Add authenticated login and SSO protection

app/api/assets/[id]/inpaint/route.ts

@@ -1,5 +1,6 @@
 import { getAsset } from "@/lib/server/data-store";
 import { jsonError, jsonOk, readJsonBody } from "@/lib/server/api";
+import { requireAppUser } from "@/lib/server/auth/current-user";
 import { requestOrigin } from "@/lib/server/runtime";
 import { saveMaskDataUrl } from "@/lib/server/storage";
 import { submitImageJob } from "@/lib/server/generation-service";
@@ -8,9 +9,10 @@ export const runtime = "nodejs";
 
 export async function POST(request: Request, context: { params: Promise<{ id: string }> }) {
   try {
+    const user = await requireAppUser();
     const { id } = await context.params;
     const asset = await getAsset(id);
-    if (!asset) return jsonError(new Error("Asset not found."), 404);
+    if (!asset || asset.ownerId !== user.id) return jsonError(new Error("Asset not found."), 404);
     const body = await readJsonBody<{
       prompt?: string;
       maskDataUrl?: string;
@@ -31,6 +33,7 @@ export async function POST(request: Request, context: { params: Promise<{ id: st
     }
     if (!maskUrl) throw new Error("maskDataUrl or maskUrl is required for inpainting.");
     const job = await submitImageJob({
+      ownerId: user.id,
       capability: "image.inpaint",
       prompt: body.prompt || "删除",
       imageUrls: [asset.url, maskUrl],