harden admin api authorization and add authz regression tests

apps/admin/src/app/api/gyms/[id]/stats/route.ts

@@ -1,7 +1,10 @@
 import { NextResponse } from "next/server";
+import { auth } from "@clerk/nextjs/server";
 import { eq, sql } from "@fitai/database";
 import { db, gyms as gymsTable } from "@fitai/database";
 import log from "@/lib/logger";
+import { getDatabase } from "@/lib/database";
+import { ensureUserSynced } from "@/lib/sync-user";
 
 async function ensureGymsTable() {
   await db.run(sql`
@@ -24,7 +27,33 @@ export async function GET(
   { params }: { params: Promise<{ id: string }> },
 ) {
   try {
+    const { userId: clerkUserId } = await auth();
+    if (!clerkUserId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const appDb = await getDatabase();
+    const currentUser = await ensureUserSynced(clerkUserId, appDb);
+
+    if (!currentUser) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
     const { id: gymId } = await params;
+
+    const canViewGymStats =
+      currentUser.role === "superAdmin" || currentUser.role === "admin";
+    if (!canViewGymStats) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    if (currentUser.role !== "superAdmin" && currentUser.gymId !== gymId) {
+      return NextResponse.json(
+        { error: "Forbidden - Cannot access other gym's data" },
+        { status: 403 },
+      );
+    }
+
     await ensureGymsTable();
 
     // Get gym info using Drizzle ORM