various: simplify code; work on security and performance

Signed-off-by: NotAShelf <raf@notashelf.dev>
Change-Id: I9a5114addcab5fbff430ab2b919b83466a6a6964

crates/pinakes-server/src/app.rs

@@ -40,6 +40,9 @@ pub fn create_router(state: AppState) -> Router {
             config: login_governor,
         });
 
+    // Public routes (no auth required)
+    let public_routes = Router::new().route("/s/{token}", get(routes::social::access_shared_media));
+
     // Read-only routes: any authenticated user (Viewer+)
     let viewer_routes = Router::new()
         .route("/health", get(routes::health::health))
@@ -87,7 +90,82 @@ pub fn create_router(state: AppState) -> Router {
         .route("/webhooks", get(routes::webhooks::list_webhooks))
         // Auth endpoints (self-service) — login handled separately with stricter rate limit
         .route("/auth/logout", post(routes::auth::logout))
-        .route("/auth/me", get(routes::auth::me));
+        .route("/auth/me", get(routes::auth::me))
+        // Social: ratings & comments (read)
+        .route(
+            "/media/{id}/ratings",
+            get(routes::social::get_media_ratings),
+        )
+        .route(
+            "/media/{id}/comments",
+            get(routes::social::get_media_comments),
+        )
+        // Favorites (read)
+        .route("/favorites", get(routes::social::list_favorites))
+        // Playlists (read)
+        .route("/playlists", get(routes::playlists::list_playlists))
+        .route("/playlists/{id}", get(routes::playlists::get_playlist))
+        .route("/playlists/{id}/items", get(routes::playlists::list_items))
+        .route(
+            "/playlists/{id}/shuffle",
+            post(routes::playlists::shuffle_playlist),
+        )
+        // Analytics (read)
+        .route(
+            "/analytics/most-viewed",
+            get(routes::analytics::get_most_viewed),
+        )
+        .route(
+            "/analytics/recently-viewed",
+            get(routes::analytics::get_recently_viewed),
+        )
+        .route("/analytics/events", post(routes::analytics::record_event))
+        .route(
+            "/media/{id}/progress",
+            get(routes::analytics::get_watch_progress),
+        )
+        .route(
+            "/media/{id}/progress",
+            post(routes::analytics::update_watch_progress),
+        )
+        // Subtitles (read)
+        .route(
+            "/media/{id}/subtitles",
+            get(routes::subtitles::list_subtitles),
+        )
+        .route(
+            "/media/{media_id}/subtitles/{subtitle_id}/content",
+            get(routes::subtitles::get_subtitle_content),
+        )
+        // Enrichment (read)
+        .route(
+            "/media/{id}/external-metadata",
+            get(routes::enrichment::get_external_metadata),
+        )
+        // Transcode (read)
+        .route("/transcode/{id}", get(routes::transcode::get_session))
+        .route("/transcode", get(routes::transcode::list_sessions))
+        // Streaming
+        .route(
+            "/media/{id}/stream/hls/master.m3u8",
+            get(routes::streaming::hls_master_playlist),
+        )
+        .route(
+            "/media/{id}/stream/hls/{profile}/playlist.m3u8",
+            get(routes::streaming::hls_variant_playlist),
+        )
+        .route(
+            "/media/{id}/stream/hls/{profile}/{segment}",
+            get(routes::streaming::hls_segment),
+        )
+        .route(
+            "/media/{id}/stream/dash/manifest.mpd",
+            get(routes::streaming::dash_manifest),
+        )
+        .route(
+            "/media/{id}/stream/dash/{profile}/{segment}",
+            get(routes::streaming::dash_segment),
+        );
 
     // Write routes: Editor+ required
     let editor_routes = Router::new()
@@ -190,6 +268,58 @@ pub fn create_router(state: AppState) -> Router {
         )
         // Webhooks
         .route("/webhooks/test", post(routes::webhooks::test_webhook))
+        // Social: ratings & comments (write)
+        .route("/media/{id}/ratings", post(routes::social::rate_media))
+        .route("/media/{id}/comments", post(routes::social::add_comment))
+        // Favorites (write)
+        .route("/favorites", post(routes::social::add_favorite))
+        .route(
+            "/favorites/{media_id}",
+            delete(routes::social::remove_favorite),
+        )
+        // Share links
+        .route("/share", post(routes::social::create_share_link))
+        // Playlists (write)
+        .route("/playlists", post(routes::playlists::create_playlist))
+        .route("/playlists/{id}", patch(routes::playlists::update_playlist))
+        .route(
+            "/playlists/{id}",
+            delete(routes::playlists::delete_playlist),
+        )
+        .route("/playlists/{id}/items", post(routes::playlists::add_item))
+        .route(
+            "/playlists/{id}/items/{media_id}",
+            delete(routes::playlists::remove_item),
+        )
+        .route(
+            "/playlists/{id}/reorder",
+            post(routes::playlists::reorder_item),
+        )
+        // Subtitles (write)
+        .route(
+            "/media/{id}/subtitles",
+            post(routes::subtitles::add_subtitle),
+        )
+        .route(
+            "/subtitles/{id}",
+            delete(routes::subtitles::delete_subtitle),
+        )
+        .route(
+            "/subtitles/{id}/offset",
+            patch(routes::subtitles::update_offset),
+        )
+        // Enrichment (write)
+        .route(
+            "/media/{id}/enrich",
+            post(routes::enrichment::trigger_enrichment),
+        )
+        .route("/jobs/enrich", post(routes::enrichment::batch_enrich))
+        // Transcode (write)
+        .route(
+            "/media/{id}/transcode",
+            post(routes::transcode::start_transcode),
+        )
+        .route("/transcode/{id}", delete(routes::transcode::cancel_session))
         .layer(middleware::from_fn(auth::require_editor));
 
     // Admin-only routes: destructive/config operations
@@ -203,14 +333,33 @@ pub fn create_router(state: AppState) -> Router {
         .route("/config/ui", put(routes::config::update_ui_config))
         .route("/database/vacuum", post(routes::database::vacuum_database))
         .route("/database/clear", post(routes::database::clear_database))
+        // Plugin management
+        .route("/plugins", get(routes::plugins::list_plugins))
+        .route("/plugins/{id}", get(routes::plugins::get_plugin))
+        .route("/plugins/install", post(routes::plugins::install_plugin))
+        .route("/plugins/{id}", delete(routes::plugins::uninstall_plugin))
+        .route("/plugins/{id}/toggle", post(routes::plugins::toggle_plugin))
+        .route("/plugins/{id}/reload", post(routes::plugins::reload_plugin))
+        // User management
+        .route("/users", get(routes::users::list_users))
+        .route("/users", post(routes::users::create_user))
+        .route("/users/{id}", get(routes::users::get_user))
+        .route("/users/{id}", patch(routes::users::update_user))
+        .route("/users/{id}", delete(routes::users::delete_user))
+        .route(
+            "/users/{id}/libraries",
+            get(routes::users::get_user_libraries),
+        )
+        .route(
+            "/users/{id}/libraries",
+            post(routes::users::grant_library_access),
+        )
+        .route(
+            "/users/{id}/libraries",
+            delete(routes::users::revoke_library_access),
+        )
         .layer(middleware::from_fn(auth::require_admin));
 
-    let api = Router::new()
-        .merge(login_route)
-        .merge(viewer_routes)
-        .merge(editor_routes)
-        .merge(admin_routes);
-
     // CORS: allow same-origin by default, plus the desktop UI origin
     let cors = CorsLayer::new()
         .allow_origin([
@@ -228,13 +377,25 @@ pub fn create_router(state: AppState) -> Router {
         .allow_headers([header::CONTENT_TYPE, header::AUTHORIZATION])
         .allow_credentials(true);
 
-    Router::new()
-        .nest("/api/v1", api)
-        .layer(DefaultBodyLimit::max(10 * 1024 * 1024))
+    // Create protected routes with auth middleware
+    let protected_api = Router::new()
+        .merge(viewer_routes)
+        .merge(editor_routes)
+        .merge(admin_routes)
         .layer(middleware::from_fn_with_state(
             state.clone(),
             auth::require_auth,
-        ))
+        ));
+
+    // Combine protected and public routes
+    let full_api = Router::new()
+        .merge(login_route)
+        .merge(public_routes)
+        .merge(protected_api);
+
+    Router::new()
+        .nest("/api/v1", full_api)
+        .layer(DefaultBodyLimit::max(10 * 1024 * 1024))
         .layer(GovernorLayer {
             config: global_governor,
         })

crates/pinakes-server/src/auth.rs

@@ -85,6 +85,7 @@ pub async fn require_auth(
             if expected_key.is_empty() {
                 // Empty key means no auth required
                 request.extensions_mut().insert(UserRole::Admin);
+                request.extensions_mut().insert("admin".to_string());
                 return next.run(request).await;
             }
 
