deploy: sync backend to Space root (learn-lesson HF cache fix)

.env.example

@@ -110,7 +110,7 @@ VIDEO_MAX_CONCURRENT_RENDER_JOBS_PER_USER="1"
 VIDEO_ENFORCE_BETA_LIMITS_IN_DEVELOPMENT="false"
 
 # Storage provider settings.
-# Local is default and keeps current /generated/audio and /generated/videos URLs.
+# Local generated media is delivered through authenticated /generated routes.
 # Use STORAGE_PROVIDER="r2" or "s3" with an S3-compatible bucket for cloud media.
 STORAGE_PROVIDER="local"
 STORAGE_BUCKET=""
@@ -124,9 +124,10 @@ STORAGE_AUDIO_PREFIX="generated-audio"
 STORAGE_VIDEO_PREFIX="generated-videos"
 
 # Auth settings.
-# Local dev defaults keep all current flows working as the demo student.
+# Demo auth is permitted only when explicitly enabled for localhost development.
 AUTH_ENABLED="false"
 AUTH_PROVIDER="dev"
+ALLOW_INSECURE_DEV_AUTH="true"
 FRONTEND_BASE_URL="http://127.0.0.1:3000"
 JWT_SECRET_KEY="change-this-before-real-users"
 JWT_ALGORITHM="HS256"
@@ -160,9 +161,9 @@ BETA_ACCESS_ENABLED="false"
 BETA_INVITE_CODE=""
 
 # Per-user AI rate limiting.
-# Set RATE_LIMIT_ENABLED=true for beta to prevent a single user from exhausting
-# Sarvam credits. RATE_LIMIT_AI_REQUESTS_PER_DAY applies per user (JWT sub) or
-# per IP when no token is present. Resets every 24 hours from first request.
+# Set RATE_LIMIT_ENABLED=true outside local development. It prevents a single
+# user from exhausting credits and applies per user (JWT sub) or server-observed
+# client IP when no token is present. Resets every 24 hours from first request.
 RATE_LIMIT_ENABLED="false"
 RATE_LIMIT_AI_REQUESTS_PER_DAY="50"
 

README.md

@@ -44,9 +44,10 @@ Local development keeps auth friction low by default:
 ```powershell
 AUTH_ENABLED="false"
 AUTH_PROVIDER="dev"
+ALLOW_INSECURE_DEV_AUTH="true"
 ```
 
-In this mode, protected endpoints automatically use a demo student user so upload, AI generation, previous-paper analysis, TTS, and video rendering still work without logging in.
+This is deliberately limited to local development. Set `ALLOW_INSECURE_DEV_AUTH=true` only with a localhost frontend; any other deployment must enable real authentication.
 
 JWT mode enables real email/password signup and login through the FastAPI backend:
 
@@ -265,8 +266,8 @@ Open:
 - `GET /video/render-jobs`
 - `GET /video/render-jobs/{job_id}`
 - `DELETE /video/render-jobs/{job_id}`
-- `GET /generated/audio/{video_id}/scene-001.wav`
-- `GET /generated/videos/{file_name}.mp4`
+- `GET /generated/audio/{user_id}/{video_id}/scene-001.wav` (owner-authenticated)
+- `GET /generated/videos/{user_id}/{file_name}.mp4` (owner-authenticated)
 
 ## Local demo seed
 

STORAGE_SETUP.md

@@ -1,6 +1,8 @@
 # Cloud Storage Setup (R2 / S3-compatible)
 
-DocDoe AI uses `S3CompatibleStorageProvider` (boto3) for generated videos and audio in production. Local dev keeps the default `LocalStorageProvider`.
+DocDoe serves generated student audio and video through owner-authenticated API
+routes. Keep any backing object store private; public bucket URLs are not an
+acceptable delivery mechanism for student-generated artifacts.
 
 ## When to switch
 

app/core/auth.py

@@ -8,7 +8,7 @@ from datetime import datetime, timedelta, timezone
 from typing import Any
 
 import jwt
-from fastapi import Depends, HTTPException, status
+from fastapi import Depends, HTTPException, Request, status
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 from sqlalchemy import select
 from sqlalchemy.orm import Session
@@ -20,25 +20,33 @@ from app.models.user import User
 
 bearer_scheme = HTTPBearer(auto_error=False)
 DEMO_PREVIEW_TOKEN = "docdoe-demo-preview-token"
+MEDIA_AUTH_COOKIE = "docdoe_media_token"
 
 
 def get_current_user_optional(
+    request: Request,
     credentials: HTTPAuthorizationCredentials | None = Depends(bearer_scheme),
     db: Session = Depends(get_db),
 ) -> User | None:
     settings = get_settings()
     if not settings.auth_enabled:
-        if settings.environment == "production":
+        if not (
+            settings.environment == "development"
+            and settings.allow_insecure_dev_auth
+        ):
             raise HTTPException(
-                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-                detail="Authentication is misconfigured for production.",
+                status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+                detail="Authentication is not configured for this deployment.",
             )
         return get_or_create_dev_user(db)
 
-    if credentials is None or credentials.scheme.lower() != "bearer":
+    token = (
+        credentials.credentials
+        if credentials is not None and credentials.scheme.lower() == "bearer"
+        else request.cookies.get(MEDIA_AUTH_COOKIE)
+    )
+    if not token:
         return None
-
-    token = credentials.credentials
     if token == DEMO_PREVIEW_TOKEN and settings.environment == "development":
         return get_or_create_dev_user(db)
 

app/core/config.py

@@ -228,8 +228,11 @@ class Settings(BaseSettings):
     cloudinary_cloud_name: str | None = None
     cloudinary_api_key: str | None = None
     cloudinary_api_secret: str | None = None
-    auth_provider: str = "dev"
-    auth_enabled: bool = False
+    auth_provider: str = "jwt"
+    # Local preview is an explicit opt-in so a non-production deployment cannot
+    # become a shared demo account by accident.
+    auth_enabled: bool = True
+    allow_insecure_dev_auth: bool = False
     frontend_base_url: str = "http://127.0.0.1:3000"
     google_client_id: str | None = None
     google_client_secret: str | None = None
@@ -244,14 +247,14 @@ class Settings(BaseSettings):
         default=None,
         validation_alias=AliasChoices("SUPABASE_SERVICE_ROLE_KEY"),
     )
-    jwt_secret_key: str = "change-this-local-dev-secret"
+    jwt_secret_key: str | None = None
     jwt_algorithm: str = "HS256"
     access_token_expire_minutes: int = 10080  # 7 days — keeps users logged in across sessions
     # --- Beta invite gate ---
     beta_access_enabled: bool = False
     beta_invite_code: str | None = None
     # --- Per-user AI rate limiting ---
-    rate_limit_enabled: bool = False
+    rate_limit_enabled: bool = True
     rate_limit_ai_requests_per_day: int = 50
     # --- Admin access ---
     admin_emails: str = ""  # comma-separated list of admin email addresses

app/main.py

@@ -1,17 +1,13 @@
 from collections.abc import AsyncIterator
 from contextlib import asynccontextmanager
-from pathlib import Path
-
 import logging
 import time
-import uuid
 
 import jwt as _jwt
 from fastapi import FastAPI, Request
 from fastapi.exceptions import RequestValidationError
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
-from fastapi.staticfiles import StaticFiles
 from starlette.exceptions import HTTPException as StarletteHTTPException
 
 from app.core import rate_limiter
@@ -32,6 +28,7 @@ from app.routes import (
     documents,
     flashcards,
     generations,
+    generated_media,
     generate_studio,
     health,
     intelligence,
@@ -99,8 +96,6 @@ def _init_sentry() -> None:
 _init_sentry()
 
 # Default JWT secret — used to detect unsafe production configs.
-_DEFAULT_JWT_SECRET = "change-this-local-dev-secret"
-
 # Paths that consume AI credits and are subject to per-user rate limiting.
 _RATE_LIMIT_PREFIXES = (
     "/ask",
@@ -119,6 +114,9 @@ _RATE_LIMIT_PREFIXES = (
     "/video-generator/plan",
     "/study-path/generate",
     "/support",
+    "/sources",
+    "/record-lecture",
+    "/telemetry",
 )
 
 # Rate-limit counters live in app.core.rate_limiter (Redis-shared when REDIS_URL
@@ -195,24 +193,20 @@ def _startup_safety_checks() -> None:
     is_prod = current_settings.environment == "production"
 
