Add authenticated login and SSO protection

app/api/assets/route.ts

@@ -1,13 +1,14 @@
 import { createAsset, listAssets } from "@/lib/server/data-store";
 import { jsonError, jsonOk, readJsonBody } from "@/lib/server/api";
-import { DEFAULT_OWNER_ID } from "@/lib/server/runtime";
+import { requireAppUser } from "@/lib/server/auth/current-user";
 import type { AssetKind } from "@/lib/types";
 
 export const runtime = "nodejs";
 
 export async function GET() {
   try {
-    return jsonOk({ assets: await listAssets(DEFAULT_OWNER_ID) });
+    const user = await requireAppUser();
+    return jsonOk({ assets: await listAssets(user.id) });
   } catch (error) {
     return jsonError(error, 500);
   }
@@ -22,9 +23,10 @@ export async function POST(request: Request) {
       tags?: string[];
       source?: "upload" | "generated" | "edited" | "upscaled" | "external" | "seed";
     }>(request);
+    const user = await requireAppUser();
     if (!body.url) throw new Error("url is required");
     const asset = await createAsset({
-      ownerId: DEFAULT_OWNER_ID,
+      ownerId: user.id,
       kind: body.kind || "image",
       name: body.name || "外部图片",
       url: body.url,