fix: enforce team scoping for campaign, contacts, and invites (#356)

* fix: enforce team-scoped lookups for campaign contacts and invites

* fix(test): mock domain service in campaign security test

apps/web/src/server/api/routers/campaign.ts

@@ -128,7 +128,7 @@ export const campaignRouter = createTRPCRouter({
       const { html: htmlInput, campaignId, ...data } = input;
       if (data.contactBookId) {
         const contactBook = await db.contactBook.findUnique({
-          where: { id: data.contactBookId },
+          where: { id: data.contactBookId, teamId: team.id },
         });
 
         if (!contactBook) {
@@ -191,7 +191,7 @@ export const campaignRouter = createTRPCRouter({
 
     if (campaign?.contactBookId) {
       const contactBook = await db.contactBook.findUnique({
-        where: { id: campaign.contactBookId },
+        where: { id: campaign.contactBookId, teamId: team.id },
       });
       return { ...campaign, contactBook, imageUploadSupported };
     }