe(list.id);
      expect(lists[0].userRole).toBe("owner");
      expect(lists[0].hasCollaborators).toBe(false);
    });

    test<CustomTestContext>("should include shared lists in stats", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      // Add bookmarks to the list
      const bookmark1 = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Bookmark 1",
      });
      const bookmark2 = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Bookmark 2",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark1.id,
      });
      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark2.id,
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Collaborator gets stats
      const { stats } = await collaboratorApi.lists.stats();

      // Shared list should appear in stats with correct count
      expect(stats.get(list.id)).toBe(2);
    });

    test<CustomTestContext>("should allow editor to add their own bookmark to shared list via addToList", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "editor",
      );

      // Editor creates their own bookmark
      const bookmark = await collaboratorApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Editor's bookmark",
      });

      // Editor should be able to add their bookmark to the shared list
      await collaboratorApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      // Verify bookmark was added
      const bookmarks = await ownerApi.bookmarks.getBookmarks({
        listId: list.id,
      });

      expect(bookmarks.bookmarks).toHaveLength(1);
      expect(bookmarks.bookmarks[0].id).toBe(bookmark.id);
    });

    test<CustomTestContext>("should not allow viewer to add their own bookmark to shared list via addToList", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const viewerApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(ownerApi, viewerApi, list.id, "viewer");

      // Viewer creates their own bookmark
      const bookmark = await viewerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Viewer's bookmark",
      });

      // Viewer should not be able to add their bookmark to the shared list
      await expect(
        viewerApi.lists.addToList({
          listId: list.id,
          bookmarkId: bookmark.id,
        }),
      ).rejects.toThrow();
    });

    test<CustomTestContext>("should not allow editor to add someone else's bookmark to shared list", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const editorApi = apiCallers[1];
      const thirdUserApi = apiCallers[2];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(ownerApi, editorApi, list.id, "editor");

      // Third user creates a bookmark (or owner if only 2 users)
      const bookmark = await thirdUserApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Someone else's bookmark",
      });

      // Editor should not be able to add someone else's bookmark
      await expect(
        editorApi.lists.addToList({
          listId: list.id,
          bookmarkId: bookmark.id,
        }),
      ).rejects.toThrow(/Bookmark not found/);
    });

    test<CustomTestContext>("should not allow collaborator to update list metadata fields", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const editorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(ownerApi, editorApi, list.id, "editor");

      // Editor tries to change list name
      await expect(
        editorApi.lists.edit({
          listId: list.id,
          name: "Modified Name",
        }),
      ).rejects.toThrow();

      // Editor tries to make list public
      await expect(
        editorApi.lists.edit({
          listId: list.id,
          public: true,
        }),
      ).rejects.toThrow();
    });
  });

  describe("hasCollaborators Field", () => {
    test<CustomTestContext>("should be false for newly created list", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];

      const list = await ownerApi.lists.create({
        name: "New List",
        icon: "📚",
        type: "manual",
      });

      expect(list.hasCollaborators).toBe(false);
    });

    test<CustomTestContext>("should be true for owner after adding a collaborator", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Fetch the list again to get updated hasCollaborators
      const updatedList = await ownerApi.lists.get({
        listId: list.id,
      });

      expect(updatedList.hasCollaborators).toBe(true);
    });

    test<CustomTestContext>("should be true for collaborator viewing shared list", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Collaborator fetches the list
      const sharedList = await collaboratorApi.lists.get({
        listId: list.id,
      });

      expect(sharedList.hasCollaborators).toBe(true);
    });

    test<CustomTestContext>("should be false for owner after removing all collaborators", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorUser = await collaboratorApi.users.whoami();

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Remove the collaborator
      await ownerApi.lists.removeCollaborator({
        listId: list.id,
        userId: collaboratorUser.id,
      });

      // Fetch the list again
      const updatedList = await ownerApi.lists.get({
        listId: list.id,
      });

      expect(updatedList.hasCollaborators).toBe(false);
    });

    test<CustomTestContext>("should show correct value in lists.list() endpoint", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      // Create list without collaborators
      const list1 = await ownerApi.lists.create({
        name: "Private List",
        icon: "🔒",
        type: "manual",
      });

