template sharing

2026-06-18 11:18:10 +02:00
parent f77a592fc8
commit 85a43d1b08
20 changed files with 714 additions and 38 deletions
--- a/listify-api/src/audit/audit-log.types.ts
+++ b/listify-api/src/audit/audit-log.types.ts
@@ -10,6 +10,8 @@ export type AuditAction =
  | 'template.created_from_list'
  | 'template.updated'
  | 'template.deleted'
+  | 'template.shared'
+  | 'template.unshared'
  | 'template.item_created'
  | 'template.item_updated'
  | 'template.item_deleted'
--- a/listify-api/src/auth/user.entity.ts
+++ b/listify-api/src/auth/user.entity.ts
@@ -8,6 +8,7 @@ import {
  UpdateDateColumn,
 } from 'typeorm';
 import { ListTemplateEntity } from '../list-templates/list-template.entity';
+import { ListTemplateShareEntity } from '../list-templates/list-template-share.entity';
 import { UserListEntity } from '../lists/user-list.entity';
 import { UserListShareEntity } from '../lists/user-list-share.entity';
 import { RefreshTokenEntity } from './refresh-token.entity';
@@ -63,4 +64,7 @@ export class UserEntity {

  @OneToMany(() => UserListShareEntity, (share) => share.user)
  sharedLists?: UserListShareEntity[];
+
+  @OneToMany(() => ListTemplateShareEntity, (share) => share.user)
+  sharedTemplates?: ListTemplateShareEntity[];
 }
--- a/listify-api/src/database/data-source.ts
+++ b/listify-api/src/database/data-source.ts
@@ -7,6 +7,7 @@ import { UserEntity } from '../auth/user.entity';
 import { RefreshTokenEntity } from '../auth/refresh-token.entity';
 import { ListTemplateEntity } from '../list-templates/list-template.entity';
 import { ListTemplateItemEntity } from '../list-templates/list-template-item.entity';
+import { ListTemplateShareEntity } from '../list-templates/list-template-share.entity';
 import { TemplateSeedEntity } from '../list-templates/template-seed.entity';
 import { UserListEntity } from '../lists/user-list.entity';
 import { UserListItemEntity } from '../lists/user-list-item.entity';
@@ -35,6 +36,7 @@ export default new DataSource({
    RefreshTokenEntity,
    ListTemplateEntity,
    ListTemplateItemEntity,
+    ListTemplateShareEntity,
    TemplateSeedEntity,
    UserListEntity,
    UserListItemEntity,
--- a/listify-api/src/database/migrations/1781500000000-CreateListTemplateShares.ts
+++ b/listify-api/src/database/migrations/1781500000000-CreateListTemplateShares.ts
@@ -0,0 +1,29 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class CreateListTemplateShares1781500000000
+  implements MigrationInterface
+{
+  name = 'CreateListTemplateShares1781500000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      'CREATE TABLE `list_template_shares` (`id` varchar(36) NOT NULL, `templateId` varchar(36) NOT NULL, `userId` varchar(36) NOT NULL, `role` varchar(32) NOT NULL DEFAULT \'collaborator\', `createdAt` datetime(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3), INDEX `IDX_list_template_shares_template_id` (`templateId`), INDEX `IDX_list_template_shares_user_id` (`userId`), UNIQUE INDEX `IDX_list_template_shares_template_user` (`templateId`, `userId`), PRIMARY KEY (`id`)) ENGINE=InnoDB',
+    );
+    await queryRunner.query(
+      'ALTER TABLE `list_template_shares` ADD CONSTRAINT `FK_list_template_shares_template_id` FOREIGN KEY (`templateId`) REFERENCES `list_templates`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION',
+    );
+    await queryRunner.query(
+      'ALTER TABLE `list_template_shares` ADD CONSTRAINT `FK_list_template_shares_user_id` FOREIGN KEY (`userId`) REFERENCES `users`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION',
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      'ALTER TABLE `list_template_shares` DROP FOREIGN KEY `FK_list_template_shares_user_id`',
+    );
+    await queryRunner.query(
+      'ALTER TABLE `list_template_shares` DROP FOREIGN KEY `FK_list_template_shares_template_id`',
+    );
+    await queryRunner.query('DROP TABLE `list_template_shares`');
+  }
+}
--- a/listify-api/src/list-templates/dto/share-template.dto.ts
+++ b/listify-api/src/list-templates/dto/share-template.dto.ts
@@ -0,0 +1,3 @@
+export class ShareTemplateDto {
+  userId?: string;
+}
--- a/listify-api/src/list-templates/list-template-share.entity.ts
+++ b/listify-api/src/list-templates/list-template-share.entity.ts
@@ -0,0 +1,50 @@
+import {
+  Column,
+  CreateDateColumn,
+  Entity,
+  Index,
+  JoinColumn,
+  ManyToOne,
+  PrimaryColumn,
+} from 'typeorm';
+import { UserEntity } from '../auth/user.entity';
+import { ListTemplateEntity } from './list-template.entity';
+
+export type ListTemplateShareRole = 'collaborator';
+
+@Entity('list_template_shares')
+@Index(['templateId', 'userId'], { unique: true })
+export class ListTemplateShareEntity {
+  @PrimaryColumn({ type: 'varchar', length: 36 })
+  id!: string;
+
+  @Index()
+  @Column({ type: 'varchar', length: 36 })
+  templateId!: string;
+
+  @Index()
+  @Column({ type: 'varchar', length: 36 })
+  userId!: string;
+
+  @Column({ type: 'varchar', length: 32, default: 'collaborator' })
+  role!: ListTemplateShareRole;
+
+  @CreateDateColumn({
+    type: 'datetime',
+    precision: 3,
+    default: () => 'CURRENT_TIMESTAMP(3)',
+  })
+  createdAt!: Date;
+
+  @ManyToOne(() => ListTemplateEntity, (template) => template.shares, {
+    onDelete: 'CASCADE',
+  })
+  @JoinColumn({ name: 'templateId' })
+  template?: ListTemplateEntity;
+
+  @ManyToOne(() => UserEntity, (user) => user.sharedTemplates, {
+    onDelete: 'CASCADE',
+  })
+  @JoinColumn({ name: 'userId' })
+  user?: UserEntity;
+}
--- a/listify-api/src/list-templates/list-template.entity.ts
+++ b/listify-api/src/list-templates/list-template.entity.ts
@@ -11,6 +11,7 @@ import {
 } from 'typeorm';
 import { UserEntity } from '../auth/user.entity';
 import { ListTemplateItemEntity } from './list-template-item.entity';
+import { ListTemplateShareEntity } from './list-template-share.entity';
 import type { ListTemplateKind } from './list-template.types';

