v3: fixed authorization bug with stale tokens, fixed private dump access bug, various small fixes across the app

api/routes/thumbnails.ts

@@ -3,6 +3,7 @@ import { APIErrorCode, APIException } from "../model/interfaces.ts";
 import { getDump, getDumpThumbnailInfo } from "../services/dump-service.ts";
 import { serveUploadedFile } from "../lib/upload.ts";
 import { DUMPS_DIR, THUMBNAILS_DIR } from "../config.ts";
+import { verifyJWT } from "../lib/jwt.ts";
 
 const router = new Router({ prefix: "/api/thumbnails" });
 
@@ -54,6 +55,12 @@ router.get("/:dumpId", async (ctx) => {
     throw new APIException(APIErrorCode.BAD_REQUEST, 400, "Invalid dump ID");
   }
 
+  // Token via query param (media elements can't send headers) — authorizes the
+  // owner's private dumps and gates the custom-thumbnail branch below too.
+  const token = ctx.request.url.searchParams.get("token");
+  const payload = token ? await verifyJWT(token) : null;
+  const dump = getDump(dumpId, payload?.userId);
+
   const customThumb = getDumpThumbnailInfo(dumpId);
   if (customThumb) {
     const served = await serveUploadedFile(
@@ -64,8 +71,6 @@ router.get("/:dumpId", async (ctx) => {
     if (served) return;
   }
 
-  const dump = getDump(dumpId);
-
   if (dump.kind !== "file" || !dump.fileMime?.startsWith("video/")) {
     throw new APIException(
       APIErrorCode.NOT_FOUND,