@@ -110,6 +111,7 @@ pub async fn require_auth(
         }
         // When no api_key is configured, or key matches, grant admin
         request.extensions_mut().insert(UserRole::Admin);
+        request.extensions_mut().insert("admin".to_string());
     }
 
     next.run(request).await
@@ -143,6 +145,24 @@ pub async fn require_admin(request: Request, next: Next) -> Response {
     }
 }
 
+/// Resolve the authenticated username (from request extensions) to a UserId.
+///
+/// Returns an error if the user cannot be found.
+pub async fn resolve_user_id(
+    storage: &pinakes_core::storage::DynStorageBackend,
+    username: &str,
+) -> Result<pinakes_core::users::UserId, crate::error::ApiError> {
+    match storage.get_user_by_username(username).await {
+        Ok(user) => Ok(user.id),
+        Err(e) => {
+            tracing::warn!(username = %username, error = ?e, "failed to resolve user");
+            Err(crate::error::ApiError(
+                pinakes_core::error::PinakesError::Authentication("user not found".into()),
+            ))
+        }
+    }
+}
+
 fn unauthorized(message: &str) -> Response {
     let body = format!(r#"{{"error":"{message}"}}"#);
     (

crates/pinakes-server/src/dto.rs

@@ -551,3 +551,431 @@ impl From<pinakes_core::model::AuditEntry> for AuditEntryResponse {
         }
     }
 }
+
+// Plugins
+#[derive(Debug, Serialize)]
+pub struct PluginResponse {
+    pub id: String,
+    pub name: String,
+    pub version: String,
+    pub author: String,
+    pub description: String,
+    pub api_version: String,
+    pub enabled: bool,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct InstallPluginRequest {
+    pub source: String, // URL or file path
+}
+
+#[derive(Debug, Deserialize)]
+pub struct TogglePluginRequest {
+    pub enabled: bool,
+}
+
+impl PluginResponse {
+    pub fn new(meta: pinakes_plugin_api::PluginMetadata, enabled: bool) -> Self {
+        Self {
+            id: meta.id,
+            name: meta.name,
+            version: meta.version,
+            author: meta.author,
+            description: meta.description,
+            api_version: meta.api_version,
+            enabled,
+        }
+    }
+}
+
+// Users
+#[derive(Debug, Serialize)]
+pub struct UserResponse {
+    pub id: String,
+    pub username: String,
+    pub role: String,
+    pub profile: UserProfileResponse,
+    pub created_at: DateTime<Utc>,
+    pub updated_at: DateTime<Utc>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct UserProfileResponse {
+    pub avatar_path: Option<String>,
+    pub bio: Option<String>,
+    pub preferences: UserPreferencesResponse,
+}
+
+#[derive(Debug, Serialize)]
+pub struct UserPreferencesResponse {
+    pub theme: Option<String>,
+    pub language: Option<String>,
+    pub default_video_quality: Option<String>,
+    pub auto_play: bool,
+}
+
+#[derive(Debug, Serialize)]
+pub struct UserLibraryResponse {
+    pub user_id: String,
+    pub root_path: String,
+    pub permission: String,
+    pub granted_at: DateTime<Utc>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct GrantLibraryAccessRequest {
+    pub root_path: String,
+    pub permission: pinakes_core::users::LibraryPermission,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct RevokeLibraryAccessRequest {
+    pub root_path: String,
+}
+
+impl From<pinakes_core::users::User> for UserResponse {
+    fn from(user: pinakes_core::users::User) -> Self {
+        Self {
+            id: user.id.0.to_string(),
+            username: user.username,
+            role: user.role.to_string(),
+            profile: UserProfileResponse {
+                avatar_path: user.profile.avatar_path,
+                bio: user.profile.bio,
+                preferences: UserPreferencesResponse {
+                    theme: user.profile.preferences.theme,
+                    language: user.profile.preferences.language,
+                    default_video_quality: user.profile.preferences.default_video_quality,
+                    auto_play: user.profile.preferences.auto_play,
+                },
+            },
+            created_at: user.created_at,
+            updated_at: user.updated_at,
+        }
+    }
+}
+
+impl From<pinakes_core::users::UserLibraryAccess> for UserLibraryResponse {
+    fn from(access: pinakes_core::users::UserLibraryAccess) -> Self {
+        Self {
+            user_id: access.user_id.0.to_string(),
+            root_path: access.root_path,
+            permission: format!("{:?}", access.permission).to_lowercase(),
+            granted_at: access.granted_at,
+        }
+    }
+}
+
+// ===== Social (Ratings, Comments, Favorites, Shares) =====
+
+#[derive(Debug, Serialize)]
+pub struct RatingResponse {
+    pub id: String,
+    pub user_id: String,
+    pub media_id: String,
+    pub stars: u8,
+    pub review_text: Option<String>,
+    pub created_at: DateTime<Utc>,
+}
+
+impl From<pinakes_core::social::Rating> for RatingResponse {
+    fn from(r: pinakes_core::social::Rating) -> Self {
+        Self {
+            id: r.id.to_string(),
+            user_id: r.user_id.0.to_string(),
+            media_id: r.media_id.0.to_string(),
+            stars: r.stars,
+            review_text: r.review_text,
+            created_at: r.created_at,
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateRatingRequest {
+    pub stars: u8,
+    pub review_text: Option<String>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct CommentResponse {
+    pub id: String,
+    pub user_id: String,
+    pub media_id: String,
+    pub parent_comment_id: Option<String>,
+    pub text: String,
+    pub created_at: DateTime<Utc>,
+}
+
+impl From<pinakes_core::social::Comment> for CommentResponse {
+    fn from(c: pinakes_core::social::Comment) -> Self {
+        Self {
+            id: c.id.to_string(),
+            user_id: c.user_id.0.to_string(),
+            media_id: c.media_id.0.to_string(),
+            parent_comment_id: c.parent_comment_id.map(|id| id.to_string()),
+            text: c.text,
+            created_at: c.created_at,
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateCommentRequest {
+    pub text: String,
+    pub parent_id: Option<Uuid>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct FavoriteRequest {
+    pub media_id: Uuid,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateShareLinkRequest {
+    pub media_id: Uuid,
+    pub password: Option<String>,
+    pub expires_in_hours: Option<u64>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct ShareLinkResponse {
+    pub id: String,
+    pub media_id: String,
+    pub token: String,
+    pub expires_at: Option<DateTime<Utc>>,
+    pub view_count: u64,
+    pub created_at: DateTime<Utc>,
+}
+
+impl From<pinakes_core::social::ShareLink> for ShareLinkResponse {
+    fn from(s: pinakes_core::social::ShareLink) -> Self {
+        Self {
+            id: s.id.to_string(),
+            media_id: s.media_id.0.to_string(),
+            token: s.token,
+            expires_at: s.expires_at,
+            view_count: s.view_count,
+            created_at: s.created_at,
+        }
+    }
+}
+
+// ===== Playlists =====
+
+#[derive(Debug, Serialize)]
+pub struct PlaylistResponse {
+    pub id: String,
+    pub owner_id: String,
+    pub name: String,
+    pub description: Option<String>,
+    pub is_public: bool,
+    pub is_smart: bool,
+    pub filter_query: Option<String>,
+    pub created_at: DateTime<Utc>,
+    pub updated_at: DateTime<Utc>,
+}
+
+impl From<pinakes_core::playlists::Playlist> for PlaylistResponse {
+    fn from(p: pinakes_core::playlists::Playlist) -> Self {
+        Self {
+            id: p.id.to_string(),
+            owner_id: p.owner_id.0.to_string(),
+            name: p.name,
+            description: p.description,
+            is_public: p.is_public,
+            is_smart: p.is_smart,
+            filter_query: p.filter_query,
+            created_at: p.created_at,
+            updated_at: p.updated_at,
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreatePlaylistRequest {
+    pub name: String,
+    pub description: Option<String>,
+    pub is_public: Option<bool>,
+    pub is_smart: Option<bool>,
+    pub filter_query: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct UpdatePlaylistRequest {
+    pub name: Option<String>,
+    pub description: Option<String>,
+    pub is_public: Option<bool>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct PlaylistItemRequest {
+    pub media_id: Uuid,
+    pub position: Option<i32>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct ReorderPlaylistRequest {
+    pub media_id: Uuid,
+    pub new_position: i32,
+}
+
+// ===== Analytics =====
+
+#[derive(Debug, Serialize)]
+pub struct UsageEventResponse {
+    pub id: String,
+    pub media_id: Option<String>,
+    pub user_id: Option<String>,
+    pub event_type: String,
+    pub timestamp: DateTime<Utc>,
+    pub duration_secs: Option<f64>,
+}
+
+impl From<pinakes_core::analytics::UsageEvent> for UsageEventResponse {
+    fn from(e: pinakes_core::analytics::UsageEvent) -> Self {
+        Self {
+            id: e.id.to_string(),
+            media_id: e.media_id.map(|m| m.0.to_string()),
+            user_id: e.user_id.map(|u| u.0.to_string()),
+            event_type: e.event_type.to_string(),
+            timestamp: e.timestamp,
+            duration_secs: e.duration_secs,
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub struct RecordUsageEventRequest {
+    pub media_id: Option<Uuid>,
+    pub event_type: String,
+    pub duration_secs: Option<f64>,
+    pub context: Option<serde_json::Value>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct MostViewedResponse {
+    pub media: MediaResponse,
+    pub view_count: u64,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct WatchProgressRequest {
+    pub progress_secs: f64,
+}
+
+#[derive(Debug, Serialize)]
+pub struct WatchProgressResponse {
+    pub progress_secs: f64,
+}
+
+// ===== Subtitles =====
+
+#[derive(Debug, Serialize)]
+pub struct SubtitleResponse {
+    pub id: String,
+    pub media_id: String,
+    pub language: Option<String>,
+    pub format: String,
+    pub is_embedded: bool,
+    pub track_index: Option<usize>,
+    pub offset_ms: i64,
+    pub created_at: DateTime<Utc>,
+}
+
+impl From<pinakes_core::subtitles::Subtitle> for SubtitleResponse {
+    fn from(s: pinakes_core::subtitles::Subtitle) -> Self {
+        Self {
+            id: s.id.to_string(),
+            media_id: s.media_id.0.to_string(),
+            language: s.language,
+            format: s.format.to_string(),
+            is_embedded: s.is_embedded,
+            track_index: s.track_index,
+            offset_ms: s.offset_ms,
+            created_at: s.created_at,
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub struct AddSubtitleRequest {
+    pub language: Option<String>,
+    pub format: String,
+    pub file_path: Option<String>,
+    pub is_embedded: Option<bool>,
+    pub track_index: Option<usize>,
+    pub offset_ms: Option<i64>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct UpdateSubtitleOffsetRequest {
+    pub offset_ms: i64,
+}
+
+// ===== Enrichment =====
+
+#[derive(Debug, Serialize)]
+pub struct ExternalMetadataResponse {
+    pub id: String,
+    pub media_id: String,
+    pub source: String,
+    pub external_id: Option<String>,
+    pub metadata: serde_json::Value,
+    pub confidence: f64,
+    pub last_updated: DateTime<Utc>,
+}
+
+impl From<pinakes_core::enrichment::ExternalMetadata> for ExternalMetadataResponse {
+    fn from(m: pinakes_core::enrichment::ExternalMetadata) -> Self {
+        let metadata = serde_json::from_str(&m.metadata_json).unwrap_or_else(|e| {
+            tracing::warn!(
+                "failed to deserialize external metadata JSON for media {}: {}",
+                m.media_id.0,
+                e
+            );
+            serde_json::Value::Null
+        });
+        Self {
+            id: m.id.to_string(),
+            media_id: m.media_id.0.to_string(),
+            source: m.source.to_string(),
+            external_id: m.external_id,
+            metadata,
+            confidence: m.confidence,
+            last_updated: m.last_updated,
+        }
+    }
+}
+
+// ===== Transcode =====
+
+#[derive(Debug, Serialize)]
+pub struct TranscodeSessionResponse {
+    pub id: String,
+    pub media_id: String,
+    pub profile: String,
+    pub status: String,
+    pub progress: f32,
+    pub created_at: DateTime<Utc>,
+    pub expires_at: Option<DateTime<Utc>>,
+}
+
+impl From<pinakes_core::transcode::TranscodeSession> for TranscodeSessionResponse {
+    fn from(s: pinakes_core::transcode::TranscodeSession) -> Self {
+        Self {
+            id: s.id.to_string(),
+            media_id: s.media_id.0.to_string(),
+            profile: s.profile,
+            status: s.status.as_str().to_string(),
+            progress: s.progress,
+            created_at: s.created_at,
+            expires_at: s.expires_at,
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateTranscodeRequest {
+    pub profile: String,
+}

