fix(security): tampered token throws 500 error

Resolves #41

Reviewed-on: #57

.gitea/workflows/ci.yml

@@ -4,7 +4,7 @@ on:
   push:
 
 env:
-  REGISTRY: gitea.vodsystem.ddns.net
+  REGISTRY: gitea.defaoite.dev
   IMAGE_PREFIX: dylan/vod-system
 
 jobs:

README.md

@@ -94,6 +94,8 @@ docker compose -f docker-compose.dev.yml up
 
 Then run the backend and frontend separately in your usual workflow.
 
+- **Important**: Rootless docker should be used to avoid permission conflicts between the RTMP container and the Spring Boot host
+
 ---
 
 ## API Reference

docker-compose.dev.yml

@@ -20,10 +20,10 @@ services:
       context: ./nginx
       dockerfile: Dockerfile
     container_name: vod_rtmp
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
     env_file:
       - .env
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     environment:
       - WEB_SERVER_URL=http://host.docker.internal:8080
     ports:

docker-compose.prod.yml

@@ -15,7 +15,7 @@ services:
     restart: unless-stopped
 
   backend:
-    image: gitea.vodsystem.ddns.net/dylan/vod-system-backend:latest
+    image: gitea.defaoite.dev/dylan/vod-system-backend:latest
     container_name: vod_backend
     depends_on:
       - postgres
@@ -29,7 +29,7 @@ services:
     restart: unless-stopped
 
   frontend:
-    image: gitea.vodsystem.ddns.net/dylan/vod-system-frontend:latest
+    image: gitea.defaoite.dev/dylan/vod-system-frontend:latest
     container_name: vod_frontend
     environment:
       VITE_API_URL: ${BACKEND_URL}
@@ -38,11 +38,11 @@ services:
     depends_on:
       - backend
     ports:
-      - "5173:5173"
+      - "5173:80"
     restart: unless-stopped
 
   rtmp:
-    image: gitea.vodsystem.ddns.net/dylan/vod-system-rtmp:latest
+    image: gitea.defaoite.dev/dylan/vod-system-rtmp:latest
     container_name: vod_rtmp
     env_file:
       - .env

docker-compose.yml

@@ -37,7 +37,7 @@ services:
     depends_on:
       - backend
     ports:
-      - "5173:5173"
+      - "5173:80"
     restart: unless-stopped
 
   rtmp:

frontend/Dockerfile

@@ -1,9 +1,19 @@
-FROM node:20-alpine
+# --- Build stage ---
-
+FROM node:20-alpine AS build
 WORKDIR /app
 COPY package*.json ./
 RUN --mount=type=cache,target=/root/.npm npm ci
-
 COPY . .
-EXPOSE 5173
+RUN npm run build
-CMD ["npm", "run", "dev"]
+
+# --- Production stage ---
+FROM nginx:1.27-alpine AS prod
+COPY --from=build /app/dist /usr/share/nginx/html
+COPY frontend_nginx.conf /etc/nginx/conf.d/default.conf
+
+# Inject envs at runtime
+COPY env.sh /docker-entrypoint.d/40-env.sh
+RUN chmod +x /docker-entrypoint.d/40-env.sh
+
+EXPOSE 80
+CMD ["nginx", "-g", "daemon off;"]

frontend/README.md

@@ -1,54 +0,0 @@
-# React + TypeScript + Vite
-
-This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.
-
-Currently, two official plugins are available:
-
-- [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react) uses [Babel](https://babeljs.io/) for Fast Refresh
-- [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc) uses [SWC](https://swc.rs/) for Fast Refresh
-
-## Expanding the ESLint configuration
-
-If you are developing a production application, we recommend updating the configuration to enable type-aware lint rules:
-
-```js
-export default tseslint.config({
-  extends: [
-    // Remove ...tseslint.configs.recommended and replace with this
-    ...tseslint.configs.recommendedTypeChecked,
-    // Alternatively, use this for stricter rules
-    ...tseslint.configs.strictTypeChecked,
-    // Optionally, add this for stylistic rules
-    ...tseslint.configs.stylisticTypeChecked,
-  ],
-  languageOptions: {
-    // other options...
-    parserOptions: {
-      project: ['./tsconfig.node.json', './tsconfig.app.json'],
-      tsconfigRootDir: import.meta.dirname,
-    },
-  },
-})
-```
-
-You can also install [eslint-plugin-react-x](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-x) and [eslint-plugin-react-dom](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-dom) for React-specific lint rules:
-
-```js
-// eslint.config.js
-import reactX from 'eslint-plugin-react-x'
-import reactDom from 'eslint-plugin-react-dom'
-
-export default tseslint.config({
-  plugins: {
-    // Add the react-x and react-dom plugins
-    'react-x': reactX,
-    'react-dom': reactDom,
-  },
-  rules: {
-    // other rules...
-    // Enable its recommended typescript rules
-    ...reactX.configs['recommended-typescript'].rules,
-    ...reactDom.configs.recommended.rules,
-  },
-})
-```

frontend/env.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+set -eu
+
+cat <<EOF > /usr/share/nginx/html/env-config.js
+window._env_ = {
+  VITE_API_URL: "${VITE_API_URL:-}",
+  VITE_FRONTEND_URL: "${VITE_FRONTEND_URL:-}",
+  VITE_GOOGLE_CLIENT_ID: "${VITE_GOOGLE_CLIENT_ID:-}"
+};
+EOF

frontend/frontend_nginx.conf

@@ -0,0 +1,15 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    error_page 500 502 503 504 /50x.html;
+    location = /50x.html {
+        root /usr/share/nginx/html;
+    }
+}

frontend/index.html

@@ -3,8 +3,28 @@
   <head>
     <meta charset="UTF-8" />
     <link rel="icon" type="image/png" href="/small_icon.png" />
+
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Newsreader:wght@100;200;300;400;500;600;700&family=IBM+Plex+Sans:wght@100;200;300;400;500;600;700&family=IBM+Plex+Mono:wght@100;200;300;400;500;600;700&display=swap" rel="stylesheet">
+
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>Vite + React + TS</title>
+    <script>
+      // Apply the stored theme before first paint so a dark session never
+      // flashes light. Mirrors the logic in src/theme/ThemeProvider.tsx.
+      (function () {
+        try {
+          var stored = localStorage.getItem("theme");
+          var dark = stored === "dark" ||
+            (stored !== "light" && window.matchMedia("(prefers-color-scheme: dark)").matches);
+          document.documentElement.dataset.theme = dark ? "dark" : "light";
+        } catch (e) {
+          document.documentElement.dataset.theme = "light";
+        }
+      })();
+    </script>
+    <script src="/env-config.js"></script>
+    <title>The VoD System</title>
   </head>
   <body>
     <div id="root"></div>

frontend/package.json

@@ -8,27 +8,21 @@
     "dev": "vite",
     "build": "tsc -b && vite build",
     "lint": "eslint .",
-    "preview": "vite preview",
+    "preview": "vite preview"
-    "postinstall": "flowbite-react patch"
   },
   "dependencies": {
     "@react-oauth/google": "^0.12.2",
-    "@tailwindcss/vite": "^4.1.7",
-    "axios": "^1.11.0",
     "clsx": "^2.1.1",
-    "dotenv": "^16.5.0",
-    "flowbite-react": "^0.11.8",
-    "js-cookie": "^3.0.5",
     "lucide-react": "^0.511.0",
-    "path": "^0.12.7",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
     "react-range-slider-input": "^3.2.1",
-    "react-router-dom": "^7.8.0",
+    "react-router-dom": "^7.8.0"
-    "tailwindcss": "^4.1.7"
   },
   "devDependencies": {
     "@eslint/js": "^9.25.0",
+    "@tailwindcss/vite": "^4.3.3",
+    "@types/node": "^26.1.1",
     "@types/react": "^19.1.2",
     "@types/react-dom": "^19.1.2",
     "@vitejs/plugin-react": "^4.4.1",
@@ -36,9 +30,9 @@
     "eslint-plugin-react-hooks": "^5.2.0",
     "eslint-plugin-react-refresh": "^0.4.19",
     "globals": "^16.0.0",
+    "tailwindcss": "^4.3.3",
     "typescript": "~5.8.3",
     "typescript-eslint": "^8.30.1",
-    "vite": "^6.3.5",
+    "vite": "^6.3.5"
-    "vite-plugin-mkcert": "^1.17.8"
   }
 }

frontend/public/vite.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="31.88" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 257"><defs><linearGradient id="IconifyId1813088fe1fbc01fb466" x1="-.828%" x2="57.636%" y1="7.652%" y2="78.411%"><stop offset="0%" stop-color="#41D1FF"></stop><stop offset="100%" stop-color="#BD34FE"></stop></linearGradient><linearGradient id="IconifyId1813088fe1fbc01fb467" x1="43.376%" x2="50.316%" y1="2.242%" y2="89.03%"><stop offset="0%" stop-color="#FFEA83"></stop><stop offset="8.333%" stop-color="#FFDD35"></stop><stop offset="100%" stop-color="#FFA800"></stop></linearGradient></defs><path fill="url(#IconifyId1813088fe1fbc01fb466)" d="M255.153 37.938L134.897 252.976c-2.483 4.44-8.862 4.466-11.382.048L.875 37.958c-2.746-4.814 1.371-10.646 6.827-9.67l120.385 21.517a6.537 6.537 0 0 0 2.322-.004l117.867-21.483c5.438-.991 9.574 4.796 6.877 9.62Z"></path><path fill="url(#IconifyId1813088fe1fbc01fb467)" d="M185.432.063L96.44 17.501a3.268 3.268 0 0 0-2.634 3.014l-5.474 92.456a3.268 3.268 0 0 0 3.997 3.378l24.777-5.718c2.318-.535 4.413 1.507 3.936 3.838l-7.361 36.047c-.495 2.426 1.782 4.5 4.151 3.78l15.304-4.649c2.372-.72 4.652 1.36 4.15 3.788l-11.698 56.621c-.732 3.542 3.979 5.473 5.943 2.437l1.313-2.028l72.516-144.72c1.215-2.423-.88-5.186-3.54-4.672l-25.505 4.922c-2.396.462-4.435-1.77-3.759-4.114l16.646-57.705c.677-2.35-1.37-4.583-3.769-4.113Z"></path></svg>

frontend/src/App.css

@@ -1,42 +0,0 @@
-#root {
-  max-width: 1280px;
-  margin: 0 auto;
-  padding: 2rem;
-  text-align: center;
-}
-
-.logo {
-  height: 6em;
-  padding: 1.5em;
-  will-change: filter;
-  transition: filter 300ms;
-}
-.logo:hover {
-  filter: drop-shadow(0 0 2em #646cffaa);
-}
-.logo.react:hover {
-  filter: drop-shadow(0 0 2em #61dafbaa);
-}
-
-@keyframes logo-spin {
-  from {
-    transform: rotate(0deg);
-  }
-  to {
-    transform: rotate(360deg);
-  }
-}
-
-@media (prefers-reduced-motion: no-preference) {
-  a:nth-of-type(2) .logo {
-    animation: logo-spin infinite 20s linear;
-  }
-}
-
-.card {
-  padding: 2em;
-}
-
-.read-the-docs {
-  color: #888;
-}

frontend/src/App.tsx

@@ -7,13 +7,19 @@ import Home from './pages/Home';
 import {useEffect} from "react";
 import MyClips from './pages/MyClips';
 import MyVods from './pages/MyVods';
-import VideoPlayer from "./pages/VideoPlayer.tsx";
+import MediaPlayer from "./pages/MediaPlayer.tsx";
-import VodPlayer from "./pages/VodPlayer.tsx";
+import { getVodById, getVodMediaUrl } from "./utils/api/vods.ts";
+import { getClipById, getClipMediaUrl } from "./utils/api/clips.ts";
 import EditClip from "./pages/EditClip.tsx";
 import EditVod from "./pages/EditVod.tsx";
 import Profile from "./pages/Profile.tsx";
 import StreamControl from "./pages/StreamControl.tsx";
 import { GoogleOAuthProvider } from '@react-oauth/google';
+import {config} from "./config.ts";
+ import NotFound from "./pages/NotFound.tsx";
+import AuthProvider from "./auth/AuthProvider.tsx";
+import ThemeProvider from "./theme/ThemeProvider.tsx";
+ import RequireAuth from "./auth/RequireAuth.tsx";
 
 
 function App() {
@@ -22,24 +28,33 @@ function App() {
     }, []);
 
     return (
-        <GoogleOAuthProvider clientId={import.meta.env.VITE_GOOGLE_CLIENT_ID}>
+        <GoogleOAuthProvider clientId={config.googleClientId}>
+            <ThemeProvider>
+                <AuthProvider>
                     <Router>
                             <Routes>
                             <Route element={<MainLayout />}>
                                 <Route path="/" element={<Home />} />
                                 <Route path="/create" element={<ClipUpload />} />
                                 <Route path="/create/:id" element={<ClipEdit />} />
+
+                                <Route element={<RequireAuth />}>
                                     <Route path="/my-clips" element={<MyClips />} />
                                     <Route path="/my-vods" element={<MyVods />} />
-                        <Route path="/video/:id" element={<VideoPlayer />} />
+                                    <Route path="/video/:id" element={<MediaPlayer noun="Clip" getMediaUrl={getClipMediaUrl} fetchDetails={getClipById} />} />
-                        <Route path="/vod/:id" element={<VodPlayer />} />
+                                    <Route path="/vod/:id" element={<MediaPlayer noun="VoD" getMediaUrl={getVodMediaUrl} fetchDetails={getVodById} />} />
                                     <Route path="/clips/:id/edit" element={<EditClip />} />
                                     <Route path="/vods/:id/edit" element={<EditVod />} />
                                     <Route path="/profile" element={<Profile />} />
                                     <Route path="/stream" element={<StreamControl />} />
                                 </Route>
+
+                                <Route path="*" element={<NotFound />} />
+                            </Route>
                         </Routes>
                     </Router>
+                </AuthProvider>
+            </ThemeProvider>
         </ GoogleOAuthProvider>
     );
 }

frontend/src/assets/react.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="35.93" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 228"><path fill="#00D8FF" d="M210.483 73.824a171.49 171.49 0 0 0-8.24-2.597c.465-1.9.893-3.777 1.273-5.621c6.238-30.281 2.16-54.676-11.769-62.708c-13.355-7.7-35.196.329-57.254 19.526a171.23 171.23 0 0 0-6.375 5.848a155.866 155.866 0 0 0-4.241-3.917C100.759 3.829 77.587-4.822 63.673 3.233C50.33 10.957 46.379 33.89 51.995 62.588a170.974 170.974 0 0 0 1.892 8.48c-3.28.932-6.445 1.924-9.474 2.98C17.309 83.498 0 98.307 0 113.668c0 15.865 18.582 31.778 46.812 41.427a145.52 145.52 0 0 0 6.921 2.165a167.467 167.467 0 0 0-2.01 9.138c-5.354 28.2-1.173 50.591 12.134 58.266c13.744 7.926 36.812-.22 59.273-19.855a145.567 145.567 0 0 0 5.342-4.923a168.064 168.064 0 0 0 6.92 6.314c21.758 18.722 43.246 26.282 56.54 18.586c13.731-7.949 18.194-32.003 12.4-61.268a145.016 145.016 0 0 0-1.535-6.842c1.62-.48 3.21-.974 4.76-1.488c29.348-9.723 48.443-25.443 48.443-41.52c0-15.417-17.868-30.326-45.517-39.844Zm-6.365 70.984c-1.4.463-2.836.91-4.3 1.345c-3.24-10.257-7.612-21.163-12.963-32.432c5.106-11 9.31-21.767 12.459-31.957c2.619.758 5.16 1.557 7.61 2.4c23.69 8.156 38.14 20.213 38.14 29.504c0 9.896-15.606 22.743-40.946 31.14Zm-10.514 20.834c2.562 12.94 2.927 24.64 1.23 33.787c-1.524 8.219-4.59 13.698-8.382 15.893c-8.067 4.67-25.32-1.4-43.927-17.412a156.726 156.726 0 0 1-6.437-5.87c7.214-7.889 14.423-17.06 21.459-27.246c12.376-1.098 24.068-2.894 34.671-5.345a134.17 134.17 0 0 1 1.386 6.193ZM87.276 214.515c-7.882 2.783-14.16 2.863-17.955.675c-8.075-4.657-11.432-22.636-6.853-46.752a156.923 156.923 0 0 1 1.869-8.499c10.486 2.32 22.093 3.988 34.498 4.994c7.084 9.967 14.501 19.128 21.976 27.15a134.668 134.668 0 0 1-4.877 4.492c-9.933 8.682-19.886 14.842-28.658 17.94ZM50.35 144.747c-12.483-4.267-22.792-9.812-29.858-15.863c-6.35-5.437-9.555-10.836-9.555-15.216c0-9.322 13.897-21.212 37.076-29.293c2.813-.98 5.757-1.905 8.812-2.773c3.204 10.42 7.406 21.315 12.477 32.332c-5.137 11.18-9.399 22.249-12.634 32.792a134.718 134.718 0 0 1-6.318-1.979Zm12.378-84.26c-4.811-24.587-1.616-43.134 6.425-47.789c8.564-4.958 27.502 2.111 47.463 19.835a144.318 144.318 0 0 1 3.841 3.545c-7.438 7.987-14.787 17.08-21.808 26.988c-12.04 1.116-23.565 2.908-34.161 5.309a160.342 160.342 0 0 1-1.76-7.887Zm110.427 27.268a347.8 347.8 0 0 0-7.785-12.803c8.168 1.033 15.994 2.404 23.343 4.08c-2.206 7.072-4.956 14.465-8.193 22.045a381.151 381.151 0 0 0-7.365-13.322Zm-45.032-43.861c5.044 5.465 10.096 11.566 15.065 18.186a322.04 322.04 0 0 0-30.257-.006c4.974-6.559 10.069-12.652 15.192-18.18ZM82.802 87.83a323.167 323.167 0 0 0-7.227 13.238c-3.184-7.553-5.909-14.98-8.134-22.152c7.304-1.634 15.093-2.97 23.209-3.984a321.524 321.524 0 0 0-7.848 12.897Zm8.081 65.352c-8.385-.936-16.291-2.203-23.593-3.793c2.26-7.3 5.045-14.885 8.298-22.6a321.187 321.187 0 0 0 7.257 13.246c2.594 4.48 5.28 8.868 8.038 13.147Zm37.542 31.03c-5.184-5.592-10.354-11.779-15.403-18.433c4.902.192 9.899.29 14.978.29c5.218 0 10.376-.117 15.453-.343c-4.985 6.774-10.018 12.97-15.028 18.486Zm52.198-57.817c3.422 7.8 6.306 15.345 8.596 22.52c-7.422 1.694-15.436 3.058-23.88 4.071a382.417 382.417 0 0 0 7.859-13.026a347.403 347.403 0 0 0 7.425-13.565Zm-16.898 8.101a358.557 358.557 0 0 1-12.281 19.815a329.4 329.4 0 0 1-23.444.823c-7.967 0-15.716-.248-23.178-.732a310.202 310.202 0 0 1-12.513-19.846h.001a307.41 307.41 0 0 1-10.923-20.627a310.278 310.278 0 0 1 10.89-20.637l-.001.001a307.318 307.318 0 0 1 12.413-19.761c7.613-.576 15.42-.876 23.31-.876H128c7.926 0 15.743.303 23.354.883a329.357 329.357 0 0 1 12.335 19.695a358.489 358.489 0 0 1 11.036 20.54a329.472 329.472 0 0 1-11 20.722Zm22.56-122.124c8.572 4.944 11.906 24.881 6.52 51.026c-.344 1.668-.73 3.367-1.15 5.09c-10.622-2.452-22.155-4.275-34.23-5.408c-7.034-10.017-14.323-19.124-21.64-27.008a160.789 160.789 0 0 1 5.888-5.4c18.9-16.447 36.564-22.941 44.612-18.3ZM128 90.808c12.625 0 22.86 10.235 22.86 22.86s-10.235 22.86-22.86 22.86s-22.86-10.235-22.86-22.86s10.235-22.86 22.86-22.86Z"></path></svg>

frontend/src/auth/AuthContext.ts

@@ -0,0 +1,20 @@
+import { createContext } from "react";
+import type { User } from "../utils/types.ts";
+
+type AuthContextValue = {
+    /** The currently authenticated user, or null when logged out. */
+    user: User | null;
+    /** True until the initial "who am I" request has resolved. */
+    loading: boolean;
+    /** Exchange a Google credential for a session, then load the user. */
+    login: (googleCredential: string) => Promise<void>;
+    /** End the session and clear the user. The local session is cleared even if the server call fails. */
+    logout: () => Promise<void>;
+    /** Re-fetch the current user (e.g. after a profile change). Token refresh is handled automatically. */
+    refresh: () => Promise<void>;
+};
+
+const AuthContext = createContext<AuthContextValue | null>(null);
+
+export { AuthContext };
+export type { AuthContextValue };

frontend/src/auth/AuthProvider.tsx

@@ -0,0 +1,126 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+import type { ReactNode } from "react";
+import type { User } from "../utils/types.ts";
+import { login as apiLogin, logout as apiLogout, getUser } from "../utils/api/users.ts";
+import { AuthContext } from "./AuthContext.ts";
+import {
+    refreshSession,
+    registerSessionRefreshedHandler,
+    registerUnauthorizedHandler,
+} from "../utils/api/client.ts";
+
+/** Refresh this long before the access token expires, so in-flight requests never see it lapse. */
+const REFRESH_MARGIN_MS = 60_000;
+/** How soon to try again when a scheduled refresh fails because the network is down. */
+const RETRY_DELAY_MS = 30_000;
+
+/**
+ * Owns the single source of truth for the authenticated user. Everything that
+ * needs to know who is logged in — the layout, the top bar, protected pages —
+ * reads it through the `useAuth` hook rather than fetching the user itself.
+ *
+ * It also keeps the session alive: the access token is refreshed shortly
+ * before it expires, rather than waiting for a request to fail. That matters
+ * for <video> elements, which load media straight from the API and can't
+ * retry on a 401 the way apiFetch does.
+ */
+const AuthProvider = ({ children }: { children: ReactNode }) => {
+    const [user, setUser] = useState<User | null>(null);
+    const [loading, setLoading] = useState(true);
+
+    const refreshTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+    /** When the next refresh is due (epoch ms), or null when there's no session to keep alive. */
+    const refreshDueRef = useRef<number | null>(null);
+
+    const cancelScheduledRefresh = useCallback(() => {
+        if (refreshTimerRef.current) clearTimeout(refreshTimerRef.current);
+        refreshTimerRef.current = null;
+        refreshDueRef.current = null;
+    }, []);
+
+    const endSession = useCallback(() => {
+        cancelScheduledRefresh();
+        setUser(null);
+    }, [cancelScheduledRefresh]);
+
+    const scheduleRefreshIn = useCallback((delayMs: number) => {
+        if (refreshTimerRef.current) clearTimeout(refreshTimerRef.current);
+        refreshDueRef.current = Date.now() + delayMs;
+        refreshTimerRef.current = setTimeout(() => {
+            refreshSession()
+                .then((refreshed) => { if (!refreshed) endSession(); })
+                .catch(() => scheduleRefreshIn(RETRY_DELAY_MS));
+        }, delayMs);
+    }, [endSession]);
+
+    // Every successful refresh — scheduled, or triggered by apiFetch on a 401 —
+    // reports the new access token lifetime here, so the timer always tracks
+    // the live cookie.
+    const scheduleRefreshBeforeExpiry = useCallback((accessTokenExpiresIn: number) => {
+        const lifetimeMs = accessTokenExpiresIn * 1000;
+        scheduleRefreshIn(Math.max(lifetimeMs - REFRESH_MARGIN_MS, lifetimeMs / 2));
+    }, [scheduleRefreshIn]);
+
+    const refresh = useCallback(async () => {
+        try {
+            setUser(await getUser());
+        } catch (error) {
+            console.error("Failed to fetch user:", error);
+            setUser(null);
+        }
+    }, []);
+
+    useEffect(() => {
+        registerUnauthorizedHandler(endSession);
+        registerSessionRefreshedHandler(scheduleRefreshBeforeExpiry);
+    }, [endSession, scheduleRefreshBeforeExpiry]);
+
+    // Restore the session on page load. Refreshing first means a returning
+    // user whose access token expired while they were away is logged straight
+    // back in, and gives us the expiry to schedule the next refresh against.
+    useEffect(() => {
+        refreshSession()
+            .catch((error) => console.error("Failed to refresh session:", error))
+            .then(refresh)
+            .finally(() => setLoading(false));
+    }, [refresh]);
+
+    // Timers are throttled in background tabs and paused while the machine
+    // sleeps, so catch up as soon as the user comes back.
+    useEffect(() => {
+        const refreshIfDue = () => {
+            if (document.visibilityState !== "visible") return;
+            const due = refreshDueRef.current;
+            if (due !== null && Date.now() >= due) scheduleRefreshIn(0);
+        };
+
+        document.addEventListener("visibilitychange", refreshIfDue);
+        window.addEventListener("online", refreshIfDue);
+        return () => {
+            document.removeEventListener("visibilitychange", refreshIfDue);
+            window.removeEventListener("online", refreshIfDue);
+        };
+    }, [scheduleRefreshIn]);
+
+    useEffect(() => cancelScheduledRefresh, [cancelScheduledRefresh]);
+
+    const login = useCallback(async (googleCredential: string) => {
+        scheduleRefreshBeforeExpiry(await apiLogin(googleCredential));
+        await refresh();
+    }, [refresh, scheduleRefreshBeforeExpiry]);
+
+    const logout = useCallback(async () => {
+        // Drop the local session even if the server call fails, so the user
+        // is never left looking logged in after clicking log out.
+        endSession();
+        await apiLogout();
+    }, [endSession]);
+
+    return (
+        <AuthContext.Provider value={{ user, loading, login, logout, refresh }}>
+            {children}
+        </AuthContext.Provider>
+    );
+};
+
+export default AuthProvider;

frontend/src/auth/RequireAuth.tsx

@@ -0,0 +1,14 @@
+import { Navigate, Outlet, useLocation } from "react-router-dom";
+import { useAuth } from "./useAuth";
+
+const RequireAuth = () => {
+    const { user, loading } = useAuth();
+    const location = useLocation();
+
+    if (loading) return null;
+    if (!user) return <Navigate to="/" replace state={{ from: location }} />;
+
+    return <Outlet />;
+};
+
+export default RequireAuth;

frontend/src/auth/useAuth.ts

@@ -0,0 +1,14 @@
+import { useContext } from "react";
+import { AuthContext } from "./AuthContext.ts";
+import type { AuthContextValue } from "./AuthContext.ts";
+
+/** Access the centralised auth state. Must be used within an <AuthProvider>. */
+const useAuth = (): AuthContextValue => {
+    const context = useContext(AuthContext);
+    if (!context) {
+        throw new Error("useAuth must be used within an AuthProvider");
+    }
+    return context;
+};
+
+export { useAuth };

frontend/src/components/Box.tsx

@@ -1,4 +1,5 @@
 import clsx from "clsx";
+import React from "react";
 
 type Props = {
     children: React.ReactNode;
@@ -6,7 +7,7 @@ type Props = {
 };
 
 const Box = ({ children, className }: Props) => (
-    <div className={clsx("bg-white border border-gray-200 shadow-sm rounded-lg", className)}>
+    <div className={clsx("bg-card border-hairline shadow-sm rounded-lg", className)}>
         {children}
     </div>
 );

frontend/src/components/CardHeader.tsx

@@ -0,0 +1,18 @@
+import type { ElementType } from "react";
+
+type Props = {
+    icon: ElementType;
+    title: string;
+    accent?: "primary" | "accent";
+};
+
+const CardHeader = ({ icon: Icon, title, accent = "primary" }: Props) => (
+    <div className="flex items-center gap-2.5">
+        <div className={`w-8 h-8 rounded-lg flex items-center justify-center flex-shrink-0 ${accent === "primary" ? "bg-terracotta/10" : "bg-olive/10"}`}>
+            <Icon size={16} className={accent === "primary" ? "text-terracotta" : "text-olive"} />
+        </div>
+        <h2 className="text-xl font-heading text-text-primary">{title}</h2>
+    </div>
+);
+
+export default CardHeader;

frontend/src/components/Dropdown.tsx

@@ -9,7 +9,7 @@ type DropdownItemProps = {
 
 const DropdownItem = ({ item, onClick, className }: DropdownItemProps) => (
     <li
-        className={clsx("cursor-pointer hover:bg-gray-50 px-3 py-2 text-sm text-gray-700", className)}
+        className={clsx("cursor-pointer hover:bg-hover px-3 py-2 text-sm rounded-md", className)}
         onClick={() => onClick(item)}
     >
         {item}
@@ -40,12 +40,12 @@ const Dropdown = ({ label, children, className }: DropdownProps) => {
         <div className={clsx(className, "relative inline-block text-left")} ref={ref}>
             <button
                 onClick={() => setIsOpen(v => !v)}
-                className="inline-flex items-center gap-1 rounded-lg px-3 py-2 text-sm font-medium text-gray-700 hover:bg-gray-100 transition-colors duration-150"
+                className="inline-flex items-center gap-1 px-3 py-2 text-sm transition-colors duration-150"
             >
                 {label}
             </button>
             {isOpen && (
-                <ul className="absolute right-0 mt-1 w-36 origin-top-right rounded-lg bg-white border border-gray-200 shadow-md z-50 py-1 overflow-hidden">
+                <ul className="absolute right-0 mt-1 w-36 origin-top-right rounded-lg bg-background border border-hairline shadow-md z-50 py-1 overflow-hidden">
                     {children}
                 </ul>
             )}

frontend/src/components/Selector.tsx

@@ -7,8 +7,8 @@ type Props = {
 
 const Selector = ({ children, label }: Props) => (
     <div className="flex items-center gap-2">
-        <label className="w-full text-sm text-gray-600">{label}</label>
+        <label className="w-full text-sm text-text-secondary">{label}</label>
-        <div className="w-px h-5 bg-gray-200 mx-2" />
+        <div className="w-px h-5 text-text-secondary mx-2" />
         {children}
     </div>
 );

frontend/src/components/Sidebar.tsx

@@ -1,50 +1,51 @@
 import clsx from "clsx";
 import SidebarButton from "./buttons/SidebarButton.tsx";
 import { Plus, Film, Home, User as UserIcon, Video, Radio } from 'lucide-react';
-import type {User} from "../utils/types.ts";
+import { useAuth } from "../auth/useAuth.ts";
 
 type props = {
-    user: User | null;
     className?: string
 }
 
-const Divider = () => <hr className="my-1.5 mx-2 border-gray-100" />;
+const Divider = () => <hr className="w-full my-1.5 mx-2 border-hover" />;
+
+const Sidebar = ({className}: props) => {
+    const { user } = useAuth();
 
