Add stage 3: todo list and item CRUD API

Two migrations add todo_lists (owner_id FK to users, title, description) and
todo_items (list_id FK, text, complete, position), both with ON DELETE
CASCADE.

New endpoints under /api/lists, all behind AuthMiddleware:
  - lists: index / store / show / update (PATCH) / destroy
  - items: nested under a list, same five verbs
Lists are owner-scoped — another user's or a missing list responds 404, never
403. New items append after the highest position unless one is given; the
list carries item_count / completed_count. Item PATCH is partial and never
renumbers siblings.

Adds App\Support\Validator for request-body checks, TodoList/TodoItem
repositories, and body()/user() helpers on the Controller base. Feature tests
move their shared harness into tests/ApiTestCase; TodoTest covers CRUD,
ownership isolation, ordering, completion counts, validation and cascade
delete. Full suite: 15 passing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/Http/Controllers/Controller.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Http\Controllers;
 
 use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
 
 /**
  * Shared helpers for HTTP controllers.
@@ -26,4 +27,29 @@ abstract class Controller
             ->withHeader('Content-Type', 'application/json')
             ->withStatus($status);
     }
+
+    /**
+     * The parsed JSON request body as an array (empty when absent or not an object).
+     *
+     * @return array<string, mixed>
+     */
+    protected function body(Request $request): array
+    {
+        $parsed = $request->getParsedBody();
+
+        return is_array($parsed) ? $parsed : [];
+    }
+
+    /**
+     * The authenticated user attached by AuthMiddleware.
+     *
+     * @return array{id: int, email: string, email_verified_at: string|null, created_at: string}
+     */
+    protected function user(Request $request): array
+    {
+        /** @var array{id: int, email: string, email_verified_at: string|null, created_at: string} $user */
+        $user = $request->getAttribute('user');
+
+        return $user;
+    }
 }

