Validate generation project ownership before enqueue

app/generation/services/generation_service.py

@@ -170,6 +170,20 @@ class GenerationService:
         key = idempotency_key.strip()
         if not key:
             raise GenerationValidationError("Idempotency-Key must not be blank.")
+        if project_id is not None and payload.project_id is not None and project_id != payload.project_id:
+            raise GenerationValidationError("Conflicting project_id values were supplied.")
+        project_id = project_id or payload.project_id
+        if project_id is not None:
+            async with self.database.tenant_session(workspace_id=workspace_id, user_id=user_id) as session:
+                project_exists = await session.scalar(
+                    select(Project.id).where(
+                        Project.id == project_id,
+                        Project.workspace_id == workspace_id,
+                        Project.status == "active",
+                    )
+                )
+            if project_exists is None:
+                raise GenerationValidationError("Project was not found in this workspace or is archived.")
 
         base_spec = self._request_spec(payload)
         requested_fingerprint = self._fingerprint(