various: simplify code; work on security and performance

Signed-off-by: NotAShelf <raf@notashelf.dev>
Change-Id: I9a5114addcab5fbff430ab2b919b83466a6a6964

crates/pinakes-server/src/routes/analytics.rs

@@ -0,0 +1,94 @@
+use axum::Json;
+use axum::extract::{Extension, Path, Query, State};
+use uuid::Uuid;
+
+use crate::auth::resolve_user_id;
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::analytics::{UsageEvent, UsageEventType};
+use pinakes_core::model::MediaId;
+
+const MAX_LIMIT: u64 = 100;
+
+pub async fn get_most_viewed(
+    State(state): State<AppState>,
+    Query(params): Query<PaginationParams>,
+) -> Result<Json<Vec<MostViewedResponse>>, ApiError> {
+    let limit = params.limit.unwrap_or(20).min(MAX_LIMIT);
+    let results = state.storage.get_most_viewed(limit).await?;
+    Ok(Json(
+        results
+            .into_iter()
+            .map(|(item, count)| MostViewedResponse {
+                media: MediaResponse::from(item),
+                view_count: count,
+            })
+            .collect(),
+    ))
+}
+
+pub async fn get_recently_viewed(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Query(params): Query<PaginationParams>,
+) -> Result<Json<Vec<MediaResponse>>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let limit = params.limit.unwrap_or(20).min(MAX_LIMIT);
+    let items = state.storage.get_recently_viewed(user_id, limit).await?;
+    Ok(Json(items.into_iter().map(MediaResponse::from).collect()))
+}
+
+pub async fn record_event(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Json(req): Json<RecordUsageEventRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let event_type: UsageEventType = req
+        .event_type
+        .parse()
+        .map_err(|e: String| ApiError(pinakes_core::error::PinakesError::InvalidOperation(e)))?;
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let event = UsageEvent {
+        id: Uuid::now_v7(),
+        media_id: req.media_id.map(MediaId),
+        user_id: Some(user_id),
+        event_type,
+        timestamp: chrono::Utc::now(),
+        duration_secs: req.duration_secs,
+        context_json: req.context.map(|v| v.to_string()),
+    };
+    state.storage.record_usage_event(&event).await?;
+    Ok(Json(serde_json::json!({"recorded": true})))
+}
+
+pub async fn get_watch_progress(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<WatchProgressResponse>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let progress = state
+        .storage
+        .get_watch_progress(user_id, MediaId(id))
+        .await?
+        .unwrap_or(0.0);
+    Ok(Json(WatchProgressResponse {
+        progress_secs: progress,
+    }))
+}
+
+pub async fn update_watch_progress(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<WatchProgressRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    state
+        .storage
+        .update_watch_progress(user_id, MediaId(id), req.progress_secs)
+        .await?;
+    Ok(Json(serde_json::json!({"updated": true})))
+}

crates/pinakes-server/src/routes/enrichment.rs

@@ -0,0 +1,48 @@
+use axum::Json;
+use axum::extract::{Path, State};
+use uuid::Uuid;
+
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::model::MediaId;
+
+pub async fn trigger_enrichment(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    // Submit enrichment as a background job
+    let job_id = state
+        .job_queue
+        .submit(pinakes_core::jobs::JobKind::Enrich {
+            media_ids: vec![MediaId(id)],
+        })
+        .await;
+    Ok(Json(serde_json::json!({"job_id": job_id.to_string()})))
+}
+
+pub async fn get_external_metadata(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Vec<ExternalMetadataResponse>>, ApiError> {
+    let metadata = state.storage.get_external_metadata(MediaId(id)).await?;
+    Ok(Json(
+        metadata
+            .into_iter()
+            .map(ExternalMetadataResponse::from)
+            .collect(),
+    ))
+}
+
+pub async fn batch_enrich(
+    State(state): State<AppState>,
+    Json(req): Json<BatchDeleteRequest>, // Reuse: has media_ids field
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let media_ids: Vec<MediaId> = req.media_ids.into_iter().map(MediaId).collect();
+    let job_id = state
+        .job_queue
+        .submit(pinakes_core::jobs::JobKind::Enrich { media_ids })
+        .await;
+    Ok(Json(serde_json::json!({"job_id": job_id.to_string()})))
+}

crates/pinakes-server/src/routes/integrity.rs

@@ -26,7 +26,7 @@ pub async fn trigger_verify_integrity(
     let media_ids = req
         .media_ids
         .into_iter()
-        .map(|id| pinakes_core::model::MediaId(id))
+        .map(pinakes_core::model::MediaId)
         .collect();
     let kind = pinakes_core::jobs::JobKind::VerifyIntegrity { media_ids };
     let job_id = state.job_queue.submit(kind).await;
@@ -94,6 +94,6 @@ pub async fn resolve_orphans(
         .collect();
     let count = pinakes_core::integrity::resolve_orphans(&state.storage, action, &ids)
         .await
-        .map_err(|e| ApiError(e))?;
+        .map_err(ApiError)?;
     Ok(Json(serde_json::json!({ "resolved": count })))
 }

