tabel user

internal/handler/snippet_handler.go

@@ -96,7 +96,13 @@ func (h *SnippetHandler) List(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	snippets, err := h.snippetStore.GetAll(r.Context())
+	userID := middleware.GetUserID(r.Context())
+	if userID == "" {
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+		return
+	}
+
+	snippets, err := h.snippetStore.GetByUserID(r.Context(), userID)
 	if err != nil {
 		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
 		return
@@ -145,6 +151,12 @@ func (h *SnippetHandler) Delete(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	userID := middleware.GetUserID(r.Context())
+	if userID == "" {
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+		return
+	}
+
 	id := r.PathValue("id")
 	if id == "" {
 		path := strings.TrimPrefix(r.URL.Path, "/snippets/")
@@ -156,6 +168,21 @@ func (h *SnippetHandler) Delete(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	snippet, err := h.snippetStore.GetByID(r.Context(), id)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			http.Error(w, "Snippet not found", http.StatusNotFound)
+			return
+		}
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+
+	if snippet.UserID != userID {
+		http.Error(w, "Forbidden", http.StatusForbidden)
+		return
+	}
+
 	if err := h.snippetStore.Delete(r.Context(), id); err != nil {
 		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
 		return