fix: complete audit security and frontend gaps

backend/internal/tasks/service.go

@@ -50,6 +50,9 @@ func (s *Service) ShareObject(taskID uint, objectType string, objectID uint) err
 		if err := tx.First(&task, taskID).Error; err != nil {
 			return err
 		}
+		if err := ensureSharedObjectInProject(tx, task.ProjectID, objectType, objectID); err != nil {
+			return err
+		}
 		if err := tx.Create(&domain.TaskShare{TaskID: taskID, ObjectType: objectType, ObjectID: objectID}).Error; err != nil {
 			return err
 		}
@@ -82,3 +85,25 @@ func (s *Service) VisibleLinkedObjects(taskID uint, viewerID uint) ([]LinkedObje
 	}
 	return objects, nil
 }
+
+func ensureSharedObjectInProject(tx *gorm.DB, projectID uint, objectType string, objectID uint) error {
+	switch objectType {
+	case "note":
+		var count int64
+		if err := tx.Model(&domain.Note{}).Where("id = ? AND project_id = ?", objectID, projectID).Count(&count).Error; err != nil {
+			return err
+		}
+		if count == 0 {
+			return errors.New("shared object not found in task project")
+		}
+	case "source":
+		var count int64
+		if err := tx.Model(&domain.Source{}).Where("id = ? AND project_id = ?", objectID, projectID).Count(&count).Error; err != nil {
+			return err
+		}
+		if count == 0 {
+			return errors.New("shared object not found in task project")
+		}
+	}
+	return nil
+}