crates/pinakes-server/src/routes/mod.rs

@@ -1,18 +1,27 @@
+pub mod analytics;
 pub mod audit;
 pub mod auth;
 pub mod collections;
 pub mod config;
 pub mod database;
 pub mod duplicates;
+pub mod enrichment;
 pub mod export;
 pub mod health;
 pub mod integrity;
 pub mod jobs;
 pub mod media;
+pub mod playlists;
+pub mod plugins;
 pub mod saved_searches;
 pub mod scan;
 pub mod scheduled_tasks;
 pub mod search;
+pub mod social;
 pub mod statistics;
+pub mod streaming;
+pub mod subtitles;
 pub mod tags;
+pub mod transcode;
+pub mod users;
 pub mod webhooks;

crates/pinakes-server/src/routes/playlists.rs

@@ -0,0 +1,208 @@
+use axum::Json;
+use axum::extract::{Extension, Path, State};
+use uuid::Uuid;
+
+use crate::auth::resolve_user_id;
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::model::MediaId;
+use pinakes_core::playlists::Playlist;
+use pinakes_core::users::UserId;
+
+/// Check whether a user has access to a playlist.
+///
+/// * `require_write` – when `true` only the playlist owner is allowed (for
+///   mutations such as update, delete, add/remove/reorder items).  When `false`
+///   the playlist must either be public or owned by the requesting user.
+async fn check_playlist_access(
+    storage: &pinakes_core::storage::DynStorageBackend,
+    playlist_id: Uuid,
+    user_id: UserId,
+    require_write: bool,
+) -> Result<Playlist, ApiError> {
+    let playlist = storage.get_playlist(playlist_id).await.map_err(ApiError)?;
+    if require_write {
+        // Write operations require ownership
+        if playlist.owner_id != user_id {
+            return Err(ApiError(pinakes_core::error::PinakesError::Authorization(
+                "only the playlist owner can modify this playlist".into(),
+            )));
+        }
+    } else {
+        // Read operations: allow if public or owner
+        if !playlist.is_public && playlist.owner_id != user_id {
+            return Err(ApiError(pinakes_core::error::PinakesError::Authorization(
+                "playlist is private".into(),
+            )));
+        }
+    }
+    Ok(playlist)
+}
+
+pub async fn create_playlist(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Json(req): Json<CreatePlaylistRequest>,
+) -> Result<Json<PlaylistResponse>, ApiError> {
+    if req.name.is_empty() || req.name.chars().count() > 255 {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "playlist name must be 1-255 characters".into(),
+            ),
+        ));
+    }
+    let owner_id = resolve_user_id(&state.storage, &username).await?;
+    let playlist = state
+        .storage
+        .create_playlist(
+            owner_id,
+            &req.name,
+            req.description.as_deref(),
+            req.is_public.unwrap_or(false),
+            req.is_smart.unwrap_or(false),
+            req.filter_query.as_deref(),
+        )
+        .await?;
+    Ok(Json(PlaylistResponse::from(playlist)))
+}
+
+pub async fn list_playlists(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+) -> Result<Json<Vec<PlaylistResponse>>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    // Fetch all playlists and filter to only public ones plus the user's own
+    let playlists = state.storage.list_playlists(None).await?;
+    let visible: Vec<PlaylistResponse> = playlists
+        .into_iter()
+        .filter(|p| p.is_public || p.owner_id == user_id)
+        .map(PlaylistResponse::from)
+        .collect();
+    Ok(Json(visible))
+}
+
+pub async fn get_playlist(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<PlaylistResponse>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let playlist = check_playlist_access(&state.storage, id, user_id, false).await?;
+    Ok(Json(PlaylistResponse::from(playlist)))
+}
+
+pub async fn update_playlist(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<UpdatePlaylistRequest>,
+) -> Result<Json<PlaylistResponse>, ApiError> {
+    if let Some(ref name) = req.name
+        && (name.is_empty() || name.chars().count() > 255) {
+            return Err(ApiError(
+                pinakes_core::error::PinakesError::InvalidOperation(
+                    "playlist name must be 1-255 characters".into(),
+                ),
+            ));
+        }
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    check_playlist_access(&state.storage, id, user_id, true).await?;
+    let playlist = state
+        .storage
+        .update_playlist(
+            id,
+            req.name.as_deref(),
+            req.description.as_deref(),
+            req.is_public,
+        )
+        .await?;
+    Ok(Json(PlaylistResponse::from(playlist)))
+}
+
+pub async fn delete_playlist(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    check_playlist_access(&state.storage, id, user_id, true).await?;
+    state.storage.delete_playlist(id).await?;
+    Ok(Json(serde_json::json!({"deleted": true})))
+}
+
+pub async fn add_item(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<PlaylistItemRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    check_playlist_access(&state.storage, id, user_id, true).await?;
+    let position = match req.position {
+        Some(p) => p,
+        None => {
+            let items = state.storage.get_playlist_items(id).await?;
+            items.len() as i32
+        }
+    };
+    state
+        .storage
+        .add_to_playlist(id, MediaId(req.media_id), position)
+        .await?;
+    Ok(Json(serde_json::json!({"added": true})))
+}
+
+pub async fn remove_item(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path((id, media_id)): Path<(Uuid, Uuid)>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    check_playlist_access(&state.storage, id, user_id, true).await?;
+    state
+        .storage
+        .remove_from_playlist(id, MediaId(media_id))
+        .await?;
+    Ok(Json(serde_json::json!({"removed": true})))
+}
+
+pub async fn list_items(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Vec<MediaResponse>>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    check_playlist_access(&state.storage, id, user_id, false).await?;
+    let items = state.storage.get_playlist_items(id).await?;
+    Ok(Json(items.into_iter().map(MediaResponse::from).collect()))
+}
+
+pub async fn reorder_item(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<ReorderPlaylistRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    check_playlist_access(&state.storage, id, user_id, true).await?;
+    state
+        .storage
+        .reorder_playlist(id, MediaId(req.media_id), req.new_position)
+        .await?;
+    Ok(Json(serde_json::json!({"reordered": true})))
+}
+
+pub async fn shuffle_playlist(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Vec<MediaResponse>>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    check_playlist_access(&state.storage, id, user_id, false).await?;
+    use rand::seq::SliceRandom;
+    let mut items = state.storage.get_playlist_items(id).await?;
+    items.shuffle(&mut rand::rng());
+    Ok(Json(items.into_iter().map(MediaResponse::from).collect()))
+}

