From c1f6b139e79fe6ee0d053b8437d27c83292a1953 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 21 Dec 2025 01:06:53 +0000
Subject: [PATCH] feat: Add JWT authentication to video server

Co-authored-by: mathieumoran1 <mathieumoran1@gmail.com>
---
 README.md                                |  14 +++
 __pycache__/video_server.cpython-312.pyc | Bin 17747 -> 21972 bytes
 public/js/app_player.js                  |  37 ++++++--
 requirements.txt                         |   2 +
 video_server.py                          | 110 +++++++++++++++++++++--
 5 files changed, 148 insertions(+), 15 deletions(-)

diff --git a/README.md b/README.md
index e90f967..c9328ab 100644
--- a/README.md
+++ b/README.md
@@ -22,6 +22,20 @@ This repo also includes a small Python server that serves local video files with
 - Served as: `http://localhost:8001/media/<filename>`
 - List endpoint: `http://localhost:8001/api/media`
 
+### Authentication (required)
+By default, the Python server requires a valid Oscar-Pool JWT (same `JWT_SECRET` as your Node app).
+
+- The server loads `./.env` automatically (so it can reuse `JWT_SECRET`)
+- The web player sends auth automatically:
+  - direct `/media/*` and `/hls/*` requests use `?token=<jwt>` (needed for the `<video>` tag)
+  - `/api/hls` uses `Authorization: Bearer <jwt>`
+
+To disable auth (not recommended):
+
+```bash
+export VIDEO_AUTH_REQUIRED=0
+```
+
 ### HLS (for better browser compatibility, especially MKV)
 The Python server can also **generate and serve HLS** (`.m3u8` + `.ts`) using `ffmpeg`, and the web player will automatically try this when a `/media/*.mkv` file is used (or when direct playback fails).
 