src/Http/Controllers/TodoItemController.php

@@ -0,0 +1,156 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers;
+
+use App\Exception\ApiException;
+use App\Repository\TodoItemRepository;
+use App\Repository\TodoListRepository;
+use App\Support\Validator;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
+/**
+ * CRUD for the items within one todo list. Every route first checks that the
+ * parent list is owned by the authenticated user; otherwise it responds 404.
+ */
+final class TodoItemController extends Controller
+{
+    private const TEXT_MAX = 1000;
+
+    public function __construct(
+        private readonly TodoListRepository $lists,
+        private readonly TodoItemRepository $items,
+    ) {
+    }
+
+    /**
+     * GET /api/lists/{listId}/items
+     */
+    public function index(Request $request, Response $response, array $args): Response
+    {
+        $listId = $this->requireOwnedListId($request, $args);
+
+        return $this->json($response, [
+            'items' => array_map($this->present(...), $this->items->allForList($listId)),
+        ]);
+    }
+
+    /**
+     * POST /api/lists/{listId}/items
+     */
+    public function store(Request $request, Response $response, array $args): Response
+    {
+        $listId = $this->requireOwnedListId($request, $args);
+
+        $validator = new Validator($this->body($request));
+        $text = $validator->requiredString('text', self::TEXT_MAX);
+        $complete = $validator->optionalBool('complete') ?? false;
+        $position = $validator->optionalInt('position', 0);
+        $validator->assert();
+
+        $item = $this->items->create($listId, $text, $complete, $position);
+        $this->lists->touch($listId);
+
+        return $this->json($response, ['item' => $this->present($item)], 201);
+    }
+
+    /**
+     * GET /api/lists/{listId}/items/{itemId}
+     */
+    public function show(Request $request, Response $response, array $args): Response
+    {
+        $listId = $this->requireOwnedListId($request, $args);
+
+        return $this->json($response, ['item' => $this->present($this->requireItem($listId, $args))]);
+    }
+
+    /**
+     * PATCH /api/lists/{listId}/items/{itemId}
+     */
+    public function update(Request $request, Response $response, array $args): Response
+    {
+        $listId = $this->requireOwnedListId($request, $args);
+        $item = $this->requireItem($listId, $args);
+
+        $validator = new Validator($this->body($request));
+        $fields = [];
+        if ($validator->has('text')) {
+            $fields['text'] = $validator->requiredString('text', self::TEXT_MAX);
+        }
+        if ($validator->has('complete')) {
+            $fields['complete'] = $validator->optionalBool('complete');
+        }
+        if ($validator->has('position')) {
+            $fields['position'] = $validator->optionalInt('position', 0);
+        }
+        if ($fields === [] && !$validator->failed()) {
+            $validator->add('text', 'Provide at least one of: text, complete, position.');
+        }
+        $validator->assert();
+
+        $updated = $this->items->update($item['id'], $listId, $fields);
+        $this->lists->touch($listId);
+
+        return $this->json($response, ['item' => $this->present($updated)]);
+    }
+
+    /**
+     * DELETE /api/lists/{listId}/items/{itemId}
+     */
+    public function destroy(Request $request, Response $response, array $args): Response
+    {
+        $listId = $this->requireOwnedListId($request, $args);
+        $this->items->delete($this->requireItem($listId, $args)['id']);
+        $this->lists->touch($listId);
+
+        return $response->withStatus(204);
+    }
+
+    /**
+     * @param array<string, string> $args
+     */
+    private function requireOwnedListId(Request $request, array $args): int
+    {
+        $list = $this->lists->findOwnedBy((int) $args['listId'], $this->user($request)['id']);
+
+        if ($list === null) {
+            throw new ApiException('List not found.', 404);
+        }
+
+        return $list['id'];
+    }
+
+    /**
+     * @param array<string, string> $args
+     * @return array{id: int, list_id: int, text: string, complete: bool, position: int, created_at: string, updated_at: string}
+     */
+    private function requireItem(int $listId, array $args): array
+    {
+        $item = $this->items->findInList((int) $args['itemId'], $listId);
+
+        if ($item === null) {
+            throw new ApiException('Item not found.', 404);
+        }
+
+        return $item;
+    }
+
+    /**
+     * @param array{id: int, list_id: int, text: string, complete: bool, position: int, created_at: string, updated_at: string} $item
+     * @return array<string, mixed>
+     */
+    private function present(array $item): array
+    {
+        return [
+            'id' => $item['id'],
+            'list_id' => $item['list_id'],
+            'text' => $item['text'],
+            'complete' => $item['complete'],
+            'position' => $item['position'],
+            'created_at' => $item['created_at'],
+            'updated_at' => $item['updated_at'],
+        ];
+    }
+}

