Add per-user library settings, folder passwords, and a still picker.

Settings manages folders, thumbnail defaults, and passwords for the signed-in account, and choosing an image now browses saved stills instead of only the desktop file dialog.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/api/library/clips/[id].delete.ts

@@ -1,6 +1,8 @@
 export default defineEventHandler(async (event) => {
-  assertLibraryAccess(event)
-  const id = getRouterParam(event, 'id')
-  await deleteClip(String(id))
+  const { owner } = assertLibraryOwner(event)
+  const id = String(getRouterParam(event, 'id') || '')
+  const clip = getClip(owner, id)
+  assertFolderAccess(event, clip.folderId)
+  await deleteClip(owner, id)
   return { ok: true }
 })

server/api/library/clips/[id]/thumb.get.ts

@@ -1,19 +1,19 @@
 import { existsSync, readFileSync } from 'node:fs'
 
 export default defineEventHandler((event) => {
-  assertLibraryAccess(event)
+  const { owner } = assertLibraryOwner(event)
   const id = String(getRouterParam(event, 'id') || '')
-  const clip = getClip(id)
+  const clip = getClip(owner, id)
+  assertFolderAccess(event, clip.folderId)
   if (clip.hideThumbnail) {
     throw createError({ statusCode: 404, statusMessage: 'Thumbnail hidden' })
   }
-  const path = clipThumbPath(clip.id)
+  const path = clipThumbPath(owner, clip.id)
   if (!existsSync(path)) {
     throw createError({ statusCode: 404, statusMessage: 'Thumbnail not found' })
   }
   const buf = readFileSync(path)
-  const png = buf[0] === 0x89 && buf[1] === 0x50
-  setHeader(event, 'Content-Type', png ? 'image/png' : 'image/jpeg')
+  setHeader(event, 'Content-Type', imageContentType(buf))
   setHeader(event, 'Cache-Control', 'private, max-age=3600')
   return buf
 })

server/api/library/clips/[id]/video.get.ts

@@ -1,10 +1,11 @@
 import { existsSync, readFileSync } from 'node:fs'
 
 export default defineEventHandler((event) => {
-  assertLibraryAccess(event)
+  const { owner } = assertLibraryOwner(event)
   const id = String(getRouterParam(event, 'id') || '')
-  const clip = getClip(id)
-  const path = clipVideoPath(clip.id)
+  const clip = getClip(owner, id)
+  assertFolderAccess(event, clip.folderId)
+  const path = clipVideoPath(owner, clip.id)
   if (!existsSync(path)) {
     throw createError({ statusCode: 404, statusMessage: 'Video file is missing' })
   }