Add authenticated login and SSO protection

app/api/assets/[id]/download/route.ts

@@ -1,14 +1,16 @@
 import { getAsset } from "@/lib/server/data-store";
 import { jsonError } from "@/lib/server/api";
+import { requireAppUser } from "@/lib/server/auth/current-user";
 import { readAssetForDownload } from "@/lib/server/storage";
 
 export const runtime = "nodejs";
 
 export async function GET(_request: Request, context: { params: Promise<{ id: string }> }) {
   try {
+    const user = await requireAppUser();
     const { id } = await context.params;
     const asset = await getAsset(id);
-    if (!asset) return jsonError("资产不存在", 404);
+    if (!asset || asset.ownerId !== user.id) return jsonError("资产不存在", 404);
     const file = await readAssetForDownload(asset);
     if (!file) return jsonError("资产文件不可下载", 404);
     return new Response(new Uint8Array(file.bytes), {