Add comprehensive video support to galleries

This commit implements full video upload, storage, streaming, and playback functionality
for the PicPeak photo sharing platform, allowing users to upload and view videos alongside
photos in galleries.

Backend Changes:
- Added video processing dependencies (fluent-ffmpeg, @ffmpeg-installer/ffmpeg)
- Created videoProcessor.js service for video metadata extraction and thumbnail generation
- Updated photoProcessor.js to handle both images and videos
- Modified adminPhotos.js to accept video files with 500MB size limit
- Enhanced gallery.js with HTTP range request support for video streaming
- Expanded fileSecurityUtils.js with video MIME types and magic number validation
- Added database migration for video support columns (media_type, duration, codecs, dimensions)

Frontend Changes:
- Updated TypeScript types to include video metadata fields
- Created VideoPlayer.tsx component with custom controls
- Modified PhotoUpload.tsx to accept video files (.mp4, .webm, .mov, .avi)
- Updated UserPhotoUpload.tsx for guest video uploads
- Enhanced PhotoGrid.tsx with video badges and duration display
- Modified PhotoLightbox.tsx to conditionally render VideoPlayer for videos

Database Schema:
- Added media_type column ('image' | 'video')
- Added mime_type, duration, video_codec, audio_codec columns
- Added width and height columns for media dimensions
- Migrated existing photos to media_type 'image'

Features:
- Video thumbnail generation from video frames
- Streaming support with range requests for efficient playback
- Video duration display on thumbnails
- Play button indicators on video items
- Full-featured video player with playback controls
- Support for MP4, WebM, MOV, and AVI formats

backend/src/utils/fileSecurityUtils.js

@@ -45,7 +45,7 @@ function isPathSafe(filePath) {
 }
 
 /**
- * Enhanced MIME type validation
+ * Enhanced MIME type validation for images and videos
  */
 const ALLOWED_IMAGE_TYPES = {
   'image/jpeg': {
@@ -78,24 +78,43 @@ const ALLOWED_IMAGE_TYPES = {
     extensions: ['.svg'],
     // SVG files are XML-based text files, so we skip magic number validation
     magicNumbers: null
-  },
-  // Video types are included here to keep validation centralized
+  }
+};
+
+const ALLOWED_VIDEO_TYPES = {
   'video/mp4': {
-    extensions: ['.mp4'],
-    magicNumbers: null
-  },
-  'video/quicktime': {
-    extensions: ['.mov', '.qt'],
-    magicNumbers: null
+    extensions: ['.mp4', '.m4v'],
+    magicNumbers: [
+      { offset: 4, bytes: [0x66, 0x74, 0x79, 0x70] } // 'ftyp' signature for MP4
+    ]
   },
   'video/webm': {
     extensions: ['.webm'],
     magicNumbers: [
-      { offset: 0, bytes: [0x1A, 0x45, 0xDF, 0xA3] } // WebM/Matroska
+      { offset: 0, bytes: [0x1A, 0x45, 0xDF, 0xA3] } // EBML header for WebM/MKV
+    ]
+  },
+  'video/quicktime': {
+    extensions: ['.mov'],
+    magicNumbers: [
+      { offset: 4, bytes: [0x66, 0x74, 0x79, 0x70, 0x71, 0x74] } // 'ftypqt' signature for QuickTime
+    ]
+  },
+  'video/x-msvideo': {
+    extensions: ['.avi'],
+    magicNumbers: [
+      { offset: 0, bytes: [0x52, 0x49, 0x46, 0x46] }, // RIFF
+      { offset: 8, bytes: [0x41, 0x56, 0x49, 0x20] }  // 'AVI '
     ]
   }
 };
 
+// Combined media types
+const ALLOWED_MEDIA_TYPES = {
+  ...ALLOWED_IMAGE_TYPES,
+  ...ALLOWED_VIDEO_TYPES
+};
+
 /**
  * Validate file type by MIME type and extension
  * @param {string} filename - The filename
@@ -108,16 +127,16 @@ function validateFileType(filename, mimetype, allowedTypes) {
   if (!allowedTypes.includes(mimetype)) {
     return false;
   }
-  
+
   // Get file extension
   const ext = path.extname(filename).toLowerCase();
-  
+
   // Check if extension matches the MIME type
-  const typeConfig = ALLOWED_IMAGE_TYPES[mimetype];
+  const typeConfig = ALLOWED_MEDIA_TYPES[mimetype];
   if (!typeConfig || !typeConfig.extensions.includes(ext)) {
     return false;
   }
-  
+
   return true;
 }
 
@@ -129,22 +148,22 @@ function validateFileType(filename, mimetype, allowedTypes) {
  */
 async function validateFileContent(filePath, expectedMimeType) {
   try {
-    const typeConfig = ALLOWED_IMAGE_TYPES[expectedMimeType];
+    const typeConfig = ALLOWED_MEDIA_TYPES[expectedMimeType];
     if (!typeConfig) {
       return false;
     }
-    
+
     // Skip validation for file types without magic numbers (like SVG)
     if (!typeConfig.magicNumbers) {
       return true;
     }
-    
+
     // Read the first 20 bytes of the file (enough for most magic numbers)
     const buffer = Buffer.alloc(20);
     const fileHandle = await fs.open(filePath, 'r');
     await fileHandle.read(buffer, 0, 20, 0);
     await fileHandle.close();
-    
+
     // Check magic numbers
     return typeConfig.magicNumbers.every(magic => {
       for (let i = 0; i < magic.bytes.length; i++) {
@@ -169,36 +188,16 @@ function getSafeFilename(originalFilename) {
   const timestamp = Date.now();
   const randomString = Math.random().toString(36).substring(2, 15);
   const ext = path.extname(originalFilename).toLowerCase();
-  
-  // Validate extension
-  const validExtensions = ['.jpg', '.jpeg', '.png', '.webp', '.gif', '.svg', '.ico'];
+
+  // Validate extension - including both image and video extensions
+  const validExtensions = ['.jpg', '.jpeg', '.png', '.webp', '.gif', '.svg', '.ico', '.mp4', '.m4v', '.webm', '.mov', '.avi'];
   if (!validExtensions.includes(ext)) {
     throw new Error('Invalid file extension');
   }
-  
+
   return `upload_${timestamp}_${randomString}${ext}`;
 }
 
-function isVideoMimeType(mimeType, filename) {
-  const lowerMime = (mimeType || '').toLowerCase();
-  if (lowerMime.startsWith('video/')) {
-    return true;
-  }
-
-  const ext = filename ? path.extname(filename).toLowerCase() : '';
-  const videoExts = ['.mp4', '.mov', '.webm', '.m4v', '.qt'];
-
-  if (videoExts.includes(ext)) {
-    return true;
-  }
-
-  if (lowerMime === 'application/mp4' || lowerMime === 'application/x-m4v' || lowerMime === 'application/octet-stream') {
-    return videoExts.includes(ext) || true;
-  }
-
-  return false;
-}
-
 /**
  * Create a file upload validator middleware
  * @param {Object} options - Validation options
@@ -265,5 +264,6 @@ module.exports = {
   getSafeFilename,
   createFileUploadValidator,
   ALLOWED_IMAGE_TYPES,
-  isVideoMimeType
-};
+  ALLOWED_VIDEO_TYPES,
+  ALLOWED_MEDIA_TYPES
+};