Load a Real EPUB

Task

Connect the Reader route to the selected Book and obtain a usable private EPUB URL.

The browser should receive only what it needs to render the book.

A server route can verify ownership before returning a short-lived signed URL:

const book = await prisma.book.findFirst({
  where: {
    id: bookId,
    userId: user.id,
  },
});

if (!book) {
  return Response.json({ error: "Book not found" }, { status: 404 });
}

Generate a signed URL using the storage provider’s S3-compatible signing support.

Pass that URL into the client Reader.

When the Book changes, destroy the previous EPUB instance before initializing the next one.

Test

Open two books owned by the same account.

Then try a Book ID belonging to another account.

Expected:

• owned books render
• switching books does not leave the previous EPUB mounted
• another user’s book is unavailable

Checkpoint

The Reader loads a real private EPUB only after the server verifies Book ownership.