IDOR: reading or changing someone else's data in Next.js

Take the user id from the session. Use the object's id from the URL only as a lookup inside that user's rows.

const user = await getCurrentUser();
if (!user) return new Response("Unauthorized", { status: 401 });

const note = await db.note.findFirst({
  where: { id: params.id, userId: user.id },
});
if (!note) return new Response("Not found", { status: 404 });

Return 404 when the row exists but is not theirs, so you do not confirm the id. Do the same for update and delete.