fix: Scope color palettes API routes to logged in user

[bprusinowski]

Closes #2467

This PR makes sure:

• user needs to be logged in to create / update / remove / get a color palette (was already a constraint in the UI, now also added to the backend side),
• we remove user palettes on User deletion (cascading delete).

---

• I added a CHANGELOG entry
• I made a self-review of my own code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
visualization-tool	Ready	Preview	Comment	Oct 13, 2025 1:49pm

[noahonyejese]

LGTM overall, there still seems to be an issue on Vercel deployment but I'll approve for now. Can we now delete a user account or was this already the case in the past? 😃

[bprusinowski]

Thanks @noahonyejese 🙇‍♂️ Yeah, in order to merge this PR, we'd actually first need to tackle #2360 to improve the way we handle migrations (and to fix Vercel deployment).

We can't remove accounts yet, but just to be prepared for the future 😄

[adintegra]

Fundamentally, these changes look good to me. However, the client has recently decided that unique palette names (globally) is useful to them. It may therefore make sense to drop the uniqueness constraint changes here but keep the other enhancements, i.e.

• user needs to be logged in to create / update / remove / get a color palette (was already a constraint in the UI, now also added to the backend side),
• we remove user palettes on User deletion (cascading delete).

For added context, there are ongoing conversations outside this thread regarding the overall streamlining of the DB design, enhancing it to accommodate palette sharing and potentially moving to the proper use of prisma migrations (i.e. moving from prisma db push to prisma migrate dev + prisma migrate deploy) – see #2360.