apps/web/app/s/[videoId]/page.tsx (3)

117-133: Consider extracting the video query logic into a reusable function

The video query logic with space and organization joins is duplicated between generateMetadata and ShareVideoPage. This duplication could lead to maintenance issues if the query structure needs to be updated.

Consider extracting this into a shared function:

async function fetchVideoWithSharing(videoId: string) {
  return db()
    .select({
      id: videos.id,
      public: videos.public,
      name: videos.name,
      password: videos.password,
      ownerId: videos.ownerId,
      sharedOrganization: {
        organizationId: sharedVideos.organizationId,
      },
      spaceId: spaceVideos.spaceId,
      // ... other fields
    })
    .from(videos)
    .leftJoin(spaceVideos, eq(videos.id, spaceVideos.videoId))
    .leftJoin(sharedVideos, eq(videos.id, sharedVideos.videoId))
    .where(eq(videos.id, videoId));
}

---

147-158: Add null check before querying space membership

The space membership query could be optimized by checking if video.spaceId exists before making the database query. Currently, it always queries even when the video might not belong to a space.

- const [space] = await db()
-   .select({
-     isSpaceMember: spaceMembers.userId,
-   })
-   .from(spaceMembers)
-   .where(
-     and(
-       eq(spaceMembers.userId, user?.id ?? ""),
-       eq(spaceMembers.spaceId, video?.spaceId ?? ""),
-     ),
-   );
+ let space = null;
+ if (user?.id && video?.spaceId) {
+   [space] = await db()
+     .select({
+       isSpaceMember: spaceMembers.userId,
+     })
+     .from(spaceMembers)
+     .where(
+       and(
+         eq(spaceMembers.userId, user.id),
+         eq(spaceMembers.spaceId, video.spaceId),
+       ),
+     );
+ }

---

340-351: Duplicate space membership query logic

This is the same space membership query logic as in generateMetadata (lines 147-158). Consider extracting it into a reusable function to avoid duplication.

Create a helper function:

async function getUserSpaceMembership(userId: string | undefined, spaceId: string | null) {
  if (!userId || !spaceId) return null;
  
  const [space] = await db()
    .select({
      isSpaceMember: spaceMembers.userId,
    })
    .from(spaceMembers)
    .where(
      and(
        eq(spaceMembers.userId, userId),
        eq(spaceMembers.spaceId, spaceId),
      ),
    );
  
  return space;
}

Then use it in both locations:

const space = await getUserSpaceMembership(user?.id, video?.spaceId);

apps/web/utils/auth.ts (1)

44-45: Consider validating the spaceId value more explicitly

The current check const isVideoSharedWithSpace = videoOrgId && video.spaceId; will be truthy even if video.spaceId is an empty string. Consider being more explicit about checking for a valid space ID.

- const isVideoSharedWithSpace = videoOrgId && video.spaceId;
+ const isVideoSharedWithSpace = videoOrgId && video.spaceId && video.spaceId.length > 0;

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

apps/web/utils/auth.ts (2)

33-41: "All spaces" org-share shouldn’t depend on isSpaceMember (and currently denies access if it’s ever true).

For org-level “All spaces” sharing, space membership is irrelevant. Tying the check to !isSpaceMember both obscures intent and risks a false deny if the caller ever passes true in this scenario.

Consider simplifying to grant access purely based on org match.

- // If the video is shared and has no space id, it's in the "All spaces" entry
- const isVideoSharedWithAllSpaces = videoOrgId && video.spaceId === null;
- if (
-   !isSpaceMember &&
-   userActiveOrgId === videoOrgId &&
-   isVideoSharedWithAllSpaces
- ) {
-   return "has-access";
- }
+ // If the video is shared org-wide with "All spaces", space membership is irrelevant
+ const isVideoSharedWithAllSpaces = !!videoOrgId && video.spaceId === null;
+ if (userActiveOrgId === videoOrgId && isVideoSharedWithAllSpaces) {
+   return "has-access";
+ }

---

26-26: Return union includes "not-org-email" but code never returns it.

Either remove it from the return type or implement corresponding logic. Keeping dead variants complicates consumers.

-export async function userHasAccessToVideo( ... ): Promise<"has-access" | "private" | "needs-password" | "not-org-email"> {
+export async function userHasAccessToVideo( ... ): Promise<"has-access" | "private" | "needs-password"> {

apps/web/app/s/[videoId]/page.tsx (2)

40-62: Parallelize space/org sharing queries to cut latency.

Both queries are independent and can be run concurrently.