crates/pinakes-server/src/routes/plugins.rs

@@ -0,0 +1,149 @@
+use axum::Json;
+use axum::extract::{Path, State};
+
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+/// List all installed plugins
+pub async fn list_plugins(
+    State(state): State<AppState>,
+) -> Result<Json<Vec<PluginResponse>>, ApiError> {
+    let plugin_manager = state.plugin_manager.as_ref().ok_or_else(|| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Plugin system is not enabled".to_string(),
+        ))
+    })?;
+
+    let plugins = plugin_manager.list_plugins().await;
+    let mut responses = Vec::with_capacity(plugins.len());
+    for meta in plugins {
+        let enabled = plugin_manager.is_plugin_enabled(&meta.id).await;
+        responses.push(PluginResponse::new(meta, enabled));
+    }
+    Ok(Json(responses))
+}
+
+/// Get a specific plugin by ID
+pub async fn get_plugin(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<PluginResponse>, ApiError> {
+    let plugin_manager = state.plugin_manager.as_ref().ok_or_else(|| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Plugin system is not enabled".to_string(),
+        ))
+    })?;
+
+    let plugin = plugin_manager.get_plugin(&id).await.ok_or_else(|| {
+        ApiError(pinakes_core::error::PinakesError::NotFound(format!(
+            "Plugin not found: {}",
+            id
+        )))
+    })?;
+
+    let enabled = plugin_manager.is_plugin_enabled(&id).await;
+    Ok(Json(PluginResponse::new(plugin, enabled)))
+}
+
+/// Install a plugin from URL or file path
+pub async fn install_plugin(
+    State(state): State<AppState>,
+    Json(req): Json<InstallPluginRequest>,
+) -> Result<Json<PluginResponse>, ApiError> {
+    let plugin_manager = state.plugin_manager.as_ref().ok_or_else(|| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Plugin system is not enabled".to_string(),
+        ))
+    })?;
+
+    let plugin_id = plugin_manager
+        .install_plugin(&req.source)
+        .await
+        .map_err(|e| {
+            ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+                format!("Failed to install plugin: {}", e),
+            ))
+        })?;
+
+    let plugin = plugin_manager.get_plugin(&plugin_id).await.ok_or_else(|| {
+        ApiError(pinakes_core::error::PinakesError::NotFound(
+            "Plugin installed but not found".to_string(),
+        ))
+    })?;
+
+    let enabled = plugin_manager.is_plugin_enabled(&plugin_id).await;
+    Ok(Json(PluginResponse::new(plugin, enabled)))
+}
+
+/// Uninstall a plugin
+pub async fn uninstall_plugin(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let plugin_manager = state.plugin_manager.as_ref().ok_or_else(|| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Plugin system is not enabled".to_string(),
+        ))
+    })?;
+
+    plugin_manager.uninstall_plugin(&id).await.map_err(|e| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            format!("Failed to uninstall plugin: {}", e),
+        ))
+    })?;
+
+    Ok(Json(serde_json::json!({"uninstalled": true})))
+}
+
+/// Enable or disable a plugin
+pub async fn toggle_plugin(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    Json(req): Json<TogglePluginRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let plugin_manager = state.plugin_manager.as_ref().ok_or_else(|| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Plugin system is not enabled".to_string(),
+        ))
+    })?;
+
+    if req.enabled {
+        plugin_manager.enable_plugin(&id).await.map_err(|e| {
+            ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+                format!("Failed to enable plugin: {}", e),
+            ))
+        })?;
+    } else {
+        plugin_manager.disable_plugin(&id).await.map_err(|e| {
+            ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+                format!("Failed to disable plugin: {}", e),
+            ))
+        })?;
+    }
+
+    Ok(Json(serde_json::json!({
+        "id": id,
+        "enabled": req.enabled
+    })))
+}
+
+/// Reload a plugin (for development)
+pub async fn reload_plugin(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let plugin_manager = state.plugin_manager.as_ref().ok_or_else(|| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Plugin system is not enabled".to_string(),
+        ))
+    })?;
+
+    plugin_manager.reload_plugin(&id).await.map_err(|e| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            format!("Failed to reload plugin: {}", e),
+        ))
+    })?;
+
+    Ok(Json(serde_json::json!({"reloaded": true})))
+}