src/Http/Controllers/TodoListController.php

@@ -0,0 +1,129 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers;
+
+use App\Exception\ApiException;
+use App\Repository\TodoListRepository;
+use App\Support\Validator;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
+/**
+ * CRUD for the authenticated user's todo lists. A list is only ever visible to
+ * its owner; anything else responds 404.
+ */
+final class TodoListController extends Controller
+{
+    private const TITLE_MAX = 255;
+    private const DESCRIPTION_MAX = 2000;
+
+    public function __construct(private readonly TodoListRepository $lists)
+    {
+    }
+
+    /**
+     * GET /api/lists
+     */
+    public function index(Request $request, Response $response): Response
+    {
+        $lists = $this->lists->allForOwner($this->user($request)['id']);
+
+        return $this->json($response, ['lists' => array_map($this->present(...), $lists)]);
+    }
+
+    /**
+     * POST /api/lists
+     */
+    public function store(Request $request, Response $response): Response
+    {
+        $validator = new Validator($this->body($request));
+        $title = $validator->requiredString('title', self::TITLE_MAX);
+        $description = $validator->optionalString('description', self::DESCRIPTION_MAX) ?? '';
+        $validator->assert();
+
+        $list = $this->lists->create($this->user($request)['id'], $title, $description);
+
+        return $this->json($response, ['list' => $this->present($list)], 201);
+    }
+
+    /**
+     * GET /api/lists/{listId}
+     */
+    public function show(Request $request, Response $response, array $args): Response
+    {
+        return $this->json($response, ['list' => $this->present($this->requireOwnedList($request, $args))]);
+    }
+
+    /**
+     * PATCH /api/lists/{listId}
+     */
+    public function update(Request $request, Response $response, array $args): Response
+    {
+        $list = $this->requireOwnedList($request, $args);
+
+        $validator = new Validator($this->body($request));
+        $fields = [];
+        if ($validator->has('title')) {
+            $fields['title'] = $validator->requiredString('title', self::TITLE_MAX);
+        }
+        if ($validator->has('description')) {
+            $fields['description'] = $validator->optionalString('description', self::DESCRIPTION_MAX) ?? '';
+        }
+        if ($fields === [] && !$validator->failed()) {
+            $validator->add('title', 'Provide at least one of: title, description.');
+        }
+        $validator->assert();
+
+        $updated = $this->lists->update($list['id'], $list['owner_id'], $fields);
+
+        return $this->json($response, ['list' => $this->present($updated)]);
+    }
+
+    /**
+     * DELETE /api/lists/{listId}
+     */
+    public function destroy(Request $request, Response $response, array $args): Response
+    {
+        $this->lists->delete($this->requireOwnedList($request, $args)['id']);
+
+        return $response->withStatus(204);
+    }
+
+    /**
+     * Load the list named in the route, or 404 if it is missing or not owned by
+     * the authenticated user.
+     *
+     * @param array<string, string> $args
+     * @return array{id: int, owner_id: int, title: string, description: string, item_count: int, completed_count: int, created_at: string, updated_at: string}
+     */
+    private function requireOwnedList(Request $request, array $args): array
+    {
+        $list = $this->lists->findOwnedBy((int) $args['listId'], $this->user($request)['id']);
+
+        if ($list === null) {
+            throw new ApiException('List not found.', 404);
+        }
+
+        return $list;
+    }
+
+    /**
+     * @param array{id: int, owner_id: int, title: string, description: string, item_count: int, completed_count: int, created_at: string, updated_at: string} $list
+     * @return array<string, mixed>
+     */
+    private function present(array $list): array
+    {
+        return [
+            'id' => $list['id'],
+            'title' => $list['title'],
+            'description' => $list['description'],
+            'owner_id' => $list['owner_id'],
+            'item_count' => $list['item_count'],
+            'completed_count' => $list['completed_count'],
+            'created_at' => $list['created_at'],
+            'updated_at' => $list['updated_at'],
+        ];
+    }
+}

