harden admin api authorization and add authz regression tests

apps/admin/src/app/api/trainer-client/[id]/route.ts

@@ -35,36 +35,37 @@ export async function DELETE(
 
     const { id } = await params;
 
-    // Try to find the assignment by checking trainer's assignments first
-    const trainerAssignments = await db.getTrainerClientAssignments(
-      currentUser.id,
-    );
-    let assignment = trainerAssignments.find((a) => a.id === id);
+    const allAssignments = await db.getAllTrainerClientAssignments();
+    const assignment = allAssignments.find((a) => a.id === id);
 
     if (!assignment) {
-      // Check all assignments to find the one with this ID
-      const allAssignments = await db.getAllTrainerClientAssignments();
-      assignment = allAssignments.find((a) => a.id === id);
+      return NextResponse.json(
+        { error: "Assignment not found" },
+        { status: 404 },
+      );
+    }
 
-      if (!assignment) {
-        return NextResponse.json(
-          { error: "Assignment not found" },
-          { status: 404 },
-        );
+    if (currentUser.role !== "superAdmin") {
+      if (!currentUser.gymId) {
+        return NextResponse.json({ error: "No gym assigned" }, { status: 403 });
       }
 
-      // Deactivate the assignment
-      await db.deactivateTrainerClientAssignment(id);
+      const [trainer, client] = await Promise.all([
+        db.getUserById(assignment.trainerId),
+        db.getUserById(assignment.clientId),
+      ]);
 
-      log.info("Trainer-client assignment deactivated", {
-        assignmentId: id,
-        deactivatedBy: currentUser.id,
-      });
-
-      return NextResponse.json({
-        success: true,
-        message: "Assignment deactivated successfully",
-      });
+      if (
+        !trainer ||
+        !client ||
+        trainer.gymId !== currentUser.gymId ||
+        client.gymId !== currentUser.gymId
+      ) {
+        return NextResponse.json(
+          { error: "Cannot modify assignments from other gyms" },
+          { status: 403 },
+        );
+      }
     }
 
     // Deactivate the assignment