intrn(chat message): validate the IDs that belongs to current user

routes/api/chat_message/list.get.ts

@@ -14,6 +14,7 @@ import { auditTrail as permissionGroup } from "$/permissions/permission_list"
 import required from "!/validators/base/required"
 import makeListRules from "!/rule_sets/make_list"
 import makeMultiIDBasedFilterRules from "!/rule_sets/make_multi-id-based_filter"
+import doesBelongToCurrentUser from "!/validators/manager/does_belong_to_user"
 
 export default class extends QueryController {
 	get filePath(): string { return __filename }
@@ -29,7 +30,10 @@ export default class extends QueryController {
 			...makeMultiIDBasedFilterRules(Manager, {
 				"initialPipes": [ required ],
 				"multipleIDKey": "consultationIDs",
-				"mustCast": true
+				"mustCast": true,
+				"postIDRules": {
+					"pipes": [ doesBelongToCurrentUser ]
+				}
 			})
 		}, {
 			"defaultSortColumn": "-createdAt"