-const Sidebar = ({user, className}: props) => {
     return (
-        <aside className={clsx("h-screen flex flex-col bg-white border-r border-gray-200", className)}>
+        <aside className={clsx("h-screen flex flex-col bg-sidebar border-r border-hairline p-2 items-center gap-1", className)}>
-            <div className="px-4 pt-5 pb-3">
+            <h2 className={"font-heading text-2xl mt-1"}>The VoD System</h2>
-                <img
+
-                    className="w-36 mx-auto"
+            <nav className="flex flex-col flex-1 items-center w-3/4">
-                    src="../../public/logo.png"
+                <Divider />
-                    alt="VoD System Logo"
+
-                />
+                <div className="flex flex-col gap-0.5 w-full">
-            </div>
-            <nav className="flex flex-col flex-1 px-2 pb-4">
-                <div className="flex flex-col gap-0.5">
                     <SidebarButton url="/" logo={<Home size={18}/>} label="Home" />
                     <SidebarButton url="/create" logo={<Plus size={18}/>} label="Create Clip" />
                 </div>
 
-                {user && (
-                    <>
                 <Divider />
-                        <div className="flex flex-col gap-0.5">
+
+                {user && (
+                        <div className="flex flex-col gap-0.5 w-full">
+                            <div>
                                 <SidebarButton url="/stream" logo={<Radio size={18}/>} label="Stream" />
                                 <SidebarButton url="/my-clips" logo={<Film size={18}/>} label="Clips" />
                                 <SidebarButton url="/my-vods" logo={<Video size={18}/>} label="VoDs" />
                             </div>
-                    </>
+                        </div>
                 )}
 
                 <div className="flex-1" />
 
+                <div className={"w-full"}>
                     {user && (
                         <>
                             <Divider />
                             <SidebarButton url="/profile" logo={<UserIcon size={18}/>} label="Profile" />
                         </>
                     )}
+                </div>
             </nav>
         </aside>
     );

frontend/src/components/Topbar.tsx

@@ -1,21 +1,19 @@
-import { Menu, X } from 'lucide-react';
+import { Menu, X, Sun, Moon } from 'lucide-react';
-import { login, logout } from "../utils/api/users.ts";
 import { Dropdown, DropdownItem } from "./Dropdown.tsx";
 import { GoogleLogin } from '@react-oauth/google';
 
-import type { User } from "../utils/types.ts";
 import type { CredentialResponse } from '@react-oauth/google';
 
 import MenuButton from "./buttons/MenuButton.tsx";
 import clsx from "clsx";
 import {useNavigate} from "react-router-dom";
+import { useAuth } from "../auth/useAuth.ts";
+import { useTheme } from "../theme/useTheme.ts";
 
 
 type props = {
     sidebarToggled: boolean;
     setSidebarToggled: (toggled: boolean) => void;
-    user: User | null;
-    fetchUser: () => void;
     isStreaming: boolean;
     className?: string;
 }
@@ -23,12 +21,12 @@ type props = {
 const Topbar = ({
                     sidebarToggled,
                     setSidebarToggled,
-                    user,
-                    fetchUser,
                     isStreaming,
                     className}: props) => {
 
     const navigate = useNavigate();
+    const { user, login, logout } = useAuth();
+    const { theme, toggleTheme } = useTheme();
 
     const handleLogin = (response: CredentialResponse) => {
         if (!response.credential) {
@@ -37,34 +35,38 @@ const Topbar = ({
         }
 
         login(response.credential)
-            .then(() => {
-                fetchUser();
-                navigate(0);
-            })
             .catch((error) => {
                 console.error("Login failed:", error);
             });
     }
 
+    const themeLabel = theme === "dark" ? "Switch to light mode" : "Switch to dark mode";
+
     const handleLogout = () => {
         logout()
-            .then(() => {
+            .then(() => navigate("/"))
-                fetchUser();
-                navigate("/");
-            })
             .catch((error) => {
                 console.error("Logout failed:", error);
             });
     }
 
     return (
-        <div className={clsx(className, "flex justify-between items-center px-4 py-2 bg-white border-b border-gray-200")}>
+        <div className={clsx(className, "flex justify-between items-center px-4 py-2 bg-sidebar border-b border-hairline")}>
             <MenuButton onClick={() => setSidebarToggled(!sidebarToggled)}>
                 {sidebarToggled ? <Menu size={24}/> :  <X size={24}/>}
             </MenuButton>
 
+            <div className="flex items-center gap-1">
+                <MenuButton
+                    onClick={toggleTheme}
+                    title={themeLabel}
+                    aria-label={themeLabel}
+                >
+                    {theme === "dark" ? <Sun size={20}/> : <Moon size={20}/>}
+                </MenuButton>
+
                 { user ? (
-                <div>
+                <div className={"hover:bg-hover rounded-lg p-0.5"}>
                     <img
                         className={"w-8 h-8 rounded-full inline-block"}
                         src={user.profilePictureUrl}
@@ -76,8 +78,8 @@ const Topbar = ({
                             {user.name}
                             {isStreaming && (
                                 <span className="relative flex h-2 w-2">
-                                    <span className="animate-ping absolute inline-flex h-full w-full rounded-full bg-red-500 opacity-75" />
+                                    <span className="animate-ping absolute inline-flex h-full w-full rounded-full bg-live opacity-75" />
-                                    <span className="relative inline-flex rounded-full h-2 w-2 bg-red-500" />
+                                    <span className="relative inline-flex rounded-full h-2 w-2 bg-live" />
                                 </span>
                             )}
                         </span>
@@ -86,17 +88,19 @@ const Topbar = ({
                                       onClick={() => navigate("/profile")} />
                         <DropdownItem item="Logout"
                                       onClick={() => handleLogout()}
-                                      className={"text-red-500 font-medium"} />
+                                      className={"text-error font-medium"} />
                     </Dropdown>
                 </div>
                 ) :
                 (
                 <GoogleLogin
                     shape={"pill"}
+                    theme={theme === "dark" ? "filled_black" : "outline"}
                     useOneTap={false}
                     onSuccess={(credentialResponse) => handleLogin(credentialResponse)} />
                 )}
             </div>
+        </div>
     )
 }
 

frontend/src/components/buttons/BlueButton.tsx

@@ -1,14 +0,0 @@
-import React from "react";
-
-type Props = React.ButtonHTMLAttributes<HTMLButtonElement>;
-
-const BlueButton: React.FC<Props> = ({ className = "", ...props }) => {
-  return (
-    <button
-      className={`bg-primary text-white font-medium rounded-lg hover:bg-primary-pressed transition-colors duration-150 h-10 px-4 ${className}`}
-      {...props}
-    />
-  );
-};
-
-export default BlueButton;

frontend/src/components/buttons/MenuButton.tsx

@@ -6,7 +6,7 @@ type Props = React.ButtonHTMLAttributes<HTMLButtonElement>;
 const MenuButton: React.FC<Props> = ({ className = "", ...props }) => {
     return (
         <button
-            className={clsx("p-2 rounded-md text-gray-600 hover:bg-gray-100 hover:text-gray-900 transition-colors duration-150", className)}
+            className={clsx("p-2 rounded-md text-text-secondary hover:bg-hover hover:text-text-primary transition-colors duration-150", className)}
             {...props}
         />
     );

frontend/src/components/buttons/PrimaryButton.tsx

@@ -0,0 +1,14 @@
+import React from "react";
+
+type Props = React.ButtonHTMLAttributes<HTMLButtonElement>;
+
+const PrimaryButton: React.FC<Props> = ({ className = "", ...props }) => {
+  return (
+    <button
+      className={`bg-terracotta text-on-accent font-body text-sm rounded-lg hover:bg-terracotta-hover disabled:bg-terracotta-disabled transition-colors duration-150 h-10 px-4 ${className}`}
+      {...props}
+    />
+  );
+};
+
+export default PrimaryButton;

frontend/src/components/buttons/SidebarButton.tsx

@@ -1,5 +1,5 @@
-import MenuButton from "./MenuButton.tsx";
 import { Link, useLocation } from "react-router-dom";
+import React from "react";
 
 type Props = {
     url: string;
@@ -13,9 +13,15 @@ const SidebarButton = ({url, logo, label}: Props) => {
 
     return (
         <Link className="w-full" to={url}>
-            <MenuButton className={`flex items-center gap-2.5 w-full px-3 py-2 text-sm font-medium rounded-md ${isActive ? "bg-gray-100 text-gray-900" : "text-gray-600"}`}>
+            <button className={`flex items-center gap-2.5 w-full text-sm 
+            font-body p-2 hover:bg-hover hover:text-text-strong
+            rounded-md 
+            ${isActive ?
+                "bg-card text-text-strong font-medium shadow-sm"
+                :
+                "text-text-primary"}`}>
                 {logo}{label}
-            </MenuButton>
+            </button>
         </Link>
     )
 }

frontend/src/components/stream/MarkerList.tsx

@@ -0,0 +1,173 @@
+import { useState } from "react";
+import { Bookmark, Plus, X } from "lucide-react";
+import clsx from "clsx";
+import Box from "../Box.tsx";
+import CardHeader from "../CardHeader.tsx";
+import PrimaryButton from "../buttons/PrimaryButton.tsx";
+import type { Marker } from "../../utils/types.ts";
+import { formatLocalTime } from "../../utils/utils.ts";
+
+const inputClass = "border border-hairline bg-fields rounded-md w-full p-2 text-sm focus:outline-none focus:ring-2 focus:ring-muted transition-colors";
+
+type RailSegment = "none" | "plain" | "lit";
+
+const railClass = (segment: RailSegment) => clsx(
+    "w-px",
+    segment === "lit" && "bg-terracotta",
+    segment === "plain" && "bg-inactive-strong/60",
+    segment === "none" && "bg-transparent"
+);
+
+type MarkerRowProps = {
+    marker: Marker;
+    role: "start" | "end" | "between" | null;
+    /** Rail segments above and below the dot — "lit" inside the chosen section. */
+    railAbove: RailSegment;
+    railBelow: RailSegment;
+    onSelect: () => void;
+    onDelete: () => void;
+};
+
+const MarkerRow = ({ marker, role, railAbove, railBelow, onSelect, onDelete }: MarkerRowProps) => (
+    <li className="group relative flex gap-3">
+        {/* Timeline rail: a dot per marker, with the segment between the chosen
+            start and end lit so the selected section reads as one run. */}
+        <div className="flex w-2.5 flex-col items-center flex-shrink-0">
+            <span className={clsx("h-3.5 flex-shrink-0", railClass(railAbove))} />
+            <span className={clsx(
+                "h-2.5 w-2.5 rounded-full border-2 flex-shrink-0 transition-colors duration-150",
+                role === "start" && "border-terracotta bg-terracotta",
+                role === "end" && "border-olive bg-olive",
+                role === "between" && "border-terracotta bg-card",
+                role === null && "border-inactive-strong bg-card"
+            )} />
+            <span className={clsx("flex-1", railClass(railBelow))} />
+        </div>
+
+        {/* The rail spans the full row, so the breathing room goes on the button —
+            the line stays continuous while neighbouring rings no longer touch. */}
+        <button
+            onClick={onSelect}
+            className={clsx(
+                "min-w-0 flex-1 rounded-md my-0.5 py-2 pl-2.5 pr-7 text-left transition-colors duration-150",
+                role === "start" && "bg-selected ring-1 ring-terracotta",
+                role === "end" && "bg-selected ring-1 ring-olive",
+                (role === "between" || role === null) && "hover:bg-hover"
+            )}
+        >
+            <p className="truncate text-sm font-medium text-text-strong">{marker.message}</p>
+            <p className="font-data text-[11px] text-muted tabular-nums">
+                {formatLocalTime(marker.timestamp)}
+                {role === "start" && <span className="font-medium text-terracotta"> · start</span>}
+                {role === "end" && <span className="font-medium text-olive"> · end</span>}
+            </p>
+        </button>
+
+        <button
+            onClick={onDelete}
+            title="Delete marker"
+            aria-label={`Delete marker ${marker.message}`}
+            className="absolute right-1 top-2.5 flex h-5 w-5 items-center justify-center rounded-md text-muted opacity-0 transition duration-150 hover:bg-hover hover:text-error focus-visible:opacity-100 group-hover:opacity-100"
+        >
+            <X size={12} />
+        </button>
+    </li>
+);
+
+type Props = {
+    /** Newest first — the list renders them in the order given. */
+    markers: Marker[];
+    startMarkerId: string;
+    endMarkerId: string;
+    error: string | null;
+    /** Resolves true once the marker exists, so the input only clears on success. */
+    onAdd: (message: string) => Promise<boolean>;
+    onSelect: (id: number) => void;
+    onDelete: (id: number) => void;
+    className?: string;
+};
+
+const MarkerList = ({ markers, startMarkerId, endMarkerId, error, onAdd, onSelect, onDelete, className }: Props) => {
+    const [message, setMessage] = useState("");
+    const [busy, setBusy] = useState(false);
+
+    const handleAdd = async () => {
+        if (!message.trim() || busy) return;
+        setBusy(true);
+        if (await onAdd(message.trim())) setMessage("");
+        setBusy(false);
+    };
+
+    // Either of the two may have been picked first, so the lit run is bounded by
+    // whichever indices come first/last rather than by start/end.
+    const startIndex = markers.findIndex((m) => String(m.id) === startMarkerId);
+    const endIndex = markers.findIndex((m) => String(m.id) === endMarkerId);
+    const hasRange = startIndex !== -1 && endIndex !== -1;
+    const rangeFrom = hasRange ? Math.min(startIndex, endIndex) : -1;
+    const rangeTo = hasRange ? Math.max(startIndex, endIndex) : -1;
+    // The rail segment sitting between marker `i` and the one after it.
+    const railSegment = (i: number): RailSegment => {
+        if (i < 0 || i >= markers.length - 1) return "none";
+        return hasRange && i >= rangeFrom && i < rangeTo ? "lit" : "plain";
+    };
+
+    return (
+        <Box className={clsx("p-5 flex flex-col gap-4", className)}>
+            <div className="flex items-center justify-between gap-3">
+                <CardHeader icon={Bookmark} title="Markers" accent="accent" />
+                {markers.length > 0 && (
+                    <span className="font-data text-[11px] text-muted tabular-nums">{markers.length}</span>
+                )}
+            </div>
+
+            <div className="flex flex-col gap-2">
+                <div className="flex gap-2">
+                    <input
+                        type="text"
+                        value={message}
+                        onChange={(e) => setMessage(e.target.value)}
+                        onKeyDown={(e) => e.key === "Enter" && handleAdd()}
+                        placeholder="What just happened?"
+                        className={inputClass}
+                    />
+                    <PrimaryButton
+                        onClick={handleAdd}
+                        disabled={busy || !message.trim()}
+                        className="flex items-center gap-1.5 px-3 whitespace-nowrap"
+                    >
+                        <Plus size={15} />
+                        Add
+                    </PrimaryButton>
+                </div>
+                {error && <p className="text-sm text-error">{error}</p>}
+            </div>
+
+            {markers.length === 0 ? (
+                <p className="text-sm text-muted">
+                    Nothing marked yet. Markers stack up here, newest first — pick two to save the section between them.
+                </p>
+            ) : (
+                /* py-0.5 keeps the scroll container from clipping the selection
+                   ring on the first and last rows. */
+                <ul className="-mr-1 flex max-h-[26rem] flex-col overflow-y-auto py-0.5 pr-1">
+                    {markers.map((m, i) => (
+                        <MarkerRow
+                            key={m.id}
+                            marker={m}
+                            role={String(m.id) === startMarkerId ? "start"
+                                : String(m.id) === endMarkerId ? "end"
+                                : hasRange && i > rangeFrom && i < rangeTo ? "between"
+                                : null}
+                            railAbove={railSegment(i - 1)}
+                            railBelow={railSegment(i)}
+                            onSelect={() => onSelect(m.id)}
+                            onDelete={() => onDelete(m.id)}
+                        />
+                    ))}
+                </ul>
+            )}
+        </Box>
+    );
+};
+
+export default MarkerList;

frontend/src/components/video/ConfigBox.tsx

@@ -8,7 +8,7 @@ type Props = {
     className?: string;
 };
 
-const inputClass = "border border-gray-300 bg-white rounded-md w-full p-2 text-sm focus:outline-none focus:ring-2 focus:ring-primary/20 focus:border-primary transition-colors";
+const inputClass = "border border-hairline bg-card rounded-md w-full p-2 text-sm focus:outline-none focus:ring-2 focus:ring-muted transition-colors";
 
 export default function ConfigBox({ setMetadata, className }: Props) {
     const updateRes = (e: React.ChangeEvent<HTMLSelectElement>) => {
@@ -26,7 +26,7 @@ export default function ConfigBox({ setMetadata, className }: Props) {
 
     return (
         <div className={clsx("flex flex-col gap-3 p-6", className)}>
-            <h2 className="text-sm font-semibold text-gray-800 mb-1">Export Settings</h2>
+            <h2 className="text-sm text-text-primary font-semibold mb-1">Export Settings</h2>
 
             <Selector label="Resolution">
                 <select id="resolution" name="resolution" defaultValue="1280,720"

frontend/src/components/video/ExportWidget.tsx

@@ -1,4 +1,4 @@
-import BlueButton from "../buttons/BlueButton.tsx";
+import PrimaryButton from "../buttons/PrimaryButton.tsx";
 import React from "react";
 
 type props = {
@@ -24,24 +24,24 @@ const Spinner = () => (
 const ExportWidget = ({dataSend, handleDownload, downloadable, progress, uploading}: props) => {
     return (
         <div className={"flex flex-col gap-3"}>
-            <BlueButton
+            <PrimaryButton
                 onClick={dataSend}
                 disabled={uploading}
                 className={uploading ? "opacity-60 cursor-not-allowed flex items-center justify-center gap-2" : ""}
             >
                 {uploading && <Spinner />}
                 {uploading ? "Uploading..." : "Export"}
-            </BlueButton>
+            </PrimaryButton>
 
             <div className="h-10 flex items-center">
                 { downloadable ?
-                    (<BlueButton className="w-full" onClick={handleDownload}>
+                    (<PrimaryButton className="w-full" onClick={handleDownload}>
                         Download
-                    </BlueButton>)
+                    </PrimaryButton>)
                     :(
                         <progress
                             value={progress}
-                            className="w-full h-1.5 rounded bg-gray-200">
+                            className="w-full h-1.5 rounded bg-fields">
                         </progress>
                     )
                 }

frontend/src/components/video/MetadataBox.tsx

@@ -9,12 +9,15 @@ type Props = {
 
 const MetadataBox = ({ setMetadata, className }: Props) => (
     <div className={clsx("flex flex-col content-between p-6 gap-2", className)}>
-        <p className="w-full font-semibold text-gray-800 text-sm">Title</p>
+        <p className="w-full font-body text-text-strong font-bold text-sm">
+            Title <span className="text-error">*</span>
+        </p>
         <input
             type="text"
+            required
             placeholder="Enter title"
             onChange={(e) => setMetadata(prev => ({ ...prev, title: e.target.value }))}
-            className="border border-gray-300 bg-white rounded-md w-full p-2 text-sm focus:outline-none focus:ring-2 focus:ring-primary/20 focus:border-primary transition-colors"
+            className="border border-hairline bg-fields rounded-md w-full p-2 text-sm focus:outline-none focus:ring-2 focus:ring-muted transition-colors"
         />
     </div>
 );

frontend/src/components/video/Playbar.tsx

@@ -62,11 +62,11 @@ export default function Playbar({ video, videoMetadata, className }: Props) {
             </div>
             <button
                 onClick={togglePlay}
-                className="hover:bg-gray-100 rounded-full p-1.5 transition-colors duration-150 text-gray-700"
+                className="hover:bg-hover rounded-full p-1.5 transition-colors duration-150 text-text-body"
             >
                 {isPlaying ? <Pause size={24} /> : <Play size={24} />}
             </button>
-            <span>
+            <span className="font-data text-sm text-text-secondary tabular-nums">
                 {formatTime(video?.currentTime ?? 0)} / {formatTime(videoMetadata.duration ?? 0)}
             </span>
         </div>

frontend/src/components/video/TimeGroupedGrid.tsx

@@ -0,0 +1,25 @@
+import type { ReactNode } from "react";
+import { groupByTimeRange } from "../../utils/utils";
+
+type props<T> = {
+    items: T[];
+    getDate: (item: T) => string;
+    renderItem: (item: T) => ReactNode;
+}
+
+const TimeGroupedGrid = <T,>({ items, getDate, renderItem }: props<T>) => {
+    return (
+        <div className="flex flex-col gap-8">
+            {groupByTimeRange(items, getDate).map((group) => (
+                <section key={group.label}>
+                    <h2 className="text-xl font-heading text-text-primary mb-3">{group.label}</h2>
+                    <div className="grid grid-cols-2 sm:grid-cols-3 md:grid-cols-4 lg:grid-cols-5 gap-4">
+                        {group.items.map(renderItem)}
+                    </div>
+                </section>
+            ))}
+        </div>
+    );
+}
+
+export default TimeGroupedGrid;

frontend/src/components/video/VideoCard.tsx

@@ -1,9 +1,9 @@
 import clsx from "clsx";
 import { formatTime, stringToDate, dateToTimeAgo } from "../../utils/utils.ts";
 import { Link } from "react-router-dom";
-import { useEffect, useRef, useState } from "react";
+import React, { useEffect, useRef, useState } from "react";
-import { isThumbnailAvailable } from "../../utils/api/client.ts";
 import { MoreVertical, Pencil, Trash2 } from "lucide-react";
+import {config} from "../../config.ts";
 
 type VideoCardProps = {
     id: number,
@@ -18,12 +18,12 @@ type VideoCardProps = {
     itemLabel?: string,
 }
 
-const fallbackThumbnail = "../../../public/default_thumbnail.png";
+const fallbackThumbnail = "public/default_thumbnail.png";
-const API_URL = import.meta.env.VITE_API_URL;
+const API_URL = config.apiUrl;
 
 const VideoCard = ({ id, title, duration, createdAt, onEdit, onDelete, className, mediaApiPath = '/api/v1/clips', playerPath = '/video', itemLabel = 'clip' }: VideoCardProps) => {
     const [timeAgo, setTimeAgo] = useState(dateToTimeAgo(stringToDate(createdAt)));
-    const [thumbnailAvailable, setThumbnailAvailable] = useState(true);
+    const [imgFailed, setImgFailed] = useState(false);
     const [menuOpen, setMenuOpen] = useState(false);
     const [confirmDelete, setConfirmDelete] = useState(false);
     const menuRef = useRef<HTMLDivElement>(null);
@@ -36,12 +36,6 @@ const VideoCard = ({ id, title, duration, createdAt, onEdit, onDelete, className
         return () => clearInterval(interval);
     }, [createdAt]);
 
-    useEffect(() => {
-        isThumbnailAvailable(thumbnailUrl)
-            .then(setThumbnailAvailable)
-            .catch(() => setThumbnailAvailable(false));
-    }, [thumbnailUrl]);
-
     useEffect(() => {
         if (!menuOpen) return;
         const handleClickOutside = (e: MouseEvent) => {
@@ -65,12 +59,13 @@ const VideoCard = ({ id, title, duration, createdAt, onEdit, onDelete, className
             <div className={clsx("flex flex-col group cursor-pointer", className)}>
                 <div className="relative overflow-hidden rounded-lg">
                     <img
-                        src={thumbnailAvailable ? thumbnailUrl : fallbackThumbnail}
+                        src={imgFailed ? fallbackThumbnail : thumbnailUrl}
+                        onError={() => setImgFailed(true)}
                         alt="Video Thumbnail"
                         className="w-full aspect-video object-cover group-hover:scale-105 transition-transform duration-200"
                     />
 
-                    <span className="absolute top-1.5 left-1.5 bg-black/70 text-white px-1.5 py-0.5 rounded text-xs font-medium pointer-events-none">
+                    <span className="absolute top-1.5 left-1.5 bg-media-backdrop/75 text-on-dark px-1.5 py-0.5 rounded text-xs font-data pointer-events-none">
                         {formatTime(duration)}
                     </span>
 
@@ -82,18 +77,18 @@ const VideoCard = ({ id, title, duration, createdAt, onEdit, onDelete, className
                         >
                             <button
                                 onClick={(e) => stopAndRun(e, () => { setMenuOpen(v => !v); setConfirmDelete(false); })}
-                                className="bg-black/70 hover:bg-black/90 text-white rounded p-0.5 transition-colors"
+                                className="bg-media-backdrop/75 hover:bg-media-backdrop/90 text-on-dark rounded p-0.5 transition-colors"
                             >
                                 <MoreVertical size={14} />
                             </button>
 