      // Create list with collaborators
      const list2 = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list2.id,
        "viewer",
      );

      // Get all lists
      const { lists } = await ownerApi.lists.list();

      const privateList = lists.find((l) => l.id === list1.id);
      const sharedList = lists.find((l) => l.id === list2.id);

      expect(privateList?.hasCollaborators).toBe(false);
      expect(sharedList?.hasCollaborators).toBe(true);
    });

    test<CustomTestContext>("should show true for collaborator in lists.list() endpoint", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Shared List",
        icon: "📚",
        type: "manual",
      });

      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "editor",
      );

      // Collaborator gets all lists
      const { lists } = await collaboratorApi.lists.list();

      const sharedList = lists.find((l) => l.id === list.id);

      expect(sharedList?.hasCollaborators).toBe(true);
      expect(sharedList?.userRole).toBe("editor");
    });
  });

  describe("List Invitations", () => {
    test<CustomTestContext>("should create pending invitation when adding collaborator", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      // Add collaborator (creates pending invitation)
      await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // Check that collaborator has a pending invitation
      const pendingInvitations =
        await collaboratorApi.lists.getPendingInvitations();

      expect(pendingInvitations).toHaveLength(1);
      expect(pendingInvitations[0].listId).toBe(list.id);
      expect(pendingInvitations[0].role).toBe("viewer");
    });

    test<CustomTestContext>("should allow collaborator to accept invitation", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      const { invitationId } = await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // Accept the invitation
      await collaboratorApi.lists.acceptInvitation({
        invitationId,
      });

      // Verify collaborator was added
      const { collaborators } = await ownerApi.lists.getCollaborators({
        listId: list.id,
      });

      expect(collaborators).toHaveLength(1);
      expect(collaborators[0].user.email).toBe(collaboratorEmail);
      expect(collaborators[0].status).toBe("accepted");

      // Verify no more pending invitations
      const pendingInvitations =
        await collaboratorApi.lists.getPendingInvitations();

      expect(pendingInvitations).toHaveLength(0);
    });

    test<CustomTestContext>("should allow collaborator to decline invitation", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      const { invitationId } = await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // Decline the invitation
      await collaboratorApi.lists.declineInvitation({
        invitationId,
      });

      // Verify collaborator was not added
      const { collaborators } = await ownerApi.lists.getCollaborators({
        listId: list.id,
      });

      expect(collaborators).toHaveLength(1);
      expect(collaborators[0].status).toBe("declined");

      // Verify no pending invitations
      const pendingInvitations =
        await collaboratorApi.lists.getPendingInvitations();

      expect(pendingInvitations).toHaveLength(0);
    });

    test<CustomTestContext>("should allow owner to revoke pending invitation", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorUser = await collaboratorApi.users.whoami();

      const { invitationId } = await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorUser.email!,
        role: "viewer",
      });

      // Owner revokes the invitation
      await ownerApi.lists.revokeInvitation({
        invitationId,
      });

      // Verify invitation was revoked
      const pendingInvitations =
        await collaboratorApi.lists.getPendingInvitations();

      expect(pendingInvitations).toHaveLength(0);
    });

    test<CustomTestContext>("should not allow access to list with pending invitation", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const bookmark = await ownerApi.bookmarks.createBookmark({
        type: BookmarkTypes.TEXT,
        text: "Test bookmark",
      });

      await ownerApi.lists.addToList({
        listId: list.id,
        bookmarkId: bookmark.id,
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      // Add collaborator but don't accept invitation
      await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // Collaborator should not be able to access the list yet
      await expect(
        collaboratorApi.lists.get({
          listId: list.id,
        }),
      ).rejects.toThrow("List not found");

      // Collaborator should not be able to access bookmarks in the list
      await expect(
        collaboratorApi.bookmarks.getBookmarks({
          listId: list.id,
        }),
      ).rejects.toThrow("List not found");

