initial commit

internal/api/admin.go

@@ -0,0 +1,172 @@
+package api
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"fuego/internal/auth"
+	"fuego/pkg/types"
+)
+
+// handleGenerateRegistrationToken generates a new registration token
+func (s *Server) handleGenerateRegistrationToken(w http.ResponseWriter, r *http.Request) {
+	userID, err := getUserID(r)
+	if err != nil {
+		s.respondError(w, http.StatusUnauthorized, err.Error())
+		return
+	}
+
+	// Default expiration: 24 hours
+	expiresIn := 24 * time.Hour
+	
+	var req struct {
+		ExpiresInHours int `json:"expires_in_hours,omitempty"`
+	}
+	if r.Body != nil && r.ContentLength > 0 {
+		if err := json.NewDecoder(r.Body).Decode(&req); err == nil && req.ExpiresInHours > 0 {
+			expiresIn = time.Duration(req.ExpiresInHours) * time.Hour
+		}
+	}
+
+	token, err := s.secrets.GenerateRegistrationToken(userID, expiresIn)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to generate token: %v", err))
+		return
+	}
+
+	s.respondJSON(w, http.StatusCreated, map[string]interface{}{
+		"token":       token,
+		"expires_in":  expiresIn.String(),
+		"expires_at":  time.Now().Add(expiresIn),
+	})
+}
+
+// handleListRegistrationTokens lists all registration tokens
+func (s *Server) handleListRegistrationTokens(w http.ResponseWriter, r *http.Request) {
+	tokens, err := s.secrets.ListRegistrationTokens()
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to list tokens: %v", err))
+		return
+	}
+
+	s.respondJSON(w, http.StatusOK, tokens)
+}
+
+// handleRevokeRegistrationToken revokes a registration token
+func (s *Server) handleRevokeRegistrationToken(w http.ResponseWriter, r *http.Request) {
+	tokenID, err := parseID(r, "id")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	if err := s.secrets.RevokeRegistrationToken(tokenID); err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to revoke token: %v", err))
+		return
+	}
+
+	s.respondJSON(w, http.StatusOK, map[string]string{"message": "Token revoked"})
+}
+
+// handleVerifyRunner manually verifies a runner
+func (s *Server) handleVerifyRunner(w http.ResponseWriter, r *http.Request) {
+	runnerID, err := parseID(r, "id")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	// Check if runner exists
+	var exists bool
+	err = s.db.QueryRow("SELECT EXISTS(SELECT 1 FROM runners WHERE id = ?)", runnerID).Scan(&exists)
+	if err != nil || !exists {
+		s.respondError(w, http.StatusNotFound, "Runner not found")
+		return
+	}
+
+	// Mark runner as verified
+	_, err = s.db.Exec("UPDATE runners SET verified = 1 WHERE id = ?", runnerID)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to verify runner: %v", err))
+		return
+	}
+
+	s.respondJSON(w, http.StatusOK, map[string]string{"message": "Runner verified"})
+}
+
+// handleDeleteRunner removes a runner
+func (s *Server) handleDeleteRunner(w http.ResponseWriter, r *http.Request) {
+	runnerID, err := parseID(r, "id")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	// Check if runner exists
+	var exists bool
+	err = s.db.QueryRow("SELECT EXISTS(SELECT 1 FROM runners WHERE id = ?)", runnerID).Scan(&exists)
+	if err != nil || !exists {
+		s.respondError(w, http.StatusNotFound, "Runner not found")
+		return
+	}
+
+	// Delete runner
+	_, err = s.db.Exec("DELETE FROM runners WHERE id = ?", runnerID)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to delete runner: %v", err))
+		return
+	}
+
+	s.respondJSON(w, http.StatusOK, map[string]string{"message": "Runner deleted"})
+}
+
+// handleListRunnersAdmin lists all runners with admin details
+func (s *Server) handleListRunnersAdmin(w http.ResponseWriter, r *http.Request) {
+	rows, err := s.db.Query(
+		`SELECT id, name, hostname, ip_address, status, last_heartbeat, capabilities, 
+		 registration_token, verified, created_at 
+		 FROM runners ORDER BY created_at DESC`,
+	)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to query runners: %v", err))
+		return
+	}
+	defer rows.Close()
+
+	runners := []map[string]interface{}{}
+	for rows.Next() {
+		var runner types.Runner
+		var registrationToken sql.NullString
+		var verified bool
+
+		err := rows.Scan(
+			&runner.ID, &runner.Name, &runner.Hostname, &runner.IPAddress,
+			&runner.Status, &runner.LastHeartbeat, &runner.Capabilities,
+			&registrationToken, &verified, &runner.CreatedAt,
+		)
+		if err != nil {
+			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to scan runner: %v", err))
+			return
+		}
+
+		runners = append(runners, map[string]interface{}{
+			"id":                 runner.ID,
+			"name":               runner.Name,
+			"hostname":           runner.Hostname,
+			"ip_address":         runner.IPAddress,
+			"status":             runner.Status,
+			"last_heartbeat":     runner.LastHeartbeat,
+			"capabilities":       runner.Capabilities,
+			"registration_token": registrationToken.String,
+			"verified":           verified,
+			"created_at":         runner.CreatedAt,
+		})
+	}
+
+	s.respondJSON(w, http.StatusOK, runners)
+}
+

internal/api/jobs.go

@@ -0,0 +1,498 @@
+package api
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+
+	"fuego/pkg/types"
+)
+
+// handleCreateJob creates a new job
+func (s *Server) handleCreateJob(w http.ResponseWriter, r *http.Request) {
+	userID, err := getUserID(r)
