init

2026-08-22 02:59:16 +02:00
commit 6a5bb1d699
100 changed files with 17409 additions and 0 deletions
@@ -0,0 +1,677 @@
+package galleries
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/example/sndit/backend/internal/auth"
+	"github.com/example/sndit/backend/internal/media"
+	"github.com/example/sndit/backend/internal/storage"
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+)
+
+const signedURLDuration = time.Hour
+
+type Handler struct {
+	repository *Repository
+	media      *media.Repository
+	storage    storage.Storage
+	auth       *auth.Service
+}
+
+func NewHandler(repository *Repository, mediaRepository *media.Repository, objectStorage storage.Storage, authService *auth.Service) *Handler {
+	return &Handler{
+		repository: repository,
+		media:      mediaRepository,
+		storage:    objectStorage,
+		auth:       authService,
+	}
+}
+
+func (h *Handler) RegisterProtectedRoutes(mux *http.ServeMux, require func(http.Handler) http.Handler) {
+	mux.Handle("GET /api/galleries", require(http.HandlerFunc(h.List)))
+	mux.Handle("POST /api/galleries", require(http.HandlerFunc(h.Create)))
+	mux.Handle("GET /api/galleries/{id}", require(http.HandlerFunc(h.Get)))
+	mux.Handle("PATCH /api/galleries/{id}", require(http.HandlerFunc(h.Update)))
+	mux.Handle("DELETE /api/galleries/{id}", require(http.HandlerFunc(h.Delete)))
+	mux.Handle("POST /api/galleries/{id}/publish", require(http.HandlerFunc(h.Publish)))
+	mux.Handle("POST /api/galleries/{id}/unpublish", require(http.HandlerFunc(h.Unpublish)))
+	mux.Handle("GET /api/galleries/{id}/preview", require(http.HandlerFunc(h.Preview)))
+}
+
+func (h *Handler) RegisterPublicRoutes(mux *http.ServeMux) {
+	mux.HandleFunc("GET /api/public/galleries/{slug}", h.Public)
+	mux.HandleFunc("POST /api/public/galleries/{slug}/authenticate", h.AuthenticatePublic)
+	mux.HandleFunc("POST /api/public/galleries/{slug}/media/{mediaId}/favorite", h.Favorite)
+	mux.HandleFunc("DELETE /api/public/galleries/{slug}/media/{mediaId}/favorite", h.Unfavorite)
+}
+
+type createRequest struct {
+	Title       string `json:"title"`
+	ClientName  string `json:"clientName"`
+	Description string `json:"description"`
+}
+
+type updateRequest struct {
+	Title              *string         `json:"title"`
+	ClientName         *string         `json:"clientName"`
+	Description        *string         `json:"description"`
+	Password           *string         `json:"password"`
+	ClearPassword      bool            `json:"clearPassword"`
+	DownloadsEnabled   *bool           `json:"downloadsEnabled"`
+	FavoritesEnabled   *bool           `json:"favoritesEnabled"`
+	DownloadAllEnabled *bool           `json:"downloadAllEnabled"`
+	WatermarkEnabled   *bool           `json:"watermarkEnabled"`
+	ExpiresAt          *string         `json:"expiresAt"`
+	CoverMediaID       *string         `json:"coverMediaId"`
+	ThemeConfig        json.RawMessage `json:"themeConfig"`
+	BrandingConfig     json.RawMessage `json:"brandingConfig"`
+}
+
+type publicPasswordRequest struct {
+	Password string `json:"password"`
+}
+
+func (h *Handler) List(w http.ResponseWriter, r *http.Request) {
+	user, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "authentication required")
+		return
+	}
+	summaries, err := h.repository.ListForUser(r.Context(), user.ID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "could not load galleries")
+		return
+	}
+	for index := range summaries {
+		if summaries[index].CoverMediaID == "" {
+			continue
+		}
+		coverID, err := uuid.Parse(summaries[index].CoverMediaID)
+		if err != nil {
+			continue
