john-okeefe
5c5593644d
ServeFile previously authenticated only ("any logged-in user") and never
checked that the user can actually see the library owning the file, so
knowing a library UUID + path was enough to fetch content from hidden
libraries. Library visibility is the permission model - the library is
what grants access to its media.
- ServeFile now resolves two URL forms through one flow:
/uploads/library-{id}/{path} (covers, reader files)
/api/media-items/{id}/download (explicit book download, new)
The item form looks up the media item, derives its library and file
path, and adds a Content-Disposition attachment header.
- Both forms enforce GetUserVisibleLibraries for the authenticated
user, mirroring the OPDS download handler (403 when not visible).
- Deleted the dead MediaHandler.DownloadBook handler (never routed).
Also widen media_highlights.start_position/end_position from
VARCHAR(100) to TEXT: the API handlers validate up to 1000 characters
(full Readium locators, KOReader CRE xpointers) but the column rejected
anything longer at the database layer. Metadata-only change applied
idempotently at startup; existing rows are untouched.
Verified against the running server: download 200 + attachment headers
+ epub bytes, unauthenticated 401, user hidden from the library 403 on
both URL forms, visible user 200, covers unchanged, and a 334-char
locator JSON now round-trips through the highlights API.
82 lines
4.2 KiB
Go
82 lines
4.2 KiB
Go
package router
|
|
|
|
import (
|
|
"bookhoard/internal/handlers"
|
|
)
|
|
|
|
func registerMediaRoutes(cfg *Config) {
|
|
e := cfg.Echo
|
|
|
|
// JWT middleware for protected routes
|
|
jwtMiddleware := createJWTMiddleware(cfg)
|
|
protected := e.Group("/api", jwtMiddleware)
|
|
admin := protected.Group("", handlers.AdminMiddleware)
|
|
|
|
// Media item routes (all authenticated users)
|
|
protected.GET("/media-items", cfg.MediaHandler.ListMediaItems)
|
|
protected.GET("/media-items/:id", cfg.MediaHandler.GetMediaItem)
|
|
// Book download endpoint - same ServeFile flow as /uploads/library-:id/*
|
|
// (JWT + library-visibility gated), addressed by media item ID.
|
|
protected.GET("/media-items/:id/download", cfg.MediaHandler.ServeFile)
|
|
|
|
// Media rating routes (all authenticated users)
|
|
protected.POST("/media-items/:id/rating", cfg.MediaHandler.CreateMediaRating)
|
|
protected.GET("/media-items/:id/rating", cfg.MediaHandler.GetMediaRating)
|
|
protected.PUT("/media-items/:id/rating", cfg.MediaHandler.UpdateMediaRating)
|
|
protected.DELETE("/media-items/:id/rating", cfg.MediaHandler.DeleteMediaRating)
|
|
|
|
// Progress routes (all authenticated users)
|
|
protected.GET("/media-items/:id/progress", cfg.MediaHandler.GetMediaReadingProgress)
|
|
protected.PUT("/media-items/:id/progress", cfg.MediaHandler.UpdateMediaReadingProgress)
|
|
protected.DELETE("/media-items/:id/progress", cfg.MediaHandler.DeleteMediaReadingProgress)
|
|
|
|
// Notes routes (all authenticated users)
|
|
protected.GET("/media-items/:id/notes", cfg.MediaHandler.GetMediaNotes)
|
|
protected.POST("/media-items/:id/notes", cfg.MediaHandler.CreateMediaNote)
|
|
protected.GET("/media-items/:id/notes/:noteId", cfg.MediaHandler.GetMediaNote)
|
|
protected.PUT("/media-items/:id/notes/:noteId", cfg.MediaHandler.UpdateMediaNote)
|
|
protected.DELETE("/media-items/:id/notes/:noteId", cfg.MediaHandler.DeleteMediaNote)
|
|
|
|
// Highlights routes (all authenticated users)
|
|
protected.GET("/media-items/:id/highlights", cfg.MediaHandler.GetMediaHighlights)
|
|
protected.POST("/media-items/:id/highlights", cfg.MediaHandler.CreateMediaHighlight)
|
|
protected.GET("/media-items/:id/highlights/:highlightId", cfg.MediaHandler.GetMediaHighlight)
|
|
protected.PUT("/media-items/:id/highlights/:highlightId", cfg.MediaHandler.UpdateMediaHighlight)
|
|
protected.DELETE("/media-items/:id/highlights/:highlightId", cfg.MediaHandler.DeleteMediaHighlight)
|
|
|
|
// Bookmark routes (all authenticated users)
|
|
protected.GET("/media-items/:id/bookmarks", cfg.MediaHandler.GetMediaBookmarks)
|
|
protected.POST("/media-items/:id/bookmarks", cfg.MediaHandler.CreateMediaBookmark)
|
|
protected.PUT("/media-items/:id/bookmarks/:bookmarkId", cfg.MediaHandler.UpdateMediaBookmark)
|
|
protected.DELETE("/media-items/:id/bookmarks/:bookmarkId", cfg.MediaHandler.DeleteMediaBookmark)
|
|
|
|
// Deleted-annotation history (all authenticated users): tombstoned
|
|
// highlights/notes/bookmarks restorable or permanently removable from the
|
|
// book page's "recently deleted" list.
|
|
protected.GET("/media-items/:id/annotations/deleted", cfg.MediaHandler.GetDeletedAnnotations)
|
|
protected.POST("/media-items/:id/annotations/:annotationId/restore", cfg.MediaHandler.RestoreDeletedAnnotation)
|
|
protected.DELETE("/media-items/:id/annotations/:annotationId", cfg.MediaHandler.PurgeDeletedAnnotation)
|
|
|
|
// Admin-only media routes
|
|
admin.POST("/media-items", cfg.MediaHandler.CreateMediaItem)
|
|
admin.PUT("/media-items/:id", cfg.MediaHandler.UpdateMediaItem)
|
|
admin.DELETE("/media-items/:id", cfg.MediaHandler.DeleteMediaItem)
|
|
|
|
// Shelf management (protected)
|
|
protected.POST("/devices/:id/shelves", cfg.MediaHandler.AddToShelf)
|
|
protected.GET("/devices/:id/shelves", cfg.MediaHandler.GetShelf)
|
|
protected.DELETE("/devices/:id/shelves", cfg.MediaHandler.RemoveFromShelf)
|
|
protected.DELETE("/devices/:id/shelves/clear", cfg.MediaHandler.ClearShelf)
|
|
|
|
// Bulk media operations (protected)
|
|
mediaItems := protected.Group("/media-items")
|
|
mediaItems.POST("/bulk-delete", cfg.MediaHandler.HandleBulkDelete)
|
|
mediaItems.POST("/bulk-update", cfg.MediaHandler.HandleBulkUpdate)
|
|
|
|
// File serving - authenticated (registered on Echo to avoid /api prefix)
|
|
// Create a group with JWT middleware for routes outside /api
|
|
authenticated := e.Group("", createJWTMiddleware(cfg))
|
|
// Note: Must be registered LAST as it's a wildcard route
|
|
authenticated.GET("/uploads/library-:id/*", cfg.MediaHandler.ServeFile)
|
|
}
|