src/Repository/TodoItemRepository.php

@@ -0,0 +1,133 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Repository;
+
+use PDO;
+
+/**
+ * Data access for the `todo_items` table.
+ *
+ * @phpstan-type TodoItemRow array{
+ *     id: int, list_id: int, text: string, complete: bool, position: int,
+ *     created_at: string, updated_at: string
+ * }
+ */
+final class TodoItemRepository
+{
+    public function __construct(private readonly PDO $pdo)
+    {
+    }
+
+    /**
+     * @return TodoItemRow[]
+     */
+    public function allForList(int $listId): array
+    {
+        $stmt = $this->pdo->prepare(
+            'SELECT * FROM todo_items WHERE list_id = :list ORDER BY position ASC, id ASC'
+        );
+        $stmt->execute(['list' => $listId]);
+
+        return array_map($this->cast(...), $stmt->fetchAll());
+    }
+
+    /**
+     * @return TodoItemRow|null
+     */
+    public function findInList(int $id, int $listId): ?array
+    {
+        $stmt = $this->pdo->prepare('SELECT * FROM todo_items WHERE id = :id AND list_id = :list');
+        $stmt->execute(['id' => $id, 'list' => $listId]);
+
+        $row = $stmt->fetch();
+
+        return $row === false ? null : $this->cast($row);
+    }
+
+    /**
+     * @return TodoItemRow
+     */
+    public function create(int $listId, string $text, bool $complete, ?int $position): array
+    {
+        $position ??= $this->nextPosition($listId);
+
+        $stmt = $this->pdo->prepare(
+            'INSERT INTO todo_items (list_id, text, complete, position)
+             VALUES (:list, :text, :complete, :position)'
+        );
+        $stmt->execute([
+            'list' => $listId,
+            'text' => $text,
+            'complete' => $complete ? 1 : 0,
+            'position' => $position,
+        ]);
+
+        /** @var TodoItemRow $item */
+        $item = $this->findInList((int) $this->pdo->lastInsertId(), $listId);
+
+        return $item;
+    }
+
+    /**
+     * @param array{text?: string, complete?: bool, position?: int} $fields
+     * @return TodoItemRow
+     */
+    public function update(int $id, int $listId, array $fields): array
+    {
+        $sets = ['updated_at = ' . "strftime('%Y-%m-%dT%H:%M:%SZ', 'now')"];
+        $params = ['id' => $id];
+
+        if (array_key_exists('text', $fields)) {
+            $sets[] = 'text = :text';
+            $params['text'] = $fields['text'];
+        }
+        if (array_key_exists('complete', $fields)) {
+            $sets[] = 'complete = :complete';
+            $params['complete'] = $fields['complete'] ? 1 : 0;
+        }
+        if (array_key_exists('position', $fields)) {
+            $sets[] = 'position = :position';
+            $params['position'] = $fields['position'];
+        }
+
+        $stmt = $this->pdo->prepare('UPDATE todo_items SET ' . implode(', ', $sets) . ' WHERE id = :id');
+        $stmt->execute($params);
+
+        /** @var TodoItemRow $item */
+        $item = $this->findInList($id, $listId);
+
+        return $item;
+    }
+
+    public function delete(int $id): void
+    {
+        $this->pdo->prepare('DELETE FROM todo_items WHERE id = :id')->execute(['id' => $id]);
+    }
+
+    private function nextPosition(int $listId): int
+    {
+        $stmt = $this->pdo->prepare(
+            'SELECT COALESCE(MAX(position), -1) + 1 FROM todo_items WHERE list_id = :list'
+        );
+        $stmt->execute(['list' => $listId]);
+
+        return (int) $stmt->fetchColumn();
+    }
+
+    /**
+     * @param array<string, mixed> $row
+     * @return TodoItemRow
+     */
+    private function cast(array $row): array
+    {
+        $row['id'] = (int) $row['id'];
+        $row['list_id'] = (int) $row['list_id'];
+        $row['complete'] = (bool) $row['complete'];
+        $row['position'] = (int) $row['position'];
+
+        /** @var TodoItemRow $row */
+        return $row;
+    }
+}

