Use postgres instead of mongodb (document store isn't really appropriate for this crud app).
Use asp.net core web api (using .net 5).
Build a create-react-app frontend.
Have tests.

Non-signed in users and the public should not be able to create wishlists on occasions or claim items on wishlist.

Wishlists need occasion id and wishlist name as unique.
Items need occaion id, wishlist name, and item name as unique.
Occasions already have unique id.

I request the above feature!

Need to display error messages to the user.

Need to add password strength and display to the user.
Also need to display error messages to the user rather than just refreshing the page.

Need to be done for occasion, wishlist, and item.

Naively, I built the occasions, occasionShares, wishlists, and wishlists items in a relational database way. This introduces a lot of promises and misses the mark on storing nested objects in MongoDB.

I should be able to filter by occasions I administer, occasions I've been invited to, and occasions I have wishlists on. Of these results, I should be able to order by occurrence date.

Email content does not display new password.

Need to be done for occasion, wishlist, and item.

An occasion creator should be able to email an occasion to their friends.
If their friends do not sign up, they'll be able to view the occasion and the various wishlists.
Their friends will need to sign up in order to claim items from the wishlists (claim workflow to be implemented).

Non-shared users and the public should not be able to claim wishlist items.

Site is not called Wishlists anymore.

Owners of the wishlist should not be able to view the items that users have claimed for them.