diff --git a/__pycache__/video_server.cpython-312.pyc b/__pycache__/video_server.cpython-312.pyc
index d24902ed056edb6a80db581f4e7ab6f34e00788f..bf420e154bcdb206ccb605195fb96c0c7f7f7ab2 100644
GIT binary patch
delta 8229
zcma($32+<Nb-Tdg1_*!v2=EfYo1jEe5^w6Dc<HhwSt4ag@PUBbB?$@#^>=BB6ll<~
z8<Vv%qOxtx87C7qbrQK!W|&diXvUsIa_otcGzlrNLwYMulw&$^rjx>wJ57~l+V?&P
zl5*T>cZm1@fB(IIz4zbonf!Bh`5K$`V~fSez^6NSAoSbzD_I`ZE$x-6gNca2Z-^NE
z#)!#pVi}&{)nRkQ;<wN`7tV@U{nm)hZ;ROd_DHrro8sB9!|woEP1qT6`CXA5e@?{h
zcSk&aPbAl$OKG&>yhy%3pVoEZf=HpiFtWwJ1=@Olk%|#4g7+HB=x|NUNSAy?msdT~
zO<Ruvf2mN)8zxK)<1a%l_^~60Wj5PUX@q(O^qR02#-iUf)mpjMP7mGSuQcH1%;Bnt
z&+lUyVD$m3Wiu-*EsM7ftNdG`S2c1PC$ZZy1N&<>rncDm?94<X&*9q5yyFGdU$;S$
zaIQ0M=UqYtpCecXIo|yW=ikA51P`?BLPaht7O=U1-MNOXhjt#c8~A*|0#p^yE`W9;
zUkIaY5t=Axw$LOr4XTizj-lm?fTo#$nsRxCrUYLMq$QNxDzxw{&km|7sgW;zMdNSX
zG<+Gbwry&cLwgs0im!kLRN@H0tL3YJYd6JVo8x^zwTG`>U*uM3@8!3_B5UCH1nyVM
z*8;MguLHz(_~CA}{0_kF<99xWs|Q>MoSsW4y56vUa-AFJX=&t}9zXIbf0xk3H=V6w
z7-Hs|hFE{MU`rpV(8D+HhNFq@6}m>gh;l4!$qd@fTxJGTL-2d9lwl^BIFpv3USuyh
zGY#3VHg$Ciog<gi+O!!8`LL>kLU(3BzIBM<+rGx)60YyMrb*MX3~<Xhb@A?X${eA7
zP{r?gg}b&kp#N}&s(kM{Ra!d=;fUKeQ9hBO+_Nu33F~n49en5YuFS~{vQ&$@=~)-T
zS@*o6S)c1k7~u_EQR9C80Do{ub^TC=Z(VHZxpN2g{NYV=AI)&~Jn<)-Pr_UoE-im#
z6W1}}DgG!G&j?&SHhkQFd_$h@WBgN@+5IN~-?Y(}f1E#&>C5cZ-@DOo>HX~M*9RoW
zNB$PKnCKHu2)#nz^^@1Qj6lZOaki8Zs>>L{vCJ7}R(0u1=a~!YGt7B*K*fSaOfu&g
z-|3H#;i!*O45L9J3W0NCSTT%|un--H@q(g<syG@BNs19_V^Lc7u?qK8P#Q+A142}g
zf2;Yf3y`L8EXW7=m?T7BnBZyw%2%}|4#(4nx_gcVI!^W-44mjWe)7<X9=WQ$#H<((
zpXv+r_H>=->AUem?e|oyMV>L7VZHLN3;|6mtgBK!VEhlSjtJ+*1W_7TvvPEcxKTCy
z9(J<wGp1U3q26R+<1A6d*<Mt0PTu9LkZW{C;{{d(!@Q2#w%w?oRK-<fe_SQss&>lT
z)q44Uwada~PM=gl&$o3>C$HhP8PV`sv?n7Lw0{X05{{5(dYN&?r#q@>q}W*@s#t<!
z(r}D~CW2BZ2F;Gm%?Vw<5F`TeK4QHe;ZA%y#SHr*;{iDNU_?~ZLxQB}hJ_$65Ruda
ziDDF`Ad$rLA!%6Aq~)Lyr349$`qZQiDcExghtrC97+$ZJv>-MsAY710a6k&sm61b$
z+y_7LRRB}WeZ6%>U$CSvSkZfz^xk=QQtzAU_&}#$wc4ijDJ^4mTyCFfUomZ2GHsbl
zBu#a9O{W%`ztjHh_LchmONsjZw-U+vQ&Zg^=uETR>&7ca*}P(_T(VVOH7wh9u38<J
zCuSz*O6Sfct;O@jOV+X#YxR<~I%(Z@*V?eaE$SOqP1c977UnUbqB&U;D#N_aNJv0G
zQ5Ay2maq@Lrx_4uMp}~~b<rZNSt17R9<REt&WP>vtfWmd!R9wpalB?Tm4T5A@{67V
zZ+sI2uLUEgyS6rKFH_1$dU@VcunjJiV^a0locfK?;;PT9cxF=dqUt;g3?0P<iT^)C
z=8pOdM?+UYO(xu^MM6{x4N$G};$;XCfhQHPua7=KlC8Z0c>y#l5)ubu(ZSHr81%P!
zH*QzL8xp<InB)~f!!!qbcQ!V`bu|XVL!hnFa73K&9E!dW42O7cjCh3$qd0+=s*X<&
zdc5i8c2iv<7MPqA0Z`N<=OsnU3)Eb=deXeTp`mC{f@Sm&5+h2&zBYUx-V=&j(_ey~