crates/pinakes-server/src/error.rs

@@ -38,6 +38,8 @@ impl IntoResponse for ApiError {
             }
             PinakesError::SearchParse(msg) => (StatusCode::BAD_REQUEST, msg.clone()),
             PinakesError::InvalidOperation(msg) => (StatusCode::BAD_REQUEST, msg.clone()),
+            PinakesError::Authentication(msg) => (StatusCode::UNAUTHORIZED, msg.clone()),
+            PinakesError::Authorization(msg) => (StatusCode::FORBIDDEN, msg.clone()),
             PinakesError::Config(_) => {
                 tracing::error!(error = %self.0, "configuration error");
                 (

crates/pinakes-server/src/main.rs

@@ -161,17 +161,29 @@ async fn main() -> Result<()> {
 
     let addr = format!("{}:{}", config.server.host, config.server.port);
 
+    // Initialize transcode service early so the job queue can reference it
+    let transcode_service: Option<Arc<pinakes_core::transcode::TranscodeService>> =
+        if config.transcoding.enabled {
+            Some(Arc::new(pinakes_core::transcode::TranscodeService::new(
+                config.transcoding.clone(),
+            )))
+        } else {
+            None
+        };
+
     // Initialize job queue with executor
     let job_storage = storage.clone();
     let job_config = config.clone();
+    let job_transcode = transcode_service.clone();
     let job_queue = pinakes_core::jobs::JobQueue::new(
         config.jobs.worker_count,
         move |job_id, kind, cancel, jobs| {
             let storage = job_storage.clone();
             let config = job_config.clone();
+            let transcode_svc = job_transcode.clone();
             tokio::spawn(async move {
                 use pinakes_core::jobs::{JobKind, JobQueue};
-                let result = match kind {
+                match kind {
                     JobKind::Scan { path } => {
                         let ignore = config.scanning.ignore_patterns.clone();
                         let res = if let Some(p) = path {
@@ -232,7 +244,7 @@ async fn main() -> Result<()> {
                             match storage.get_media(*mid).await {
                                 Ok(item) => {
                                     let source = item.path.clone();
-                                    let mt = item.media_type;
+                                    let mt = item.media_type.clone();
                                     let id = item.id;
                                     let td = thumb_dir.clone();
                                     let tc = thumb_config.clone();
@@ -333,8 +345,65 @@ async fn main() -> Result<()> {
                             Err(e) => JobQueue::fail(&jobs, job_id, e.to_string()).await,
                         }
                     }
+                    JobKind::Transcode { media_id, profile } => {
+                        if let Some(ref svc) = transcode_svc {
+                            match storage.get_media(media_id).await {
+                                Ok(item) => {
+                                    match svc
+                                        .start_transcode(
+                                            media_id,
+                                            &item.path,
+                                            &profile,
+                                            item.duration_secs,
+                                            &storage,
+                                        )
+                                        .await
+                                    {
+                                        Ok(session_id) => {
+                                            JobQueue::complete(
+                                                &jobs,
+                                                job_id,
+                                                serde_json::json!({"session_id": session_id.to_string()}),
+                                            )
+                                            .await;
+                                        }
+                                        Err(e) => {
+                                            JobQueue::fail(&jobs, job_id, e.to_string()).await
+                                        }
+                                    }
+                                }
+                                Err(e) => JobQueue::fail(&jobs, job_id, e.to_string()).await,
+                            }
+                        } else {
+                            JobQueue::fail(&jobs, job_id, "transcoding is not enabled".to_string())
+                                .await;
+                        }
+                    }
+                    JobKind::Enrich { media_ids } => {
+                        // Enrichment job placeholder
+                        JobQueue::complete(
+                            &jobs,
+                            job_id,
+                            serde_json::json!({"media_ids": media_ids.len(), "status": "not_implemented"}),
+                        )
+                        .await;
+                    }
+                    JobKind::CleanupAnalytics => {
+                        let before = chrono::Utc::now() - chrono::Duration::days(90);
+                        match storage.cleanup_old_events(before).await {
+                            Ok(count) => {
+                                JobQueue::complete(
+                                    &jobs,
+                                    job_id,
+                                    serde_json::json!({"cleaned_up": count}),
+                                )
+                                .await;
+                            }
+                            Err(e) => JobQueue::fail(&jobs, job_id, e.to_string()).await,
+                        }
+                    }
                 };
-                let _ = result;
+                ();
                 drop(cancel);
             })
         },
@@ -345,6 +414,27 @@ async fn main() -> Result<()> {
         config.jobs.cache_ttl_secs,
     ));
 