src/Repository/TodoListRepository.php

@@ -0,0 +1,130 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Repository;
+
+use PDO;
+
+/**
+ * Data access for the `todo_lists` table.
+ *
+ * @phpstan-type TodoListRow array{
+ *     id: int, owner_id: int, title: string, description: string,
+ *     item_count: int, completed_count: int, created_at: string, updated_at: string
+ * }
+ */
+final class TodoListRepository
+{
+    private const SELECT = <<<'SQL'
+        SELECT l.id, l.owner_id, l.title, l.description, l.created_at, l.updated_at,
+               (SELECT COUNT(*) FROM todo_items i WHERE i.list_id = l.id) AS item_count,
+               (SELECT COUNT(*) FROM todo_items i WHERE i.list_id = l.id AND i.complete = 1) AS completed_count
+        FROM todo_lists l
+        SQL;
+
+    public function __construct(private readonly PDO $pdo)
+    {
+    }
+
+    /**
+     * @return TodoListRow[]
+     */
+    public function allForOwner(int $ownerId): array
+    {
+        $stmt = $this->pdo->prepare(self::SELECT . ' WHERE l.owner_id = :owner ORDER BY l.created_at DESC, l.id DESC');
+        $stmt->execute(['owner' => $ownerId]);
+
+        return array_map($this->cast(...), $stmt->fetchAll());
+    }
+
+    /**
+     * @return TodoListRow|null
+     */
+    public function findOwnedBy(int $id, int $ownerId): ?array
+    {
+        $stmt = $this->pdo->prepare(self::SELECT . ' WHERE l.id = :id AND l.owner_id = :owner');
+        $stmt->execute(['id' => $id, 'owner' => $ownerId]);
+
+        $row = $stmt->fetch();
+
+        return $row === false ? null : $this->cast($row);
+    }
+
+    /**
+     * @return TodoListRow
+     */
+    public function create(int $ownerId, string $title, string $description): array
+    {
+        $stmt = $this->pdo->prepare(
+            'INSERT INTO todo_lists (owner_id, title, description) VALUES (:owner, :title, :description)'
+        );
+        $stmt->execute([
+            'owner' => $ownerId,
+            'title' => $title,
+            'description' => $description,
+        ]);
+
+        /** @var TodoListRow $list */
+        $list = $this->findOwnedBy((int) $this->pdo->lastInsertId(), $ownerId);
+
+        return $list;
+    }
+
+    /**
+     * @param array{title?: string, description?: string} $fields
+     * @return TodoListRow
+     */
+    public function update(int $id, int $ownerId, array $fields): array
+    {
+        $sets = ['updated_at = ' . $this->nowExpr()];
+        $params = ['id' => $id];
+
+        foreach (['title', 'description'] as $column) {
+            if (array_key_exists($column, $fields)) {
+                $sets[] = "{$column} = :{$column}";
+                $params[$column] = $fields[$column];
+            }
+        }
+
+        $stmt = $this->pdo->prepare('UPDATE todo_lists SET ' . implode(', ', $sets) . ' WHERE id = :id');
+        $stmt->execute($params);
+
+        /** @var TodoListRow $list */
+        $list = $this->findOwnedBy($id, $ownerId);
+
+        return $list;
+    }
+
+    public function delete(int $id): void
+    {
+        $this->pdo->prepare('DELETE FROM todo_lists WHERE id = :id')->execute(['id' => $id]);
+    }
+
+    /** Bump updated_at, e.g. when the list's items change. */
+    public function touch(int $id): void
+    {
+        $this->pdo->prepare('UPDATE todo_lists SET updated_at = ' . $this->nowExpr() . ' WHERE id = :id')
+            ->execute(['id' => $id]);
+    }
+
+    private function nowExpr(): string
+    {
+        return "strftime('%Y-%m-%dT%H:%M:%SZ', 'now')";
+    }
+
+    /**
+     * @param array<string, mixed> $row
+     * @return TodoListRow
+     */
+    private function cast(array $row): array
+    {
+        $row['id'] = (int) $row['id'];
+        $row['owner_id'] = (int) $row['owner_id'];
+        $row['item_count'] = (int) $row['item_count'];
+        $row['completed_count'] = (int) $row['completed_count'];
+
+        /** @var TodoListRow $row */
+        return $row;
+    }
+}

src/Support/Validator.php

@@ -0,0 +1,141 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Support;
+
+use App\Exception\ValidationException;
+
+/**
+ * Small helper for validating a decoded JSON request body. Accumulates
+ * field => messages and throws a ValidationException when asked.
+ */
+final class Validator
+{
+    /** @var array<string, string[]> */
+    private array $errors = [];
+
+    /**
+     * @param array<string, mixed> $data
+     */
+    public function __construct(private readonly array $data)
+    {
+    }
+
+    public function has(string $field): bool
+    {
+        return array_key_exists($field, $this->data);
+    }
+
+    /**
+     * A required, non-blank, length-bounded string.
+     */
+    public function requiredString(string $field, int $max, int $min = 1): string
+    {
+        if (!$this->has($field) || $this->data[$field] === null) {
+            $this->errors[$field][] = ucfirst($field) . ' is required.';
+
+            return '';
+        }
+
+        return $this->stringValue($field, $max, $min) ?? '';
+    }
+
+    /**
+     * An optional string; returns null when the field is absent.
+     */
+    public function optionalString(string $field, int $max, int $min = 0): ?string
+    {
+        if (!$this->has($field)) {
+            return null;
+        }
+
+        return $this->stringValue($field, $max, $min);
+    }
+
+    public function optionalBool(string $field): ?bool
+    {
+        if (!$this->has($field)) {
+            return null;
+        }
+
+        $value = $this->data[$field];
+
+        if (is_bool($value)) {
+            return $value;
+        }
+        if ($value === 0 || $value === 1) {
+            return $value === 1;
+        }
+
+        $this->errors[$field][] = ucfirst($field) . ' must be true or false.';
+
+        return null;
+    }
+
+    public function optionalInt(string $field, int $min): ?int
+    {
+        if (!$this->has($field)) {
+            return null;
+        }
+
+        $value = $this->data[$field];
+
+        if (!is_int($value) || $value < $min) {
+            $this->errors[$field][] = ucfirst($field) . " must be an integer of at least {$min}.";
+
+            return null;
+        }
+
+        return $value;
+    }
+
+    public function add(string $field, string $message): void
+    {
+        $this->errors[$field][] = $message;
+    }
+
+    public function failed(): bool
+    {
+        return $this->errors !== [];
+    }
+
+    /**
+     * @throws ValidationException when any errors were recorded.
+     */
+    public function assert(): void
+    {
+        if ($this->errors !== []) {
+            throw new ValidationException($this->errors);
+        }
+    }
+
+    private function stringValue(string $field, int $max, int $min): ?string
+    {
+        $value = $this->data[$field];
+
+        if (!is_string($value)) {
+            $this->errors[$field][] = ucfirst($field) . ' must be a string.';
+
+            return null;
+        }
+
+        $value = trim($value);
+        $length = mb_strlen($value);
+
+        if ($length < $min) {
+            $this->errors[$field][] = $min === 1
+                ? ucfirst($field) . ' cannot be empty.'
+                : ucfirst($field) . " must be at least {$min} characters.";
+
+            return null;
+        }
+        if ($length > $max) {
+            $this->errors[$field][] = ucfirst($field) . " must be at most {$max} characters.";
+
+            return null;
+        }
+
+        return $value;
+    }
+}