zi!=jxT!AftwS5Lqxk(=o96_Qt08B9-nmnsk`?TTL=DfM)q`7pe=L3`NURM59^<u-3
z<*cKN`lBD3Tx*Ena#o^$QQx29G@3K)J!>}A&GI+%Zn|$8maUzO`p)0qGi9xq%9c!J
z4;U7S(nB3x&N{Yu^7Nwq^dBgJcgf`a-w0A_WPBu+!UDfj(BWimI~|={)VC|MIvUmX
z+l@KUc-NHGnX7&`SJSyg-fjAO)-69U?bPlB4pJ{yn@iY}@)2`E5xv2Vz!2CxF#rMu
za|-u(d{iKx1JZyzZ9c3bhi@#KZE7tl0of=2*4kP|_G29dqiBXmY;06fhoX|Aj)bB<
zJqcoGzkJBH+e61UqtyX>PlC}Qft-Wh;TvDERj{VRNEkyfdgG_|9W1-=OOC>V5kM$v
z@CrU1Ik`cBH6ph<%5&(T#z06CNMJA&7DycWW^YK2Ikxc>lAT8IEC3NrH(07QQ)Lef
zhd;H=DIoZ=+~GRO9=`FqtC7{#0fN-XcXN)y5f!`h*%o<^+pWQP<s0%D_c@^ZvHM3V
z_GS66@~YVi`F38eb_{u*k?-f#veU9PzrdM388IvfqdtzzV)qrfJwGp(F5MCc4$zAg
z2*(D_lCMJdw{DR9OKcfZifFLc7L2MH7J_hgl=4mJxpkwYa9Ov5JPGv)=ip#uR2ZW7
zEffU<9uBYF)}w?T?#n<$wgPxdt}L(LkGmi)0E$+)5E3O((L~PjAwt(caCk*44v$Hp
zu%aaqi3kGu3yK7H0WLNz_Gjez@+$D3KP)fGBFAw=oWN%xUzh*0yqKMp^D9~k@tTnz
z01)vkPz38AX^}@O@-<6<zjI@@;vF@6=f;t0pQ_vkn2D^6bvXEBuQ!x7Jp?tKlp!dW
z-`Lh^N?`Rx1l96yw$+@$Ip`|LHmu<eNi6~@&Fxs*fgr8_Q1fZX9Yov(pl~D>lSm`B
zsdYg6PFD*njn))uSD;<M-ndfZVNWRPF%qJdWMC~Jf=-6f!w+ru!+!+;-UMYxzfI0V
zmGLPIvtiD`{ZG|9`+4@dD&t4iy^Wez$JH;eL=$J@P)GA68P>*S;;IpvcV^n@60qjS
zG1vlZmK@A>xa^s}xH>ZnEWlpmOblu=h+f9W9qj{~Z9fa@8|V)Qqh|wPu)##oefx|A
z4@lwo(11j6(~5@176iQ?=+D5g5D^q@RFFVv(>EBep`sro!J!Bk7`PIvfS{u(8n6wL
zm>>rL^C#C8gOPMt5lBz*3!rL*!xf)_$`o_Y?40d=?Z{NmJ-zwTnc1<|FJ8I0z%N^N
zCH1?fI#zXAv%w{ud)1XU%}!U&81I=}Koh?bpFjD{XaD-yg~so+eY@?Q@jLdn_r~v>
z{MqwAe10+K*`(>YMeaFzeH7iAN&IYCL(UDd9s>6(&lY&hnFH)*o*R<wO(ptCF3u5q
zoRe=CIx#%tNcLJBIFf7jUTTSRlbTHe1u<t-U{aeVRK?X09lDA%aV@XT1P7UUSmsiQ
zV|We%#S2>t5+FCt#LGrh+zy@>z3tSe?y0S<1@Gz=f&;_elP3;&!=b3)tr7()32~eE
ztT2vvs0q?Qt<M{ZdV}84aBw^f_Mw&zcPttnhcU)Lu;|*OH3P8-%5fWQ2$4}~+#627
zxMG^V?-5%{_JM$i003f7BMm2UW-)C-x&g0fgQKHDlqV=tdU+LYBnA#dM}CPIRCmP?
z8<PT*Q31blo>mnO5mbc~0};+cSOLZ<A>xw<y|x*1?*Z$Hy+R;TKh_f1P$q)6bPuZ0
z7ojr6q>N0#mZ?Ll&ioZ;#gemPUP?N*Jzxx)z0(k;x-Y*t^J3CkG|hcrb<9eyC$1#s
z#bx)_RkLfwT(D#=m^-~}u6T0Q?7W|qJ+1z=vwVKwYGcy5W7@E)x3B0uOM1_oXC>FS
zl<T`%dUgC}aWZ%JKk4_R956x3$(XY)H_tTBwkA!5i(Da9Jo&BK{cK83)y}x78K-VT
z3*mYg0+c_(ng`_Bx*Qw!O&IHfqoKNpz=wkJxx$=^zoT0DSr&+8q;;D`buv}wu(A@K
z8~w0XR;u&mn(ZDnq%D}3K+0lqf2L6xv0{FbE!i^cV5!(kjlfo{cgp|ha>x(2J22zf
zGO3QUBkl~@Mj2OwVaml(<eWU0ngeCuyThF*%uw*!I2&R!>JIv?JK9IS3BBas08Hr8
zo38Vz6)qZ#2&5mdXrIH12813FeO4OGks4(A9(HQQ7?A{C(U75Vtp8I!fixgp-2lQ@
z5c~^*KSS^Z1la(<bYUt)SU6;b9VM5b@hPii#ETQ4@*o-@8%9050d!N$uQ~f{<uaFd
zPp;hg7JFD;+WEwBSkf375FWEIXh^9y`7TsG+nazak%E3;H((C@Fj0{0tq!YtL#mLC
z>fwwXx-}Xq)rI<8@ZdkH{|B~AeyJgky(53Qp{!k(J}*p%3A$&3R#wsXV*rB3swJWX
