Verify the response only contains data from requester account.

We have logic at each route to get the account of the requester and use that in the query to retrieve data. This is good, but we'd like to add an additional level of security to verify the response does not contain any items associated with a different account, before returning it to the client. It would make most sense if this was done as some type of middleware and was not required to be implemented at each route.

Start by tracing the existing requester-account lookup and query flow at each route. Investigate the middleware entry point and response path, then define how account ownership is verified before data reaches the client; done means responses contain no items associated with another account.

Rédigé par le modèle d'indexation à partir du texte de l'issue.