fix: check chat/vote ownership during actions (#847)

2025-03-05 10:03:17 -08:00 · 2025-03-05 10:03:17 -08:00 · a378757d3b
commit a378757d3b
parent c58fd528fc
4 changed files with 28 additions and 2 deletions
--- a/app/(chat)/api/chat/route.ts
+++ b/app/(chat)/api/chat/route.ts
@ -58,7 +58,12 @@ export async function POST(request: Request) {
      const title = await generateTitleFromUserMessage({
        message: userMessage,
      });
+
      await saveChat({ id, userId: session.user.id, title });
+    } else {
+      if (chat.userId !== session.user.id) {
+        return new Response('Unauthorized', { status: 401 });
+      }
    }

    await saveMessages({