z`C$4awCR(;VaeB#_>TOjp{$mws%ex6VAlnVw}=%eCgCSWfNF~Q#K~x~)5l=<$=!_s
zIEXhJ%e4=1jEC~i8uPcJV|y8X4~Ib`pJ3R>&p?&gEuMk=-;Ft*P40BvuYvKUuGPr1
z^r@r?wCny_3jPI;vt&{e=Om09=oepif4quUe_1`Lm8|ktnmlNLr*fQfSuRc9t9dOQ
zOpq|dNOP_)XDw6LP3q$65jQ@T)aiM{b>q5G*T;3lEMab+=7jd9KK)2O@|@IXwl`^z
ztn0J}9-PU>dZqPC5;tV%Gi7=Q*G(CJ0dEwKZ9VaSZXJ^?`bou^8U!HbxCY*JK{lCz
zVM*FJcReff64c9lOMRa8S&tG-w;$=Fu^Lf|5y7W^WbR7m7Bzk2qq4QxoA?OBueVgB
z5(?6VfQEDEFbIl19nHN1HOSt6iHHqKPzp#y0KBE%z$!+1<!JKav!@jq12-}SK+#47
zcrM}BZ*wB8+XRi*MpQ`iP4p@7v?SrH2Kosyjo<<T2ZA^Nh=JC_$MiKgiCxblKr58q
z5%pjk4g|qcPzs8u*J%%>#R9_1#b#Fm!-&7c`vK4A%x{?AZ?Y4nlKG~qZAnwpRQEk|
z;T%u%&-=QpS6_VT#krijx*~l37@rw`?c$2HWXW1G&D}33zPF`#zU+<AYGLKaI?iF7
z)_r1RY@Ye91^2SGby436Z!UWCs~2CoxT5nc={$*~E^lt=uCDx^ZOh#Gq^<I<t>)^^
zX$=kyj&E-0YG@kVUkkWDNPHbzuXZn#Cmk)*-AHh8<|1Up*3xP2p4GkT^sIXFSIev4
z8F;Vs7XN+U+tI~9XvsP9iH@@wQw(P?rp%1lcDZ$?^|f8;7oVx_?A4;Ochon#-!?4v
zJ-?I{m^yGzeyU{~*S)=ar##iNt7ZAKjKI3dd(04Sywsrkx?Na+!8JFjh6fjWt6M(1
zy;45b>SC?3&|1TK<ST8t?g9y=N<ZEhV&aCcv%E>lm%rayYFfW!Qjz>|YbBd6=eG3#
z47BZ_-1)3S{#IM=V{}VxTUnd@$F`#4^>O365oczOjWVv2ue3Vl<GY$!L7v&woS+I$
zRh`}k_>U0kei;<Rfxv|TZx+eHniGK=!TNn59%xQz`^O~+)E==lG-dLs(xj!(_t8&*
z-Dlfm<~Q71;&V7Oow^fi=MbQQOkWbZx+-ku;hg9hHr)pcDMBpujr1z?V?VtQL8vKO
z`U1ey{EE(@WML2)iv}`pkg-$9F-nOc_aB01Mw~o-UDjaw!O<k*6V#fAt%hmehM)K~
z0H3-%rSpf9@LbEbxNa2hNw5u`o+|cszOB28xxKY>4>aDZGW3+I-`nBq@v7g?W1;?j
zz6S8`do@@uSNBxO%X?4ChufPIPm?paKum|pGJ;zOzK=jgFatm_gO?14`fKTKX>LR~
z?9?Ej>5*;}9<zaj=#X9uPc5P75Yb~lrgj8P1Ti6a3V@;;3_?~9Z)7e^>(b)L!Ww!8
zVv~Q@UYNk7PO+~M))GM+jYUO>v@u>ui|7wXp%2i<l0blF##AB@!z=pEj^3U?_n{N%
zFzH=nqQXTF2aj#^g`MOe`fm_4AR6+b$SA(N3^ELu(*4+R3;}u$LgR-+So>!LeF#2>
zAcTPGRS8IoT2gAB$z|;LDuOo=EFqxA`xjWFR`?Or6x%?Ihyi#=9D>)50KQ117!TmB
zfj}?{kB;=&QiLt`0JZ$PeeMdX$`~=zSd7LZiUAHZ0Iyc?euTD{RI~Dqj-1x*Sl@wQ
zCxZ8Y39?`|MjvFhQ{8){-yMnZV_{)0*$*`E$A~f~PjwVHe$I3ynXV5R&(E3WB-8vW
z#`tsj8y(O0YgogFT*)su>#TmRX~|Z+%#}d8VRz4I7p+B8=KChs^v=s|Gi{4G+mfc5
zDgAw0?yTx{!xh6~UfqHtX=_}u?OL+!O4{};_6#rDhNmp6mYnGmm(R?cnT;ncWm87E
zsMA$rWNmW?QVbMV^$U)-EDy1o%CoX(*tzBugXO&Rkd~=3xuNsl+fq9<?DOngeTu<y
zUQCx)#fP+=vf0=z^8+aciiJ{I+$?>Ft&c0@tzGXY>}>U%F2z7G|KtNK9;z9YJEekJ
zs)|u*UUk3Zp3Y0M&X2W>!!xH|^gX?ted=S4lhv+ToGCSw_s!N6w!tB3vmfZ7hGV!=
zD#X>|7=<qtE?T$WY`j%*vu>&|$sSIrN?7eYtfwE!1z0;2x7@V2bNT_caEK>ZN|!ne
z|Bqf9q-vq@X2k*>q%)<egFzfA28yfaX>qgV0k)923z(sr;^iN7i|xNp4P`NUJ3Pg*
y28GkZ(<^KEuLlzb#&v=fw}AZLZLlA)GC$biI+D-b(PabtiB)sNqyCAT1^7R9EY^hp