@Entity('list_templates')
@@ -60,4 +61,7 @@ export class ListTemplateEntity {
    cascade: ['insert', 'update'],
  })
  items!: ListTemplateItemEntity[];
+
+  @OneToMany(() => ListTemplateShareEntity, (share) => share.template)
+  shares?: ListTemplateShareEntity[];
 }
--- a/listify-api/src/list-templates/list-template.types.ts
+++ b/listify-api/src/list-templates/list-template.types.ts
@@ -14,14 +14,27 @@ export interface ListTemplateItem {
 export interface ListTemplate {
  id: string;
  ownerId: string;
+  ownerName?: string;
+  ownerEmail?: string;
+  accessRole: ListTemplateAccessRole;
  name: string;
  description?: string;
  kind: ListTemplateKind;
  items: ListTemplateItem[];
+  collaborators: ListTemplateCollaborator[];
  createdAt: string;
  updatedAt: string;
 }

+export type ListTemplateAccessRole = 'owner' | 'collaborator';
+
+export interface ListTemplateCollaborator {
+  id: string;
+  name?: string;
+  email: string;
+  role: 'collaborator';
+}
+
 export interface UserListItem {
  id: string;
  sourceTemplateItemId?: string;
--- a/listify-api/src/list-templates/list-templates.controller.ts
+++ b/listify-api/src/list-templates/list-templates.controller.ts
@@ -19,6 +19,7 @@ import {
  ReorderListTemplateItemsDto,
  UpdateListTemplateItemDto,
 } from './dto/list-template-item.dto';
+import { ShareTemplateDto } from './dto/share-template.dto';
 import { UpdateListTemplateDto } from './dto/update-list-template.dto';
 import { ListTemplatesService } from './list-templates.service';
 import type { AuthenticatedRequest } from '../auth/auth.types';
@@ -87,6 +88,32 @@ export class ListTemplatesController {
    );
  }

+  @Post(':templateId/shares')
+  shareTemplate(
+    @Req() request: AuthenticatedRequest,
+    @Param('templateId') templateId: string,
+    @Body() shareDto: ShareTemplateDto,
+  ) {
+    return this.listTemplatesService.shareTemplate(
+      this.requireUserId(request),
+      templateId,
+      shareDto,
+    );
+  }
+
+  @Delete(':templateId/shares/:userId')
+  removeShare(
+    @Req() request: AuthenticatedRequest,
+    @Param('templateId') templateId: string,
+    @Param('userId') userId: string,
+  ) {
+    return this.listTemplatesService.removeShare(
+      this.requireUserId(request),
+      templateId,
+      userId,
+    );
+  }
+
  @Post(':templateId/items')
  addItem(
    @Req() request: AuthenticatedRequest,
--- a/listify-api/src/list-templates/list-templates.module.ts
+++ b/listify-api/src/list-templates/list-templates.module.ts
@@ -2,10 +2,12 @@ import { Module } from '@nestjs/common';
 import { TypeOrmModule } from '@nestjs/typeorm';
 import { AuditModule } from '../audit/audit.module';
 import { AuthModule } from '../auth/auth.module';
+import { UserEntity } from '../auth/user.entity';
 import { ListsModule } from '../lists/lists.module';
 import { ListTemplatesController } from './list-templates.controller';
 import { ListTemplateEntity } from './list-template.entity';
 import { ListTemplateItemEntity } from './list-template-item.entity';
+import { ListTemplateShareEntity } from './list-template-share.entity';
 import { ListTemplatesService } from './list-templates.service';
 import { TemplateSeedEntity } from './template-seed.entity';

@@ -17,7 +19,9 @@ import { TemplateSeedEntity } from './template-seed.entity';
    TypeOrmModule.forFeature([
      ListTemplateEntity,
      ListTemplateItemEntity,
+      ListTemplateShareEntity,
      TemplateSeedEntity,
+      UserEntity,
    ]),
  ],
  controllers: [ListTemplatesController],
--- a/listify-api/src/list-templates/list-templates.service.spec.ts
+++ b/listify-api/src/list-templates/list-templates.service.spec.ts
@@ -1,19 +1,25 @@
 import { ForbiddenException, NotFoundException } from '@nestjs/common';
+import { UserEntity } from '../auth/user.entity';
 import { InMemoryRepository } from '../testing/in-memory-repository';
 import { ListTemplateEntity } from './list-template.entity';
 import { ListTemplateItemEntity } from './list-template-item.entity';
+import { ListTemplateShareEntity } from './list-template-share.entity';
 import { ListTemplatesService } from './list-templates.service';
 import { TemplateSeedEntity } from './template-seed.entity';

 describe('ListTemplatesService', () => {
  let service: ListTemplatesService;
  let templatesRepository: InMemoryRepository<ListTemplateEntity>;
+  let usersRepository: InMemoryRepository<UserEntity>;

