fix: complete audit security and frontend gaps

backend/internal/projects/handlers.go

@@ -5,6 +5,7 @@ import (
 	"strconv"
 
 	"github.com/gin-gonic/gin"
+	"senlinai-agent/backend/internal/auth"
 )
 
 type Handler struct {
@@ -22,6 +23,11 @@ func (h *Handler) Register(router gin.IRouter) {
 }
 
 func (h *Handler) createProject(c *gin.Context) {
+	userID, ok := auth.CurrentUserID(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "missing current user"})
+		return
+	}
 	var input struct {
 		Name        string `json:"name"`
 		Description string `json:"description"`
@@ -30,7 +36,7 @@ func (h *Handler) createProject(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request"})
 		return
 	}
-	project, err := h.service.CreateProject(1, input.Name, input.Description)
+	project, err := h.service.CreateProject(userID, input.Name, input.Description)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
@@ -39,7 +45,12 @@ func (h *Handler) createProject(c *gin.Context) {
 }
 
 func (h *Handler) listProjects(c *gin.Context) {
-	projects, err := h.service.ListProjects(1)
+	userID, ok := auth.CurrentUserID(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "missing current user"})
+		return
+	}
+	projects, err := h.service.ListProjects(userID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to list projects"})
 		return
@@ -48,12 +59,17 @@ func (h *Handler) listProjects(c *gin.Context) {
 }
 
 func (h *Handler) dashboard(c *gin.Context) {
+	userID, ok := auth.CurrentUserID(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "missing current user"})
+		return
+	}
 	projectID, err := strconv.ParseUint(c.Param("id"), 10, 64)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid project id"})
 		return
 	}
-	dashboard, err := h.service.Dashboard(uint(projectID))
+	dashboard, err := h.service.Dashboard(userID, uint(projectID))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to load dashboard"})
 		return