fix(api): add project access validation to video progress route

app/api/watch/[videoId]/progress/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
+import { auth, checkProjectAccess } from '@/lib/auth';
 import { apiErrors, successResponse } from '@/lib/api-response';
 
 type RouteParams = { params: Promise<{ videoId: string }> };
@@ -20,6 +20,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
         const video = await db.video.findUnique({
             where: { id: videoId },
             include: {
+                project: true,
                 versions: {
                     where: { isActive: true },
                     take: 1,
@@ -31,6 +32,13 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
             return apiErrors.notFound('Video');
         }
 
+        // Check access including workspace membership
+        const access = await checkProjectAccess(video.project, session?.user?.id);
+
+        if (!access.hasAccess) {
+            return apiErrors.forbidden('Access denied');
+        }
+
         const activeVersion = video.versions[0];
         if (!activeVersion) {
             return apiErrors.notFound('Video version');
@@ -82,6 +90,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
             const video = await db.video.findUnique({
                 where: { id: videoId },
                 include: {
+                    project: true,
                     versions: {
                         where: { isActive: true },
                         take: 1,
@@ -93,6 +102,13 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
                 return apiErrors.notFound('Video');
             }
 
+            // Check access including workspace membership
+            const access = await checkProjectAccess(video.project, session?.user?.id);
+
+            if (!access.hasAccess) {
+                return apiErrors.forbidden('Access denied');
+            }
+
             const activeVersion = video.versions[0];
             if (!activeVersion) {
                 return apiErrors.notFound('Video version');