Update main.py

main.py

@@ -181,11 +181,15 @@ async def download_file(access_code: str):
         raise HTTPException(status_code=500, detail=str(e))
 
 @app.delete("/delete/{access_code}")
-async def delete_file(access_code: str):
+async def delete_file(access_code: str, user_id: str = None):
     try:
         if access_code not in file_codes:
             raise HTTPException(status_code=404, detail="Invalid access code")
         
+        # Check if user owns the file
+        if user_id and file_codes[access_code]["user_id"] != user_id:
+            raise HTTPException(status_code=403, detail="You don't have permission to delete this file")
+        
         filename = file_codes[access_code]["filename"]
         file_path = os.path.join(UPLOAD_DIR, filename)