Protect photos from public access

api/routes/photos.go

@@ -8,6 +8,7 @@ import (
 	"os"
 
 	"github.com/go-chi/chi"
+	"github.com/viktorstrate/photoview/api/graphql/auth"
 	"github.com/viktorstrate/photoview/api/graphql/models"
 )
 
@@ -30,6 +31,28 @@ func PhotoRoutes(db *sql.DB) chi.Router {
 			return
 		}
 
+		user := auth.UserFromContext(r.Context())
+		if user != nil {
+			row := db.QueryRow("SELECT owner_id FROM album WHERE album.album_id = ?", album_id)
+			var owner_id int
+
+			if err := row.Scan(&owner_id); err != nil {
+				w.WriteHeader(http.StatusInternalServerError)
+				w.Write([]byte("internal server error"))
+				return
+			}
+
+			if owner_id != user.UserID {
+				w.WriteHeader(http.StatusForbidden)
+				w.Write([]byte("invalid credentials"))
+				return
+			}
+		} else {
+			w.WriteHeader(http.StatusForbidden)
+			w.Write([]byte("unauthorized"))
+			return
+		}
+
 		w.Header().Set("Content-Type", content_type)
 
 		var file *os.File