feat(api): route track-list reads through user-context quarantine filter

internal/api/library.go

@@ -7,6 +7,7 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/jackc/pgx/v5"
 
+	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
 )
 
@@ -71,7 +72,14 @@ func (h *handlers) handleGetAlbum(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, http.StatusInternalServerError, "server_error", "lookup failed")
 		return
 	}
-	tracks, err := q.ListTracksByAlbum(r.Context(), id)
+	var tracks []dbq.Track
+	if user, ok := auth.UserFromContext(r.Context()); ok {
+		tracks, err = q.ListTracksByAlbumForUser(r.Context(), dbq.ListTracksByAlbumForUserParams{
+			AlbumID: id, UserID: user.ID,
+		})
+	} else {
+		tracks, err = q.ListTracksByAlbum(r.Context(), id)
+	}
 	if err != nil {
 		h.logger.Error("api: list tracks failed", "err", err)
 		writeErr(w, http.StatusInternalServerError, "server_error", "lookup failed")