      // Collaborator should not be able to access individual bookmarks
      await expect(
        collaboratorApi.bookmarks.getBookmark({
          bookmarkId: bookmark.id,
        }),
      ).rejects.toThrow("Bookmark not found");
    });

    test<CustomTestContext>("should show pending invitations with list details", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test Shared List",
        icon: "📚",
        description: "A test list for sharing",
        type: "manual",
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "editor",
      });

      const pendingInvitations =
        await collaboratorApi.lists.getPendingInvitations();

      expect(pendingInvitations).toHaveLength(1);
      const invitation = pendingInvitations[0];

      expect(invitation.listId).toBe(list.id);
      expect(invitation.role).toBe("editor");
      expect(invitation.list.name).toBe("Test Shared List");
      expect(invitation.list.icon).toBe("📚");
      expect(invitation.list.description).toBe("A test list for sharing");
      expect(invitation.list.owner).toBeDefined();
    });

    test<CustomTestContext>("should show pending invitations in getCollaborators for owner", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // Owner should see pending invitation in collaborators list
      const { collaborators } = await ownerApi.lists.getCollaborators({
        listId: list.id,
      });

      expect(collaborators).toHaveLength(1);
      expect(collaborators[0].status).toBe("pending");
      expect(collaborators[0].role).toBe("viewer");
      expect(collaborators[0].user.email).toBe(collaboratorEmail);
    });

    test<CustomTestContext>("should update hasCollaborators after invitation is accepted", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      // hasCollaborators should be false initially
      expect(list.hasCollaborators).toBe(false);

      const { invitationId } = await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // hasCollaborators should be false after adding invitation (pending does not counts)
      const listAfterInvite = await ownerApi.lists.get({
        listId: list.id,
      });
      expect(listAfterInvite.hasCollaborators).toBe(false);

      // Accept the invitation
      await collaboratorApi.lists.acceptInvitation({
        invitationId,
      });

      // hasCollaborators should still be true
      const listAfterAccept = await ownerApi.lists.get({
        listId: list.id,
      });
      expect(listAfterAccept.hasCollaborators).toBe(true);
    });

    test<CustomTestContext>("should update hasCollaborators after invitation is declined", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      const { invitationId } = await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // hasCollaborators should be false with pending invitation
      const listAfterInvite = await ownerApi.lists.get({
        listId: list.id,
      });
      expect(listAfterInvite.hasCollaborators).toBe(false);

      // Decline the invitation
      await collaboratorApi.lists.declineInvitation({
        invitationId,
      });

      // hasCollaborators should be false after declining
      const listAfterDecline = await ownerApi.lists.get({
        listId: list.id,
      });
      expect(listAfterDecline.hasCollaborators).toBe(false);
    });

    test<CustomTestContext>("should not show declined invitations in pending list", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      const { invitationId } = await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // Decline the invitation
      await collaboratorApi.lists.declineInvitation({
        invitationId,
      });

      // Should not appear in pending invitations
      const pendingInvitations =
        await collaboratorApi.lists.getPendingInvitations();

      expect(pendingInvitations).toHaveLength(0);
    });

    test<CustomTestContext>("should allow re-inviting after decline", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      // First invitation
      const { invitationId } = await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // Decline it
      await collaboratorApi.lists.declineInvitation({
        invitationId,
      });

      // Re-invite with different role
      await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "editor",
      });

      // Should have a new pending invitation
      const pendingInvitations =
        await collaboratorApi.lists.getPendingInvitations();

      expect(pendingInvitations).toHaveLength(1);
      expect(pendingInvitations[0].role).toBe("editor"
);
    });

    test<CustomTestContext>("should not allow accepting non-existent invitation", async ({
      apiCallers,
    }) => {
      const collaboratorApi = apiCallers[1];

      const fakeInvitationId = "non-existent-invitation-id";

      await expect(
        collaboratorApi.lists.acceptInvitation({
          invitationId: fakeInvitationId,
        }),
      ).rejects.toThrow("Invitation not found");
    });

    test<CustomTestContext>("should not allow accepting already accepted invitation", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      const { invitationId } = await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // Accept once
      await collaboratorApi.lists.acceptInvitation({
        invitationId,
      });