+		}
+		cover, err := h.media.GetForUser(r.Context(), user.ID, coverID)
+		if err != nil {
+			continue
+		}
+		summaries[index].CoverURL, _ = h.mediaURL(r.Context(), cover, false)
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"galleries": summaries})
+}
+
+func (h *Handler) Create(w http.ResponseWriter, r *http.Request) {
+	user, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "authentication required")
+		return
+	}
+	var request createRequest
+	if !decodeJSON(w, r, &request) {
+		return
+	}
+	request.Title = strings.TrimSpace(request.Title)
+	request.ClientName = strings.TrimSpace(request.ClientName)
+	if request.Title == "" || len(request.Title) > 180 || request.ClientName == "" || len(request.ClientName) > 180 {
+		writeError(w, http.StatusBadRequest, "title and client name are required")
+		return
+	}
+
+	record, err := h.repository.Create(r.Context(), user.ID, newSlug(request.Title), request.Title, request.ClientName, strings.TrimSpace(request.Description))
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "could not create gallery")
+		return
+	}
+	writeJSON(w, http.StatusCreated, map[string]any{"gallery": h.detail(record, nil)})
+}
+
+func (h *Handler) Get(w http.ResponseWriter, r *http.Request) {
+	user, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "authentication required")
+		return
+	}
+	record, err := h.recordForUser(r, user.ID)
+	if err != nil {
+		writeGalleryError(w, err)
+		return
+	}
+	items, err := h.media.ListByGallery(r.Context(), record.ID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "could not load gallery media")
+		return
+	}
+	views, err := h.mediaViews(r.Context(), items, "", true)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "could not sign media URLs")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"gallery": h.detail(record, views)})
+}
+
+func (h *Handler) Preview(w http.ResponseWriter, r *http.Request) {
+	user, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "authentication required")
+		return
+	}
+	record, err := h.recordForUser(r, user.ID)
+	if err != nil {
+		writeGalleryError(w, err)
+		return
+	}
+	gallery, err := h.publicPayload(r.Context(), r, record, true, true, "")
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "could not build gallery preview")
+		return
+	}
+	gallery.Preview = true
+	writeJSON(w, http.StatusOK, map[string]any{"gallery": gallery})
+}
+
+func (h *Handler) Update(w http.ResponseWriter, r *http.Request) {
+	user, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "authentication required")
+		return
+	}
+	current, err := h.recordForUser(r, user.ID)
+	if err != nil {
+		writeGalleryError(w, err)
+		return
+	}
+	var request updateRequest
+	if !decodeJSON(w, r, &request) {
+		return
+	}
+
+	input := UpdateInput{
+		Title:              current.Title,
+		ClientName:         current.ClientName,
+		Description:        current.Description,
+		DownloadsEnabled:   current.DownloadsEnabled,
+		FavoritesEnabled:   current.FavoritesEnabled,
+		DownloadAllEnabled: current.DownloadAllEnabled,
+		WatermarkEnabled:   current.WatermarkEnabled,
+		ExpiresAt:          stringPointer(current.ExpiresAt),
+		CoverMediaID:       stringPointer(current.CoverMediaID),
+		ThemeConfig:        current.ThemeConfig,
+		BrandingConfig:     current.BrandingConfig,
+	}
+	if current.PasswordHash != "" {
+		input.PasswordHash = &current.PasswordHash
+	}
+	if request.Title != nil {
+		input.Title = strings.TrimSpace(*request.Title)
+	}
+	if request.ClientName != nil {
+		input.ClientName = strings.TrimSpace(*request.ClientName)
