From 33fcc416b9902e8be4a4a81e4bbfdefa61538fe2 Mon Sep 17 00:00:00 2001
From: John O'Keefe <jrokeefe@protonmail.com>
Date: Fri, 20 Feb 2026 17:04:02 -0500
Subject: [PATCH] fix(collections): add authentication check to
 PreviewCollection handler

The PreviewCollection endpoint was missing authentication verification,
allowing unauthenticated access to the preview functionality. Added
check for user in context, returning 401 Unauthorized if missing.
---
 internal/handlers/collections.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/internal/handlers/collections.go b/internal/handlers/collections.go
index 3edd69c..c566cd1 100644
--- a/internal/handlers/collections.go
+++ b/internal/handlers/collections.go
@@ -827,6 +827,11 @@ func (h *CollectionHandler) HandleBulkAddBooks(c echo.Context) error {
 }
 
 func (h *CollectionHandler) PreviewCollection(c echo.Context) error {
+	user := c.Get("user")
+	if user == nil {
+		return c.JSON(http.StatusUnauthorized, map[string]string{"error": "unauthorized"})
+	}
+
 	var req struct {
 		LibraryID     string          `json:"library_id"`
 		Rules         []services.Rule `json:"rules"`