+    // Initialize plugin manager if plugins are enabled (before moving config into Arc)
+    let plugin_manager = if config.plugins.enabled {
+        match pinakes_core::plugin::PluginManager::new(
+            config.plugins.data_dir.clone(),
+            config.plugins.cache_dir.clone(),
+            config.plugins.clone().into(),
+        ) {
+            Ok(pm) => {
+                tracing::info!("Plugin manager initialized");
+                Some(Arc::new(pm))
+            }
+            Err(e) => {
+                tracing::warn!("Failed to initialize plugin manager: {}", e);
+                None
+            }
+        }
+    } else {
+        tracing::info!("Plugins disabled in configuration");
+        None
+    };
+
     // Initialize scheduler with cancellation support
     let shutdown_token = tokio_util::sync::CancellationToken::new();
     let config_arc = Arc::new(RwLock::new(config));
@@ -376,6 +466,8 @@ async fn main() -> Result<()> {
         job_queue,
         cache,
         scheduler,
+        plugin_manager,
+        transcode_service,
     };
 
     // Periodic session cleanup (every 15 minutes)

crates/pinakes-server/src/routes/analytics.rs

@@ -0,0 +1,94 @@
+use axum::Json;
+use axum::extract::{Extension, Path, Query, State};
+use uuid::Uuid;
+
+use crate::auth::resolve_user_id;
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::analytics::{UsageEvent, UsageEventType};
+use pinakes_core::model::MediaId;
+
+const MAX_LIMIT: u64 = 100;
+
+pub async fn get_most_viewed(
+    State(state): State<AppState>,
+    Query(params): Query<PaginationParams>,
+) -> Result<Json<Vec<MostViewedResponse>>, ApiError> {
+    let limit = params.limit.unwrap_or(20).min(MAX_LIMIT);
+    let results = state.storage.get_most_viewed(limit).await?;
+    Ok(Json(
+        results
+            .into_iter()
+            .map(|(item, count)| MostViewedResponse {
+                media: MediaResponse::from(item),
+                view_count: count,
+            })
+            .collect(),
+    ))
+}
+
+pub async fn get_recently_viewed(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Query(params): Query<PaginationParams>,
+) -> Result<Json<Vec<MediaResponse>>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let limit = params.limit.unwrap_or(20).min(MAX_LIMIT);
+    let items = state.storage.get_recently_viewed(user_id, limit).await?;
+    Ok(Json(items.into_iter().map(MediaResponse::from).collect()))
+}
+
+pub async fn record_event(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Json(req): Json<RecordUsageEventRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let event_type: UsageEventType = req
+        .event_type
+        .parse()
+        .map_err(|e: String| ApiError(pinakes_core::error::PinakesError::InvalidOperation(e)))?;
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let event = UsageEvent {
+        id: Uuid::now_v7(),
+        media_id: req.media_id.map(MediaId),
+        user_id: Some(user_id),
+        event_type,
+        timestamp: chrono::Utc::now(),
+        duration_secs: req.duration_secs,
+        context_json: req.context.map(|v| v.to_string()),
+    };
+    state.storage.record_usage_event(&event).await?;
+    Ok(Json(serde_json::json!({"recorded": true})))
+}
+
+pub async fn get_watch_progress(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<WatchProgressResponse>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let progress = state
+        .storage
+        .get_watch_progress(user_id, MediaId(id))
+        .await?
+        .unwrap_or(0.0);
+    Ok(Json(WatchProgressResponse {
+        progress_secs: progress,
+    }))
+}
+
+pub async fn update_watch_progress(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<WatchProgressRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    state
+        .storage
+        .update_watch_progress(user_id, MediaId(id), req.progress_secs)
+        .await?;
+    Ok(Json(serde_json::json!({"updated": true})))
+}

crates/pinakes-server/src/routes/enrichment.rs

@@ -0,0 +1,48 @@
+use axum::Json;
+use axum::extract::{Path, State};
+use uuid::Uuid;
+
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::model::MediaId;
+
+pub async fn trigger_enrichment(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    // Submit enrichment as a background job
+    let job_id = state
+        .job_queue
+        .submit(pinakes_core::jobs::JobKind::Enrich {
+            media_ids: vec![MediaId(id)],
+        })
+        .await;
+    Ok(Json(serde_json::json!({"job_id": job_id.to_string()})))
+}
+
+pub async fn get_external_metadata(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Vec<ExternalMetadataResponse>>, ApiError> {
+    let metadata = state.storage.get_external_metadata(MediaId(id)).await?;
+    Ok(Json(
+        metadata
+            .into_iter()
+            .map(ExternalMetadataResponse::from)
+            .collect(),
+    ))
+}
+
+pub async fn batch_enrich(
+    State(state): State<AppState>,
+    Json(req): Json<BatchDeleteRequest>, // Reuse: has media_ids field
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let media_ids: Vec<MediaId> = req.media_ids.into_iter().map(MediaId).collect();
+    let job_id = state
+        .job_queue
+        .submit(pinakes_core::jobs::JobKind::Enrich { media_ids })
+        .await;
+    Ok(Json(serde_json::json!({"job_id": job_id.to_string()})))
+}

crates/pinakes-server/src/routes/integrity.rs

@@ -26,7 +26,7 @@ pub async fn trigger_verify_integrity(
     let media_ids = req
         .media_ids
         .into_iter()
-        .map(|id| pinakes_core::model::MediaId(id))
+        .map(pinakes_core::model::MediaId)
         .collect();
     let kind = pinakes_core::jobs::JobKind::VerifyIntegrity { media_ids };
     let job_id = state.job_queue.submit(kind).await;
@@ -94,6 +94,6 @@ pub async fn resolve_orphans(
         .collect();
     let count = pinakes_core::integrity::resolve_orphans(&state.storage, action, &ids)
         .await
-        .map_err(|e| ApiError(e))?;
+        .map_err(ApiError)?;
     Ok(Json(serde_json::json!({ "resolved": count })))
 }

crates/pinakes-server/src/routes/mod.rs

@@ -1,18 +1,27 @@
+pub mod analytics;
 pub mod audit;
 pub mod auth;
 pub mod collections;
 pub mod config;
 pub mod database;
 pub mod duplicates;
+pub mod enrichment;
 pub mod export;
 pub mod health;
 pub mod integrity;
 pub mod jobs;
 pub mod media;
+pub mod playlists;
+pub mod plugins;
 pub mod saved_searches;
 pub mod scan;
 pub mod scheduled_tasks;
 pub mod search;
+pub mod social;
 pub mod statistics;
+pub mod streaming;
+pub mod subtitles;
 pub mod tags;
+pub mod transcode;
+pub mod users;
 pub mod webhooks;