+	}
+	if request.Description != nil {
+		input.Description = strings.TrimSpace(*request.Description)
+	}
+	if input.Title == "" || input.ClientName == "" || len(input.Title) > 180 || len(input.ClientName) > 180 {
+		writeError(w, http.StatusBadRequest, "title and client name are required")
+		return
+	}
+	if request.Password != nil {
+		if strings.TrimSpace(*request.Password) == "" {
+			input.ClearPassword = true
+		} else if len(*request.Password) < 4 {
+			writeError(w, http.StatusBadRequest, "gallery password must be at least 4 characters")
+			return
+		} else {
+			hash, err := bcrypt.GenerateFromPassword([]byte(*request.Password), bcrypt.DefaultCost)
+			if err != nil {
+				writeError(w, http.StatusInternalServerError, "could not secure gallery password")
+				return
+			}
+			hashed := string(hash)
+			input.PasswordHash = &hashed
+			input.ClearPassword = false
+		}
+	}
+	if request.ClearPassword {
+		input.ClearPassword = true
+		input.PasswordHash = nil
+	}
+	if request.DownloadsEnabled != nil {
+		input.DownloadsEnabled = *request.DownloadsEnabled
+	}
+	if request.FavoritesEnabled != nil {
+		input.FavoritesEnabled = *request.FavoritesEnabled
+	}
+	if request.DownloadAllEnabled != nil {
+		input.DownloadAllEnabled = *request.DownloadAllEnabled
+	}
+	if request.WatermarkEnabled != nil {
+		input.WatermarkEnabled = *request.WatermarkEnabled
+	}
+	if request.ExpiresAt != nil {
+		value := strings.TrimSpace(*request.ExpiresAt)
+		if value != "" {
+			if _, err := time.Parse(time.RFC3339, value); err != nil {
+				writeError(w, http.StatusBadRequest, "expiry must be an ISO timestamp")
+				return
+			}
+		}
+		input.ExpiresAt = &value
+	}
+	if request.CoverMediaID != nil {
+		value := strings.TrimSpace(*request.CoverMediaID)
+		if value != "" {
+			coverID, err := uuid.Parse(value)
+			if err != nil {
+				writeError(w, http.StatusBadRequest, "invalid cover media id")
+				return
+			}
+			cover, err := h.media.GetForUser(r.Context(), user.ID, coverID)
+			if err != nil || cover.GalleryID != current.ID {
+				writeError(w, http.StatusBadRequest, "cover media does not belong to this gallery")
+				return
+			}
+		}
+		input.CoverMediaID = &value
+	}
+	if len(request.ThemeConfig) > 0 {
+		if !json.Valid(request.ThemeConfig) {
+			writeError(w, http.StatusBadRequest, "theme config must be valid JSON")
+			return
+		}
+		input.ThemeConfig = request.ThemeConfig
+	}
+	if len(request.BrandingConfig) > 0 {
+		if !json.Valid(request.BrandingConfig) {
+			writeError(w, http.StatusBadRequest, "branding config must be valid JSON")
+			return
+		}
+		input.BrandingConfig = request.BrandingConfig
+	}
+
+	record, err := h.repository.Update(r.Context(), user.ID, current.ID, input)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "could not update gallery")
+		return
+	}
+	items, err := h.media.ListByGallery(r.Context(), record.ID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "could not load gallery media")
+		return
+	}
+	views, err := h.mediaViews(r.Context(), items, "", true)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "could not sign media URLs")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"gallery": h.detail(record, views)})
+}
+
+func (h *Handler) Publish(w http.ResponseWriter, r *http.Request) {
+	h.setStatus(w, r, StatusPublished)
+}
+
+func (h *Handler) Unpublish(w http.ResponseWriter, r *http.Request) {
+	h.setStatus(w, r, StatusDraft)
+}
+
+func (h *Handler) setStatus(w http.ResponseWriter, r *http.Request, status string) {
+	user, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "authentication required")
