Find the authorization flaw in this generated mutation.
TypeScript
const rename = protectedProcedure
.input(z.object({ orderId: z.string(), ownerId: z.string(), name: z.string() }))
.mutation(async ({ ctx, input }) => {
const order = await ctx.db.order.findFirst({
where: { id: input.orderId, ownerId: input.ownerId },
});
if (!order) throw new TRPCError({ code: "NOT_FOUND" });
return ctx.db.order.update({
where: { id: order.id }, data: { name: input.name },
});
});