Fix: monetize page must show only sites you own

The projects RLS also permits org-wide and project-member reads, so the
/ads/slots list was showing teammates' sites. Monetization is owner-only
(payouts go to the slot owner), so scope the project list to owner_id, and
harden createSlot to require ownership rather than trusting the broad RLS.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ralyodio

app/(app)/ads/slots/page.tsx

@@ -48,7 +48,13 @@ export default async function SlotsPage() {
   const payoutsBySlot = new Map<string, Payout[]>();
   if (user) {
     const [{ data: p }, { data: s }, { data: ledger }, { data: payouts }] = await Promise.all([
-      supabase.from("projects").select("id, name, url").order("created_at", { ascending: false }),
+      // Monetization is owner-only: you earn from a slot, so only list projects
+      // you OWN — not org/member-shared ones the broad RLS would also return.
+      supabase
+        .from("projects")
+        .select("id, name, url")
+        .eq("owner_id", user.id)
+        .order("created_at", { ascending: false }),
       supabase.from("ad_slots").select("id, project_id, status, payout_address, payout_currency"),
       supabase.from("ad_ledger").select("slot_id, amount_cents").eq("kind", "publisher_accrual"),
       supabase

app/actions/ads.ts

@@ -215,13 +215,15 @@ export async function createSlot(input: {
   } = await supabase.auth.getUser();
   if (!user) return { ok: false, error: "Not authenticated." };
 
-  // Confirm the project belongs to the user (RLS also enforces this).
+  // Monetization is owner-only — the broad projects RLS also allows org/member
+  // reads, so scope explicitly to owner_id (payouts go to the slot owner).
   const { data: project } = await supabase
     .from("projects")
     .select("id, organization_id")
     .eq("id", input.projectId)
+    .eq("owner_id", user.id)
     .maybeSingle();
-  if (!project) return { ok: false, error: "Project not found." };
+  if (!project) return { ok: false, error: "You can only monetize a site you own." };
 
   const payload: Record<string, unknown> = {
     project_id: project.id,