Acceptance Checklist — Product Wishlist

Use this checklist to verify your implementation is complete before archiving.

API

[ ] POST /api/wishlist with valid { productId } and authenticated session returns 201 Created with the saved wishlist item
[ ] POST /api/wishlist with a duplicate (productId, userId) returns 409 Conflict
[ ] GET /api/wishlist returns a JSON array of the authenticated user's wishlist items with product details
[ ] DELETE /api/wishlist/{id} returns 204 No Content and removes the item (only if owned by authenticated user)
[ ] DELETE /api/wishlist/{id} for another user's item returns 403 Forbidden or 404 Not Found
[ ] GET /api/wishlist/check?productId={id} returns { "exists": true } or { "exists": false }
[ ] All wishlist endpoints return 401 Unauthorized when called without authentication

[ ] Product detail page shows a wishlist toggle button for logged-in users
[ ] Logged-out users see a "Log in to save" prompt instead of the wishlist button
[ ] Clicking "Save to Wishlist" adds the product and toggles the button to "Saved"
[ ] Clicking "Saved" removes the product from the wishlist and toggles back
[ ] /wishlist route renders all saved products as cards (name, price, image, remove action)
[ ] /wishlist route is guarded — redirects to login if unauthenticated
[ ] Removing an item from the wishlist page removes it from the displayed list
[ ] An empty state ("Your wishlist is empty. Browse products to add some!") is shown when no items exist
[ ] Navigation includes a wishlist link (visible only when logged in)

[ ] openspec/changes/ contains an archived entry for this feature (timestamped folder under archive/)
[ ] tasks.md has all items checked off before archiving
[ ] proposal.md reflects the final agreed scope (not the original draft)