Add a persistent clip library with folders, optional password, and hidden-thumbnail glow.

Generated videos save into a chosen folder, sensitive clips skip thumbnails until played, and Docker writes the catalog to a Coolify volume.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/api/generate.post.ts

@@ -34,9 +34,31 @@ export default defineEventHandler(async (event) => {
     ? Number(fields.seed)
     : Math.floor(Math.random() * 2_147_483_647)
   const length = frameLength(Number(fields.duration || 5))
+  const hideThumbnail = fields.hideThumbnail === 'true'
+  assertLibraryAccess(event)
+  const library = publicLibrary(event)
+  const folderId = library.folders.some(folder => folder.id === fields.folderId)
+    ? fields.folderId
+    : library.folders[0]?.id
+  if (!folderId) {
+    throw createError({ statusCode: 400, statusMessage: 'Create a library folder before generating' })
+  }
 
   const job = createJob()
   job.maxStep = steps
+  job.hideThumbnail = hideThumbnail
+  job.library = {
+    folderId,
+    hideThumbnail,
+    prompt,
+    aspect: fields.aspect || 'auto',
+    width,
+    height,
+    steps,
+    turbo,
+    seed,
+    thumb: image.data
+  }
   emitJob(job, { type: 'status', message: 'Uploading image...', progress: 2 })
 
   void runGeneration(job, { prompt, image, width, height, steps, seed, turbo, length }).catch((error) => {
@@ -54,7 +76,9 @@ export default defineEventHandler(async (event) => {
     height,
     aspect: fields.aspect || 'auto',
     steps,
-    turbo
+    turbo,
+    folderId,
+    hideThumbnail
   }
 })
 

server/api/library/clips/[id].delete.ts

@@ -0,0 +1,6 @@
+export default defineEventHandler(async (event) => {
+  assertLibraryAccess(event)
+  const id = getRouterParam(event, 'id')
+  await deleteClip(String(id))
+  return { ok: true }
+})

server/api/library/clips/[id]/thumb.get.ts

@@ -0,0 +1,19 @@
+import { existsSync, readFileSync } from 'node:fs'
+
+export default defineEventHandler((event) => {
+  assertLibraryAccess(event)
+  const id = String(getRouterParam(event, 'id') || '')
+  const clip = getClip(id)
+  if (clip.hideThumbnail) {
+    throw createError({ statusCode: 404, statusMessage: 'Thumbnail hidden' })
+  }
+  const path = clipThumbPath(clip.id)
+  if (!existsSync(path)) {
+    throw createError({ statusCode: 404, statusMessage: 'Thumbnail not found' })
+  }
+  const buf = readFileSync(path)
+  const png = buf[0] === 0x89 && buf[1] === 0x50
+  setHeader(event, 'Content-Type', png ? 'image/png' : 'image/jpeg')
+  setHeader(event, 'Cache-Control', 'private, max-age=3600')
+  return buf
+})

server/api/library/clips/[id]/video.get.ts

@@ -0,0 +1,15 @@
+import { existsSync, readFileSync } from 'node:fs'
+
+export default defineEventHandler((event) => {
+  assertLibraryAccess(event)
+  const id = String(getRouterParam(event, 'id') || '')
+  const clip = getClip(id)
+  const path = clipVideoPath(clip.id)
+  if (!existsSync(path)) {
+    throw createError({ statusCode: 404, statusMessage: 'Video file is missing' })
+  }
+  setHeader(event, 'Content-Type', 'video/mp4')
+  setHeader(event, 'Content-Disposition', `inline; filename="${clip.id}.mp4"`)
+  setHeader(event, 'Cache-Control', 'private, max-age=3600')
+  return readFileSync(path)
+})

server/api/library/folders.post.ts

@@ -0,0 +1,6 @@
+export default defineEventHandler(async (event) => {
+  assertLibraryAccess(event)
+  const body = await readBody<{ name?: string }>(event)
+  const folder = await createFolder(String(body?.name || ''))
+  return folder
+})

server/api/library/folders/[id].delete.ts

@@ -0,0 +1,5 @@
+export default defineEventHandler(async (event) => {
+  assertLibraryAccess(event)
+  const id = getRouterParam(event, 'id')
+  return await deleteFolder(String(id))
+})

server/api/library/folders/[id].patch.ts

@@ -0,0 +1,6 @@
+export default defineEventHandler(async (event) => {
+  assertLibraryAccess(event)
+  const id = getRouterParam(event, 'id')
+  const body = await readBody<{ name?: string }>(event)
+  return await renameFolder(String(id), String(body?.name || ''))
+})

server/api/library/index.get.ts

@@ -0,0 +1,3 @@
+export default defineEventHandler((event) => {
+  return publicLibrary(event)
+})

server/api/library/lock.post.ts

@@ -0,0 +1,4 @@
+export default defineEventHandler((event) => {
+  clearLibraryUnlock(event)
+  return publicLibrary(event)
+})

server/api/library/password.put.ts

@@ -0,0 +1,14 @@
+export default defineEventHandler(async (event) => {
+  const body = await readBody<{ password?: string; currentPassword?: string }>(event)
+  if (isLibraryLocked() && !(await verifyLibraryPassword(String(body?.currentPassword || '')))) {
+    throw createError({ statusCode: 401, statusMessage: 'Current library password is incorrect' })
+  }
+  const next = String(body?.password || '').trim()
+  if (next && next.length < 4) {
+    throw createError({ statusCode: 400, statusMessage: 'Use at least 4 characters, or leave blank to remove the password' })
+  }
+  const version = await setLibraryPassword(next || null)
+  if (next) setLibraryUnlock(event, version)
+  else clearLibraryUnlock(event)
+  return publicLibrary(event)
+})

server/api/library/unlock.post.ts

@@ -0,0 +1,12 @@
+export default defineEventHandler(async (event) => {
+  const body = await readBody<{ password?: string }>(event)
+  const password = String(body?.password || '')
+  if (!password) {
+    throw createError({ statusCode: 400, statusMessage: 'Password is required' })
+  }
+  if (!(await verifyLibraryPassword(password))) {
+    throw createError({ statusCode: 401, statusMessage: 'Incorrect library password' })
+  }
+  setLibraryUnlock(event, currentPasswordVersion())
+  return publicLibrary(event)
+})