refactor(server, web): create shared link (#2879)

* refactor: shared links

* chore: open api

* fix: tsc error

server/src/domain/access/access.repository.ts

@@ -2,8 +2,11 @@ export const IAccessRepository = 'IAccessRepository';
 
 export interface IAccessRepository {
   hasPartnerAccess(userId: string, partnerId: string): Promise<boolean>;
+
   hasAlbumAssetAccess(userId: string, assetId: string): Promise<boolean>;
   hasOwnerAssetAccess(userId: string, assetId: string): Promise<boolean>;
   hasPartnerAssetAccess(userId: string, assetId: string): Promise<boolean>;
   hasSharedLinkAssetAccess(userId: string, assetId: string): Promise<boolean>;
+
+  hasAlbumOwnerAccess(userId: string, albumId: string): Promise<boolean>;
 }

server/src/domain/auth/auth.service.ts

@@ -13,7 +13,7 @@ import { IKeyRepository } from '../api-key';
 import { APIKeyCore } from '../api-key/api-key.core';
 import { ICryptoRepository } from '../crypto/crypto.repository';
 import { OAuthCore } from '../oauth/oauth.core';
-import { ISharedLinkRepository, SharedLinkCore } from '../shared-link';
+import { ISharedLinkRepository } from '../shared-link';
 import { INITIAL_SYSTEM_CONFIG, ISystemConfigRepository } from '../system-config';
 import { IUserRepository, UserCore } from '../user';
 import { IUserTokenRepository, UserTokenCore } from '../user-token';
@@ -35,7 +35,6 @@ export class AuthService {
   private authCore: AuthCore;
   private oauthCore: OAuthCore;
   private userCore: UserCore;
-  private shareCore: SharedLinkCore;
   private keyCore: APIKeyCore;
 
   private logger = new Logger(AuthService.name);
@@ -45,7 +44,7 @@ export class AuthService {
     @Inject(ISystemConfigRepository) configRepository: ISystemConfigRepository,
     @Inject(IUserRepository) userRepository: IUserRepository,
     @Inject(IUserTokenRepository) userTokenRepository: IUserTokenRepository,
-    @Inject(ISharedLinkRepository) shareRepository: ISharedLinkRepository,
+    @Inject(ISharedLinkRepository) private sharedLinkRepository: ISharedLinkRepository,
     @Inject(IKeyRepository) keyRepository: IKeyRepository,
     @Inject(INITIAL_SYSTEM_CONFIG)
     initialConfig: SystemConfig,
@@ -54,7 +53,6 @@ export class AuthService {
     this.authCore = new AuthCore(cryptoRepository, configRepository, userTokenRepository, initialConfig);
     this.oauthCore = new OAuthCore(configRepository, initialConfig);
     this.userCore = new UserCore(userRepository, cryptoRepository);
-    this.shareCore = new SharedLinkCore(shareRepository, cryptoRepository);
     this.keyCore = new APIKeyCore(cryptoRepository, keyRepository);
   }
 
@@ -147,7 +145,7 @@ export class AuthService {
     const apiKey = (headers[IMMICH_API_KEY_HEADER] || params.apiKey) as string;
 
     if (shareKey) {
-      return this.shareCore.validate(shareKey);
+      return this.validateSharedLink(shareKey);
     }
 
     if (userToken) {
@@ -193,4 +191,29 @@ export class AuthService {
     const cookies = cookieParser.parse(headers.cookie || '');
     return cookies[IMMICH_ACCESS_COOKIE] || null;
   }
+
+  async validateSharedLink(key: string | string[]): Promise<AuthUserDto | null> {
+    key = Array.isArray(key) ? key[0] : key;
+
+    const bytes = Buffer.from(key, key.length === 100 ? 'hex' : 'base64url');
+    const link = await this.sharedLinkRepository.getByKey(bytes);
+    if (link) {
+      if (!link.expiresAt || new Date(link.expiresAt) > new Date()) {
+        const user = link.user;
+        if (user) {
+          return {
+            id: user.id,
+            email: user.email,
+            isAdmin: user.isAdmin,
+            isPublicUser: true,
+            sharedLinkId: link.id,
+            isAllowUpload: link.allowUpload,
+            isAllowDownload: link.allowDownload,
+            isShowExif: link.showExif,
+          };
+        }
+      }
+    }
+    throw new UnauthorizedException('Invalid share key');
+  }
 }