- // Fetch space-level sharing
- const spaceSharing = await db()
-   .select({
-     id: spaces.id,
-     name: spaces.name,
-     organizationId: spaces.organizationId,
-     iconUrl: organizations.iconUrl,
-   })
-   .from(spaceVideos)
-   .innerJoin(spaces, eq(spaceVideos.spaceId, spaces.id))
-   .innerJoin(organizations, eq(spaces.organizationId, organizations.id))
-   .where(eq(spaceVideos.videoId, videoId));
-
- // Fetch organization-level sharing
- const orgSharing = await db()
-   .select({
-     id: organizations.id,
-     name: organizations.name,
-     organizationId: organizations.id,
-     iconUrl: organizations.iconUrl,
-   })
-   .from(sharedVideos)
-   .innerJoin(organizations, eq(sharedVideos.organizationId, organizations.id))
-   .where(eq(sharedVideos.videoId, videoId));
+ const [spaceSharing, orgSharing] = await Promise.all([
+   db()
+     .select({
+       id: spaces.id,
+       name: spaces.name,
+       organizationId: spaces.organizationId,
+       iconUrl: organizations.iconUrl,
+     })
+     .from(spaceVideos)
+     .innerJoin(spaces, eq(spaceVideos.spaceId, spaces.id))
+     .innerJoin(organizations, eq(spaces.organizationId, organizations.id))
+     .where(eq(spaceVideos.videoId, videoId)),
+   db()
+     .select({
+       id: organizations.id,
+       name: organizations.name,
+       organizationId: organizations.id,
+       iconUrl: organizations.iconUrl,
+     })
+     .from(sharedVideos)
+     .innerJoin(organizations, eq(sharedVideos.organizationId, organizations.id))
+     .where(eq(sharedVideos.videoId, videoId)),
+ ]);

---

71-90: Potential duplicates in sharedSpaces; consider deduping or tagging type (space vs org).

If a video is linked to a space and also org-shared with the same org, UI may show redundant entries. Consider deduping by (type, id) or add a type: "space" | "org" field so consumers can distinguish.

If helpful, I can provide a small helper to uniq by (type, id).

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

apps/web/app/embed/[videoId]/page.tsx (1)

122-153: Left join can duplicate rows; first-row pick is non-deterministic (add limit or refactor).

Left-joining sharedVideos can produce multiple rows per video when shared to multiple orgs. Destructuring [video] then arbitrarily picks the first joined row, which can skew downstream logic (e.g., sharedOrganization). At minimum, add .limit(1) to reduce ambiguity and round-trips. Longer term: refactor to aggregate org shares or fetch them separately.

Apply this minimal diff:

                 .from(videos)
                 .leftJoin(sharedVideos, eq(videos.id, sharedVideos.videoId))
-                .where(eq(videos.id, videoId)),
+                .where(eq(videos.id, videoId))
+                .limit(1),

apps/web/app/s/[videoId]/page.tsx (1)

261-291: Left join can duplicate rows; first-row pick is non-deterministic (add limit or refactor).

Left-joining sharedVideos can yield multiple rows; destructuring [video] grabs an arbitrary org share. This can confuse UI and membership/organization-dependent rendering. Add .limit(1) or refactor to aggregate.

       .from(videos)
       .leftJoin(sharedVideos, eq(videos.id, sharedVideos.videoId))
-      .where(eq(videos.id, videoId)),
+      .where(eq(videos.id, videoId))
+      .limit(1),

apps/web/app/api/playlist/route.ts (1)

198-205: Consider deriving host for M3U8 URLs from the request instead of serverEnv().WEB_URL

Absolute URLs using WEB_URL can be brittle behind proxies, multiple domains, or preview environments. If feasible, generate relative URLs or derive the origin from the incoming request/headers for resilience.

packages/web-domain/src/Video.ts (1)

54-73: Optional: use a constant‑time comparison for passwords

To avoid timing side-channels, compare passwords in constant time. Consider injecting a domain-agnostic compare function (e.g., via a small service) and implementing it using Node crypto.timingSafeEqual at the edge.

apps/web/lib/server.ts (1)

40-47: Nit: VideosPolicy.Default is likely redundant in Dependencies

Videos.Default already depends on VideosPolicy.Default (see Videos service dependencies). Providing it again is unnecessary.

Minimal cleanup:

 export const Dependencies = Layer.mergeAll(
   S3Buckets.Default,
   Videos.Default,
-  VideosPolicy.Default,
   Folders.Default,
   TracingLayer,
 ).pipe(Layer.provideMerge(DatabaseLive));

apps/web/app/s/[videoId]/page.tsx (2)

30-35: Inconsistent import: use package root for VideosPolicy.

Importing from a deep path is brittle and bypasses package boundaries. Align with the other imports and use the root export.

Apply this diff:

-import { VideosPolicy } from "@cap/web-backend/src/Videos/VideosPolicy";
+import { VideosPolicy } from "@cap/web-backend";

---

123-131: Optional: prefer Effect.sync(notFound()) for clarity.

Inside Effect pipelines, returning notFound() (which throws) from onNone relies on implicit exception capture. Using Effect.sync(notFound()) is more explicit and mirrors your usage elsewhere in this file.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.