+	if err != nil {
+		s.respondError(w, http.StatusUnauthorized, err.Error())
+		return
+	}
+
+	var req types.CreateJobRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		s.respondError(w, http.StatusBadRequest, "Invalid request body")
+		return
+	}
+
+	if req.Name == "" {
+		s.respondError(w, http.StatusBadRequest, "Job name is required")
+		return
+	}
+
+	if req.FrameStart < 0 || req.FrameEnd < req.FrameStart {
+		s.respondError(w, http.StatusBadRequest, "Invalid frame range")
+		return
+	}
+
+	if req.OutputFormat == "" {
+		req.OutputFormat = "PNG"
+	}
+
+	result, err := s.db.Exec(
+		`INSERT INTO jobs (user_id, name, status, progress, frame_start, frame_end, output_format) 
+		 VALUES (?, ?, ?, ?, ?, ?, ?)`,
+		userID, req.Name, types.JobStatusPending, 0.0, req.FrameStart, req.FrameEnd, req.OutputFormat,
+	)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to create job: %v", err))
+		return
+	}
+
+	jobID, _ := result.LastInsertId()
+
+	// Create tasks for the job (one task per frame for simplicity, could be batched)
+	for frame := req.FrameStart; frame <= req.FrameEnd; frame++ {
+		_, err = s.db.Exec(
+			`INSERT INTO tasks (job_id, frame_start, frame_end, status) VALUES (?, ?, ?, ?)`,
+			jobID, frame, frame, types.TaskStatusPending,
+		)
+		if err != nil {
+			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to create tasks: %v", err))
+			return
+		}
+	}
+
+	job := types.Job{
+		ID:           jobID,
+		UserID:       userID,
+		Name:         req.Name,
+		Status:       types.JobStatusPending,
+		Progress:     0.0,
+		FrameStart:   req.FrameStart,
+		FrameEnd:     req.FrameEnd,
+		OutputFormat: req.OutputFormat,
+		CreatedAt:    time.Now(),
+	}
+
+	s.respondJSON(w, http.StatusCreated, job)
+}
+
+// handleListJobs lists jobs for the current user
+func (s *Server) handleListJobs(w http.ResponseWriter, r *http.Request) {
+	userID, err := getUserID(r)
+	if err != nil {
+		s.respondError(w, http.StatusUnauthorized, err.Error())
+		return
+	}
+
+	rows, err := s.db.Query(
+		`SELECT id, user_id, name, status, progress, frame_start, frame_end, output_format, 
+		 created_at, started_at, completed_at, error_message 
+		 FROM jobs WHERE user_id = ? ORDER BY created_at DESC`,
+		userID,
+	)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to query jobs: %v", err))
+		return
+	}
+	defer rows.Close()
+
+	jobs := []types.Job{}
+	for rows.Next() {
+		var job types.Job
+		var startedAt, completedAt sql.NullTime
+
+		err := rows.Scan(
+			&job.ID, &job.UserID, &job.Name, &job.Status, &job.Progress,
+			&job.FrameStart, &job.FrameEnd, &job.OutputFormat,
+			&job.CreatedAt, &startedAt, &completedAt, &job.ErrorMessage,
+		)
+		if err != nil {
+			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to scan job: %v", err))
+			return
+		}
+
+		if startedAt.Valid {
+			job.StartedAt = &startedAt.Time
+		}
+		if completedAt.Valid {
+			job.CompletedAt = &completedAt.Time
+		}
+
+		jobs = append(jobs, job)
+	}
+
+	s.respondJSON(w, http.StatusOK, jobs)
+}
+
+// handleGetJob gets a specific job
+func (s *Server) handleGetJob(w http.ResponseWriter, r *http.Request) {
+	userID, err := getUserID(r)
+	if err != nil {
+		s.respondError(w, http.StatusUnauthorized, err.Error())
+		return
+	}
+
+	jobID, err := parseID(r, "id")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	var job types.Job
+	var startedAt, completedAt sql.NullTime
+
+	err = s.db.QueryRow(
+		`SELECT id, user_id, name, status, progress, frame_start, frame_end, output_format,
+		 created_at, started_at, completed_at, error_message
+		 FROM jobs WHERE id = ? AND user_id = ?`,
+		jobID, userID,
+	).Scan(
+		&job.ID, &job.UserID, &job.Name, &job.Status, &job.Progress,
+		&job.FrameStart, &job.FrameEnd, &job.OutputFormat,
+		&job.CreatedAt, &startedAt, &completedAt, &job.ErrorMessage,
+	)
+
+	if err == sql.ErrNoRows {
+		s.respondError(w, http.StatusNotFound, "Job not found")
+		return
+	}
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to query job: %v", err))
+		return
+	}
+
+	if startedAt.Valid {
+		job.StartedAt = &startedAt.Time
+	}
+	if completedAt.Valid {
+		job.CompletedAt = &completedAt.Time
+	}
+
+	s.respondJSON(w, http.StatusOK, job)
+}
+
+// handleCancelJob cancels a job
+func (s *Server) handleCancelJob(w http.ResponseWriter, r *http.Request) {
+	userID, err := getUserID(r)
+	if err != nil {
+		s.respondError(w, http.StatusUnauthorized, err.Error())
+		return
+	}
+
+	jobID, err := parseID(r, "id")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	result, err := s.db.Exec(
+		`UPDATE jobs SET status = ? WHERE id = ? AND user_id = ?`,
+		types.JobStatusCancelled, jobID, userID,
+	)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to cancel job: %v", err))
+		return
+	}
+
+	rowsAffected, _ := result.RowsAffected()
+	if rowsAffected == 0 {
+		s.respondError(w, http.StatusNotFound, "Job not found")
+		return
+	}
+
+	// Cancel pending tasks
+	_, err = s.db.Exec(
+		`UPDATE tasks SET status = ? WHERE job_id = ? AND status = ?`,
+		types.TaskStatusFailed, jobID, types.TaskStatusPending,
+	)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to cancel tasks: %v", err))
+		return
+	}
+
+	s.respondJSON(w, http.StatusOK, map[string]string{"message": "Job cancelled"})