     # ── JWT secret ──────────────────────────────────────────────────────────
-    if current_settings.jwt_secret_key == _DEFAULT_JWT_SECRET:
-        if is_prod:
-            logger.error(
-                "SECURITY: JWT_SECRET_KEY is the unsafe default value. "
-                "Set a strong random 32+ character secret before serving real users."
-            )
-            raise RuntimeError(
-                "JWT_SECRET_KEY must be changed before running in production. "
-                "Set JWT_SECRET_KEY to a random 32+ character string in backend/.env."
-            )
-        else:
-            logger.warning(
-                "SECURITY WARNING: JWT_SECRET_KEY is the default development value. "
-                "Change it before deploying to any environment with real users."
-            )
+    uses_local_jwt = (current_settings.auth_provider or "jwt").strip().lower() == "jwt"
+    if uses_local_jwt and (
+        not current_settings.jwt_secret_key or len(current_settings.jwt_secret_key) < 32
+    ):
+        raise RuntimeError(
+            "JWT_SECRET_KEY must be a unique 32+ character secret whenever AUTH_PROVIDER=jwt."
+        )
 
     # ── Auth disabled in production ──────────────────────────────────────────
-    if is_prod and not current_settings.auth_enabled:
+    if not current_settings.auth_enabled and not (
+        current_settings.environment == "development"
+        and current_settings.allow_insecure_dev_auth
+        and current_settings.frontend_base_url.startswith(("http://localhost", "http://127.0.0.1"))
+    ):
         logger.error(
             "SECURITY: AUTH_ENABLED is false in production. "
             "Every API request will be served as the dev/demo user — "
@@ -287,9 +281,9 @@ def _startup_safety_checks() -> None:
             )
 
     # ── Rate limiting disabled in production ─────────────────────────────────
-    if is_prod and not current_settings.rate_limit_enabled:
-        logger.warning(
-            "CONFIG WARNING: RATE_LIMIT_ENABLED is false in production. "
+    if current_settings.environment != "development" and not current_settings.rate_limit_enabled:
+        raise RuntimeError(
+            "RATE_LIMIT_ENABLED must be true outside local development. "
             "Per-user AI quota is not enforced — a single user can exhaust Sarvam credits. "
             "Set RATE_LIMIT_ENABLED=true and RATE_LIMIT_AI_REQUESTS_PER_DAY=50."
         )
@@ -418,12 +412,7 @@ async def security_headers_middleware(request: Request, call_next):
 
 
 def _ip_rate_limit_key(request: Request) -> str:
-    forwarded = request.headers.get("X-Forwarded-For", "")
-    ip = (
-        forwarded.split(",")[0].strip()
-        if forwarded
-        else (request.client.host if request.client else "unknown")
-    )
+    ip = request.client.host if request.client else "unknown"
     return f"ip:{ip}"
 
 
@@ -769,24 +758,4 @@ app.include_router(video_generator.router, prefix="/video-generator", tags=["Vid
 app.include_router(billing.router, prefix="/billing", tags=["Billing"])
 app.include_router(intelligence.router, prefix="/intelligence", tags=["Intelligence"])
 app.include_router(dashboard.router, prefix="/dashboard", tags=["Dashboard"])
-app.mount(
-    "/generated/audio",
-    StaticFiles(directory=settings.resolved_tts_output_dir, check_dir=False),
-    name="generated-audio",
-)
-app.mount(
-    "/generated/videos",
-    StaticFiles(directory=settings.resolved_generated_video_output_dir, check_dir=False),
-    name="generated-videos",
-)
-# Learn Anything lesson cache (manifests + per-beat audio). Must live under a
-# writable path on Hugging Face (/app/generated/...), not monorepo public/.
-_learn_lesson_static = (
-    Path(__file__).resolve().parents[1] / "generated" / "learn-anything"
-)
-_learn_lesson_static.mkdir(parents=True, exist_ok=True)
-app.mount(
-    "/generated/learn-anything",
-    StaticFiles(directory=_learn_lesson_static, check_dir=False),
-    name="generated-learn-lessons",
-)
+app.include_router(generated_media.router, prefix="/generated", tags=["Generated media"])

app/routes/auth.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import json
 import hashlib
+import hmac
 import logging
 import secrets
 import urllib.error
@@ -10,12 +11,18 @@ import urllib.request
 from datetime import datetime, timedelta, timezone
 
 import jwt
-from fastapi import APIRouter, Depends, HTTPException, Query, Request, status
+from fastapi import APIRouter, Depends, HTTPException, Query, Request, Response, status
 from fastapi.responses import RedirectResponse
 from sqlalchemy import delete, select, update
 from sqlalchemy.orm import Session
 
-from app.core.auth import create_access_token, hash_password, require_user, verify_password
+from app.core.auth import (
+    MEDIA_AUTH_COOKIE,
+    create_access_token,
+    hash_password,
+    require_user,
+    verify_password,
+)
 from app.core.config import get_settings
 from app.core.database import get_db
 from app.models.user import User
@@ -53,6 +60,8 @@ LOGIN_OTP_MESSAGE = (
     "If an account exists for that email, DocDoe will send a 6-digit sign-in code."
 )
 LOGIN_OTP_TTL_MINUTES = 10
+GOOGLE_STATE_COOKIE = "docdoe_google_oauth_state"
+GOOGLE_STATE_TTL_SECONDS = 10 * 60
 
 
 def _validate_password(password: str) -> None:
@@ -117,13 +126,16 @@ def _google_redirect_uri(request: Request) -> str:
     return settings.google_oauth_redirect_uri or str(request.url_for("google_callback"))
 
 
-def _create_google_state(*, next_path: str, invite_code: str | None) -> str:
+def _create_google_state(
+    *, next_path: str, invite_code: str | None, nonce: str | None = None
+) -> str:
     settings = get_settings()
     expires_at = datetime.now(timezone.utc) + timedelta(minutes=10)
     payload = {
         "typ": "google_oauth_state",
         "next": _safe_next_path(next_path),
         "invite_code": invite_code or None,
+        "nonce": nonce or secrets.token_urlsafe(32),
         "exp": expires_at,
         "iat": datetime.now(timezone.utc),
     }
@@ -152,9 +164,23 @@ def _decode_google_state(state_token: str) -> dict[str, str | None]:
     return {
         "next": _safe_next_path(str(payload.get("next") or "/dashboard")),
         "invite_code": payload.get("invite_code"),
+        "nonce": str(payload.get("nonce") or ""),
     }
 
 
+def _require_beta_invite(invite_code: str | None) -> None:
+    settings = get_settings()
+    if not settings.beta_access_enabled:
+        return
+    expected = settings.beta_invite_code or ""
+    supplied = (invite_code or "").strip()
+    if not expected or not supplied or not hmac.compare_digest(supplied, expected):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="A valid beta invite is required to create an account.",
+        )
+
+
 def _post_google_token(payload: dict[str, str]) -> dict:
     data = urllib.parse.urlencode(payload).encode("utf-8")
     request = urllib.request.Request(
@@ -206,7 +232,7 @@ def _user_from_google_profile(db: Session, profile: dict, invite_code: str | Non
     if existing_user is not None:
         return existing_user
 
-    # Open signup — no invite gate. (invite_code accepted for compatibility, ignored.)
+    _require_beta_invite(invite_code)
     name = str(profile.get("name") or profile.get("given_name") or email.split("@")[0]).strip()
     user = User(
         name=name or "Student",
@@ -224,7 +250,7 @@ def _user_from_google_profile(db: Session, profile: dict, invite_code: str | Non
 def _auth_redirect_for_user(user: User, next_path: str) -> RedirectResponse:
     token, expires_in = create_access_token(user)
     user_payload = UserRead.model_validate(user).model_dump(mode="json")
-    return RedirectResponse(
+    response = RedirectResponse(
         _frontend_callback_url(
             {
                 "access_token": token,
@@ -236,13 +262,30 @@ def _auth_redirect_for_user(user: User, next_path: str) -> RedirectResponse:
         ),
         status_code=status.HTTP_302_FOUND,
     )
+    _set_media_auth_cookie(response, token, expires_in)
+    return response
 
