Add per-user library settings, folder passwords, and a still picker.

Settings manages folders, thumbnail defaults, and passwords for the signed-in account, and choosing an image now browses saved stills instead of only the desktop file dialog.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/api/generate.post.ts

@@ -35,7 +35,7 @@ export default defineEventHandler(async (event) => {
     : Math.floor(Math.random() * 2_147_483_647)
   const length = frameLength(Number(fields.duration || 5))
   const hideThumbnail = fields.hideThumbnail === 'true'
-  assertLibraryAccess(event)
+  const ownerKey = libraryOwnerKey(event)
   const library = publicLibrary(event)
   const folderId = library.folders.some(folder => folder.id === fields.folderId)
     ? fields.folderId
@@ -43,11 +43,21 @@ export default defineEventHandler(async (event) => {
   if (!folderId) {
     throw createError({ statusCode: 400, statusMessage: 'Create a library folder before generating' })
   }
+  assertFolderAccess(event, folderId)
+  await saveStill({
+    ownerKey,
+    folderId,
+    filename: image.filename,
+    data: image.data,
+    width,
+    height
+  })
 
   const job = createJob()
   job.maxStep = steps
   job.hideThumbnail = hideThumbnail
   job.library = {
+    ownerKey,
     folderId,
     hideThumbnail,
     prompt,

server/api/library/clips/[id].delete.ts

@@ -1,6 +1,8 @@
 export default defineEventHandler(async (event) => {
-  assertLibraryAccess(event)
-  const id = getRouterParam(event, 'id')
-  await deleteClip(String(id))
+  const { owner } = assertLibraryOwner(event)
+  const id = String(getRouterParam(event, 'id') || '')
+  const clip = getClip(owner, id)
+  assertFolderAccess(event, clip.folderId)
+  await deleteClip(owner, id)
   return { ok: true }
 })

server/api/library/clips/[id]/thumb.get.ts

@@ -1,19 +1,19 @@
 import { existsSync, readFileSync } from 'node:fs'
 
 export default defineEventHandler((event) => {
-  assertLibraryAccess(event)
+  const { owner } = assertLibraryOwner(event)
   const id = String(getRouterParam(event, 'id') || '')
-  const clip = getClip(id)
+  const clip = getClip(owner, id)
+  assertFolderAccess(event, clip.folderId)
   if (clip.hideThumbnail) {
     throw createError({ statusCode: 404, statusMessage: 'Thumbnail hidden' })
   }
-  const path = clipThumbPath(clip.id)
+  const path = clipThumbPath(owner, clip.id)
   if (!existsSync(path)) {
     throw createError({ statusCode: 404, statusMessage: 'Thumbnail not found' })
   }
   const buf = readFileSync(path)
-  const png = buf[0] === 0x89 && buf[1] === 0x50
-  setHeader(event, 'Content-Type', png ? 'image/png' : 'image/jpeg')
+  setHeader(event, 'Content-Type', imageContentType(buf))
   setHeader(event, 'Cache-Control', 'private, max-age=3600')
   return buf
 })

server/api/library/clips/[id]/video.get.ts

@@ -1,10 +1,11 @@
 import { existsSync, readFileSync } from 'node:fs'
 
 export default defineEventHandler((event) => {
-  assertLibraryAccess(event)
+  const { owner } = assertLibraryOwner(event)
   const id = String(getRouterParam(event, 'id') || '')
-  const clip = getClip(id)
-  const path = clipVideoPath(clip.id)
+  const clip = getClip(owner, id)
+  assertFolderAccess(event, clip.folderId)
+  const path = clipVideoPath(owner, clip.id)
   if (!existsSync(path)) {
     throw createError({ statusCode: 404, statusMessage: 'Video file is missing' })
   }

server/api/library/folders.post.ts

@@ -1,6 +1,6 @@
 export default defineEventHandler(async (event) => {
-  assertLibraryAccess(event)
+  const { owner } = assertLibraryOwner(event)
   const body = await readBody<{ name?: string }>(event)
-  const folder = await createFolder(String(body?.name || ''))
-  return folder
+  const folder = await createFolder(owner, String(body?.name || ''))
+  return publicFolder(event, folder)
 })

server/api/library/folders/[id].delete.ts

@@ -1,5 +1,7 @@
 export default defineEventHandler(async (event) => {
-  assertLibraryAccess(event)
-  const id = getRouterParam(event, 'id')
-  return await deleteFolder(String(id))
+  const { owner } = assertLibraryOwner(event)
+  const id = String(getRouterParam(event, 'id') || '')
+  const result = await deleteFolder(owner, id)
+  clearFolderUnlock(event, id)
+  return { ...result, ...publicLibrary(event) }
 })

server/api/library/folders/[id].patch.ts

@@ -1,6 +1,22 @@
 export default defineEventHandler(async (event) => {
-  assertLibraryAccess(event)
-  const id = getRouterParam(event, 'id')
-  const body = await readBody<{ name?: string }>(event)
-  return await renameFolder(String(id), String(body?.name || ''))
+  const { owner } = assertLibraryOwner(event)
+  const id = String(getRouterParam(event, 'id') || '')
+  const body = await readBody<{
+    name?: string
+    thumbnailDefault?: boolean
+    password?: string | null
+    currentPassword?: string
+  }>(event)
+  const folder = await updateFolder(owner, id, {
+    name: body?.name,
+    thumbnailDefault: body?.thumbnailDefault,
+    password: body?.password,
+    currentPassword: body?.currentPassword
+  })
+  if (body?.password) {
+    setFolderUnlock(event, folder.id, passwordVersion(folder.passwordHash))
+  } else if (body?.password === '') {
+    clearFolderUnlock(event, folder.id)
+  }
+  return publicLibrary(event)
 })