+}
+
+// handleUploadJobFile handles file upload for a job
+func (s *Server) handleUploadJobFile(w http.ResponseWriter, r *http.Request) {
+	userID, err := getUserID(r)
+	if err != nil {
+		s.respondError(w, http.StatusUnauthorized, err.Error())
+		return
+	}
+
+	jobID, err := parseID(r, "id")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	// Verify job belongs to user
+	var jobUserID int64
+	err = s.db.QueryRow("SELECT user_id FROM jobs WHERE id = ?", jobID).Scan(&jobUserID)
+	if err == sql.ErrNoRows {
+		s.respondError(w, http.StatusNotFound, "Job not found")
+		return
+	}
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to verify job: %v", err))
+		return
+	}
+	if jobUserID != userID {
+		s.respondError(w, http.StatusForbidden, "Access denied")
+		return
+	}
+
+	// Parse multipart form
+	err = r.ParseMultipartForm(100 << 20) // 100 MB
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, "Failed to parse form")
+		return
+	}
+
+	file, header, err := r.FormFile("file")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, "No file provided")
+		return
+	}
+	defer file.Close()
+
+	// Save file
+	filePath, err := s.storage.SaveUpload(jobID, header.Filename, file)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to save file: %v", err))
+		return
+	}
+
+	// Record in database
+	result, err := s.db.Exec(
+		`INSERT INTO job_files (job_id, file_type, file_path, file_name, file_size) 
+		 VALUES (?, ?, ?, ?, ?)`,
+		jobID, types.JobFileTypeInput, filePath, header.Filename, header.Size,
+	)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to record file: %v", err))
+		return
+	}
+
+	fileID, _ := result.LastInsertId()
+
+	s.respondJSON(w, http.StatusCreated, map[string]interface{}{
+		"id":       fileID,
+		"file_name": header.Filename,
+		"file_path": filePath,
+		"file_size": header.Size,
+	})
+}
+
+// handleListJobFiles lists files for a job
+func (s *Server) handleListJobFiles(w http.ResponseWriter, r *http.Request) {
+	userID, err := getUserID(r)
+	if err != nil {
+		s.respondError(w, http.StatusUnauthorized, err.Error())
+		return
+	}
+
+	jobID, err := parseID(r, "id")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	// Verify job belongs to user
+	var jobUserID int64
+	err = s.db.QueryRow("SELECT user_id FROM jobs WHERE id = ?", jobID).Scan(&jobUserID)
+	if err == sql.ErrNoRows {
+		s.respondError(w, http.StatusNotFound, "Job not found")
+		return
+	}
+	if jobUserID != userID {
+		s.respondError(w, http.StatusForbidden, "Access denied")
+		return
+	}
+
+	rows, err := s.db.Query(
+		`SELECT id, job_id, file_type, file_path, file_name, file_size, created_at 
+		 FROM job_files WHERE job_id = ? ORDER BY created_at DESC`,
+		jobID,
+	)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to query files: %v", err))
+		return
+	}
+	defer rows.Close()
+
+	files := []types.JobFile{}
+	for rows.Next() {
+		var file types.JobFile
+		err := rows.Scan(
+			&file.ID, &file.JobID, &file.FileType, &file.FilePath,
+			&file.FileName, &file.FileSize, &file.CreatedAt,
+		)
+		if err != nil {
+			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to scan file: %v", err))
+			return
+		}
+		files = append(files, file)
+	}
+
+	s.respondJSON(w, http.StatusOK, files)
+}
+
+// handleDownloadJobFile downloads a job file
+func (s *Server) handleDownloadJobFile(w http.ResponseWriter, r *http.Request) {
+	userID, err := getUserID(r)
+	if err != nil {
+		s.respondError(w, http.StatusUnauthorized, err.Error())
+		return
+	}
+
+	jobID, err := parseID(r, "id")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	fileID, err := parseID(r, "fileId")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	// Verify job belongs to user
+	var jobUserID int64
+	err = s.db.QueryRow("SELECT user_id FROM jobs WHERE id = ?", jobID).Scan(&jobUserID)
+	if err == sql.ErrNoRows {
+		s.respondError(w, http.StatusNotFound, "Job not found")
+		return
+	}
+	if jobUserID != userID {
+		s.respondError(w, http.StatusForbidden, "Access denied")
+		return
+	}
+
+	// Get file info
+	var filePath, fileName string
+	err = s.db.QueryRow(
+		`SELECT file_path, file_name FROM job_files WHERE id = ? AND job_id = ?`,
+		fileID, jobID,
+	).Scan(&filePath, &fileName)
+	if err == sql.ErrNoRows {
+		s.respondError(w, http.StatusNotFound, "File not found")
+		return
+	}
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to query file: %v", err))
+		return
+	}
+
+	// Open file
+	file, err := s.storage.GetFile(filePath)
+	if err != nil {
+		s.respondError(w, http.StatusNotFound, "File not found on disk")
+		return
+	}
+	defer file.Close()
+
+	// Set headers
+	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%s", fileName))
+	w.Header().Set("Content-Type", "application/octet-stream")
+
+	// Stream file
+	io.Copy(w, file)
+}
+
+// handleStreamVideo streams MP4 video file with range support
+func (s *Server) handleStreamVideo(w http.ResponseWriter, r *http.Request) {
+	userID, err := getUserID(r)
+	if err != nil {
+		s.respondError(w, http.StatusUnauthorized, err.Error())
+		return
+	}
+
+	jobID, err := parseID(r, "id")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	// Verify job belongs to user
+	var jobUserID int64
+	var outputFormat string