delta 4708
zcmZ`6TWnOv_0HYhyKAr4>j&%gYwfl1g9VIjjKMbMVPoSLp&=AC*{WF<&)8mjAI{us
z5?oW87O5enZPKX}nvjSDRU*PkX{;h5RfH&^jnXJ30x9Wjo+?#BKdJ>%wT-Hz=geh|
zL(`G>+%t0?Gv_g9j<1|1mmeXyfADy+6&QnkeX%FjK9*aoo^m|4qJM-aRH3$bRw6r`
zop6WUiJWjw!V~t$b$dKF;SGBedEvZ7emFl-5H3g*h6^Rl5nq<@g?$p&;zbF6*q<m4
z7sK2cE>RWcVx^}E?x-l^8^oc?(v{<F)^sTh2Uvi*rrnAXu0SF9k@3yq`oOX}K!ZTc
zMq)<OY1I<W%q`7%;VSB;Ib&+L8idsG?c!}u;jAaa6t1DUEJ(e~HDafEhwb57n$KJ?
z55l|v=5@3X=*w6=tmQBdt7r8iY6<LwzY&f4fM*3Alu|{&<%eIf<j!UxN+=nzNzQCq
za@Y}GX=$I8>Pta%)spSXV7{6T(Q-II09AmnMk_$9L9XH4PAh?H4Gk_HvI^#nv>Fb%
z{FWgat%0>BFxSgU=4%&CZMGZ;=N4Byd7e62pK;kZ!yv2(x3CskKe0klcn+-}CE<0<
z&4PG*)=F1&!Z*2@wTvgwg(M`tu$2)eu6I`26idO*$JC>>c4b&SsDNnmcnT!$7|aKU
zXk+U#hoUP-6}swKg4@lnKJBpBi2~9(Zd28;$mwMrBPv~U*naw!&hW-XuEr%?e&A|a
z!qu7K+SHukf-~gPwX|h^UB&|=gtoE*x?Z}_4{qOZ*s-|JCeUyYPt)2)+iAzBI=?X^
zx9E73_Oike7wufK_m+%g@23Be+zfkVq%^u^iPTosMYqZ@j8lb@cz3wl3LT!o-$lDK
zyN9>Idi`x$**4mfp=E3h_uQs?dg=BI-3nO_?b}bny};5veiYS*`q?(t!+PfjPTMoV
zI6w}NVU@_hKB$CtTtmW65p=#KY_95sQP+8uWQjWWeWXy#xg(C%KrR(m-T!phC!@xg
zc(klYTq-z53Ph}MtyT+EUMHR@tgdJP)U>gO4AU`e9GGM#iRid%5C&f*J}xYAU|nbt
zUltCkH<g8<WqCFY^YI!HQGa`u>Cg=xo8(#I8NXla00Q4A&igxyR{?6~L?)wLXAvGv
zjxxRjmO2*-itC8G9T^7^3@vOcX(k<;5XbTna+vniBukohov{hi&RLZ5ULcsZI7^0{
z98Y{p6tTO+3#GM1a<}YA%wRk+5{onbEuhhbYo*6XYa_BXAy@}siFGhD^CM$%Ju;k1
z8Z2o<&;$J2us$iymhZ9SDbaNcwSjV?Rl|%2MPJ3vcFSv=#Z6T=OxpxI@U?1VG%}Ln
zkp!c$C?5y$Y4KLY1EhUnYvmg%xnH=eSIWCR3M3epwuEv`yAew;Q%&joZdl?iVo&uN
zIt(ZTD4x=p>D><Y^*$8S4ZWB16z5rzsK*(b4B7bvO2u)>sT)ylFlwqJ^p4|sBGKUo
zred5$;;G>YJ`L=L7CxyyN@`GC$A<x;k4iidu#!a~hLUp@)_%V5c+C~3E%q4^$<-x3
zOop9Y2K0VFc?E!wIKH}NJ6g>10hk(-=QSOP2^!;aKaQ$QO&^;wVsTUB34=4nv0j<l
zD1&J1=iMmZB76-iAh$O+ROXu+Wy2}TtUWw@PE0gZkqPnRhPF*Bk@*<_x(5KJ@8Ym5
z@kLltp8}IH;J3pv58THW)HT1gk&_EAH;2^Pa#)$p9Z2qv#$z<tzhieWMmbu^ixBt`
z6bsL~Zg&{b`w#>~cwNJN7zuecUWpi*&Z`i})LD*L4Fc=_0Ty!bleq9a07&&z%HUA?
z6^_Q}Sc#<#a1TFP7tmgWd0JVpwH6c6v2i;&D-LZu;+Kw>q0+`!G;WOXSAnlwRCN|L
zA#FOlF*+G*lsSlLv^boA+2D8cX$be@iUFuN<0=!!Itx6Cft$-=C?Z@N5LY^j9b|@#
zXUW%wjAx53PoX&8UnsU_xk5&6hJ8Qb<Y+4}qVabO*g`xKTn-Z1WJY`$@@X?FaQgA(
z6W9BFo9#2|lgd*nbsV>4Y9~>S9<eJ%Sw<DrW|SDoP<JaK=gx2P?*o<pMg%weW;X(A
z+NOBibU-mk=%HL5MCvbaUDH$YLOA$nJhktRSnzt}laY!@=IA7pA<FmSaufj?8M5);
z!^b3(9B-|T9)uuSDV7~Cg==~1zP|~SDsZiS8jv~Vs`y~@bEI87yk)4z$=L%_3@Qg4
zXo?TBVHH?1Ljy#{<rE+g7f@l1nMJb?s)kKG&|jEiyB(()LCSsVX(D#4EfX&Uv&8qd
zdWl>7Wb4^-%-Cs1BjkPKw7W5ur0k(JiI%B0u;rxK+f~z{@zub>@hb2Z0H$jn-gxw)
z#;y7;ZP)l)$nr-7a|lj~SG#KJWcIlyIfG&^uNQv@h^=Tl17uG5ELSO5DSX`#uz#w%
zRy&8XFNqV~W%VvVe*nLm{{b+hkgr;-fX&i3Vz#Y%a2y||JH|n~fr%`~%wpCYbj&ym
zyp7hnJ(Dlc4XVd&2Q~5QK+!O@$p_wJV8M`s+Gn(RN9K9ntr*@6#aK+|85^XaojRwp
zq3^{w!9ckg$Gj`^Uhh_(w>?NgSvy5rZ~H8N30SVZ4&XVJm%_(%!cB!LrppJ9<J0$?
zO;Y$rNY0j*RX#?cERNTHNfP4gWCck}Fk>u5c@D1NN#&ylFXTzYv82dw%~~%eUJSk-
z!AAgebQ<I>4l8%PI^+AT;uzI+X7H=PF@P~V49KU-zaWL()hE`U>bUG)KiBiF+xye@
zBke!h_>Q~cZFj|7&wDw6WAt*)^10r$rj%5?R|?Z7L+_R>&${lkd$qZ~bdET3SG9Py
zug2ch(bXy5=-cQ#55a|?i@lwG?VviNj@z&n6n|}?ZH5za-cMYz^4#z&6KDFD5s$do
z-$07sUy>4k`Rypt?3gl>^-DtCMu}KHu-v^^K#YLcHBe7V#DRfcfG-a;OX)I_FFb=K
zU*T&WTt#xlcLpo{x1;YIF93Jk8sgw!rFe00J=r3z4Q`mVVtcEXkZ$HCaKbhF8+`bm
z5xkE86M}z$;5`H%BEU44slY!5Y+BoQz+igtbJ8FmoRDg<V&8WSFJZ`Q-Pyf>Th*xz
zA5<%WZ18}}ZcFwCR)XN+IC_Eq1p!|3B}wDqf5ioPy&Dj_oh}_PH8t7CQTZ@gd*lwM
z5{XnYl1b%3r4Pi0Br`N>qsG|(dx+gurdeIl4G`FiS@r|~E6Wy=JDw!#JiP((N?u-1
zKzSwDy$L3-1+sceZLigZdVRKwUIO^VJO`{_^f?eOwe<$Xrk#64yQ@n4Z0CmAKHiLm
zU`N4!h2RMUPa#Mmpa4uKcE|D9K8`op)S&;1B}X~d8ICU?$70O!u9(h|DD+d4F^(0>
z@+(vTg}V{p6*T>~IMyU$l*UEs8}3=GEM|UYoilwhmDHIoUlPmvuONpjBAeDoM0N|(
z+0c!euI{egy^)@Qd#oqyIPN6lhUqAuE7J*4n8bc}D=x_@j_o?{L9k;j!cP%kJ1iSp
z*@oV3z^s}tOUwmi=@xtME-F6@sOgPFqRC{+h#E0CbR+_u{$xC6h)3`C&;A`5>@+rP
z$ZmtbiLzMq%`9+Hgr}yU5x<Iy7+<t68BH+I;hfqZ8&2^g{{o3$B7mB&@TUO_5tF23
z@7W|v(&w(uM2b$u*=D{Bc;HXbFF>5qHWA!aoc+F1{Gqbpva;b5F|_M`aeh~sFRc|3
z-w8dfz~_{46F=#-;;wuCp<Z7rW_Dkk%_A!x-El*K&rO@6`qL_4={iMq{Lp{M|8VJL
zvg}Vyt!IWW^%+;1rmh2@cFdo~&#C3|lU9`Pl0FqRXsE%58Z=8o;85U_x9ME#g}QT%
zbAiibFs&96?F0zI=S&NJ?$s`UI+(tG?+yH*iXkHT(yQ?lQpbujt>@~_NFCj2bq(k!
yOe^p?^`QKmYrBCnl-&lhfTs6}>OFeNzi(`_E53V(j@fvz#W&=&|1PTl;C}&|m{N=Y