crates/pinakes-server/src/routes/playlists.rs

@@ -0,0 +1,208 @@
+use axum::Json;
+use axum::extract::{Extension, Path, State};
+use uuid::Uuid;
+
+use crate::auth::resolve_user_id;
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::model::MediaId;
+use pinakes_core::playlists::Playlist;
+use pinakes_core::users::UserId;
+
+/// Check whether a user has access to a playlist.
+///
+/// * `require_write` – when `true` only the playlist owner is allowed (for
+///   mutations such as update, delete, add/remove/reorder items).  When `false`
+///   the playlist must either be public or owned by the requesting user.
+async fn check_playlist_access(
+    storage: &pinakes_core::storage::DynStorageBackend,
+    playlist_id: Uuid,
+    user_id: UserId,
+    require_write: bool,
+) -> Result<Playlist, ApiError> {
+    let playlist = storage.get_playlist(playlist_id).await.map_err(ApiError)?;
+    if require_write {
+        // Write operations require ownership
+        if playlist.owner_id != user_id {
+            return Err(ApiError(pinakes_core::error::PinakesError::Authorization(
+                "only the playlist owner can modify this playlist".into(),
+            )));
+        }
+    } else {
+        // Read operations: allow if public or owner
+        if !playlist.is_public && playlist.owner_id != user_id {
+            return Err(ApiError(pinakes_core::error::PinakesError::Authorization(
+                "playlist is private".into(),
+            )));
+        }
+    }
+    Ok(playlist)
+}
+
+pub async fn create_playlist(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Json(req): Json<CreatePlaylistRequest>,
+) -> Result<Json<PlaylistResponse>, ApiError> {
+    if req.name.is_empty() || req.name.chars().count() > 255 {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "playlist name must be 1-255 characters".into(),
+            ),
+        ));
+    }
+    let owner_id = resolve_user_id(&state.storage, &username).await?;
+    let playlist = state
+        .storage
+        .create_playlist(
+            owner_id,
+            &req.name,
+            req.description.as_deref(),
+            req.is_public.unwrap_or(false),
+            req.is_smart.unwrap_or(false),
+            req.filter_query.as_deref(),
+        )
+        .await?;
+    Ok(Json(PlaylistResponse::from(playlist)))
+}
+
+pub async fn list_playlists(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+) -> Result<Json<Vec<PlaylistResponse>>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    // Fetch all playlists and filter to only public ones plus the user's own
+    let playlists = state.storage.list_playlists(None).await?;
+    let visible: Vec<PlaylistResponse> = playlists
+        .into_iter()
+        .filter(|p| p.is_public || p.owner_id == user_id)
+        .map(PlaylistResponse::from)
+        .collect();
+    Ok(Json(visible))
+}
+
+pub async fn get_playlist(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<PlaylistResponse>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let playlist = check_playlist_access(&state.storage, id, user_id, false).await?;
+    Ok(Json(PlaylistResponse::from(playlist)))
+}
+
+pub async fn update_playlist(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<UpdatePlaylistRequest>,
+) -> Result<Json<PlaylistResponse>, ApiError> {
+    if let Some(ref name) = req.name
+        && (name.is_empty() || name.chars().count() > 255) {
+            return Err(ApiError(
+                pinakes_core::error::PinakesError::InvalidOperation(
+                    "playlist name must be 1-255 characters".into(),
+                ),
+            ));
+        }
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    check_playlist_access(&state.storage, id, user_id, true).await?;
+    let playlist = state
+        .storage
+        .update_playlist(
+            id,
+            req.name.as_deref(),
+            req.description.as_deref(),
+            req.is_public,
+        )
+        .await?;
+    Ok(Json(PlaylistResponse::from(playlist)))
+}
+
+pub async fn delete_playlist(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    check_playlist_access(&state.storage, id, user_id, true).await?;
+    state.storage.delete_playlist(id).await?;
+    Ok(Json(serde_json::json!({"deleted": true})))
+}
+
+pub async fn add_item(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<PlaylistItemRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    check_playlist_access(&state.storage, id, user_id, true).await?;
+    let position = match req.position {
+        Some(p) => p,
+        None => {
+            let items = state.storage.get_playlist_items(id).await?;
+            items.len() as i32
+        }
+    };
+    state
+        .storage
+        .add_to_playlist(id, MediaId(req.media_id), position)
+        .await?;
+    Ok(Json(serde_json::json!({"added": true})))
+}
+
+pub async fn remove_item(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path((id, media_id)): Path<(Uuid, Uuid)>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    check_playlist_access(&state.storage, id, user_id, true).await?;
+    state
+        .storage
+        .remove_from_playlist(id, MediaId(media_id))
+        .await?;
+    Ok(Json(serde_json::json!({"removed": true})))
+}
+
+pub async fn list_items(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Vec<MediaResponse>>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    check_playlist_access(&state.storage, id, user_id, false).await?;
+    let items = state.storage.get_playlist_items(id).await?;
+    Ok(Json(items.into_iter().map(MediaResponse::from).collect()))
+}
+
+pub async fn reorder_item(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<ReorderPlaylistRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    check_playlist_access(&state.storage, id, user_id, true).await?;
+    state
+        .storage
+        .reorder_playlist(id, MediaId(req.media_id), req.new_position)
+        .await?;
+    Ok(Json(serde_json::json!({"reordered": true})))
+}
+
+pub async fn shuffle_playlist(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Vec<MediaResponse>>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    check_playlist_access(&state.storage, id, user_id, false).await?;
+    use rand::seq::SliceRandom;
+    let mut items = state.storage.get_playlist_items(id).await?;
+    items.shuffle(&mut rand::rng());
+    Ok(Json(items.into_iter().map(MediaResponse::from).collect()))
+}

crates/pinakes-server/src/routes/plugins.rs

@@ -0,0 +1,149 @@
+use axum::Json;
+use axum::extract::{Path, State};
+
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+/// List all installed plugins
+pub async fn list_plugins(
+    State(state): State<AppState>,
+) -> Result<Json<Vec<PluginResponse>>, ApiError> {
+    let plugin_manager = state.plugin_manager.as_ref().ok_or_else(|| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Plugin system is not enabled".to_string(),
+        ))
+    })?;
+
+    let plugins = plugin_manager.list_plugins().await;
+    let mut responses = Vec::with_capacity(plugins.len());
+    for meta in plugins {
+        let enabled = plugin_manager.is_plugin_enabled(&meta.id).await;
+        responses.push(PluginResponse::new(meta, enabled));
+    }
+    Ok(Json(responses))
+}
+
+/// Get a specific plugin by ID
+pub async fn get_plugin(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<PluginResponse>, ApiError> {
+    let plugin_manager = state.plugin_manager.as_ref().ok_or_else(|| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Plugin system is not enabled".to_string(),
+        ))
+    })?;
+
+    let plugin = plugin_manager.get_plugin(&id).await.ok_or_else(|| {
+        ApiError(pinakes_core::error::PinakesError::NotFound(format!(
+            "Plugin not found: {}",
+            id
+        )))
+    })?;
+
+    let enabled = plugin_manager.is_plugin_enabled(&id).await;
+    Ok(Json(PluginResponse::new(plugin, enabled)))
+}
+
+/// Install a plugin from URL or file path
+pub async fn install_plugin(
+    State(state): State<AppState>,
+    Json(req): Json<InstallPluginRequest>,
+) -> Result<Json<PluginResponse>, ApiError> {
+    let plugin_manager = state.plugin_manager.as_ref().ok_or_else(|| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Plugin system is not enabled".to_string(),
+        ))
+    })?;
+
+    let plugin_id = plugin_manager
+        .install_plugin(&req.source)
+        .await
+        .map_err(|e| {
+            ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+                format!("Failed to install plugin: {}", e),
+            ))
+        })?;
+
+    let plugin = plugin_manager.get_plugin(&plugin_id).await.ok_or_else(|| {
+        ApiError(pinakes_core::error::PinakesError::NotFound(
+            "Plugin installed but not found".to_string(),
+        ))
+    })?;
+
+    let enabled = plugin_manager.is_plugin_enabled(&plugin_id).await;
+    Ok(Json(PluginResponse::new(plugin, enabled)))
+}
+
+/// Uninstall a plugin
+pub async fn uninstall_plugin(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let plugin_manager = state.plugin_manager.as_ref().ok_or_else(|| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Plugin system is not enabled".to_string(),
+        ))
+    })?;
+
+    plugin_manager.uninstall_plugin(&id).await.map_err(|e| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            format!("Failed to uninstall plugin: {}", e),
+        ))
+    })?;
+
+    Ok(Json(serde_json::json!({"uninstalled": true})))
+}
+
+/// Enable or disable a plugin
+pub async fn toggle_plugin(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    Json(req): Json<TogglePluginRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let plugin_manager = state.plugin_manager.as_ref().ok_or_else(|| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Plugin system is not enabled".to_string(),
+        ))
+    })?;
+
+    if req.enabled {
+        plugin_manager.enable_plugin(&id).await.map_err(|e| {
+            ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+                format!("Failed to enable plugin: {}", e),
+            ))
+        })?;
+    } else {
+        plugin_manager.disable_plugin(&id).await.map_err(|e| {
+            ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+                format!("Failed to disable plugin: {}", e),
+            ))
+        })?;
+    }
+
+    Ok(Json(serde_json::json!({
+        "id": id,
+        "enabled": req.enabled
+    })))
+}
+
+/// Reload a plugin (for development)
+pub async fn reload_plugin(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let plugin_manager = state.plugin_manager.as_ref().ok_or_else(|| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Plugin system is not enabled".to_string(),
+        ))
+    })?;
+
+    plugin_manager.reload_plugin(&id).await.map_err(|e| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            format!("Failed to reload plugin: {}", e),
+        ))
+    })?;
+
+    Ok(Json(serde_json::json!({"reloaded": true})))
+}

