Implement option to show or hide other shares

Author: ybizeul

README.md

@@ -75,9 +75,18 @@ be used to configure storage backend and authentication.
 Sample configuration file :
 
 ```
+# Web site name for the title bar
 Title: Hupload
+
+# By default shares will be created for upload only
 default_exposure: upload
+
+# By default, shares will be available for 7 days
 default_validity_days: 7
+
+# Registered users will only see their own shares
+hide_other_shares: false
+
 auth:
   type: file
   options:

hupload/handlers.go

@@ -85,18 +85,31 @@ func (h *Hupload) patchShare(w http.ResponseWriter, r *http.Request) {
 	// We ignore unmarshalling of JSON body as it is optional.
 	_ = json.NewDecoder(r.Body).Decode(&options)
 
-	result, err := h.Config.Storage.UpdateShare(r.Context(), r.PathValue("share"), options)
+	share, err := h.Config.Storage.GetShare(r.Context(), r.PathValue("share"))
 	if err != nil {
 		slog.Error("patchShare", slog.String("error", err.Error()))
 		switch {
 		case errors.Is(err, storage.ErrInvalidShareName):
 			writeError(w, http.StatusBadRequest, "invalid share name")
 			return
 		case errors.Is(err, storage.ErrShareNotFound):
-			writeError(w, http.StatusNotFound, "share does not exists")
+			writeError(w, http.StatusNotFound, "share not found")
+			return
+		}
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+
+	if h.Config.Values.HideOtherShares {
+		if share.Owner != user {
+			writeError(w, http.StatusForbidden, "unauthorized")
 			return
 		}
+	}
 
+	result, err := h.Config.Storage.UpdateShare(r.Context(), share.Name, options)
+	if err != nil {
+		slog.Error("patchShare", slog.String("error", err.Error()))
 		writeError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
@@ -222,6 +235,16 @@ func (h *Hupload) getShares(w http.ResponseWriter, r *http.Request) {
 	}
 	user, _ := auth.AuthForRequest(r)
 
+	if h.Config.Values.HideOtherShares {
+		tmpShares := []storage.Share{}
+		for s := range shares {
+			if shares[s].Owner == user {
+				tmpShares = append(tmpShares, shares[s])
+			}
+		}
+		shares = tmpShares
+	}
+
 	if user == "" {
 		writeSuccessJSON(w, storage.PublicShares(shares))
 	} else {