fix: complete audit security and frontend gaps

backend/internal/projects/handlers.go

@@ -5,6 +5,7 @@ import (
 	"strconv"
 
 	"github.com/gin-gonic/gin"
+	"senlinai-agent/backend/internal/auth"
 )
 
 type Handler struct {
@@ -22,6 +23,11 @@ func (h *Handler) Register(router gin.IRouter) {
 }
 
 func (h *Handler) createProject(c *gin.Context) {
+	userID, ok := auth.CurrentUserID(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "missing current user"})
+		return
+	}
 	var input struct {
 		Name        string `json:"name"`
 		Description string `json:"description"`
@@ -30,7 +36,7 @@ func (h *Handler) createProject(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request"})
 		return
 	}
-	project, err := h.service.CreateProject(1, input.Name, input.Description)
+	project, err := h.service.CreateProject(userID, input.Name, input.Description)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
@@ -39,7 +45,12 @@ func (h *Handler) createProject(c *gin.Context) {
 }
 
 func (h *Handler) listProjects(c *gin.Context) {
-	projects, err := h.service.ListProjects(1)
+	userID, ok := auth.CurrentUserID(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "missing current user"})
+		return
+	}
+	projects, err := h.service.ListProjects(userID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to list projects"})
 		return
@@ -48,12 +59,17 @@ func (h *Handler) listProjects(c *gin.Context) {
 }
 
 func (h *Handler) dashboard(c *gin.Context) {
+	userID, ok := auth.CurrentUserID(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "missing current user"})
+		return
+	}
 	projectID, err := strconv.ParseUint(c.Param("id"), 10, 64)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid project id"})
 		return
 	}
-	dashboard, err := h.service.Dashboard(uint(projectID))
+	dashboard, err := h.service.Dashboard(userID, uint(projectID))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to load dashboard"})
 		return

backend/internal/projects/service.go

@@ -54,7 +54,11 @@ func (s *Service) ListTags(projectID uint) ([]domain.Tag, error) {
 	return tags, err
 }
 
-func (s *Service) Dashboard(projectID uint) (Dashboard, error) {
+func (s *Service) Dashboard(ownerID uint, projectID uint) (Dashboard, error) {
+	var project domain.Project
+	if err := s.db.Where("id = ? AND owner_id = ?", projectID, ownerID).First(&project).Error; err != nil {
+		return Dashboard{}, err
+	}
 	dashboard := Dashboard{ProjectID: projectID}
 	if err := s.db.Model(&domain.InboxItem{}).Where("project_id = ? AND status = ?", projectID, "open").Count(&dashboard.PendingInboxCount).Error; err != nil {
 		return dashboard, err

backend/internal/projects/service_test.go

@@ -41,13 +41,24 @@ func TestDashboardCountsOnlyRequestedProject(t *testing.T) {
 	require.NoError(t, database.Create(&domain.Task{ProjectID: first.ID, CreatedBy: 1, Title: "A", Status: "open"}).Error)
 	require.NoError(t, database.Create(&domain.Task{ProjectID: second.ID, CreatedBy: 1, Title: "B", Status: "open"}).Error)
 
-	dashboard, err := service.Dashboard(first.ID)
+	dashboard, err := service.Dashboard(1, first.ID)
 
 	require.NoError(t, err)
 	require.Equal(t, int64(1), dashboard.PendingInboxCount)
 	require.Equal(t, int64(1), dashboard.OpenTaskCount)
 }
 
+func TestDashboardRejectsProjectOwnedByAnotherUser(t *testing.T) {
+	database := newTestDB(t)
+	service := NewService(database)
+	project, err := service.CreateProject(2, "Beta", "")
+	require.NoError(t, err)
+
+	_, err = service.Dashboard(1, project.ID)
+
+	require.Error(t, err)
+}
+
 func newTestDB(t *testing.T) *gorm.DB {
 	t.Helper()
 	database, err := gorm.Open(sqlite.Open(fmt.Sprintf("file:%s?mode=memory&cache=shared", t.Name())), &gorm.Config{})