Keep editorial calendars private to each tenant.

Stop seeding Agua Miia’s October plan for every client and restrict the portal publish action to that tenant only.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/app/api/calendar/publish/route.ts

@@ -30,6 +30,20 @@ export async function POST() {
     );
   }
 
+  const t = await restGet<{ slug?: string; name?: string }[]>(
+    `/rest/v1/tenants?id=eq.${encodeURIComponent(ctx.tenantId)}&select=slug,name`
+  );
+  const slug = t.data?.[0]?.slug || '';
+  if (slug !== 'agua-miia') {
+    return NextResponse.json(
+      {
+        error:
+          'Este botón solo carga el plan de octubre de Agua Miia en su propio portal. No publica en Instagram ni copia el calendario a otros clientes.',
+      },
+      { status: 400 }
+    );
+  }
+
   const headers = serviceHeaders();
   if (!headers) {
     return NextResponse.json({ error: 'no service role' }, { status: 500 });