feat(backend): enforce user-owned sessions

backend/src/routes/settings.ts

@@ -2,6 +2,8 @@ import type { FastifyInstance } from "fastify";
 import type { AppConfig } from "../config.js";
 import { loadSettings, saveSettings, type Settings } from "../settings/settings-store.js";
 import { listWorkspaces, type ListModelsFn } from "./meta.js";
+import { getPrincipal } from "../auth/auth.js";
+import type { PrincipalContext } from "../auth/principal.js";
 
 /** Merge stored settings over env/first-workspace defaults. */
 export function effectiveSettings(cfg: AppConfig, stored: Settings): Settings {
@@ -16,10 +18,18 @@ export function effectiveSettings(cfg: AppConfig, stored: Settings): Settings {
 
 export function settingsRoutes(
   app: FastifyInstance,
-  deps: { cfg: AppConfig; listModels: ListModelsFn },
+  deps: {
+    cfg: AppConfig; listModels: ListModelsFn;
+    getSettings: (principal: PrincipalContext) => Promise<Settings>;
+    saveSettings: (principal: PrincipalContext, settings: Settings) => Promise<void>;
+  },
 ): void {
-  app.get("/settings", async () => {
-    return effectiveSettings(deps.cfg, loadSettings(deps.cfg));
+  app.get("/settings", async (req, reply) => {
+    try {
+      return await deps.getSettings(getPrincipal(req));
+    } catch {
+      return reply.code(503).send({ error: "settings storage is unavailable" });
+    }
   });
 
   app.put("/settings", async (req, reply) => {
@@ -46,7 +56,11 @@ export function settingsRoutes(
       model: b.model,
       thinking: b.thinking,
     };
-    saveSettings(deps.cfg, next);
-    return effectiveSettings(deps.cfg, next);
+    try {
+      await deps.saveSettings(getPrincipal(req), next);
+      return effectiveSettings(deps.cfg, next);
+    } catch {
+      return reply.code(503).send({ error: "settings storage is unavailable" });
+    }
   });
 }