refactor: move business logic out of presentation — ReadAssetFile, checksum, auth checks, MetadataValue conversions

crates/application/src/organization/commands/manage_album_entries.rs

@@ -32,6 +32,10 @@ impl ManageAlbumEntriesHandler {
             .await?
             .ok_or_else(|| DomainError::NotFound(format!("Album {} not found", cmd.album_id)))?;
 
+        if album.creator_user_id != cmd.user_id {
+            return Err(DomainError::Forbidden("Access denied".to_string()));
+        }
+
         match cmd.action {
             AlbumAction::Add { asset_id } => album.add_asset(asset_id, cmd.user_id)?,
             AlbumAction::Remove { asset_id } => album.remove_asset(&asset_id)?,

crates/application/src/organization/queries/get_album.rs

@@ -6,6 +6,7 @@ use std::sync::Arc;
 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
 pub struct GetAlbumQuery {
     pub album_id: SystemId,
+    pub user_id: SystemId,
 }
 
 pub struct GetAlbumHandler {
@@ -18,9 +19,16 @@ impl GetAlbumHandler {
     }
 
     pub async fn execute(&self, query: GetAlbumQuery) -> Result<Album, DomainError> {
-        self.album_repo
+        let album = self
+            .album_repo
             .find_by_id(&query.album_id)
             .await?
-            .ok_or_else(|| DomainError::NotFound(format!("Album {} not found", query.album_id)))
+            .ok_or_else(|| DomainError::NotFound(format!("Album {} not found", query.album_id)))?;
+
+        if album.creator_user_id != query.user_id {
+            return Err(DomainError::Forbidden("Access denied".to_string()));
+        }
+
+        Ok(album)
     }
 }