fix: restore anonymous snapshot visibility and deletion

src/features/snapshots/api/delete-snapshot.ts

@@ -2,7 +2,7 @@
 
 import { db } from "@/db";
 import { sessionSnapshots } from "@/db/schema";
-import { and, eq } from "drizzle-orm";
+import { and, eq, isNull } from "drizzle-orm";
 import { auth } from "@/lib/auth";
 
 export async function deleteSnapshot(id: number) {
@@ -10,22 +10,21 @@ export async function deleteSnapshot(id: number) {
     const rawUserId = (session?.user as any)?.id;
     const userId = rawUserId ? parseInt(String(rawUserId), 10) : null;
 
-    console.log(`[deleteSnapshot] Request for ID: ${id}, Session UserId: ${userId} (raw: ${rawUserId})`);
+    console.log(`[deleteSnapshot] Request for ID: ${id}, Session UserId: ${userId}`);
-
-    if (!userId || isNaN(userId)) {
-        console.error("[deleteSnapshot] Unauthorized: userId is missing or invalid");
-        return { success: false, error: "Non autorisé" };
-    }
 
     try {
+        // Condition de sécurité : match ID ET match le propriétaire (ou anonyme)
+        const userCondition = userId && !isNaN(userId)
+            ? eq(sessionSnapshots.userId, userId)
+            : isNull(sessionSnapshots.userId);
+
         const result = await db.delete(sessionSnapshots)
-            .where(and(eq(sessionSnapshots.id, id), eq(sessionSnapshots.userId, userId)))
+            .where(and(eq(sessionSnapshots.id, id), userCondition))
             .returning({ deletedId: sessionSnapshots.id });
         
         if (result.length === 0) {
-            console.warn(`[deleteSnapshot] No rows deleted for ID ${id} and User ${userId}. Maybe the snapshot doesn't belong to the user?`);
+            console.warn(`[deleteSnapshot] No rows deleted for ID ${id}. Snapshot may not exist or belongs to another user.`);
-            // We return success: false to trigger the error modal in UI if nothing was actually deleted
+            return { success: false, error: "Snapshot non trouvé ou non autorisé" };
-            return { success: false, error: "Élément non trouvé ou non autorisé" };
         }
 
         console.log(`[deleteSnapshot] Successfully deleted ID: ${id}`);

src/features/snapshots/api/get-snapshots.ts

@@ -3,7 +3,7 @@
 import { db } from "@/db";
 import { sessionSnapshots } from "@/db/schema";
 import { auth } from "@/lib/auth";
-import { and, desc, eq } from "drizzle-orm";
+import { and, desc, eq, isNull } from "drizzle-orm";
 
 export async function getSnapshots(type?: "snapshot" | "export") {
     try {
@@ -11,12 +11,13 @@ export async function getSnapshots(type?: "snapshot" | "export") {
         const rawUserId = (session?.user as any)?.id;
         const userId = rawUserId ? parseInt(String(rawUserId), 10) : null;
 
-        if (!userId || isNaN(userId)) {
+        // Si on a un userId, on filtre par celui-ci.
-            console.warn("[getSnapshots] Unauthenticated access attempt");
+        // Sinon, on filtre par userId IS NULL (mode anonyme/local)
-            return [];
+        const userCondition = userId && !isNaN(userId) 
-        }
+            ? eq(sessionSnapshots.userId, userId) 
+            : isNull(sessionSnapshots.userId);
 
-        const conditions = [eq(sessionSnapshots.userId, userId)];
+        const conditions = [userCondition];
         if (type) conditions.push(eq(sessionSnapshots.type, type));
 
         return await db.select()