                             {menuOpen && (
-                                <div className="absolute right-0 top-7 w-32 bg-white rounded-lg border border-gray-200 shadow-md z-50 py-1 overflow-hidden">
+                                <div className="absolute right-0 top-7 w-32 bg-card rounded-lg border border-hairline shadow-md z-50 py-1 overflow-hidden">
                                     {!confirmDelete && (<>
                                         {onEdit && (
                                             <button
                                                 onClick={(e) => stopAndRun(e, onEdit)}
-                                                className="flex items-center gap-2 w-full px-3 py-2 text-sm text-gray-700 hover:bg-gray-50"
+                                                className="flex items-center gap-2 w-full px-3 py-2 text-sm text-text-body hover:bg-hover"
                                             >
                                                 <Pencil size={13} /> Edit
                                             </button>
@@ -101,7 +96,7 @@ const VideoCard = ({ id, title, duration, createdAt, onEdit, onDelete, className
                                         {onDelete && (
                                             <button
                                                 onClick={(e) => stopAndRun(e, () => setConfirmDelete(true))}
-                                                className="flex items-center gap-2 w-full px-3 py-2 text-sm text-red-500 hover:bg-red-50"
+                                                className="flex items-center gap-2 w-full px-3 py-2 text-sm text-error hover:bg-hover"
                                             >
                                                 <Trash2 size={13} /> Delete
                                             </button>
@@ -109,17 +104,17 @@ const VideoCard = ({ id, title, duration, createdAt, onEdit, onDelete, className
                                     </>)}
                                     {confirmDelete && (
                                         <div className="px-3 py-2">
-                                            <p className="text-xs text-gray-600 mb-2">Delete this {itemLabel}?</p>
+                                            <p className="text-xs text-text-secondary mb-2">Delete this {itemLabel}?</p>
                                             <div className="flex gap-1.5">
                                                 <button
                                                     onClick={(e) => stopAndRun(e, onDelete!)}
-                                                    className="flex-1 text-xs bg-red-500 text-white rounded px-2 py-1 hover:bg-red-600 transition-colors"
+                                                    className="flex-1 text-xs bg-error text-on-accent rounded px-2 py-1 hover:bg-terracotta-hover transition-colors"
                                                 >
                                                     Delete
                                                 </button>
                                                 <button
                                                     onClick={(e) => stopAndRun(e, () => setConfirmDelete(false))}
-                                                    className="flex-1 text-xs bg-gray-100 text-gray-600 rounded px-2 py-1 hover:bg-gray-200 transition-colors"
+                                                    className="flex-1 text-xs bg-fields text-text-secondary rounded px-2 py-1 hover:bg-hover transition-colors"
                                                 >
                                                     Cancel
                                                 </button>
@@ -133,10 +128,10 @@ const VideoCard = ({ id, title, duration, createdAt, onEdit, onDelete, className
                 </div>
 
                 <div className="flex flex-col p-2">
-                    <p className="font-medium text-gray-900 text-sm leading-snug line-clamp-2">
+                    <p className="font-body text-text-strong text-sm leading-snug line-clamp-2">
                         {title === "" ? "(No Title)" : title}
                     </p>
-                    <p className="text-gray-500 text-xs mt-0.5">{timeAgo}</p>
+                    <p className="text-muted text-xs mt-0.5">{timeAgo}</p>
                 </div>
             </div>
         </Link>

frontend/src/config.ts

@@ -0,0 +1,5 @@
+export const config = {
+    apiUrl: window._env_?.VITE_API_URL ?? import.meta.env.VITE_API_URL ?? '',
+    frontendUrl: window._env_?.VITE_FRONTEND_URL ?? import.meta.env.VITE_FRONTEND_URL ?? '',
+    googleClientId: window._env_?.VITE_GOOGLE_CLIENT_ID ?? import.meta.env.VITE_GOOGLE_CLIENT_ID ?? '',
+};

frontend/src/index.css

@@ -1,45 +1,170 @@
 @import "tailwindcss";
-@plugin "flowbite-react/plugin/tailwindcss";
+
-@source "../.flowbite-react/class-list.json";
+/* Drive the `dark:` variant off the same data-theme attribute the toggle sets,
+   instead of Tailwind's default prefers-color-scheme. Without this a stray
+   `dark:` utility would disagree with an explicit light/dark choice. */
+@custom-variant dark (&:where([data-theme="dark"], [data-theme="dark"] *));
 
 @theme {
-    --font-sans: "Inter", ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+    /* ── Fonts ───────────────────────────────────────────────────────────── */
+    --font-body: "IBM Plex Sans", system-ui, sans-serif;
+    --font-data: "IBM Plex Mono", monospace;
 
-    /* Breakpoints */
+    /* ── Surfaces ────────────────────────────────────────────────────────── */
-    --breakpoint-3xl: 1920px;
+    --color-background: #F7F4EE;
+    --color-sidebar: #F2EEE6;
+    --color-card: #FDFBF7;
+    --color-fields: #F4F0E8;
+    --color-dropzone: #F9F6EF;
 
-    --color-primary: oklch(0.55 0.21 254);
+    /* Letterbox behind video. Dark in both themes — it is a cinema surface,
-    --color-primary-pressed: oklch(0.45 0.21 254);
+       not an ink colour — so `text-on-dark` always reads on top of it. */
-    --color-secondary: oklch(0.94 0.01 250);
+    --color-media-backdrop: #2B2620;
-    --color-accent: oklch(0.68 0.20 288);
-    --color-text: oklch(0.17 0.01 270);
-    --color-background: oklch(0.97 0.005 250);
-    --color-surface: oklch(1 0 0);
-    --color-border: oklch(0.91 0.008 250);
 
-    /* Easing */
+    /* ── Ink ─────────────────────────────────────────────────────────────── */
-    --ease-fluid: cubic-bezier(0.3, 0, 0, 1);
+    --color-text-primary: #2B2620;
-    --ease-snappy: cubic-bezier(0.2, 0, 0, 1);
+    --color-text-strong: #35302A;
+    --color-text-body: #554D44;
+    --color-text-secondary: #6E6559;
+    --color-muted: #9A9084;
+    --color-faint-mono: #A79C8E;
+
+    /* ── Accents ─────────────────────────────────────────────────────────── */
+    --color-terracotta: #A85A38;
+    --color-terracotta-hover: #94492A;
+    --color-terracotta-light: #C87A52;
+    --color-terracotta-disabled: #C9AE9C;
+    --color-olive: #6E7A50;
+
+    /* ── Status ──────────────────────────────────────────────────────────── */
+    --color-live: #B5432E;
+    --color-error: #B5432E;
+
+    /* ── Ink on dark / accent surfaces ───────────────────────────────────── */
+    --color-on-dark: #FBF8F2;
+    --color-on-accent: #FDFBF7;
+
+    /* ── Lines, chips, placeholders ──────────────────────────────────────── */
+    --color-hairline: #F0EBE2;
+    --color-hover: #E7E0D2;
+    --color-selected: #F6EFE6;
+    --color-ring: #E2DACB;
+    --color-inactive: #DED7CA;
+    --color-inactive-strong: #C4BAA9;
 }
 
-#range-slider .range-slider__range {
+/* Dark mode. Only token values change here: every component already styles
-    background: var(--color-primary);
+   itself with the semantic utilities above, so the whole UI follows from this
+   one block. `--color-on-dark` is deliberately absent — it is the ink on the
+   media backdrop, which stays dark in both themes.
+
+   Soft charcoal rather than pure black, with only a trace of warmth so it
+   still sits with the paper tones of the light theme. Ink is a warm off-white
+   instead of #FFF, and terracotta becomes a gentle clay. Layering matches the
+   light theme: sidebar recessed, cards raised, fields inset into the card. */
+:root[data-theme="dark"] {
+    color-scheme: dark;
+
+    /* ── Surfaces ────────────────────────────────────────────────────────── */
+    --color-background: #161615;
+    --color-sidebar: #111111;
+    --color-card: #1F1F1E;
+    --color-fields: #1A1A19;
+    --color-dropzone: #1C1C1B;
+
+    --color-media-backdrop: #0B0B0B;
+
+    /* ── Ink ─────────────────────────────────────────────────────────────── */
+    --color-text-primary: #F5F4EF;
+    --color-text-strong: #E8E6E0;
+    --color-text-body: #C9C7C0;
+    --color-text-secondary: #A2A099;
+    --color-muted: #87857F;
+    --color-faint-mono: #6C6B66;
+
+    /* ── Accents ── clay and sage; hover lightens rather than deepens ────── */
+    --color-terracotta: #D97757;
+    --color-terracotta-hover: #E28B6E;
+    --color-terracotta-light: #BC6A4E;
+    --color-terracotta-disabled: #46372F;
+    --color-olive: #A7AF84;
+
+    /* ── Status ──────────────────────────────────────────────────────────── */
+    --color-live: #E0644E;
+    --color-error: #E0644E;
+
+    /* ── Ink on accent surfaces ── the accents are light here, so the ink that
+       sits on them flips dark ─────────────────────────────────────────────── */
+    --color-on-accent: #1A1410;
+
+    /* ── Lines, chips, placeholders ──────────────────────────────────────── */
+    --color-hairline: #282827;
+    --color-hover: #2A2A29;
+    --color-selected: #2A2522;
+    --color-ring: #3B3B3A;
+    --color-inactive: #333332;
+    --color-inactive-strong: #5A5955;
 }
 
-#range-slider .range-slider__thumb {
+/* Tailwind's shadows default to 10% black, which vanishes on a dark canvas.
-    background: var(--color-primary);
+   `--tw-shadow-color` does not inherit, so it is set on the shadowed elements
+   themselves; a deeper warm-black keeps cards and menus visibly lifted. */
+:root[data-theme="dark"] :where(.shadow-sm, .shadow-md) {
+    --tw-shadow-color: rgb(0 0 0 / 0.45);
 }
 
 :root {
-    font-family: "Inter", ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+    font-family: "IBM Plex Sans", system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
     line-height: 1.5;
     font-weight: 400;
     font-synthesis: none;
     text-rendering: optimizeLegibility;
     -webkit-font-smoothing: antialiased;
     -moz-osx-font-smoothing: grayscale;
+    color-scheme: light;
 }
 
 body {
     background-color: var(--color-background);
+    font-family: "IBM Plex Sans", system-ui, sans-serif;
+    color: var(--color-text-body);
+}
+
+@utility font-heading {
+    font-family: "Newsreader", serif;
+    font-weight: 400;
+    color: var(--color-text-primary);
+}
+
+/* Google Identity Services renders its sign-in button in a cross-origin iframe
+   whose document is light-scheme with a transparent background. Left to inherit
+   our `color-scheme: dark`, Chrome cannot honour dark there and paints an opaque
+   white canvas behind it instead — framing the pill in a white box on every dark
+   page. Pinning the iframe back to light keeps it transparent; the button's own
+   colours come from the `theme` prop in Topbar.tsx. */
+iframe[src*="accounts.google.com/gsi/"] {
+    color-scheme: light;
+}
+
+/* Clip trim slider (react-range-slider-input). Its own stylesheet ships blue
+   defaults; the #id beats those class selectors regardless of import order. */
+#range-slider {
+    height: 8px;
+    background: var(--color-fields);
+    border-radius: 8px;
+}
+
+#range-slider .range-slider__range {
+    background: var(--color-terracotta-light);
+}
+
+#range-slider .range-slider__thumb {
+    width: 18px;
+    height: 18px;
+    background: var(--color-terracotta);
+    box-shadow: 0 1px 2px rgba(90, 40, 20, 0.2);
+}
+
+#range-slider .range-slider__thumb:focus-visible {
+    box-shadow: 0 0 0 4px color-mix(in oklab, var(--color-terracotta) 35%, transparent);
 }

frontend/src/layouts/MainLayout.tsx

@@ -3,27 +3,13 @@ import Sidebar from '../components/Sidebar'
 import Topbar from '../components/Topbar'
 import { Outlet } from 'react-router-dom';
 import {useEffect, useState} from "react";
-import type {User} from "../utils/types";
+import { useAuth } from "../auth/useAuth";
-import { getUser } from "../utils/api/users";
 import { getStreamStatus } from "../utils/api/stream";
 
 const MainLayout = () => {
     const [sidebarToggled, setSidebarToggled] = useState(false);
-    const [user, setUser] = useState<null | User>(null);
     const [isStreaming, setIsStreaming] = useState(false);
-
+    const { user } = useAuth();
-    const fetchUser = async () => {
-        try {
-            const userData = await getUser();
-            setUser(userData);
-        } catch (error) {
-            console.error('Failed to fetch user:', error);
-        }
-    };
-
-    useEffect(() => {
-        fetchUser();
-    }, []);
 
     useEffect(() => {
         if (!user) return;
@@ -34,16 +20,13 @@ const MainLayout = () => {
     }, [user]);
 
     return (
-        <div className={`transition-all duration-300 grid h-screen ${sidebarToggled ? "grid-cols-[0px_1fr]" : "grid-cols-[240px_1fr]"} grid-rows-[auto_1fr]`}>
+        <div className={`transition-all duration-300 grid h-screen ${sidebarToggled ? "grid-cols-[0px_1fr]" : "grid-cols-[252px_1fr]"} grid-rows-[auto_1fr]`}>
             <Sidebar
-                user={user}
                 className={`row-span-2 transition-all duration-300 overflow-hidden whitespace-nowrap ${sidebarToggled ? "-translate-x-full" : "translate-x-0"}`}/>
             <Topbar
                 className={"transition-all duration-300"}
                 sidebarToggled={sidebarToggled}
                 setSidebarToggled={setSidebarToggled}
-                user={user}
-                fetchUser={fetchUser}
                 isStreaming={isStreaming}/>
             <div className="overflow-auto bg-background">
                 <Outlet />

frontend/src/pages/ClipEdit.tsx

@@ -6,13 +6,11 @@ import ClipRangeSlider from "./../components/video/ClipRangeSlider";
 import ConfigBox from "../components/video/ConfigBox.tsx";
 import ExportWidget from "../components/video/ExportWidget.tsx";
 import { compress } from "../utils/api/media"
-import { getJob } from "../utils/api/jobs"
+import { getJob, downloadJob } from "../utils/api/jobs"
 import type { VideoMetadata } from "../utils/types.ts";
 import Box from "../components/Box.tsx";
 import MetadataBox from "../components/video/MetadataBox.tsx";
 
-const API_URL = import.meta.env.VITE_API_URL;
-
 const ClipEdit = () => {
     const location = useLocation();
     const localFile: File = location.state?.file;
@@ -63,12 +61,18 @@ const ClipEdit = () => {
     const sendData = async () => {
         if (!localFile || uploading) return;
 
+        const title = outputMetadata.title.trim();
+        if (!title) {
+            setError('A title is required before exporting.');
+            return;
+        }
+
         setUploading(true);
         setError(null);
 
         let jobId: string;
         try {
-            jobId = await compress(localFile, outputMetadata);
+            jobId = await compress(localFile, { ...outputMetadata, title });
             setUploadedId(jobId);
         } catch (err: unknown) {
             setError(`Failed to start compression: ${err instanceof Error ? err.message : 'Unknown error'}`);
@@ -79,7 +83,7 @@ const ClipEdit = () => {
         const interval = setInterval(async () => await pollProgress(jobId, interval), 500);
     };
 
-    const pollProgress = async (jobId: string, intervalId: number) => {
+    const pollProgress = async (jobId: string, intervalId: ReturnType<typeof setInterval>) => {
         getJob(jobId)
             .then((job) => {
                 setProgress(job.progress);
@@ -104,14 +108,14 @@ const ClipEdit = () => {
     const handleDownload = async () => {
         if (!uploadedId) return;
 
-        const response = await fetch(API_URL + `/api/v1/jobs/${uploadedId}/download`, { credentials: 'include' });
+        let blob: Blob;
-
+        try {
-        if (!response.ok) {
+            blob = await downloadJob(uploadedId);
-            console.error('Download failed');
+        } catch (err) {
+            console.error('Download failed', err);
             return;
         }
 
-        const blob = await response.blob();
         const url = window.URL.createObjectURL(blob);
         const a = document.createElement('a');
 
@@ -128,7 +132,7 @@ const ClipEdit = () => {
             <video
                 ref={videoRef}
                 src={videoUrl}
-                className={"w-full rounded-lg shadow-sm bg-black"}
+                className={"w-full rounded-lg shadow-sm bg-media-backdrop"}
                 onLoadedMetadata={handleVideoMetadataLoaded}
             />
 
@@ -142,7 +146,7 @@ const ClipEdit = () => {
                     <Playbar
                         video={videoRef.current}
                         videoMetadata={metadata}
-                        className={"w-full accent-primary"}
+                        className={"w-full accent-terracotta"}
                     />
 
                     <PlaybackSlider
@@ -150,7 +154,7 @@ const ClipEdit = () => {
                         videoMetadata={metadata}
                         sliderValue={playbackValue}
                         setSliderValue={setPlaybackValue}
-                        className={"w-full accent-primary"}
+                        className={"w-full accent-terracotta"}
                     />
 
                     <ClipRangeSlider
@@ -158,11 +162,11 @@ const ClipEdit = () => {
                         videoMetadata={metadata}
                         setSliderValue={setPlaybackValue}
                         setMetadata={setOutputMetadata}
-                        className={"w-full mt-2 bg-primary"}
+                        className={"w-full mt-2"}
                     />
 
                     {error && (
-                        <div className={"text-red-600 text-center mt-2"}>
+                        <div className={"text-error text-center mt-2"}>
                             {error}
                         </div>
                     )}

frontend/src/pages/ClipUpload.tsx

@@ -1,12 +1,11 @@
 import {useState} from "react";
 import {useNavigate} from "react-router-dom";
-import BlueButton from "../components/buttons/BlueButton.tsx";
 import Box from "../components/Box.tsx";
 
 const ClipUpload = () => {
     const [file, setFile] = useState<File | null>(null);
-    const navigate = useNavigate();
     const [error, setError] = useState<null | string>(null);
+    const navigate = useNavigate();
 
     const press = () => {
         if (!file) {
@@ -17,10 +16,17 @@ const ClipUpload = () => {
     };
 
     return (
-        <div className="flex items-start justify-center p-8 min-h-full">
+        <div className="flex justify-center p-8">
             <Box className="flex flex-col gap-4 p-6 w-full max-w-md">
-                <h1 className="text-lg font-semibold text-gray-900">Upload Clip</h1>
+                <div
-
+                    className="cursor-pointer rounded-lg border-2
+                                border-dashed border-hairline bg-dropzone
+                                text-center text-sm text-text-secondary
+                                hover:bg-hover transition-colors duration-150
+                                min-h-50 flex flex-col items-center justify-center gap-2"
+                    >
+                    <label className="cursor-pointer flex flex-col items-center justify-center gap-2 w-full h-full">
+                        Choose file
                         <input
                             type="file"
                             onChange={(e) => {
@@ -28,12 +34,22 @@ const ClipUpload = () => {
                                 setFile(selected);
                                 setError(null);
                             }}
-                    className="h-36 cursor-pointer rounded-lg border-2 border-dashed border-gray-300 bg-gray-50 p-4 text-center text-sm text-gray-500 hover:bg-gray-100 hover:border-primary transition-colors duration-150"
+                            className="hidden"
                         />
+                    </label>
+                    {file && (
+                        <p className="mt-2 text-xs text-text-secondary">{file.name}</p>
+                    )}
+                </div>
 
-                <BlueButton onClick={press}>Upload</BlueButton>
+                <button
+                    onClick={press}
+                    className={"hover:bg-hover p-1 rounded-md"}
+                >
+                    Upload
+                </button>
 
-                {error && <p className="text-sm text-red-500 text-center">{error}</p>}
+                {error && <p className="text-sm font-body text-center">{error}</p>}
             </Box>
         </div>
     )

frontend/src/pages/EditClip.tsx

@@ -3,9 +3,9 @@ import { useNavigate, useParams } from "react-router-dom";
 import { ArrowLeft, Check } from "lucide-react";
 import { getClipById, patchClip } from "../utils/api/clips.ts";
 import Box from "../components/Box.tsx";
-import BlueButton from "../components/buttons/BlueButton.tsx";
+import PrimaryButton from "../components/buttons/PrimaryButton.tsx";
 
-const inputClass = "border border-gray-300 bg-white rounded-md w-full p-2 text-sm focus:outline-none focus:ring-2 focus:ring-primary/20 focus:border-primary transition-colors";
+const inputClass = "border border-hairline bg-fields rounded-md w-full p-2 text-sm focus:outline-none focus:ring-2 focus:ring-muted transition-colors";
 
 const EditClip = () => {
     const { id } = useParams();
@@ -50,20 +50,20 @@ const EditClip = () => {
         <div className="px-8 py-10 max-w-2xl mx-auto">
             <button
                 onClick={() => navigate(-1)}
-                className="flex items-center gap-1.5 text-sm text-gray-500 hover:text-gray-900 mb-6 transition-colors duration-150"
+                className="flex items-center gap-1.5 text-sm text-text-secondary hover:text-text-primary mb-6 transition-colors duration-150"
             >
                 <ArrowLeft size={16} />
                 Back
             </button>
 
-            <h1 className="text-2xl font-semibold text-gray-900 mb-6">Edit Clip</h1>
+            <h1 className="text-4xl font-heading text-text-primary mb-6">Edit Clip</h1>
 
             {loading ? (
-                <div className="text-gray-400 text-sm">Loading...</div>
+                <div className="text-muted text-sm">Loading...</div>
             ) : (
                 <Box className="p-6 flex flex-col gap-4">
                     <div className="flex flex-col gap-1.5">
-                        <label className="text-sm font-medium text-gray-700">Title</label>
+                        <label className="text-sm font-medium text-text-secondary">Title</label>
                         <input
                             type="text"
                             value={title}
@@ -74,7 +74,7 @@ const EditClip = () => {
                     </div>
 
                     <div className="flex flex-col gap-1.5">
-                        <label className="text-sm font-medium text-gray-700">Description</label>
+                        <label className="text-sm font-medium text-text-secondary">Description</label>
                         <textarea
                             value={description}
                             onChange={(e) => setDescription(e.target.value)}
@@ -84,17 +84,17 @@ const EditClip = () => {
                         />
                     </div>
 
-                    {error && <p className="text-sm text-red-500">{error}</p>}
+                    {error && <p className="text-sm text-error">{error}</p>}
 
                     <div className="flex items-center gap-3 pt-1">
-                        <BlueButton onClick={handleSave} disabled={saving} className="w-28">
+                        <PrimaryButton onClick={handleSave} disabled={saving} className="w-28">
                             {saving ? "Saving…" : saved
                                 ? <span className="flex items-center gap-1.5 justify-center"><Check size={14} />Saved</span>
                                 : "Save"}
-                        </BlueButton>
+                        </PrimaryButton>
                         <button
                             onClick={() => navigate(-1)}
-                            className="text-sm text-gray-500 hover:text-gray-900 transition-colors duration-150"
+                            className="text-sm text-text-secondary hover:text-text-primary transition-colors duration-150"
                         >
                             Cancel
                         </button>

frontend/src/pages/EditVod.tsx

@@ -3,9 +3,9 @@ import { useNavigate, useParams } from "react-router-dom";
 import { ArrowLeft, Check } from "lucide-react";
 import { getVodById, patchVod } from "../utils/api/vods.ts";
 import Box from "../components/Box.tsx";
-import BlueButton from "../components/buttons/BlueButton.tsx";
+import PrimaryButton from "../components/buttons/PrimaryButton.tsx";
 
-const inputClass = "border border-gray-300 bg-white rounded-md w-full p-2 text-sm focus:outline-none focus:ring-2 focus:ring-primary/20 focus:border-primary transition-colors";
+const inputClass = "border border-hairline bg-fields rounded-md w-full p-2 text-sm focus:outline-none focus:ring-2 focus:ring-muted transition-colors";
 
 const EditVod = () => {
     const { id } = useParams();
@@ -50,20 +50,20 @@ const EditVod = () => {
         <div className="px-8 py-10 max-w-2xl mx-auto">
             <button
                 onClick={() => navigate(-1)}
-                className="flex items-center gap-1.5 text-sm text-gray-500 hover:text-gray-900 mb-6 transition-colors duration-150"
+                className="flex items-center gap-1.5 text-sm text-text-secondary hover:text-text-primary mb-6 transition-colors duration-150"
             >
                 <ArrowLeft size={16} />
                 Back
             </button>
 
-            <h1 className="text-2xl font-semibold text-gray-900 mb-6">Edit VoD</h1>
+            <h1 className="text-4xl font-heading text-text-primary mb-6">Edit VoD</h1>
 
             {loading ? (
-                <div className="text-gray-400 text-sm">Loading...</div>
+                <div className="text-muted text-sm">Loading...</div>
             ) : (
                 <Box className="p-6 flex flex-col gap-4">
                     <div className="flex flex-col gap-1.5">
-                        <label className="text-sm font-medium text-gray-700">Title</label>
+                        <label className="text-sm font-medium text-text-secondary">Title</label>
                         <input
                             type="text"
                             value={title}
@@ -74,7 +74,7 @@ const EditVod = () => {
                     </div>
 
                     <div className="flex flex-col gap-1.5">
-                        <label className="text-sm font-medium text-gray-700">Description</label>
+                        <label className="text-sm font-medium text-text-secondary">Description</label>
                         <textarea
                             value={description}
                             onChange={(e) => setDescription(e.target.value)}
@@ -84,17 +84,17 @@ const EditVod = () => {
                         />
                     </div>
 
-                    {error && <p className="text-sm text-red-500">{error}</p>}
+                    {error && <p className="text-sm text-error">{error}</p>}
 
                     <div className="flex items-center gap-3 pt-1">
-                        <BlueButton onClick={handleSave} disabled={saving} className="w-28">
+                        <PrimaryButton onClick={handleSave} disabled={saving} className="w-28">
                             {saving ? "Saving…" : saved
                                 ? <span className="flex items-center gap-1.5 justify-center"><Check size={14} />Saved</span>
                                 : "Save"}
-                        </BlueButton>
+                        </PrimaryButton>
                         <button
                             onClick={() => navigate(-1)}
-                            className="text-sm text-gray-500 hover:text-gray-900 transition-colors duration-150"
+                            className="text-sm text-text-secondary hover:text-text-primary transition-colors duration-150"
                         >
                             Cancel
                         </button>

frontend/src/pages/Home.tsx

@@ -43,10 +43,10 @@ const Home = () => {
                     alt="VoD System Logo"
                     className="h-24 mb-6 object-contain"
                 />
-                <h1 className="text-4xl font-semibold text-gray-900 mb-3 leading-tight">
+                <h1 className="text-4xl font-heading text-text-primary">
                     A home for your clips.
                 </h1>
-                <p className="text-base text-gray-500 leading-relaxed">
+                <p className="text-text-secondary">
                     Upload, trim, and export video clips. Stream live if you need to.
                 </p>
             </div>
@@ -56,21 +56,21 @@ const Home = () => {
                 {features.map(({ icon: Icon, title, description }) => (
                     <div
                         key={title}
-                        className="bg-white border border-gray-200 rounded-xl p-5 flex flex-col gap-3 shadow-sm"
+                        className="bg-card border border-hairline rounded-xl p-5 flex flex-col gap-3 shadow-sm"
                     >
-                        <div className="w-9 h-9 rounded-lg bg-primary/10 flex items-center justify-center flex-shrink-0">
+                        <div className="w-9 h-9 rounded-lg flex items-center justify-center shrink-0">
-                            <Icon size={18} className="text-primary" />
+                            <Icon size={18} className="text-terracotta" />
                         </div>
                         <div>
-                            <p className="font-semibold text-gray-900 text-sm mb-1">{title}</p>
+                            <p className="font-body text-text-strong font-bold text-sm mb-1">{title}</p>
-                            <p className="text-sm text-gray-500 leading-relaxed">{description}</p>
+                            <p className="text-sm text-text-secondary leading-relaxed">{description}</p>
                         </div>
                     </div>
                 ))}
             </div>
 
