Fix: Multi-user data isolation and Legacy migration logic

app/api/sync/route.ts

@@ -1,15 +1,26 @@
 import { NextResponse } from 'next/server';
 import { getDatabase, saveDatabase } from '@/lib/server-db';
+import { verifySession } from '@/lib/auth';
 
 export async function GET() {
-  const data = getDatabase();
+  const session = await verifySession();
+  if (!session) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const data = getDatabase(session.username);
   return NextResponse.json(data);
 }
 
 export async function POST(req: Request) {
+  const session = await verifySession();
+  if (!session) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
   try {
     const body = await req.json();
-    saveDatabase(body);
+    saveDatabase(session.username, body);
     return NextResponse.json({ success: true });
   } catch (error) {
     return NextResponse.json({ error: 'Invalid Data' }, { status: 400 });