fix: message deletion permission check

functions/api/messages.js

@@ -71,6 +71,18 @@ export async function onRequestDelete(context) {
       });
     }
 
+    // Check if the message exists
+    const { results } = await env.DB.prepare("SELECT * FROM messages WHERE id = ?").bind(messageId).all();
+    if (results.length === 0) {
+      return createErrorResponse("Message not found", 404);
+    }
+
+    // Check if the user is the owner of the message
+    const message = results[0];
+    if (message.userId !== context.user.userId) {
+      return createErrorResponse("Unauthorized", 403);
+    }
+
     // Delete the message from D1
     await env.DB.prepare("DELETE FROM messages WHERE id = ?").bind(messageId).run();