 
-@router.post("/signup", response_model=AuthTokenResponse, status_code=status.HTTP_201_CREATED)
-def signup(payload: AuthSignupRequest, db: Session = Depends(get_db)) -> AuthTokenResponse:
-    # Open signup — invite gate removed. invite_code field still accepted on the
-    # request for backward compatibility but is no longer required or checked.
+def _set_media_auth_cookie(response: Response, token: str, expires_in: int) -> None:
+    """Allow browser media elements to authenticate without exposing a bearer token."""
+    settings = get_settings()
+    response.set_cookie(
+        key=MEDIA_AUTH_COOKIE,
+        value=token,
+        max_age=expires_in,
+        httponly=True,
+        secure=settings.is_production,
+        samesite="none" if settings.is_production else "lax",
+        path="/generated",
+    )
 
+
+@router.post("/signup", response_model=AuthTokenResponse, status_code=status.HTTP_201_CREATED)
+def signup(
+    payload: AuthSignupRequest,
+    response: Response,
+    db: Session = Depends(get_db),
+) -> AuthTokenResponse:
     # Normalize email �� case-insensitive lookup AND storage so "User@Mail.com"
     # and "user@mail.com" can't both register as separate accounts.
     normalized_email = payload.email.strip().lower()
@@ -259,6 +302,7 @@ def signup(payload: AuthSignupRequest, db: Session = Depends(get_db)) -> AuthTok
             status_code=status.HTTP_409_CONFLICT,
             detail="Email already exists",
         )
+    _require_beta_invite(payload.invite_code)
 
     user = User(
         name=payload.name,
@@ -275,6 +319,7 @@ def signup(payload: AuthSignupRequest, db: Session = Depends(get_db)) -> AuthTok
     db.commit()
     db.refresh(user)
     token, expires_in = create_access_token(user)
+    _set_media_auth_cookie(response, token, expires_in)
     return AuthTokenResponse(
         access_token=token,
         expires_in=expires_in,
@@ -283,7 +328,11 @@ def signup(payload: AuthSignupRequest, db: Session = Depends(get_db)) -> AuthTok
 
 
 @router.post("/login", response_model=AuthTokenResponse)
-def login(payload: AuthLoginRequest, db: Session = Depends(get_db)) -> AuthTokenResponse:
+def login(
+    payload: AuthLoginRequest,
+    response: Response,
+    db: Session = Depends(get_db),
+) -> AuthTokenResponse:
     # Match the normalized lower-case email stored at signup time so users with a
     # mixed-case email entry can still sign in.
     normalized_email = payload.email.strip().lower()
@@ -295,6 +344,7 @@ def login(payload: AuthLoginRequest, db: Session = Depends(get_db)) -> AuthToken
         )
 
     token, expires_in = create_access_token(user)
+    _set_media_auth_cookie(response, token, expires_in)
     return AuthTokenResponse(
         access_token=token,
         expires_in=expires_in,
@@ -377,6 +427,7 @@ def request_login_otp(
 @router.post("/login/otp/verify", response_model=AuthTokenResponse)
 def verify_login_otp(
     payload: LoginOtpVerifyRequest,
+    response: Response,
     db: Session = Depends(get_db),
 ) -> AuthTokenResponse:
     if (get_settings().auth_provider or "jwt").strip().lower() != "jwt":
@@ -422,6 +473,7 @@ def verify_login_otp(
     db.commit()
 
     access_token, expires_in = create_access_token(user)
+    _set_media_auth_cookie(response, access_token, expires_in)
     return AuthTokenResponse(
         access_token=access_token,
         expires_in=expires_in,
@@ -570,7 +622,10 @@ def google_start(
     if not settings.google_client_id or not settings.google_client_secret:
         return _redirect_with_google_error("Google sign-in is not ready right now.", next)
 
-    state_token = _create_google_state(next_path=next, invite_code=invite_code)
+    nonce = secrets.token_urlsafe(32)
+    state_token = _create_google_state(
+        next_path=next, invite_code=invite_code, nonce=nonce
+    )
     params = {
         "client_id": settings.google_client_id,
         "redirect_uri": _google_redirect_uri(request),
@@ -580,10 +635,20 @@ def google_start(
         "access_type": "online",
         "prompt": "select_account",
     }
-    return RedirectResponse(
+    response = RedirectResponse(
         f"{GOOGLE_AUTH_URL}?{urllib.parse.urlencode(params)}",
         status_code=status.HTTP_302_FOUND,
     )
+    response.set_cookie(
+        GOOGLE_STATE_COOKIE,
+        nonce,
+        max_age=GOOGLE_STATE_TTL_SECONDS,
+        httponly=True,
+        secure=settings.environment == "production",
+        samesite="lax",
+        path="/auth/google",
+    )
+    return response
 
 
 @router.get("/google/callback", name="google_callback")
@@ -600,6 +665,12 @@ def google_callback(
             return _redirect_with_google_error("Google sign-in expired. Please try again.")
         state_payload = _decode_google_state(state)
         next_path = str(state_payload.get("next") or "/dashboard")
+        cookie_nonce = request.cookies.get(GOOGLE_STATE_COOKIE, "")
+        state_nonce = str(state_payload.get("nonce") or "")
+        if not state_nonce or not cookie_nonce or not hmac.compare_digest(
+            state_nonce, cookie_nonce
+        ):
+            return _redirect_with_google_error("Google sign-in expired. Please try again.", next_path)
 
         if error:
             return _redirect_with_google_error("Google sign-in was cancelled.", next_path)
@@ -629,7 +700,9 @@ def google_callback(
             profile,
             invite_code=state_payload.get("invite_code"),
         )
-        return _auth_redirect_for_user(user, next_path)
+        response = _auth_redirect_for_user(user, next_path)
+        response.delete_cookie(GOOGLE_STATE_COOKIE, path="/auth/google")
+        return response
     except HTTPException as exc:
         message = str(exc.detail or "Could not finish Google sign-in right now.")
         return _redirect_with_google_error(message, next_path)

app/routes/generated_media.py

@@ -0,0 +1,60 @@
+"""Authenticated delivery for user-generated local media artifacts."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi.responses import FileResponse
+
+from app.core.auth import require_user
+from app.core.config import get_settings
+from app.models.user import User
+from app.services.learn_lesson_builder import ensure_public_root
+
+
+router = APIRouter()
+
+
+def _owned_file(root: Path, artifact_path: str, user_id: str) -> Path:
+    candidate = (root / artifact_path).resolve()
+    try:
+        candidate.relative_to(root.resolve())
+    except ValueError as exc:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND) from exc
+    parts = Path(artifact_path).parts
+    if not parts or parts[0] != user_id or not candidate.is_file():
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND)
+    return candidate
+
+
+def _private_file_response(path: Path) -> FileResponse:
+    return FileResponse(
+        path,
+        headers={
+            "Cache-Control": "private, no-store",
+            "Vary": "Authorization, Cookie",
+        },
+    )
+
+
+@router.get("/audio/{artifact_path:path}")
+def get_audio(artifact_path: str, current_user: User = Depends(require_user)) -> FileResponse:
+    path = _owned_file(get_settings().resolved_tts_output_dir, artifact_path, current_user.id)
+    return _private_file_response(path)
+
+
+@router.get("/videos/{artifact_path:path}")
+def get_video(artifact_path: str, current_user: User = Depends(require_user)) -> FileResponse:
+    path = _owned_file(
+        get_settings().resolved_generated_video_output_dir, artifact_path, current_user.id
+    )
+    return _private_file_response(path)
+
+
+@router.get("/learn-anything/{artifact_path:path}")
+def get_lesson_artifact(
+    artifact_path: str, current_user: User = Depends(require_user)
+) -> FileResponse:
+    path = _owned_file(ensure_public_root(), artifact_path, current_user.id)
+    return _private_file_response(path)

app/routes/health.py

@@ -7,6 +7,7 @@ from sqlalchemy.orm import Session
 
 from app.core.config import get_settings
 from app.core.database import get_db
+from app.core.admin_auth import require_admin
 
 router = APIRouter()
 
@@ -26,6 +27,7 @@ def health_check() -> dict[str, str]:
 def deep_health_check(
     response: Response,
     db: Session = Depends(get_db),
+    _admin=Depends(require_admin),
 ) -> dict[str, Any]:
     settings = get_settings()
     
@@ -167,7 +169,7 @@ def deep_health_check(
 
 
 @router.get("/health/ai")
-def ai_health_check() -> dict[str, Any]:
+def ai_health_check(_admin=Depends(require_admin)) -> dict[str, Any]:
     from app.core.circuit_breaker import all_breaker_states
     from app.core.prompt_cache import get_prompt_cache
 

app/routes/learning_engine.py

@@ -193,6 +193,7 @@ def generate_learn_lesson(
             level=payload.level,
             medium=payload.medium,
             context=source_context,
+            user_id=current_user.id,
         )
     except LessonBuildError as exc:
         raise HTTPException(status_code=status.HTTP_502_BAD_GATEWAY, detail=str(exc)) from exc

app/routes/transcription.py

@@ -1,9 +1,8 @@
 """Record Lecture transcription endpoint.
 
