fix(api): enforce ownership check on AI generation endpoint

[MinitJain]

Summary

• GET /api/video/ai authenticated the caller but never verified they own the target video
• Any authenticated user could pass ?videoId=<any_video_id> and trigger AI generation billed to the video owner's account
• Added eq(videos.ownerId, user.id) to the DB query — non-owners get a 404 (same as "not found"), so the existence of other users' videos is not leaked

Security Impact

This is an IDOR (Insecure Direct Object Reference). An attacker with a free account could exhaust another user's paid AI generation quota by repeatedly triggering generation on their videos.

Test plan

• Owner can trigger AI generation on their own video (existing behavior unchanged)
• Authenticated non-owner gets 404 when passing another user's video ID
• Unauthenticated request still gets 401

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[tembo]

EffectRuntime looks unused now that the Effect/Policy code path is gone — worth dropping to avoid unused-import lint failures.

[tembo]

Minor: since videos.id is unique, you can limit(1) and avoid the result[0] dance.

Suggested change

	const result = await db()
	const [video] = await db()
	.select()
	.from(videos)
	.where(and(eq(videos.id, videoId), eq(videos.ownerId, user.id)))
	.limit(1);
	if (!video) {
	return Response.json(
	{ error: true, message: "Video not found" },
	{ status: 404 },
	);
	}

[tembo]

Did you mean to include the workspace lockfile update (e.g. pnpm-lock.yaml) with this dependency bump? If CI runs with a frozen lockfile, it’ll fail if the lock isn’t updated.

[tembo]

Minor: having type IconDefinition = ... between imports can trip import/first / import-order rules. If you hit lint noise, consider moving this alias below the full import block.

[tembo]

Minor perf: this handler only needs metadata, transcriptionStatus, and ownerId — selecting the whole videos row may pull large columns unnecessarily.

Suggested change

	}
	const exit = await Effect.gen(function* () {
	const videosPolicy = yield* VideosPolicy;
	return yield* Effect.promise(() =>
	db().select().from(videos).where(eq(videos.id, videoId)),
	).pipe(Policy.withPublicPolicy(videosPolicy.canView(videoId)));
	}).pipe(provideOptionalAuth, EffectRuntime.runPromiseExit);
	if (Exit.isFailure(exit)) {
	return Response.json(
	{ error: true, message: "Video not found" },
	{ status: 404 },
	);
	}
	const result = exit.value;
	if (result.length === 0 || !result[0]) {
	const [video] = await db()
	.select()
	.from(videos)
	const [video] = await db()
	.select({
	ownerId: videos.ownerId,
	metadata: videos.metadata,
	transcriptionStatus: videos.transcriptionStatus,
	})
	.from(videos)
	.where(and(eq(videos.id, videoId), eq(videos.ownerId, user.id)))
	.limit(1);

[richiemcilroy]

Closing: already covered on main. The /api/video/ai route now gates reads through Policy.withPublicPolicy(videosPolicy.canView(videoId)) (from #1926) and scopes AI generation to the video owner. The ownership gap this PR targeted is no longer present. Thanks.