fix(workout-session): require auth + ownership to delete a workout session

[evan188199-tech]

What

deleteWorkoutSessionAction let any logged-in user delete any other user's workout session. It was built on the unauthenticated actionClient, fetched the session's userId but never compared it to the caller, and deleted by id alone.

Root cause

export const deleteWorkoutSessionAction = actionClient.schema(...).action(async ({ parsedInput }) => {
  const { id } = parsedInput;
  const session = await prisma.workoutSession.findUnique({
    where: { id },
    select: { userId: true },     // fetched, then discarded
  });
  if (!session) { ... }
  await prisma.workoutSession.delete({ where: { id } });  // deletes unconditionally
});

actionClient performs no auth (vs authenticatedActionClient, which injects ctx.user via serverAuth()). The action had no idea who the caller was, so the selected userId could never be checked.

Fix

Switch to authenticatedActionClient and require ownership:

export const deleteWorkoutSessionAction = authenticatedActionClient
  .schema(deleteWorkoutSessionSchema)
  .action(async ({ parsedInput, ctx }) => {
    const { id } = parsedInput;
    const session = await prisma.workoutSession.findUnique({ where: { id }, select: { userId: true } });
    if (!session || session.userId !== ctx.user.id) {
      return { serverError: "Session not found" };
    }
    await prisma.workoutSession.delete({ where: { id } });
    return { success: true };
  });

The same "not found" is returned for missing and non-owned rows to avoid disclosing which session ids exist.

Fixes #238.

[vercel]

Someone is attempting to deploy a commit to the Workoutcool Team Team on Vercel.

A member of the Team first needs to authorize it.

[evan188199-tech]

此 PR 由 GLM-5.2 修复。