src/bootstrap.php

@@ -5,7 +5,11 @@ declare(strict_types=1);
 use App\Auth\AuthMiddleware;
 use App\Auth\JwtService;
 use App\Http\Controllers\AuthController;
+use App\Http\Controllers\TodoItemController;
+use App\Http\Controllers\TodoListController;
 use App\Http\JsonErrorHandler;
+use App\Repository\TodoItemRepository;
+use App\Repository\TodoListRepository;
 use App\Repository\UserRepository;
 use App\Support\Config;
 use App\Support\Database;
@@ -30,14 +34,23 @@ $errorMiddleware->setDefaultErrorHandler(
 // --- Wiring -----------------------------------------------------------------
 
 $users = new UserRepository($database->pdo());
+$todoLists = new TodoListRepository($database->pdo());
+$todoItems = new TodoItemRepository($database->pdo());
 $jwt = new JwtService($config->jwtSecret, $config->jwtTtl);
 
 $authController = new AuthController($users, $jwt);
+$listController = new TodoListController($todoLists);
+$itemController = new TodoItemController($todoLists, $todoItems);
 $authMiddleware = new AuthMiddleware($jwt, $users);
 
 // --- Routes ---------------------------------------------------------------
 
-$app->group('/api', function (RouteCollectorProxy $group) use ($authController, $authMiddleware) {
+$app->group('/api', function (RouteCollectorProxy $group) use (
+    $authController,
+    $listController,
+    $itemController,
+    $authMiddleware,
+) {
     $group->get('/health', function (Request $request, Response $response): Response {
         $response->getBody()->write((string) json_encode(['status' => 'ok']));
         return $response->withHeader('Content-Type', 'application/json');
@@ -47,6 +60,20 @@ $app->group('/api', function (RouteCollectorProxy $group) use ($authController,
     $group->post('/auth/login', [$authController, 'login']);
 
     $group->get('/me', [$authController, 'me'])->add($authMiddleware);
+
+    $group->group('/lists', function (RouteCollectorProxy $lists) use ($listController, $itemController) {
+        $lists->get('', [$listController, 'index']);
+        $lists->post('', [$listController, 'store']);
+        $lists->get('/{listId:[0-9]+}', [$listController, 'show']);
+        $lists->patch('/{listId:[0-9]+}', [$listController, 'update']);
+        $lists->delete('/{listId:[0-9]+}', [$listController, 'destroy']);
+
+        $lists->get('/{listId:[0-9]+}/items', [$itemController, 'index']);
+        $lists->post('/{listId:[0-9]+}/items', [$itemController, 'store']);
+        $lists->get('/{listId:[0-9]+}/items/{itemId:[0-9]+}', [$itemController, 'show']);
+        $lists->patch('/{listId:[0-9]+}/items/{itemId:[0-9]+}', [$itemController, 'update']);
+        $lists->delete('/{listId:[0-9]+}/items/{itemId:[0-9]+}', [$itemController, 'destroy']);
+    })->add($authMiddleware);
 });
 
 return $app;