+	err = s.db.QueryRow("SELECT user_id, output_format FROM jobs WHERE id = ?", jobID).Scan(&jobUserID, &outputFormat)
+	if err == sql.ErrNoRows {
+		s.respondError(w, http.StatusNotFound, "Job not found")
+		return
+	}
+	if jobUserID != userID {
+		s.respondError(w, http.StatusForbidden, "Access denied")
+		return
+	}
+
+	// Find MP4 file
+	var filePath, fileName string
+	err = s.db.QueryRow(
+		`SELECT file_path, file_name FROM job_files 
+		 WHERE job_id = ? AND file_type = ? AND file_name LIKE '%.mp4' 
+		 ORDER BY created_at DESC LIMIT 1`,
+		jobID, types.JobFileTypeOutput,
+	).Scan(&filePath, &fileName)
+	if err == sql.ErrNoRows {
+		s.respondError(w, http.StatusNotFound, "Video file not found")
+		return
+	}
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to query file: %v", err))
+		return
+	}
+
+	// Open file
+	file, err := s.storage.GetFile(filePath)
+	if err != nil {
+		s.respondError(w, http.StatusNotFound, "File not found on disk")
+		return
+	}
+	defer file.Close()
+
+	// Get file info
+	fileInfo, err := file.Stat()
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, "Failed to get file info")
+		return
+	}
+
+	fileSize := fileInfo.Size()
+
+	// Handle range requests for video seeking
+	rangeHeader := r.Header.Get("Range")
+	if rangeHeader != "" {
+		// Parse range header
+		var start, end int64
+		fmt.Sscanf(rangeHeader, "bytes=%d-%d", &start, &end)
+		if end == 0 {
+			end = fileSize - 1
+		}
+
+		// Seek to start position
+		file.Seek(start, 0)
+
+		// Set headers for partial content
+		w.Header().Set("Content-Range", fmt.Sprintf("bytes %d-%d/%d", start, end, fileSize))
+		w.Header().Set("Accept-Ranges", "bytes")
+		w.Header().Set("Content-Length", fmt.Sprintf("%d", end-start+1))
+		w.Header().Set("Content-Type", "video/mp4")
+		w.WriteHeader(http.StatusPartialContent)
+
+		// Copy partial content
+		io.CopyN(w, file, end-start+1)
+	} else {
+		// Full file
+		w.Header().Set("Content-Type", "video/mp4")
+		w.Header().Set("Content-Length", fmt.Sprintf("%d", fileSize))
+		w.Header().Set("Accept-Ranges", "bytes")
+		io.Copy(w, file)
+	}
+}
+

internal/api/runners.go

@@ -0,0 +1,582 @@
+package api
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"fuego/internal/auth"
+	"fuego/pkg/types"
+)
+
+// handleListRunners lists all runners
+func (s *Server) handleListRunners(w http.ResponseWriter, r *http.Request) {
+	_, err := getUserID(r)
+	if err != nil {
+		s.respondError(w, http.StatusUnauthorized, err.Error())
+		return
+	}
+
+	rows, err := s.db.Query(
+		`SELECT id, name, hostname, ip_address, status, last_heartbeat, capabilities, created_at 
+		 FROM runners ORDER BY created_at DESC`,
+	)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to query runners: %v", err))
+		return
+	}
+	defer rows.Close()
+
+	runners := []types.Runner{}
+	for rows.Next() {
+		var runner types.Runner
+		err := rows.Scan(
+			&runner.ID, &runner.Name, &runner.Hostname, &runner.IPAddress,
+			&runner.Status, &runner.LastHeartbeat, &runner.Capabilities, &runner.CreatedAt,
+		)
+		if err != nil {
+			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to scan runner: %v", err))
+			return
+		}
+		runners = append(runners, runner)
+	}
+
+	s.respondJSON(w, http.StatusOK, runners)
+}
+
+// runnerAuthMiddleware verifies runner requests using HMAC signatures
+func (s *Server) runnerAuthMiddleware(next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		// Get runner ID from query string
+		runnerIDStr := r.URL.Query().Get("runner_id")
+		if runnerIDStr == "" {
+			s.respondError(w, http.StatusBadRequest, "runner_id required in query string")
+			return
+		}
+
+		var runnerID int64
+		_, err := fmt.Sscanf(runnerIDStr, "%d", &runnerID)
+		if err != nil {
+			s.respondError(w, http.StatusBadRequest, "invalid runner_id")
+			return
+		}
+
+		// Get runner secret
+		runnerSecret, err := s.secrets.GetRunnerSecret(runnerID)
+		if err != nil {
+			s.respondError(w, http.StatusUnauthorized, "runner not found or not verified")
+			return
+		}
+
+		// Verify request signature
+		valid, err := auth.VerifyRequest(r, runnerSecret, 5*time.Minute)
+		if err != nil || !valid {
+			s.respondError(w, http.StatusUnauthorized, "invalid signature")
+			return
+		}
+
+		// Add runner ID to context
+		ctx := r.Context()
+		ctx = context.WithValue(ctx, "runner_id", runnerID)
+		next(w, r.WithContext(ctx))
+	}
+}
+
+// handleRegisterRunner registers a new runner
+func (s *Server) handleRegisterRunner(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		types.RegisterRunnerRequest
+		RegistrationToken string `json:"registration_token"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		s.respondError(w, http.StatusBadRequest, "Invalid request body")
+		return
+	}
+
+	if req.Name == "" {
+		s.respondError(w, http.StatusBadRequest, "Runner name is required")
+		return
+	}
+
+	if req.RegistrationToken == "" {
+		s.respondError(w, http.StatusBadRequest, "Registration token is required")
+		return
+	}
+
+	// Validate registration token
+	valid, err := s.secrets.ValidateRegistrationToken(req.RegistrationToken)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to validate token: %v", err))
+		return
+	}
+	if !valid {
+		s.respondError(w, http.StatusUnauthorized, "Invalid or expired registration token")
+		return
+	}
