AI-Assisted Code Review

# Use the actual `git diff` output, or the file content if your changes are larger.

Review this diff for:
  - Bugs (logic errors, missing edge cases, off-by-one)
  - Security issues (auth, input validation, secrets in client code)
  - Missing error handling
  - Code that violates the project's existing conventions

Do NOT comment on style or formatting, my linter handles that.

For each issue, give:
  - File and line
  - What's wrong
  - Why it matters
  - Suggested fix (one line if possible)

If you don't see any issues in a category, say "no issues found", don't invent.

```diff
<paste git diff here>
```

// src/app/api/posts/route.ts
import { prisma } from "@/lib/prisma";

export async function POST(request: Request) {
  const body = await request.json();

  const post = await prisma.post.create({
    data: {
      title: body.title,
      body:  body.body,
      userId: body.userId,  // ← trusting client input for ownership
    },
  });

  return Response.json(post);
}

// Things AI review will (correctly) flag:
//  1. No input validation, body could be anything, breaks at runtime
//     or stores garbage in the DB. Suggested fix: Zod schema.
//  2. userId comes from the request body, anyone can create posts AS
//     other users by changing the JSON. Use the authenticated session
//     user instead, not body.userId.
//  3. No error handling, if the DB call throws, the request 500s with
//     no useful response. Wrap in try/catch and return a clean error.
//  4. Returns 200 by default for a POST that created a resource;
//     should be 201.