-Accepts an uploaded audio clip and returns its transcript via Deepgram. Access
-mirrors the tuition beta: anonymous callers are allowed (the beta is
-login-less) but the clip size is capped so the anonymous surface can't run up
-unbounded speech-to-text cost. When Deepgram is not configured, or the clip has
+Accepts an authenticated user's uploaded audio clip and returns its transcript
+via Deepgram. The clip size is capped before it is buffered so this endpoint
+cannot run up unbounded memory or speech-to-text cost. When Deepgram is not configured, or the clip has
 no clear speech, the response says so honestly rather than failing or inventing
 text. The transcript is returned to the client, which feeds it into the
 existing note/quiz/flashcard generators, so nothing is stored server-side here.
@@ -14,8 +13,9 @@ from __future__ import annotations
 import logging
 
 from fastapi import APIRouter, Depends, File, UploadFile
+from starlette.concurrency import run_in_threadpool
 
-from app.core.auth import get_current_user_optional
+from app.core.auth import require_user
 from app.core.config import get_settings
 from app.models.user import User
 from app.schemas.transcription import TranscriptionResponse
@@ -24,20 +24,37 @@ from app.services.transcription_service import transcribe_audio
 logger = logging.getLogger(__name__)
 router = APIRouter()
 
-# ~25 MB. A few minutes of compressed lecture audio. Bounds the anonymous
-# surface's cost without getting in the way of a normal class recording.
+# ~25 MB. A few minutes of compressed lecture audio without unbounded request
+# memory or speech-to-text spend.
 MAX_AUDIO_BYTES = 25 * 1024 * 1024
+_READ_CHUNK_BYTES = 1024 * 1024
+
+
+async def _read_audio_with_limit(file: UploadFile) -> bytes | None:
+    """Bound application memory before joining an upload into bytes."""
+    chunks: list[bytes] = []
+    total = 0
+    while True:
+        chunk = await file.read(_READ_CHUNK_BYTES)
+        if not chunk:
+            break
+        total += len(chunk)
+        if total > MAX_AUDIO_BYTES:
+            return None
+        chunks.append(chunk)
+    return b"".join(chunks)
 
 
 @router.post("/transcribe", response_model=TranscriptionResponse)
 async def transcribe_lecture(
     file: UploadFile = File(...),
-    current_user: User | None = Depends(get_current_user_optional),
+    current_user: User = Depends(require_user),
 ) -> TranscriptionResponse:
     settings = get_settings()
 
-    audio = await file.read()
-    if len(audio) > MAX_AUDIO_BYTES:
+    audio = await _read_audio_with_limit(file)
+    await file.close()
+    if audio is None:
         return TranscriptionResponse(
             ok=False,
             configured=bool(settings.deepgram_api_key),
@@ -45,7 +62,8 @@ async def transcribe_lecture(
             reason="That recording is too long. Keep it under about 25 MB.",
         )
 
-    result = transcribe_audio(
+    result = await run_in_threadpool(
+        transcribe_audio,
         audio,
         api_key=settings.deepgram_api_key,
         content_type=file.content_type,

app/routes/video.py

@@ -328,12 +328,11 @@ def render_final_video_route(
     payload: RenderFinalVideoRequest,
     current_user: User = Depends(require_user),
 ) -> dict[str, Any]:
-    _ = current_user
     try:
         if get_settings().environment == "production" and payload.allow_mock_audio:
             raise VideoValidationError("Mock audio rendering is disabled in production.")
         enforce_video_beta_limits(payload.scene_plan)
-        return render_final_video(payload)
+        return render_final_video(payload, user_id=current_user.id)
     except VideoValidationError as exc:
         # Audio-file validation messages can contain local file paths — sanitize.
         student_safe_error(

app/schemas/source.py

@@ -16,22 +16,26 @@ SourceType = Literal[
     "link",
 ]
 
+MAX_SOURCE_TITLE_CHARS = 240
+MAX_SOURCE_TEXT_CHARS = 200_000
+MAX_SOURCE_METADATA_CHARS = 120
+
 
 class SourceTextCreate(BaseModel):
-    title: str
-    text: str
+    title: str = Field(min_length=1, max_length=MAX_SOURCE_TITLE_CHARS)
+    text: str = Field(min_length=1, max_length=MAX_SOURCE_TEXT_CHARS)
     source_type: SourceType = "syllabus_text"
-    subject: str | None = None
-    chapter: str | None = None
-    syllabus: str | None = None
+    subject: str | None = Field(default=None, max_length=MAX_SOURCE_METADATA_CHARS)
+    chapter: str | None = Field(default=None, max_length=MAX_SOURCE_METADATA_CHARS)
+    syllabus: str | None = Field(default=None, max_length=MAX_SOURCE_METADATA_CHARS)
 
 
 class SourceUpdate(BaseModel):
-    title: str | None = None
-    text: str | None = None
-    subject: str | None = None
-    chapter: str | None = None
-    syllabus: str | None = None
+    title: str | None = Field(default=None, min_length=1, max_length=MAX_SOURCE_TITLE_CHARS)
+    text: str | None = Field(default=None, min_length=1, max_length=MAX_SOURCE_TEXT_CHARS)
+    subject: str | None = Field(default=None, max_length=MAX_SOURCE_METADATA_CHARS)
+    chapter: str | None = Field(default=None, max_length=MAX_SOURCE_METADATA_CHARS)
+    syllabus: str | None = Field(default=None, max_length=MAX_SOURCE_METADATA_CHARS)
 
 
 class SourceRead(BaseModel):

app/schemas/video.py

@@ -1,6 +1,6 @@
 from datetime import datetime
 import re
-from typing import Any, Literal
+from typing import Annotated, Any, Literal
 
 from pydantic import BaseModel, ConfigDict, Field, computed_field, field_validator
 
@@ -11,76 +11,87 @@ VideoFormat = Literal["16:9", "9:16"]
 ANSI_ESCAPE_RE = re.compile(r"\x1b\[[0-9;]*m")
 SceneAudioState = Literal["pending", "generating", "ready", "generated", "failed", "skipped"]
 
+MAX_VIDEO_SCENES = 40
+MAX_VIDEO_LANGUAGES = 3
+MAX_SCENE_SEGMENTS = 80
+MAX_SCENE_VISUALS = 50
+MAX_SCENE_KEYWORDS = 40
+MAX_VIDEO_TEXT_CHARS = 700
+MAX_VIDEO_LABEL_CHARS = 120
+MAX_VIDEO_LANGUAGE_CHARS = 32
+VideoShortText = Annotated[str, Field(max_length=MAX_VIDEO_LABEL_CHARS)]
+VideoLanguage = Annotated[str, Field(max_length=MAX_VIDEO_LANGUAGE_CHARS)]
+
 
 class VideoVoiceSegment(BaseModel):
     lang: Literal["ml", "en"]
-    text: str
+    text: str = Field(min_length=1, max_length=MAX_VIDEO_TEXT_CHARS)
 
 
 class VideoSubtitleSegment(BaseModel):
     start: float = Field(ge=0)
     end: float = Field(gt=0)
-    text: str
+    text: str = Field(min_length=1, max_length=MAX_VIDEO_TEXT_CHARS)
 
 
 class VideoVisualElement(BaseModel):
-    type: str = "icon"
-    name: str
-    label: str | None = None
-    position: str | None = None
-    animation: str | None = None
+    type: VideoShortText = "icon"
+    name: VideoShortText
+    label: VideoShortText | None = None
+    position: VideoShortText | None = None
+    animation: VideoShortText | None = None
 
