add auth

src/app/api/file/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server'
 import fs from 'fs'
 import path from 'path'
 import { getLibrary, resolveLibraryRoot, resolveAndJail } from '@/lib/libraries'
+import { requireLibraryAccess } from '@/lib/auth'
 
 const MIME_TYPES: Record<string, string> = {
   '.mp4': 'video/mp4',
@@ -35,6 +36,9 @@ export async function GET(request: NextRequest) {
     return NextResponse.json({ error: 'Missing libraryId or path' }, { status: 400 })
   }
 
+  const auth = await requireLibraryAccess(request, libraryId)
+  if (auth instanceof NextResponse) return auth
+
   const library = getLibrary(libraryId)
   if (!library) {
     return NextResponse.json({ error: 'Library not found' }, { status: 404 })