implement better-auth auth with postgres and route protection

app/api/tasks/[taskId]/route.ts

@@ -1,4 +1,5 @@
 import { jsonError } from '@/lib/server/http';
+import { requireAuthenticatedSession } from '@/lib/server/auth-session';
 import { getTaskById } from '@/lib/server/tasks';
 
 type Context = {
@@ -6,8 +7,13 @@ type Context = {
 };
 
 export async function GET(_request: Request, context: Context) {
+  const { session, response } = await requireAuthenticatedSession();
+  if (response) {
+    return response;
+  }
+
   const { taskId } = await context.params;
-  const task = await getTaskById(taskId);
+  const task = await getTaskById(taskId, session.user.id);
 
   if (!task) {
     return jsonError('Task not found', 404);

app/api/tasks/route.ts

@@ -1,9 +1,15 @@
 import type { TaskStatus } from '@/lib/types';
+import { requireAuthenticatedSession } from '@/lib/server/auth-session';
 import { listRecentTasks } from '@/lib/server/tasks';
 
 const ALLOWED_STATUSES: TaskStatus[] = ['queued', 'running', 'completed', 'failed'];
 
 export async function GET(request: Request) {
+  const { session, response } = await requireAuthenticatedSession();
+  if (response) {
+    return response;
+  }
+
   const url = new URL(request.url);
   const limitValue = Number(url.searchParams.get('limit') ?? 20);
   const limit = Number.isFinite(limitValue)
@@ -15,6 +21,6 @@ export async function GET(request: Request) {
     return ALLOWED_STATUSES.includes(status as TaskStatus);
   });
 
-  const tasks = await listRecentTasks(limit, statuses.length > 0 ? statuses : undefined);
+  const tasks = await listRecentTasks(session.user.id, limit, statuses.length > 0 ? statuses : undefined);
   return Response.json({ tasks });
 }