server/api/library/lock.post.ts

@@ -1,4 +1,5 @@
-export default defineEventHandler((event) => {
-  clearLibraryUnlock(event)
+export default defineEventHandler(async (event) => {
+  const body = await readBody<{ folderId?: string }>(event).catch(() => ({} as { folderId?: string }))
+  clearFolderUnlock(event, body?.folderId)
   return publicLibrary(event)
 })

server/api/library/password.put.ts

@@ -1,14 +1,19 @@
 export default defineEventHandler(async (event) => {
-  const body = await readBody<{ password?: string; currentPassword?: string }>(event)
-  if (isLibraryLocked() && !(await verifyLibraryPassword(String(body?.currentPassword || '')))) {
-    throw createError({ statusCode: 401, statusMessage: 'Current library password is incorrect' })
+  const { owner } = assertLibraryOwner(event)
+  const body = await readBody<{ folderId?: string; password?: string; currentPassword?: string }>(event)
+  const folderId = String(body?.folderId || '')
+  if (!folderId) {
+    throw createError({ statusCode: 400, statusMessage: 'Choose a folder to protect' })
   }
-  const next = String(body?.password || '').trim()
-  if (next && next.length < 4) {
-    throw createError({ statusCode: 400, statusMessage: 'Use at least 4 characters, or leave blank to remove the password' })
+  await updateFolder(owner, folderId, {
+    password: body?.password ?? '',
+    currentPassword: body?.currentPassword
+  })
+  const folder = assertLibraryOwner(event).catalog.folders.find(item => item.id === folderId)
+  if (folder?.passwordHash) {
+    setFolderUnlock(event, folder.id, passwordVersion(folder.passwordHash))
+  } else {
+    clearFolderUnlock(event, folderId)
   }
-  const version = await setLibraryPassword(next || null)
-  if (next) setLibraryUnlock(event, version)
-  else clearLibraryUnlock(event)
   return publicLibrary(event)
 })

server/api/library/stills.post.ts

@@ -0,0 +1,36 @@
+export default defineEventHandler(async (event) => {
+  const form = await readMultipartFormData(event)
+  if (!form?.length) {
+    throw createError({ statusCode: 400, statusMessage: 'Expected an image upload' })
+  }
+  const fields: Record<string, string> = {}
+  let image: { filename: string; data: Buffer; type?: string } | null = null
+  for (const part of form) {
+    if (part.name === 'image' && part.filename && part.data?.length) {
+      image = { filename: part.filename, data: part.data, type: part.type }
+    } else if (part.name && part.data) {
+      fields[part.name] = part.data.toString('utf8')
+    }
+  }
+  if (!image) {
+    throw createError({ statusCode: 400, statusMessage: 'An image is required' })
+  }
+  const { owner } = assertLibraryOwner(event)
+  const library = publicLibrary(event)
+  const folderId = library.folders.some(folder => folder.id === fields.folderId)
+    ? fields.folderId
+    : library.folders[0]?.id
+  if (!folderId) {
+    throw createError({ statusCode: 400, statusMessage: 'Create a library folder first' })
+  }
+  assertFolderAccess(event, folderId)
+  const still = await saveStill({
+    ownerKey: owner,
+    folderId,
+    filename: image.filename,
+    data: image.data,
+    width: Number(fields.width || 0),
+    height: Number(fields.height || 0)
+  })
+  return { still, ...publicLibrary(event) }
+})

server/api/library/stills/[id].delete.ts

@@ -0,0 +1,8 @@
+export default defineEventHandler(async (event) => {
+  const { owner } = assertLibraryOwner(event)
+  const id = String(getRouterParam(event, 'id') || '')
+  const still = getStill(owner, id)
+  assertFolderAccess(event, still.folderId)
+  await deleteStill(owner, id)
+  return publicLibrary(event)
+})

server/api/library/stills/[id].get.ts

@@ -0,0 +1,16 @@
+import { existsSync, readFileSync } from 'node:fs'
+
+export default defineEventHandler((event) => {
+  const { owner } = assertLibraryOwner(event)
+  const id = String(getRouterParam(event, 'id') || '')
+  const still = getStill(owner, id)
+  assertFolderAccess(event, still.folderId)
+  const path = stillPath(owner, still.id)
+  if (!existsSync(path)) {
+    throw createError({ statusCode: 404, statusMessage: 'Image file is missing' })
+  }
+  const buf = readFileSync(path)
+  setHeader(event, 'Content-Type', imageContentType(buf))
+  setHeader(event, 'Cache-Control', 'private, max-age=3600')
+  return buf
+})

server/api/library/unlock.post.ts

@@ -1,12 +1,11 @@
 export default defineEventHandler(async (event) => {
-  const body = await readBody<{ password?: string }>(event)
+  const { owner } = assertLibraryOwner(event)
+  const body = await readBody<{ password?: string; folderId?: string }>(event)
   const password = String(body?.password || '')
   if (!password) {
     throw createError({ statusCode: 400, statusMessage: 'Password is required' })
   }
-  if (!(await verifyLibraryPassword(password))) {
-    throw createError({ statusCode: 401, statusMessage: 'Incorrect library password' })
-  }
-  setLibraryUnlock(event, currentPasswordVersion())
+  const unlocked = await unlockMatchingFolders(owner, password, body?.folderId)
+  setFolderUnlocks(event, Object.fromEntries(unlocked.map(folder => [folder.id, passwordVersion(folder.passwordHash)])))
   return publicLibrary(event)
 })