🚧 making shot not an admin colletion

app/components/shot/ShotForm.vue

@@ -12,7 +12,6 @@ const props = defineProps<{ pen: Pen }>()
 const emit = defineEmits(['created'])
 const form = ref<Form<any>>()
 const state = reactive({
-  user: props.pen.cartridge?.userId,
   cartridge: props.pen.cartridge?.id,
   units: shotUnits[1],
   date: format(new Date(), 'yyyy-MM-dd'),

server/routes/shot.ts

@@ -1,19 +1,19 @@
 import { z } from 'zod'
 
 const index = defineEventHandler(async (event) => {
+  const { user } = await requireUserSession(event)
   return metapi().render(
     await prisma.shot.findMany({
       where: {
-        userId: BigInt(auth.user().id),
+        userId: user.id,
       },
     }),
   )
 })
 
 const create = defineEventHandler(async (event) => {
-  if (!middleware.requireAdmin()) return metapi().notFound(event)
+  const { user } = await requireUserSession(event)
   const schema = z.object({
-    user: z.string(),
     cartridge: z.string(),
     units: z.number(),
     date: z.string().date(),
@@ -23,7 +23,7 @@ const create = defineEventHandler(async (event) => {
   const shot = await prisma.shot.create({
     data: {
       cartridgeId: BigInt(parsed.data.cartridge),
-      userId: BigInt(parsed.data.user),
+      userId: user.id,
       units: parsed.data.units,
       date: new Date(parsed.data.date),
     },
@@ -33,13 +33,14 @@ const create = defineEventHandler(async (event) => {
 })
 
 const remove = defineEventHandler(async (event) => {
-  if (!middleware.requireAdmin()) return metapi().notFound(event)
+  const { user } = await requireUserSession(event)
   const schema = z.object({ id: z.number(), user: z.number() })
   const parsed = schema.safeParse({ id: event.context.params?.id })
   if (!parsed.success) return metapi().error(event, parsed.error.issues, 403)
   await prisma.shot.delete({
     where: {
       id: parsed.data.id,
+      userId: user.id,
     },
   })
   return metapi().success('shot deleted')