Momento/memento-note/lib/upload-access.ts

import { prisma } from './prisma'

/** Whether a note image upload may be served to the current viewer. */
export async function canAccessUploadedNoteImage(
  filename: string,
  userId: string | null | undefined,
): Promise<boolean> {
  const imagePath = `/uploads/notes/${filename}`

  const published = await prisma.note.findFirst({
    where: {
      isPublic: true,
      trashedAt: null,
      OR: [
        { content: { contains: imagePath } },
        { images: { contains: filename } },
      ],
    },
    select: { id: true },
  })
  if (published) return true

  if (!userId) return false

  const owned = await prisma.note.findFirst({
    where: {
      userId,
      trashedAt: null,
      OR: [
        { content: { contains: imagePath } },
        { images: { contains: filename } },
      ],
    },
    select: { id: true },
  })
  return !!owned
}