Add authenticated login and SSO protection

app/api/assets/[id]/download/route.ts

@@ -1,14 +1,16 @@
 import { getAsset } from "@/lib/server/data-store";
 import { jsonError } from "@/lib/server/api";
+import { requireAppUser } from "@/lib/server/auth/current-user";
 import { readAssetForDownload } from "@/lib/server/storage";
 
 export const runtime = "nodejs";
 
 export async function GET(_request: Request, context: { params: Promise<{ id: string }> }) {
   try {
+    const user = await requireAppUser();
     const { id } = await context.params;
     const asset = await getAsset(id);
-    if (!asset) return jsonError("资产不存在", 404);
+    if (!asset || asset.ownerId !== user.id) return jsonError("资产不存在", 404);
     const file = await readAssetForDownload(asset);
     if (!file) return jsonError("资产文件不可下载", 404);
     return new Response(new Uint8Array(file.bytes), {

app/api/assets/[id]/inpaint/route.ts

@@ -1,5 +1,6 @@
 import { getAsset } from "@/lib/server/data-store";
 import { jsonError, jsonOk, readJsonBody } from "@/lib/server/api";
+import { requireAppUser } from "@/lib/server/auth/current-user";
 import { requestOrigin } from "@/lib/server/runtime";
 import { saveMaskDataUrl } from "@/lib/server/storage";
 import { submitImageJob } from "@/lib/server/generation-service";
@@ -8,9 +9,10 @@ export const runtime = "nodejs";
 
 export async function POST(request: Request, context: { params: Promise<{ id: string }> }) {
   try {
+    const user = await requireAppUser();
     const { id } = await context.params;
     const asset = await getAsset(id);
-    if (!asset) return jsonError(new Error("Asset not found."), 404);
+    if (!asset || asset.ownerId !== user.id) return jsonError(new Error("Asset not found."), 404);
     const body = await readJsonBody<{
       prompt?: string;
       maskDataUrl?: string;
@@ -31,6 +33,7 @@ export async function POST(request: Request, context: { params: Promise<{ id: st
     }
     if (!maskUrl) throw new Error("maskDataUrl or maskUrl is required for inpainting.");
     const job = await submitImageJob({
+      ownerId: user.id,
       capability: "image.inpaint",
       prompt: body.prompt || "删除",
       imageUrls: [asset.url, maskUrl],

app/api/assets/[id]/route.ts

@@ -1,14 +1,16 @@
 import { deleteAsset, getAsset } from "@/lib/server/data-store";
 import { jsonError, jsonOk } from "@/lib/server/api";
+import { requireAppUser } from "@/lib/server/auth/current-user";
 import { deleteStoredAsset } from "@/lib/server/storage";
 
 export const runtime = "nodejs";
 
 export async function DELETE(_request: Request, context: { params: Promise<{ id: string }> }) {
   try {
+    const user = await requireAppUser();
     const { id } = await context.params;
     const asset = await getAsset(id);
-    if (!asset) return jsonError("资产不存在", 404);
+    if (!asset || asset.ownerId !== user.id) return jsonError("资产不存在", 404);
     await deleteStoredAsset(asset);
     await deleteAsset(id);
     return jsonOk({ ok: true, deletedAssetId: id });

app/api/assets/[id]/upscale/route.ts

@@ -1,5 +1,6 @@
 import { getAsset } from "@/lib/server/data-store";
 import { jsonError, jsonOk, readJsonBody } from "@/lib/server/api";
+import { requireAppUser } from "@/lib/server/auth/current-user";
 import { requestOrigin } from "@/lib/server/runtime";
 import { submitImageJob } from "@/lib/server/generation-service";
 
@@ -7,14 +8,16 @@ export const runtime = "nodejs";
 
 export async function POST(request: Request, context: { params: Promise<{ id: string }> }) {
   try {
+    const user = await requireAppUser();
     const { id } = await context.params;
     const asset = await getAsset(id);
-    if (!asset) return jsonError(new Error("Asset not found."), 404);
+    if (!asset || asset.ownerId !== user.id) return jsonError(new Error("Asset not found."), 404);
     const body = await readJsonBody<{
       resolution?: "4k" | "8k";
       scale?: number;
     }>(request);
     const job = await submitImageJob({
+      ownerId: user.id,
       capability: "image.upscale",
       imageUrls: [asset.url],
       inputAssetIds: [asset.id],