             {/* Format note */}
-            <p className="text-xs text-gray-400">
+            <p className="text-xs text-muted">
                 Supports MP4, MOV, WebM, and OGG.
             </p>
         </div>

frontend/src/pages/MediaPlayer.tsx

@@ -1,13 +1,27 @@
 import { useCallback, useEffect, useRef, useState } from "react";
 import { useNavigate, useParams } from "react-router-dom";
 import { ArrowLeft, Lock, Maximize, Minimize, Pause, Play, Volume1, Volume2, VolumeX } from "lucide-react";
-import type { Clip } from "../utils/types";
 import { AuthError } from "../utils/api/client.ts";
-import { getClipById, getVideoBlob } from "../utils/api/clips.ts";
 import Box from "../components/Box.tsx";
 import { dateToTimeAgo, formatTime, stringToDate } from "../utils/utils.ts";
 
-const VideoPlayer = () => {
+// Both VoDs and clips share the same on-screen shape.
+type MediaItem = {
+    title: string,
+    createdAt: string,
+};
+
+type MediaPlayerProps = {
+    /** Human-readable name for the media, e.g. "VoD" or "clip". Used in messages. */
+    noun: string,
+    /** Builds the raw media stream URL for the given id. Loaded directly by the
+     *  <video> element so the browser can issue HTTP Range requests. */
+    getMediaUrl: (id: string) => string,
+    /** Fetches the media metadata for the given id. */
+    fetchDetails: (id: string) => Promise<MediaItem | null>,
+};
+
+const MediaPlayer = ({ noun, getMediaUrl, fetchDetails }: MediaPlayerProps) => {
     const { id } = useParams();
     const navigate = useNavigate();
 
@@ -17,10 +31,11 @@ const VideoPlayer = () => {
     const hideTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
 
     // Data
-    const [videoUrl, setVideoUrl] = useState<string | undefined>(undefined);
+    const mediaUrl = id ? getMediaUrl(id) : undefined;
+    const [mediaLoaded, setMediaLoaded] = useState(false);
     const [error, setError] = useState<string | null>(null);
     const [notAuthenticated, setNotAuthenticated] = useState(false);
-    const [clip, setClip] = useState<Clip | null>(null);
+    const [item, setItem] = useState<MediaItem | null>(null);
     const [timeAgo, setTimeAgo] = useState("");
 
     // Playback
@@ -40,28 +55,28 @@ const VideoPlayer = () => {
     const [isDragging, setIsDragging] = useState(false);
 
     // ── Data loading ────────────────────────────────────────────────────────
+    // The video stream itself is loaded by the <video> element from `mediaUrl`,
+    // which lets the browser fetch it incrementally via Range requests. We only
+    // need to fetch the metadata here; it shares the media endpoint's auth, so a
+    // 401/403 here also stands in for the stream being inaccessible.
     useEffect(() => {
-        if (!id) { setError("Clip ID is required."); return; }
+        if (!id) { setError(`${noun} ID is required.`); return; }
 
-        getVideoBlob(id)
+        fetchDetails(id)
-            .then((blob) => setVideoUrl(URL.createObjectURL(blob)))
+            .then(setItem)
-            .catch((e) => { if (e instanceof AuthError) setNotAuthenticated(true); });
-
-        getClipById(id)
-            .then(setClip)
             .catch((e) => {
                 if (e instanceof AuthError) setNotAuthenticated(true);
-                else setError("Failed to load clip details.");
+                else setError(`Failed to load ${noun.toLowerCase()} details.`);
             });
-    }, [id]);
+    }, [id, noun, fetchDetails]);
 
     useEffect(() => {
-        if (!clip?.createdAt) return;
+        if (!item?.createdAt) return;
-        const update = () => setTimeAgo(dateToTimeAgo(stringToDate(clip.createdAt)));
+        const update = () => setTimeAgo(dateToTimeAgo(stringToDate(item.createdAt)));
         update();
         const interval = setInterval(update, 1000);
         return () => clearInterval(interval);
-    }, [clip]);
+    }, [item]);
 
     // ── Controls visibility ─────────────────────────────────────────────────
     const scheduleHide = useCallback(() => {
@@ -187,16 +202,16 @@ const VideoPlayer = () => {
     if (notAuthenticated) {
         return (
             <div className="h-full flex flex-col items-center justify-center gap-4 text-center p-8">
-                <div className="w-14 h-14 rounded-full bg-gray-100 flex items-center justify-center">
+                <div className="w-14 h-14 rounded-full bg-fields flex items-center justify-center">
-                    <Lock size={24} className="text-gray-400" />
+                    <Lock size={24} className="text-muted" />
                 </div>
                 <div>
-                    <p className="text-lg font-semibold text-gray-900">Not authenticated</p>
+                    <p className="text-2xl font-heading text-text-primary">Not authenticated</p>
-                    <p className="text-sm text-gray-500 mt-1">You don't have access to this clip.</p>
+                    <p className="text-sm text-text-secondary mt-1">You don't have access to this {noun.toLowerCase()}.</p>
                 </div>
                 <button
                     onClick={() => navigate(-1)}
-                    className="flex items-center gap-1.5 text-sm text-gray-500 hover:text-gray-900 transition-colors duration-150"
+                    className="flex items-center gap-1.5 text-sm text-text-secondary hover:text-text-primary transition-colors duration-150"
                 >
                     <ArrowLeft size={16} />
                     Go back
@@ -209,7 +224,7 @@ const VideoPlayer = () => {
         <div className="h-full flex flex-col p-4 gap-3">
             <button
                 onClick={() => navigate(-1)}
-                className="flex items-center gap-1.5 text-sm text-gray-500 hover:text-gray-900 flex-shrink-0 transition-colors duration-150"
+                className="flex items-center gap-1.5 text-sm text-text-secondary hover:text-text-primary flex-shrink-0 transition-colors duration-150"
             >
                 <ArrowLeft size={16} />
                 Back
@@ -218,7 +233,7 @@ const VideoPlayer = () => {
             {/* Player */}
             <div
                 ref={containerRef}
-                className="relative bg-black rounded-xl overflow-hidden flex-1 min-h-0 select-none"
+                className="relative bg-media-backdrop rounded-xl overflow-hidden flex-1 min-h-0 select-none"
                 onMouseMove={showControls}
                 onMouseLeave={() => isPlaying && setControlsVisible(false)}
                 onClick={togglePlay}
@@ -227,7 +242,10 @@ const VideoPlayer = () => {
                 <video
                     ref={videoRef}
                     className="w-full h-full object-contain"
-                    src={videoUrl}
+                    src={mediaUrl}
+                    // Send auth cookies with the cross-origin Range requests.
+                    crossOrigin="use-credentials"
+                    preload="metadata"
                     onPlay={() => { setIsPlaying(true); scheduleHide(); }}
                     onPause={() => {
                         setIsPlaying(false);
@@ -235,16 +253,19 @@ const VideoPlayer = () => {
                         if (hideTimerRef.current) clearTimeout(hideTimerRef.current);
                     }}
                     onTimeUpdate={handleTimeUpdate}
-                    onLoadedMetadata={() => { if (videoRef.current) setDuration(videoRef.current.duration); }}
+                    onLoadedMetadata={() => {
+                        if (videoRef.current) setDuration(videoRef.current.duration);
+                        setMediaLoaded(true);
+                    }}
                     onWaiting={() => setIsWaiting(true)}
                     onCanPlay={() => setIsWaiting(false)}
                     onError={(e) => setError(e.currentTarget.error?.message || "An error occurred.")}
                 />
 
                 {/* Buffering spinner */}
-                {isWaiting && videoUrl && (
+                {isWaiting && mediaUrl && (
                     <div className="absolute inset-0 flex items-center justify-center pointer-events-none">
-                        <div className="w-11 h-11 rounded-full border-[3px] border-white/20 border-t-white animate-spin" />
+                        <div className="w-11 h-11 rounded-full border-[3px] border-on-dark/20 border-t-on-dark animate-spin" />
                     </div>
                 )}
 
@@ -261,20 +282,20 @@ const VideoPlayer = () => {
                         {/* Scrub bar */}
                         <div
                             ref={progressRef}
-                            className="relative h-1 rounded-full bg-white/25 cursor-pointer mb-3 group/prog hover:h-1.5 transition-[height] duration-150"
+                            className="relative h-1 rounded-full bg-on-dark/25 cursor-pointer mb-3 group/prog hover:h-1.5 transition-[height] duration-150"
                             onMouseDown={(e) => { setIsDragging(true); seekTo(e.clientX); }}
                         >
-                            <div className="absolute inset-y-0 left-0 bg-white/35 rounded-full" style={{ width: `${bufferedPct}%` }} />
+                            <div className="absolute inset-y-0 left-0 bg-on-dark/35 rounded-full" style={{ width: `${bufferedPct}%` }} />
-                            <div className="absolute inset-y-0 left-0 bg-primary rounded-full" style={{ width: `${progressPct}%` }} />
+                            <div className="absolute inset-y-0 left-0 bg-terracotta-light rounded-full" style={{ width: `${progressPct}%` }} />
                             <div
-                                className="absolute top-1/2 -translate-y-1/2 w-3 h-3 bg-white rounded-full shadow opacity-0 group-hover/prog:opacity-100 transition-opacity"
+                                className="absolute top-1/2 -translate-y-1/2 w-3 h-3 bg-on-dark rounded-full shadow opacity-0 group-hover/prog:opacity-100 transition-opacity"
                                 style={{ left: `calc(${progressPct}% - 6px)` }}
                             />
                         </div>
 
                         {/* Buttons row */}
-                        <div className="flex items-center gap-3 text-white">
+                        <div className="flex items-center gap-3 text-on-dark">
-                            <button onClick={togglePlay} className="hover:text-white/70 transition-colors">
+                            <button onClick={togglePlay} className="hover:text-on-dark/70 transition-colors">
                                 {isPlaying
                                     ? <Pause size={20} fill="currentColor" />
                                     : <Play size={20} fill="currentColor" />}
@@ -282,7 +303,7 @@ const VideoPlayer = () => {
 
                             {/* Volume — slider expands on hover */}
                             <div className="flex items-center gap-1.5 group/vol">
-                                <button onClick={toggleMute} className="hover:text-white/70 transition-colors">
+                                <button onClick={toggleMute} className="hover:text-on-dark/70 transition-colors">
                                     <VolumeIcon size={18} />
                                 </button>
                                 <div className="overflow-hidden w-0 group-hover/vol:w-16 transition-[width] duration-200">
@@ -291,18 +312,18 @@ const VideoPlayer = () => {
                                         min={0} max={1} step={0.02}
                                         value={effectiveVolume}
                                         onChange={handleVolumeChange}
-                                        className="w-16 accent-white cursor-pointer"
+                                        className="w-16 accent-on-dark cursor-pointer"
                                     />
                                 </div>
                             </div>
 
-                            <span className="text-xs font-mono tabular-nums text-white/80">
+                            <span className="text-xs font-data tabular-nums text-on-dark/80">
                                 {formatTime(currentTime)} / {formatTime(duration)}
                             </span>
 
                             <div className="flex-1" />
 
-                            <button onClick={toggleFullscreen} className="hover:text-white/70 transition-colors">
+                            <button onClick={toggleFullscreen} className="hover:text-on-dark/70 transition-colors">
                                 {isFullscreen ? <Minimize size={18} /> : <Maximize size={18} />}
                             </button>
                         </div>
@@ -310,20 +331,20 @@ const VideoPlayer = () => {
                 </div>
             </div>
 
-            {error && <div className="text-red-500 text-sm mt-3">{error}</div>}
+            {error && <div className="text-error text-sm mt-3">{error}</div>}
-            {!videoUrl && !error && (
+            {!mediaLoaded && !error && (
-                <div className="text-gray-400 text-sm mt-3 flex items-center gap-2">
+                <div className="text-muted text-sm mt-3 flex items-center gap-2">
-                    <div className="w-3 h-3 rounded-full border-2 border-gray-300 border-t-gray-500 animate-spin" />
+                    <div className="w-3 h-3 rounded-full border-2 border-inactive border-t-muted animate-spin" />
                     Loading video...
                 </div>
             )}
 
             <Box className="p-4 flex-shrink-0">
-                <p className="text-xl font-semibold text-gray-900">{clip?.title || "(No Title)"}</p>
+                <p className="text-2xl font-heading text-text-primary">{item?.title || "(No Title)"}</p>
-                <p className="text-sm text-gray-500 mt-1">{timeAgo}</p>
+                <p className="text-sm text-text-secondary mt-1">{timeAgo}</p>
             </Box>
         </div>
     );
 };
 
-export default VideoPlayer;
+export default MediaPlayer;

frontend/src/pages/MyClips.tsx

@@ -1,18 +1,22 @@
 import VideoCard from "../components/video/VideoCard";
+import TimeGroupedGrid from "../components/video/TimeGroupedGrid";
 import { useEffect, useState } from "react";
 import { useNavigate } from "react-router-dom";
 import { getClips, deleteClip } from "../utils/api/clips";
+import { stringToDate } from "../utils/utils";
 import type { Clip } from "../utils/types";
 
 const MyClips = () => {
     const [clips, setClips] = useState<Clip[]>([]);
     const [error, setError] = useState<null | string>(null);
+    const [loading, setLoading] = useState(true);
     const navigate = useNavigate();
 
     useEffect(() => {
         getClips()
-            .then((data) => setClips(data.sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime())))
+            .then((data) => setClips(data.sort((a, b) => stringToDate(b.createdAt).getTime() - stringToDate(a.createdAt).getTime())))
-            .catch((err) => setError(err));
+            .catch((err) => setError(err))
+            .finally(() => setLoading(false));
     }, []);
 
     const handleDelete = async (id: number) => {
@@ -26,10 +30,12 @@ const MyClips = () => {
 
     return (
         <div className="p-6">
-            <h1 className="text-2xl font-semibold text-gray-900 mb-6">My Clips</h1>
+            <h1 className="text-4xl font-heading text-text-primary mb-6">My Clips</h1>
 
-            <div className="grid grid-cols-2 sm:grid-cols-3 md:grid-cols-4 lg:grid-cols-5 gap-4">
+            <TimeGroupedGrid
-                {clips.map((clip) => (
+                items={clips}
+                getDate={(clip) => clip.createdAt}
+                renderItem={(clip) => (
                     <VideoCard
                         key={clip.id}
                         id={clip.id}
@@ -39,17 +45,17 @@ const MyClips = () => {
                         onEdit={() => navigate(`/clips/${clip.id}/edit`)}
                         onDelete={() => handleDelete(clip.id)}
                     />
-                ))}
+                )}
-            </div>
+            />
 
-            {clips.length === 0 && !error && (
+            {clips.length === 0 && !error && !loading && (
-                <div className="flex flex-col items-center justify-center py-16 text-gray-400">
+                <div className="flex flex-col items-center justify-center py-16 text-muted">
                     <p className="text-base">No clips yet.</p>
                     <p className="text-sm mt-1">Upload your first clip to get started.</p>
                 </div>
             )}
 
-            {error && <p className="text-sm text-red-500 mt-4">{error.toString()}</p>}
+            {error && <p className="text-sm text-error mt-4">{error.toString()}</p>}
         </div>
     );
 }

frontend/src/pages/MyVods.tsx

@@ -1,18 +1,22 @@
 import VideoCard from "../components/video/VideoCard";
+import TimeGroupedGrid from "../components/video/TimeGroupedGrid";
 import { useEffect, useState } from "react";
 import { useNavigate } from "react-router-dom";
 import { getVods, deleteVod } from "../utils/api/vods";
+import { stringToDate } from "../utils/utils";
 import type { Vod } from "../utils/types";
 
 const MyVods = () => {
     const [vods, setVods] = useState<Vod[]>([]);
     const [error, setError] = useState<null | string>(null);
+    const [loading, setLoading] = useState(true);
     const navigate = useNavigate();
 
     useEffect(() => {
         getVods()
-            .then((data) => setVods(data.sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime())))
+            .then((data) => setVods(data.sort((a, b) => stringToDate(b.createdAt).getTime() - stringToDate(a.createdAt).getTime())))
-            .catch((err) => setError(err instanceof Error ? err.message : "Failed to load vods"));
+            .catch((err) => setError(err instanceof Error ? err.message : "Failed to load vods"))
+            .finally(() => setLoading(false));
     }, []);
 
     const handleDelete = async (id: number) => {
@@ -26,10 +30,12 @@ const MyVods = () => {
 
     return (
         <div className="p-6">
-            <h1 className="text-2xl font-semibold text-gray-900 mb-6">My VoDs</h1>
+            <h1 className="text-4xl font-heading text-text-primary mb-6">My VoDs</h1>
 
-            <div className="grid grid-cols-2 sm:grid-cols-3 md:grid-cols-4 lg:grid-cols-5 gap-4">
+            <TimeGroupedGrid
-                {vods.map((vod) => (
+                items={vods}
+                getDate={(vod) => vod.createdAt}
+                renderItem={(vod) => (
                     <VideoCard
                         key={vod.id}
                         id={vod.id}
@@ -42,17 +48,17 @@ const MyVods = () => {
                         onEdit={() => navigate(`/vods/${vod.id}/edit`)}
                         onDelete={() => handleDelete(vod.id)}
                     />
-                ))}
+                )}
-            </div>
+            />
 
-            {vods.length === 0 && !error && (
+            {vods.length === 0 && !error && !loading && (
-                <div className="flex flex-col items-center justify-center py-16 text-gray-400">
+                <div className="flex flex-col items-center justify-center py-16 text-muted">
                     <p className="text-base">No VoDs yet.</p>
                     <p className="text-sm mt-1">Your stream recordings will appear here.</p>
                 </div>
             )}
 
-            {error && <p className="text-sm text-red-500 mt-4">{error}</p>}
+            {error && <p className="text-sm text-error mt-4">{error}</p>}
         </div>
     );
 };

frontend/src/pages/NotFound.tsx

@@ -0,0 +1,24 @@
+import { Lock } from 'lucide-react';
+import {useNavigate} from "react-router-dom";
+
+const NotFound = () => {
+    const navigate = useNavigate();
+
+    const goHomePage = () => {
+        navigate("/")
+    }
+
+    return (
+        <div className="w-full min-h-screen flex flex-col items-center justify-center gap-3 text-center px-6">
+            <Lock className="w-8 h-8 text-faint-mono/60 mb-1" strokeWidth={1.5} />
+            <h2 className="font-heading text-2xl md:text-3xl text-faint-mono">
+                This page does not exist.
+            </h2>
+            <p className="text-sm text-faint-mono/70 max-w-xs">
+                <a onClick={goHomePage} className={"font-bold cursor-pointer"}>Click here</a> to get back to the home page.
+            </p>
+        </div>
+    );
+}
+
+export default NotFound;

frontend/src/pages/Profile.tsx

@@ -1,19 +1,14 @@
-import { useState, useEffect } from "react";
+import { useState } from "react";
 import { Eye, EyeOff, Copy, Check } from "lucide-react";
 import Box from "../components/Box.tsx";
-import { getUser } from "../utils/api/users.ts";
+import { useAuth } from "../auth/useAuth.ts";
-import type { User } from "../utils/types.ts";
 import { formatLocalDate } from "../utils/utils.ts";
 
 const Profile = () => {
-    const [user, setUser] = useState<User | null>(null);
+    const { user } = useAuth();
     const [keyVisible, setKeyVisible] = useState(false);
     const [copied, setCopied] = useState(false);
 
-    useEffect(() => {
-        getUser().then(setUser).catch(console.error);
-    }, []);
-
     const handleCopy = () => {
         if (!user?.streamKey) return;
         navigator.clipboard.writeText(user.streamKey);
@@ -23,7 +18,7 @@ const Profile = () => {
 
     if (!user) {
         return (
-            <div className="flex justify-center items-center h-full text-gray-400 text-base">
+            <div className="flex justify-center items-center h-full text-muted text-base">
                 Please log in to view your profile.
             </div>
         );
@@ -31,7 +26,7 @@ const Profile = () => {
 
     return (
         <div className="px-8 py-10 max-w-2xl mx-auto">
-            <h1 className="text-2xl font-semibold text-gray-900 mb-6">Profile</h1>
+            <h1 className="text-4xl font-heading text-text-primary mb-6">Profile</h1>
 
             <Box className="p-6 mb-4 flex items-center gap-5">
                 <img
@@ -41,31 +36,31 @@ const Profile = () => {
                     className="w-20 h-20 rounded-full shadow-sm"
                 />
                 <div>
-                    <p className="text-lg font-semibold text-gray-900">{user.name}</p>
+                    <p className="text-2xl font-heading text-text-primary">{user.name}</p>
-                    <p className="text-sm text-gray-500">@{user.username}</p>
+                    <p className="text-sm text-text-secondary">@{user.username}</p>
-                    <p className="text-sm text-gray-500">{user.email}</p>
+                    <p className="text-sm text-text-secondary">{user.email}</p>
-                    <p className="text-xs text-gray-400 mt-1">
+                    <p className="text-xs text-muted mt-1">
                         Member since {formatLocalDate(user.createdAt)}
                     </p>
                 </div>
             </Box>
 
             <Box className="p-6">
-                <h2 className="text-sm font-semibold text-gray-800 mb-1">Stream Key</h2>
+                <h2 className="text-xl font-heading text-text-primary mb-1">Stream Key</h2>
-                <p className="text-sm text-gray-500 mb-4">
+                <p className="text-sm text-text-secondary mb-4">
                     Use this key in OBS or any RTMP-compatible software to start streaming.
                     Keep it private — anyone with this key can stream to your account.
                 </p>
 
                 <div className="flex items-center gap-2">
-                    <div className="flex-1 bg-gray-50 border border-gray-200 rounded-md px-4 py-2 font-mono text-sm text-gray-700 overflow-hidden">
+                    <div className="flex-1 bg-fields border border-hairline rounded-md px-4 py-2 font-data text-sm text-text-strong overflow-hidden">
                         {keyVisible ? user.streamKey : "•".repeat(user.streamKey.length)}
                     </div>
 
                     <button
                         onClick={() => setKeyVisible(v => !v)}
                         title={keyVisible ? "Hide key" : "Show key"}
-                        className="p-2 rounded-md bg-gray-100 hover:bg-gray-200 transition-colors duration-150 text-gray-600"
+                        className="p-2 rounded-md bg-fields hover:bg-hover transition-colors duration-150 text-text-secondary"
                     >
                         {keyVisible ? <EyeOff size={16} /> : <Eye size={16} />}
                     </button>
@@ -73,9 +68,9 @@ const Profile = () => {
                     <button
                         onClick={handleCopy}
                         title="Copy key"
-                        className="p-2 rounded-md bg-gray-100 hover:bg-gray-200 transition-colors duration-150 text-gray-600"
+                        className="p-2 rounded-md bg-fields hover:bg-hover transition-colors duration-150 text-text-secondary"
                     >
-                        {copied ? <Check size={16} className="text-green-600" /> : <Copy size={16} />}
+                        {copied ? <Check size={16} className="text-olive" /> : <Copy size={16} />}
                     </button>
                 </div>
             </Box>

frontend/src/pages/StreamControl.tsx

@@ -1,18 +1,20 @@
 import { useEffect, useState } from "react";
-import { Radio, Check, Bookmark, Scissors, Film, Activity, Loader2, X } from "lucide-react";
+import { Radio, Check, Scissors, Film, Activity, Loader2, X } from "lucide-react";
 import clsx from "clsx";
 import Box from "../components/Box.tsx";
-import BlueButton from "../components/buttons/BlueButton.tsx";
+import CardHeader from "../components/CardHeader.tsx";
-import { getUser } from "../utils/api/users.ts";
+import MarkerList from "../components/stream/MarkerList.tsx";
+import PrimaryButton from "../components/buttons/PrimaryButton.tsx";
+import { useAuth } from "../auth/useAuth.ts";
 import { getCurrentStream, getStreamHistory } from "../utils/api/stream.ts";
 import { getMarkers, createMarker, deleteMarker } from "../utils/api/markers.ts";
 import { saveSectionByMarkers, clipSection } from "../utils/api/media.ts";
 import { getJob } from "../utils/api/jobs.ts";
-import type { User, StreamStatus, StreamHistoryItem, Marker, JobResponse } from "../utils/types.ts";
+import type { StreamStatus, StreamHistoryItem, Marker, JobResponse } from "../utils/types.ts";
-import { formatTime, formatLocalDate, stringToDate } from "../utils/utils.ts";
+import { formatLocalDate, stringToDate } from "../utils/utils.ts";
 
-const inputClass = "border border-gray-300 bg-white rounded-md w-full p-2 text-sm focus:outline-none focus:ring-2 focus:ring-primary/20 focus:border-primary transition-colors";
+const inputClass = "border border-hairline bg-fields rounded-md w-full p-2 text-sm focus:outline-none focus:ring-2 focus:ring-muted transition-colors";
-const labelClass = "text-xs font-medium text-gray-500 uppercase tracking-wide";
+const labelClass = "font-data text-[11px] text-muted uppercase tracking-[0.12em]";
 
 type TrackedJob = {
     uuid: string;
@@ -22,52 +24,40 @@ type TrackedJob = {
     errorOutput: string | null;
 };
 
-const CardHeader = ({ icon: Icon, title, accent = "primary" }: { icon: React.ElementType; title: string; accent?: "primary" | "accent" }) => (
-    <div className="flex items-center gap-2.5">
-        <div className={clsx("w-8 h-8 rounded-lg flex items-center justify-center flex-shrink-0", accent === "primary" ? "bg-primary/10" : "bg-accent/10")}>
-            <Icon size={16} className={accent === "primary" ? "text-primary" : "text-accent"} />
-        </div>
-        <h2 className="text-sm font-semibold text-gray-800">{title}</h2>
-    </div>
-);
-
 const JobStatus = ({ job }: { job: TrackedJob }) => {
     if (job.state === 'FAILED') {
         return (
             <div className="flex items-start gap-2 text-sm">
-                <X size={15} className="text-red-500 mt-0.5 flex-shrink-0" />
+                <X size={15} className="text-error mt-0.5 flex-shrink-0" />
-                <p className="text-red-500">{job.label} failed: {job.errorOutput ?? "Unknown error"}</p>
+                <p className="text-error">{job.label} failed: {job.errorOutput ?? "Unknown error"}</p>
             </div>
         );
     }
     if (job.state === 'SUCCEEDED') {
         return (
             <div className="flex items-center gap-2 text-sm">
-                <Check size={15} className="text-green-600 flex-shrink-0" />
+                <Check size={15} className="text-olive flex-shrink-0" />
-                <p className="text-gray-700">{job.label} saved</p>
+                <p className="text-text-body">{job.label} saved</p>
             </div>
         );
     }
     return (
         <div className="flex items-center gap-2">
-            <Loader2 size={15} className="text-primary animate-spin flex-shrink-0" />
+            <Loader2 size={15} className="text-terracotta animate-spin flex-shrink-0" />
             <div className="flex-1">
-                <p className="text-sm text-gray-600 mb-1">{job.label}…</p>
+                <p className="text-sm text-text-secondary mb-1">{job.label}…</p>
-                <progress value={job.progress} className="w-full h-1.5 rounded bg-gray-200" />
+                <progress value={job.progress} className="w-full h-1.5 rounded bg-fields" />
             </div>
         </div>
     );
 };
 
 const StreamControl = () => {
-    const [user, setUser] = useState<User | null>(null);
+    const { user } = useAuth();
     const [streamStatus, setStreamStatus] = useState<StreamStatus | null>(null);
     const [streamDetails, setStreamDetails] = useState<StreamHistoryItem | null>(null);
-    const [now, setNow] = useState(Date.now());
 
     const [markers, setMarkers] = useState<Marker[]>([]);
-    const [markerMessage, setMarkerMessage] = useState("");
-    const [markerBusy, setMarkerBusy] = useState(false);
     const [markerError, setMarkerError] = useState<string | null>(null);
 
     const [clipDuration, setClipDuration] = useState(30);
@@ -85,10 +75,6 @@ const StreamControl = () => {
 
     const isStreaming = streamStatus?.isStreaming ?? false;
 