      // Try to accept again (should fail since invitation is already accepted and deleted)
      await expect(
        collaboratorApi.lists.acceptInvitation({
          invitationId,
        }),
      ).rejects.toThrow("Invitation not found");
    });

    test<CustomTestContext>("should show list in shared lists only after accepting invitation", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      const { invitationId } = await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // List should not appear in collaborator's lists yet
      const listsBefore = await collaboratorApi.lists.list();
      expect(listsBefore.lists.find((l) => l.id === list.id)).toBeUndefined();

      // Accept invitation
      await collaboratorApi.lists.acceptInvitation({
        invitationId,
      });

      // Now list should appear
      const listsAfter = await collaboratorApi.lists.list();
      const sharedList = listsAfter.lists.find((l) => l.id === list.id);
      expect(sharedList).toBeDefined();
      expect(sharedList?.userRole).toBe("viewer");
    });

    test<CustomTestContext>("should handle multiple pending invitations for different lists", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list1 = await ownerApi.lists.create({
        name: "List 1",
        icon: "📚",
        type: "manual",
      });

      const list2 = await ownerApi.lists.create({
        name: "List 2",
        icon: "📖",
        type: "manual",
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      // Invite to both lists
      const { invitationId: invitationId1 } =
        await ownerApi.lists.addCollaborator({
          listId: list1.id,
          email: collaboratorEmail,
          role: "viewer",
        });

      const { invitationId: invitationId2 } =
        await ownerApi.lists.addCollaborator({
          listId: list2.id,
          email: collaboratorEmail,
          role: "editor",
        });

      // Should have 2 pending invitations
      const pendingInvitations =
        await collaboratorApi.lists.getPendingInvitations();

      expect(pendingInvitations).toHaveLength(2);

      // Accept one
      await collaboratorApi.lists.acceptInvitation({
        invitationId: invitationId1,
      });

      // Should have 1 pending invitation left
      const remainingInvitations =
        await collaboratorApi.lists.getPendingInvitations();

      expect(remainingInvitations).toHaveLength(1);
      expect(remainingInvitations[0].id).toBe(invitationId2);
      expect(remainingInvitations[0].listId).toBe(list2.id);
    });

    test<CustomTestContext>("should not allow collaborator to revoke invitation", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];
      const thirdUserApi = apiCallers[2];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      // Owner adds collaborator 1 and they accept
      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "editor",
      );

      // Owner invites third user
      const thirdUserEmail = (await thirdUserApi.users.whoami()).email!;
      const { invitationId } = await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: thirdUserEmail,
        role: "viewer",
      });

      // Collaborator tries to revoke the third user's invitation
      // Collaborator cannot access the invitation at all (not the invitee, not the owner)
      await expect(
        collaboratorApi.lists.revokeInvitation({
          invitationId,
        }),
      ).rejects.toThrow("Invitation not found");
    });

    test<CustomTestContext>("should not allow invited user to revoke their own invitation", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      const { invitationId } = await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // Invited user tries to revoke (should only be able to decline)
      await expect(
        collaboratorApi.lists.revokeInvitation({
          invitationId,
        }),
      ).rejects.toThrow("Only the list owner can perform this action");
    });

    test<CustomTestContext>("should not allow non-owner/non-invitee to access invitation", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];
      const thirdUserApi = apiCallers[2];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;

      const { invitationId } = await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // Third user (not owner, not invitee) tries to revoke invitation
      await expect(
        thirdUserApi.lists.revokeInvitation({
          invitationId,
        }),
      ).rejects.toThrow("Invitation not found");

      // Third user tries to accept invitation
      await expect(
        thirdUserApi.lists.acceptInvitation({
          invitationId,
        }),
      ).rejects.toThrow("Invitation not found");

      // Third user tries to decline invitation
      await expect(
        thirdUserApi.lists.declineInvitation({
          invitationId,
        }),
      ).rejects.toThrow("Invitation not found");
    });

    test<CustomTestContext>("should not show invitations to collaborators in getCollaborators", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];
      const thirdUserApi = apiCallers[2];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      // Owner adds collaborator 1 and they accept
      await addAndAcceptCollaborator(
        ownerApi,
        collaboratorApi,
        list.id,
        "viewer",
      );