crates/pinakes-server/src/routes/social.rs

@@ -0,0 +1,199 @@
+use axum::Json;
+use axum::extract::{Extension, Path, Query, State};
+use serde::Deserialize;
+use uuid::Uuid;
+
+use crate::auth::resolve_user_id;
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::model::{MediaId, Pagination};
+
+#[derive(Deserialize)]
+pub struct ShareLinkQuery {
+    pub password: Option<String>,
+}
+
+// ===== Ratings =====
+
+pub async fn rate_media(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<CreateRatingRequest>,
+) -> Result<Json<RatingResponse>, ApiError> {
+    if req.stars < 1 || req.stars > 5 {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "stars must be between 1 and 5".into(),
+            ),
+        ));
+    }
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let rating = state
+        .storage
+        .rate_media(user_id, MediaId(id), req.stars, req.review_text.as_deref())
+        .await?;
+    Ok(Json(RatingResponse::from(rating)))
+}
+
+pub async fn get_media_ratings(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Vec<RatingResponse>>, ApiError> {
+    let ratings = state.storage.get_media_ratings(MediaId(id)).await?;
+    Ok(Json(
+        ratings.into_iter().map(RatingResponse::from).collect(),
+    ))
+}
+
+// ===== Comments =====
+
+pub async fn add_comment(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<CreateCommentRequest>,
+) -> Result<Json<CommentResponse>, ApiError> {
+    let char_count = req.text.chars().count();
+    if char_count == 0 || char_count > 10_000 {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "comment text must be 1-10000 characters".into(),
+            ),
+        ));
+    }
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let comment = state
+        .storage
+        .add_comment(user_id, MediaId(id), &req.text, req.parent_id)
+        .await?;
+    Ok(Json(CommentResponse::from(comment)))
+}
+
+pub async fn get_media_comments(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Vec<CommentResponse>>, ApiError> {
+    let comments = state.storage.get_media_comments(MediaId(id)).await?;
+    Ok(Json(
+        comments.into_iter().map(CommentResponse::from).collect(),
+    ))
+}
+
+// ===== Favorites =====
+
+pub async fn add_favorite(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Json(req): Json<FavoriteRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    state
+        .storage
+        .add_favorite(user_id, MediaId(req.media_id))
+        .await?;
+    Ok(Json(serde_json::json!({"added": true})))
+}
+
+pub async fn remove_favorite(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(media_id): Path<Uuid>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    state
+        .storage
+        .remove_favorite(user_id, MediaId(media_id))
+        .await?;
+    Ok(Json(serde_json::json!({"removed": true})))
+}
+
+pub async fn list_favorites(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+) -> Result<Json<Vec<MediaResponse>>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let items = state
+        .storage
+        .get_user_favorites(user_id, &Pagination::default())
+        .await?;
+    Ok(Json(items.into_iter().map(MediaResponse::from).collect()))
+}
+
+// ===== Share Links =====
+
+pub async fn create_share_link(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Json(req): Json<CreateShareLinkRequest>,
+) -> Result<Json<ShareLinkResponse>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let token = uuid::Uuid::now_v7().to_string().replace('-', "");
+    let password_hash = match req.password.as_ref() {
+        Some(p) => Some(pinakes_core::users::auth::hash_password(p).map_err(ApiError)?),
+        None => None,
+    };
+    const MAX_EXPIRY_HOURS: u64 = 8760; // 1 year
+    if let Some(h) = req.expires_in_hours
+        && h > MAX_EXPIRY_HOURS {
+            return Err(ApiError(
+                pinakes_core::error::PinakesError::InvalidOperation(format!(
+                    "expires_in_hours cannot exceed {}",
+                    MAX_EXPIRY_HOURS
+                )),
+            ));
+        }
+    let expires_at = req
+        .expires_in_hours
+        .map(|h| chrono::Utc::now() + chrono::Duration::hours(h as i64));
+    let link = state
+        .storage
+        .create_share_link(
+            MediaId(req.media_id),
+            user_id,
+            &token,
+            password_hash.as_deref(),
+            expires_at,
+        )
+        .await?;
+    Ok(Json(ShareLinkResponse::from(link)))
+}
+
+pub async fn access_shared_media(
+    State(state): State<AppState>,
+    Path(token): Path<String>,
+    Query(query): Query<ShareLinkQuery>,
+) -> Result<Json<MediaResponse>, ApiError> {
+    let link = state.storage.get_share_link(&token).await?;
+    // Check expiration
+    if let Some(expires) = link.expires_at
+        && chrono::Utc::now() > expires {
+            return Err(ApiError(
+                pinakes_core::error::PinakesError::InvalidOperation(
+                    "share link has expired".into(),
+                ),
+            ));
+        }
+    // Verify password if set
+    if let Some(ref hash) = link.password_hash {
+        let password = match query.password.as_deref() {
+            Some(p) => p,
+            None => {
+                return Err(ApiError(pinakes_core::error::PinakesError::Authentication(
+                    "password required for this share link".into(),
+                )));
+            }
+        };
+        let valid = pinakes_core::users::auth::verify_password(password, hash).unwrap_or(false);
+        if !valid {
+            return Err(ApiError(pinakes_core::error::PinakesError::Authentication(
+                "invalid share link password".into(),
+            )));
+        }
+    }
+    state.storage.increment_share_views(&token).await?;
+    let item = state.storage.get_media(link.media_id).await?;
+    Ok(Json(MediaResponse::from(item)))
+}

