Exercise 2: Confirming the Exploit No Longer Works — Possible Solution
====================================================================

THE ADDED CHECK
------------------------------
Per this chapter, updatePageTitle now starts with:

const session = await auth();
if (!session) {
  throw new Error('Unauthorized');
}

before any Prisma call runs at all.

REPEATING CHAPTER 8'S OWN EXERCISE 1
------------------------------
Calling updatePageTitle(somePageId, 'A New Title') with no active
NextAuth session present (no prior sign-in, no valid session cookie) now
throws the Unauthorized error immediately - the function returns before
ever reaching prisma.page.update(). Checking the page's own title
afterward confirms it is unchanged from before the call.

CONFIRMING THE AUTHENTICATED PATH STILL WORKS
------------------------------
Signing in first (per Exercise 1), then calling the same
updatePageTitle with a valid session present, succeeds exactly as it
did in Chapter 8 - the title actually changes, and updateTag() still
fires correctly.

WHY THIS WORKS AS AN ANSWER
------------------------------
It re-runs the exact same exploit attempt from Chapter 8's own Exercise
1 rather than a new scenario, confirms the database row is genuinely
unchanged (not just that an error was thrown), and separately confirms
the legitimate authenticated path still works - proving the fix blocks
the attack without breaking the real feature.