server/src/domain/shared-link/dto/create-shared-link.dto.ts

@@ -1,12 +0,0 @@
-import { AlbumEntity, AssetEntity, SharedLinkType } from '@app/infra/entities';
-
-export class CreateSharedLinkDto {
-  description?: string;
-  expiresAt?: Date;
-  type!: SharedLinkType;
-  assets!: AssetEntity[];
-  album?: AlbumEntity;
-  allowUpload?: boolean;
-  allowDownload?: boolean;
-  showExif?: boolean;
-}

server/src/domain/shared-link/dto/edit-shared-link.dto.ts

@@ -1,18 +0,0 @@
-import { IsOptional } from 'class-validator';
-
-export class EditSharedLinkDto {
-  @IsOptional()
-  description?: string;
-
-  @IsOptional()
-  expiresAt?: Date | null;
-
-  @IsOptional()
-  allowUpload?: boolean;
-
-  @IsOptional()
-  allowDownload?: boolean;
-
-  @IsOptional()
-  showExif?: boolean;
-}

server/src/domain/shared-link/dto/index.ts

@@ -1,2 +0,0 @@
-export * from './create-shared-link.dto';
-export * from './edit-shared-link.dto';

server/src/domain/shared-link/index.ts

@@ -1,5 +1,4 @@
-export * from './dto';
-export * from './response-dto';
-export * from './shared-link.core';
+export * from './shared-link-response.dto';
+export * from './shared-link.dto';
 export * from './shared-link.repository';
 export * from './shared-link.service';

server/src/domain/shared-link/response-dto/index.ts

@@ -1 +0,0 @@
-export * from './shared-link-response.dto';

server/src/domain/shared-link/shared-link-response.dto.ts

@@ -1,12 +1,12 @@
 import { SharedLinkEntity, SharedLinkType } from '@app/infra/entities';
 import { ApiProperty } from '@nestjs/swagger';
 import _ from 'lodash';
-import { AlbumResponseDto, mapAlbumExcludeAssetInfo } from '../../album';
-import { AssetResponseDto, mapAsset, mapAssetWithoutExif } from '../../asset';
+import { AlbumResponseDto, mapAlbumExcludeAssetInfo } from '../album';
+import { AssetResponseDto, mapAsset, mapAssetWithoutExif } from '../asset';
 
 export class SharedLinkResponseDto {
   id!: string;
-  description?: string;
+  description!: string | null;
   userId!: string;
   key!: string;
 

server/src/domain/shared-link/shared-link.core.ts

@@ -1,80 +0,0 @@
-import { AssetEntity, SharedLinkEntity } from '@app/infra/entities';
-import { BadRequestException, ForbiddenException, Logger, UnauthorizedException } from '@nestjs/common';
-import { AuthUserDto } from '../auth';
-import { ICryptoRepository } from '../crypto';
-import { CreateSharedLinkDto } from './dto';
-import { ISharedLinkRepository } from './shared-link.repository';
-
-export class SharedLinkCore {
-  readonly logger = new Logger(SharedLinkCore.name);
-
-  constructor(private repository: ISharedLinkRepository, private cryptoRepository: ICryptoRepository) {}
-
-  // TODO: move to SharedLinkController/SharedLinkService
-  create(userId: string, dto: CreateSharedLinkDto): Promise<SharedLinkEntity> {
-    return this.repository.create({
-      key: Buffer.from(this.cryptoRepository.randomBytes(50)),
-      description: dto.description,
-      userId,
-      createdAt: new Date(),
-      expiresAt: dto.expiresAt ?? null,
-      type: dto.type,
-      assets: dto.assets,
-      album: dto.album,
-      allowUpload: dto.allowUpload ?? false,
-      allowDownload: dto.allowDownload ?? true,
-      showExif: dto.showExif ?? true,
-    });
-  }
-
-  async addAssets(userId: string, id: string, assets: AssetEntity[]) {
-    const link = await this.repository.get(userId, id);
-    if (!link) {
-      throw new BadRequestException('Shared link not found');
-    }
-
-    return this.repository.update({ ...link, assets: [...link.assets, ...assets] });
-  }
-
-  async removeAssets(userId: string, id: string, assets: AssetEntity[]) {
-    const link = await this.repository.get(userId, id);
-    if (!link) {
-      throw new BadRequestException('Shared link not found');
-    }
-
-    const newAssets = link.assets.filter((asset) => assets.find((a) => a.id === asset.id));
-
-    return this.repository.update({ ...link, assets: newAssets });
-  }
-
-  checkDownloadAccess(user: AuthUserDto) {
-    if (user.isPublicUser && !user.isAllowDownload) {
-      throw new ForbiddenException();
-    }
-  }
-
-  async validate(key: string | string[]): Promise<AuthUserDto | null> {
-    key = Array.isArray(key) ? key[0] : key;
-
-    const bytes = Buffer.from(key, key.length === 100 ? 'hex' : 'base64url');
-    const link = await this.repository.getByKey(bytes);
-    if (link) {
-      if (!link.expiresAt || new Date(link.expiresAt) > new Date()) {
-        const user = link.user;
-        if (user) {
-          return {
-            id: user.id,
-            email: user.email,
-            isAdmin: user.isAdmin,
-            isPublicUser: true,
-            sharedLinkId: link.id,
-            isAllowUpload: link.allowUpload,
-            isAllowDownload: link.allowDownload,
-            isShowExif: link.showExif,
-          };
-        }
-      }
-    }
-    throw new UnauthorizedException('Invalid share key');
-  }
-}

