feat: implement user preference management with persistence, reactive CSS variables, and layout customization

src/app/api/tasks/route.ts

@@ -48,6 +48,16 @@ export async function POST(req: NextRequest) {
     const list = await prisma.list.findFirst({ where: { id: listId, userId: session.user.id } });
     if (!list) return NextResponse.json({ error: "List not found" }, { status: 404 });
 
+    // IDOR 방어: parentId가 지정된 경우, 부모 태스크가 현재 사용자의 소유인지 검증
+    if (parentId) {
+      const parentTask = await prisma.task.findFirst({
+        where: { id: parentId, userId: session.user.id },
+      });
+      if (!parentTask) {
+        return NextResponse.json({ error: "Parent task not found or forbidden" }, { status: 403 });
+      }
+    }
+
     const count = await prisma.task.count({ where: { listId, parentId: parentId || null } });
     const task = await prisma.task.create({
       data: {