crates/pinakes-server/src/routes/streaming.rs

@@ -0,0 +1,238 @@
+use axum::extract::{Path, State};
+use axum::http::StatusCode;
+use percent_encoding::{NON_ALPHANUMERIC, utf8_percent_encode};
+use uuid::Uuid;
+
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::model::MediaId;
+use pinakes_core::transcode::{estimate_bandwidth, parse_resolution};
+
+fn escape_xml(s: &str) -> String {
+    s.replace('&', "&")
+        .replace('<', "&lt;")
+        .replace('>', "&gt;")
+        .replace('"', "&quot;")
+        .replace('\'', "&apos;")
+}
+
+pub async fn hls_master_playlist(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<axum::response::Response, ApiError> {
+    // Verify media exists
+    let _item = state.storage.get_media(MediaId(id)).await?;
+
+    let config = state.config.read().await;
+    let profiles = &config.transcoding.profiles;
+
+    let mut playlist = String::from("#EXTM3U\n#EXT-X-VERSION:3\n\n");
+
+    for profile in profiles {
+        let (w, h) = parse_resolution(&profile.max_resolution);
+        let bandwidth = estimate_bandwidth(profile);
+        let encoded_name = utf8_percent_encode(&profile.name, NON_ALPHANUMERIC).to_string();
+        playlist.push_str(&format!(
+            "#EXT-X-STREAM-INF:BANDWIDTH={bandwidth},RESOLUTION={w}x{h}\n\
+             /api/v1/media/{id}/stream/hls/{encoded_name}/playlist.m3u8\n\n",
+        ));
+    }
+
+    Ok(axum::response::Response::builder()
+        .header("Content-Type", "application/vnd.apple.mpegurl")
+        .body(axum::body::Body::from(playlist))
+        .unwrap())
+}
+
+pub async fn hls_variant_playlist(
+    State(state): State<AppState>,
+    Path((id, profile)): Path<(Uuid, String)>,
+) -> Result<axum::response::Response, ApiError> {
+    let item = state.storage.get_media(MediaId(id)).await?;
+    let duration = item.duration_secs.unwrap_or(0.0);
+    if duration <= 0.0 {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "cannot generate HLS playlist for media with unknown or zero duration".into(),
+            ),
+        ));
+    }
+    let segment_duration = 10.0;
+    let num_segments = (duration / segment_duration).ceil() as usize;
+
+    let mut playlist = String::from(
+        "#EXTM3U\n#EXT-X-VERSION:3\n#EXT-X-TARGETDURATION:10\n#EXT-X-MEDIA-SEQUENCE:0\n",
+    );
+    for i in 0..num_segments.max(1) {
+        let seg_dur = if i == num_segments.saturating_sub(1) && duration > 0.0 {
+            duration - (i as f64 * segment_duration)
+        } else {
+            segment_duration
+        };
+        playlist.push_str(&format!("#EXTINF:{seg_dur:.3},\n"));
+        playlist.push_str(&format!(
+            "/api/v1/media/{id}/stream/hls/{profile}/segment{i}.ts\n"
+        ));
+    }
+    playlist.push_str("#EXT-X-ENDLIST\n");
+
+    Ok(axum::response::Response::builder()
+        .header("Content-Type", "application/vnd.apple.mpegurl")
+        .body(axum::body::Body::from(playlist))
+        .unwrap())
+}
+
+pub async fn hls_segment(
+    State(state): State<AppState>,
+    Path((id, profile, segment)): Path<(Uuid, String, String)>,
+) -> Result<axum::response::Response, ApiError> {
+    // Strict validation: reject path traversal, null bytes, leading dots
+    if segment.is_empty()
+        || segment.starts_with('.')
+        || segment.contains('\0')
+        || segment.contains("..")
+        || segment.contains('/')
+        || segment.contains('\\')
+    {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation("invalid segment name".into()),
+        ));
+    }
+
+    let media_id = MediaId(id);
+
+    // Look for an active/completed transcode session
+    if let Some(transcode_service) = &state.transcode_service
+        && let Some(session) = transcode_service.find_session(media_id, &profile).await {
+            let segment_path = session.cache_path.join(&segment);
+
+            if segment_path.exists() {
+                let data = tokio::fs::read(&segment_path).await.map_err(|e| {
+                    ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+                        format!("failed to read segment: {}", e),
+                    ))
+                })?;
+
+                return Ok(axum::response::Response::builder()
+                    .header("Content-Type", "video/MP2T")
+                    .body(axum::body::Body::from(data))
+                    .unwrap());
+            }