crates/pinakes-server/src/routes/social.rs

@@ -0,0 +1,199 @@
+use axum::Json;
+use axum::extract::{Extension, Path, Query, State};
+use serde::Deserialize;
+use uuid::Uuid;
+
+use crate::auth::resolve_user_id;
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::model::{MediaId, Pagination};
+
+#[derive(Deserialize)]
+pub struct ShareLinkQuery {
+    pub password: Option<String>,
+}
+
+// ===== Ratings =====
+
+pub async fn rate_media(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<CreateRatingRequest>,
+) -> Result<Json<RatingResponse>, ApiError> {
+    if req.stars < 1 || req.stars > 5 {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "stars must be between 1 and 5".into(),
+            ),
+        ));
+    }
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let rating = state
+        .storage
+        .rate_media(user_id, MediaId(id), req.stars, req.review_text.as_deref())
+        .await?;
+    Ok(Json(RatingResponse::from(rating)))
+}
+
+pub async fn get_media_ratings(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Vec<RatingResponse>>, ApiError> {
+    let ratings = state.storage.get_media_ratings(MediaId(id)).await?;
+    Ok(Json(
+        ratings.into_iter().map(RatingResponse::from).collect(),
+    ))
+}
+
+// ===== Comments =====
+
+pub async fn add_comment(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<CreateCommentRequest>,
+) -> Result<Json<CommentResponse>, ApiError> {
+    let char_count = req.text.chars().count();
+    if char_count == 0 || char_count > 10_000 {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "comment text must be 1-10000 characters".into(),
+            ),
+        ));
+    }
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let comment = state
+        .storage
+        .add_comment(user_id, MediaId(id), &req.text, req.parent_id)
+        .await?;
+    Ok(Json(CommentResponse::from(comment)))
+}
+
+pub async fn get_media_comments(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Vec<CommentResponse>>, ApiError> {
+    let comments = state.storage.get_media_comments(MediaId(id)).await?;
+    Ok(Json(
+        comments.into_iter().map(CommentResponse::from).collect(),
+    ))
+}
+
+// ===== Favorites =====
+
+pub async fn add_favorite(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Json(req): Json<FavoriteRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    state
+        .storage
+        .add_favorite(user_id, MediaId(req.media_id))
+        .await?;
+    Ok(Json(serde_json::json!({"added": true})))
+}
+
+pub async fn remove_favorite(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(media_id): Path<Uuid>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    state
+        .storage
+        .remove_favorite(user_id, MediaId(media_id))
+        .await?;
+    Ok(Json(serde_json::json!({"removed": true})))
+}
+
+pub async fn list_favorites(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+) -> Result<Json<Vec<MediaResponse>>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let items = state
+        .storage
+        .get_user_favorites(user_id, &Pagination::default())
+        .await?;
+    Ok(Json(items.into_iter().map(MediaResponse::from).collect()))
+}
+
+// ===== Share Links =====
+
+pub async fn create_share_link(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Json(req): Json<CreateShareLinkRequest>,
+) -> Result<Json<ShareLinkResponse>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let token = uuid::Uuid::now_v7().to_string().replace('-', "");
+    let password_hash = match req.password.as_ref() {
+        Some(p) => Some(pinakes_core::users::auth::hash_password(p).map_err(ApiError)?),
+        None => None,
+    };
+    const MAX_EXPIRY_HOURS: u64 = 8760; // 1 year
+    if let Some(h) = req.expires_in_hours
+        && h > MAX_EXPIRY_HOURS {
+            return Err(ApiError(
+                pinakes_core::error::PinakesError::InvalidOperation(format!(
+                    "expires_in_hours cannot exceed {}",
+                    MAX_EXPIRY_HOURS
+                )),
+            ));
+        }
+    let expires_at = req
+        .expires_in_hours
+        .map(|h| chrono::Utc::now() + chrono::Duration::hours(h as i64));
+    let link = state
+        .storage
+        .create_share_link(
+            MediaId(req.media_id),
+            user_id,
+            &token,
+            password_hash.as_deref(),
+            expires_at,
+        )
+        .await?;
+    Ok(Json(ShareLinkResponse::from(link)))
+}
+
+pub async fn access_shared_media(
+    State(state): State<AppState>,
+    Path(token): Path<String>,
+    Query(query): Query<ShareLinkQuery>,
+) -> Result<Json<MediaResponse>, ApiError> {
+    let link = state.storage.get_share_link(&token).await?;
+    // Check expiration
+    if let Some(expires) = link.expires_at
+        && chrono::Utc::now() > expires {
+            return Err(ApiError(
+                pinakes_core::error::PinakesError::InvalidOperation(
+                    "share link has expired".into(),
+                ),
+            ));
+        }
+    // Verify password if set
+    if let Some(ref hash) = link.password_hash {
+        let password = match query.password.as_deref() {
+            Some(p) => p,
+            None => {
+                return Err(ApiError(pinakes_core::error::PinakesError::Authentication(
+                    "password required for this share link".into(),
+                )));
+            }
+        };
+        let valid = pinakes_core::users::auth::verify_password(password, hash).unwrap_or(false);
+        if !valid {
+            return Err(ApiError(pinakes_core::error::PinakesError::Authentication(
+                "invalid share link password".into(),
+            )));
+        }
+    }
+    state.storage.increment_share_views(&token).await?;
+    let item = state.storage.get_media(link.media_id).await?;
+    Ok(Json(MediaResponse::from(item)))
+}

