Initial commit: Aurora Moments self-hosted photo/video sharing platform

Django/DRF + PostgreSQL/Redis/Celery backend with accounts, library,
moments, and notifications apps; React/TypeScript/Vite frontend with
Instagram-style sidebar nav, feed, profiles, nested comment replies,
notifications, and photo/video upload with ffmpeg-generated posters.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

api/apps/library/views.py

@@ -0,0 +1,67 @@
+from rest_framework import permissions, viewsets
+from rest_framework.exceptions import PermissionDenied
+
+from .models import Album, AlbumCollaborator, AlbumItem, LibraryItem
+from .permissions import IsOwner
+from .serializers import AlbumCollaboratorSerializer, AlbumItemSerializer, AlbumSerializer, LibraryItemSerializer
+from .tasks import process_library_item
+
+
+class LibraryItemViewSet(viewsets.ModelViewSet):
+    serializer_class = LibraryItemSerializer
+    permission_classes = [permissions.IsAuthenticated, IsOwner]
+
+    def get_queryset(self):
+        return LibraryItem.objects.filter(owner=self.request.user)
+
+    def perform_create(self, serializer):
+        item = serializer.save()
+        process_library_item.delay(str(item.id))
+
+
+class AlbumViewSet(viewsets.ModelViewSet):
+    serializer_class = AlbumSerializer
+    permission_classes = [permissions.IsAuthenticated, IsOwner]
+
+    def get_queryset(self):
+        return Album.objects.filter(owner=self.request.user).prefetch_related("items", "collaborators")
+
+    def perform_create(self, serializer):
+        serializer.save(owner=self.request.user)
+
+
+class AlbumItemViewSet(viewsets.ModelViewSet):
+    serializer_class = AlbumItemSerializer
+    permission_classes = [permissions.IsAuthenticated]
+    http_method_names = ["get", "post", "delete", "head", "options"]
+
+    def _get_album(self):
+        album = Album.objects.get(pk=self.kwargs["album_pk"])
+        allowed = album.owner_id == self.request.user.id or album.collaborators.filter(
+            user=self.request.user, role=AlbumCollaborator.Role.CONTRIBUTOR, status=AlbumCollaborator.Status.ACCEPTED
+        ).exists()
+        if not allowed:
+            raise PermissionDenied("Not a contributor on this album.")
+        return album
+
+    def get_queryset(self):
+        return AlbumItem.objects.filter(album=self._get_album())
+
+    def perform_create(self, serializer):
+        serializer.save(album=self._get_album(), added_by=self.request.user)
+
+
+class AlbumCollaboratorViewSet(viewsets.ModelViewSet):
+    serializer_class = AlbumCollaboratorSerializer
+    permission_classes = [permissions.IsAuthenticated]
+    http_method_names = ["get", "post", "delete", "head", "options"]
+
+    def _get_album(self):
+        album = Album.objects.get(pk=self.kwargs["album_pk"], owner=self.request.user)
+        return album
+
+    def get_queryset(self):
+        return AlbumCollaborator.objects.filter(album=self._get_album())
+
+    def perform_create(self, serializer):
+        serializer.save(album=self._get_album(), invited_by=self.request.user)