-    useEffect(() => {
-        getUser().then(setUser).catch(() => setUser(null));
-    }, []);
-
     useEffect(() => {
         if (!user) return;
         const poll = () => getCurrentStream().then(setStreamStatus).catch(() => {});
@@ -107,16 +93,10 @@ const StreamControl = () => {
             .catch(() => {});
     }, [user, streamStatus?.id]);
 
-    useEffect(() => {
-        if (!streamDetails?.startDate) return;
-        const interval = setInterval(() => setNow(Date.now()), 1000);
-        return () => clearInterval(interval);
-    }, [streamDetails?.startDate]);
-
     const refreshMarkers = () => {
         getMarkers()
             .then((data) => setMarkers(data
-                .sort((a, b) => stringToDate(a.timestamp).getTime() - stringToDate(b.timestamp).getTime())))
+                .sort((a, b) => stringToDate(b.timestamp).getTime() - stringToDate(a.timestamp).getTime())))
             .catch(() => {});
     };
 
@@ -153,18 +133,15 @@ const StreamControl = () => {
         setJobs((prev) => [{ uuid, label, progress: 0, state: 'READY', errorOutput: null }, ...prev]);
     };
 
-    const handleAddMarker = async () => {
+    const handleAddMarker = async (message: string) => {
-        if (!markerMessage.trim() || markerBusy) return;
-        setMarkerBusy(true);
         setMarkerError(null);
         try {
-            await createMarker(markerMessage.trim());
+            await createMarker(message);
-            setMarkerMessage("");
             refreshMarkers();
+            return true;
         } catch (err) {
             setMarkerError(err instanceof Error ? err.message : "Failed to add marker");
-        } finally {
+            return false;
-            setMarkerBusy(false);
         }
     };
 
@@ -183,7 +160,7 @@ const StreamControl = () => {
     const handleSaveByMarkers = async () => {
         setMarkerSaveError(null);
         if (!startMarkerId || !endMarkerId) {
-            setMarkerSaveError("Tap two markers above to pick a start and end");
+            setMarkerSaveError("Pick a start and an end marker from the timeline");
             return;
         }
         try {
@@ -214,7 +191,7 @@ const StreamControl = () => {
         }
     };
 
-    const handleChipClick = (id: number) => {
+    const handleSelectMarker = (id: number) => {
         const idStr = String(id);
         setMarkerSaveError(null);
         if (startMarkerId === idStr) { setStartMarkerId(""); return; }
@@ -226,112 +203,88 @@ const StreamControl = () => {
 
     if (!user) {
         return (
-            <div className="flex justify-center items-center h-full text-gray-400 text-base">
+            <div className="flex justify-center items-center h-full text-muted text-base">
                 Please log in to control your stream.
             </div>
         );
     }
 
-    const elapsed = streamDetails?.startDate
-        ? formatTime((now - stringToDate(streamDetails.startDate).getTime()) / 1000)
-        : null;
-
     const startMarker = markers.find((m) => String(m.id) === startMarkerId);
     const endMarker = markers.find((m) => String(m.id) === endMarkerId);
 
     return (
         <div className="px-8 py-10 max-w-5xl mx-auto flex flex-col gap-5">
-            <h1 className="text-2xl font-semibold text-gray-900">Stream Control</h1>
+            <h1 className="text-4xl font-heading text-text-primary">Stream Control</h1>
 
             {/* Hero status bar */}
             <Box className={clsx(
                 "p-6 flex items-center justify-between gap-6 border-l-4",
-                isStreaming ? "border-l-red-500" : "border-l-gray-200"
+                isStreaming ? "border-l-live" : "border-l-hairline"
             )}>
                 <div className="flex items-center gap-3.5">
                     <span className="relative flex h-3.5 w-3.5">
-                        {isStreaming && <span className="animate-ping absolute inline-flex h-full w-full rounded-full bg-red-500 opacity-75" />}
+                        {isStreaming && <span className="animate-ping absolute inline-flex h-full w-full rounded-full bg-live opacity-75" />}
-                        <span className={clsx("relative inline-flex rounded-full h-3.5 w-3.5", isStreaming ? "bg-red-500" : "bg-gray-300")} />
+                        <span className={clsx("relative inline-flex rounded-full h-3.5 w-3.5", isStreaming ? "bg-live" : "bg-inactive-strong")} />
                     </span>
                     <div>
-                        <p className="font-semibold text-gray-900 text-lg leading-tight">{isStreaming ? "Live" : "Offline"}</p>
+                        <p className="text-2xl font-heading text-text-primary leading-tight">{isStreaming ? "Live" : "Offline"}</p>
                         {isStreaming && streamDetails?.startDate ? (
-                            <p className="text-sm text-gray-500">Started {formatLocalDate(streamDetails.startDate)}</p>
+                            <p className="text-sm text-text-secondary">Started {formatLocalDate(streamDetails.startDate)}</p>
                         ) : !isStreaming ? (
-                            <p className="text-sm text-gray-500">Point OBS at your stream key (see Profile) to go live.</p>
+                            <p className="text-sm text-text-secondary">Point OBS at your stream key (see Profile) to go live.</p>
                         ) : null}
                     </div>
                 </div>
 
-                {isStreaming && elapsed ? (
+                <Radio size={28} className={isStreaming ? "text-live" : "text-inactive"} />
-                    <div className="text-right">
-                        <p className="text-2xl font-mono font-semibold text-gray-900 tabular-nums">{elapsed}</p>
-                        <p className="text-xs text-gray-400 uppercase tracking-wide">elapsed</p>
-                    </div>
-                ) : (
-                    <Radio size={28} className="text-gray-200" />
-                )}
             </Box>
 
             {isStreaming && (
-                <>
+                <div className="grid grid-cols-1 lg:grid-cols-[minmax(0,1fr)_20rem] gap-5 items-start">
-                    {/* Quick mark toolbar */}
+                    {/* Marker timeline. First on narrow screens, where marking
-                    <Box className="p-4 flex flex-col gap-3">
+                        something as it happens beats the action forms for urgency. */}
-                        <div className="flex items-center gap-3">
+                    <MarkerList
-                            <Bookmark size={18} className="text-accent flex-shrink-0" />
+                        className="lg:order-last lg:sticky lg:top-6"
-                            <input
+                        markers={markers}
-                                type="text"
+                        startMarkerId={startMarkerId}
-                                value={markerMessage}
+                        endMarkerId={endMarkerId}
-                                onChange={(e) => setMarkerMessage(e.target.value)}
+                        error={markerError}
-                                onKeyDown={(e) => e.key === "Enter" && handleAddMarker()}
+                        onAdd={handleAddMarker}
-                                placeholder="What just happened?"
+                        onSelect={handleSelectMarker}
-                                className={inputClass}
+                        onDelete={handleDeleteMarker}
                     />
-                            <BlueButton onClick={handleAddMarker} disabled={markerBusy || !markerMessage.trim()} className="whitespace-nowrap">
-                                Add Marker
-                            </BlueButton>
-                        </div>
-                        {markerError && <p className="text-sm text-red-500">{markerError}</p>}
-
-                        {markers.length > 0 && (
-                            <div className="flex gap-2 overflow-x-auto pb-0.5 -mx-1 px-1 pt-1.5">
-                                {markers.map((m) => {
-                                    const isStart = startMarkerId === String(m.id);
-                                    const isEnd = endMarkerId === String(m.id);
-                                    return (
-                                        <div key={m.id} className="group relative flex-shrink-0">
-                                            <button
-                                                onClick={() => handleChipClick(m.id)}
-                                                className={clsx(
-                                                    "flex flex-col items-start gap-0.5 rounded-lg border px-3 py-1.5 text-left transition-colors duration-150",
-                                                    isStart && "border-primary bg-primary/5 ring-1 ring-primary",
-                                                    isEnd && "border-accent bg-accent/5 ring-1 ring-accent",
-                                                    !isStart && !isEnd && "border-gray-200 hover:border-gray-300 hover:bg-gray-50"
-                                                )}
-                                            >
-                                                <span className="text-xs font-medium text-gray-800 max-w-40 truncate">{m.message}</span>
-                                                <span className="text-[11px] text-gray-400">
-                                                    {formatLocalDate(m.timestamp, { hour: "2-digit", minute: "2-digit", second: "2-digit" })}
-                                                    {isStart && <span className="text-primary font-medium"> · start</span>}
-                                                    {isEnd && <span className="text-accent font-medium"> · end</span>}
-                                                </span>
-                                            </button>
-                                            <button
-                                                onClick={(e) => { e.stopPropagation(); handleDeleteMarker(m.id); }}
-                                                title="Delete marker"
-                                                className="hidden group-hover:flex items-center justify-center absolute -top-1.5 -right-1.5 w-4 h-4 rounded-full bg-gray-400 hover:bg-red-500 text-white transition-colors duration-150"
-                                            >
-                                                <X size={10} />
-                                            </button>
-                                        </div>
-                                    );
-                                })}
-                            </div>
-                        )}
-                    </Box>
 
                     {/* Forefront actions */}
-                    <div className="grid grid-cols-1 lg:grid-cols-2 gap-5 items-stretch">
+                    <div className="flex flex-col gap-5">
+                        <Box className="p-6 flex flex-col gap-3">
+                            <CardHeader icon={Film} title="Save between two markers" accent="accent" />
+                            {markers.length < 2 ? (
+                                <p className="text-sm text-muted">Add at least two markers to save a section between them.</p>
+                            ) : (
+                                <>
+                                    <div className="flex items-center gap-2 flex-wrap">
+                                        <span className={clsx(
+                                            "text-xs font-medium px-2.5 py-1 rounded-full border",
+                                            startMarker ? "border-terracotta text-terracotta bg-selected" : "border-dashed border-inactive text-muted"
+                                        )}>
+                                            {startMarker ? startMarker.message : "Tap a marker to set start"}
+                                        </span>
+                                        <span className="text-inactive-strong">→</span>
+                                        <span className={clsx(
+                                            "text-xs font-medium px-2.5 py-1 rounded-full border",
+                                            endMarker ? "border-olive text-olive bg-selected" : "border-dashed border-inactive text-muted"
+                                        )}>
+                                            {endMarker ? endMarker.message : "Tap a marker to set end"}
+                                        </span>
+                                    </div>
+                                    <input type="text" placeholder="Title" value={markerSaveTitle} onChange={(e) => setMarkerSaveTitle(e.target.value)} className={inputClass} />
+                                    <textarea placeholder="Description" value={markerSaveDescription} onChange={(e) => setMarkerSaveDescription(e.target.value)} rows={2} className={inputClass + " resize-none"} />
+                                    {markerSaveError && <p className="text-sm text-error">{markerSaveError}</p>}
+                                </>
+                            )}
+                            <PrimaryButton onClick={handleSaveByMarkers} disabled={markers.length < 2} className="self-start mt-auto">Save</PrimaryButton>
+                        </Box>
+
                         <Box className="p-6 flex flex-col gap-3">
                             <CardHeader icon={Scissors} title="Clip the last few seconds" />
                             <div className="flex flex-col gap-1.5">
@@ -346,51 +299,22 @@ const StreamControl = () => {
                             </div>
                             <input type="text" placeholder="Title" value={clipTitle} onChange={(e) => setClipTitle(e.target.value)} className={inputClass} />
                             <textarea placeholder="Description" value={clipDescription} onChange={(e) => setClipDescription(e.target.value)} rows={2} className={inputClass + " resize-none"} />
-                            {clipError && <p className="text-sm text-red-500">{clipError}</p>}
+                            {clipError && <p className="text-sm text-error">{clipError}</p>}
-                            <BlueButton onClick={handleClip} className="self-start mt-auto">Clip</BlueButton>
+                            <PrimaryButton onClick={handleClip} className="self-start mt-auto">Clip</PrimaryButton>
                         </Box>
 
-                        <Box className="p-6 flex flex-col gap-3">
-                            <CardHeader icon={Film} title="Save between two markers" accent="accent" />
-                            {markers.length < 2 ? (
-                                <p className="text-sm text-gray-400">Add at least two markers above to save a section between them.</p>
-                            ) : (
-                                <>
-                                    <div className="flex items-center gap-2 flex-wrap">
-                                        <span className={clsx(
-                                            "text-xs font-medium px-2.5 py-1 rounded-full border",
-                                            startMarker ? "border-primary text-primary bg-primary/5" : "border-dashed border-gray-300 text-gray-400"
-                                        )}>
-                                            {startMarker ? startMarker.message : "Tap a marker to set start"}
-                                        </span>
-                                        <span className="text-gray-300">→</span>
-                                        <span className={clsx(
-                                            "text-xs font-medium px-2.5 py-1 rounded-full border",
-                                            endMarker ? "border-accent text-accent bg-accent/5" : "border-dashed border-gray-300 text-gray-400"
-                                        )}>
-                                            {endMarker ? endMarker.message : "Tap a marker to set end"}
-                                        </span>
-                                    </div>
-                                    <input type="text" placeholder="Title" value={markerSaveTitle} onChange={(e) => setMarkerSaveTitle(e.target.value)} className={inputClass} />
-                                    <textarea placeholder="Description" value={markerSaveDescription} onChange={(e) => setMarkerSaveDescription(e.target.value)} rows={2} className={inputClass + " resize-none"} />
-                                    {markerSaveError && <p className="text-sm text-red-500">{markerSaveError}</p>}
-                                </>
-                            )}
-                            <BlueButton onClick={handleSaveByMarkers} disabled={markers.length < 2} className="self-start mt-auto">Save</BlueButton>
-                        </Box>
-                    </div>
-
                         <Box className="p-5 flex flex-col gap-3">
                             <CardHeader icon={Activity} title="Recent actions" />
                             {jobs.length === 0 ? (
-                            <p className="text-sm text-gray-400">Clip and save actions will show up here.</p>
+                                <p className="text-sm text-muted">Clip and save actions will show up here.</p>
                             ) : (
                                 <div className="flex flex-col gap-3">
                                     {jobs.map((job) => <JobStatus key={job.uuid} job={job} />)}
                                 </div>
                             )}
                         </Box>
-                </>
+                    </div>
+                </div>
             )}
         </div>
     );

frontend/src/pages/VodPlayer.tsx

@@ -1,311 +0,0 @@
-import { useCallback, useEffect, useRef, useState } from "react";
-import { useNavigate, useParams } from "react-router-dom";
-import { ArrowLeft, Lock, Maximize, Minimize, Pause, Play, Volume1, Volume2, VolumeX } from "lucide-react";
-import type { Vod } from "../utils/types";
-import { AuthError } from "../utils/api/client.ts";
-import { getVodById, getVodBlob } from "../utils/api/vods.ts";
-import Box from "../components/Box.tsx";
-import { dateToTimeAgo, formatTime, stringToDate } from "../utils/utils.ts";
-
-const VodPlayer = () => {
-    const { id } = useParams();
-    const navigate = useNavigate();
-
-    const videoRef = useRef<HTMLVideoElement>(null);
-    const containerRef = useRef<HTMLDivElement>(null);
-    const progressRef = useRef<HTMLDivElement>(null);
-    const hideTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
-
-    const [videoUrl, setVideoUrl] = useState<string | undefined>(undefined);
-    const [error, setError] = useState<string | null>(null);
-    const [notAuthenticated, setNotAuthenticated] = useState(false);
-    const [vod, setVod] = useState<Vod | null>(null);
-    const [timeAgo, setTimeAgo] = useState("");
-
-    const [isPlaying, setIsPlaying] = useState(false);
-    const [currentTime, setCurrentTime] = useState(0);
-    const [duration, setDuration] = useState(0);
-    const [bufferedPct, setBufferedPct] = useState(0);
-    const [isWaiting, setIsWaiting] = useState(false);
-
-    const [volume, setVolume] = useState(1);
-    const [isMuted, setIsMuted] = useState(false);
-
-    const [isFullscreen, setIsFullscreen] = useState(false);
-    const [controlsVisible, setControlsVisible] = useState(true);
-    const [isDragging, setIsDragging] = useState(false);
-
-    useEffect(() => {
-        if (!id) { setError("VoD ID is required."); return; }
-
-        getVodBlob(id)
-            .then((blob) => setVideoUrl(URL.createObjectURL(blob)))
-            .catch((e) => { if (e instanceof AuthError) setNotAuthenticated(true); });
-
-        getVodById(id)
-            .then(setVod)
-            .catch((e) => {
-                if (e instanceof AuthError) setNotAuthenticated(true);
-                else setError("Failed to load vod details.");
-            });
-    }, [id]);
-
-    useEffect(() => {
-        if (!vod?.createdAt) return;
-        const update = () => setTimeAgo(dateToTimeAgo(stringToDate(vod.createdAt)));
-        update();
-        const interval = setInterval(update, 1000);
-        return () => clearInterval(interval);
-    }, [vod]);
-
-    const scheduleHide = useCallback(() => {
-        if (hideTimerRef.current) clearTimeout(hideTimerRef.current);
-        hideTimerRef.current = setTimeout(() => setControlsVisible(false), 3000);
-    }, []);
-
-    const showControls = useCallback(() => {
-        setControlsVisible(true);
-        scheduleHide();
-    }, [scheduleHide]);
-
-    useEffect(() => {
-        const onChange = () => setIsFullscreen(!!document.fullscreenElement);
-        document.addEventListener('fullscreenchange', onChange);
-        return () => document.removeEventListener('fullscreenchange', onChange);
-    }, []);
-
-    const toggleFullscreen = useCallback(() => {
-        if (!containerRef.current) return;
-        document.fullscreenElement
-            ? document.exitFullscreen()
-            : containerRef.current.requestFullscreen();
-    }, []);
-
-    useEffect(() => {
-        const onKey = (e: KeyboardEvent) => {
-            if (e.target instanceof HTMLInputElement || e.target instanceof HTMLTextAreaElement) return;
-            const video = videoRef.current;
-            if (!video) return;
-
-            switch (e.code) {
-                case 'Space': case 'KeyK':
-                    e.preventDefault();
-                    video.paused ? video.play() : video.pause();
-                    showControls();
-                    break;
-                case 'ArrowLeft':
-                    e.preventDefault();
-                    video.currentTime = Math.max(0, video.currentTime - 5);
-                    showControls();
-                    break;
-                case 'ArrowRight':
-                    e.preventDefault();
-                    video.currentTime = Math.min(video.duration, video.currentTime + 5);
-                    showControls();
-                    break;
-                case 'KeyM':
-                    video.muted = !video.muted;
-                    setIsMuted(video.muted);
-                    break;
-                case 'KeyF':
-                    toggleFullscreen();
-                    break;
-            }
-        };
-        document.addEventListener('keydown', onKey);
-        return () => document.removeEventListener('keydown', onKey);
-    }, [showControls, toggleFullscreen]);
-
-    const seekTo = useCallback((clientX: number) => {
-        const rect = progressRef.current?.getBoundingClientRect();
-        const video = videoRef.current;
-        if (!rect || !video || !duration) return;
-        const ratio = Math.max(0, Math.min(1, (clientX - rect.left) / rect.width));
-        video.currentTime = ratio * duration;
-        setCurrentTime(ratio * duration);
-    }, [duration]);
-
-    useEffect(() => {
-        if (!isDragging) return;
-        const onMove = (e: MouseEvent) => seekTo(e.clientX);
-        const onUp = () => setIsDragging(false);
-        document.addEventListener('mousemove', onMove);
-        document.addEventListener('mouseup', onUp);
-        return () => {
-            document.removeEventListener('mousemove', onMove);
-            document.removeEventListener('mouseup', onUp);
-        };
-    }, [isDragging, seekTo]);
-
-    const handleTimeUpdate = () => {
-        const video = videoRef.current;
-        if (!video) return;
-        setCurrentTime(video.currentTime);
-        if (video.buffered.length > 0) {
-            setBufferedPct((video.buffered.end(video.buffered.length - 1) / video.duration) * 100);
-        }
-    };
-
-    const handleVolumeChange = (e: React.ChangeEvent<HTMLInputElement>) => {
-        const v = parseFloat(e.target.value);
-        setVolume(v);
-        setIsMuted(v === 0);
-        if (videoRef.current) {
-            videoRef.current.volume = v;
-            videoRef.current.muted = v === 0;
-        }
-    };
-
-    const toggleMute = () => {
-        const video = videoRef.current;
-        if (!video) return;
-        video.muted = !video.muted;
-        setIsMuted(video.muted);
-    };
-
-    const togglePlay = () => {
-        const video = videoRef.current;
-        if (!video) return;
-        video.paused ? video.play() : video.pause();
-        showControls();
-    };
-
-    const progressPct = duration > 0 ? (currentTime / duration) * 100 : 0;
-    const effectiveVolume = isMuted ? 0 : volume;
-    const VolumeIcon = effectiveVolume === 0 ? VolumeX : effectiveVolume < 0.5 ? Volume1 : Volume2;
-
-    if (notAuthenticated) {
-        return (
-            <div className="h-full flex flex-col items-center justify-center gap-4 text-center p-8">
-                <div className="w-14 h-14 rounded-full bg-gray-100 flex items-center justify-center">
-                    <Lock size={24} className="text-gray-400" />
-                </div>
-                <div>
-                    <p className="text-lg font-semibold text-gray-900">Not authenticated</p>
-                    <p className="text-sm text-gray-500 mt-1">You don't have access to this VoD.</p>
-                </div>
-                <button
-                    onClick={() => navigate(-1)}
-                    className="flex items-center gap-1.5 text-sm text-gray-500 hover:text-gray-900 transition-colors duration-150"
-                >
-                    <ArrowLeft size={16} />
-                    Go back
-                </button>
-            </div>
-        );
-    }
-
-    return (
-        <div className="h-full flex flex-col p-4 gap-3">
-            <button
-                onClick={() => navigate(-1)}
-                className="flex items-center gap-1.5 text-sm text-gray-500 hover:text-gray-900 flex-shrink-0 transition-colors duration-150"
-            >
-                <ArrowLeft size={16} />
-                Back
-            </button>
-
-            <div
-                ref={containerRef}
-                className="relative bg-black rounded-xl overflow-hidden flex-1 min-h-0 select-none"
-                onMouseMove={showControls}
-                onMouseLeave={() => isPlaying && setControlsVisible(false)}
-                onClick={togglePlay}
-                style={{ cursor: controlsVisible ? 'default' : 'none' }}
-            >
-                <video
-                    ref={videoRef}
-                    className="w-full h-full object-contain"
-                    src={videoUrl}
-                    onPlay={() => { setIsPlaying(true); scheduleHide(); }}
-                    onPause={() => {
-                        setIsPlaying(false);
-                        setControlsVisible(true);
-                        if (hideTimerRef.current) clearTimeout(hideTimerRef.current);
-                    }}
-                    onTimeUpdate={handleTimeUpdate}
-                    onLoadedMetadata={() => { if (videoRef.current) setDuration(videoRef.current.duration); }}
-                    onWaiting={() => setIsWaiting(true)}
-                    onCanPlay={() => setIsWaiting(false)}
-                    onError={(e) => setError(e.currentTarget.error?.message || "An error occurred.")}
-                />
-
-                {isWaiting && videoUrl && (
-                    <div className="absolute inset-0 flex items-center justify-center pointer-events-none">
-                        <div className="w-11 h-11 rounded-full border-[3px] border-white/20 border-t-white animate-spin" />
-                    </div>
-                )}
-
-                <div className={`absolute inset-0 flex flex-col justify-end transition-opacity duration-300 pointer-events-none ${controlsVisible ? 'opacity-100' : 'opacity-0'}`}>
-                    <div className="absolute inset-0 bg-gradient-to-t from-black/75 via-black/10 to-transparent" />
-
-                    <div
-                        className="relative px-4 pb-4 pt-10 pointer-events-auto"
-                        onClick={(e) => e.stopPropagation()}
-                    >
-                        <div
-                            ref={progressRef}
-                            className="relative h-1 rounded-full bg-white/25 cursor-pointer mb-3 group/prog hover:h-1.5 transition-[height] duration-150"
-                            onMouseDown={(e) => { setIsDragging(true); seekTo(e.clientX); }}
-                        >
-                            <div className="absolute inset-y-0 left-0 bg-white/35 rounded-full" style={{ width: `${bufferedPct}%` }} />
-                            <div className="absolute inset-y-0 left-0 bg-primary rounded-full" style={{ width: `${progressPct}%` }} />
-                            <div
-                                className="absolute top-1/2 -translate-y-1/2 w-3 h-3 bg-white rounded-full shadow opacity-0 group-hover/prog:opacity-100 transition-opacity"
-                                style={{ left: `calc(${progressPct}% - 6px)` }}
-                            />
-                        </div>
-
-                        <div className="flex items-center gap-3 text-white">
-                            <button onClick={togglePlay} className="hover:text-white/70 transition-colors">
-                                {isPlaying
-                                    ? <Pause size={20} fill="currentColor" />
-                                    : <Play size={20} fill="currentColor" />}
-                            </button>
-
-                            <div className="flex items-center gap-1.5 group/vol">
-                                <button onClick={toggleMute} className="hover:text-white/70 transition-colors">
-                                    <VolumeIcon size={18} />
-                                </button>
-                                <div className="overflow-hidden w-0 group-hover/vol:w-16 transition-[width] duration-200">
-                                    <input
-                                        type="range"
-                                        min={0} max={1} step={0.02}
-                                        value={effectiveVolume}
-                                        onChange={handleVolumeChange}
-                                        className="w-16 accent-white cursor-pointer"
-                                    />
-                                </div>
-                            </div>
-
-                            <span className="text-xs font-mono tabular-nums text-white/80">
-                                {formatTime(currentTime)} / {formatTime(duration)}
-                            </span>
-
-                            <div className="flex-1" />
-
-                            <button onClick={toggleFullscreen} className="hover:text-white/70 transition-colors">
-                                {isFullscreen ? <Minimize size={18} /> : <Maximize size={18} />}
-                            </button>
-                        </div>
-                    </div>
-                </div>
-            </div>
-
-            {error && <div className="text-red-500 text-sm mt-3">{error}</div>}
-            {!videoUrl && !error && (
-                <div className="text-gray-400 text-sm mt-3 flex items-center gap-2">
-                    <div className="w-3 h-3 rounded-full border-2 border-gray-300 border-t-gray-500 animate-spin" />
-                    Loading video...
-                </div>
-            )}
-
-            <Box className="p-4 flex-shrink-0">
-                <p className="text-xl font-semibold text-gray-900">{vod?.title || "(No Title)"}</p>
-                <p className="text-sm text-gray-500 mt-1">{timeAgo}</p>
-            </Box>
-        </div>
-    );
-};
-
-export default VodPlayer;

frontend/src/theme/ThemeContext.ts

@@ -0,0 +1,23 @@
+import { createContext } from "react";
+
+/** What the user chose. "system" defers to the OS setting. */
+type ThemePreference = "light" | "dark" | "system";
+
+/** The theme actually on screen, once "system" has been resolved. */
+type ResolvedTheme = "light" | "dark";
+
+type ThemeContextValue = {
+    /** The stored choice, which may be "system". */
+    preference: ThemePreference;
+    /** The theme currently applied to the document. */
+    theme: ResolvedTheme;
+    /** Store a new preference and apply it immediately. */
+    setPreference: (preference: ThemePreference) => void;
+    /** Flip between light and dark, pinning the result as an explicit choice. */
+    toggleTheme: () => void;
+};
+
+const ThemeContext = createContext<ThemeContextValue | null>(null);
+
+export { ThemeContext };
+export type { ThemeContextValue, ThemePreference, ResolvedTheme };

frontend/src/theme/ThemeProvider.tsx

@@ -0,0 +1,71 @@
+import { useCallback, useEffect, useState } from "react";
+import type { ReactNode } from "react";
+import { ThemeContext } from "./ThemeContext.ts";
+import type { ResolvedTheme, ThemePreference } from "./ThemeContext.ts";
+
+/** Shared with the pre-paint script in index.html — keep the two in step. */
+const STORAGE_KEY = "theme";
+const DARK_QUERY = "(prefers-color-scheme: dark)";
+
+const readPreference = (): ThemePreference => {
+    try {
+        const stored = localStorage.getItem(STORAGE_KEY);
+        if (stored === "light" || stored === "dark" || stored === "system") {
+            return stored;
+        }
+    } catch {
+        // Storage blocked (private browsing, cookies disabled) — follow the OS.
+    }
+    return "system";
+};
+
+const readSystemTheme = (): ResolvedTheme =>
+    window.matchMedia(DARK_QUERY).matches ? "dark" : "light";
+
+/**
+ * Owns the single source of truth for the active theme. Nothing reads colours
+ * from here: the palette lives in index.css and switches on the `data-theme`
+ * attribute this provider writes, so components keep using the semantic
+ * utilities (`bg-card`, `text-text-primary`) and follow along for free.
+ */
+const ThemeProvider = ({ children }: { children: ReactNode }) => {
+    const [preference, setPreferenceState] = useState<ThemePreference>(readPreference);
+    const [systemTheme, setSystemTheme] = useState<ResolvedTheme>(readSystemTheme);
+
+    // Keep following the OS while the preference is "system".
+    useEffect(() => {
+        const query = window.matchMedia(DARK_QUERY);
+        const onChange = (event: MediaQueryListEvent) =>
+            setSystemTheme(event.matches ? "dark" : "light");
+
+        query.addEventListener("change", onChange);
+        return () => query.removeEventListener("change", onChange);
+    }, []);
+
+    const theme: ResolvedTheme = preference === "system" ? systemTheme : preference;
+
+    useEffect(() => {
+        document.documentElement.dataset.theme = theme;
+    }, [theme]);
+
+    const setPreference = useCallback((next: ThemePreference) => {
+        setPreferenceState(next);
+        try {
+            localStorage.setItem(STORAGE_KEY, next);
+        } catch {
+            // Storage blocked — the choice still applies for this session.
+        }
+    }, []);
+
+    const toggleTheme = useCallback(() => {
+        setPreference(theme === "dark" ? "light" : "dark");
+    }, [theme, setPreference]);
+
+    return (
+        <ThemeContext.Provider value={{ preference, theme, setPreference, toggleTheme }}>
+            {children}
+        </ThemeContext.Provider>
+    );
+};
+
+export default ThemeProvider;

frontend/src/theme/useTheme.ts

@@ -0,0 +1,14 @@
+import { useContext } from "react";
+import { ThemeContext } from "./ThemeContext.ts";
+import type { ThemeContextValue } from "./ThemeContext.ts";
+
+/** Access the centralised theme state. Must be used within a <ThemeProvider>. */
+const useTheme = (): ThemeContextValue => {
+    const context = useContext(ThemeContext);
+    if (!context) {
+        throw new Error("useTheme must be used within a ThemeProvider");
+    }
+    return context;
+};
+
+export { useTheme };

frontend/src/utils/api/client.ts

@@ -1,12 +1,93 @@
-const API_URL = import.meta.env.VITE_API_URL;
+import {config} from "../../config.ts";
+import type { APIResponse } from "../types.ts";
+
+const API_URL = config.apiUrl;
 
 class AuthError extends Error {
     constructor() { super("Not authenticated"); this.name = "AuthError"; }
 }
 