+
+            // Session exists but segment not ready yet
+            return Ok(axum::response::Response::builder()
+                .status(StatusCode::ACCEPTED)
+                .header("Retry-After", "2")
+                .body(axum::body::Body::from("segment not yet available"))
+                .unwrap());
+        }
+
+    Err(ApiError(
+        pinakes_core::error::PinakesError::InvalidOperation(
+            "no transcode session found; start a transcode first via POST /media/{id}/transcode"
+                .into(),
+        ),
+    ))
+}
+
+pub async fn dash_manifest(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<axum::response::Response, ApiError> {
+    let item = state.storage.get_media(MediaId(id)).await?;
+    let duration = item.duration_secs.unwrap_or(0.0);
+    if duration <= 0.0 {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "cannot generate DASH manifest for media with unknown or zero duration".into(),
+            ),
+        ));
+    }
+    let hours = (duration / 3600.0) as u32;
+    let minutes = ((duration % 3600.0) / 60.0) as u32;
+    let seconds = duration % 60.0;
+
+    let config = state.config.read().await;
+    let profiles = &config.transcoding.profiles;
+
+    let mut representations = String::new();
+    for profile in profiles {
+        let (w, h) = parse_resolution(&profile.max_resolution);
+        let bandwidth = estimate_bandwidth(profile);
+        let xml_name = escape_xml(&profile.name);
+        let url_name = utf8_percent_encode(&profile.name, NON_ALPHANUMERIC).to_string();
+        representations.push_str(&format!(
+            r#"      <Representation id="{xml_name}" bandwidth="{bandwidth}" width="{w}" height="{h}">
+        <SegmentTemplate media="/api/v1/media/{id}/stream/dash/{url_name}/segment$Number$.m4s" initialization="/api/v1/media/{id}/stream/dash/{url_name}/init.mp4" duration="10000" timescale="1000" startNumber="0"/>
+      </Representation>
+"#,
+        ));
+    }
+
+    let mpd = format!(
+        r#"<?xml version="1.0" encoding="UTF-8"?>
+<MPD xmlns="urn:mpeg:dash:schema:mpd:2011" type="static" mediaPresentationDuration="PT{hours}H{minutes}M{seconds:.1}S" minBufferTime="PT1.5S">
+  <Period>
+    <AdaptationSet mimeType="video/mp4" segmentAlignment="true">
+{representations}    </AdaptationSet>
+  </Period>
+</MPD>"#
+    );
+
+    Ok(axum::response::Response::builder()
+        .header("Content-Type", "application/dash+xml")
+        .body(axum::body::Body::from(mpd))
+        .unwrap())
+}
+
+pub async fn dash_segment(
+    State(state): State<AppState>,
+    Path((id, profile, segment)): Path<(Uuid, String, String)>,
+) -> Result<axum::response::Response, ApiError> {
+    // Strict validation: reject path traversal, null bytes, leading dots
+    if segment.is_empty()
+        || segment.starts_with('.')
+        || segment.contains('\0')
+        || segment.contains("..")
+        || segment.contains('/')
+        || segment.contains('\\')
+    {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation("invalid segment name".into()),
+        ));
+    }
+
+    let media_id = MediaId(id);
+
+    if let Some(transcode_service) = &state.transcode_service
+        && let Some(session) = transcode_service.find_session(media_id, &profile).await {
+            let segment_path = session.cache_path.join(&segment);
+
+            if segment_path.exists() {
+                let data = tokio::fs::read(&segment_path).await.map_err(|e| {
+                    ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+                        format!("failed to read segment: {}", e),
+                    ))
+                })?;
+
+                return Ok(axum::response::Response::builder()
+                    .header("Content-Type", "video/mp4")
+                    .body(axum::body::Body::from(data))
+                    .unwrap());
+            }
+
+            return Ok(axum::response::Response::builder()
+                .status(StatusCode::ACCEPTED)
+                .header("Retry-After", "2")
+                .body(axum::body::Body::from("segment not yet available"))
+                .unwrap());
+        }
+
+    Err(ApiError(
+        pinakes_core::error::PinakesError::InvalidOperation(
+            "no transcode session found; start a transcode first via POST /media/{id}/transcode"
+                .into(),
+        ),
+    ))
+}