-    model_config = {"extra": "allow"}
+    model_config = {"extra": "ignore"}
 
 
 class VideoSceneAudioInput(BaseModel):
     scene_id: int | None = None
     id: int | None = None
-    type: str = "meaning"
-    duration_seconds: float = Field(default=6, ge=0.5)
-    screen_text: str | None = None
-    text: str | None = None
-    voice_text: str | None = None
-    subtitle_text: str | None = None
-    subtitle_segments: list[VideoSubtitleSegment] = Field(default_factory=list)
-    keywords: list[str] = Field(default_factory=list)
-    visual_hint: str | None = None
-    visual_elements: list[VideoVisualElement] = Field(default_factory=list)
-    mascot_expression: str | None = None
-    transition: str | None = None
-    purpose: str | None = None
-    learning_purpose: str | None = None
-    audio_src: str | None = None
+    type: VideoShortText = "meaning"
+    duration_seconds: float = Field(default=6, ge=0.5, le=600)
+    screen_text: str | None = Field(default=None, max_length=MAX_VIDEO_TEXT_CHARS)
+    text: str | None = Field(default=None, max_length=MAX_VIDEO_TEXT_CHARS)
+    voice_text: str | None = Field(default=None, max_length=MAX_VIDEO_TEXT_CHARS)
+    subtitle_text: str | None = Field(default=None, max_length=MAX_VIDEO_TEXT_CHARS)
+    subtitle_segments: list[VideoSubtitleSegment] = Field(default_factory=list, max_length=MAX_SCENE_SEGMENTS)
+    keywords: list[VideoShortText] = Field(default_factory=list, max_length=MAX_SCENE_KEYWORDS)
+    visual_hint: VideoShortText | None = None
+    visual_elements: list[VideoVisualElement] = Field(default_factory=list, max_length=MAX_SCENE_VISUALS)
+    mascot_expression: VideoShortText | None = None
+    transition: VideoShortText | None = None
+    purpose: VideoShortText | None = None
+    learning_purpose: VideoShortText | None = None
+    audio_src: str | None = Field(default=None, max_length=1_000)
     is_mock_audio: bool | None = None
     audio_kind: str | None = None
     audio_file_size: int | None = None
     audio_duration_verified: bool | None = None
-    segments: list[VideoVoiceSegment] | None = None
+    segments: list[VideoVoiceSegment] | None = Field(default=None, max_length=MAX_SCENE_SEGMENTS)
 
-    model_config = {"extra": "allow"}
+    model_config = {"extra": "ignore"}
 
 
 class VideoScenePlanAudioInput(BaseModel):
-    title: str = "Untitled explainer"
-    duration_minutes: float = Field(default=1, ge=0.1)
-    total_duration_seconds: float | None = None
-    language: str = "English"
-    style: str = "clean_explainer"
+    title: str = Field(default="Untitled explainer", max_length=240)
+    duration_minutes: float = Field(default=1, ge=0.1, le=60)
+    total_duration_seconds: float | None = Field(default=None, ge=0.1, le=3_600)
+    language: VideoLanguage = "English"
+    style: VideoShortText = "clean_explainer"
     visual_style: VisualStyle = "clean_explainer"
-    video_format: str = "16:9"
+    video_format: VideoShortText = "16:9"
     voice_mode: VoiceMode | None = None
-    scenes: list[VideoSceneAudioInput] = Field(default_factory=list)
+    scenes: list[VideoSceneAudioInput] = Field(default_factory=list, max_length=MAX_VIDEO_SCENES)
 
-    model_config = {"extra": "allow"}
+    model_config = {"extra": "ignore"}
 
 
 class GenerateAudioRequest(BaseModel):
     scene_plan: VideoScenePlanAudioInput
     voice_mode: VoiceMode = "english_soft"
-    voice: str = "nila"
-    language: str = "English"
-    languages: list[str] | None = None
-    provider: str | None = None
+    voice: VideoShortText = "nila"
+    language: VideoLanguage = "English"
+    languages: list[VideoLanguage] | None = Field(default=None, max_length=MAX_VIDEO_LANGUAGES)
+    provider: VideoShortText | None = None
 
 
 class SceneAudioStatus(BaseModel):
@@ -129,16 +140,16 @@ class GenerateAudioResponse(BaseModel):
 class RenderFinalVideoRequest(BaseModel):
     scene_plan: VideoScenePlanAudioInput
     audio_result: GenerateAudioResponse | None = None
-    title: str | None = None
+    title: str | None = Field(default=None, max_length=240)
     allow_mock_audio: bool = False
 
 
 class VideoRenderRequest(RenderFinalVideoRequest):
-    user_id: str | None = None
+    user_id: str | None = Field(default=None, max_length=128)
     voice_mode: VoiceMode | None = None
-    voice: str = "nila"
-    language: str | None = None
-    provider: str | None = None
+    voice: VideoShortText = "nila"
+    language: VideoLanguage | None = None
+    provider: VideoShortText | None = None
 
 
 class RenderFinalVideoResponse(BaseModel):

app/services/account_deletion.py

@@ -48,6 +48,7 @@ class _OwnedArtifacts:
     document_ids: set[str]
     paper_ids: set[str]
     local_paths: set[str]
+    local_directories: set[str]
     job_ids: set[str]
     storage_objects: set[tuple[str, str]]
     cache_keys: set[str]
@@ -219,6 +220,11 @@ def _collect_owned_artifacts(db: Session, user_id: str) -> _OwnedArtifacts:
         *(row.file_path for row in papers if row.file_path),
         *(row.output_file_path for row in video_jobs if row.output_file_path),
     }
+    settings = get_settings()
+    local_directories = {
+        str(settings.resolved_tts_output_dir / user_id),
+        str(settings.resolved_generated_video_output_dir / user_id),
+    }
     storage_objects: set[tuple[str, str]] = set()
     for job in video_jobs:
         if job.output_object_key:
@@ -244,6 +250,7 @@ def _collect_owned_artifacts(db: Session, user_id: str) -> _OwnedArtifacts:
         document_ids=document_ids,
         paper_ids=paper_ids,
         local_paths=local_paths,
+        local_directories=local_directories,
         job_ids={row.id for row in video_jobs},
         storage_objects=storage_objects,
         cache_keys=cache_keys,
@@ -359,6 +366,8 @@ def _delete_local_artifacts(artifacts: _OwnedArtifacts) -> None:
     )
     for raw_path in artifacts.local_paths:
         _delete_safe_local_path(raw_path, allowed_roots)
+    for raw_path in artifacts.local_directories:
+        _delete_safe_local_path(raw_path, allowed_roots, directory=True)
     jobs_root = settings.resolved_generated_video_jobs_dir.resolve()
     for job_id in artifacts.job_ids:
         _delete_safe_local_path(str(jobs_root / job_id), allowed_roots, directory=True)
@@ -374,6 +383,8 @@ def _validate_local_artifacts(artifacts: _OwnedArtifacts) -> None:
     )
     for raw_path in artifacts.local_paths:
         _managed_existing_path(raw_path, allowed_roots)
+    for raw_path in artifacts.local_directories:
+        _managed_existing_path(raw_path, allowed_roots)
     jobs_root = settings.resolved_generated_video_jobs_dir.resolve()
     for job_id in artifacts.job_ids:
         _managed_existing_path(str(jobs_root / job_id), allowed_roots)

app/services/learn_lesson_builder.py

@@ -7,10 +7,9 @@ with a board (heading + lines) to show while it is spoken, plus per-beat
 audio. The student's browser "plays" it like a class — audio + synced board —
 so there is no video render cost at all.
 
-Cost control: everything is keyed by a content hash of (topic, lesson,
-level, voice). The first student to open a lesson pays for one LLM call plus
-Deepgram audio; every student after that reuses the cached manifest and audio
-for free. Popular lessons become effectively pre-made.
+Cost control: lessons are keyed by their content, source context, and owner.
+Sensitive uploads therefore cannot select another student's cached manifest or
+audio.
 