-const isThumbnailAvailable = async (thumbnailUrl: string): Promise<boolean> => {
+let onUnauthorized: (() => void) | null = null;
-    const response = await fetch(thumbnailUrl, { credentials: 'include' });
+let onSessionRefreshed: ((accessTokenExpiresIn: number) => void) | null = null;
-    return response.ok;
+let refreshInFlight: Promise<boolean> | null = null;
-};
 
-export { API_URL, AuthError, isThumbnailAvailable };
+export function registerUnauthorizedHandler(handler: () => void) {
+    onUnauthorized = handler;
+}
+
+/** Called with the new access token lifetime (in seconds) whenever the session is refreshed. */
+export function registerSessionRefreshedHandler(handler: (accessTokenExpiresIn: number) => void) {
+    onSessionRefreshed = handler;
+}
+
+/**
+ * Exchanges the refresh token cookie for new access and refresh token cookies.
+ * Concurrent callers share a single request, so a burst of 401s only rotates
+ * the refresh token once.
+ *
+ * @returns true if the session was refreshed, false if it has ended (no valid
+ * refresh token). Throws on network errors so a dropped connection isn't
+ * mistaken for being logged out.
+ */
+function refreshSession(): Promise<boolean> {
+    refreshInFlight ??= requestRefresh().finally(() => { refreshInFlight = null; });
+    return refreshInFlight;
+}
+
+async function requestRefresh(): Promise<boolean> {
+    const response = await fetch(API_URL + '/api/v1/users/refresh', {
+        method: 'POST',
+        credentials: 'include',
+    });
+
+    if (!response.ok) return false;
+
+    const result: APIResponse = await response.json();
+    onSessionRefreshed?.(result.data.accessTokenExpiresIn);
+    return true;
+}
+
+/**
+ * Performs a request against the API, sending session cookies. An expired
+ * access token is refreshed and the request retried once, so callers only see
+ * an AuthError when the session has really ended — at which point the
+ * registered unauthorized handler drops the UI back to a logged out state.
+ * Returns the raw response so callers that need something other than JSON
+ * (blobs, streams) can read it themselves.
+ */
+async function apiFetchRaw(url: string, options: RequestInit = {}): Promise<Response> {
+    const send = () => fetch(url, { ...options, credentials: 'include' });
+
+    let response = await send();
+
+    if (response.status == 401 && await refreshSession()) {
+        response = await send();
+    }
+
+    if (response.status == 401) {
+        onUnauthorized?.();
+        throw new AuthError();
+    }
+
+    // Logged in, but not allowed to access this resource: don't end the session.
+    if (response.status == 403) {
+        throw new AuthError();
+    }
+
+    if (!response.ok) {
+        const text = await response.text();
+        let message = text;
+        try { message = JSON.parse(text).message ?? text; } catch { /* not JSON, use raw text */ }
+        throw new Error(message || `Request failed: ${response.status}`);
+    }
+
+    return response;
+}
+
+async function apiFetch<T>(url: string, options: RequestInit = {}): Promise<T> {
+    const response = await apiFetchRaw(url, options);
+    const text = await response.text();
+    return text ? JSON.parse(text) : (undefined as T);
+}
+
+export { API_URL, AuthError, apiFetch, apiFetchRaw, refreshSession };

frontend/src/utils/api/clips.ts

@@ -1,67 +1,40 @@
 import type { APIResponse, Clip } from "../types.ts";
-import { API_URL, AuthError } from "./client.ts";
+import { API_URL, apiFetch } from "./client.ts";
 
 const getClips = async (): Promise<Clip[]> => {
-    const response = await fetch(API_URL + '/api/v1/clips', { credentials: 'include' });
+    const result = await apiFetch<APIResponse>(API_URL + '/api/v1/clips');
+    if (result.status === 'error') throw new Error(`Failed to fetch clips: ${result.message}`);
 
-    if (!response.ok) {
-        const errorResult: APIResponse = await response.json();
-        throw new Error(`Failed to fetch clips: ${errorResult.message}`);
-    }
-
-    const result: APIResponse = await response.json();
     return result.data;
 };
 
 const getClipById = async (id: string): Promise<Clip | null> => {
-    const response = await fetch(API_URL + `/api/v1/clips/${id}`, { credentials: 'include' });
+    const result = await apiFetch<APIResponse>(API_URL + `/api/v1/clips/${id}`);
+    if (result.status === 'error') throw new Error(`Failed to fetch clip: ${result.message}`);
 
-    if (!response.ok) {
-        if (response.status === 401 || response.status === 403) throw new AuthError();
-        throw new Error(`Failed to fetch clip: ${response.status}`);
-    }
-
-    const result: APIResponse = await response.json();
     return result.data;
 };
 
-const getVideoBlob = async (id: string): Promise<Blob> => {
+// URL for the raw media stream. The <video> element loads this directly so the
-    const response = await fetch(API_URL + `/api/v1/clips/${id}/media`, { credentials: 'include' });
+// browser can issue HTTP Range requests (progressive loading + seeking) instead
-
+// of downloading the whole file up front.
-    if (!response.ok) {
+const getClipMediaUrl = (id: string): string => API_URL + `/api/v1/clips/${id}/media`;
-        if (response.status === 401 || response.status === 403) throw new AuthError();
-        throw new Error(`Failed to fetch video ${id}: ${response.status}`);
-    }
-
-    return response.blob();
-};
 
 const patchClip = async (id: number, data: { title?: string; description?: string }): Promise<Clip> => {
-    const response = await fetch(API_URL + `/api/v1/clips/${id}`, {
+    const result = await apiFetch<APIResponse>(API_URL + `/api/v1/clips/${id}`, {
         method: 'PATCH',
         headers: { 'Content-Type': 'application/json' },
-        credentials: 'include',
         body: JSON.stringify(data),
     });
 
-    if (!response.ok) throw new Error(`Failed to update clip: ${response.status}`);
-
-    const result: APIResponse = await response.json();
     if (result.status === 'error') throw new Error(`Failed to update clip: ${result.message}`);
 
     return result.data;
 };
 
 const deleteClip = async (id: number): Promise<void> => {
-    const response = await fetch(API_URL + `/api/v1/clips/${id}`, {
+    const result = await apiFetch<APIResponse>(API_URL + `/api/v1/clips/${id}`, { method: 'DELETE' });
-        method: 'DELETE',
+    if (result?.status === 'error') throw new Error(`Failed to delete clip: ${result.message}`);
-        credentials: 'include',
-    });
-
-    if (!response.ok) throw new Error(`Failed to delete clip: ${response.status}`);
-
-    const result: APIResponse = await response.json();
-    if (result.status === 'error') throw new Error(`Failed to delete clip: ${result.message}`);
 };
 
-export { getClips, getClipById, getVideoBlob, patchClip, deleteClip };
+export { getClips, getClipById, getClipMediaUrl, patchClip, deleteClip };

frontend/src/utils/api/jobs.ts

@@ -1,15 +1,16 @@
 import type { APIResponse, JobResponse } from "../types.ts";
-import { API_URL } from "./client.ts";
+import { API_URL, apiFetch, apiFetchRaw } from "./client.ts";
 
 const getJob = async (uuid: string): Promise<JobResponse> => {
-    const response = await fetch(API_URL + `/api/v1/jobs/${uuid}`, { credentials: 'include' });
+    const result = await apiFetch<APIResponse>(API_URL + `/api/v1/jobs/${uuid}`);
-
-    if (!response.ok) throw new Error(`Failed to fetch job: ${response.status}`);
-
-    const result: APIResponse = await response.json();
     if (result.status === 'error') throw new Error(`Failed to fetch job: ${result.message}`);
 
     return result.data;
 };
 
-export { getJob };
+const downloadJob = async (uuid: string): Promise<Blob> => {
+    const response = await apiFetchRaw(API_URL + `/api/v1/jobs/${uuid}/download`);
+    return response.blob();
+};
+
+export { getJob, downloadJob };

frontend/src/utils/api/markers.ts

@@ -1,40 +1,28 @@
 import type { APIResponse, Marker } from "../types.ts";
-import { API_URL } from "./client.ts";
+import { API_URL, apiFetch } from "./client.ts";
 
 const getMarkers = async (): Promise<Marker[]> => {
-    const response = await fetch(API_URL + '/api/v1/markers', { credentials: 'include' });
+    const result = await apiFetch<APIResponse>(API_URL + '/api/v1/markers');
-    if (!response.ok) throw new Error(`Failed to fetch markers: ${response.status}`);
-
-    const result: APIResponse = await response.json();
     if (result.status === 'error') throw new Error(`Failed to fetch markers: ${result.message}`);
 
     return result.data;
 };
 
 const createMarker = async (message: string): Promise<Marker> => {
-    const response = await fetch(API_URL + '/api/v1/markers', {
+    const result = await apiFetch<APIResponse>(API_URL + '/api/v1/markers', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        credentials: 'include',
         body: JSON.stringify({ message }),
     });
 
-    const result: APIResponse = await response.json();
+    if (result.status === 'error') throw new Error(`Failed to add marker: ${result.message}`);
-    if (!response.ok || result.status === 'error') throw new Error(`Failed to add marker: ${result.message}`);
 
     return result.data;
 };
 
 const deleteMarker = async (id: number): Promise<void> => {
-    const response = await fetch(API_URL + `/api/v1/markers/${id}`, {
+    const result = await apiFetch<APIResponse>(API_URL + `/api/v1/markers/${id}`, { method: 'DELETE' });
-        method: 'DELETE',
+    if (result?.status === 'error') throw new Error(`Failed to delete marker: ${result.message}`);
-        credentials: 'include',
-    });
-
-    if (!response.ok) throw new Error(`Failed to delete marker: ${response.status}`);
-
-    const result: APIResponse = await response.json();
-    if (result.status === 'error') throw new Error(`Failed to delete marker: ${result.message}`);
 };
 
 export { getMarkers, createMarker, deleteMarker };

frontend/src/utils/api/media.ts

@@ -1,5 +1,5 @@
 import type { APIResponse, VideoMetadata } from "../types.ts";
-import { API_URL } from "./client.ts";
+import { API_URL, apiFetch } from "./client.ts";
 
 const compress = async (file: File, options: VideoMetadata): Promise<string> => {
     const formData = new FormData();
@@ -13,58 +13,48 @@ const compress = async (file: File, options: VideoMetadata): Promise<string> =>
     if (options.height) formData.append('height', options.height.toString());
     if (options.fileSize) formData.append('fileSize', options.fileSize.toString());
 
-    const response = await fetch(API_URL + '/api/v1/media/compress', {
+    const result = await apiFetch<APIResponse>(API_URL + '/api/v1/media/compress', {
         method: 'POST',
         body: formData,
-        credentials: 'include',
     });
 
-    if (!response.ok) throw new Error(`Compression failed: ${response.status}`);
-
-    const result: APIResponse = await response.json();
     if (result.status === 'error') throw new Error(`Compression failed: ${result.message}`);
 
     return result.data.uuid;
 };
 
 const saveSection = async (startTime: string, endTime: string, title?: string, description?: string): Promise<string> => {
-    const response = await fetch(API_URL + '/api/v1/media/save', {
+    const result = await apiFetch<APIResponse>(API_URL + '/api/v1/media/save', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        credentials: 'include',
         body: JSON.stringify({ startTime, endTime, title, description }),
     });
 
-    const result: APIResponse = await response.json();
+    if (result.status === 'error') throw new Error(`Failed to save section: ${result.message}`);
-    if (!response.ok || result.status === 'error') throw new Error(`Failed to save section: ${result.message}`);
 
     return result.data.uuid;
 };
 
 const saveSectionByMarkers = async (startMarkerId: number, endMarkerId: number, title?: string, description?: string): Promise<string> => {
-    const response = await fetch(API_URL + '/api/v1/media/save/markers', {
+    const result = await apiFetch<APIResponse>(API_URL + '/api/v1/media/save/markers', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        credentials: 'include',
         body: JSON.stringify({ startMarkerId, endMarkerId, title, description }),
     });
 
-    const result: APIResponse = await response.json();
+    if (result.status === 'error') throw new Error(`Failed to save section: ${result.message}`);
-    if (!response.ok || result.status === 'error') throw new Error(`Failed to save section: ${result.message}`);
 
     return result.data.uuid;
 };
 
 const clipSection = async (duration: number, title?: string, description?: string): Promise<string> => {
-    const response = await fetch(API_URL + '/api/v1/media/clip', {
+    const result = await apiFetch<APIResponse>(API_URL + '/api/v1/media/clip', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        credentials: 'include',
         body: JSON.stringify({ duration, title, description }),
     });
 
-    const result: APIResponse = await response.json();
+    if (result.status === 'error') throw new Error(`Failed to clip section: ${result.message}`);
-    if (!response.ok || result.status === 'error') throw new Error(`Failed to clip section: ${result.message}`);
 
     return result.data.uuid;
 };

frontend/src/utils/api/stream.ts

@@ -1,28 +1,24 @@
 import type { APIResponse, StreamHistoryItem, StreamStatus } from "../types.ts";
-import { API_URL } from "./client.ts";
+import { API_URL, apiFetch } from "./client.ts";
 
 const getStreamStatus = async (): Promise<boolean> => {
-    const response = await fetch(API_URL + '/api/v1/stream/current', { credentials: 'include' });
+    try {
-    if (!response.ok) return false;
+        const result = await apiFetch<APIResponse>(API_URL + '/api/v1/stream/current');
-    const result: APIResponse = await response.json();
         return result.status === 'success' && result.data?.isStreaming === true;
+    } catch {
+        return false;
+    }
 };
 
 const getCurrentStream = async (): Promise<StreamStatus> => {
-    const response = await fetch(API_URL + '/api/v1/stream/current', { credentials: 'include' });
+    const result = await apiFetch<APIResponse>(API_URL + '/api/v1/stream/current');
-    if (!response.ok) throw new Error(`Failed to fetch stream status: ${response.status}`);
-
-    const result: APIResponse = await response.json();
     if (result.status === 'error') throw new Error(`Failed to fetch stream status: ${result.message}`);
 
     return result.data;
 };
 
 const getStreamHistory = async (userId: number): Promise<StreamHistoryItem[]> => {
-    const response = await fetch(API_URL + `/api/v1/stream/history/${userId}`, { credentials: 'include' });
+    const result = await apiFetch<APIResponse>(API_URL + `/api/v1/stream/history/${userId}`);
-    if (!response.ok) throw new Error(`Failed to fetch stream history: ${response.status}`);
-
-    const result: APIResponse = await response.json();
     if (result.status === 'error') throw new Error(`Failed to fetch stream history: ${result.message}`);
 
     return result.data;

frontend/src/utils/api/users.ts

@@ -1,7 +1,17 @@
 import type { APIResponse, User } from "../types.ts";
 import { API_URL } from "./client.ts";
 
-const login = async (googleToken: string): Promise<string> => {
+// These deliberately use fetch directly rather than apiFetch: they run when
+// there may be no session at all, and apiFetch's refresh-and-retry on 401
+// would either loop or log the user out from under the auth provider.
+
+/**
+ * Exchanges a Google credential for a session. The tokens are set as HttpOnly
+ * cookies; only the access token lifetime is returned.
+ *
+ * @returns seconds until the access token expires
+ */
+const login = async (googleToken: string): Promise<number> => {
     const response = await fetch(API_URL + '/api/v1/users/login', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
@@ -14,9 +24,10 @@ const login = async (googleToken: string): Promise<string> => {
     const result: APIResponse = await response.json();
     if (result.status === 'error') throw new Error(`Login failed: ${result.message}`);
 
-    return result.data.token;
+    return result.data.accessTokenExpiresIn;
 };
 
+/** Revokes the session and clears the auth cookies. */
 const logout = async (): Promise<void> => {
     const response = await fetch(API_URL + '/api/v1/users/logout', {
         method: 'POST',
@@ -24,9 +35,6 @@ const logout = async (): Promise<void> => {
     });
 
     if (!response.ok) throw new Error(`Logout failed: ${response.status}`);
-
-    const result: APIResponse = await response.json();
-    if (result.status === 'error') throw new Error(`Logout failed: ${result.message}`);
 };
 
 const getUser = async (): Promise<User | null> => {

frontend/src/utils/api/vods.ts

@@ -1,67 +1,40 @@
 import type { APIResponse, Vod } from "../types.ts";
-import { API_URL, AuthError } from "./client.ts";
+import { API_URL, apiFetch } from "./client.ts";
 
 const getVods = async (): Promise<Vod[]> => {
-    const response = await fetch(API_URL + '/api/v1/vods', { credentials: 'include' });
+    const result = await apiFetch<APIResponse>(API_URL + '/api/v1/vods');
+    if (result.status === 'error') throw new Error(`Failed to fetch vods: ${result.message}`);
 
-    if (!response.ok) {
-        const errorResult: APIResponse = await response.json();
-        throw new Error(`Failed to fetch vods: ${errorResult.message}`);
-    }
-
-    const result: APIResponse = await response.json();
     return result.data;
 };
 
 const getVodById = async (id: string): Promise<Vod | null> => {
-    const response = await fetch(API_URL + `/api/v1/vods/${id}`, { credentials: 'include' });
+    const result = await apiFetch<APIResponse>(API_URL + `/api/v1/vods/${id}`);
+    if (result.status === 'error') throw new Error(`Failed to fetch vod: ${result.message}`);
 
-    if (!response.ok) {
-        if (response.status === 401 || response.status === 403) throw new AuthError();
-        throw new Error(`Failed to fetch vod: ${response.status}`);
-    }
-
-    const result: APIResponse = await response.json();
     return result.data;
 };
 
-const getVodBlob = async (id: string): Promise<Blob> => {
+// URL for the raw media stream. The <video> element loads this directly so the
-    const response = await fetch(API_URL + `/api/v1/vods/${id}/media`, { credentials: 'include' });
+// browser can issue HTTP Range requests (progressive loading + seeking) instead
-
+// of downloading the whole file up front.
-    if (!response.ok) {
+const getVodMediaUrl = (id: string): string => API_URL + `/api/v1/vods/${id}/media`;
-        if (response.status === 401 || response.status === 403) throw new AuthError();
-        throw new Error(`Failed to fetch vod ${id}: ${response.status}`);
-    }
-
-    return response.blob();
-};
 
 const patchVod = async (id: number, data: { title?: string; description?: string }): Promise<Vod> => {
-    const response = await fetch(API_URL + `/api/v1/vods/${id}`, {
+    const result = await apiFetch<APIResponse>(API_URL + `/api/v1/vods/${id}`, {
         method: 'PATCH',
         headers: { 'Content-Type': 'application/json' },
-        credentials: 'include',
         body: JSON.stringify(data),
     });
 
-    if (!response.ok) throw new Error(`Failed to update vod: ${response.status}`);
-
-    const result: APIResponse = await response.json();
     if (result.status === 'error') throw new Error(`Failed to update vod: ${result.message}`);
 
     return result.data;
 };
 
 const deleteVod = async (id: number): Promise<void> => {
-    const response = await fetch(API_URL + `/api/v1/vods/${id}`, {
+    const result = await apiFetch<APIResponse>(API_URL + `/api/v1/vods/${id}`, { method: 'DELETE' });
-        method: 'DELETE',
+    if (result?.status === 'error') throw new Error(`Failed to delete vod: ${result.message}`);
-        credentials: 'include',
-    });
-
-    if (!response.ok) throw new Error(`Failed to delete vod: ${response.status}`);
-
-    const result: APIResponse = await response.json();
-    if (result.status === 'error') throw new Error(`Failed to delete vod: ${result.message}`);
 };
 
-export { getVods, getVodById, getVodBlob, patchVod, deleteVod };
+export { getVods, getVodById, getVodMediaUrl, patchVod, deleteVod };

frontend/src/utils/utils.ts

@@ -21,6 +21,12 @@ function formatLocalDate(dateString: string, options?: Intl.DateTimeFormatOption
     return stringToDate(dateString).toLocaleDateString(undefined, options ?? { year: "numeric", month: "long", day: "numeric" });
 }
 
+// Clock time only, no date — markers within a stream are all from the same day,
+// so the date would just be noise beside them.
+function formatLocalTime(dateString: string): string {
+    return stringToDate(dateString).toLocaleTimeString(undefined, { hour: "2-digit", minute: "2-digit", second: "2-digit" });
+}
+
 function dateToTimeAgo(date: Date): string {
     const secondsAgo = Math.floor((Date.now() - date.getTime()) / 1000);
     const units: [number, string][] = [
@@ -40,4 +46,52 @@ function dateToTimeAgo(date: Date): string {
     return `${s} second${s !== 1 ? 's' : ''} ago`;
 }
 
-export { formatTime, stringToDate, dateToTimeAgo, formatLocalDate };
+function startOfDay(date: Date): Date {
+    return new Date(date.getFullYear(), date.getMonth(), date.getDate());
+}
+
+// Weeks start on Monday.
+function startOfWeek(date: Date): Date {
+    const day = startOfDay(date);
+    day.setDate(day.getDate() - ((day.getDay() + 6) % 7));
+    return day;
+}
+
+// Buckets a date relative to now. Anything before last month falls back to its
+// month and year, so older items still group sensibly.
+function timeRangeLabel(date: Date, now: Date = new Date()): string {
+    const today = startOfDay(now);
+    const yesterday = new Date(today);
+    yesterday.setDate(today.getDate() - 1);
+    const thisWeek = startOfWeek(now);
+    const lastWeek = new Date(thisWeek);
+    lastWeek.setDate(thisWeek.getDate() - 7);
+    const thisMonth = new Date(now.getFullYear(), now.getMonth(), 1);
+    const lastMonth = new Date(now.getFullYear(), now.getMonth() - 1, 1);
+
+    if (date >= today) return "Today";
+    if (date >= yesterday) return "Yesterday";
+    if (date >= thisWeek) return "This Week";
+    if (date >= lastWeek) return "Last Week";
+    if (date >= thisMonth) return "This Month";
+    if (date >= lastMonth) return "Last Month";
+    return date.toLocaleDateString(undefined, { month: "long", year: "numeric" });
+}
+
+type TimeGroup<T> = { label: string, items: T[] };
+
+// Expects items already sorted newest first; groups keep that order.
+function groupByTimeRange<T>(items: T[], getDateString: (item: T) => string): TimeGroup<T>[] {
+    const now = new Date();
+    const groups: TimeGroup<T>[] = [];
+    for (const item of items) {
+        const label = timeRangeLabel(stringToDate(getDateString(item)), now);
+        const last = groups[groups.length - 1];
+        if (last?.label === label) last.items.push(item);
+        else groups.push({ label, items: [item] });
+    }
+    return groups;
+}
+
+export { formatTime, stringToDate, dateToTimeAgo, formatLocalDate, formatLocalTime, timeRangeLabel, groupByTimeRange };
+export type { TimeGroup };

frontend/src/vite-env.d.ts

@@ -1 +1,9 @@
 /// <reference types="vite/client" />
+
+interface Window {
+    _env_?: {
+        VITE_API_URL?: string;
+        VITE_FRONTEND_URL?: string;
+        VITE_GOOGLE_CLIENT_ID?: string;
+    };
+}

frontend/vite.config.ts

@@ -1,13 +1,12 @@
 import { defineConfig, loadEnv } from 'vite'
 import react from '@vitejs/plugin-react'
 import tailwindcss from '@tailwindcss/vite'
-import flowbiteReact from "flowbite-react/plugin/vite";
 
 export default defineConfig(({ mode }) => {  // change to function form
   const env = loadEnv(mode, process.cwd(), '')  // load all env vars
 
   return {
-    plugins: [react(), tailwindcss(), flowbiteReact()],
+    plugins: [react(), tailwindcss()],
     preview: {
       port: 5173,
       strictPort: true,

nginx/Dockerfile

@@ -1,6 +1,6 @@
-FROM tiangolo/nginx-rtmp
+FROM tiangolo/nginx-rtmp:latest-2026-09-07
 
-RUN apt-get update && \
+RUN apt-get update -o Acquire::Check-Valid-Until=false && \
     apt-get install -y --no-install-recommends gettext-base && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*

pom.xml

@@ -90,6 +90,16 @@
 			<artifactId>spring-boot-starter-test</artifactId>
 			<scope>test</scope>
 		</dependency>
+
+		<!-- Database Migration Tools -->
+		<dependency>
+			<groupId>org.flywaydb</groupId>
+			<artifactId>flyway-core</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.flywaydb</groupId>
+			<artifactId>flyway-database-postgresql</artifactId>
+		</dependency>
 	</dependencies>
 
