Add authenticated login and SSO protection

app/api/assets/[id]/route.ts

@@ -1,14 +1,16 @@
 import { deleteAsset, getAsset } from "@/lib/server/data-store";
 import { jsonError, jsonOk } from "@/lib/server/api";
+import { requireAppUser } from "@/lib/server/auth/current-user";
 import { deleteStoredAsset } from "@/lib/server/storage";
 
 export const runtime = "nodejs";
 
 export async function DELETE(_request: Request, context: { params: Promise<{ id: string }> }) {
   try {
+    const user = await requireAppUser();
     const { id } = await context.params;
     const asset = await getAsset(id);
-    if (!asset) return jsonError("资产不存在", 404);
+    if (!asset || asset.ownerId !== user.id) return jsonError("资产不存在", 404);
     await deleteStoredAsset(asset);
     await deleteAsset(id);
     return jsonOk({ ok: true, deletedAssetId: id });