crates/pinakes-server/src/routes/streaming.rs

@@ -0,0 +1,238 @@
+use axum::extract::{Path, State};
+use axum::http::StatusCode;
+use percent_encoding::{NON_ALPHANUMERIC, utf8_percent_encode};
+use uuid::Uuid;
+
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::model::MediaId;
+use pinakes_core::transcode::{estimate_bandwidth, parse_resolution};
+
+fn escape_xml(s: &str) -> String {
+    s.replace('&', "&")
+        .replace('<', "&lt;")
+        .replace('>', "&gt;")
+        .replace('"', "&quot;")
+        .replace('\'', "&apos;")
+}
+
+pub async fn hls_master_playlist(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<axum::response::Response, ApiError> {
+    // Verify media exists
+    let _item = state.storage.get_media(MediaId(id)).await?;
+
+    let config = state.config.read().await;
+    let profiles = &config.transcoding.profiles;
+
+    let mut playlist = String::from("#EXTM3U\n#EXT-X-VERSION:3\n\n");
+
+    for profile in profiles {
+        let (w, h) = parse_resolution(&profile.max_resolution);
+        let bandwidth = estimate_bandwidth(profile);
+        let encoded_name = utf8_percent_encode(&profile.name, NON_ALPHANUMERIC).to_string();
+        playlist.push_str(&format!(
+            "#EXT-X-STREAM-INF:BANDWIDTH={bandwidth},RESOLUTION={w}x{h}\n\
+             /api/v1/media/{id}/stream/hls/{encoded_name}/playlist.m3u8\n\n",
+        ));
+    }
+
+    Ok(axum::response::Response::builder()
+        .header("Content-Type", "application/vnd.apple.mpegurl")
+        .body(axum::body::Body::from(playlist))
+        .unwrap())
+}
+
+pub async fn hls_variant_playlist(
+    State(state): State<AppState>,
+    Path((id, profile)): Path<(Uuid, String)>,
+) -> Result<axum::response::Response, ApiError> {
+    let item = state.storage.get_media(MediaId(id)).await?;
+    let duration = item.duration_secs.unwrap_or(0.0);
+    if duration <= 0.0 {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "cannot generate HLS playlist for media with unknown or zero duration".into(),
+            ),
+        ));
+    }
+    let segment_duration = 10.0;
+    let num_segments = (duration / segment_duration).ceil() as usize;
+
+    let mut playlist = String::from(
+        "#EXTM3U\n#EXT-X-VERSION:3\n#EXT-X-TARGETDURATION:10\n#EXT-X-MEDIA-SEQUENCE:0\n",
+    );
+    for i in 0..num_segments.max(1) {
+        let seg_dur = if i == num_segments.saturating_sub(1) && duration > 0.0 {
+            duration - (i as f64 * segment_duration)
+        } else {
+            segment_duration
+        };
+        playlist.push_str(&format!("#EXTINF:{seg_dur:.3},\n"));
+        playlist.push_str(&format!(
+            "/api/v1/media/{id}/stream/hls/{profile}/segment{i}.ts\n"
+        ));
+    }
+    playlist.push_str("#EXT-X-ENDLIST\n");
+
+    Ok(axum::response::Response::builder()
+        .header("Content-Type", "application/vnd.apple.mpegurl")
+        .body(axum::body::Body::from(playlist))
+        .unwrap())
+}
+
+pub async fn hls_segment(
+    State(state): State<AppState>,
+    Path((id, profile, segment)): Path<(Uuid, String, String)>,
+) -> Result<axum::response::Response, ApiError> {
+    // Strict validation: reject path traversal, null bytes, leading dots
+    if segment.is_empty()
+        || segment.starts_with('.')
+        || segment.contains('\0')
+        || segment.contains("..")
+        || segment.contains('/')
+        || segment.contains('\\')
+    {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation("invalid segment name".into()),
+        ));
+    }
+
+    let media_id = MediaId(id);
+
+    // Look for an active/completed transcode session
+    if let Some(transcode_service) = &state.transcode_service
+        && let Some(session) = transcode_service.find_session(media_id, &profile).await {
+            let segment_path = session.cache_path.join(&segment);
+
+            if segment_path.exists() {
+                let data = tokio::fs::read(&segment_path).await.map_err(|e| {
+                    ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+                        format!("failed to read segment: {}", e),
+                    ))
+                })?;
+
+                return Ok(axum::response::Response::builder()
+                    .header("Content-Type", "video/MP2T")
+                    .body(axum::body::Body::from(data))
+                    .unwrap());
+            }
+
+            // Session exists but segment not ready yet
+            return Ok(axum::response::Response::builder()
+                .status(StatusCode::ACCEPTED)
+                .header("Retry-After", "2")
+                .body(axum::body::Body::from("segment not yet available"))
+                .unwrap());
+        }
+
+    Err(ApiError(
+        pinakes_core::error::PinakesError::InvalidOperation(
+            "no transcode session found; start a transcode first via POST /media/{id}/transcode"
+                .into(),
+        ),
+    ))
+}
+
+pub async fn dash_manifest(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<axum::response::Response, ApiError> {
+    let item = state.storage.get_media(MediaId(id)).await?;
+    let duration = item.duration_secs.unwrap_or(0.0);
+    if duration <= 0.0 {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "cannot generate DASH manifest for media with unknown or zero duration".into(),
+            ),
+        ));
+    }
+    let hours = (duration / 3600.0) as u32;
+    let minutes = ((duration % 3600.0) / 60.0) as u32;
+    let seconds = duration % 60.0;
+
+    let config = state.config.read().await;
+    let profiles = &config.transcoding.profiles;
+
+    let mut representations = String::new();
+    for profile in profiles {
+        let (w, h) = parse_resolution(&profile.max_resolution);
+        let bandwidth = estimate_bandwidth(profile);
+        let xml_name = escape_xml(&profile.name);
+        let url_name = utf8_percent_encode(&profile.name, NON_ALPHANUMERIC).to_string();
+        representations.push_str(&format!(
+            r#"      <Representation id="{xml_name}" bandwidth="{bandwidth}" width="{w}" height="{h}">
+        <SegmentTemplate media="/api/v1/media/{id}/stream/dash/{url_name}/segment$Number$.m4s" initialization="/api/v1/media/{id}/stream/dash/{url_name}/init.mp4" duration="10000" timescale="1000" startNumber="0"/>
+      </Representation>
+"#,
+        ));
+    }
+
+    let mpd = format!(
+        r#"<?xml version="1.0" encoding="UTF-8"?>
+<MPD xmlns="urn:mpeg:dash:schema:mpd:2011" type="static" mediaPresentationDuration="PT{hours}H{minutes}M{seconds:.1}S" minBufferTime="PT1.5S">
+  <Period>
+    <AdaptationSet mimeType="video/mp4" segmentAlignment="true">
+{representations}    </AdaptationSet>
+  </Period>
+</MPD>"#
+    );
+
+    Ok(axum::response::Response::builder()
+        .header("Content-Type", "application/dash+xml")
+        .body(axum::body::Body::from(mpd))
+        .unwrap())
+}
+
+pub async fn dash_segment(
+    State(state): State<AppState>,
+    Path((id, profile, segment)): Path<(Uuid, String, String)>,
+) -> Result<axum::response::Response, ApiError> {
+    // Strict validation: reject path traversal, null bytes, leading dots
+    if segment.is_empty()
+        || segment.starts_with('.')
+        || segment.contains('\0')
+        || segment.contains("..")
+        || segment.contains('/')
+        || segment.contains('\\')
+    {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation("invalid segment name".into()),
+        ));
+    }
+
+    let media_id = MediaId(id);
+
+    if let Some(transcode_service) = &state.transcode_service
+        && let Some(session) = transcode_service.find_session(media_id, &profile).await {
+            let segment_path = session.cache_path.join(&segment);
+
+            if segment_path.exists() {
+                let data = tokio::fs::read(&segment_path).await.map_err(|e| {
+                    ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+                        format!("failed to read segment: {}", e),
+                    ))
+                })?;
+
+                return Ok(axum::response::Response::builder()
+                    .header("Content-Type", "video/mp4")
+                    .body(axum::body::Body::from(data))
+                    .unwrap());
+            }
+
+            return Ok(axum::response::Response::builder()
+                .status(StatusCode::ACCEPTED)
+                .header("Retry-After", "2")
+                .body(axum::body::Body::from("segment not yet available"))
+                .unwrap());
+        }
+
+    Err(ApiError(
+        pinakes_core::error::PinakesError::InvalidOperation(
+            "no transcode session found; start a transcode first via POST /media/{id}/transcode"
+                .into(),
+        ),
+    ))
+}

crates/pinakes-server/src/routes/subtitles.rs

@@ -0,0 +1,123 @@
+use axum::Json;
+use axum::extract::{Path, State};
+use uuid::Uuid;
+
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::model::MediaId;
+use pinakes_core::subtitles::{Subtitle, SubtitleFormat};
+
+pub async fn list_subtitles(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Vec<SubtitleResponse>>, ApiError> {
+    let subtitles = state.storage.get_media_subtitles(MediaId(id)).await?;
+    Ok(Json(
+        subtitles.into_iter().map(SubtitleResponse::from).collect(),
+    ))
+}
+
+pub async fn add_subtitle(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<AddSubtitleRequest>,
+) -> Result<Json<SubtitleResponse>, ApiError> {
+    let format: SubtitleFormat = req
+        .format
+        .parse()
+        .map_err(|e: String| ApiError(pinakes_core::error::PinakesError::InvalidOperation(e)))?;
+    let is_embedded = req.is_embedded.unwrap_or(false);
+    if !is_embedded && req.file_path.is_none() {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "file_path is required for non-embedded subtitles".into(),
+            ),
+        ));
+    }
+    if is_embedded && req.track_index.is_none() {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "track_index is required for embedded subtitles".into(),
+            ),
+        ));
+    }
+    let subtitle = Subtitle {
+        id: Uuid::now_v7(),
+        media_id: MediaId(id),
+        language: req.language,
+        format,
+        file_path: req.file_path.map(std::path::PathBuf::from),
+        is_embedded,
+        track_index: req.track_index,
+        offset_ms: req.offset_ms.unwrap_or(0),
+        created_at: chrono::Utc::now(),
+    };
+    state.storage.add_subtitle(&subtitle).await?;
+    Ok(Json(SubtitleResponse::from(subtitle)))
+}
+
+pub async fn delete_subtitle(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    state.storage.delete_subtitle(id).await?;
+    Ok(Json(serde_json::json!({"deleted": true})))
+}
+
+pub async fn get_subtitle_content(
+    State(state): State<AppState>,
+    Path((media_id, subtitle_id)): Path<(Uuid, Uuid)>,
+) -> Result<axum::response::Response, ApiError> {
+    let subtitles = state.storage.get_media_subtitles(MediaId(media_id)).await?;
+    let subtitle = subtitles
+        .into_iter()
+        .find(|s| s.id == subtitle_id)
+        .ok_or_else(|| {
+            ApiError(pinakes_core::error::PinakesError::NotFound(format!(
+                "subtitle {subtitle_id}"
+            )))
+        })?;
+
+    if let Some(ref path) = subtitle.file_path {
+        let content = tokio::fs::read_to_string(path).await.map_err(|e| {
+            if e.kind() == std::io::ErrorKind::NotFound {
+                ApiError(pinakes_core::error::PinakesError::FileNotFound(
+                    path.clone(),
+                ))
+            } else {
+                ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+                    format!("failed to read subtitle file {}: {}", path.display(), e),
+                ))
+            }
+        })?;
+        let content_type = match subtitle.format {
+            SubtitleFormat::Vtt => "text/vtt",
+            SubtitleFormat::Srt => "application/x-subrip",
+            _ => "text/plain",
+        };
+        Ok(axum::response::Response::builder()
+            .header("Content-Type", content_type)
+            .body(axum::body::Body::from(content))
+            .unwrap())
+    } else {
+        Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "subtitle is embedded, no file to serve".into(),
+            ),
+        ))
+    }
+}
+
+pub async fn update_offset(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<UpdateSubtitleOffsetRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    state
+        .storage
+        .update_subtitle_offset(id, req.offset_ms)
+        .await?;
+    Ok(Json(serde_json::json!({"updated": true})))
+}