 	<build>

src/main/java/com/ddf/vodsystem/VodSystemApplication.java

@@ -1,15 +1,23 @@
 package com.ddf.vodsystem;
 
+import com.ddf.vodsystem.dto.properties.AuthProperties;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.scheduling.annotation.EnableAsync;
 import org.springframework.scheduling.annotation.EnableScheduling;
 
 @SpringBootApplication
 @EnableScheduling
 @EnableAsync
+@EnableConfigurationProperties(AuthProperties.class)
 public class VodSystemApplication {
 
+	/**
+	 * Application entry point; boots the Spring context.
+	 *
+	 * @param args command-line arguments passed to Spring Boot
+	 */
 	public static void main(String[] args) {
 		SpringApplication.run(VodSystemApplication.class, args);
 	}

src/main/java/com/ddf/vodsystem/configuration/AsyncConfig.java

@@ -14,6 +14,11 @@ import java.util.concurrent.Executor;
 public class AsyncConfig implements AsyncConfigurer {
     private static final Logger logger = LoggerFactory.getLogger(AsyncConfig.class);
 
+    /**
+     * Provides the bounded thread pool that runs ffmpeg-backed {@code @Async} media tasks.
+     *
+     * @return the configured {@link Executor} registered as {@code ffmpegTaskExecutor}
+     */
     @Bean(name = "ffmpegTaskExecutor")
     public Executor taskExecutor() {
         ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor();
@@ -25,6 +30,11 @@ public class AsyncConfig implements AsyncConfigurer {
         return executor;
     }
 
+    /**
+     * Supplies the handler that logs uncaught exceptions from void-returning {@code @Async} methods.
+     *
+     * @return the async uncaught-exception handler
+     */
     @Override
     public AsyncUncaughtExceptionHandler getAsyncUncaughtExceptionHandler() {
         return (ex, method, params) ->

src/main/java/com/ddf/vodsystem/configuration/CorsConfig.java

@@ -12,6 +12,11 @@ public class CorsConfig {
     @Value("${frontend.url}")
     private String frontendUrl;
 
+    /**
+     * Configures CORS for the API, allowing credentialed requests from the configured frontend origin.
+     *
+     * @return a {@link WebMvcConfigurer} that registers the CORS mappings for {@code /api/v1/**}
+     */
     @Bean
     public WebMvcConfigurer corsConfigurer() {
         return new WebMvcConfigurer() {

src/main/java/com/ddf/vodsystem/configuration/SecurityConfig.java

@@ -1,10 +1,12 @@
 package com.ddf.vodsystem.configuration;
 
 import org.springframework.http.HttpMethod;
+import org.springframework.http.HttpStatus;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.Customizer;
 import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.HttpStatusEntryPoint;
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
@@ -22,6 +24,14 @@ public class SecurityConfig {
         this.jwtFilter = jwtFilter;
     }
 
+    /**
+     * Builds the security filter chain: stateless sessions, CSRF disabled, the {@link JwtFilter}
+     * installed, {@code 401} for unauthenticated requests, and per-endpoint authorization rules.
+     *
+     * @param http the HTTP security builder to configure
+     * @return the built {@link SecurityFilterChain}
+     * @throws Exception if the security configuration cannot be built
+     */
     @Bean
     public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
         http
@@ -30,13 +40,17 @@ public class SecurityConfig {
                 .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class)
                 .authorizeHttpRequests(auth -> auth
                         .requestMatchers(HttpMethod.OPTIONS, "/api/v1/**").permitAll()
+                        .requestMatchers("/api/v1/media/compress").permitAll() // compression available without authenticated
+                        .requestMatchers("/api/v1/jobs/**").permitAll() // same with jobs
                         .requestMatchers("/api/v1/media/**").authenticated()
-                        .requestMatchers("/api/v1/jobs/**").authenticated()
+                        .requestMatchers("/api/v1/users/me").authenticated()
-                        .requestMatchers("/api/v1/users/me", "/api/v1/users/logout").authenticated()
+                        // authenticated by the refresh token cookie, not the (possibly expired) access token
-                        .requestMatchers("/api/v1/users/login").permitAll()
+                        .requestMatchers("/api/v1/users/login", "/api/v1/users/refresh", "/api/v1/users/logout").permitAll()
                         .requestMatchers("/api/v1/stream/start", "/api/v1/stream/stop", "/api/v1/stream/heartbeat").permitAll()
                         .anyRequest().authenticated()
                 )
+                // 401 rather than the default 403, so clients know to refresh their session
+                .exceptionHandling(e -> e.authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED)))
                 .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                 );
 

src/main/java/com/ddf/vodsystem/configuration/TimeConfig.java

@@ -0,0 +1,15 @@
+package com.ddf.vodsystem.configuration;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+import java.time.Clock;
+
+@Configuration
+public class TimeConfig {
+
+    @Bean
+    public Clock clock() {
+        return Clock.systemUTC();
+    }
+}

src/main/java/com/ddf/vodsystem/controllers/ClipController.java

@@ -6,13 +6,12 @@ import com.ddf.vodsystem.controllers.dto.ClipUpdateRequest;
 import com.ddf.vodsystem.entities.Clip;
 import com.ddf.vodsystem.services.ClipService;
 import org.springframework.core.io.Resource;
-import org.springframework.http.HttpHeaders;
+import org.springframework.http.*;
-import org.springframework.http.MediaType;
-import org.springframework.http.MediaTypeFactory;
-import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;
 
+import java.io.IOException;
 import java.util.List;
+import java.util.concurrent.TimeUnit;
 
 @RestController
 @RequestMapping("/api/v1/clips")
@@ -25,6 +24,11 @@ public class ClipController {
         this.clipService = clipService;
     }
 
+    /**
+     * Lists all clips belonging to the authenticated user.
+     *
+     * @return {@code 200 OK} wrapping the user's clips as {@link ClipResponse} DTOs
+     */
     @GetMapping("")
     public ResponseEntity<APIResponse<List<ClipResponse>>> getClips() {
         List<Clip> clips = clipService.getClipsByUser();
@@ -40,6 +44,12 @@ public class ClipController {
         );
     }
 
+    /**
+     * Retrieves a single clip owned by the authenticated user.
+     *
+     * @param id the ID of the clip to retrieve
+     * @return {@code 200 OK} wrapping the clip as a {@link ClipResponse} DTO
+     */
     @GetMapping("/{id}")
     public ResponseEntity<APIResponse<ClipResponse>> getClipById(@PathVariable Long id) {
         Clip clip = clipService.getClipById(id);
@@ -53,6 +63,13 @@ public class ClipController {
         );
     }
 
+    /**
+     * Applies a partial update to a clip's metadata; null fields are left unchanged.
+     *
+     * @param id           the ID of the clip to update
+     * @param updateFields the title and/or description to overwrite
+     * @return {@code 200 OK} wrapping the updated clip as a {@link ClipResponse} DTO
+     */
     @PatchMapping("/{id}")
     public ResponseEntity<APIResponse<ClipResponse>> updateClip(@PathVariable Long id,
                                                            @RequestBody ClipUpdateRequest updateFields) {
@@ -64,6 +81,12 @@ public class ClipController {
         );
     }
 
+    /**
+     * Deletes a clip and its associated files.
+     *
+     * @param id the ID of the clip to delete
+     * @return {@code 200 OK} with a confirmation message
+     */
     @DeleteMapping("/{id}")
     public ResponseEntity<APIResponse<String>> deleteClip(@PathVariable Long id) {
         clipService.deleteClip(id);
@@ -77,8 +100,15 @@ public class ClipController {
         );
     }
 
-    @GetMapping("/{id}/media")
+    /**
-    public ResponseEntity<Resource> downloadClip(@PathVariable Long id) {
+     * Streams the clip's video file inline, supporting HTTP range requests.
+     *
+     * @param id the ID of the clip to download
+     * @return {@code 200 OK} with the video resource, or {@code 404 Not Found} if the file is missing
+     * @throws IOException if the resource's content length cannot be read
+     */
+    @GetMapping(value = "/{id}/media", produces = MediaType.ALL_VALUE)
+    public ResponseEntity<Resource> downloadClip(@PathVariable Long id) throws IOException {
         Resource resource = clipService.downloadClip(id);
 
         if (resource == null || !resource.exists()) {
@@ -86,13 +116,23 @@ public class ClipController {
         }
 
         return ResponseEntity.ok()
-                .header(HttpHeaders.CONTENT_DISPOSITION, String.format(FILENAME_HEADER, resource.getFilename()))
+                .header(HttpHeaders.CONTENT_DISPOSITION,
-                .contentType(MediaTypeFactory.getMediaType(resource).orElse(MediaType.APPLICATION_OCTET_STREAM))
+                        String.format(FILENAME_HEADER, resource.getFilename()))
+                .contentType(MediaTypeFactory.getMediaType(resource)
+                        .orElse(MediaType.APPLICATION_OCTET_STREAM))
+                .contentLength(resource.contentLength())
                 .body(resource);
     }
 
+    /**
+     * Streams the clip's thumbnail image with a public cache policy.
+     *
+     * @param id the ID of the clip whose thumbnail to download
+     * @return {@code 200 OK} with the thumbnail resource, or {@code 404 Not Found} if the file is missing
+     * @throws IOException if the resource's last-modified time cannot be read
+     */
     @GetMapping("/{id}/thumbnail")
-    public ResponseEntity<Resource> downloadThumbnail(@PathVariable Long id) {
+    public ResponseEntity<Resource> downloadThumbnail(@PathVariable Long id) throws IOException {
         Resource resource = clipService.downloadThumbnail(id);
 
         if (resource == null || !resource.exists()) {
@@ -100,6 +140,8 @@ public class ClipController {
         }
 
         return ResponseEntity.ok()
+                .cacheControl(CacheControl.maxAge(2, TimeUnit.DAYS).cachePublic())
+                .lastModified(resource.lastModified())
                 .header(HttpHeaders.CONTENT_DISPOSITION, String.format(FILENAME_HEADER, resource.getFilename()))
                 .contentType(MediaTypeFactory.getMediaType(resource).orElse(MediaType.APPLICATION_OCTET_STREAM))
                 .body(resource);

src/main/java/com/ddf/vodsystem/controllers/GlobalExceptionHandler.java

@@ -18,6 +18,12 @@ public class GlobalExceptionHandler {
     private static final Logger logger = LoggerFactory.getLogger(GlobalExceptionHandler.class);
     private static final String ERROR = "error";
 
+    /**
+     * Handles malformed multipart requests, returning {@code 400 Bad Request}.
+     *
+     * @param ex the thrown exception
+     * @return an error {@link APIResponse}
+     */
     @ExceptionHandler({ MultipartException.class })
     public ResponseEntity<APIResponse<Void>> handleMultipartException(MultipartException ex) {
         logger.error("MultipartException: {}", ex.getMessage());
@@ -25,6 +31,12 @@ public class GlobalExceptionHandler {
         return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(response);
     }
 
+    /**
+     * Handles requests missing a required file part, returning {@code 400 Bad Request}.
+     *
+     * @param ex the thrown exception
+     * @return an error {@link APIResponse}
+     */
     @ExceptionHandler({ MissingServletRequestPartException.class })
     public ResponseEntity<APIResponse<Void>> handleMissingPart(MissingServletRequestPartException ex) {
         logger.error("MissingServletRequestPartException: {}", ex.getMessage());
@@ -32,6 +44,12 @@ public class GlobalExceptionHandler {
         return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(response);
     }
 
+    /**
+     * Handles unsupported request content types, returning {@code 415 Unsupported Media Type}.
+     *
+     * @param ex the thrown exception
+     * @return an error {@link APIResponse}
+     */
     @ExceptionHandler({ HttpMediaTypeNotSupportedException.class })
     public ResponseEntity<APIResponse<Void>> handleUnsupportedMediaType(HttpMediaTypeNotSupportedException ex) {
         logger.error("HttpMediaTypeNotSupportedException: {}", ex.getMessage());
@@ -39,6 +57,12 @@ public class GlobalExceptionHandler {
         return ResponseEntity.status(HttpStatus.UNSUPPORTED_MEDIA_TYPE).body(response);
     }
 
+    /**
+     * Handles invalid arguments, returning {@code 400 Bad Request} with the exception message.
+     *
+     * @param ex the thrown exception
+     * @return an error {@link APIResponse}
+     */
     @ExceptionHandler(IllegalArgumentException.class)
     public ResponseEntity<APIResponse<Void>> handleIllegalArgument(IllegalArgumentException ex) {
         logger.error("IllegalArgumentException: {}", ex.getMessage());
@@ -46,6 +70,12 @@ public class GlobalExceptionHandler {
         return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(response);
     }
 
+    /**
+     * Handles lookups for a non-existent job, returning {@code 404 Not Found}.
+     *
+     * @param ex the thrown exception
+     * @return an error {@link APIResponse}
+     */
     @ExceptionHandler(JobNotFound.class)
     public ResponseEntity<APIResponse<Void>> handleFileNotFound(JobNotFound ex) {
         logger.error("JobNotFound: {}", ex.getMessage());
@@ -53,6 +83,12 @@ public class GlobalExceptionHandler {
         return ResponseEntity.status(HttpStatus.NOT_FOUND).body(response);
     }
 
+    /**
+     * Handles requests for a job that is still running, returning {@code 202 Accepted}.
+     *
+     * @param ex the thrown exception
+     * @return an error {@link APIResponse}
+     */
     @ExceptionHandler(JobNotFinished.class)
     public ResponseEntity<APIResponse<Void>> handleJobNotFinished(JobNotFinished ex) {
         logger.error("JobNotFinished: {}", ex.getMessage());
@@ -60,6 +96,12 @@ public class GlobalExceptionHandler {
         return ResponseEntity.status(HttpStatus.ACCEPTED).body(response);
     }
 
+    /**
+     * Handles ffmpeg processing failures, returning {@code 500 Internal Server Error}.
+     *
+     * @param ex the thrown exception
+     * @return an error {@link APIResponse}
+     */
     @ExceptionHandler(FFMPEGException.class)
     public ResponseEntity<APIResponse<Void>> handleFFMPEGException(FFMPEGException ex) {
         logger.error("FFMPEGException: {}", ex.getMessage());
@@ -67,6 +109,12 @@ public class GlobalExceptionHandler {
         return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body(response);
     }
 
+    /**
+     * Handles unauthenticated or unauthorized access, returning {@code 401 Unauthorized}.
+     *
+     * @param ex the thrown exception
+     * @return an error {@link APIResponse}
+     */
     @ExceptionHandler(NotAuthenticated.class)
     public ResponseEntity<APIResponse<Void>> handleNotAuthenticated(NotAuthenticated ex) {
         logger.error("NotAuthenticated: {}", ex.getMessage());
@@ -74,6 +122,12 @@ public class GlobalExceptionHandler {
         return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(response);
     }
 
+    /**
+     * Handles an unrecognised stream key, returning {@code 404 Not Found}.
+     *
+     * @param ex the thrown exception
+     * @return an error {@link APIResponse}
+     */
     @ExceptionHandler(KeyNotFound.class)
     public ResponseEntity<APIResponse<Void>> handleKeyNotFound(KeyNotFound ex) {
         logger.error("KeyNotFound: {}", ex.getMessage());
@@ -81,6 +135,12 @@ public class GlobalExceptionHandler {
         return ResponseEntity.status(HttpStatus.NOT_FOUND).body(response);
     }
 
+    /**
+     * Handles an attempt to start a stream while one is already active, returning {@code 409 Conflict}.
+     *
+     * @param ex the thrown exception
+     * @return an error {@link APIResponse}
+     */
     @ExceptionHandler(AlreadyStreaming.class)
     public ResponseEntity<APIResponse<Void>> handleAlreadyStreaming(AlreadyStreaming ex) {
         logger.error("AlreadyStreaming: {}", ex.getMessage());
@@ -88,6 +148,12 @@ public class GlobalExceptionHandler {
         return ResponseEntity.status(HttpStatus.CONFLICT).body(response);
     }
 
+    /**
+     * Handles file storage failures, returning {@code 500 Internal Server Error}.
+     *
+     * @param e the thrown exception
+     * @return an error {@link APIResponse}
+     */
     @ExceptionHandler(StorageException.class)
     public ResponseEntity<APIResponse<Void>> handleStorage(StorageException e) {
         logger.error("Storage operation failed", e);
@@ -95,6 +161,12 @@ public class GlobalExceptionHandler {
         return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body(response);
     }
 
+    /**
+     * Handles lookups for a non-existent clip, returning {@code 404 Not Found}.
+     *
+     * @param ex the thrown exception
+     * @return an error {@link APIResponse}
+     */
     @ExceptionHandler(ClipNotFound.class)
     public ResponseEntity<APIResponse<Void>> handleClipNotFound(ClipNotFound ex) {
         logger.error("ClipNotFound: {}", ex.getMessage());
@@ -102,6 +174,25 @@ public class GlobalExceptionHandler {
         return ResponseEntity.status(HttpStatus.NOT_FOUND).body(response);
     }
 
+    /**
+     * Handles a clip whose media file exists but is not readable, returning {@code 503 Service Unavailable}.
+     *
+     * @param ex the thrown exception
+     * @return an error {@link APIResponse}
+     */
+    @ExceptionHandler(ClipMediaUnavailable.class)
+    public ResponseEntity<APIResponse<Void>> handleClipMediaUnavailable(ClipMediaUnavailable ex) {
+        logger.error("ClipMediaUnavailable (clip {}): {}", ex.getClipId(), ex.getMessage());
+        APIResponse<Void> response = new APIResponse<>(ERROR, "Clip media is currently unavailable", null);
+        return ResponseEntity.status(HttpStatus.SERVICE_UNAVAILABLE).body(response);
+    }
+
+    /**
+     * Handles lookups for a non-existent VoD, returning {@code 404 Not Found}.
+     *
+     * @param ex the thrown exception
+     * @return an error {@link APIResponse}
+     */
     @ExceptionHandler(VodNotFound.class)
     public ResponseEntity<APIResponse<Void>> handleVodNotFound(VodNotFound ex) {
         logger.error("VodNotFound: {}", ex.getMessage());
@@ -109,6 +200,25 @@ public class GlobalExceptionHandler {
         return ResponseEntity.status(HttpStatus.NOT_FOUND).body(response);
     }
 
+    /**
+     * Handles a VoD whose media file exists but is not readable, returning {@code 503 Service Unavailable}.
+     *
+     * @param ex the thrown exception
+     * @return an error {@link APIResponse}
+     */
+    @ExceptionHandler(VodMediaUnavailable.class)
+    public ResponseEntity<APIResponse<Void>> handleVodMediaUnavailable(VodMediaUnavailable ex) {
+        logger.error("VodMediaUnavailable (vod {}): {}", ex.getVodId(), ex.getMessage());
+        APIResponse<Void> response = new APIResponse<>(ERROR, "Vod media is currently unavailable", null);
+        return ResponseEntity.status(HttpStatus.SERVICE_UNAVAILABLE).body(response);
+    }
+
+    /**
+     * Handles actions that require an active stream when none exists, returning {@code 409 Conflict}.
+     *
+     * @param ex the thrown exception
+     * @return an error {@link APIResponse}
+     */
     @ExceptionHandler(NotStreaming.class)
     public ResponseEntity<APIResponse<Void>> handleNotStreaming(NotStreaming ex) {
         logger.error("NotStreaming: {}", ex.getMessage());
@@ -116,6 +226,12 @@ public class GlobalExceptionHandler {
         return ResponseEntity.status(HttpStatus.CONFLICT).body(response);
     }
 
+    /**
+     * Handles lookups for a non-existent marker, returning {@code 404 Not Found}.
+     *
+     * @param ex the thrown exception
+     * @return an error {@link APIResponse}
+     */
     @ExceptionHandler(MarkerNotFound.class)
     public ResponseEntity<APIResponse<Void>> handleMarkerNotFound(MarkerNotFound ex) {
         logger.error("MarkerNotFound: {}", ex.getMessage());

src/main/java/com/ddf/vodsystem/controllers/JobController.java

@@ -28,6 +28,13 @@ public class JobController {
         this.jobRegistryService = jobRegistryService;
     }
 
+    /**
+     * Retrieves the status and progress of an asynchronous job.
+     *
+     * @param uuid the UUID of the job to look up
+     * @return {@code 200 OK} wrapping the job's state as a {@link JobResponse} DTO
+     * @throws com.ddf.vodsystem.exceptions.JobNotFound if no job with {@code uuid} exists
+     */
     @GetMapping("/{uuid}")
     public ResponseEntity<APIResponse<JobResponse>> getJob(@PathVariable String uuid) {
         Job job = jobRegistryService.getJob(uuid);
@@ -47,6 +54,15 @@ public class JobController {
         ));
     }
 
+    /**
+     * Downloads the output file produced by a completed job.
+     *
+     * @param uuid the UUID of the job whose output to download
+     * @return {@code 200 OK} with the output file as a downloadable resource
+     * @throws com.ddf.vodsystem.exceptions.JobNotFound     if no job with {@code uuid} exists
+     * @throws NotReadyException if the job has not yet produced a downloadable file
+     * @throws ClipNotFound     if the job's output file no longer exists on disk
+     */
     @GetMapping("/{uuid}/download")
     public ResponseEntity<Resource> downloadJobFile(@PathVariable String uuid) {
         Job job = jobRegistryService.getJob(uuid);

src/main/java/com/ddf/vodsystem/controllers/MarkerController.java

@@ -22,6 +22,11 @@ public class MarkerController {
         this.markerService = markerService;
     }
 
+    /**
+     * Lists all markers belonging to the authenticated user.
+     *
+     * @return {@code 200 OK} wrapping the user's markers as {@link MarkerResponse} DTOs
+     */
     @GetMapping("")
     public ResponseEntity<APIResponse<List<MarkerResponse>>> getMarkers() {
         List<MarkerResponse> markers = markerService.getUserMarkers().stream()
@@ -33,6 +38,12 @@ public class MarkerController {
         );
     }
 
+    /**
+     * Retrieves a single marker owned by the authenticated user.
+     *
+     * @param id the ID of the marker to retrieve
+     * @return {@code 200 OK} wrapping the marker as a {@link MarkerResponse} DTO
+     */
     @GetMapping("/{id}")
     public ResponseEntity<APIResponse<MarkerResponse>> getMarkerById(@PathVariable Long id) {
         Marker marker = markerService.getMarkerById(id);
@@ -42,6 +53,12 @@ public class MarkerController {
         );
     }
 
+    /**
+     * Creates a marker at the current moment on the user's active stream.
+     *
+     * @param request the marker payload carrying the marker message
+     * @return {@code 200 OK} wrapping the created marker as a {@link MarkerResponse} DTO
+     */
     @PostMapping("")
     public ResponseEntity<APIResponse<MarkerResponse>> createMarker(@Valid @RequestBody MarkerCreateRequest request) {
         Marker marker = markerService.create(request.message());
@@ -51,6 +68,12 @@ public class MarkerController {
         );
     }
 
+    /**
+     * Deletes a marker owned by the authenticated user.
+     *
+     * @param id the ID of the marker to delete
+     * @return {@code 200 OK} with a confirmation message
+     */
     @DeleteMapping("/{id}")
     public ResponseEntity<APIResponse<String>> deleteMarker(@PathVariable Long id) {
         markerService.deleteMarker(id);

src/main/java/com/ddf/vodsystem/controllers/MediaController.java

@@ -26,11 +26,19 @@ public class MediaController {
         this.mediaService = mediaService;
     }
 
+    /**
+     * Starts an asynchronous job to compress an uploaded video file.
+     *
+     * @param file    the uploaded video to compress
+     * @param options trim window, resolution, fps, and target size for the output
+     * @return {@code 200 OK} wrapping the new job's UUID for polling
+     * @throws IOException if saving the upload to temporary storage fails
+     */
     @PostMapping(value = "/compress", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
     public ResponseEntity<APIResponse<UUIDResponse>> compress(
             @RequestParam("file")MultipartFile file,
             @Valid @ModelAttribute ClipOptions options
-            ) throws IOException, InterruptedException {
+            ) throws IOException {
         Job job = mediaService.compress(file, options);
         return ResponseEntity.ok(new APIResponse<>(
                 SUCCESS,
@@ -40,6 +48,13 @@ public class MediaController {
     }
 
 
+    /**
+     * Starts an asynchronous job to save a section of the user's stream between two timestamps as a VoD.
+     *
+     * @param saveSectionRequest the start/end timestamps and optional title/description
+     * @return {@code 200 OK} wrapping the new job's UUID for polling
+     * @throws IOException if reading the stream segments fails
+     */
     @PostMapping("/save")
     public ResponseEntity<APIResponse<UUIDResponse>> save(
             @RequestBody SaveSectionRequest saveSectionRequest) throws IOException {
@@ -55,6 +70,13 @@ public class MediaController {
         ));
     }
 
+    /**
+     * Starts an asynchronous job to save the section of the user's stream between two markers as a VoD.
+     *
+     * @param saveSectionByMarkerRequest the start/end marker IDs and optional title/description
+     * @return {@code 200 OK} wrapping the new job's UUID for polling
+     * @throws IOException if reading the stream segments fails
+     */
     @PostMapping("/save/markers")
     public ResponseEntity<APIResponse<UUIDResponse>> saveByMarkers(
             @Valid @RequestBody SaveSectionByMarkerRequest saveSectionByMarkerRequest) throws IOException {
@@ -70,6 +92,13 @@ public class MediaController {
         ));
     }
 
+    /**
+     * Starts an asynchronous job to save the last few seconds of the user's stream as a clip.
+     *
+     * @param clipSectionRequest the clip duration in seconds and optional title/description
+     * @return {@code 200 OK} wrapping the new job's UUID for polling
+     * @throws IOException if reading the stream segments fails
+     */
     @PostMapping("/clip")
     public ResponseEntity<APIResponse<UUIDResponse>> clip(
             @RequestBody ClipSectionRequest clipSectionRequest) throws IOException {

src/main/java/com/ddf/vodsystem/controllers/StreamController.java

@@ -24,6 +24,14 @@ public class StreamController {
         this.streamService = streamService;
     }
 
+    /**
+     * Starts a new stream for the user owning the given stream key.
+     * <p>
+     * Called by nginx via its {@code on_publish} RTMP callback when a broadcast begins.
+     *
+     * @param streamKey the RTMP stream key identifying the broadcasting user
+     * @return {@code 200 OK} wrapping the newly started {@link Stream}
+     */
     // Called by nginx on_publish
     @PostMapping("/start")
     public ResponseEntity<APIResponse<Stream>> startStream(@RequestParam("name") String streamKey) {
@@ -32,6 +40,14 @@ public class StreamController {
         return ResponseEntity.ok(new APIResponse<>(SUCCESS, "Stream started", stream));
     }
 
+    /**
+     * Ends the active stream for the user owning the given stream key.
+     * <p>
+     * Called by nginx via its {@code on_publish_done} RTMP callback when a broadcast stops.
+     *
+     * @param streamKey the RTMP stream key identifying the broadcasting user
+     * @return {@code 200 OK} confirming the stream was ended
+     */
     // Called by nginx on_publish_done
     @PostMapping("/stop")
     public ResponseEntity<APIResponse<Void>> stopStream(@RequestParam("name") String streamKey) {
@@ -40,6 +56,14 @@ public class StreamController {
         return ResponseEntity.ok(new APIResponse<>(SUCCESS, "Stream ended", null));
     }
 