server/src/domain/shared-link/shared-link.dto.ts

@@ -0,0 +1,53 @@
+import { SharedLinkType } from '@app/infra/entities';
+import { ApiProperty } from '@nestjs/swagger';
+import { IsBoolean, IsDate, IsEnum, IsOptional, IsString } from 'class-validator';
+import { ValidateUUID } from '../../immich/decorators/validate-uuid.decorator';
+
+export class SharedLinkCreateDto {
+  @IsEnum(SharedLinkType)
+  @ApiProperty({ enum: SharedLinkType, enumName: 'SharedLinkType' })
+  type!: SharedLinkType;
+
+  @ValidateUUID({ each: true, optional: true })
+  assetIds?: string[];
+
+  @ValidateUUID({ optional: true })
+  albumId?: string;
+
+  @IsString()
+  @IsOptional()
+  description?: string;
+
+  @IsDate()
+  @IsOptional()
+  expiresAt?: Date | null = null;
+
+  @IsOptional()
+  @IsBoolean()
+  allowUpload?: boolean = false;
+
+  @IsOptional()
+  @IsBoolean()
+  allowDownload?: boolean = true;
+
+  @IsOptional()
+  @IsBoolean()
+  showExif?: boolean = true;
+}
+
+export class SharedLinkEditDto {
+  @IsOptional()
+  description?: string;
+
+  @IsOptional()
+  expiresAt?: Date | null;
+
+  @IsOptional()
+  allowUpload?: boolean;
+
+  @IsOptional()
+  allowDownload?: boolean;
+
+  @IsOptional()
+  showExif?: boolean;
+}

server/src/domain/shared-link/shared-link.repository.ts

@@ -6,7 +6,7 @@ export interface ISharedLinkRepository {
   getAll(userId: string): Promise<SharedLinkEntity[]>;
   get(userId: string, id: string): Promise<SharedLinkEntity | null>;
   getByKey(key: Buffer): Promise<SharedLinkEntity | null>;
-  create(entity: Omit<SharedLinkEntity, 'id' | 'user'>): Promise<SharedLinkEntity>;
+  create(entity: Partial<SharedLinkEntity>): Promise<SharedLinkEntity>;
   update(entity: Partial<SharedLinkEntity>): Promise<SharedLinkEntity>;
   remove(entity: SharedLinkEntity): Promise<void>;
 }

server/src/domain/shared-link/shared-link.service.spec.ts

@@ -1,16 +1,33 @@
 import { BadRequestException, ForbiddenException } from '@nestjs/common';
-import { authStub, newSharedLinkRepositoryMock, sharedLinkResponseStub, sharedLinkStub } from '@test';
+import {
+  albumStub,
+  assetEntityStub,
+  authStub,
+  newAccessRepositoryMock,
+  newCryptoRepositoryMock,
+  newSharedLinkRepositoryMock,
+  sharedLinkResponseStub,
+  sharedLinkStub,
+} from '@test';
+import { when } from 'jest-when';
+import _ from 'lodash';
+import { SharedLinkType } from '../../infra/entities/shared-link.entity';
+import { AssetIdErrorReason, IAccessRepository, ICryptoRepository } from '../index';
 import { ISharedLinkRepository } from './shared-link.repository';
 import { SharedLinkService } from './shared-link.service';
 
 describe(SharedLinkService.name, () => {
   let sut: SharedLinkService;
+  let accessMock: jest.Mocked<IAccessRepository>;
+  let cryptoMock: jest.Mocked<ICryptoRepository>;
   let shareMock: jest.Mocked<ISharedLinkRepository>;
 
   beforeEach(async () => {
+    accessMock = newAccessRepositoryMock();
+    cryptoMock = newCryptoRepositoryMock();
     shareMock = newSharedLinkRepositoryMock();
 
