about to implement role->album permission check in thebackend