Update app.py

app.py

@@ -129,6 +129,12 @@ async def edit_recipe(request: Request, id: str, update: RecipeUpdate):
         if not update_dict:
             raise HTTPException(status_code=400, detail="No fields provided to update.")
 
+        # Check ownership
+        ownership_check = supabase.table("recipes").select("user_id").eq("id", id).single().execute()
+        if ownership_check.data["user_id"] != update.user_id:
+            raise HTTPException(status_code=403, detail="You are not authorized to edit this recipe.")
+
+
         # Make the update
         response = supabase.table("recipes").update(update_dict).eq("id", id).execute()