not everything needs to be a nostr app, but if i can make this work, why not?

for my next vibe coded nostr app idea i want to make a photo and video display app for my grandmother's funeral wake tomorrow. can this be done on nostr in a private manner? if not, i won't do it and will go the traditional route.

i want all family members to upload photos and videos to my blossom server and then at any given time, the application will play a slideshow of photos and videos that exist / have been uploaded from any user if a logged in users clicks play. i guess then we could have logged in users comment / react to photos and videos.

users won't have have nostr keys and will need profiles generated for each uploader.

i guess in theory i could have the events published to a brand new relay that only allows authenticated users to read from it? it could be part of the app package.

maybe i could give family members a password to login to rossfamilyphotowebsite.com. once authenticated with the password, any pubkey generated would then be whitelisted via blossom and the relay for read and write access.

the authenticated or whitelisted pubkeys, how to get them? they could be written to a local database, but how to get them from that database into an auth file that strfry can read? if im doing auth for reading from the relay, i guess i could also do this with the blossom server too. same question. how to get them from the db to blossom

a hack would be to run a db export every time new keys are written to the auth table via a db trigger. im sure a better real dev way exists here, but this is my hacky sysadmin brain working.

hmm. would all of this work then? if you don't auth with a whitelisted key you can't read the event or the uploaded images/videos.

but the final remaining question, can you re-broadcast without authenticating? that's what im not sure about and need answered from experts. maybe ill DM dad and ask him.

i guess that wouldn't matter if you can't download the image? the events would just be a link to a blossom file that non-family members can read. who cares if you can't performat a GET on it without authenticated?

thoughts? :)