diff --git a/public/js/app_player.js b/public/js/app_player.js
index cd89673..2d35165 100644
--- a/public/js/app_player.js
+++ b/public/js/app_player.js
@@ -90,6 +90,25 @@ function looksLikeVideoFile(url) {
   return /\.(mp4|mkv|webm|ogg|ogv|mov|m4v)(\?|#|$)/.test(s);
 }
 
+function getAuthToken() {
+  return localStorage.getItem('auth_token');
+}
+
+function withAuthTokenQuery(url) {
+  const token = getAuthToken();
+  if (!token) return url;
+  try {
+    const u = new URL(url, window.location.origin);
+    const p = u.pathname || '';
+    // Only attach tokens to our python video endpoints.
+    if (!(p.startsWith('/media/') || p.startsWith('/hls/'))) return url;
+    if (!u.searchParams.has('token')) u.searchParams.set('token', token);
+    return u.toString();
+  } catch (_) {
+    return url;
+  }
+}
+
 function isMkv(url) {
   try {
     const u = new URL(url, window.location.origin);
@@ -109,12 +128,17 @@ async function tryGetGeneratedHlsPlaylist(rawUrl) {
 
     const api = new URL('/api/hls', u.origin);
     api.searchParams.set('source', rel);
-    const res = await fetch(api.toString(), { method: 'GET' });
+    const token = getAuthToken();
+    const res = await fetch(api.toString(), {
+      method: 'GET',
+      headers: token ? { 'Authorization': `Bearer ${token}` } : undefined,
+    });
     if (!res.ok) return null;
     const data = await res.json().catch(() => null);
     const playlist = data?.playlist_abs_url || data?.playlist_url;
     if (!playlist) return null;
-    return playlist.startsWith('http') ? playlist : new URL(playlist, u.origin).toString();
+    const abs = playlist.startsWith('http') ? playlist : new URL(playlist, u.origin).toString();
+    return withAuthTokenQuery(abs);
   } catch (_) {
     return null;
   }
@@ -221,7 +245,7 @@ async function playVodLink(vodLink) {
   }
 
