fix: prevent createdAt forgery, customCreatedAt leak, and password drop in video duplicate (#2223)

- Enumerate explicit Video creation payload in Videos.duplicate instead of spreading the Video entity
- Strip customCreatedAt and desktopRecordingUpload from metadata on duplication
- Retain password protection on duplicated videos when the source video has a password
- Exclude createdAt, updatedAt, and id in VideosRepo.create so database default timestamps are always applied

Closes #2223

Author: massmarketconsumer-arch

apps/web/__tests__/unit/recording-storage-lifecycle.test.ts

@@ -134,13 +134,14 @@ type DatabaseMutation = {
 	values?: Record<string, unknown>;
 };
 
-function databaseFixture(video = recording()) {
+function databaseFixture(video = recording(), password?: string | null) {
 	const encoded = Schema.encodeSync(Video.Video)(video);
 	const original = {
 		...encoded,
 		bucket: encoded.bucketId,
 		createdAt: video.createdAt,
 		updatedAt: video.updatedAt,
+		password: password ?? null,
 	};
 	const rows = new Map<string, Record<string, unknown>>([[videoId, original]]);
 	const jobs = new Map<string, Record<string, unknown>>([
@@ -879,6 +880,12 @@ describe("recording storage lifecycle", () => {
 		expect(database.rows.get("duplicate-video")?.metadata).not.toHaveProperty(
 			"desktopRecordingUpload",
 		);
+		expect(database.rows.get("duplicate-video")).not.toHaveProperty(
+			"createdAt",
+		);
+		expect(database.rows.get("duplicate-video")).not.toHaveProperty(
+			"updatedAt",
+		);
 		expect(database.rows.get("owned-video")?.metadata).toHaveProperty(
 			"desktopRecordingUpload",
 		);
@@ -899,6 +906,32 @@ describe("recording storage lifecycle", () => {
 		]);
 	});
 
+	it("preserves password and strips customCreatedAt without copying original createdAt or updatedAt", async () => {
+		const videoWithCustomDate = Video.Video.make({
+			...recording(),
+			metadata: Option.some({
+				sourceName: "Dated recording",
+				customCreatedAt: "2020-01-01T00:00:00.000Z",
+			}),
+		});
+		const database = databaseFixture(videoWithCustomDate, "secret-pass-123");
+		await storageFixture([
+			[outputKey, "verified-video"],
+			[thumbnailKey, "verified-thumbnail"],
+			[previewKey, "verified-preview"],
+		]);
+		const result = await runVideoOperation("duplicate");
+		expect(Exit.isSuccess(result)).toBe(true);
+		const duplicated = database.rows.get("duplicate-video");
+		expect(duplicated).toBeDefined();
+		expect(duplicated).not.toHaveProperty("createdAt");
+		expect(duplicated).not.toHaveProperty("updatedAt");
+		expect(duplicated?.metadata).not.toHaveProperty("customCreatedAt");
+		expect(duplicated).toMatchObject({
+			password: "secret-pass-123",
+		});
+	});
+
 	it("does not duplicate source inventories, raw fragments, or comment attachments across pages", async () => {
 		const database = databaseFixture();
 		const retained = Array.from(

packages/web-backend/src/Videos/VideosRepo.ts

@@ -109,10 +109,16 @@ export class VideosRepo extends Effect.Service<VideosRepo>()("VideosRepo", {
 
 				yield* db.use((db) =>
 					db.transaction(async (db) => {
+						const {
+							createdAt: _createdAt,
+							updatedAt: _updatedAt,
+							id: _id,
+							...insertData
+						} = data as Record<string, unknown>;
 						const promises: MySqlInsertBase<any, any, any>[] = [
 							db.insert(Db.videos).values([
 								{
-									...data,
+									...insertData,
 									id,
 									orgId: data.orgId,
 									bucket: Option.getOrNull(data.bucketId ?? Option.none()),

packages/web-backend/src/Videos/index.ts

@@ -349,7 +349,7 @@ export class Videos extends Effect.Service<Videos>()("Videos", {
 				const maybeVideo = yield* policy.getOwnedById(videoId);
 				if (Option.isNone(maybeVideo))
 					return yield* Effect.fail(new Video.NotFoundError());
-				const [video] = maybeVideo.value;
+				const [video, password] = maybeVideo.value;
 
 				const [bucket] = yield* storage.getAccessForVideo(video);
 
@@ -410,16 +410,29 @@ export class Videos extends Effect.Service<Videos>()("Videos", {
 						}
 					} while (continuationToken);
 					publicationAttempted = true;
+					const hasPassword = Option.isSome(password);
 					yield* repo.create(
 						{
-							...video,
+							ownerId: video.ownerId,
+							orgId: video.orgId,
+							name: video.name,
+							public: video.public,
 							source:
 								publishedKeys.size > 0 ? { type: "desktopMP4" } : video.source,
 							metadata: Option.map(video.metadata, (metadata) => {
 								const copied = { ...metadata };
 								delete copied.desktopRecordingUpload;
+								delete copied.customCreatedAt;
 								return copied;
 							}),
+							bucketId: video.bucketId,
+							storageIntegrationId: video.storageIntegrationId,
+							folderId: video.folderId,
+							transcriptionStatus: video.transcriptionStatus,
+							width: video.width,
+							height: video.height,
+							duration: video.duration,
+							...(hasPassword ? { password: password.value } : {}),
 						},
 						{ id: newVideoId },
 					);