don't allow users to just mount the prime db i guess for privacy reasons (may undo this someday)

index.js

@@ -12,11 +12,18 @@ const { match } = require("path-to-regexp");
 const bcrypt = require("bcrypt");
 const cheerio = require("cheerio");
 const webPush = require("web-push");
+const { randomUUID } = require("node:crypto");
 const app = express();
 const _expressWs = require("express-ws")(app);
 const bodyParser = require("body-parser");
 const model = require("./db");
 const PORT = process.env.PORT || 3000;
+const SESSION_SECRET = process.env.SESSION_SECRET || randomUUID();
+if (!process.env.SESSION_SECRET) {
+  console.warn(
+    "SESSION_SECRET is not set; using an ephemeral secret and invalidating sessions on restart.",
+  );
+}
 
 const db = model.db;
 const wsRouter = express.Router();
@@ -62,7 +69,7 @@ app.use(fileUpload());
 app.use(
   session({
     store: new SQLiteStore({ client: db, expired: { clear: true } }),
-    secret: "your secret key",
+    secret: SESSION_SECRET,
     resave: false,
     saveUninitialized: true,
     cookie: { secure: false },
@@ -229,6 +236,26 @@ function currentUserFor(req) {
   }
 }
 
+function dbForWorkshopRequest(req, res) {
+  const appDb = model.getDbForStructure(
+    req.params.structure_id,
+    req.params.db_id,
+  );
+  if (!appDb) {
+    res.status(404).send("Not found");
+    return null;
+  }
+  const ownDb = String(appDb.db_struct_id) === String(req.params.structure_id);
+  if (
+    !ownDb &&
+    !model.canAccessStructure(req.session.userId, appDb.db_struct_id)
+  ) {
+    res.status(404).send("Not found");
+    return null;
+  }
+  return appDb;
+}
+
 function userIdFrom(value) {
   if (value == null) return null;
   if (typeof value === "object" && value.id != null) return Number(value.id);
@@ -925,6 +952,9 @@ app.post("/workshop/:structure_id/db", (req, res) => {
 });
 
 app.post("/workshop/:structure_id/db/attach", (req, res) => {
+  if (Number(req.body.db_id) === 0 && Number(req.params.structure_id) !== 0) {
+    return res.status(400).send("prime db cannot be attached");
+  }
   model.attachDb(req.params.structure_id, req.body.db_id, req.body.alias);
   const redirectUrl = `/workshop/${req.params.structure_id}/db/${req.body.db_id}`;
   return smartRedirect(req, res, redirectUrl);
@@ -993,7 +1023,8 @@ app.put("/workshop/:structure_id/route/:route_id", (req, res) => {
 app.put("/workshop/:structure_id/db/:db_id/library", (req, res) => {
   try {
     let dbId = req.params.db_id;
-    let appDb = model.getDb(dbId);
+    let appDb = dbForWorkshopRequest(req, res);
+    if (!appDb) return;
     model.updateDb({ ...appDb, library: req.body.library });
     appDb = model.getDb(dbId);
 
@@ -1018,7 +1049,8 @@ app.put("/workshop/:structure_id/db/:db_id/library", (req, res) => {
 app.post("/workshop/:structure_id/db/:db_id/repl", (req, res) => {
   try {
     let dbId = req.params.db_id;
-    let appDb = model.getDb(dbId);
+    let appDb = dbForWorkshopRequest(req, res);
+    if (!appDb) return;
     let dbInstance = model.getDbInstance(dbId);
     let capturedOutput = [];
     let context = vm.createContext({