Media

Media endpoints allow reordering and deletion of images/documents attached to lots and auctions. Ownership is strictly enforced.

SPA / browser sessions: Users authenticated via browser session (cookie) are also permitted for media endpoints without a Sanctum token — no ability check is applied. This supports the admin UI and seller upload screens.

Ownership rules

The MediaController enforces the following rules before allowing reorder or delete:

Media attached to	Who can manage
Lot	Seller who owns the lot, or the auction owner, or any admin
Auction (team-owned)	Any member of the owning team, or any admin
Auction (user-owned)	The owning user, or any admin

Attempting to manage media you do not own returns 403 with code media_not_owned.

POST /api/media/reorder write ability (or session)

Reorders media items. Pass the desired order as an array of media IDs. All IDs must belong to the same lot/auction, and you must own that lot/auction.

Request body

Field	Type	Required	Description
media_ids	array of integers	Yes	Media IDs in the desired display order

Example

curl -X POST "https://bidyear.com/api/media/reorder" \
  -H "Authorization: Bearer {token}" \
  -H "Content-Type: application/json" \
  -d '{"media_ids": [34, 31, 38, 29]}'

Response 200

{ "success": true, "message": "Media reordered" }

DELETE /api/media/{media} write ability (or session)

Deletes a media item. The media file is removed from storage. Ownership is verified before deletion.

Path parameters

Param	Type	Description
media	integer	Media ID (Spatie Media Library record)

Example

curl -X DELETE "https://bidyear.com/api/media/34" \
  -H "Authorization: Bearer {token}"

Response 200

{ "success": true, "message": "Media deleted" }

Error responses

HTTP	code	Cause
403	media_not_owned	Caller does not own the lot/auction this media is attached to
404	—	Media ID not found