+		return
+	}
+	record, err := h.recordForUser(r, user.ID)
+	if err != nil {
+		writeGalleryError(w, err)
+		return
+	}
+	record, err = h.repository.SetStatus(r.Context(), user.ID, record.ID, status)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "could not update gallery status")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"gallery": h.detail(record, nil)})
+}
+
+func (h *Handler) Delete(w http.ResponseWriter, r *http.Request) {
+	user, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "authentication required")
+		return
+	}
+	id, err := pathUUID(r, "id")
+	if err != nil {
+		writeGalleryError(w, err)
+		return
+	}
+	if err := h.repository.Delete(r.Context(), user.ID, id); err != nil {
+		writeGalleryError(w, err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (h *Handler) Public(w http.ResponseWriter, r *http.Request) {
+	slug := strings.TrimSpace(r.PathValue("slug"))
+	record, err := h.repository.GetPublicBySlug(r.Context(), slug)
+	if err != nil || record.IsExpired() {
+		writeError(w, http.StatusNotFound, "gallery not found")
+		return
+	}
+	if record.PasswordHash != "" && !h.auth.HasGalleryAccess(r, record.Slug) {
+		gallery := h.lockedPayload(record)
+		writeJSON(w, http.StatusOK, gallery)
+		return
+	}
+	visitorID := ""
+	if record.FavoritesEnabled {
+		visitorID = h.auth.EnsureVisitor(w, r)
+	}
+	gallery, err := h.publicPayload(r.Context(), r, record, false, false, visitorID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "could not load gallery")
+		return
+	}
+	writeJSON(w, http.StatusOK, gallery)
+}
+
+func (h *Handler) AuthenticatePublic(w http.ResponseWriter, r *http.Request) {
+	slug := strings.TrimSpace(r.PathValue("slug"))
+	record, err := h.repository.GetPublicBySlug(r.Context(), slug)
+	if err != nil || record.IsExpired() {
+		writeError(w, http.StatusNotFound, "gallery not found")
+		return
+	}
+	var request publicPasswordRequest
+	if !decodeJSON(w, r, &request) {
+		return
+	}
+	if record.PasswordHash == "" || bcrypt.CompareHashAndPassword([]byte(record.PasswordHash), []byte(request.Password)) != nil {
+		writeError(w, http.StatusUnauthorized, "incorrect gallery password")
+		return
+	}
+	h.auth.GrantGalleryAccess(w, record.Slug)
+	visitorID := ""
+	if record.FavoritesEnabled {
+		visitorID = h.auth.EnsureVisitor(w, r)
+	}
+	gallery, err := h.publicPayload(r.Context(), r, record, false, false, visitorID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "could not load gallery")
+		return
+	}
+	writeJSON(w, http.StatusOK, gallery)
+}
+
+func (h *Handler) Favorite(w http.ResponseWriter, r *http.Request) {
+	h.setFavorite(w, r, true)
+}
+
+func (h *Handler) Unfavorite(w http.ResponseWriter, r *http.Request) {
+	h.setFavorite(w, r, false)
+}
+
+func (h *Handler) setFavorite(w http.ResponseWriter, r *http.Request, favorited bool) {
+	record, err := h.publicRecordForRequest(r)
+	if err != nil {
+		writeError(w, http.StatusNotFound, "gallery not found")
+		return
+	}
+	if !record.FavoritesEnabled {
+		writeError(w, http.StatusForbidden, "favorites are disabled")
+		return
+	}
+	mediaID, err := pathUUID(r, "mediaId")
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid media id")
+		return
+	}
+	item, err := h.media.GetByID(r.Context(), mediaID)
+	if err != nil || item.GalleryID != record.ID {
+		writeError(w, http.StatusNotFound, "media not found")
+		return
+	}
+	visitorID := h.auth.EnsureVisitor(w, r)
+	if err := h.media.SetFavorite(r.Context(), record.ID, mediaID, visitorID, favorited); err != nil {
