You could store the permissions that each user has in the database. Then on a protected page you would want to have a query that checks which files users have permission to download and then display links for the user to download them. This however wouldn't prevent the user from trying random links to download the other files that are in the directory.