fix: idor checks on all exposed endpoints

src/routes/api/mappools/[id]/+server.ts

@@ -2,11 +2,12 @@ import { json, error } from '@sveltejs/kit';
 import { db } from '$lib/server/db';
 import { mappool, mappoolSlot } from '$lib/server/db/schema';
 import { eq } from 'drizzle-orm';
+import { requireAuth, requireOwnerOrAdmin } from '$lib/server/permissions';
 import type { RequestHandler } from './$types';
 
 // Get a mappool with its slots
 export const GET: RequestHandler = async ({ params, locals }) => {
-	if (!locals.user) error(401, 'Not logged in');
+	requireAuth(locals);
 
 	const pool = await db.query.mappool.findFirst({
 		where: eq(mappool.id, params.id)
@@ -24,7 +25,17 @@ export const GET: RequestHandler = async ({ params, locals }) => {
 
 // Delete a mappool
 export const DELETE: RequestHandler = async ({ params, locals }) => {
-	if (!locals.user) error(401, 'Not logged in');
+	const pool = await db.query.mappool.findFirst({
+		where: eq(mappool.id, params.id)
+	});
+
+	if (!pool) error(404, 'Mappool not found');
+
+	requireOwnerOrAdmin(
+		locals,
+		pool.createdBy,
+		'Only the mappool creator or an admin can delete this'
+	);
 
 	await db.delete(mappool).where(eq(mappool.id, params.id));
 	return json({ ok: true });