  beforeEach(() => {
    templatesRepository = new InMemoryRepository<ListTemplateEntity>();
+    usersRepository = new InMemoryRepository<UserEntity>();
    service = new ListTemplatesService(
      templatesRepository as never,
      new InMemoryRepository<ListTemplateItemEntity>() as never,
+      new InMemoryRepository<ListTemplateShareEntity>() as never,
+      usersRepository as never,
      new InMemoryRepository<TemplateSeedEntity>() as never,
    );
  });
@@ -69,6 +75,7 @@ describe('ListTemplatesService', () => {

    expect(template.name).toBe('Urlaub');
    expect(template.kind).toBe('packing');
+    expect(template.accessRole).toBe('owner');
    expect(template.items).toHaveLength(2);
    expect(template.items[0].title).toBe('Pass');
    expect(
@@ -81,6 +88,54 @@ describe('ListTemplatesService', () => {
    ).toBe(false);
  });

+  it('allows owners to share templates with collaborators', async () => {
+    await usersRepository.save({
+      id: 'user-2',
+      email: 'collaborator@example.com',
+      passwordHash: 'hash',
+      verified: true,
+      onboardingCompleted: false,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    const template = await service.createTemplate('user-1', {
+      name: 'Geteilte Vorlage',
+      items: [{ title: 'Gemeinsamer Schritt' }],
+    });
+
+    const sharedTemplate = await service.shareTemplate('user-1', template.id, {
+      userId: 'user-2',
+    });
+    const collaboratorTemplate = await service.getTemplate('user-2', template.id);
+    const updatedByCollaborator = await service.addItem('user-2', template.id, {
+      title: 'Vom Collaborator',
+    });
+
+    expect(sharedTemplate.collaborators).toEqual([
+      expect.objectContaining({
+        id: 'user-2',
+        email: 'collaborator@example.com',
+      }),
+    ]);
+    expect(collaboratorTemplate.accessRole).toBe('collaborator');
+    expect(updatedByCollaborator.items.map((item) => item.title)).toContain(
+      'Vom Collaborator',
+    );
+    expect(
+      (await service.listTemplates('user-2')).some(
+        (existingTemplate) => existingTemplate.id === template.id,
+      ),
+    ).toBe(true);
+    await expect(service.deleteTemplate('user-2', template.id)).rejects.toThrow(
+      ForbiddenException,
+    );
+
+    await service.removeShare('user-1', template.id, 'user-2');
+    await expect(service.getTemplate('user-2', template.id)).rejects.toThrow(
+      ForbiddenException,
+    );
+  });
+
  it('updates template metadata and item content', async () => {
    const template = await service.createTemplate('user-1', {
      name: 'Einkauf',
--- a/listify-api/src/list-templates/list-templates.service.ts
+++ b/listify-api/src/list-templates/list-templates.service.ts
@@ -9,11 +9,13 @@ import { InjectRepository } from '@nestjs/typeorm';
 import { randomUUID } from 'crypto';
 import { IsNull, Repository } from 'typeorm';
 import { AuditLogService } from '../audit/audit-log.service';
+import { UserEntity } from '../auth/user.entity';
 import {
  AddListTemplateItemDto,
  ReorderListTemplateItemsDto,
  UpdateListTemplateItemDto,
 } from './dto/list-template-item.dto';
+import { ShareTemplateDto } from './dto/share-template.dto';
 import {
  CreateListTemplateDto,
  CreateListTemplateItemDto,
@@ -21,11 +23,13 @@ import {
 import { UpdateListTemplateDto } from './dto/update-list-template.dto';
 import {
  ListTemplate,
+  ListTemplateAccessRole,
  ListTemplateItem,
  ListTemplateKind,
 } from './list-template.types';
 import { ListTemplateEntity } from './list-template.entity';
 import { ListTemplateItemEntity } from './list-template-item.entity';
+import { ListTemplateShareEntity } from './list-template-share.entity';
 import { TemplateSeedEntity } from './template-seed.entity';

@Injectable()
@@ -35,6 +39,10 @@ export class ListTemplatesService {
    private readonly templatesRepository: Repository<ListTemplateEntity>,
    @InjectRepository(ListTemplateItemEntity)
    private readonly templateItemsRepository: Repository<ListTemplateItemEntity>,
+    @InjectRepository(ListTemplateShareEntity)
+    private readonly templateSharesRepository: Repository<ListTemplateShareEntity>,
+    @InjectRepository(UserEntity)
+    private readonly usersRepository: Repository<UserEntity>,
    @InjectRepository(TemplateSeedEntity)
    private readonly templateSeedsRepository: Repository<TemplateSeedEntity>,
    @Optional()
@@ -69,26 +77,56 @@ export class ListTemplatesService {
      },
    });

-    return this.toListTemplate(savedTemplate);
+    return this.toListTemplate(savedTemplate, ownerId);
  }

  async listTemplates(ownerId: string): Promise<ListTemplate[]> {
    await this.ensureExampleTemplates(ownerId);

-    const templates = await this.templatesRepository.find({
+    const ownedTemplates = await this.templatesRepository.find({
      where: { ownerId, deletedAt: IsNull() },
-      relations: { items: true },
+      relations: { items: true, owner: true, shares: { user: true } },
      order: { name: 'ASC', items: { position: 'ASC' } },
    });
+    const sharedTemplateShares = await this.templateSharesRepository.find({
+      where: { userId: ownerId },
+      relations: { template: { items: true, owner: true, shares: { user: true } } },
+    });
+    const templatesById = new Map<string, ListTemplateEntity>();