   // "Open original" button
-  setOpenOriginal(raw);
+  setOpenOriginal(withAuthTokenQuery(raw));
 
   // Prefer known embed providers
   const yt = toYoutubeEmbed(raw);
@@ -252,7 +276,7 @@ async function playVodLink(vodLink) {
     setSourceLabel('Direct video file');
     const videoEl = showVideoPlayer();
     if (!videoEl) return;
-    videoEl.src = raw;
+    videoEl.src = withAuthTokenQuery(raw);
     videoEl.addEventListener('error', () => {
       // If the browser can't play it (or CORS blocks), try HLS from the python server, then fall back to iframe.
       (async () => {
@@ -275,10 +299,11 @@ async function playVodLink(vodLink) {
     setSourceLabel('HLS stream (.m3u8)');
     const videoEl = showVideoPlayer();
     if (!videoEl) return;
+    const hlsUrl = withAuthTokenQuery(raw);
 
     // Native HLS (Safari) first
     if (videoEl.canPlayType('application/vnd.apple.mpegurl')) {
-      videoEl.src = raw;
+      videoEl.src = hlsUrl;
       try { videoEl.load(); } catch (_) {}
       return;
     }
@@ -288,7 +313,7 @@ async function playVodLink(vodLink) {
       const hls = new window.Hls({
         enableWorker: true,
       });
-      hls.loadSource(raw);
+      hls.loadSource(hlsUrl);
       hls.attachMedia(videoEl);
       hls.on(window.Hls.Events.ERROR, function (_evt, data) {
         if (data?.fatal) {
diff --git a/requirements.txt b/requirements.txt
index 3fb50f0..e1b0cd6 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,2 +1,4 @@
 fastapi==0.115.6
 uvicorn[standard]==0.34.0
+PyJWT==2.10.1
+python-dotenv==1.2.1
diff --git a/video_server.py b/video_server.py
index 99bcaf0..db990af 100644
--- a/video_server.py
+++ b/video_server.py
@@ -5,9 +5,11 @@ import shutil
 import subprocess
 import time
 import hashlib
+from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
 from pathlib import Path
 from typing import Generator, Iterable, Optional, Tuple
 
+import jwt
 from fastapi import FastAPI, HTTPException, Query, Request, Response
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse, StreamingResponse
@@ -17,11 +19,22 @@ BASE_DIR = Path(__file__).resolve().parent
 MEDIA_DIR = BASE_DIR / "media"
 HLS_CACHE_DIR = Path(os.getenv("HLS_CACHE_DIR", str(BASE_DIR / ".hls_cache"))).resolve()
 
+# Load repo .env (shared with the Node app) if present.
+try:
+    from dotenv import load_dotenv  # type: ignore
+
+    load_dotenv(BASE_DIR / ".env")
+except Exception:
+    pass
+
 # Allow common video types (what browsers can play is separate from what we serve).
 ALLOWED_EXTS = {".mp4", ".mkv"}
 
 RANGE_RE = re.compile(r"^bytes=(\d*)-(\d*)$")
 
+AUTH_REQUIRED = os.getenv("VIDEO_AUTH_REQUIRED", "1").strip() not in {"0", "false", "False", "no", "NO"}
+JWT_SECRET = os.getenv("JWT_SECRET")
+
 
 def _safe_resolve_media_path(rel_path: str) -> Path:
     """
@@ -48,6 +61,37 @@ def _safe_resolve_media_path(rel_path: str) -> Path:
     return candidate
 
 
+def _extract_token(request: Request) -> Optional[str]:
+    # Query-param token (works for <video> and Safari HLS)
+    q = request.query_params.get("token")
+    if q:
+        return q
+
+    # Authorization: Bearer <token> (works for fetch/hls.js)
+    auth = request.headers.get("authorization") or request.headers.get("Authorization")
+    if auth and auth.lower().startswith("bearer "):
+        return auth.split(" ", 1)[1].strip() or None
+    return None
+
+
+def _require_auth(request: Request) -> dict:
+    if not AUTH_REQUIRED:
+        return {}
+
+    token = _extract_token(request)
+    if not token:
+        raise HTTPException(status_code=401, detail="Authentication required")
+    if not JWT_SECRET:
+        raise HTTPException(status_code=500, detail="Server misconfigured: JWT_SECRET is not set")
+
+    try:
+        return jwt.decode(token, JWT_SECRET, algorithms=["HS256"])
+    except jwt.ExpiredSignatureError as exc:
+        raise HTTPException(status_code=401, detail="Invalid or expired token") from exc
+    except jwt.InvalidTokenError as exc:
+        raise HTTPException(status_code=401, detail="Invalid or expired token") from exc
+
+
 def _guess_content_type(path: Path) -> str:
     ext = path.suffix.lower()
     if ext == ".mkv":
@@ -262,6 +306,33 @@ def _safe_resolve_hls_asset(hls_id: str, asset_path: str) -> Path:
     return candidate
 