+
+	// Get manager secret
+	managerSecret, err := s.secrets.GetManagerSecret()
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, "Failed to get manager secret")
+		return
+	}
+
+	// Generate runner secret
+	runnerSecret, err := s.secrets.GenerateRunnerSecret()
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, "Failed to generate runner secret")
+		return
+	}
+
+	// Register runner
+	result, err := s.db.Exec(
+		`INSERT INTO runners (name, hostname, ip_address, status, last_heartbeat, capabilities, 
+		 registration_token, runner_secret, manager_secret, verified) 
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		req.Name, req.Hostname, req.IPAddress, types.RunnerStatusOnline, time.Now(), req.Capabilities,
+		req.RegistrationToken, runnerSecret, managerSecret, true,
+	)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to register runner: %v", err))
+		return
+	}
+
+	runnerID, _ := result.LastInsertId()
+
+	// Return runner info with secrets
+	s.respondJSON(w, http.StatusCreated, map[string]interface{}{
+		"id":             runnerID,
+		"name":           req.Name,
+		"hostname":      req.Hostname,
+		"ip_address":    req.IPAddress,
+		"status":        types.RunnerStatusOnline,
+		"runner_secret": runnerSecret,
+		"manager_secret": managerSecret,
+		"verified":      true,
+	})
+}
+
+// handleRunnerHeartbeat updates runner heartbeat
+func (s *Server) handleRunnerHeartbeat(w http.ResponseWriter, r *http.Request) {
+	runnerID, ok := r.Context().Value("runner_id").(int64)
+	if !ok {
+		s.respondError(w, http.StatusBadRequest, "runner_id not found in context")
+		return
+	}
+
+	_, err := s.db.Exec(
+		`UPDATE runners SET last_heartbeat = ?, status = ? WHERE id = ?`,
+		time.Now(), types.RunnerStatusOnline, runnerID,
+	)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to update heartbeat: %v", err))
+		return
+	}
+
+	s.respondJSON(w, http.StatusOK, map[string]string{"message": "Heartbeat updated"})
+}
+
+// handleGetRunnerTasks gets pending tasks for a runner
+func (s *Server) handleGetRunnerTasks(w http.ResponseWriter, r *http.Request) {
+	runnerID, ok := r.Context().Value("runner_id").(int64)
+	if !ok {
+		s.respondError(w, http.StatusBadRequest, "runner_id not found in context")
+		return
+	}
+
+	// Get pending tasks
+	rows, err := s.db.Query(
+		`SELECT t.id, t.job_id, t.runner_id, t.frame_start, t.frame_end, t.status, t.output_path,
+		 t.created_at, t.started_at, t.completed_at, t.error_message,
+		 j.name as job_name, j.output_format
+		 FROM tasks t
+		 JOIN jobs j ON t.job_id = j.id
+		 WHERE t.status = ? AND j.status != ?
+		 ORDER BY t.created_at ASC
+		 LIMIT 10`,
+		types.TaskStatusPending, types.JobStatusCancelled,
+	)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to query tasks: %v", err))
+		return
+	}
+	defer rows.Close()
+
+	tasks := []map[string]interface{}{}
+	for rows.Next() {
+		var task types.Task
+		var runnerID sql.NullInt64
+		var startedAt, completedAt sql.NullTime
+		var jobName, outputFormat string
+
+		err := rows.Scan(
+			&task.ID, &task.JobID, &runnerID, &task.FrameStart, &task.FrameEnd,
+			&task.Status, &task.OutputPath, &task.CreatedAt,
+			&startedAt, &completedAt, &task.ErrorMessage,
+			&jobName, &outputFormat,
+		)
+		if err != nil {
+			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to scan task: %v", err))
+			return
+		}
+
+		if runnerID.Valid {
+			task.RunnerID = &runnerID.Int64
+		}
+		if startedAt.Valid {
+			task.StartedAt = &startedAt.Time
+		}
+		if completedAt.Valid {
+			task.CompletedAt = &completedAt.Time
+		}
+
+		// Get input files for the job
+		var inputFiles []string
+		fileRows, err := s.db.Query(
+			`SELECT file_path FROM job_files WHERE job_id = ? AND file_type = ?`,
+			task.JobID, types.JobFileTypeInput,
+		)
+		if err == nil {
+			for fileRows.Next() {
+				var filePath string
+				if err := fileRows.Scan(&filePath); err == nil {
+					inputFiles = append(inputFiles, filePath)
+				}
+			}
+			fileRows.Close()
+		}
+
+		tasks = append(tasks, map[string]interface{}{
+			"task":         task,
+			"job_name":     jobName,
+			"output_format": outputFormat,
+			"input_files":  inputFiles,
+		})
+
+		// Assign task to runner
+		_, err = s.db.Exec(
+			`UPDATE tasks SET runner_id = ?, status = ? WHERE id = ?`,
+			runnerID, types.TaskStatusRunning, task.ID,
+		)
+		if err != nil {
+			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to assign task: %v", err))
+			return
+		}
+	}
+
+	s.respondJSON(w, http.StatusOK, tasks)
+}
+
+// handleCompleteTask marks a task as completed
+func (s *Server) handleCompleteTask(w http.ResponseWriter, r *http.Request) {
+	taskID, err := parseID(r, "id")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	var req struct {
+		OutputPath string `json:"output_path"`
+		Success    bool   `json:"success"`
+		Error      string `json:"error,omitempty"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		s.respondError(w, http.StatusBadRequest, "Invalid request body")
+		return
+	}
+
+	status := types.TaskStatusCompleted
+	if !req.Success {
+		status = types.TaskStatusFailed
+	}
+
+	now := time.Now()
+	_, err = s.db.Exec(
+		`UPDATE tasks SET status = ?, output_path = ?, completed_at = ?, error_message = ? WHERE id = ?`,