-    sut = new SharedLinkService(shareMock);
+    sut = new SharedLinkService(accessMock, cryptoMock, shareMock);
   });
 
   it('should work', () => {
@@ -64,6 +81,82 @@ describe(SharedLinkService.name, () => {
     });
   });
 
+  describe('create', () => {
+    it('should not allow an album shared link without an albumId', async () => {
+      await expect(sut.create(authStub.admin, { type: SharedLinkType.ALBUM, assetIds: [] })).rejects.toBeInstanceOf(
+        BadRequestException,
+      );
+    });
+
+    it('should not allow non-owners to create album shared links', async () => {
+      accessMock.hasAlbumOwnerAccess.mockResolvedValue(false);
+      await expect(
+        sut.create(authStub.admin, { type: SharedLinkType.ALBUM, assetIds: [], albumId: 'album-1' }),
+      ).rejects.toBeInstanceOf(BadRequestException);
+    });
+
+    it('should not allow individual shared links with no assets', async () => {
+      await expect(
+        sut.create(authStub.admin, { type: SharedLinkType.INDIVIDUAL, assetIds: [] }),
+      ).rejects.toBeInstanceOf(BadRequestException);
+    });
+
+    it('should require asset ownership to make an individual shared link', async () => {
+      accessMock.hasOwnerAssetAccess.mockResolvedValue(false);
+      await expect(
+        sut.create(authStub.admin, { type: SharedLinkType.INDIVIDUAL, assetIds: ['asset-1'] }),
+      ).rejects.toBeInstanceOf(BadRequestException);
+    });
+
+    it('should create an album shared link', async () => {
+      accessMock.hasAlbumOwnerAccess.mockResolvedValue(true);
+      shareMock.create.mockResolvedValue(sharedLinkStub.valid);
+
+      await sut.create(authStub.admin, { type: SharedLinkType.ALBUM, albumId: albumStub.oneAsset.id });
+
+      expect(accessMock.hasAlbumOwnerAccess).toHaveBeenCalledWith(authStub.admin.id, albumStub.oneAsset.id);
+      expect(shareMock.create).toHaveBeenCalledWith({
+        type: SharedLinkType.ALBUM,
+        userId: authStub.admin.id,
+        albumId: albumStub.oneAsset.id,
+        allowDownload: true,
+        allowUpload: true,
+        assets: [],
+        description: null,
+        expiresAt: null,
+        showExif: true,
+        key: Buffer.from('random-bytes', 'utf8'),
+      });
+    });
+
+    it('should create an individual shared link', async () => {
+      accessMock.hasOwnerAssetAccess.mockResolvedValue(true);
+      shareMock.create.mockResolvedValue(sharedLinkStub.individual);
+
+      await sut.create(authStub.admin, {
+        type: SharedLinkType.INDIVIDUAL,
+        assetIds: [assetEntityStub.image.id],
+        showExif: true,
+        allowDownload: true,
+        allowUpload: true,
+      });
+
+      expect(accessMock.hasOwnerAssetAccess).toHaveBeenCalledWith(authStub.admin.id, assetEntityStub.image.id);
+      expect(shareMock.create).toHaveBeenCalledWith({
+        type: SharedLinkType.INDIVIDUAL,
+        userId: authStub.admin.id,
+        albumId: null,
+        allowDownload: true,
+        allowUpload: true,
+        assets: [{ id: assetEntityStub.image.id }],
+        description: null,
+        expiresAt: null,
+        showExif: true,
+        key: Buffer.from('random-bytes', 'utf8'),
+      });
+    });
+  });
+
   describe('update', () => {
     it('should throw an error for an invalid shared link', async () => {
       shareMock.get.mockResolvedValue(null);
@@ -100,4 +193,58 @@ describe(SharedLinkService.name, () => {
       expect(shareMock.remove).toHaveBeenCalledWith(sharedLinkStub.valid);
     });
   });
+
+  describe('addAssets', () => {
+    it('should not work on album shared links', async () => {
+      shareMock.get.mockResolvedValue(sharedLinkStub.valid);
+      await expect(sut.addAssets(authStub.admin, 'link-1', { assetIds: ['asset-1'] })).rejects.toBeInstanceOf(
+        BadRequestException,
+      );
+    });
+
+    it('should add assets to a shared link', async () => {
+      shareMock.get.mockResolvedValue(_.cloneDeep(sharedLinkStub.individual));
+      shareMock.create.mockResolvedValue(sharedLinkStub.individual);
+
+      when(accessMock.hasOwnerAssetAccess).calledWith(authStub.admin.id, 'asset-2').mockResolvedValue(false);
+      when(accessMock.hasOwnerAssetAccess).calledWith(authStub.admin.id, 'asset-3').mockResolvedValue(true);
+
+      await expect(
+        sut.addAssets(authStub.admin, 'link-1', { assetIds: [assetEntityStub.image.id, 'asset-2', 'asset-3'] }),
+      ).resolves.toEqual([
+        { assetId: assetEntityStub.image.id, success: false, error: AssetIdErrorReason.DUPLICATE },
+        { assetId: 'asset-2', success: false, error: AssetIdErrorReason.NO_PERMISSION },
+        { assetId: 'asset-3', success: true },
+      ]);
+
+      expect(accessMock.hasOwnerAssetAccess).toHaveBeenCalledTimes(2);
+      expect(shareMock.update).toHaveBeenCalledWith({
+        ...sharedLinkStub.individual,
+        assets: [assetEntityStub.image, { id: 'asset-3' }],
+      });
+    });
+  });
+
+  describe('removeAssets', () => {
+    it('should not work on album shared links', async () => {
+      shareMock.get.mockResolvedValue(sharedLinkStub.valid);
+      await expect(sut.removeAssets(authStub.admin, 'link-1', { assetIds: ['asset-1'] })).rejects.toBeInstanceOf(
+        BadRequestException,
+      );
+    });
+
+    it('should remove assets from a shared link', async () => {
+      shareMock.get.mockResolvedValue(_.cloneDeep(sharedLinkStub.individual));
+      shareMock.create.mockResolvedValue(sharedLinkStub.individual);
+
+      await expect(
+        sut.removeAssets(authStub.admin, 'link-1', { assetIds: [assetEntityStub.image.id, 'asset-2'] }),
+      ).resolves.toEqual([
+        { assetId: assetEntityStub.image.id, success: true },
+        { assetId: 'asset-2', success: false, error: AssetIdErrorReason.NOT_FOUND },
+      ]);
+
+      expect(shareMock.update).toHaveBeenCalledWith({ ...sharedLinkStub.individual, assets: [] });
+    });
+  });
 });