 
+def _with_token_query(uri: str, token: str) -> str:
+    parts = urlsplit(uri)
+    q = dict(parse_qsl(parts.query, keep_blank_values=True))
+    if "token" not in q:
+        q["token"] = token
+    return urlunsplit((parts.scheme, parts.netloc, parts.path, urlencode(q), parts.fragment))
+
+
+def _rewrite_m3u8_with_token(content: str, token: str) -> str:
+    """
+    Adds ?token=... to each URI line (segments, key URIs, etc.) in a playlist.
+    Only touches non-comment, non-empty lines.
+    """
+    out_lines: list[str] = []
+    for raw_line in content.splitlines(True):
+        line = raw_line.strip()
+        if not line or line.startswith("#"):
+            out_lines.append(raw_line)
+            continue
+        # Preserve original newline by rewriting only the URI portion.
+        uri = line
+        # If the line already includes leading/trailing whitespace, normalize to original.
+        rewritten = _with_token_query(uri, token)
+        out_lines.append(raw_line.replace(uri, rewritten, 1))
+    return "".join(out_lines)
+
+
 app = FastAPI(title=APP_NAME)
 
 # Default to permissive CORS because the player may be on another port/host.
@@ -287,7 +358,8 @@ def health() -> dict:
 
 
 @app.get("/api/media")
-def list_media() -> JSONResponse:
+def list_media(request: Request) -> JSONResponse:
+    _require_auth(request)
     MEDIA_DIR.mkdir(parents=True, exist_ok=True)
     items = []
     for p in sorted(MEDIA_DIR.rglob("*")):
@@ -307,12 +379,16 @@ def list_media() -> JSONResponse:
 
 
 @app.get("/api/hls")
-def prepare_hls(request: Request, source: str = Query(..., description="Path relative to ./media (e.g. MyMovie.mkv)")) -> JSONResponse:
+def prepare_hls(
+    request: Request,
+    source: str = Query(..., description="Path relative to ./media (e.g. MyMovie.mkv)"),
+) -> JSONResponse:
     """
     Generates (and caches) an HLS VOD playlist for a local media file.
 
     Returns an id and a playlist URL like: /hls/<id>/index.m3u8
     """
+    _require_auth(request)
     media_path = _safe_resolve_media_path(source)
     hls_id = _ensure_hls_for_media(media_path)
     base = str(request.base_url).rstrip("/")
@@ -328,19 +404,34 @@ def prepare_hls(request: Request, source: str = Query(..., description="Path rel
 
 @app.api_route("/hls/{hls_id}/{asset_path:path}", methods=["GET", "HEAD"])
 async def serve_hls_asset(hls_id: str, asset_path: str, request: Request) -> Response:
+    _require_auth(request)
     path = _safe_resolve_hls_asset(hls_id, asset_path)
-    size = path.stat().st_size
     ctype = _hls_content_type(path)
 
-    headers = {
-        "Content-Type": ctype,
-        "Content-Length": str(size),
-        "Cache-Control": "no-store",
-    }
-
     if request.method == "HEAD":
+        size = path.stat().st_size
+        headers = {
+            "Content-Type": ctype,
+            "Content-Length": str(size),
+            "Cache-Control": "no-store",
+        }
         return Response(status_code=200, headers=headers)
 
+    # For playlists, inject token into segment URIs so the browser can fetch them without headers.
+    if path.suffix.lower() == ".m3u8":
+        token = _extract_token(request) or ""
+        text = path.read_text("utf-8", errors="replace")
+        if token:
+            text = _rewrite_m3u8_with_token(text, token)
+        data = text.encode("utf-8")
+        return Response(
+            content=data,
+            status_code=200,
+            headers={"Content-Type": ctype, "Content-Length": str(len(data)), "Cache-Control": "no-store"},
+        )
+
+    size = path.stat().st_size
+    headers = {"Content-Type": ctype, "Content-Length": str(size), "Cache-Control": "no-store"}
     return StreamingResponse(
         _iter_file(path, 0, size - 1),
         status_code=200,
@@ -351,6 +442,7 @@ async def serve_hls_asset(hls_id: str, asset_path: str, request: Request) -> Res
 
 @app.api_route("/media/{file_path:path}", methods=["GET", "HEAD"])
 async def serve_media(file_path: str, request: Request) -> Response:
+    _require_auth(request)
     path = _safe_resolve_media_path(file_path)
     size = path.stat().st_size
     ctype = _guess_content_type(path)