Update app.py

app.py

@@ -343,10 +343,9 @@ async def get_investment(investment_id: int, current_user_data=Depends(get_curre
 async def update_investment(investment_id: int, update_data: InvestmentUpdate, current_user_data=Depends(get_current_user)):
     try:
         current_user, token = current_user_data
-        user_supabase = get_user_supabase_client(token)
 
         # Check if investment exists and belongs to user
-        check_result = user_supabase.table("investments").select("id").eq("id", investment_id).execute()
+        check_result = supabase.table("investments").select("id").eq("id", investment_id).eq("user_id", current_user.id).execute()
 
         if not check_result.data:
             raise HTTPException(status_code=404, detail="Investment not found")
@@ -361,8 +360,8 @@ async def update_investment(investment_id: int, update_data: InvestmentUpdate, c
         if not update_dict:
             raise HTTPException(status_code=400, detail="No valid fields to update")
 
-        # Update investment
-        result = user_supabase.table("investments").update(update_dict).eq("id", investment_id).execute()
+        # Update investment using service client with user verification
+        result = supabase.table("investments").update(update_dict).eq("id", investment_id).eq("user_id", current_user.id).execute()
 
         return InvestmentResponse(
             id=investment_id,
@@ -375,16 +374,15 @@ async def update_investment(investment_id: int, update_data: InvestmentUpdate, c
 async def delete_investment(investment_id: int, current_user_data=Depends(get_current_user)):
     try:
         current_user, token = current_user_data
-        user_supabase = get_user_supabase_client(token)
 
         # Check if investment exists and belongs to user
-        check_result = user_supabase.table("investments").select("id").eq("id", investment_id).execute()
+        check_result = supabase.table("investments").select("id").eq("id", investment_id).eq("user_id", current_user.id).execute()
 
         if not check_result.data:
             raise HTTPException(status_code=404, detail="Investment not found")
 
-        # Delete investment
-        result = user_supabase.table("investments").delete().eq("id", investment_id).execute()
+        # Delete investment using service client with user verification
+        result = supabase.table("investments").delete().eq("id", investment_id).eq("user_id", current_user.id).execute()
 
         return InvestmentResponse(
             id=investment_id,