+		status, req.OutputPath, now, req.Error, taskID,
+	)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to update task: %v", err))
+		return
+	}
+
+	// Update job progress
+	var jobID int64
+	var frameStart, frameEnd int
+	err = s.db.QueryRow(
+		`SELECT job_id, frame_start, frame_end FROM tasks WHERE id = ?`,
+		taskID,
+	).Scan(&jobID, &frameStart, &frameEnd)
+	if err == nil {
+		// Count completed tasks
+		var totalTasks, completedTasks int
+		s.db.QueryRow(
+			`SELECT COUNT(*) FROM tasks WHERE job_id = ?`,
+			jobID,
+		).Scan(&totalTasks)
+		s.db.QueryRow(
+			`SELECT COUNT(*) FROM tasks WHERE job_id = ? AND status = ?`,
+			jobID, types.TaskStatusCompleted,
+		).Scan(&completedTasks)
+
+		progress := float64(completedTasks) / float64(totalTasks) * 100.0
+
+		// Update job status
+		var jobStatus string
+		var outputFormat string
+		s.db.QueryRow(`SELECT output_format FROM jobs WHERE id = ?`, jobID).Scan(&outputFormat)
+		
+		if completedTasks == totalTasks {
+			jobStatus = string(types.JobStatusCompleted)
+			now := time.Now()
+			s.db.Exec(
+				`UPDATE jobs SET status = ?, progress = ?, completed_at = ? WHERE id = ?`,
+				jobStatus, progress, now, jobID,
+			)
+			
+			// For MP4 jobs, create a video generation task
+			if outputFormat == "MP4" {
+				go s.generateMP4Video(jobID)
+			}
+		} else {
+			jobStatus = string(types.JobStatusRunning)
+			var startedAt sql.NullTime
+			s.db.QueryRow(`SELECT started_at FROM jobs WHERE id = ?`, jobID).Scan(&startedAt)
+			if !startedAt.Valid {
+				now := time.Now()
+				s.db.Exec(`UPDATE jobs SET started_at = ? WHERE id = ?`, now, jobID)
+			}
+			s.db.Exec(
+				`UPDATE jobs SET status = ?, progress = ? WHERE id = ?`,
+				jobStatus, progress, jobID,
+			)
+		}
+	}
+
+	s.respondJSON(w, http.StatusOK, map[string]string{"message": "Task completed"})
+}
+
+// handleUpdateTaskProgress updates task progress
+func (s *Server) handleUpdateTaskProgress(w http.ResponseWriter, r *http.Request) {
+	_, err := parseID(r, "id")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	var req struct {
+		Progress float64 `json:"progress"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		s.respondError(w, http.StatusBadRequest, "Invalid request body")
+		return
+	}
+
+	// This is mainly for logging/debugging, actual progress is calculated from completed tasks
+	s.respondJSON(w, http.StatusOK, map[string]string{"message": "Progress updated"})
+}
+
+// handleDownloadFileForRunner allows runners to download job files
+func (s *Server) handleDownloadFileForRunner(w http.ResponseWriter, r *http.Request) {
+	jobID, err := parseID(r, "jobId")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	fileName := chi.URLParam(r, "fileName")
+
+	// Find the file in the database
+	var filePath string
+	err = s.db.QueryRow(
+		`SELECT file_path FROM job_files WHERE job_id = ? AND file_name = ?`,
+		jobID, fileName,
+	).Scan(&filePath)
+	if err == sql.ErrNoRows {
+		s.respondError(w, http.StatusNotFound, "File not found")
+		return
+	}
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to query file: %v", err))
+		return
+	}
+
+	// Open and serve file
+	file, err := s.storage.GetFile(filePath)
+	if err != nil {
+		s.respondError(w, http.StatusNotFound, "File not found on disk")
+		return
+	}
+	defer file.Close()
+
+	w.Header().Set("Content-Type", "application/octet-stream")
+	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%s", fileName))
+	io.Copy(w, file)
+}
+
+// handleUploadFileFromRunner allows runners to upload output files
+func (s *Server) handleUploadFileFromRunner(w http.ResponseWriter, r *http.Request) {
+	jobID, err := parseID(r, "jobId")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	err = r.ParseMultipartForm(100 << 20) // 100 MB
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, "Failed to parse form")
+		return
+	}
+
+	file, header, err := r.FormFile("file")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, "No file provided")
+		return
+	}
+	defer file.Close()
+
+	// Save file
+	filePath, err := s.storage.SaveOutput(jobID, header.Filename, file)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to save file: %v", err))
+		return
+	}
+
+	// Record in database
+	_, err = s.db.Exec(
+		`INSERT INTO job_files (job_id, file_type, file_path, file_name, file_size) 
+		 VALUES (?, ?, ?, ?, ?)`,
+		jobID, types.JobFileTypeOutput, filePath, header.Filename, header.Size,
+	)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to record file: %v", err))
+		return
+	}
+
+	s.respondJSON(w, http.StatusCreated, map[string]interface{}{
+		"file_path": filePath,
+		"file_name": header.Filename,
+	})
+}
+
+// generateMP4Video generates MP4 video from PNG frames for a completed job
+func (s *Server) generateMP4Video(jobID int64) {
+	// This would be called by a runner or external process
+	// For now, we'll create a special task that runners can pick up
+	// In a production system, you might want to use a job queue or have a dedicated video processor
+	
+	// Get all PNG output files for this job
+	rows, err := s.db.Query(
+		`SELECT file_path, file_name FROM job_files 
+		 WHERE job_id = ? AND file_type = ? AND file_name LIKE '%.png'
+		 ORDER BY file_name`,
+		jobID, types.JobFileTypeOutput,
+	)
+	if err != nil {