+		writeError(w, http.StatusInternalServerError, "could not update favorite")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]bool{"favorited": favorited})
+}
+
+func (h *Handler) publicRecordForRequest(r *http.Request) (GalleryRecord, error) {
+	record, err := h.repository.GetPublicBySlug(r.Context(), strings.TrimSpace(r.PathValue("slug")))
+	if err != nil || record.IsExpired() {
+		return GalleryRecord{}, ErrNotFound
+	}
+	if record.PasswordHash != "" && !h.auth.HasGalleryAccess(r, record.Slug) {
+		return GalleryRecord{}, ErrNotFound
+	}
+	return record, nil
+}
+
+func (h *Handler) publicPayload(ctx context.Context, _ *http.Request, record GalleryRecord, preview, includeOriginal bool, visitorID string) (Public, error) {
+	items, err := h.media.ListByGallery(ctx, record.ID)
+	if err != nil {
+		return Public{}, err
+	}
+	views, err := h.mediaViews(ctx, items, visitorID, includeOriginal)
+	if err != nil {
+		return Public{}, err
+	}
+	gallery := Public{
+		Slug:               record.Slug,
+		Title:              record.Title,
+		ClientName:         record.ClientName,
+		Description:        record.Description,
+		ThemeConfig:        record.ThemeConfig,
+		BrandingConfig:     record.BrandingConfig,
+		DownloadsEnabled:   record.DownloadsEnabled,
+		FavoritesEnabled:   record.FavoritesEnabled,
+		DownloadAllEnabled: record.DownloadAllEnabled,
+		WatermarkEnabled:   record.WatermarkEnabled,
+		ExpiresAt:          record.ExpiresAt,
+		Media:              views,
+	}
+	for index := range items {
+		if record.CoverMediaID != "" && items[index].ID.String() == record.CoverMediaID {
+			gallery.Cover = &views[index]
+			break
+		}
+	}
+	if gallery.Cover == nil {
+		for index := range items {
+			if media.IsImage(items[index]) && views[index].PreviewURL != "" {
+				gallery.Cover = &views[index]
+				break
+			}
+		}
+	}
+	return gallery, nil
+}
+
+func (h *Handler) lockedPayload(record GalleryRecord) map[string]any {
+	return map[string]any{
+		"slug":             record.Slug,
+		"title":            record.Title,
+		"clientName":       record.ClientName,
+		"description":      record.Description,
+		"themeConfig":      record.ThemeConfig,
+		"brandingConfig":   record.BrandingConfig,
+		"requiresPassword": true,
+		"media":            []media.Public{},
+	}
+}
+
+func (h *Handler) recordForUser(r *http.Request, userID uuid.UUID) (GalleryRecord, error) {
+	id, err := pathUUID(r, "id")
+	if err != nil {
+		return GalleryRecord{}, err
+	}
+	return h.repository.GetForUser(r.Context(), userID, id)
+}
+
+func (h *Handler) detail(record GalleryRecord, items []media.Public) Detail {
+	if items == nil {
+		items = []media.Public{}
+	}
+	return Detail{
+		ID:                 record.ID.String(),
+		Slug:               record.Slug,
+		Title:              record.Title,
+		ClientName:         record.ClientName,
+		Description:        record.Description,
+		Status:             record.Status,
+		DownloadsEnabled:   record.DownloadsEnabled,
+		FavoritesEnabled:   record.FavoritesEnabled,
+		DownloadAllEnabled: record.DownloadAllEnabled,
+		WatermarkEnabled:   record.WatermarkEnabled,
+		ExpiresAt:          record.ExpiresAt,
+		CoverMediaID:       record.CoverMediaID,
+		ThemeConfig:        record.ThemeConfig,
+		BrandingConfig:     record.BrandingConfig,
+		CreatedAt:          record.CreatedAt,
+		PublishedAt:        record.PublishedAt,
+		Media:              items,
+	}
+}
+
+func (h *Handler) mediaViews(ctx context.Context, items []media.Record, visitorID string, includeOriginal bool) ([]media.Public, error) {
+	views := make([]media.Public, 0, len(items))