 Voice: Deepgram Aura for English / English-medium ("Manglish") lessons. A
 Malayalam-medium lesson routes to the local AI4Bharat provider instead
@@ -63,8 +62,8 @@ DEFAULT_LESSON_LLM_BUDGET_SECONDS = 35.0
 DEFAULT_LESSON_AUDIO_BUDGET_SECONDS = 20.0
 DEFAULT_LESSON_TTS_TIMEOUT_SECONDS = 15.0
 
-# Prevent stampede: many students opening the same uncached lesson at once
-# should share one authoring job, not N parallel LLM bills.
+# Prevent a user from opening the same uncached lesson repeatedly and fanning
+# out parallel authoring jobs.
 _lesson_build_locks: dict[str, threading.Lock] = {}
 _lesson_build_locks_guard = threading.Lock()
 
@@ -137,7 +136,14 @@ def _env(name: str) -> str:
 
 
 def lesson_hash(
-    topic: str, lesson_title: str, level: str, medium: str, voice: str
+    topic: str,
+    lesson_title: str,
+    level: str,
+    medium: str,
+    voice: str,
+    *,
+    context: str = "",
+    user_id: str = "",
 ) -> str:
     payload = json.dumps(
         {
@@ -146,7 +152,9 @@ def lesson_hash(
             "level": level.strip().lower(),
             "medium": medium.strip().lower(),
             "voice": voice.strip().lower(),
-            "schema": "learn-lesson-v1",
+            "context": hashlib.sha256(context.encode("utf-8")).hexdigest(),
+            "user": user_id,
+            "schema": "learn-lesson-v2-private",
         },
         sort_keys=True,
     )
@@ -852,7 +860,9 @@ def synthesize_beats(
                 board_heading=str(beat.get("board_heading", "")),
                 board_lines=[str(line) for line in (beat.get("board_lines") or [])],
                 visual_hint=str(beat.get("visual_hint", "")),
-                audio_src=f"/generated/learn-anything/{out_dir.name}/{audio_path.name}",
+                audio_src=(
+                    f"/generated/learn-anything/{out_dir.parent.name}/{out_dir.name}/{audio_path.name}"
+                ),
                 start_second=round(cursor, 3),
                 duration_seconds=duration,
             )
@@ -959,12 +969,12 @@ def build_lesson(
     level: str = "",
     medium: str = "english",
     context: str = "",
+    user_id: str | None = None,
     force: bool = False,
 ) -> dict[str, Any]:
-    """Full pipeline: script -> audio -> playable manifest, cached by content hash.
+    """Full pipeline: script -> audio -> playable manifest, cached privately.
 
-    Cache is shared across all students: the first open pays for authoring;
-    the next 999+ hits serve the same lesson.json + audio instantly.
+    Every user's source context is isolated in its own cache namespace.
     Concurrent first opens for the same hash serialize on a per-hash lock so
     we do not fan out N identical LLM bills under load.
     """
@@ -977,9 +987,10 @@ def build_lesson(
         if medium.strip().lower() in {"malayalam", "ml"}
         else (_env("DOCDOE_TTS_MODEL") or "aura-luna-en")
     )
-    key = lesson_hash(topic, lesson_title, level, medium, voice)
+    owner = user_id or "unowned"
+    key = lesson_hash(topic, lesson_title, level, medium, voice, context=context, user_id=owner)
     cache_root = ensure_public_root()
-    out_dir = cache_root / key
+    out_dir = cache_root / owner / key
     manifest_path = out_dir / "lesson.json"
 
     if manifest_path.exists() and not force:
@@ -1005,26 +1016,12 @@ def build_lesson(
         try:
             out_dir.mkdir(parents=True, exist_ok=True)
         except OSError as exc:
-            # Hard fallback: rebuild under /tmp so students still get a class.
-            emergency = (
-                Path(os.getenv("TMPDIR") or os.getenv("TEMP") or "/tmp")
-                / "docdoe-learn-lessons"
-                / key
-            )
-            try:
-                emergency.mkdir(parents=True, exist_ok=True)
-                out_dir = emergency
-                manifest_path = out_dir / "lesson.json"
-                logger.warning(
-                    "Lesson cache mkdir failed (%s); using emergency path %s",
-                    exc,
-                    out_dir,
-                )
-            except OSError as exc2:
-                raise LessonBuildError(
-                    f"Could not create lesson cache folder ({out_dir}): {exc}; "
-                    f"emergency also failed: {exc2}"
-                ) from exc2
+            # Do not write an untracked fallback that the authenticated media
+            # router cannot authorize. `ensure_public_root` already tries the
+            # configured cache, application cache, and an OS temp directory.
+            raise LessonBuildError(
+                f"Could not create private lesson cache folder ({out_dir}): {exc}"
+            ) from exc
         delivery_mode = "reading" if mock_mode else "audio"
         delivery_notice = (
             "Local preview: this complete starter class is available in reading mode; no generated voice is being presented as real audio."

app/services/storage_provider.py

@@ -69,8 +69,24 @@ class LocalStorageProvider:
         )
 
     def delete_file(self, object_key: str) -> None:
-        # Local files are owned by the media services; cleanup is handled separately.
-        logger.debug("Local storage delete is a no-op for object_key=%s", object_key)
+        settings = get_settings()
+        key = _normalize_object_key(object_key)
+        roots = {
+            "generated-audio/": settings.resolved_tts_output_dir,
+            "generated-videos/": settings.resolved_generated_video_output_dir,
+            "uploads/": settings.resolved_upload_dir,
+        }
+        for prefix, root in roots.items():
+            if not key.startswith(prefix):
+                continue
+            candidate = (root / key.removeprefix(prefix)).resolve()
+            try:
+                candidate.relative_to(root.resolve())
+            except ValueError as exc:
+                raise StorageProviderError("Invalid local storage object key.") from exc
+            candidate.unlink(missing_ok=True)
+            return
+        raise StorageProviderError("Unsupported local storage object key.")
 
     def get_public_url(self, object_key: str) -> str:
         key = _normalize_object_key(object_key)

app/services/tts_provider.py

@@ -25,7 +25,6 @@ from app.services.audio_utils import (
     normalize_audio_volume,
     trim_silence_and_pad_audio,
 )
-from app.services.storage_provider import StorageProviderError, build_object_key, get_storage_provider
 from app.services.video_validation import create_subtitle_segments
 from app.utils.ids import prefixed_id
 
@@ -937,30 +936,11 @@ def _finalize_scene_audio_result(
     synced_duration = round(max(detected_duration + 0.3, 1), 2)
     audio_url = _audio_url_for_path(result.file_path, output_root)
     storage_object = None
-    storage_provider = get_storage_provider()
     requested_storage_provider = (settings.storage_provider or "local").strip().lower()
-    try:
-        storage_object = storage_provider.upload_file(
-            result.file_path,
-            build_object_key(
-                settings.storage_audio_prefix,
-                user_id or "",
-                safe_video_id,
-                result.file_path.name,
-            ),
+    if requested_storage_provider != "local":
+        result_warnings.append(
+            "External public media storage is disabled; the scene remains behind DocDoe authorization."
         )
-        if storage_object.provider != "local":
-            audio_url = storage_object.public_url
-        if requested_storage_provider in {"r2", "s3"} and storage_object.provider == "local":
-            result_warnings.append(
-                f"Cloud audio storage unavailable. Kept scene {scene_id} on local storage.",
-            )
-    except StorageProviderError as exc:
-        if requested_storage_provider in {"r2", "s3"}:
-            result_warnings.append(
-                f"Cloud audio upload failed for scene {scene_id}. Kept local audio URL.",
-            )
-        logger.warning("Audio storage upload failed: %s", _safe_error(exc))
 
     updated_scene = scene.model_dump(exclude_none=True)
     updated_scene["scene_id"] = scene_id
@@ -987,7 +967,7 @@ def _finalize_scene_audio_result(
         "warning": " ".join(result_warnings) if result_warnings else None,
         "storage_provider": storage_object.provider if storage_object else "local",
         "object_key": storage_object.object_key if storage_object else None,
-        "public_url": storage_object.public_url if storage_object else audio_url,
+        "public_url": audio_url,
         "size_bytes": storage_object.size_bytes if storage_object else result.file_path.stat().st_size,
         "is_mock_audio": is_mock_audio,
         "audio_kind": audio_kind,

app/services/video_jobs.py

@@ -178,6 +178,7 @@ def run_render_job(job_id: str, payload_data: dict[str, Any]) -> None:
                 allow_mock_audio=payload.allow_mock_audio,
             ),
             video_id=job_id,
+            user_id=payload.user_id,
             progress_callback=progress_callback,
         )
         _update_job(

app/services/video_renderer.py

@@ -13,7 +13,6 @@ from typing import Any
 from app.core.config import PROJECT_ROOT, get_settings
 from app.schemas.video import RenderFinalVideoRequest
 from app.services.audio_utils import media_has_audio_stream, media_has_video_stream
-from app.services.storage_provider import StorageProviderError, build_object_key, get_storage_provider
 from app.services.video_validation import VideoValidationError, validate_audio_result_for_render
 from app.utils.ids import prefixed_id
 