+		log.Printf("Failed to query PNG files for job %d: %v", jobID, err)
+		return
+	}
+	defer rows.Close()
+
+	var pngFiles []string
+	for rows.Next() {
+		var filePath, fileName string
+		if err := rows.Scan(&filePath, &fileName); err == nil {
+			pngFiles = append(pngFiles, filePath)
+		}
+	}
+
+	if len(pngFiles) == 0 {
+		log.Printf("No PNG files found for job %d", jobID)
+		return
+	}
+
+	// Note: Video generation will be handled by runners when they complete tasks
+	// Runners can check job status and generate MP4 when all frames are complete
+	log.Printf("Job %d completed with %d PNG frames - ready for MP4 generation", jobID, len(pngFiles))
+}
+
+// handleGetJobStatusForRunner allows runners to check job status
+func (s *Server) handleGetJobStatusForRunner(w http.ResponseWriter, r *http.Request) {
+	jobID, err := parseID(r, "jobId")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	var job types.Job
+	var startedAt, completedAt sql.NullTime
+
+	err = s.db.QueryRow(
+		`SELECT id, user_id, name, status, progress, frame_start, frame_end, output_format,
+		 created_at, started_at, completed_at, error_message
+		 FROM jobs WHERE id = ?`,
+		jobID,
+	).Scan(
+		&job.ID, &job.UserID, &job.Name, &job.Status, &job.Progress,
+		&job.FrameStart, &job.FrameEnd, &job.OutputFormat,
+		&job.CreatedAt, &startedAt, &completedAt, &job.ErrorMessage,
+	)
+
+	if err == sql.ErrNoRows {
+		s.respondError(w, http.StatusNotFound, "Job not found")
+		return
+	}
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to query job: %v", err))
+		return
+	}
+
+	if startedAt.Valid {
+		job.StartedAt = &startedAt.Time
+	}
+	if completedAt.Valid {
+		job.CompletedAt = &completedAt.Time
+	}
+
+	s.respondJSON(w, http.StatusOK, job)
+}
+
+// handleGetJobFilesForRunner allows runners to get job files
+func (s *Server) handleGetJobFilesForRunner(w http.ResponseWriter, r *http.Request) {
+	jobID, err := parseID(r, "jobId")
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	rows, err := s.db.Query(
+		`SELECT id, job_id, file_type, file_path, file_name, file_size, created_at 
+		 FROM job_files WHERE job_id = ? ORDER BY file_name`,
+		jobID,
+	)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to query files: %v", err))
+		return
+	}
+	defer rows.Close()
+
+	files := []types.JobFile{}
+	for rows.Next() {
+		var file types.JobFile
+		err := rows.Scan(
+			&file.ID, &file.JobID, &file.FileType, &file.FilePath,
+			&file.FileName, &file.FileSize, &file.CreatedAt,
+		)
+		if err != nil {
+			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to scan file: %v", err))
+			return
+		}
+		files = append(files, file)
+	}
+
+	s.respondJSON(w, http.StatusOK, files)
+}
+

internal/api/server.go

@@ -0,0 +1,284 @@
+package api
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/chi/v5/middleware"
+	"github.com/go-chi/cors"
+	"fuego/internal/auth"
+	"fuego/internal/database"
+	"fuego/internal/storage"
+)
+
+// Server represents the API server
+type Server struct {
+	db      *database.DB
+	auth    *auth.Auth
+	secrets *auth.Secrets
+	storage *storage.Storage
+	router  *chi.Mux
+}
+
+// NewServer creates a new API server
+func NewServer(db *database.DB, auth *auth.Auth, storage *storage.Storage) (*Server, error) {
+	secrets, err := auth.NewSecrets(db.DB)
+	if err != nil {
+		return nil, fmt.Errorf("failed to initialize secrets: %w", err)
+	}
+
+	s := &Server{
+		db:      db,
+		auth:    auth,
+		secrets: secrets,
+		storage: storage,
+		router:  chi.NewRouter(),
+	}
+
+	s.setupMiddleware()
+	s.setupRoutes()
+
+	return s, nil
+}
+
+// setupMiddleware configures middleware
+func (s *Server) setupMiddleware() {
+	s.router.Use(middleware.Logger)
+	s.router.Use(middleware.Recoverer)
+	s.router.Use(middleware.Timeout(60 * time.Second))
+
+	s.router.Use(cors.Handler(cors.Options{
+		AllowedOrigins:   []string{"*"},
+		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
+		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type"},
+		ExposedHeaders:   []string{"Link"},
+		AllowCredentials: true,
+		MaxAge:           300,
+	}))
+}
+
+// setupRoutes configures routes
+func (s *Server) setupRoutes() {
+	// Public routes
+	s.router.Route("/api/auth", func(r chi.Router) {
+		r.Get("/google/login", s.handleGoogleLogin)
+		r.Get("/google/callback", s.handleGoogleCallback)
+		r.Get("/discord/login", s.handleDiscordLogin)
+		r.Get("/discord/callback", s.handleDiscordCallback)
+		r.Post("/logout", s.handleLogout)
+		r.Get("/me", s.handleGetMe)
+	})
+
+	// Protected routes
+	s.router.Route("/api/jobs", func(r chi.Router) {
+		r.Use(func(next http.Handler) http.Handler {
+			return http.HandlerFunc(s.auth.Middleware(next.ServeHTTP))
+		})
+		r.Post("/", s.handleCreateJob)
+		r.Get("/", s.handleListJobs)
+		r.Get("/{id}", s.handleGetJob)
+		r.Delete("/{id}", s.handleCancelJob)
+		r.Post("/{id}/upload", s.handleUploadJobFile)
+		r.Get("/{id}/files", s.handleListJobFiles)
+		r.Get("/{id}/files/{fileId}/download", s.handleDownloadJobFile)
+		r.Get("/{id}/video", s.handleStreamVideo)
+	})
+
+	s.router.Route("/api/runners", func(r chi.Router) {
+		r.Use(func(next http.Handler) http.Handler {
+			return http.HandlerFunc(s.auth.Middleware(next.ServeHTTP))
+		})
+		r.Get("/", s.handleListRunners)
+	})
+