crates/pinakes-server/src/routes/subtitles.rs

@@ -0,0 +1,123 @@
+use axum::Json;
+use axum::extract::{Path, State};
+use uuid::Uuid;
+
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::model::MediaId;
+use pinakes_core::subtitles::{Subtitle, SubtitleFormat};
+
+pub async fn list_subtitles(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Vec<SubtitleResponse>>, ApiError> {
+    let subtitles = state.storage.get_media_subtitles(MediaId(id)).await?;
+    Ok(Json(
+        subtitles.into_iter().map(SubtitleResponse::from).collect(),
+    ))
+}
+
+pub async fn add_subtitle(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<AddSubtitleRequest>,
+) -> Result<Json<SubtitleResponse>, ApiError> {
+    let format: SubtitleFormat = req
+        .format
+        .parse()
+        .map_err(|e: String| ApiError(pinakes_core::error::PinakesError::InvalidOperation(e)))?;
+    let is_embedded = req.is_embedded.unwrap_or(false);
+    if !is_embedded && req.file_path.is_none() {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "file_path is required for non-embedded subtitles".into(),
+            ),
+        ));
+    }
+    if is_embedded && req.track_index.is_none() {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "track_index is required for embedded subtitles".into(),
+            ),
+        ));
+    }
+    let subtitle = Subtitle {
+        id: Uuid::now_v7(),
+        media_id: MediaId(id),
+        language: req.language,
+        format,
+        file_path: req.file_path.map(std::path::PathBuf::from),
+        is_embedded,
+        track_index: req.track_index,
+        offset_ms: req.offset_ms.unwrap_or(0),
+        created_at: chrono::Utc::now(),
+    };
+    state.storage.add_subtitle(&subtitle).await?;
+    Ok(Json(SubtitleResponse::from(subtitle)))
+}
+
+pub async fn delete_subtitle(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    state.storage.delete_subtitle(id).await?;
+    Ok(Json(serde_json::json!({"deleted": true})))
+}
+
+pub async fn get_subtitle_content(
+    State(state): State<AppState>,
+    Path((media_id, subtitle_id)): Path<(Uuid, Uuid)>,
+) -> Result<axum::response::Response, ApiError> {
+    let subtitles = state.storage.get_media_subtitles(MediaId(media_id)).await?;
+    let subtitle = subtitles
+        .into_iter()
+        .find(|s| s.id == subtitle_id)
+        .ok_or_else(|| {
+            ApiError(pinakes_core::error::PinakesError::NotFound(format!(
+                "subtitle {subtitle_id}"
+            )))
+        })?;
+
+    if let Some(ref path) = subtitle.file_path {
+        let content = tokio::fs::read_to_string(path).await.map_err(|e| {
+            if e.kind() == std::io::ErrorKind::NotFound {
+                ApiError(pinakes_core::error::PinakesError::FileNotFound(
+                    path.clone(),
+                ))
+            } else {
+                ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+                    format!("failed to read subtitle file {}: {}", path.display(), e),
+                ))
+            }
+        })?;
+        let content_type = match subtitle.format {
+            SubtitleFormat::Vtt => "text/vtt",
+            SubtitleFormat::Srt => "application/x-subrip",
+            _ => "text/plain",
+        };
+        Ok(axum::response::Response::builder()
+            .header("Content-Type", content_type)
+            .body(axum::body::Body::from(content))
+            .unwrap())
+    } else {
+        Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "subtitle is embedded, no file to serve".into(),
+            ),
+        ))
+    }
+}
+
+pub async fn update_offset(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<UpdateSubtitleOffsetRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    state
+        .storage
+        .update_subtitle_offset(id, req.offset_ms)
+        .await?;
+    Ok(Json(serde_json::json!({"updated": true})))
+}

crates/pinakes-server/src/routes/transcode.rs

@@ -0,0 +1,63 @@
+use axum::Json;
+use axum::extract::{Path, Query, State};
+use uuid::Uuid;
+
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::model::MediaId;
+
+pub async fn start_transcode(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<CreateTranscodeRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let job_id = state
+        .job_queue
+        .submit(pinakes_core::jobs::JobKind::Transcode {
+            media_id: MediaId(id),
+            profile: req.profile,
+        })
+        .await;
+    Ok(Json(serde_json::json!({"job_id": job_id.to_string()})))
+}
+
+pub async fn get_session(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<TranscodeSessionResponse>, ApiError> {
+    let session = state.storage.get_transcode_session(id).await?;
+    Ok(Json(TranscodeSessionResponse::from(session)))
+}
+
+pub async fn list_sessions(
+    State(state): State<AppState>,
+    Query(params): Query<PaginationParams>,
+) -> Result<Json<Vec<TranscodeSessionResponse>>, ApiError> {
+    let _ = params; // reserved for future filtering
+    let sessions = state.storage.list_transcode_sessions(None).await?;
+    Ok(Json(
+        sessions
+            .into_iter()
+            .map(TranscodeSessionResponse::from)
+            .collect(),
+    ))
+}
+
+pub async fn cancel_session(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    if let Some(transcode_service) = &state.transcode_service {
+        transcode_service
+            .cancel_transcode(id, &state.storage)
+            .await?;
+    } else {
+        state
+            .storage
+            .update_transcode_status(id, pinakes_core::transcode::TranscodeStatus::Cancelled, 0.0)
+            .await?;
+    }
+    Ok(Json(serde_json::json!({"cancelled": true})))
+}