+    /**
+     * Records a liveness heartbeat for the active stream, keeping it from being reaped as stale.
+     * <p>
+     * Called periodically by nginx via its {@code on_update} RTMP callback.
+     *
+     * @param streamKey the RTMP stream key identifying the broadcasting user
+     * @return {@code 200 OK} confirming the heartbeat was recorded
+     */
     // Called by nginx on_update
     @PostMapping("/heartbeat")
     public ResponseEntity<APIResponse<Void>> heartbeat(@RequestParam("name") String streamKey) {
@@ -47,12 +71,24 @@ public class StreamController {
         return ResponseEntity.ok(new APIResponse<>(SUCCESS, "Heartbeat recorded", null));
     }
 
+    /**
+     * Retrieves the stream history for the given user.
+     *
+     * @param userId the ID of the user whose stream history to retrieve; must be the authenticated user
+     * @return {@code 200 OK} wrapping the user's past and current {@link Stream}s
+     */
     @GetMapping("/history/{userId}")
     public ResponseEntity<APIResponse<List<Stream>>> getStreamHistory(@PathVariable Long userId) {
         List<Stream> history = streamService.getStreamHistory(userId);
         return ResponseEntity.ok(new APIResponse<>(SUCCESS, "Stream history retrieved", history));
     }
 
+    /**
+     * Reports whether the authenticated user is currently streaming.
+     *
+     * @return {@code 200 OK} wrapping a {@link StreamResponse} indicating the live status and, if live,
+     *         the active stream's ID
+     */
     @GetMapping("/current")
     public ResponseEntity<APIResponse<StreamResponse>> getCurrentStream() {
         Optional<Stream> stream = streamService.getActiveStream();

src/main/java/com/ddf/vodsystem/controllers/UserController.java

@@ -1,17 +1,21 @@
 package com.ddf.vodsystem.controllers;
 
 import com.ddf.vodsystem.dto.APIResponse;
+import com.ddf.vodsystem.controllers.dto.SessionResponse;
 import com.ddf.vodsystem.controllers.dto.Token;
+import com.ddf.vodsystem.dto.TokenPackage;
+import com.ddf.vodsystem.dto.properties.AuthProperties;
 import com.ddf.vodsystem.entities.User;
 import com.ddf.vodsystem.exceptions.NotAuthenticated;
 import com.ddf.vodsystem.services.UserService;
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.servlet.http.HttpServletRequest;
-import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.HttpHeaders;
 import org.springframework.http.ResponseCookie;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;
 
+import java.time.Duration;
 import java.util.Optional;
 
 @RestController
@@ -19,14 +23,26 @@ import java.util.Optional;
 public class UserController {
     private final UserService userService;
 
-    @Value("${jwt.expiration}")
+    private final Duration jwtExpiration;
-    private long jwtExpiration;
+    private final Duration refreshTokenExpiration;
     private static final String SUCCESS = "success";
 
-    public UserController(UserService userService) {
+    private static final String ACCESS_COOKIE_PATH = "/";
+    private static final String REFRESH_COOKIE_PATH = "/api/v1/users";
+
+    public UserController(UserService userService,
+                          AuthProperties props) {
         this.userService = userService;
+        this.jwtExpiration = props.expiration().jwt();
+        this.refreshTokenExpiration = props.expiration().refreshToken();
     }
 
+    /**
+     * Returns the currently authenticated user's profile.
+     *
+     * @return {@code 200 OK} wrapping the authenticated {@link User}
+     * @throws NotAuthenticated if no valid session is present
+     */
     @GetMapping("/me")
     public ResponseEntity<APIResponse<User>> user() {
         Optional<User> user = userService.getLoggedInUser();
@@ -40,42 +56,111 @@ public class UserController {
         );
     }
 
+    /**
+     * Authenticates a user from a Google ID token and starts a session.
+     * <p>
+     * Sets two HttpOnly cookies: {@code accessToken} (the JWT, path {@code /}) and {@code refreshToken}
+     * (path {@code /api/v1/users}). Neither token is returned in the response body.
+     *
+     * @param token    the payload carrying the Google ID token to verify
+     * @param request  the incoming request, used to decide the cookies' {@code Secure} flag
+     * @param response the response the cookies are written to
+     * @return {@code 200 OK} wrapping the access token lifetime as a {@link SessionResponse}
+     * @throws NotAuthenticated if the Google ID token is rejected
+     */
     @PostMapping("/login")
-    public ResponseEntity<APIResponse<Token>> login(@RequestBody Token token,
+    public ResponseEntity<APIResponse<SessionResponse>> login(@RequestBody Token token,
                                                            HttpServletRequest request,
                                                            HttpServletResponse response) {
-        String jwt = userService.login(token.token());
+        TokenPackage tokenPackage = userService.login(token.token());
-
+        addCookies(request, response, tokenPackage.accessToken(), tokenPackage.refreshToken());
-        ResponseCookie cookie = ResponseCookie.from("token", jwt)
-                .httpOnly(true)
-                .maxAge(jwtExpiration / 1000)
-                .sameSite(request.isSecure() ? "None" : "Lax")
-                .secure(request.isSecure())
-                .path("/")
-                .build();
-
-        response.addHeader("Set-Cookie", cookie.toString());
 
         return ResponseEntity.ok(
-                new APIResponse<>(SUCCESS, "Logged in successfully", new Token(jwt))
+                new APIResponse<>(SUCCESS, "Logged in successfully", sessionResponse())
         );
     }
 
-    @PostMapping("/logout")
+    /**
-    public ResponseEntity<APIResponse<Void>> logout(HttpServletResponse response,
+     * Exchanges the {@code refreshToken} cookie for a new refresh token and JWT, replacing both cookies.
-		    				    HttpServletRequest request) {
+     *
-        ResponseCookie cookie = ResponseCookie.from("token", "")
+     * @param refreshToken the refresh token from the {@code refreshToken} cookie, if present
-                .httpOnly(true)
+     * @param request      the incoming request, used to decide the cookies' {@code Secure} flag
-                .maxAge(0)
+     * @param response     the response the new cookies are written to
-                .sameSite(request.isSecure() ? "None" : "Lax")
+     * @return {@code 200 OK} wrapping the new access token lifetime as a {@link SessionResponse}
-                .secure(request.isSecure())
+     * @throws NotAuthenticated if the refresh token is missing or rejected
-                .path("/")
+     */
-                .build();
+    @PostMapping("/refresh")
+    public ResponseEntity<APIResponse<SessionResponse>> refresh(
+            @CookieValue(name = "refreshToken", required = false) String refreshToken,
+            HttpServletRequest request,
+            HttpServletResponse response) {
+        TokenPackage tokenPackage = userService.refresh(refreshToken);
+        addCookies(request, response, tokenPackage.accessToken(), tokenPackage.refreshToken());
 
-        response.addHeader("Set-Cookie", cookie.toString());
+        return ResponseEntity.ok(
+                new APIResponse<>(SUCCESS, "Refreshed tokens successfully", sessionResponse())
+        );
+    }
+
+    /**
+     * Logs the user out by revoking the session tied to the {@code refreshToken} cookie and clearing
+     * both auth cookies. Succeeds even if no refresh token cookie is present.
+     *
+     * @param refreshToken the refresh token from the {@code refreshToken} cookie, if present
+     * @param request      the incoming request, used to decide the cookies' {@code Secure} flag
+     * @param response     the response the expired cookies are written to
+     * @return {@code 200 OK} confirming logout
+     */
+    @PostMapping("/logout")
+    public ResponseEntity<APIResponse<Void>> logout(
+            @CookieValue(name = "refreshToken", required = false) String refreshToken,
+            HttpServletRequest request,
+            HttpServletResponse response) {
+        userService.logout(refreshToken);
+        writeCookies(request, response, "", Duration.ZERO, "", Duration.ZERO);
 
         return ResponseEntity.ok(
                 new APIResponse<>(SUCCESS, "Logged out successfully", null)
         );
     }
+
+    private SessionResponse sessionResponse() {
+        return new SessionResponse(jwtExpiration.getSeconds());
+    }
+
+    private void addCookies(
+            HttpServletRequest request,
+            HttpServletResponse response,
+            String accessToken,
+            String refreshToken) {
+        writeCookies(request, response, accessToken, jwtExpiration, refreshToken, refreshTokenExpiration);
+    }
+
+
+    private void writeCookies(
+            HttpServletRequest request,
+            HttpServletResponse response,
+            String accessToken,
+            Duration accessTokenMaxAge,
+            String refreshToken,
+            Duration refreshTokenMaxAge) {
+        ResponseCookie accessTokenCookie = ResponseCookie.from("accessToken", accessToken)
+                .httpOnly(true)
+                .maxAge(accessTokenMaxAge)
+                .sameSite("Lax")
+                .secure(request.isSecure())
+                .path(ACCESS_COOKIE_PATH)
+                .build();
+
+        ResponseCookie refreshTokenCookie = ResponseCookie.from("refreshToken", refreshToken)
+                .httpOnly(true)
+                .maxAge(refreshTokenMaxAge)
+                .sameSite("Lax")
+                .secure(request.isSecure())
+                .path(REFRESH_COOKIE_PATH)
+                .build();
+
+        response.addHeader(HttpHeaders.SET_COOKIE, refreshTokenCookie.toString());
+        response.addHeader(HttpHeaders.SET_COOKIE, accessTokenCookie.toString());
+    }
 }

src/main/java/com/ddf/vodsystem/controllers/VodController.java

@@ -6,13 +6,12 @@ import com.ddf.vodsystem.dto.APIResponse;
 import com.ddf.vodsystem.entities.Vod;
 import com.ddf.vodsystem.services.VodService;
 import org.springframework.core.io.Resource;
-import org.springframework.http.HttpHeaders;
+import org.springframework.http.*;
-import org.springframework.http.MediaType;
-import org.springframework.http.MediaTypeFactory;
-import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;
 
+import java.io.IOException;
 import java.util.List;
+import java.util.concurrent.TimeUnit;
 
 @RestController
 @RequestMapping("/api/v1/vods")
@@ -25,6 +24,11 @@ public class VodController {
         this.vodService = vodService;
     }
 
+    /**
+     * Lists all VoDs belonging to the authenticated user.
+     *
+     * @return {@code 200 OK} wrapping the user's VoDs as {@link VodResponse} DTOs
+     */
     @GetMapping("")
     public ResponseEntity<APIResponse<List<VodResponse>>> getVods() {
         List<VodResponse> vods = vodService.getUserVods().stream()
@@ -34,12 +38,25 @@ public class VodController {
         return ResponseEntity.ok(new APIResponse<>(SUCCESS, "Vods retrieved successfully", vods));
     }
 
+    /**
+     * Retrieves a single VoD owned by the authenticated user.
+     *
+     * @param id the ID of the VoD to retrieve
+     * @return {@code 200 OK} wrapping the VoD as a {@link VodResponse} DTO
+     */
     @GetMapping("/{id}")
     public ResponseEntity<APIResponse<VodResponse>> getVodById(@PathVariable Long id) {
         VodResponse vod = convertToDTO(vodService.getVodById(id));
         return ResponseEntity.ok(new APIResponse<>(SUCCESS, "Vod retrieved successfully", vod));
     }
 
+    /**
+     * Applies a partial update to a VoD's metadata; null fields are left unchanged.
+     *
+     * @param id           the ID of the VoD to update
+     * @param updateFields the title and/or description to overwrite
+     * @return {@code 200 OK} wrapping the updated VoD as a {@link VodResponse} DTO
+     */
     @PatchMapping("/{id}")
     public ResponseEntity<APIResponse<VodResponse>> updateVod(@PathVariable Long id,
                                                               @RequestBody VodUpdateRequest updateFields) {
@@ -47,6 +64,12 @@ public class VodController {
         return ResponseEntity.ok(new APIResponse<>(SUCCESS, "Vod updated successfully", vod));
     }
 
+    /**
+     * Deletes a VoD and its associated files.
+     *
+     * @param id the ID of the VoD to delete
+     * @return {@code 200 OK} with a confirmation message
+     */
     @DeleteMapping("/{id}")
     public ResponseEntity<APIResponse<String>> deleteVod(@PathVariable Long id) {
         vodService.deleteVod(id);
@@ -54,8 +77,15 @@ public class VodController {
                 "Vod with ID " + id + " has been deleted"));
     }
 
-    @GetMapping("/{id}/media")
+    /**
-    public ResponseEntity<Resource> downloadVod(@PathVariable Long id) {
+     * Streams the VoD's video file inline, supporting HTTP range requests.
+     *
+     * @param id the ID of the VoD to download
+     * @return {@code 200 OK} with the video resource, or {@code 404 Not Found} if the file is missing
+     * @throws IOException if the resource's content length cannot be read
+     */
+    @GetMapping(value = "/{id}/media", produces = MediaType.ALL_VALUE)
+    public ResponseEntity<Resource> downloadVod(@PathVariable Long id) throws IOException {
         Resource resource = vodService.downloadVod(id);
 
         if (resource == null || !resource.exists()) {
@@ -63,13 +93,23 @@ public class VodController {
         }
 
         return ResponseEntity.ok()
-                .header(HttpHeaders.CONTENT_DISPOSITION, String.format(FILENAME_HEADER, resource.getFilename()))
+                .header(HttpHeaders.CONTENT_DISPOSITION,
-                .contentType(MediaTypeFactory.getMediaType(resource).orElse(MediaType.APPLICATION_OCTET_STREAM))
+                        String.format(FILENAME_HEADER, resource.getFilename()))
+                .contentType(MediaTypeFactory.getMediaType(resource)
+                        .orElse(MediaType.APPLICATION_OCTET_STREAM))
+                .contentLength(resource.contentLength())
                 .body(resource);
     }
 
+    /**
+     * Streams the VoD's thumbnail image with a public cache policy.
+     *
+     * @param id the ID of the VoD whose thumbnail to download
+     * @return {@code 200 OK} with the thumbnail resource, or {@code 404 Not Found} if the file is missing
+     * @throws IOException if the resource's last-modified time cannot be read
+     */
     @GetMapping("/{id}/thumbnail")
-    public ResponseEntity<Resource> downloadThumbnail(@PathVariable Long id) {
+    public ResponseEntity<Resource> downloadThumbnail(@PathVariable Long id) throws IOException {
         Resource resource = vodService.downloadThumbnail(id);
 
         if (resource == null || !resource.exists()) {
@@ -77,6 +117,8 @@ public class VodController {
         }
 
         return ResponseEntity.ok()
+                .cacheControl(CacheControl.maxAge(2, TimeUnit.DAYS).cachePublic())
+                .lastModified(resource.lastModified())
                 .header(HttpHeaders.CONTENT_DISPOSITION, String.format(FILENAME_HEADER, resource.getFilename()))
                 .contentType(MediaTypeFactory.getMediaType(resource).orElse(MediaType.APPLICATION_OCTET_STREAM))
                 .body(resource);

src/main/java/com/ddf/vodsystem/controllers/dto/SessionResponse.java

@@ -0,0 +1,11 @@
+package com.ddf.vodsystem.controllers.dto;
+
+/**
+ * Session metadata returned after login or refresh. The tokens themselves are only ever sent as
+ * HttpOnly cookies; this tells the client when to refresh them.
+ *
+ * @param accessTokenExpiresIn seconds until the access token cookie expires
+ */
+public record SessionResponse(
+        long accessTokenExpiresIn
+) {}

src/main/java/com/ddf/vodsystem/dto/ClipOptions.java

@@ -11,7 +11,7 @@ public class ClipOptions {
     private String description;
 
     @NotNull
-    @Positive
+    @PositiveOrZero
     private Float startPoint;
 
     @NotNull @Positive

src/main/java/com/ddf/vodsystem/dto/CommandOutput.java

@@ -10,6 +10,11 @@ public class CommandOutput {
     private List<String> output = new ArrayList<>();
     private int exitCode;
 
+    /**
+     * Appends a line to the captured command output.
+     *
+     * @param line the output line to append
+     */
     public void addLine(String line) {
         output.add(line);
     }

src/main/java/com/ddf/vodsystem/dto/GoogleUser.java

@@ -0,0 +1,9 @@
+package com.ddf.vodsystem.dto;
+
+public record GoogleUser(
+        String googleId,
+        String email,
+        String name,
+        String profilePictureUrl
+) {
+}

src/main/java/com/ddf/vodsystem/dto/ProgressTracker.java

@@ -4,14 +4,30 @@ public class ProgressTracker {
     private float progress = 0.0f;
     private boolean isComplete = false;
 
+    /**
+     * Returns the current progress.
+     *
+     * @return the progress as a fraction in {@code [0, 1]}
+     */
     public synchronized float getProgress() {
         return progress;
     }
 
+    /**
+     * Returns whether the tracked task has been marked complete.
+     *
+     * @return {@code true} if complete
+     */
     public synchronized boolean isComplete() {
         return isComplete;
     }
 
+    /**
+     * Updates the current progress.
+     *
+     * @param newProgress the progress as a fraction in {@code [0, 1]}
+     * @throws IllegalArgumentException if {@code newProgress} is outside {@code [0, 1]}
+     */
     public synchronized void setProgress(float newProgress) {
         if (newProgress < 0 || newProgress > 1) {
             throw new IllegalArgumentException("Progress must be between 0 and 1");
@@ -19,10 +35,16 @@ public class ProgressTracker {
         this.progress = newProgress;
     }
 
+    /**
+     * Marks the tracked task as complete.
+     */
     public synchronized void markComplete() {
         this.isComplete = true;
     }
 
+    /**
+     * Resets progress to zero and clears the complete flag.
+     */
     public synchronized void reset() {
         this.progress = 0.0f;
         this.isComplete = false;

src/main/java/com/ddf/vodsystem/dto/TokenPackage.java

@@ -0,0 +1,7 @@
+package com.ddf.vodsystem.dto;
+
+public record TokenPackage (
+        String refreshToken,
+        String accessToken
+) {
+}

src/main/java/com/ddf/vodsystem/dto/properties/AuthProperties.java

@@ -0,0 +1,32 @@
+package com.ddf.vodsystem.dto.properties;
+
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Size;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.validation.annotation.Validated;
+
+import java.time.Duration;
+
+@Validated
+@ConfigurationProperties(prefix = "app.security")
+public record AuthProperties (
+        @NotBlank @Size(min = 32) String jwtSecret,
+        @Valid @NotNull Expiration expiration
+) {
+
+    /**
+     *
+     * @param jwt
+     * @param refreshToken
+     * @param tokenFamily
+     * @param gracePeriod
+     */
+    public record Expiration (
+            @NotNull Duration jwt,
+            @NotNull Duration refreshToken,
+            @NotNull Duration tokenFamily,
+            @NotNull Duration gracePeriod
+    ) {}
+}

src/main/java/com/ddf/vodsystem/entities/RefreshToken.java

@@ -0,0 +1,37 @@
+package com.ddf.vodsystem.entities;
+
+import jakarta.persistence.*;
+import lombok.Data;
+import org.hibernate.annotations.CreationTimestamp;
+
+import java.time.Instant;
+
+@Entity
+@Table(name = "refresh_tokens")
+@Data
+public class RefreshToken {
+    @Id
+    @Column(name = "id", nullable = false, unique = true)
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name = "family_id", nullable = false)
+    private TokenFamily tokenFamily;
+
+    @Column(name = "token_hash", unique = true, nullable = false, length = 32)
+    private byte[] tokenHash;
+
+    @Column(name = "created_at", nullable = false)
+    @CreationTimestamp
+    private Instant createdAt;
+
+    @Column(name = "expires_at", nullable = false)
+    private Instant expiresAt;
+
+    @Column(name = "used_at")
+    private Instant usedAt;
+
+    @Column(name = "revoked_at")
+    private Instant revokedAt;
+}

src/main/java/com/ddf/vodsystem/entities/TokenFamily.java

@@ -0,0 +1,31 @@
+package com.ddf.vodsystem.entities;
+
+import jakarta.persistence.*;
+import lombok.Data;
+import org.hibernate.annotations.CreationTimestamp;
+
+import java.time.Instant;
+
+@Entity
+@Table(name = "token_families")
+@Data
+public class TokenFamily {
+    @Id
+    @Column(name = "id", nullable = false, unique = true)
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name = "user_id", nullable = false)
+    private User user;
+
+    @Column(name = "created_at", nullable = false)
+    @CreationTimestamp
+    private Instant createdAt;
+
+    @Column(name = "expires_at", nullable = false)
+    private Instant expiresAt;
+
+    @Column(name = "revoked_at")
+    private Instant revokedAt;
+}

src/main/java/com/ddf/vodsystem/exceptions/ClipMediaUnavailable.java

@@ -0,0 +1,23 @@
+package com.ddf.vodsystem.exceptions;
+
+public class ClipMediaUnavailable extends RuntimeException {
+  private final Long clipId;
+
+  public ClipMediaUnavailable(Long clipId, String message) {
+    this(clipId, message, null);
+  }
+
+  public ClipMediaUnavailable(Long clipId, String message, Throwable cause) {
+    super(message, cause);
+    this.clipId = clipId;
+  }
+
+  /**
+   * Returns the ID of the clip whose media was unavailable.
+   *
+   * @return the affected clip's ID
+   */
+  public Long getClipId() {
+    return clipId;
+  }
+}

src/main/java/com/ddf/vodsystem/exceptions/VodMediaUnavailable.java

@@ -0,0 +1,23 @@
+package com.ddf.vodsystem.exceptions;
+
+public class VodMediaUnavailable extends RuntimeException {
+  private final Long vodId;
+
+  public VodMediaUnavailable(Long vodId, String message) {
+    this(vodId, message, null);
+  }
+
+  public VodMediaUnavailable(Long vodId, String message, Throwable cause) {
+    super(message, cause);
+    this.vodId = vodId;
+  }
+
+  /**
+   * Returns the ID of the VoD whose media was unavailable.
+   *
+   * @return the affected VoD's ID
+   */
+  public Long getVodId() {
+    return vodId;
+  }
+}

src/main/java/com/ddf/vodsystem/repositories/ClipRepository.java

@@ -10,6 +10,12 @@ import java.util.List;
 
 @Repository
 public interface ClipRepository extends JpaRepository<Clip, Long> {
+    /**
+     * Finds all clips owned by the given user.
+     *
+     * @param user the owning user
+     * @return the user's clips
+     */
     @Query("SELECT c FROM Clip c WHERE c.user = ?1")
     List<Clip> findByUser(User user);
 }

src/main/java/com/ddf/vodsystem/repositories/MarkerRepository.java

@@ -11,9 +11,21 @@ import java.util.List;
 
 @Repository
 public interface MarkerRepository extends JpaRepository<Marker, Long> {
+    /**
+     * Finds all markers owned by the given user.
+     *
+     * @param user the owning user
+     * @return the user's markers
+     */
     @Query("SELECT m FROM Marker m WHERE m.user = ?1")
     List<Marker> findByUser(User user);
 
+    /**
+     * Finds all markers timestamped at or before the given instant.
+     *
+     * @param time the cutoff instant (inclusive)
+     * @return markers at or before {@code time}
+     */
     @Query("SELECT m FROM Marker m WHERE m.timestamp <= ?1")
     List<Marker> findAllBefore(Instant time);
 }

src/main/java/com/ddf/vodsystem/repositories/RefreshTokenRepository.java

@@ -0,0 +1,17 @@
+package com.ddf.vodsystem.repositories;
+
+import com.ddf.vodsystem.entities.RefreshToken;
+import jakarta.persistence.LockModeType;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Lock;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.stereotype.Repository;
+
+import java.util.Optional;
+
+@Repository
+public interface RefreshTokenRepository extends JpaRepository<RefreshToken, Long> {
+    @Lock(LockModeType.PESSIMISTIC_WRITE)
+    @Query("SELECT r FROM RefreshToken r WHERE r.tokenHash = ?1")
+    Optional<RefreshToken> findByHash(byte[] tokenHash);
+}

src/main/java/com/ddf/vodsystem/repositories/StreamRepository.java

@@ -11,7 +11,27 @@ import java.util.Optional;
 
 @Repository
 public interface StreamRepository extends JpaRepository<Stream, Long> {
+    /**
+     * Finds the user's active (not-yet-ended) stream, if any.
+     *
+     * @param user the owning user
+     * @return the active stream, or empty if none
+     */
     Optional<Stream> findByUserAndEndDateIsNull(User user);
+
+    /**
+     * Finds all streams belonging to the given user.
+     *
+     * @param user the owning user
+     * @return the user's streams
+     */
     List<Stream> findByUser(User user);
+
+    /**
+     * Finds active streams whose last heartbeat predates the given cutoff, i.e. stale streams.
+     *
+     * @param cutoff the last-seen cutoff; streams last seen before this are returned
+     * @return the stale active streams
+     */
     List<Stream> findByEndDateIsNullAndLastSeenBefore(Instant cutoff);
 }

src/main/java/com/ddf/vodsystem/repositories/TokenFamilyRepository.java

@@ -0,0 +1,30 @@
+package com.ddf.vodsystem.repositories;
+
+import com.ddf.vodsystem.entities.TokenFamily;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Modifying;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.stereotype.Repository;
+
+import java.time.Instant;
+
+@Repository
+public interface TokenFamilyRepository extends JpaRepository<TokenFamily, Long> {
+    /**
+     * Deletes families that can no longer be refreshed: revoked, expired, or with every refresh
+     * token expired. Their refresh tokens are removed by the {@code ON DELETE CASCADE} foreign key.
+     *
+     * @return the number of families deleted
+     */
+    @Modifying
+    @Query("""
+            DELETE FROM TokenFamily f
+            WHERE f.revokedAt IS NOT NULL
+               OR f.expiresAt <= ?1
+               OR NOT EXISTS (
+                   SELECT 1 FROM RefreshToken r
+                   WHERE r.tokenFamily = f AND r.expiresAt > ?1
+               )
+            """)
+    int deleteDead(Instant now);
+}

src/main/java/com/ddf/vodsystem/repositories/UserRepository.java

@@ -9,9 +9,21 @@ import java.util.Optional;
 
 @Repository
 public interface UserRepository extends JpaRepository<User, Long> {
+    /**
+     * Finds a user by their Google account ID.
+     *
+     * @param googleId the Google subject identifier
+     * @return the matching user, or empty if none
+     */
     @Query("SELECT u FROM User u WHERE u.googleId = ?1")
     Optional<User> findByGoogleId(String googleId);
 
+    /**
+     * Finds a user by their stream key.
+     *
+     * @param streamKey the stream key to match
+     * @return the matching user, or empty if none
+     */
     @Query("SELECT u FROM User u WHERE u.streamKey = ?1")
     Optional<User> findByStreamKey(String streamKey);
 }

src/main/java/com/ddf/vodsystem/repositories/VodRepository.java

@@ -11,6 +11,12 @@ import java.util.List;
 @Repository
 public interface VodRepository extends JpaRepository<Vod, Long>
 {
+    /**
+     * Finds all VoDs owned by the given user.
+     *
+     * @param user the owning user
+     * @return the user's VoDs
+     */
     @Query("SELECT v FROM Vod v WHERE v.user = ?1")
     List<Vod> findByUser(User user);
 }

src/main/java/com/ddf/vodsystem/security/GoogleAuthConfig.java

@@ -0,0 +1,28 @@
+package com.ddf.vodsystem.security;
+
+import com.google.api.client.googleapis.auth.oauth2.GoogleIdTokenVerifier;
+import com.google.api.client.http.javanet.NetHttpTransport;
+import com.google.api.client.json.gson.GsonFactory;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+import java.util.Collections;
+
+@Configuration
+public class GoogleAuthConfig {
+
+    /**
+     * Provides the verifier used to validate Google ID tokens issued for this application's client ID.
+     *
+     * @param googleClientId the OAuth client ID that tokens must be issued for
+     * @return the configured {@link GoogleIdTokenVerifier}
+     */
+    @Bean
+    public GoogleIdTokenVerifier googleIdTokenVerifier(
+            @Value("${spring.security.oauth2.client.registration.google.client-id}") String googleClientId) {
+        return new GoogleIdTokenVerifier.Builder(new NetHttpTransport(), new GsonFactory())
+                .setAudience(Collections.singletonList(googleClientId))
+                .build();
+    }
+}