use check permissions in /media endpoint

backend/files/media_urls.py

@@ -2,22 +2,27 @@ from django.http import HttpResponse
 from django.urls import path
 from drf_yasg.utils import swagger_auto_schema
 from rest_framework import status
-from rest_framework.decorators import api_view
+from rest_framework.decorators import api_view, permission_classes, authentication_classes
+from rest_framework.permissions import IsAuthenticated
 from rest_framework.response import Response
 
+from authentication.signature_auth import SignatureAuthentication
 from files.models import File
 
 
-# TODO check file permissions here
 @swagger_auto_schema(method='GET', auto_schema=None)
 @api_view(['GET'])
-def media_urls(request, id, format=None):
+@permission_classes([IsAuthenticated])
+@authentication_classes([SignatureAuthentication])
+def media_urls(request, hash_path):
     try:
-        file = File.objects.get(file=id)
+        file = File.objects.filter(connected_items__owner__in=request.user.friends_or_self()).distinct().get(
+            file=hash_path)
+
         return HttpResponse(status=status.HTTP_200_OK,
                             content_type=file.mime_type,
                             headers={
-                                'X-Accel-Redirect': f'/redirect_media/{id}',
+                                'X-Accel-Redirect': f'/redirect_media/{hash_path}',
                                 'Access-Control-Allow-Origin': '*',
                             })  # TODO Expires and Cache-Control
 
@@ -26,5 +31,5 @@ def media_urls(request, id, format=None):
 
 
 urlpatterns = [
-    path('<path:id>', media_urls),
+    path('<path:hash_path>', media_urls),
 ]