fix(security): close IDOR on computers/components update & destroy

- Scope update/destroy queries by userId (Computers & Components), matching
  the pattern already used in index/show/edit
- Add missing auth.authenticate() calls on destroy actions
- handleComponents now requires userId and scopes component lookups to the
  current user, preventing cross-user component takeover
- handleComponents rejects attaching more than one component of the same
  'unique' type to a computer (new InvalidComponentSelectionException, 422)
- handlePictures scopes picture lookups by computerId
- destroy(Computer) now detaches its components (computerId = null) instead
  of losing them to cascade delete, and removes the computer's uploads dir
- Switch store/update actions to request.validateUsing() for consistency
- Fix relative redirects to absolute paths (/computers, /computers/:id)
- Untrack .env.production and add it to .gitignore (secrets must not be
  committed); local file kept on disk

app/controllers/components_controller.ts

@@ -18,9 +18,8 @@ export default class ComponentsController {
   }
 
   async store({ request, response, auth }: HttpContext) {
-    const data = request.all()
     const user = await auth.authenticate()
-    const { quantity, ...componentData } = await storeComponentValidator.validate(data)
+    const { quantity, ...componentData } = await request.validateUsing(storeComponentValidator)
     await ComponentType.findOrFail(componentData.typeId)
     for (let i = 0; i < quantity; i++) {
       await Component.create({
@@ -59,9 +58,8 @@ export default class ComponentsController {
   }
 
   async update({ params, auth, request, response }: HttpContext) {
-    const data = request.all()
-    const componentData = await updateComponentValidator.validate(data)
     const user = await auth.authenticate()
+    const componentData = await request.validateUsing(updateComponentValidator)
     const component = await Component.query()
       .where('userId', user.id)
       .andWhere('id', params.id)
@@ -74,9 +72,13 @@ export default class ComponentsController {
     return response.redirect('/components')
   }
 
-  async destroy({ params, response }: HttpContext) {
+  async destroy({ params, auth, response }: HttpContext) {
+    const user = await auth.authenticate()
     const componentId = params.id
-    const component = await Component.findOrFail(componentId)
+    const component = await Component.query()
+      .where('userId', user.id)
+      .andWhere('id', componentId)
+      .firstOrFail()
     await component.delete()
     return response.redirect('/components')
   }