-    return templates.map((template) => this.toListTemplate(template));
+    for (const template of ownedTemplates) {
+      await this.hydrateTemplateAccessRelations(template);
+      templatesById.set(template.id, template);
+    }
+
+    for (const share of sharedTemplateShares) {
+      const sharedTemplate =
+        share.template ??
+        (await this.templatesRepository.findOne({
+          where: { id: share.templateId, deletedAt: IsNull() },
+          relations: { items: true, owner: true, shares: { user: true } },
+          order: { items: { position: 'ASC' } },
+        }));
+
+      if (sharedTemplate && !sharedTemplate.deletedAt) {
+        await this.hydrateTemplateAccessRelations(sharedTemplate);
+        templatesById.set(sharedTemplate.id, sharedTemplate);
+      }
+    }
+
+    return [...templatesById.values()]
+      .sort((left, right) => left.name.localeCompare(right.name))
+      .map((template) => this.toListTemplate(template, ownerId));
  }

  async getTemplate(
    ownerId: string,
    templateId: string,
  ): Promise<ListTemplate> {
-    return this.toListTemplate(await this.findOwnedTemplate(ownerId, templateId));
+    return this.toListTemplate(
+      await this.findAccessibleTemplate(ownerId, templateId),
+      ownerId,
+    );
  }

  async updateTemplate(
@@ -96,7 +134,7 @@ export class ListTemplatesService {
    templateId: string,
    updateDto: UpdateListTemplateDto,
  ): Promise<ListTemplate> {
-    const template = await this.findOwnedTemplate(ownerId, templateId);
+    const template = await this.findAccessibleTemplate(ownerId, templateId);

    if (updateDto.name !== undefined) {
      template.name = this.requireName(updateDto.name);
@@ -136,7 +174,7 @@ export class ListTemplatesService {
      },
    });

-    return this.toListTemplate(savedTemplate);
+    return this.toListTemplate(savedTemplate, ownerId);
  }

  async deleteTemplate(
@@ -163,12 +201,88 @@ export class ListTemplatesService {
    return { message: 'List template deleted.' };
  }

+  async shareTemplate(
+    ownerId: string,
+    templateId: string,
+    shareDto: ShareTemplateDto,
+  ): Promise<ListTemplate> {
+    const template = await this.findOwnedTemplate(ownerId, templateId);
+    const targetUserId = this.requireShareUserId(shareDto.userId);
+
+    if (targetUserId === ownerId) {
+      throw new BadRequestException('Template owner cannot be added as collaborator.');
+    }
+
+    const targetUser = await this.usersRepository.findOne({
+      where: { id: targetUserId },
+    });
+
+    if (!targetUser || !targetUser.verified) {
+      throw new NotFoundException('User was not found.');
+    }
+
+    const existingShare = await this.templateSharesRepository.findOne({
+      where: { templateId, userId: targetUserId },
+    });
+
+    if (!existingShare) {
+      await this.templateSharesRepository.save(
+        this.templateSharesRepository.create({
+          id: randomUUID(),
+          templateId,
+          userId: targetUserId,
+          role: 'collaborator',
+        }),
+      );
+    }
+
+    await this.auditLogService?.record({
+      actorUserId: ownerId,
+      action: 'template.shared',
+      entityType: 'template',
+      entityId: template.id,
+      metadata: {
+        sharedWithUserId: targetUserId,
+        sharedWithEmail: targetUser.email,
+      },
+    });
+
+    return this.getTemplate(ownerId, templateId);
+  }
+
+  async removeShare(
+    ownerId: string,
+    templateId: string,
+    collaboratorUserId: string,
+  ): Promise<ListTemplate> {
+    const template = await this.findOwnedTemplate(ownerId, templateId);
+    const existingShare = await this.templateSharesRepository.findOne({
+      where: { templateId, userId: collaboratorUserId },
+    });
+
+    if (!existingShare) {
+      throw new NotFoundException('Template share was not found.');
+    }
+
+    await this.templateSharesRepository.remove(existingShare);
+
+    await this.auditLogService?.record({
+      actorUserId: ownerId,
+      action: 'template.unshared',
+      entityType: 'template',
+      entityId: template.id,
+      metadata: { removedUserId: collaboratorUserId },
+    });
+
+    return this.getTemplate(ownerId, templateId);
+  }
+
  async addItem(
    ownerId: string,
    templateId: string,
    addDto: AddListTemplateItemDto,
  ): Promise<ListTemplate> {
-    const template = await this.findOwnedTemplate(ownerId, templateId);
+    const template = await this.findAccessibleTemplate(ownerId, templateId);
    const item = this.createTemplateItem(addDto, template.items.length);

    item.templateId = template.id;
@@ -198,7 +312,7 @@ export class ListTemplatesService {
    itemId: string,
    updateDto: UpdateListTemplateItemDto,
  ): Promise<ListTemplate> {
-    const template = await this.findOwnedTemplate(ownerId, templateId);
+    const template = await this.findAccessibleTemplate(ownerId, templateId);
    const item = this.findTemplateItem(template, itemId);

    if (updateDto.title !== undefined) {
@@ -243,7 +357,7 @@ export class ListTemplatesService {
    templateId: string,
    reorderDto: ReorderListTemplateItemsDto,
  ): Promise<ListTemplate> {
-    const template = await this.findOwnedTemplate(ownerId, templateId);
+    const template = await this.findAccessibleTemplate(ownerId, templateId);
    const itemIds = reorderDto.itemIds;

    if (!Array.isArray(itemIds)) {
@@ -292,7 +406,7 @@ export class ListTemplatesService {
    templateId: string,
    itemId: string,
  ): Promise<ListTemplate> {
-    const template = await this.findOwnedTemplate(ownerId, templateId);
+    const template = await this.findAccessibleTemplate(ownerId, templateId);
    const itemIndex = template.items.findIndex((item) => item.id === itemId);

    if (itemIndex === -1) {
@@ -323,13 +437,13 @@ export class ListTemplatesService {
    return this.getTemplate(ownerId, templateId);
  }

