fix: make chat session deletion server controlled (#19)

frontend/src/app/api/sessions/[id]/route.ts

@@ -0,0 +1,28 @@
+import { NextResponse } from "next/server";
+import { createServerSupabaseClient } from "@/lib/supabase/server";
+import { isSupabaseConfigurationError } from "@/lib/supabase/config";
+
+type RouteContext = { params: Promise<{ id: string }> };
+
+export async function DELETE(_request: Request, context: RouteContext) {
+  try {
+    const { id } = await context.params;
+    const supabase = await createServerSupabaseClient();
+    const { data: { user } } = await supabase.auth.getUser();
+    if (!user) return NextResponse.json({ error: "请先登录" }, { status: 401 });
+
+    const { count, error } = await supabase
+      .from("chat_sessions")
+      .delete({ count: "exact" })
+      .eq("id", id)
+      .eq("user_id", user.id);
+    if (error) throw error;
+    if (count !== 1) return NextResponse.json({ error: "聊天记录不存在或无权删除" }, { status: 404 });
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    if (isSupabaseConfigurationError(error)) {
+      return NextResponse.json({ error: "Supabase 尚未配置", code: "SUPABASE_NOT_CONFIGURED" }, { status: 503 });
+    }
+    return NextResponse.json({ error: error instanceof Error ? error.message : "删除聊天记录失败" }, { status: 500 });
+  }
+}

frontend/src/app/page.tsx

@@ -1253,9 +1253,9 @@ export default function Home() {
     setArchivedSessionIds((current) => current.filter((id) => id !== session.id));
     if (activeSessionId === session.id) setActiveSessionId(nextSessions[0]?.id ?? "");
     try {
-      const supabase = createBrowserSupabaseClient();
-      const { error } = await supabase.from("chat_sessions").delete().eq("id", session.id).eq("user_id", account.user.id);
-      if (error) throw error;
+      const response = await fetch(`/api/sessions/${encodeURIComponent(session.id)}`, { method: "DELETE" });
+      const payload = await response.json().catch(() => null) as { error?: string } | null;
+      if (!response.ok) throw new Error(payload?.error || "删除聊天记录失败");
     } catch (caught) {
       setSessions(previousSessions);
       setComposerNotice(caught instanceof Error ? `删除失败：${caught.message}` : "删除失败");