      // Owner invites third user (pending invitation)
      const thirdUserEmail = (await thirdUserApi.users.whoami()).email!;
      await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: thirdUserEmail,
        role: "viewer",
      });

      // Owner should see 2 collaborators (1 accepted + 1 pending)
      const ownerView = await ownerApi.lists.getCollaborators({
        listId: list.id,
      });
      expect(ownerView.collaborators).toHaveLength(2);

      // Collaborator should only see 1 (themselves, no pending invitations)
      const collaboratorView = await collaboratorApi.lists.getCollaborators({
        listId: list.id,
      });
      expect(collaboratorView.collaborators).toHaveLength(1);
      expect(collaboratorView.collaborators[0].status).toBe("accepted");
    });

    test<CustomTestContext>("should allow owner to see both accepted collaborators and pending invitations", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];
      const thirdUserApi = apiCallers[2];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      // Add and accept one collaborator
      const collaboratorEmail = (await collaboratorApi.users.whoami()).email!;
      const { invitationId } = await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "editor",
      });

      await collaboratorApi.lists.acceptInvitation({
        invitationId,
      });

      // Add pending invitation for third user
      const thirdUserEmail = (await thirdUserApi.users.whoami()).email!;
      await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: thirdUserEmail,
        role: "viewer",
      });

      // Owner should see both
      const { collaborators } = await ownerApi.lists.getCollaborators({
        listId: list.id,
      });

      expect(collaborators).toHaveLength(2);

      const acceptedCollaborator = collaborators.find(
        (c) => c.status === "accepted",
      );
      const pendingCollaborator = collaborators.find(
        (c) => c.status === "pending",
      );

      expect(acceptedCollaborator).toBeDefined();
      expect(acceptedCollaborator?.role).toBe("editor");
      expect(acceptedCollaborator?.user.email).toBe(collaboratorEmail);

      expect(pendingCollaborator).toBeDefined();
      expect(pendingCollaborator?.role).toBe("viewer");
      expect(pendingCollaborator?.user.email).toBe(thirdUserEmail);
    });

    test<CustomTestContext>("should not show invitee name for pending invitations", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorUser = await collaboratorApi.users.whoami();
      const collaboratorEmail = collaboratorUser.email!;
      const collaboratorName = collaboratorUser.name;

      await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // Owner checks pending invitations
      const { collaborators } = await ownerApi.lists.getCollaborators({
        listId: list.id,
      });

      const pendingInvitation = collaborators.find(
        (c) => c.status === "pending",
      );

      expect(pendingInvitation).toBeDefined();
      // Name should be masked as "Pending User"
      expect(pendingInvitation?.user.name).toBe("Pending User");
      // Name should NOT be the actual user's name
      expect(pendingInvitation?.user.name).not.toBe(collaboratorName);
      // Email should still be visible to owner
      expect(pendingInvitation?.user.email).toBe(collaboratorEmail);
    });

    test<CustomTestContext>("should show invitee name after invitation is accepted", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorUser = await collaboratorApi.users.whoami();
      const collaboratorEmail = collaboratorUser.email!;
      const collaboratorName = collaboratorUser.name;

      const { invitationId } = await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // Before acceptance - name should be masked
      const beforeAccept = await ownerApi.lists.getCollaborators({
        listId: list.id,
      });
      const pendingInvitation = beforeAccept.collaborators.find(
        (c) => c.status === "pending",
      );
      expect(pendingInvitation?.user.name).toBe("Pending User");

      // Accept invitation
      await collaboratorApi.lists.acceptInvitation({
        invitationId,
      });