-  private async findOwnedTemplate(
+  private async findAccessibleTemplate(
    ownerId: string,
    templateId: string,
  ): Promise<ListTemplateEntity> {
    const template = await this.templatesRepository.findOne({
      where: { id: templateId, deletedAt: IsNull() },
-      relations: { items: true },
+      relations: { items: true, owner: true, shares: { user: true } },
      order: { items: { position: 'ASC' } },
    });

@@ -337,11 +451,27 @@ export class ListTemplatesService {
      throw new NotFoundException('List template was not found.');
    }

-    if (template.ownerId !== ownerId) {
+    await this.hydrateTemplateAccessRelations(template);
+
+    if (!this.canAccessTemplate(template, ownerId)) {
      throw new ForbiddenException('List template belongs to another user.');
    }

    template.items = template.items ?? [];
+    template.shares = template.shares ?? [];
+    return template;
+  }
+
+  private async findOwnedTemplate(
+    ownerId: string,
+    templateId: string,
+  ): Promise<ListTemplateEntity> {
+    const template = await this.findAccessibleTemplate(ownerId, templateId);
+
+    if (template.ownerId !== ownerId) {
+      throw new ForbiddenException('Only the template owner can perform this action.');
+    }
+
    return template;
  }

@@ -518,16 +648,74 @@ export class ListTemplatesService {
    return value;
  }

-  private toListTemplate(template: ListTemplateEntity): ListTemplate {
+  private requireShareUserId(userId?: string): string {
+    const normalizedUserId = userId?.trim();
+
+    if (!normalizedUserId) {
+      throw new BadRequestException('User id is required.');
+    }
+
+    return normalizedUserId;
+  }
+
+  private canAccessTemplate(template: ListTemplateEntity, userId: string): boolean {
+    return (
+      template.ownerId === userId ||
+      Boolean(template.shares?.some((share) => share.userId === userId))
+    );
+  }
+
+  private accessRoleFor(
+    template: ListTemplateEntity,
+    viewerId?: string,
+  ): ListTemplateAccessRole {
+    return template.ownerId === viewerId ? 'owner' : 'collaborator';
+  }
+
+  private async hydrateTemplateAccessRelations(
+    template: ListTemplateEntity,
+  ): Promise<void> {
+    template.owner ??= (await this.usersRepository.findOne({
+      where: { id: template.ownerId },
+    })) ?? undefined;
+
+    const storedShares = await this.templateSharesRepository.find({
+      where: { templateId: template.id },
+      relations: { user: true },
+    });
+    template.shares = storedShares;
+
+    for (const share of template.shares) {
+      share.user ??= (await this.usersRepository.findOne({
+        where: { id: share.userId },
+      })) ?? undefined;
+    }
+  }
+
+  private toListTemplate(
+    template: ListTemplateEntity,
+    viewerId?: string,
+  ): ListTemplate {
    return {
      id: template.id,
      ownerId: template.ownerId,
+      ownerName: template.owner?.name ?? undefined,
+      ownerEmail: template.owner?.email ?? undefined,
+      accessRole: this.accessRoleFor(template, viewerId),
      name: template.name,
      description: template.description ?? undefined,
      kind: template.kind,
      items: (template.items ?? [])
        .sort((left, right) => left.position - right.position)
        .map((item) => this.toListTemplateItem(item)),
+      collaborators: (template.shares ?? [])
+        .filter((share) => Boolean(share.user))
+        .map((share) => ({
+          id: share.userId,
+          name: share.user?.name ?? undefined,
+          email: share.user!.email,
+          role: 'collaborator',
+        })),
      createdAt: this.toIsoString(template.createdAt),
      updatedAt: this.toIsoString(template.updatedAt),
    };
--- a/listify-api/src/lists/lists.service.spec.ts
+++ b/listify-api/src/lists/lists.service.spec.ts
@@ -259,8 +259,10 @@ describe('ListsService', () => {
    const template: ListTemplate = {
      id: 'template-1',
      ownerId: 'user-1',
+      accessRole: 'owner',
      name: 'Urlaub',
      kind: 'packing',
+      collaborators: [],
      items: [
        {
          id: 'template-item-1',
--- a/listify-api/src/lists/lists.service.ts
+++ b/listify-api/src/lists/lists.service.ts
@@ -135,10 +135,6 @@ export class ListsService {
    template: ListTemplate,
    createDto: CreateListFromTemplateDto = {},
  ): Promise<UserList> {
-    if (template.ownerId !== ownerId) {
-      throw new ForbiddenException('List template belongs to another user.');
-    }
-
    const list = this.listsRepository.create({
      id: randomUUID(),
      ownerId,
@@ -876,6 +872,9 @@ export class ListsService {
    return {
      id: template.id,
      ownerId: template.ownerId,
+      ownerName: undefined,
+      ownerEmail: undefined,
+      accessRole: 'owner',
      name: template.name,
      description: template.description ?? undefined,
      kind: template.kind,
@@ -891,6 +890,7 @@ export class ListsService {
          createdAt: this.toIsoString(item.createdAt),
          updatedAt: this.toIsoString(item.updatedAt),
        })),
+      collaborators: [],
      createdAt: this.toIsoString(template.createdAt),
      updatedAt: this.toIsoString(template.updatedAt),
    };
--- a/listify-client/src/app/templates/template-detail/template-detail.component.html
+++ b/listify-client/src/app/templates/template-detail/template-detail.component.html
@@ -1,11 +1,16 @@
 <section class="template-detail-page">
  <header class="detail-header">
-    <button mat-icon-button type="button" aria-label="Zurück" (click)="backToTemplates()">
+    <button mat-icon-button type="button" aria-label="Zurueck" (click)="backToTemplates()">
      <mat-icon aria-hidden="true">arrow_back</mat-icon>
    </button>
    <div>
      <h1>{{ template()?.name || (isCreateMode() ? 'Neues Template' : 'Template') }}</h1>
-      <p>{{ isCreateMode() ? 'Vorlage anlegen' : 'Vorlage bearbeiten' }}</p>
+      <p>
+        {{ isCreateMode() ? 'Vorlage anlegen' : 'Vorlage bearbeiten' }}
+        @if (template()?.accessRole === 'collaborator') {
+          - geteilt von {{ template()!.ownerName || template()!.ownerEmail || 'Owner' }}
+        }
+      </p>
    </div>
    @if (canEditItems()) {
      <div class="detail-actions">
@@ -23,13 +28,15 @@
          }
          Als Liste
        </button>
-        <button mat-icon-button type="button" aria-label="Template löschen" [disabled]="deletingTemplate()" (click)="deleteTemplate()">
-          @if (deletingTemplate()) {
-            <mat-progress-spinner mode="indeterminate" diameter="18" />
-          } @else {
-            <mat-icon aria-hidden="true">delete</mat-icon>
-          }
-        </button>
+        @if (canDeleteTemplate()) {
+          <button mat-icon-button type="button" aria-label="Template loeschen" [disabled]="deletingTemplate()" (click)="deleteTemplate()">
+            @if (deletingTemplate()) {
+              <mat-progress-spinner mode="indeterminate" diameter="18" />
+            } @else {
+              <mat-icon aria-hidden="true">delete</mat-icon>
+            }
+          </button>
+        }
      </div>
    }
  </header>
@@ -86,17 +93,115 @@
      </mat-card-content>
    </mat-card>

