feat: show publicTrackData if track is visible but you are not author, change /api/tracks/:slug/TrackData to .../data

src/models/Track.js

@@ -53,6 +53,10 @@ class Track extends mongoose.Model {
     return false;
   }
 
+  isVisibleToPrivate(user) {
+    return user._id.equals(this.author._id);
+  }
+
   /**
    * Fills the trackData and publicTrackData with references to correct
    * TrackData objects.  For now, this is either the same, or publicTrackData

src/routes/api/tracks.js

@@ -414,14 +414,22 @@ router.delete(
 
 // return an track's trackData
 router.get(
-  '/:track/TrackData',
+  '/:track/data',
   auth.optional,
   wrapRoute(async (req, res) => {
     if (!req.track.isVisibleTo(req.user)) {
       return res.sendStatus(403);
     }
 
-    const trackData = await TrackData.findById(req.track.trackData);
+    let trackData;
+
+    if (req.track.isVisibleToPrivate(req.user)) {
+      trackData = await TrackData.findById(req.track.trackData);
+    } else if (!req.track.publicTrackData) {
+      return res.sendStatus(403);
+    } else {
+      trackData = await TrackData.findById(req.track.publicTrackData);
+    }
 
     return res.json({ trackData });
   }),