Merge branch 'main' into iqs8-patch-1

app/controllers/playlists_controller.rb

@@ -40,6 +40,7 @@ def remove_song
 
   private
 
+  #Validate playlist belongs to user and Song belongs to user, or is public
   def set_playlist_and_song
     @playlist = current_user.playlists.find_by(id: params[:id])
     @song = current_user.songs.find_by(id: params[:song_id]) || Song.where(privacy: 'public').find_by(id: params[:song_id])

app/controllers/songs_controller.rb

@@ -3,12 +3,24 @@
 class SongsController < ApplicationController
   before_action :authenticate_user!
 
-  # GET /songs
+  # GET /songs (all of the current user's songs)
   def index
     @songs = current_user.songs
     render json: @songs
   end
 
+  # GET /songs/# (get a single song)
+  def show
+    @song = current_user.songs.find_by(id: params[:id]) || Song.where(privacy: 'public').find_by(id: params[:id])
+
+    if @song.nil?
+      render json: { error: 'Song does not exist or is private/owned by someone else' }, status: :not_found 
+      return
+    end
+
+    render json: @song, status: :ok
+  end
+
   # POST /songs
   def create
     @song = current_user.songs.build(song_params)

config/routes.rb

@@ -20,7 +20,7 @@
     end
   end
 
-  resources :songs, only: %i[index create]
+  resources :songs
 
   get 'up' => 'rails/health#show', as: :rails_health_check
 end