Restricting access to files with Roda and Rodauth

[i-h8-github]

Hello,

What is the preferred approach to restricting access to (certain) files to a logged-in user? I can't seem to quite figure out how this should work with Roda and Rodauth. Given "public/file.pdf", my instinct was to try something like this:

r.is "file.pdf" do
  rodauth.require_authentication
  pass
end

r.public

but that skips the authentication requirement (tangentially, what use case was the :pass plugin designed for?).

Is there a preferred approach to this? Or am I just missing something obvious?

[jeremyevans]

You should have a separate directory for files that require authentication, and then you can use the multi_public plugin to only serve those files after authentication: https://roda.jeremyevans.net/rdoc/classes/Roda/RodaPlugins/MultiPublic.html

[i-h8-github]

Thank you, that was indeed very simple.