feat: Add Python video server and improve playback

Co-authored-by: mathieumoran1 <[email protected]>

routes/movies.js

@@ -648,9 +648,12 @@ router.put("/:id/progress", authenticate, async (req, res) => {
 
     let time = Number(rawTime);
     if (!Number.isFinite(time) || time < 0) time = 0;
+    // Store whole seconds for stable, consistent resume behavior.
+    time = Math.floor(time);
 
     let duration = rawDuration === undefined || rawDuration === null ? null : Number(rawDuration);
     if (duration !== null && (!Number.isFinite(duration) || duration <= 0)) duration = null;
+    if (duration !== null) duration = Math.floor(duration);
 
     if (duration !== null) {
       // Clamp into [0, duration]

routes/users.js

@@ -76,6 +76,9 @@ function isAdminFromDecoded(decoded) {
 
 function signUserToken(user) {
   const isAdmin = user.role === 69;
+  const expiresIn = typeof process.env.JWT_EXPIRES_IN === "string" && process.env.JWT_EXPIRES_IN.trim()
+    ? process.env.JWT_EXPIRES_IN.trim()
+    : "8h";
   return jwt.sign(
     {
       id: user._id,
@@ -84,7 +87,7 @@ function signUserToken(user) {
       mustChangePassword: !!user.mustChangePassword,
     },
     process.env.JWT_SECRET,
-    { expiresIn: "1h" }
+    { expiresIn }
   );
 }
 

routes/video.js

@@ -89,7 +89,10 @@ router.post("/session", (req, res) => {
     jwt.verify(token, process.env.JWT_SECRET);
     // Cookie scoped to /api/video so it doesn't leak broadly.
     // httpOnly helps a bit, even though the JWT originally lives in localStorage.
-    const maxAgeSeconds = 60 * 60 * 8; // 8h
+    const maxAgeSecondsRaw = typeof process.env.VIDEO_SESSION_MAX_AGE_SECONDS === "string" ? process.env.VIDEO_SESSION_MAX_AGE_SECONDS.trim() : "";
+    const maxAgeSeconds = Number.isFinite(Number(maxAgeSecondsRaw)) && Number(maxAgeSecondsRaw) > 0
+      ? Math.floor(Number(maxAgeSecondsRaw))
+      : 60 * 60 * 8; // 8h
     const cookie = [
       `video_auth=${encodeURIComponent(token)}`,
       "Path=/api/video",