+	for _, item := range items {
+		view := media.Public{
+			ID:               item.ID,
+			OriginalFilename: item.OriginalFilename,
+			MimeType:         item.MimeType,
+			FileSize:         item.FileSize,
+			ProcessingStatus: item.ProcessingStatus,
+			Width:            item.Width,
+			Height:           item.Height,
+			DurationSeconds:  item.DurationSeconds,
+			SortOrder:        item.SortOrder,
+		}
+		if item.ProcessingStatus == media.StatusReady {
+			var err error
+			view.ThumbnailURL, err = h.mediaVariantURL(ctx, item, item.ThumbnailKey)
+			if err != nil {
+				return nil, err
+			}
+			view.PreviewURL, err = h.mediaURL(ctx, item, false)
+			if err != nil {
+				return nil, err
+			}
+			if includeOriginal {
+				view.OriginalURL, err = h.mediaURL(ctx, item, true)
+				if err != nil {
+					return nil, err
+				}
+			}
+		}
+		if visitorID != "" {
+			var err error
+			view.Favorited, err = h.media.IsFavorited(ctx, item.GalleryID, item.ID, visitorID)
+			if err != nil {
+				return nil, err
+			}
+		}
+		views = append(views, view)
+	}
+	return views, nil
+}
+
+func (h *Handler) mediaURL(ctx context.Context, item media.Record, original bool) (string, error) {
+	if item.ExternalURL != "" {
+		return item.ExternalURL, nil
+	}
+	key := item.PreviewKey
+	if original {
+		key = item.StorageKey
+	}
+	return h.mediaVariantURL(ctx, item, key)
+}
+
+func (h *Handler) mediaVariantURL(ctx context.Context, item media.Record, key string) (string, error) {
+	if item.ExternalURL != "" {
+		return item.ExternalURL, nil
+	}
+	if key == "" {
+		return "", fmt.Errorf("media object is not ready")
+	}
+	return h.storage.CreateDownloadURL(ctx, key, signedURLDuration)
+}
+
+func newSlug(title string) string {
+	var builder strings.Builder
+	lastWasSeparator := true
+	for _, character := range strings.ToLower(title) {
+		if (character >= 'a' && character <= 'z') || (character >= '0' && character <= '9') {
+			builder.WriteRune(character)
+			lastWasSeparator = false
+			continue
+		}
+		if builder.Len() > 0 && !lastWasSeparator {
+			builder.WriteByte('-')
+			lastWasSeparator = true
+		}
+	}
+	slug := strings.Trim(builder.String(), "-")
+	if slug == "" {
+		slug = "gallery"
+	}
+	suffix := strings.ReplaceAll(uuid.NewString(), "-", "")[:8]
+	return slug + "-" + suffix
+}
+
+func pathUUID(r *http.Request, name string) (uuid.UUID, error) {
+	id, err := uuid.Parse(r.PathValue(name))
+	if err != nil {
+		return uuid.Nil, fmt.Errorf("invalid %s", name)
+	}
+	return id, nil
+}
+
+func stringPointer(value string) *string {
+	if value == "" {
+		return nil
+	}
+	copy := value
+	return &copy
+}
+
+func decodeJSON(w http.ResponseWriter, r *http.Request, target any) bool {
+	if !strings.HasPrefix(r.Header.Get("Content-Type"), "application/json") {
+		writeError(w, http.StatusUnsupportedMediaType, "content type must be application/json")
+		return false
+	}
+	decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(target); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid JSON body")
+		return false
+	}
+	return true
+}
+
+func writeGalleryError(w http.ResponseWriter, err error) {
+	if errors.Is(err, ErrNotFound) || strings.HasPrefix(err.Error(), "invalid ") {
+		writeError(w, http.StatusNotFound, "gallery not found")
+		return
+	}
+	writeError(w, http.StatusInternalServerError, "could not load gallery")
+}
+
+func writeError(w http.ResponseWriter, status int, message string) {
+	writeJSON(w, status, map[string]string{"error": message})
+}
+
+func writeJSON(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}