+	// Admin routes
+	s.router.Route("/api/admin", func(r chi.Router) {
+		r.Use(func(next http.Handler) http.Handler {
+			return http.HandlerFunc(s.auth.AdminMiddleware(next.ServeHTTP))
+		})
+		r.Route("/runners", func(r chi.Router) {
+			r.Route("/tokens", func(r chi.Router) {
+				r.Post("/", s.handleGenerateRegistrationToken)
+				r.Get("/", s.handleListRegistrationTokens)
+				r.Delete("/{id}", s.handleRevokeRegistrationToken)
+			})
+			r.Get("/", s.handleListRunnersAdmin)
+			r.Post("/{id}/verify", s.handleVerifyRunner)
+			r.Delete("/{id}", s.handleDeleteRunner)
+		})
+	})
+
+	// Runner API
+	s.router.Route("/api/runner", func(r chi.Router) {
+		// Registration doesn't require auth (uses token)
+		r.Post("/register", s.handleRegisterRunner)
+		
+		// All other endpoints require runner authentication
+		r.Group(func(r chi.Router) {
+			r.Use(func(next http.Handler) http.Handler {
+				return http.HandlerFunc(s.runnerAuthMiddleware(next.ServeHTTP))
+			})
+			r.Post("/heartbeat", s.handleRunnerHeartbeat)
+			r.Get("/tasks", s.handleGetRunnerTasks)
+			r.Post("/tasks/{id}/complete", s.handleCompleteTask)
+			r.Post("/tasks/{id}/progress", s.handleUpdateTaskProgress)
+			r.Get("/files/{jobId}/{fileName}", s.handleDownloadFileForRunner)
+			r.Post("/files/{jobId}/upload", s.handleUploadFileFromRunner)
+			r.Get("/jobs/{jobId}/status", s.handleGetJobStatusForRunner)
+			r.Get("/jobs/{jobId}/files", s.handleGetJobFilesForRunner)
+		})
+	})
+
+	// Serve static files (built React app)
+	s.router.Handle("/*", http.FileServer(http.Dir("./web/dist")))
+}
+
+// ServeHTTP implements http.Handler
+func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	s.router.ServeHTTP(w, r)
+}
+
+// JSON response helpers
+func (s *Server) respondJSON(w http.ResponseWriter, status int, data interface{}) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	if err := json.NewEncoder(w).Encode(data); err != nil {
+		log.Printf("Failed to encode JSON response: %v", err)
+	}
+}
+
+func (s *Server) respondError(w http.ResponseWriter, status int, message string) {
+	s.respondJSON(w, status, map[string]string{"error": message})
+}
+
+// Auth handlers
+func (s *Server) handleGoogleLogin(w http.ResponseWriter, r *http.Request) {
+	url, err := s.auth.GoogleLoginURL()
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	http.Redirect(w, r, url, http.StatusFound)
+}
+
+func (s *Server) handleGoogleCallback(w http.ResponseWriter, r *http.Request) {
+	code := r.URL.Query().Get("code")
+	if code == "" {
+		s.respondError(w, http.StatusBadRequest, "Missing code parameter")
+		return
+	}
+
+	session, err := s.auth.GoogleCallback(r.Context(), code)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+
+	sessionID := s.auth.CreateSession(session)
+	http.SetCookie(w, &http.Cookie{
+		Name:     "session_id",
+		Value:    sessionID,
+		Path:     "/",
+		MaxAge:   86400,
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	})
+
+	http.Redirect(w, r, "/", http.StatusFound)
+}
+
+func (s *Server) handleDiscordLogin(w http.ResponseWriter, r *http.Request) {
+	url, err := s.auth.DiscordLoginURL()
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	http.Redirect(w, r, url, http.StatusFound)
+}
+
+func (s *Server) handleDiscordCallback(w http.ResponseWriter, r *http.Request) {
+	code := r.URL.Query().Get("code")
+	if code == "" {
+		s.respondError(w, http.StatusBadRequest, "Missing code parameter")
+		return
+	}
+
+	session, err := s.auth.DiscordCallback(r.Context(), code)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+
+	sessionID := s.auth.CreateSession(session)
+	http.SetCookie(w, &http.Cookie{
+		Name:     "session_id",
+		Value:    sessionID,
+		Path:     "/",
+		MaxAge:   86400,
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	})
+
+	http.Redirect(w, r, "/", http.StatusFound)
+}
+
+func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
+	cookie, err := r.Cookie("session_id")
+	if err == nil {
+		s.auth.DeleteSession(cookie.Value)
+	}
+	http.SetCookie(w, &http.Cookie{
+		Name:     "session_id",
+		Value:    "",
+		Path:     "/",
+		MaxAge:   -1,
+		HttpOnly: true,
+	})
+	s.respondJSON(w, http.StatusOK, map[string]string{"message": "Logged out"})
+}
+
+func (s *Server) handleGetMe(w http.ResponseWriter, r *http.Request) {
+	cookie, err := r.Cookie("session_id")
+	if err != nil {
+		s.respondError(w, http.StatusUnauthorized, "Not authenticated")
+		return
+	}
+
+	session, ok := s.auth.GetSession(cookie.Value)
+	if !ok {
+		s.respondError(w, http.StatusUnauthorized, "Invalid session")
+		return
+	}
+
+	s.respondJSON(w, http.StatusOK, map[string]interface{}{
+		"id":       session.UserID,
+		"email":    session.Email,
+		"name":     session.Name,
+		"is_admin": session.IsAdmin,
+	})
+}
+
+// Helper to get user ID from context
+func getUserID(r *http.Request) (int64, error) {
+	userID, ok := auth.GetUserID(r.Context())
+	if !ok {
+		return 0, fmt.Errorf("user ID not found in context")
+	}
+	return userID, nil
+}
+
+// Helper to parse ID from URL
+func parseID(r *http.Request, param string) (int64, error) {
+	idStr := chi.URLParam(r, param)
+	id, err := strconv.ParseInt(idStr, 10, 64)
+	if err != nil {
+		return 0, fmt.Errorf("invalid ID: %s", idStr)
+	}
+	return id, nil
+}
+