server/src/domain/shared-link/shared-link.service.ts

@@ -1,15 +1,22 @@
-import { SharedLinkEntity } from '@app/infra/entities';
+import { AssetEntity, SharedLinkEntity, SharedLinkType } from '@app/infra/entities';
 import { BadRequestException, ForbiddenException, Inject, Injectable } from '@nestjs/common';
+import { IAccessRepository } from '../access';
+import { AssetIdErrorReason, AssetIdsDto, AssetIdsResponseDto } from '../asset';
 import { AuthUserDto } from '../auth';
-import { EditSharedLinkDto } from './dto';
-import { mapSharedLink, mapSharedLinkWithNoExif, SharedLinkResponseDto } from './response-dto';
+import { ICryptoRepository } from '../crypto';
+import { mapSharedLink, mapSharedLinkWithNoExif, SharedLinkResponseDto } from './shared-link-response.dto';
+import { SharedLinkCreateDto, SharedLinkEditDto } from './shared-link.dto';
 import { ISharedLinkRepository } from './shared-link.repository';
 
 @Injectable()
 export class SharedLinkService {
-  constructor(@Inject(ISharedLinkRepository) private repository: ISharedLinkRepository) {}
+  constructor(
+    @Inject(IAccessRepository) private accessRepository: IAccessRepository,
+    @Inject(ICryptoRepository) private cryptoRepository: ICryptoRepository,
+    @Inject(ISharedLinkRepository) private repository: ISharedLinkRepository,
+  ) {}
 
-  async getAll(authUser: AuthUserDto): Promise<SharedLinkResponseDto[]> {
+  getAll(authUser: AuthUserDto): Promise<SharedLinkResponseDto[]> {
     return this.repository.getAll(authUser.id).then((links) => links.map(mapSharedLink));
   }
 
@@ -30,7 +37,52 @@ export class SharedLinkService {
     return this.map(sharedLink, { withExif: true });
   }
 
