Database structure and query building

Question

Please advise how to accomplish this task.

There is an entity - the user. He can create a group in which there will be other users with certain rights.

Here I'm interested in how to correctly cost requests to get groups for the user and guest.

I assume that the group will have corresponding fields for which I will make a selection, but I don’t really understand how to properly store the role of the guest in this group. I have one idea, but I'm not sure if it's ok.

interface Group {
  id: string;
  ownerId: string;
  guestsId: string[];
  // or my idea :)
  guests: Array<{
    guestId: string;
    role: string;
  }>
}

Perhaps you need to create another table for this? I am using relational db

Same way. Question number 2. Each user has a photo, and each group has pictures.

I need to restrict access to pictures (getting will be through api with middleware, not static) for different users.

1. Pictures in a group can only be viewed by its members.
2. A user's photo can be seen if you are in the same group with him.

I don't have many ideas here. I see the problem that in order to get a picture, you need to check which groups the user who requested the picture belongs to.

All that came to mind is when generating a jwt token, get a list of user groups and add them to this token. But I'm not sure.

I would appreciate your ideas and advice.