      // After acceptance - name should be visible
      const afterAccept = await ownerApi.lists.getCollaborators({
        listId: list.id,
      });
      const acceptedCollaborator = afterAccept.collaborators.find(
        (c) => c.status === "accepted",
      );
      expect(acceptedCollaborator?.user.name).toBe(collaboratorName);
      expect(acceptedCollaborator?.user.email).toBe(collaboratorEmail);
    });

    test<CustomTestContext>("should not show invitee name for declined invitations", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaboratorApi = apiCallers[1];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const collaboratorUser = await collaboratorApi.users.whoami();
      const collaboratorEmail = collaboratorUser.email!;
      const collaboratorName = collaboratorUser.name;

      const { invitationId } = await ownerApi.lists.addCollaborator({
        listId: list.id,
        email: collaboratorEmail,
        role: "viewer",
      });

      // Decline the invitation
      await collaboratorApi.lists.declineInvitation({
        invitationId,
      });

      // Owner checks declined invitations
      const { collaborators } = await ownerApi.lists.getCollaborators({
        listId: list.id,
      });

      const declinedInvitation = collaborators.find(
        (c) => c.status === "declined",
      );

      expect(declinedInvitation).toBeDefined();
      // Name should still be masked as "Pending User" even after decline
      expect(declinedInvitation?.user.name).toBe("Pending User");
      expect(declinedInvitation?.user.name).not.toBe(collaboratorName);
      // Email should still be visible to owner
      expect(declinedInvitation?.user.email).toBe(collaboratorEmail);
    });

    test<CustomTestContext>("should hide emails from non-owners", async ({
      apiCallers,
    }) => {
      const ownerApi = apiCallers[0];
      const collaborator1Api = apiCallers[1];
      const collaborator2Api = apiCallers[2];

      const list = await ownerApi.lists.create({
        name: "Test List",
        icon: "📚",
        type: "manual",
      });

      const ownerUser = await ownerApi.users.whoami();
      const ownerEmail = ownerUser.email!;

      const collaborator1User = await collaborator1Api.users.whoami();
      const collaborator1Email = collaborator1User.email!;

      const collaborator2User = await collaborator2Api.users.whoami();
      const collaborator2Email = collaborator2User.email!;

      // Add both collaborators
      await addAndAcceptCollaborator(
        ownerApi,
        collaborator1Api,
        list.id,
        "editor",
      );
      await addAndAcceptCollaborator(
        ownerApi,
        collaborator2Api,
        list.id,
        "viewer",
      );

      // Owner should see all emails
      const ownerView = await ownerApi.lists.getCollaborators({
        listId: list.id,
      });

      expect(ownerView.owner?.email).toBe(ownerEmail);

      const ownerViewCollaborators = ownerView.collaborators.filter(
        (c) => c.status === "accepted",
      );
      expect(ownerViewCollaborators).toHaveLength(2);

      const ownerViewCollab1 = ownerViewCollaborators.find(
        (c) => c.user.email === collaborator1Email,
      );
      const ownerViewCollab2 = ownerViewCollaborators.find(
        (c) => c.user.email === collaborator2Email,
      );

      expect(ownerViewCollab1?.user.email).toBe(collaborator1Email);
      expect(ownerViewCollab2?.user.email).toBe(collaborator2Email);

      // Non-owners should NOT see any emails
      const collaborator1View = await collaborator1Api.lists.getCollaborators({
        listId: list.id,
      });

      // Should not see owner email
      expect(collaborator1View.owner?.email).toBe(null);

      // Should not see other collaborators' emails
      const collab1ViewCollaborators = collaborator1View.collaborators.filter(
        (c) => c.status === "accepted",
      );
      expect(collab1ViewCollaborators).toHaveLength(2);

      collab1ViewCollaborators.forEach((c) => {
        expect(c.user.email).toBe(null);
      });

      // Verify collaborator2 also can't see emails
      const collaborator2View = await collaborator2Api.lists.getCollaborators({
        listId: list.id,
      });

      expect(collaborator2View.owner?.email).toBe(null);

      const collab2ViewCollaborators = collaborator2View.collaborators.filter(
        (c) => c.status === "accepted",
      );
      expect(collab2ViewCollaborators).toHaveLength(2);

      collab2ViewCollaborators.forEach((c) => {
        expect(c.user.email).toBe(null);
      });
    });
  });
});