fix: update the permission access for combo page

tests/unit/combo-ownership.test.js

@@ -0,0 +1,47 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+let tempDir;
+const originalDataDir = process.env.DATA_DIR;
+
+beforeEach(() => {
+  tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "9router-combo-owner-"));
+  process.env.DATA_DIR = tempDir;
+  delete global._dbAdapter;
+  vi.resetModules();
+});
+
+afterEach(() => {
+  try { global._dbAdapter?.instance?.close?.(); } catch {}
+  delete global._dbAdapter;
+  fs.rmSync(tempDir, { recursive: true, force: true });
+  if (originalDataDir === undefined) delete process.env.DATA_DIR;
+  else process.env.DATA_DIR = originalDataDir;
+});
+
+describe("combo ownership", () => {
+  it("allows identical names in different user scopes and prevents cross-owner reads", async () => {
+    const { createUser } = await import("@/lib/db/index.js");
+    const {
+      createCombo,
+      getComboByName,
+      getCombos,
+      updateCombo,
+      deleteCombo,
+    } = await import("@/lib/db/repos/combosRepo.js");
+
+    const userA = await createUser({ username: "combo-owner-a", password: "password", role: "user" });
+    const userB = await createUser({ username: "combo-owner-b", password: "password", role: "user" });
+    const comboA = await createCombo({ name: "fast", ownerId: userA.id, models: ["openai/gpt-a"] });
+    const comboB = await createCombo({ name: "fast", ownerId: userB.id, models: ["anthropic/claude-b"] });
+
+    expect((await getComboByName("fast", userA.id)).id).toBe(comboA.id);
+    expect((await getComboByName("fast", userB.id)).id).toBe(comboB.id);
+    expect(await getCombos(userA.id)).toEqual([comboA]);
+    expect(await updateCombo(comboA.id, { models: ["openai/gpt-updated"] }, userB.id)).toBeNull();
+    expect(await deleteCombo(comboA.id, userB.id)).toBe(false);
+    expect((await getComboByName("fast", userA.id)).models).toEqual(["openai/gpt-a"]);
+  });
+});

tests/unit/combo-routing.test.js

@@ -11,7 +11,7 @@ describe("combo round-robin routing", () => {
     const models = ["provider/model-a", "provider/model-b"];
 
     const firstChoices = Array.from({ length: 4 }, () => (
-      getRotatedModels(models, "code-xhigh", "round-robin")[0]
+      getRotatedModels(models, "combo-user-a", "round-robin")[0]
     ));
 
     expect(firstChoices).toEqual([
@@ -26,7 +26,7 @@ describe("combo round-robin routing", () => {
     const models = ["provider/model-a", "provider/model-b"];
 
     const firstChoices = Array.from({ length: 6 }, () => (
-      getRotatedModels(models, "code-xhigh", "round-robin", 2)[0]
+      getRotatedModels(models, "combo-user-a", "round-robin", 2)[0]
     ));
 
     expect(firstChoices).toEqual([
@@ -42,17 +42,27 @@ describe("combo round-robin routing", () => {
   it("tracks sticky rotation independently per combo", () => {
     const models = ["provider/model-a", "provider/model-b"];
 
-    expect(getRotatedModels(models, "code-high", "round-robin", 2)[0]).toBe("provider/model-a");
-    expect(getRotatedModels(models, "code-xhigh", "round-robin", 2)[0]).toBe("provider/model-a");
-    expect(getRotatedModels(models, "code-high", "round-robin", 2)[0]).toBe("provider/model-a");
-    expect(getRotatedModels(models, "code-high", "round-robin", 2)[0]).toBe("provider/model-b");
-    expect(getRotatedModels(models, "code-xhigh", "round-robin", 2)[0]).toBe("provider/model-a");
+    expect(getRotatedModels(models, "combo-user-a", "round-robin", 2)[0]).toBe("provider/model-a");
+    expect(getRotatedModels(models, "combo-user-b", "round-robin", 2)[0]).toBe("provider/model-a");
+    expect(getRotatedModels(models, "combo-user-a", "round-robin", 2)[0]).toBe("provider/model-a");
+    expect(getRotatedModels(models, "combo-user-a", "round-robin", 2)[0]).toBe("provider/model-b");
+    expect(getRotatedModels(models, "combo-user-b", "round-robin", 2)[0]).toBe("provider/model-a");
+  });
+
+  it("isolates rotations for same-named combos owned by different users", () => {
+    const modelsA = ["provider/model-a", "provider/model-b"];
+    const modelsB = ["provider/model-c", "provider/model-d"];
+
+    expect(getRotatedModels(modelsA, "combo-id-user-a-fast", "round-robin")[0]).toBe("provider/model-a");
+    expect(getRotatedModels(modelsB, "combo-id-user-b-fast", "round-robin")[0]).toBe("provider/model-c");
+    expect(getRotatedModels(modelsA, "combo-id-user-a-fast", "round-robin")[0]).toBe("provider/model-b");
+    expect(getRotatedModels(modelsB, "combo-id-user-b-fast", "round-robin")[0]).toBe("provider/model-d");
   });
 
   it("does not rotate fallback combos", () => {
     const models = ["provider/model-a", "provider/model-b"];
 
-    expect(getRotatedModels(models, "code-xhigh", "fallback", 2)).toEqual(models);
+    expect(getRotatedModels(models, "combo-user-a", "fallback", 2)).toEqual(models);
     expect(getRotatedModels(models, "code-xhigh", "fallback", 2)).toEqual(models);
   });
 });

tests/unit/db-migration-chain.test.js

@@ -39,6 +39,8 @@ describe("Schema migrations", () => {
     ]));
     expect(db.all(`PRAGMA table_info(providerConnections)`).map((column) => column.name)).toContain("ownerId");
     expect(db.all(`PRAGMA index_list(providerConnections)`).map((index) => index.name)).toContain("idx_pc_owner");
+    expect(db.all(`PRAGMA table_info(combos)`).map((column) => column.name)).toContain("ownerId");
+    expect(db.all(`PRAGMA index_list(combos)`).map((index) => index.name)).toContain("idx_combo_owner_name");
   });
 
   it("existing DB at older schemaVersion → re-applies pending migrations on restart", async () => {

tests/unit/db-sqlite-vs-lowdb.test.js

@@ -141,6 +141,9 @@ describe("DB SQLite layer — public API parity", () => {
     const ownerOneConnections = await sqliteDb.getProviderConnections({ ownerId: ownerOne.id });
     expect(ownerOneConnections.map((connection) => connection.id)).toContain(firstConnection.id);
     expect(ownerOneConnections.map((connection) => connection.id)).not.toContain(secondConnection.id);
+    const globalConnections = await sqliteDb.getProviderConnections({ ownerId: null });
+    expect(globalConnections.map((connection) => connection.id)).not.toContain(firstConnection.id);
+    expect(globalConnections.map((connection) => connection.id)).not.toContain(secondConnection.id);
     await expect(sqliteDb.createProviderConnection({
       provider: "owner-test-account",
       authType: "oauth",