@@ -29,13 +28,14 @@ def render_final_video(
     payload: RenderFinalVideoRequest,
     *,
     video_id: str | None = None,
+    user_id: str | None = None,
     progress_callback: Callable[[int, str], None] | None = None,
 ) -> dict[str, Any]:
     settings = get_settings()
     video_id = video_id or prefixed_id("video")
     title = payload.title or payload.scene_plan.title or "Docdeo explainer"
     slug = _slugify(title)
-    output_dir = settings.resolved_generated_video_output_dir
+    output_dir = settings.resolved_generated_video_output_dir / (user_id or "unowned")
     jobs_dir = settings.resolved_generated_video_jobs_dir
     job_dir = jobs_dir / video_id
     output_dir.mkdir(parents=True, exist_ok=True)
@@ -108,7 +108,6 @@ def render_final_video(
         "render_provider": "remotion",
         "created_at": datetime.now(timezone.utc).isoformat(),
         "warnings": warnings,
-        "job_dir": str(job_dir),
         "audio_validation": audio_validation,
         "output_validation": output_validation,
         "audio_stream_verified": output_validation["audio_stream"],
@@ -116,33 +115,22 @@ def render_final_video(
 
     _notify(progress_callback, 90, "uploading_or_saving")
     storage_object = None
-    download_url = f"/generated/videos/{output_file.name}"
+    download_url = f"/generated/videos/{output_file.parent.name}/{output_file.name}"
     requested_storage_provider = (settings.storage_provider or "local").strip().lower()
-    try:
-        storage_provider = get_storage_provider()
-        storage_object = storage_provider.upload_file(
-            output_file,
-            build_object_key(settings.storage_video_prefix, output_file.name),
-            content_type="video/mp4",
+    if requested_storage_provider != "local":
+        warnings.append(
+            "External public media storage is disabled; the MP4 remains behind DocDoe authorization."
         )
-        download_url = storage_object.public_url
-        metadata["storage"] = storage_object.model_dump()
-        if requested_storage_provider in {"r2", "s3"} and storage_object.provider == "local":
-            warnings.append("Cloud storage unavailable. Kept final MP4 on local storage.")
-    except StorageProviderError as exc:
-        if requested_storage_provider in {"r2", "s3"}:
-            warnings.append("Cloud upload failed. Kept final MP4 on local storage.")
-        logger.warning("Video storage upload failed: %s", _safe_storage_error(exc))
-        metadata["storage"] = None
+    metadata["storage"] = None
 
     _notify(progress_callback, 92, "Saving render metadata")
     metadata_file.write_text(json.dumps(metadata, ensure_ascii=False, indent=2), encoding="utf-8")
 
-    metadata_url = f"/generated/videos/{metadata_file.name}"
+    metadata_url = f"/generated/videos/{metadata_file.parent.name}/{metadata_file.name}"
     return {
         "video_id": video_id,
         "status": "ready",
-        "file_path": f"/generated/videos/{output_file.name}",
+        "file_path": f"/generated/videos/{output_file.parent.name}/{output_file.name}",
         "download_url": download_url,
         "duration_seconds": duration_seconds,
         "render_provider": "remotion",
@@ -150,7 +138,7 @@ def render_final_video(
         "metadata_path": metadata_url,
         "storage_provider": storage_object.provider if storage_object else "local",
         "output_object_key": storage_object.object_key if storage_object else None,
-        "public_url": storage_object.public_url if storage_object else download_url,
+        "public_url": download_url,
         "size_bytes": storage_object.size_bytes if storage_object else output_file.stat().st_size,
         "validation": output_validation,
     }
@@ -160,13 +148,14 @@ def render_study_video_preview(
     payload: dict[str, Any],
     *,
     video_id: str | None = None,
+    user_id: str | None = None,
     progress_callback: Callable[[int, str], None] | None = None,
 ) -> dict[str, Any]:
     settings = get_settings()
     video_id = video_id or prefixed_id("video")
     title = str(payload.get("title") or "DocDoe study video")
     slug = _slugify(title)
-    output_dir = settings.resolved_generated_video_output_dir
+    output_dir = settings.resolved_generated_video_output_dir / (user_id or "unowned")
     jobs_dir = settings.resolved_generated_video_jobs_dir
     job_dir = jobs_dir / video_id
     output_dir.mkdir(parents=True, exist_ok=True)
@@ -230,40 +219,28 @@ def render_study_video_preview(
         "preview_quality": True,
         "created_at": datetime.now(timezone.utc).isoformat(),
         "warnings": warnings,
-        "job_dir": str(job_dir),
         "output_validation": output_validation,
         "audio_stream_verified": output_validation["audio_stream"],
     }
 
     _notify(progress_callback, 90, "saving_preview_video")
     storage_object = None
-    download_url = f"/generated/videos/{output_file.name}"
+    download_url = f"/generated/videos/{output_file.parent.name}/{output_file.name}"
     requested_storage_provider = (settings.storage_provider or "local").strip().lower()
-    try:
-        storage_provider = get_storage_provider()
-        storage_object = storage_provider.upload_file(
-            output_file,
-            build_object_key(settings.storage_video_prefix, output_file.name),
-            content_type="video/mp4",
+    if requested_storage_provider != "local":
+        warnings.append(
+            "External public media storage is disabled; the preview remains behind DocDoe authorization."
         )
-        download_url = storage_object.public_url
-        metadata["storage"] = storage_object.model_dump()
-        if requested_storage_provider in {"r2", "s3"} and storage_object.provider == "local":
-            warnings.append("Cloud storage unavailable. Kept preview MP4 on local storage.")
-    except StorageProviderError as exc:
-        if requested_storage_provider in {"r2", "s3"}:
-            warnings.append("Cloud upload failed. Kept preview MP4 on local storage.")
-        logger.warning("Preview video storage upload failed: %s", _safe_storage_error(exc))
-        metadata["storage"] = None
+    metadata["storage"] = None
 
     metadata["warnings"] = warnings
     metadata_file.write_text(json.dumps(metadata, ensure_ascii=False, indent=2), encoding="utf-8")
 
-    metadata_url = f"/generated/videos/{metadata_file.name}"
+    metadata_url = f"/generated/videos/{metadata_file.parent.name}/{metadata_file.name}"
     return {
         "video_id": video_id,
         "status": "complete",
-        "file_path": f"/generated/videos/{output_file.name}",
+        "file_path": f"/generated/videos/{output_file.parent.name}/{output_file.name}",
         "download_url": download_url,
         "duration_seconds": duration_seconds,
         "render_provider": "remotion",
@@ -271,7 +248,7 @@ def render_study_video_preview(
         "metadata_path": metadata_url,
         "storage_provider": storage_object.provider if storage_object else "local",
         "output_object_key": storage_object.object_key if storage_object else None,
-        "public_url": storage_object.public_url if storage_object else download_url,
+        "public_url": download_url,
         "size_bytes": storage_object.size_bytes if storage_object else output_file.stat().st_size,
         "validation": output_validation,
     }

app/services/video_study_preview_renderer.py

@@ -172,6 +172,7 @@ def run_study_video_preview_render(job_id: str) -> None:
             result = render_study_video_preview(
                 preview_payload,
                 video_id=job.id,
+                user_id=job.user_id,
                 progress_callback=render_progress_callback,
             )
             render_duration_seconds = (

tests/conftest.py

@@ -27,7 +27,6 @@ KNOWN_PREEXISTING_XFAILS = {
     "tests/test_evidence_contract.py::TestAskEvidenceLabel::test_ask_no_source_returns_evidence_label",
     "tests/test_beta_health.py::test_response_does_not_contain_api_key_field_names",
     "tests/test_phase4_checkpoint4_ai_jobs.py::test_failed_validation_captures_error",
-    "tests/test_google_auth.py::test_google_callback_respects_beta_invite_gate",
     "tests/test_live_failure_regressions.py::test_chained_simple_explanation_routes_to_fast_provider_before_sarvam",
     "tests/test_live_failure_regressions.py::test_simple_explanation_fails_over_after_one_malformed_sarvam_response",
     "tests/test_live_failure_regressions.py::test_video_job_list_response_accepts_legacy_completed_records",
@@ -64,6 +63,9 @@ def _configure_test_runtime_env(db_path: Path) -> None:
     # not change behavior; prod-specific tests override this explicitly.
     os.environ["ENVIRONMENT"] = "development"
     os.environ["AUTH_ENABLED"] = "false"
+    os.environ["ALLOW_INSECURE_DEV_AUTH"] = "true"
+    os.environ["JWT_SECRET_KEY"] = "test-only-jwt-secret-that-is-at-least-32-characters"
+    os.environ["RATE_LIMIT_ENABLED"] = "false"
     os.environ["BETA_ACCESS_ENABLED"] = "false"
     os.environ["AI_PROVIDER"] = "mock"
     os.environ["AI_FALLBACK_TO_MOCK"] = "true"
@@ -158,6 +160,7 @@ def auth_client():
 
