harden admin api authorization and add authz regression tests

apps/admin/src/app/api/notifications/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { auth } from "@clerk/nextjs/server";
 import { getDatabase } from "@/lib/database";
 import log from "@/lib/logger";
+import { ensureUserSynced } from "@/lib/sync-user";
 
 /**
  * GET /api/notifications
@@ -84,6 +85,39 @@ export async function POST(req: NextRequest) {
     }
 
     const db = await getDatabase();
+    const currentUser = await ensureUserSynced(userId, db);
+
+    if (!currentUser) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    const canCreateNotifications =
+      currentUser.role === "superAdmin" ||
+      currentUser.role === "admin" ||
+      currentUser.role === "trainer";
+
+    if (!canCreateNotifications) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    const targetUser = await db.getUserById(targetUserId);
+    if (!targetUser) {
+      return NextResponse.json(
+        { error: "Target user not found" },
+        { status: 404 },
+      );
+    }
+
+    if (
+      currentUser.role !== "superAdmin" &&
+      (!currentUser.gymId || targetUser.gymId !== currentUser.gymId)
+    ) {
+      return NextResponse.json(
+        { error: "Forbidden - Cannot notify users from other gyms" },
+        { status: 403 },
+      );
+    }
+
     const notification = await db.createNotification({
       id: crypto.randomUUID(),
       userId: targetUserId,