+    @if (template() && (canManageShares() || template()!.collaborators.length > 0 || template()!.accessRole === 'collaborator')) {
+      <mat-card class="editor-card" appearance="outlined">
+        <mat-card-header>
+          <mat-card-title>Freigaben</mat-card-title>
+          <mat-card-subtitle>
+            @if (canManageShares()) {
+              {{ template()!.collaborators.length }} Mitwirkende
+            } @else {
+              Geteilt von {{ template()!.ownerName || template()!.ownerEmail || 'Owner' }}
+            }
+          </mat-card-subtitle>
+        </mat-card-header>
+
+        <mat-card-content>
+          @if (canManageShares()) {
+            <mat-form-field appearance="outline" class="share-search-field">
+              <mat-label>User suchen</mat-label>
+              <mat-icon matPrefix aria-hidden="true">person_search</mat-icon>
+              <input
+                matInput
+                type="search"
+                [value]="shareSearchTerm()"
+                (input)="searchShareUsers($any($event.target).value)"
+                autocomplete="off"
+              />
+              @if (searchingUsers()) {
+                <mat-progress-spinner matSuffix mode="indeterminate" diameter="18" />
+              }
+            </mat-form-field>
+
+            @if (availableShareSearchResults().length > 0) {
+              <ul class="share-results">
+                @for (user of availableShareSearchResults(); track user.id) {
+                  <li>
+                    <span>{{ displayUser(user) }}</span>
+                    <button
+                      mat-stroked-button
+                      type="button"
+                      [disabled]="sharingUserId() === user.id"
+                      (click)="shareWithUser(user)"
+                    >
+                      @if (sharingUserId() === user.id) {
+                        <mat-progress-spinner mode="indeterminate" diameter="18" />
+                      } @else {
+                        <mat-icon aria-hidden="true">person_add</mat-icon>
+                      }
+                      Hinzufuegen
+                    </button>
+                  </li>
+                }
+              </ul>
+            } @else if (shareSearchTerm().trim().length >= 2 && !searchingUsers()) {
+              <div class="inline-empty">
+                <mat-icon aria-hidden="true">person_off</mat-icon>
+                <span>Keine passenden User gefunden.</span>
+              </div>
+            }
+          }
+
+          @if (template()!.collaborators.length > 0) {
+            <ul class="collaborator-list">
+              @for (collaborator of template()!.collaborators; track collaborator.id) {
+                <li>
+                  <div>
+                    <strong>{{ collaborator.name || collaborator.email }}</strong>
+                    @if (collaborator.name) {
+                      <span>{{ collaborator.email }}</span>
+                    }
+                  </div>
+
+                  @if (canManageShares()) {
+                    <button
+                      mat-icon-button
+                      type="button"
+                      [attr.aria-label]="displayUser(collaborator) + ' entfernen'"
+                      [disabled]="removingShareUserId() === collaborator.id"
+                      (click)="removeCollaborator(collaborator.id)"
+                    >
+                      @if (removingShareUserId() === collaborator.id) {
+                        <mat-progress-spinner mode="indeterminate" diameter="18" />
+                      } @else {
+                        <mat-icon aria-hidden="true">person_remove</mat-icon>
+                      }
+                    </button>
+                  }
+                </li>
+              }
+            </ul>
+          } @else {
+            <div class="inline-empty">
+              <mat-icon aria-hidden="true">group</mat-icon>
+              <span>Noch keine Mitwirkenden.</span>
+            </div>
+          }
+        </mat-card-content>
+      </mat-card>
+    }
+
    <mat-card class="editor-card" appearance="outlined" data-onboarding="template-item">
      <mat-card-header>
        <mat-card-title>Items</mat-card-title>
        <mat-card-subtitle>
          @if (canEditItems()) {
-            {{ template()?.items?.length || 0 }} Einträge
+            {{ template()?.items?.length || 0 }} Eintraege
            @if (reordering()) {
              - Reihenfolge wird gespeichert
            }
          } @else {
-            Nach dem Speichern verfügbar
+            Nach dem Speichern verfuegbar
          }
        </mat-card-subtitle>
      </mat-card-header>
@@ -119,14 +224,14 @@
            } @else {
              <mat-icon aria-hidden="true">add</mat-icon>
            }
-            Hinzufügen
+            Hinzufuegen
          </button>
        </form>

