upd

src/modules/reports/dto/create-report.dto.ts

@@ -2,6 +2,10 @@ import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
 import { IsEnum, IsOptional, IsString, IsUUID } from 'class-validator';
 
 export class CreateReportDto {
+  @ApiProperty({ description: 'Your profile ID' })
+  @IsUUID()
+  sourceProfileId: string;
+
   @ApiProperty()
   @IsUUID()
   entityId: string;

src/modules/reports/reports.controller.ts

@@ -16,10 +16,7 @@ export class ReportsController {
 
   @Post()
   @ApiOperation({ summary: 'Submit a report' })
-  create(
-    @CurrentUser('id') userId: string,
-    @Body() dto: CreateReportDto,
-  ) {
+  create(@CurrentUser('id') userId: string, @Body() dto: CreateReportDto) {
     return this.reportsService.create(userId, dto);
   }
 

src/modules/reports/reports.service.ts

@@ -1,23 +1,26 @@
-import { Injectable } from '@nestjs/common';
-import { DrizzleService } from '../../database/drizzle.service';
-import { report } from '../../database/schema';
-import { CreateReportDto } from './dto/create-report.dto';
+import { ForbiddenException, Injectable, NotFoundException } from '@nestjs/common';
 import { eq } from 'drizzle-orm';
+import { DrizzleService } from '../../database/drizzle.service';
+import { profile, report } from '../../database/schema';
+import { CreateReportDto } from './dto/create-report.dto';
 
 @Injectable()
 export class ReportsService {
   constructor(private readonly drizzleService: DrizzleService) {}
 
   async create(userId: string, dto: CreateReportDto) {
+    await this.assertProfileOwnership(userId, dto.sourceProfileId);
+
     const [newReport] = await this.drizzleService.db
       .insert(report)
       .values({
-        sourceUser: userId,
+        sourceProfileId: dto.sourceProfileId,
         entityId: dto.entityId,
         entityType: dto.entityType,
         description: dto.description || null,
       } as any)
       .returning();
+
     return newReport;
   }
 
@@ -25,10 +28,14 @@ export class ReportsService {
     return this.drizzleService.db.select().from(report).orderBy(report.id);
   }
 
-  async getByUser(userId: string) {
-    return this.drizzleService.db
-      .select()
-      .from(report)
-      .where(eq(report.sourceUser, userId));
+  private async assertProfileOwnership(userId: string, profileId: string) {
+    const [found] = await this.drizzleService.db
+      .select({ userId: profile.userId })
+      .from(profile)
+      .where(eq(profile.id, profileId))
+      .limit(1);
+
+    if (!found) throw new NotFoundException('Profile not found');
+    if (found.userId !== userId) throw new ForbiddenException('Profile does not belong to you');
   }
 }