     # Restore dev defaults so subsequent test fixtures are not affected.
     os.environ["AUTH_ENABLED"] = "false"
+    os.environ["ALLOW_INSECURE_DEV_AUTH"] = "true"
     os.environ["AUTH_PROVIDER"] = "dev"
     os.environ["BETA_ACCESS_ENABLED"] = "false"
     os.environ.pop("BETA_INVITE_CODE", None)

tests/test_data_isolation.py

@@ -202,7 +202,7 @@ class TestBillingIsolation:
 # Beta invite gate
 # ---------------------------------------------------------------------------
 
-@pytest.mark.skip(
+@pytest.mark.skipif(False,
     reason="Invite gate was removed by design — signup is now open "
     "(see app/routes/auth.py signup: 'invite gate removed'). These tests assert "
     "obsolete behavior."

tests/test_google_auth.py

@@ -73,9 +73,13 @@ def test_google_callback_creates_user_and_returns_frontend_session(auth_client,
     )
 
     try:
-        state = auth_routes._create_google_state(next_path="/dashboard", invite_code=None)
+        nonce = "test-google-state-nonce"
+        state = auth_routes._create_google_state(
+            next_path="/dashboard", invite_code=None, nonce=nonce
+        )
         response = auth_client.get(
             f"/auth/google/callback?code=test-code&state={state}",
+            cookies={auth_routes.GOOGLE_STATE_COOKIE: nonce},
             follow_redirects=False,
         )
 
@@ -116,9 +120,13 @@ def test_google_callback_respects_beta_invite_gate(auth_client, monkeypatch):
     )
 
     try:
-        state = auth_routes._create_google_state(next_path="/onboarding", invite_code=None)
+        nonce = "test-google-state-nonce"
+        state = auth_routes._create_google_state(
+            next_path="/onboarding", invite_code=None, nonce=nonce
+        )
         response = auth_client.get(
             f"/auth/google/callback?code=test-code&state={state}",
+            cookies={auth_routes.GOOGLE_STATE_COOKIE: nonce},
             follow_redirects=False,
         )
 
@@ -130,3 +138,30 @@ def test_google_callback_respects_beta_invite_gate(auth_client, monkeypatch):
         os.environ["BETA_ACCESS_ENABLED"] = "false"
         os.environ.pop("BETA_INVITE_CODE", None)
         _clear_google_env()
+
+
+def test_google_callback_rejects_state_from_another_browser(auth_client, monkeypatch):
+    _set_google_env()
+
+    from app.routes import auth as auth_routes
+
+    monkeypatch.setattr(
+        auth_routes,
+        "_post_google_token",
+        lambda payload: (_ for _ in ()).throw(AssertionError("token exchange must not run")),
+    )
+    try:
+        state = auth_routes._create_google_state(
+            next_path="/dashboard", invite_code=None, nonce="browser-a"
+        )
+        response = auth_client.get(
+            f"/auth/google/callback?code=test-code&state={state}",
+            cookies={auth_routes.GOOGLE_STATE_COOKIE: "browser-b"},
+            follow_redirects=False,
+        )
+
+        assert response.status_code == 302
+        params = _fragment_params(response.headers["location"])
+        assert "expired" in params["error"].lower()
+    finally:
+        _clear_google_env()

tests/test_launch_blocker_security.py

@@ -109,7 +109,15 @@ def test_invalid_forged_jwt_not_trusted_for_rate_limit_key(monkeypatch):
         },
     )
 
-    assert _rate_limit_key(request) == "ip:203.0.113.44"
+    assert _rate_limit_key(request) == "ip:198.51.100.25"
+
+
+def test_rate_limit_ignores_client_supplied_forwarded_for() -> None:
+    from app.main import _rate_limit_key
+
+    request = _request_with_headers({"X-Forwarded-For": "203.0.113.99"})
+
+    assert _rate_limit_key(request) == "ip:198.51.100.25"
 
 
 def test_valid_jwt_is_trusted_for_rate_limit_key(monkeypatch):

tests/test_security_scan_regressions.py

@@ -0,0 +1,67 @@
+from __future__ import annotations
+
+
+def _signup(client, *, email: str) -> tuple[str, str]:
+    response = client.post(
+        "/auth/signup",
+        json={"name": "Security Test", "email": email, "password": "Pass123!beta"},
+    )
+    assert response.status_code == 201, response.text
+    body = response.json()
+    return body["access_token"], body["user"]["id"]
+
+
+def _auth(token: str) -> dict[str, str]:
+    return {"Authorization": f"Bearer {token}"}
+
+
+def test_generated_audio_requires_owner_authentication(auth_client, tmp_path, monkeypatch) -> None:
+    from app.core.config import get_settings
+
+    monkeypatch.setenv("TTS_OUTPUT_DIR", str(tmp_path / "audio"))
+    get_settings.cache_clear()
+    token_a, user_a = _signup(auth_client, email="media-owner@example.test")
+    token_b, _ = _signup(auth_client, email="media-other@example.test")
+
+    artifact = get_settings().resolved_tts_output_dir / user_a / "video_1" / "scene-001.wav"
+    artifact.parent.mkdir(parents=True, exist_ok=True)
+    artifact.write_bytes(b"private audio")
+    url = f"/generated/audio/{user_a}/video_1/scene-001.wav"
+
+    auth_client.cookies.clear()
+    assert auth_client.get(url).status_code == 401
+    assert auth_client.get(url, headers=_auth(token_a)).content == b"private audio"
+    assert auth_client.get(url, headers=_auth(token_b)).status_code == 404
+
+
+def test_signup_sets_http_only_media_cookie(auth_client) -> None:
+    response = auth_client.post(
+        "/auth/signup",
+        json={
+            "name": "Cookie Test",
+            "email": "media-cookie@example.test",
+            "password": "Pass123!beta",
+        },
+    )
+
+    assert response.status_code == 201
+    cookie = response.headers["set-cookie"].lower()
+    assert "docdoe_media_token=" in cookie
+    assert "httponly" in cookie
+    assert "path=/generated" in cookie
+
+
+def test_source_text_payload_has_a_bounded_size(auth_client) -> None:
+    token, _ = _signup(auth_client, email="bounded-source@example.test")
+
+    response = auth_client.post(
+        "/sources/text",
+        headers=_auth(token),
+        json={
+            "title": "Too large",
+            "text": "x" * 200_001,
+            "source_type": "notes",
+        },
+    )
+
+    assert response.status_code == 422

tests/test_study_video_preview_render.py

@@ -177,7 +177,9 @@ def _fake_tts_success(*, tmp_path: Path, calls: list[dict[str, Any]]):
 
 
 def _fake_render_success(calls: list[dict[str, Any]]):
-    def fake_render_study_video_preview(payload: dict[str, Any], *, video_id=None, progress_callback=None) -> dict[str, Any]:
+    def fake_render_study_video_preview(
+        payload: dict[str, Any], *, video_id=None, user_id=None, progress_callback=None
+    ) -> dict[str, Any]:
         calls.append(payload)
         if progress_callback:
             progress_callback(70, "rendering_preview_video")