Fix admin authorization and harden chat requests

src/routes/uploads.js

@@ -2,6 +2,7 @@
  * @file Verarbeitet das Hochladen, Abrufen und Entfernen von Bildanhängen mit Zugriffskontrolle.
  */
 import express from "express";
+import {asyncHandler} from "../middleware/asyncHandler.js";
 import multer from "multer";
 import {requireLogin} from "../middleware/auth.js";
 import {AttachmentError} from "../services/attachmentService.js";
@@ -31,17 +32,17 @@ export function createUploadsRouter(service, config) {
             catch (failure) { fail(res, failure); }
         });
     });
-    router.get("/attachments/:id", requireLogin, async (req, res) => {
+    router.get("/attachments/:id", requireLogin, asyncHandler(async (req, res) => {
         try {
             const row = service.owned(req.params.id, req.session.user);
             const buffer = await service.storage.read(row.storage_key);
             res.set({"Content-Type": row.mime_type, "Content-Length": buffer.length, "Cache-Control": "private, no-store",
                 "X-Content-Type-Options": "nosniff", "Content-Disposition": "inline"}).send(buffer);
         } catch (error) { fail(res, error); }
-    });
-    router.delete("/attachments/:id", requireLogin, async (req, res) => {
+    }));
+    router.delete("/attachments/:id", requireLogin, asyncHandler(async (req, res) => {
         try { await service.remove(req.params.id, req.session.user); res.json({success: true}); }
         catch (error) { fail(res, error); }
-    });
+    }));
     return router;
 }