crates/pinakes-server/src/routes/users.rs

@@ -0,0 +1,191 @@
+use axum::Json;
+use axum::extract::{Path, State};
+
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::users::{CreateUserRequest, UpdateUserRequest, UserId};
+
+/// List all users (admin only)
+pub async fn list_users(
+    State(state): State<AppState>,
+) -> Result<Json<Vec<UserResponse>>, ApiError> {
+    let users = state.storage.list_users().await?;
+    Ok(Json(users.into_iter().map(UserResponse::from).collect()))
+}
+
+/// Create a new user (admin only)
+pub async fn create_user(
+    State(state): State<AppState>,
+    Json(req): Json<CreateUserRequest>,
+) -> Result<Json<UserResponse>, ApiError> {
+    // Validate username
+    if req.username.is_empty() || req.username.len() > 255 {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "username must be 1-255 characters".into(),
+            ),
+        ));
+    }
+
+    // Validate password
+    if req.password.len() < 8 {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "password must be at least 8 characters".into(),
+            ),
+        ));
+    }
+
+    // Hash password
+    let password_hash = pinakes_core::users::auth::hash_password(&req.password)?;
+
+    // Create user - rely on DB unique constraint for username to avoid TOCTOU race
+    let user = state
+        .storage
+        .create_user(&req.username, &password_hash, req.role, req.profile)
+        .await
+        .map_err(|e| {
+            // Map unique constraint violations to a user-friendly conflict error
+            let err_str = e.to_string();
+            if err_str.contains("UNIQUE")
+                || err_str.contains("unique")
+                || err_str.contains("duplicate key")
+            {
+                ApiError(pinakes_core::error::PinakesError::DuplicateHash(
+                    "username already exists".into(),
+                ))
+            } else {
+                ApiError(e)
+            }
+        })?;
+
+    Ok(Json(UserResponse::from(user)))
+}
+
+/// Get a specific user by ID
+pub async fn get_user(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<UserResponse>, ApiError> {
+    let user_id: UserId = id.parse::<uuid::Uuid>().map(UserId::from).map_err(|_| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Invalid user ID".into(),
+        ))
+    })?;
+
+    let user = state.storage.get_user(user_id).await?;
+    Ok(Json(UserResponse::from(user)))
+}
+
+/// Update a user
+pub async fn update_user(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    Json(req): Json<UpdateUserRequest>,
+) -> Result<Json<UserResponse>, ApiError> {
+    let user_id: UserId = id.parse::<uuid::Uuid>().map(UserId::from).map_err(|_| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Invalid user ID".into(),
+        ))
+    })?;
+
+    // Hash password if provided
+    let password_hash = if let Some(ref password) = req.password {
+        if password.len() < 8 {
+            return Err(ApiError(
+                pinakes_core::error::PinakesError::InvalidOperation(
+                    "password must be at least 8 characters".into(),
+                ),
+            ));
+        }
+        Some(pinakes_core::users::auth::hash_password(password)?)
+    } else {
+        None
+    };
+
+    let user = state
+        .storage
+        .update_user(user_id, password_hash.as_deref(), req.role, req.profile)
+        .await?;
+
+    Ok(Json(UserResponse::from(user)))
+}
+
+/// Delete a user (admin only)
+pub async fn delete_user(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id: UserId = id.parse::<uuid::Uuid>().map(UserId::from).map_err(|_| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Invalid user ID".into(),
+        ))
+    })?;
+
+    state.storage.delete_user(user_id).await?;
+    Ok(Json(serde_json::json!({"deleted": true})))
+}
+
+/// Get user's accessible libraries
+pub async fn get_user_libraries(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<Vec<UserLibraryResponse>>, ApiError> {
+    let user_id: UserId = id.parse::<uuid::Uuid>().map(UserId::from).map_err(|_| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Invalid user ID".into(),
+        ))
+    })?;
+
+    let libraries = state.storage.get_user_libraries(user_id).await?;
+    Ok(Json(
+        libraries
+            .into_iter()
+            .map(UserLibraryResponse::from)
+            .collect(),
+    ))
+}
+
+/// Grant library access to a user (admin only)
+pub async fn grant_library_access(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    Json(req): Json<GrantLibraryAccessRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id: UserId = id.parse::<uuid::Uuid>().map(UserId::from).map_err(|_| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Invalid user ID".into(),
+        ))
+    })?;
+
+    state
+        .storage
+        .grant_library_access(user_id, &req.root_path, req.permission)
+        .await?;
+
+    Ok(Json(serde_json::json!({"granted": true})))
+}
+
+/// Revoke library access from a user (admin only)
+///
+/// Uses a JSON body instead of a path parameter because root_path may contain
+/// slashes that conflict with URL routing.
+pub async fn revoke_library_access(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    Json(req): Json<RevokeLibraryAccessRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id: UserId = id.parse::<uuid::Uuid>().map(UserId::from).map_err(|_| {
+        ApiError(pinakes_core::error::PinakesError::InvalidOperation(
+            "Invalid user ID".into(),
+        ))
+    })?;
+
+    state
+        .storage
+        .revoke_library_access(user_id, &req.root_path)
+        .await?;
+    Ok(Json(serde_json::json!({"revoked": true})))
+}