crates/pinakes-server/src/routes/transcode.rs

@@ -0,0 +1,63 @@
+use axum::Json;
+use axum::extract::{Path, Query, State};
+use uuid::Uuid;
+
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::model::MediaId;
+
+pub async fn start_transcode(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<CreateTranscodeRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let job_id = state
+        .job_queue
+        .submit(pinakes_core::jobs::JobKind::Transcode {
+            media_id: MediaId(id),
+            profile: req.profile,
+        })
+        .await;
+    Ok(Json(serde_json::json!({"job_id": job_id.to_string()})))
+}
+
+pub async fn get_session(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<TranscodeSessionResponse>, ApiError> {
+    let session = state.storage.get_transcode_session(id).await?;
+    Ok(Json(TranscodeSessionResponse::from(session)))
+}
+
+pub async fn list_sessions(
+    State(state): State<AppState>,
+    Query(params): Query<PaginationParams>,
+) -> Result<Json<Vec<TranscodeSessionResponse>>, ApiError> {
+    let _ = params; // reserved for future filtering
+    let sessions = state.storage.list_transcode_sessions(None).await?;
+    Ok(Json(
+        sessions
+            .into_iter()
+            .map(TranscodeSessionResponse::from)
+            .collect(),
+    ))
+}
+
+pub async fn cancel_session(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    if let Some(transcode_service) = &state.transcode_service {
+        transcode_service
+            .cancel_transcode(id, &state.storage)
+            .await?;
+    } else {
+        state
+            .storage
+            .update_transcode_status(id, pinakes_core::transcode::TranscodeStatus::Cancelled, 0.0)
+            .await?;
+    }
+    Ok(Json(serde_json::json!({"cancelled": true})))
+}

crates/pinakes-server/src/routes/users.rs

@@ -0,0 +1,191 @@
+use axum::Json;
+use axum::extract::{Path, State};
+
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::users::{CreateUserRequest, UpdateUserRequest, UserId};
+
+/// List all users (admin only)
+pub async fn list_users(
+    State(state): State<AppState>,
+) -> Result<Json<Vec<UserResponse>>, ApiError> {
+    let users = state.storage.list_users().await?;
+    Ok(Json(users.into_iter().map(UserResponse::from).collect()))
+}
+
+/// Create a new user (admin only)
+pub async fn create_user(
+    State(state): State<AppState>,
+    Json(req): Json<CreateUserRequest>,
+) -> Result<Json<UserResponse>, ApiError> {
+    // Validate username
+    if req.username.is_empty() || req.username.len() > 255 {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "username must be 1-255 characters".into(),
+            ),
+        ));
+    }
+
+    // Validate password
+    if req.password.len() < 8 {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "password must be at least 8 characters".into(),
+            ),
+        ));
+    }
+
+    // Hash password
+    let password_hash = pinakes_core::users::auth::hash_password(&req.password)?;
+
+    // Create user - rely on DB unique constraint for username to avoid TOCTOU race
+    let user = state
+        .storage
+        .create_user(&req.username, &password_hash, req.role, req.profile)
+        .await
+        .map_err(|e| {
+            // Map unique constraint violations to a user-friendly conflict error
+            let err_str = e.to_string();
+            if err_str.contains("UNIQUE")
+                || err_str.contains("unique")
+                || err_str.contains("duplicate key")
+            {
+                ApiError(pinakes_core::error::PinakesError::DuplicateHash(
+                    "username already exists".into(),
+                ))
+            } else {
+                ApiError(e)
+            }
+        })?;
+
+    Ok(Json(UserResponse::from(user)))
+}
+
+/// Get a specific user by ID
+pub async fn get_user(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<UserResponse>, ApiError> {
+    let user_id: UserId = id.parse::<uuid::Uuid>().map(UserId::from).map_err(|_| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Invalid user ID".into(),
+        ))
+    })?;
+
+    let user = state.storage.get_user(user_id).await?;
+    Ok(Json(UserResponse::from(user)))
+}
+
+/// Update a user
+pub async fn update_user(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    Json(req): Json<UpdateUserRequest>,
+) -> Result<Json<UserResponse>, ApiError> {
+    let user_id: UserId = id.parse::<uuid::Uuid>().map(UserId::from).map_err(|_| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Invalid user ID".into(),
+        ))
+    })?;
+
+    // Hash password if provided
+    let password_hash = if let Some(ref password) = req.password {
+        if password.len() < 8 {
+            return Err(ApiError(
+                pinakes_core::error::PinakesError::InvalidOperation(
+                    "password must be at least 8 characters".into(),
+                ),
+            ));
+        }
+        Some(pinakes_core::users::auth::hash_password(password)?)
+    } else {
+        None
+    };
+
+    let user = state
+        .storage
+        .update_user(user_id, password_hash.as_deref(), req.role, req.profile)
+        .await?;
+
+    Ok(Json(UserResponse::from(user)))
+}
+
+/// Delete a user (admin only)
+pub async fn delete_user(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id: UserId = id.parse::<uuid::Uuid>().map(UserId::from).map_err(|_| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Invalid user ID".into(),
+        ))
+    })?;
+
+    state.storage.delete_user(user_id).await?;
+    Ok(Json(serde_json::json!({"deleted": true})))
+}
+
+/// Get user's accessible libraries
+pub async fn get_user_libraries(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<Vec<UserLibraryResponse>>, ApiError> {
+    let user_id: UserId = id.parse::<uuid::Uuid>().map(UserId::from).map_err(|_| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Invalid user ID".into(),
+        ))
+    })?;
+
+    let libraries = state.storage.get_user_libraries(user_id).await?;
+    Ok(Json(
+        libraries
+            .into_iter()
+            .map(UserLibraryResponse::from)
+            .collect(),
+    ))
+}
+
+/// Grant library access to a user (admin only)
+pub async fn grant_library_access(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    Json(req): Json<GrantLibraryAccessRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id: UserId = id.parse::<uuid::Uuid>().map(UserId::from).map_err(|_| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Invalid user ID".into(),
+        ))
+    })?;
+
+    state
+        .storage
+        .grant_library_access(user_id, &req.root_path, req.permission)
+        .await?;
+
+    Ok(Json(serde_json::json!({"granted": true})))
+}
+
+/// Revoke library access from a user (admin only)
+///
+/// Uses a JSON body instead of a path parameter because root_path may contain
+/// slashes that conflict with URL routing.
+pub async fn revoke_library_access(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    Json(req): Json<RevokeLibraryAccessRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id: UserId = id.parse::<uuid::Uuid>().map(UserId::from).map_err(|_| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Invalid user ID".into(),
+        ))
+    })?;
+
+    state
+        .storage
+        .revoke_library_access(user_id, &req.root_path)
+        .await?;
+    Ok(Json(serde_json::json!({"revoked": true})))
+}

crates/pinakes-server/src/state.rs

@@ -7,9 +7,11 @@ use tokio::sync::RwLock;
 use pinakes_core::cache::CacheLayer;
 use pinakes_core::config::{Config, UserRole};
 use pinakes_core::jobs::JobQueue;
+use pinakes_core::plugin::PluginManager;
 use pinakes_core::scan::ScanProgress;
 use pinakes_core::scheduler::TaskScheduler;
 use pinakes_core::storage::DynStorageBackend;
+use pinakes_core::transcode::TranscodeService;
 
 /// Default session TTL: 24 hours.
 pub const SESSION_TTL_SECS: i64 = 24 * 60 * 60;
@@ -47,4 +49,6 @@ pub struct AppState {
     pub job_queue: Arc<JobQueue>,
     pub cache: Arc<CacheLayer>,
     pub scheduler: Arc<TaskScheduler>,
+    pub plugin_manager: Option<Arc<PluginManager>>,
+    pub transcode_service: Option<Arc<TranscodeService>>,
 }