The app serves users and some admins. For every user, there will be a video associated which only the user himself or the admin can view. All the other videos are not accessible by a regular user.
How can I do this?
Placing the videos in some public directory seems impossible, as they would be accessible freely even if I somehow construct the URL.
The only reasonable way to do this(?) seems to me that the request needs to be routed through express, and streamed to the client after some logic evaluates if she can see the video.