code-style

The code contains a likely authorization/data-isolation bug: JavaScript `&&` drops the user ID condition from both database filters. Use Drizzle's `and(...)` helper (and enforce tenant authorization independently) to constrain operations to the intended user. No evidence of intentional malware.