        @if (!canEditItems()) {
          <div class="inline-empty">
            <mat-icon aria-hidden="true">save</mat-icon>
-            <span>Speichere das Template, bevor du Items hinzufügst.</span>
+            <span>Speichere das Template, bevor du Items hinzufuegst.</span>
          </div>
        } @else if (template()?.items?.length) {
          <ul
--- a/listify-client/src/app/templates/template-detail/template-detail.component.scss
+++ b/listify-client/src/app/templates/template-detail/template-detail.component.scss
@@ -76,6 +76,56 @@
  margin-right: 0.5rem;
 }

+.share-search-field {
+  width: 100%;
+}
+
+.share-results,
+.collaborator-list {
+  display: grid;
+  gap: 0.5rem;
+  margin: 0.75rem 0 0;
+  padding: 0;
+  list-style: none;
+}
+
+.share-results li,
+.collaborator-list li {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) auto;
+  align-items: center;
+  gap: 0.75rem;
+  min-width: 0;
+  padding: 0.6rem;
+  border: 1px solid color-mix(in srgb, var(--mat-sys-outline-variant) 72%, transparent);
+  border-radius: 8px;
+  background: color-mix(in srgb, var(--mat-sys-surface-container-low) 36%, var(--mat-sys-surface));
+}
+
+.share-results span,
+.collaborator-list strong,
+.collaborator-list span {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.collaborator-list div {
+  display: grid;
+  min-width: 0;
+}
+
+.collaborator-list span {
+  color: var(--mat-sys-on-surface-variant);
+  font-size: 0.85rem;
+}
+
+.share-results mat-progress-spinner,
+.collaborator-list mat-progress-spinner {
+  display: inline-flex;
+  margin-right: 0.5rem;
+}
+
 .state-card mat-card-content {
  display: grid;
  justify-items: center;
--- a/listify-client/src/app/templates/template-detail/template-detail.component.ts
+++ b/listify-client/src/app/templates/template-detail/template-detail.component.ts
@@ -12,6 +12,8 @@ import { MatIconModule } from '@angular/material/icon';
 import { MatInputModule } from '@angular/material/input';
 import { MatProgressSpinnerModule } from '@angular/material/progress-spinner';
 import { MatSnackBar, MatSnackBarModule } from '@angular/material/snack-bar';
+import { AuthService } from '../../auth/auth.service';
+import { PublicUserSearchResult } from '../../auth/auth.models';
 import { getAuthErrorMessage } from '../../auth/error-message';
 import { OnboardingService } from '../../onboarding/onboarding.service';
 import { ConfirmDeleteDialogComponent } from '../confirm-delete-dialog/confirm-delete-dialog.component';
@@ -44,6 +46,7 @@ import { TemplatesService } from '../templates.service';
 export class TemplateDetailComponent implements OnInit {
  private readonly formBuilder = inject(NonNullableFormBuilder);
  private readonly dialog = inject(MatDialog);
+  private readonly authService = inject(AuthService);
  private readonly route = inject(ActivatedRoute);
  private readonly router = inject(Router);
  private readonly snackBar = inject(MatSnackBar);
@@ -60,6 +63,11 @@ export class TemplateDetailComponent implements OnInit {
  protected readonly copyingTemplate = signal(false);
  protected readonly reordering = signal(false);
  protected readonly errorMessage = signal<string | null>(null);
+  protected readonly shareSearchTerm = signal('');
+  protected readonly shareSearchResults = signal<PublicUserSearchResult[]>([]);
+  protected readonly searchingUsers = signal(false);
+  protected readonly sharingUserId = signal<string | null>(null);
+  protected readonly removingShareUserId = signal<string | null>(null);

  protected readonly templateForm = this.formBuilder.group({
    name: ['', [Validators.required]],
@@ -71,6 +79,22 @@ export class TemplateDetailComponent implements OnInit {
    required: [true],
  });
  protected readonly canEditItems = computed(() => Boolean(this.template()?.id));
+  protected readonly canManageShares = computed(
+    () => this.template()?.accessRole === 'owner' && !this.isCreateMode(),
+  );
+  protected readonly canDeleteTemplate = computed(
+    () => this.template()?.accessRole === 'owner' && !this.isCreateMode(),
+  );
+  protected readonly availableShareSearchResults = computed(() => {
+    const template = this.template();
+    const collaboratorIds = new Set(
+      template?.collaborators.map((collaborator) => collaborator.id) ?? [],
+    );
+
+    return this.shareSearchResults().filter(
+      (user) => user.id !== template?.ownerId && !collaboratorIds.has(user.id),
+    );
+  });

  ngOnInit(): void {
    this.isCreateMode.set(this.templateId() === null);
@@ -292,11 +316,7 @@ export class TemplateDetailComponent implements OnInit {
    const templateId = this.templateId();
    const template = this.template();

-    if (
-      !templateId ||
-      !template ||
-      this.deletingTemplate()
-    ) {
+    if (!templateId || !template || !this.canDeleteTemplate() || this.deletingTemplate()) {
      return;
    }

@@ -338,6 +358,77 @@ export class TemplateDetailComponent implements OnInit {
    await this.router.navigateByUrl('/templates');
  }

