add new rules for store and update package

app/Http/Requests/StorePackageRequest.php

@@ -2,6 +2,7 @@
 
 namespace App\Http\Requests;
 
+use App\Rules\ValidateItemOwnership;
 use Illuminate\Foundation\Http\FormRequest;
 
 class StorePackageRequest extends FormRequest
@@ -23,7 +24,8 @@ class StorePackageRequest extends FormRequest
                 return [
                     'name' => 'required|max:250',
                     'note' => 'nullable',
-                    'items' => 'required',
+                    'items' => 'required|array|min:1',
+                    'items.*' => ['exists:items,id','integer',new ValidateItemOwnership()],
                 ];
                 break;
             }
@@ -33,7 +35,8 @@ class StorePackageRequest extends FormRequest
                 return [
                     'name' => 'required|max:250',
                     'note' => 'nullable',
-                    'items' => 'required',
+                    'items' => 'required|array|min:1',
+                    'items.*' => ['exists:items,id','integer',new ValidateItemOwnership()],
                 ];
                 break;
 

app/Rules/ValidateItemOwnership.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Rules;
+
+use App\Models\Item;
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+
+class ValidateItemOwnership implements ValidationRule
+{
+    /**
+     * Run the validation rule.
+     *
+     * @param  \Closure(string, ?string=): \Illuminate\Translation\PotentiallyTranslatedString  $fail
+     */
+    public function validate(string $attribute, mixed $value, Closure $fail): void
+    {
+        $item = Item::find($value);
+        if(!($item && $item->user_id === auth()->id())){
+            $fail(":attribute have invalid ownership");
+        }
+    }
+}