-  async update(authUser: AuthUserDto, id: string, dto: EditSharedLinkDto) {
+  async create(authUser: AuthUserDto, dto: SharedLinkCreateDto): Promise<SharedLinkResponseDto> {
+    switch (dto.type) {
+      case SharedLinkType.ALBUM:
+        if (!dto.albumId) {
+          throw new BadRequestException('Invalid albumId');
+        }
+
+        const isAlbumOwner = await this.accessRepository.hasAlbumOwnerAccess(authUser.id, dto.albumId);
+        if (!isAlbumOwner) {
+          throw new BadRequestException('Invalid albumId');
+        }
+
+        break;
+
+      case SharedLinkType.INDIVIDUAL:
+        if (!dto.assetIds || dto.assetIds.length === 0) {
+          throw new BadRequestException('Invalid assetIds');
+        }
+
+        for (const assetId of dto.assetIds) {
+          const hasAccess = await this.accessRepository.hasOwnerAssetAccess(authUser.id, assetId);
+          if (!hasAccess) {
+            throw new BadRequestException(`No access to assetId: ${assetId}`);
+          }
+        }
+
+        break;
+    }
+
+    const sharedLink = await this.repository.create({
+      key: this.cryptoRepository.randomBytes(50),
+      userId: authUser.id,
+      type: dto.type,
+      albumId: dto.albumId || null,
+      assets: (dto.assetIds || []).map((id) => ({ id } as AssetEntity)),
+      description: dto.description || null,
+      expiresAt: dto.expiresAt || null,
+      allowUpload: dto.allowUpload ?? true,
+      allowDownload: dto.allowDownload ?? true,
+      showExif: dto.showExif ?? true,
+    });
+
+    return this.map(sharedLink, { withExif: true });
+  }
+
+  async update(authUser: AuthUserDto, id: string, dto: SharedLinkEditDto) {
     await this.findOrFail(authUser, id);
     const sharedLink = await this.repository.update({
       id,
@@ -57,6 +109,60 @@ export class SharedLinkService {
     return sharedLink;
   }
 
+  async addAssets(authUser: AuthUserDto, id: string, dto: AssetIdsDto): Promise<AssetIdsResponseDto[]> {
+    const sharedLink = await this.findOrFail(authUser, id);
+
+    if (sharedLink.type !== SharedLinkType.INDIVIDUAL) {
+      throw new BadRequestException('Invalid shared link type');
+    }
+
+    const results: AssetIdsResponseDto[] = [];
+    for (const assetId of dto.assetIds) {
+      const hasAsset = sharedLink.assets.find((asset) => asset.id === assetId);
+      if (hasAsset) {
+        results.push({ assetId, success: false, error: AssetIdErrorReason.DUPLICATE });
+        continue;
+      }
+
+      const hasAccess = await this.accessRepository.hasOwnerAssetAccess(authUser.id, assetId);
+      if (!hasAccess) {
+        results.push({ assetId, success: false, error: AssetIdErrorReason.NO_PERMISSION });
+        continue;
+      }
+
+      results.push({ assetId, success: true });
+      sharedLink.assets.push({ id: assetId } as AssetEntity);
+    }
+
+    await this.repository.update(sharedLink);
+
+    return results;
+  }
+
+  async removeAssets(authUser: AuthUserDto, id: string, dto: AssetIdsDto): Promise<AssetIdsResponseDto[]> {
+    const sharedLink = await this.findOrFail(authUser, id);
+
+    if (sharedLink.type !== SharedLinkType.INDIVIDUAL) {
+      throw new BadRequestException('Invalid shared link type');
+    }
+
+    const results: AssetIdsResponseDto[] = [];
+    for (const assetId of dto.assetIds) {
+      const hasAsset = sharedLink.assets.find((asset) => asset.id === assetId);
+      if (!hasAsset) {
+        results.push({ assetId, success: false, error: AssetIdErrorReason.NOT_FOUND });
+        continue;
+      }
+
+      results.push({ assetId, success: true });
+      sharedLink.assets = sharedLink.assets.filter((asset) => asset.id !== assetId);
+    }
+
+    await this.repository.update(sharedLink);
+
+    return results;
+  }
+
   private map(sharedLink: SharedLinkEntity, { withExif }: { withExif: boolean }) {
     return withExif ? mapSharedLink(sharedLink) : mapSharedLinkWithNoExif(sharedLink);
   }