+  protected searchShareUsers(term: string): void {
+    this.shareSearchTerm.set(term);
+
+    if (term.trim().length < 2) {
+      this.shareSearchResults.set([]);
+      return;
+    }
+
+    this.searchingUsers.set(true);
+    this.authService
+      .searchUsers(term)
+      .pipe(finalize(() => this.searchingUsers.set(false)))
+      .subscribe({
+        next: (users) => this.shareSearchResults.set(users),
+        error: (error: unknown) => {
+          this.shareSearchResults.set([]);
+          this.snackBar.open(getAuthErrorMessage(error), 'OK', { duration: 5000 });
+        },
+      });
+  }
+
+  protected shareWithUser(user: PublicUserSearchResult): void {
+    const templateId = this.templateId();
+
+    if (!templateId || this.sharingUserId()) {
+      return;
+    }
+
+    this.sharingUserId.set(user.id);
+    this.templatesService
+      .shareTemplate(templateId, user.id)
+      .pipe(finalize(() => this.sharingUserId.set(null)))
+      .subscribe({
+        next: (template) => {
+          this.setTemplate(template);
+          this.shareSearchTerm.set('');
+          this.shareSearchResults.set([]);
+          this.snackBar.open('Template geteilt.', 'OK', { duration: 2500 });
+        },
+        error: (error: unknown) => {
+          this.snackBar.open(getAuthErrorMessage(error), 'OK', { duration: 5000 });
+        },
+      });
+  }
+
+  protected removeCollaborator(userId: string): void {
+    const templateId = this.templateId();
+
+    if (!templateId || this.removingShareUserId()) {
+      return;
+    }
+
+    this.removingShareUserId.set(userId);
+    this.templatesService
+      .removeShare(templateId, userId)
+      .pipe(finalize(() => this.removingShareUserId.set(null)))
+      .subscribe({
+        next: (template) => {
+          this.setTemplate(template);
+          this.snackBar.open('Freigabe entfernt.', 'OK', { duration: 2500 });
+        },
+        error: (error: unknown) => {
+          this.snackBar.open(getAuthErrorMessage(error), 'OK', { duration: 5000 });
+        },
+      });
+  }
+
+  protected displayUser(user: { name?: string; email: string }): string {
+    return user.name ? `${user.name} (${user.email})` : user.email;
+  }
+
  private setTemplate(template: ListTemplate): void {
    this.template.set(template);
    this.templateForm.reset({
--- a/listify-client/src/app/templates/templates.component.html
+++ b/listify-client/src/app/templates/templates.component.html
@@ -41,7 +41,12 @@
        <mat-card class="template-card" appearance="outlined">
          <mat-card-header>
            <mat-card-title>{{ template.name }}</mat-card-title>
-            <mat-card-subtitle>{{ kindLabel(template.kind) }}</mat-card-subtitle>
+            <mat-card-subtitle>
+              {{ kindLabel(template.kind) }}
+              @if (template.accessRole === 'collaborator') {
+                - geteilt von {{ template.ownerName || template.ownerEmail || 'Owner' }}
+              }
+            </mat-card-subtitle>
          </mat-card-header>

          <mat-card-content>
@@ -58,6 +63,12 @@
                <mat-icon aria-hidden="true">schedule</mat-icon>
                {{ template.updatedAt | date: 'dd.MM.yyyy' }}
              </span>
+              @if (template.collaborators.length > 0) {
+                <span>
+                  <mat-icon aria-hidden="true">group</mat-icon>
+                  {{ template.collaborators.length }} Mitwirkende
+                </span>
+              }
            </div>

            @if (template.items.length > 0) {
@@ -92,6 +103,7 @@
              <mat-icon aria-hidden="true">edit</mat-icon>
              Bearbeiten
            </a>
+            @if (template.accessRole === 'owner') {
            <button
              mat-icon-button
              type="button"
@@ -105,6 +117,7 @@
                <mat-icon aria-hidden="true">delete</mat-icon>
              }
            </button>
+            }
          </mat-card-actions>
        </mat-card>
      }
--- a/listify-client/src/app/templates/templates.models.ts
+++ b/listify-client/src/app/templates/templates.models.ts
@@ -14,14 +14,27 @@ export interface ListTemplateItem {
 export interface ListTemplate {
  id: string;
  ownerId: string;
+  ownerName?: string;
+  ownerEmail?: string;
+  accessRole: ListTemplateAccessRole;
  name: string;
  description?: string;
  kind: ListTemplateKind;
  items: ListTemplateItem[];
+  collaborators: ListTemplateCollaborator[];
  createdAt: string;
  updatedAt: string;
 }

+export type ListTemplateAccessRole = 'owner' | 'collaborator';
+
+export interface ListTemplateCollaborator {
+  id: string;
+  name?: string;
+  email: string;
+  role: 'collaborator';
+}
+
 export interface UserListItem {
  id: string;
  sourceTemplateItemId?: string;
@@ -38,12 +51,21 @@ export interface UserListItem {
 export interface UserList {
  id: string;
  ownerId: string;
+  ownerName?: string;
+  ownerEmail?: string;
+  accessRole?: 'owner' | 'collaborator';
  sourceTemplateId?: string;
  name: string;
  description?: string;
  kind: ListTemplateKind;
  reminderAt?: string | null;
  items: UserListItem[];
+  collaborators?: Array<{
+    id: string;
+    name?: string;
+    email: string;
+    role: 'collaborator';
+  }>;
  createdAt: string;
  updatedAt: string;
 }
--- a/listify-client/src/app/templates/templates.service.ts
+++ b/listify-client/src/app/templates/templates.service.ts
@@ -39,6 +39,18 @@ export class TemplatesService {
    return this.http.delete<{ message: string }>(`${this.apiUrl}/${templateId}`);
  }

+  shareTemplate(templateId: string, userId: string): Observable<ListTemplate> {
+    return this.http.post<ListTemplate>(`${this.apiUrl}/${templateId}/shares`, {
+      userId,
+    });
+  }
+
+  removeShare(templateId: string, userId: string): Observable<ListTemplate> {
+    return this.http.delete<ListTemplate>(
+      `${this.apiUrl}/${templateId}/shares/${userId}`,
+    );
+  }
+
  createListFromTemplate(
    templateId: string,
    data: CreateListFromTemplateRequest = {},