ライブラリ・再生・削除を追加（Range 配信、パスの安全確認、共有ファイル名規則）

internal/media/path.go

@@ -0,0 +1,61 @@
+package media
+
+import (
+	"path/filepath"
+	"strings"
+	"unicode"
+)
+
+const maxComponentRunes = 80
+const maxComponentBytes = 60
+
+// RelativeVideoPath は worker と web が共有する保存先の相対パスを返す。
+func RelativeVideoPath(seriesTitle, episodeTitle, episodeID string) string {
+	series := sanitizeComponent(seriesTitle)
+	episode := sanitizeComponent(episodeTitle)
+	id := sanitizeComponent(episodeID)
+	return filepath.Join(series, series+" "+episode+" ["+id+"].mp4")
+}
+
+func sanitizeComponent(value string) string {
+	var result []rune
+	lastReplacement := false
+	for _, r := range value {
+		invalid := unicode.IsControl(r) || strings.ContainsRune(`<>:"/\|?*`, r)
+		if invalid {
+			if !lastReplacement {
+				result = append(result, '_')
+				lastReplacement = true
+			}
+			continue
+		}
+		if unicode.IsSpace(r) {
+			r = ' '
+		}
+		result = append(result, r)
+		lastReplacement = false
+	}
+	clean := strings.Trim(string(result), " .")
+	if clean == "" || clean == "." || clean == ".." {
+		return "名称未設定"
+	}
+	runes := []rune(clean)
+	if len(runes) > maxComponentRunes {
+		runes = runes[:maxComponentRunes]
+	}
+	var limited []rune
+	bytes := 0
+	for _, r := range runes {
+		size := len(string(r))
+		if bytes+size > maxComponentBytes {
+			break
+		}
+		limited = append(limited, r)
+		bytes += size
+	}
+	clean = strings.Trim(string(limited), " .")
+	if clean == "" || clean == "." || clean == ".." {
+		return "名称未設定"
+	}
+	return clean
+}

internal/media/path_test.go

@@ -0,0 +1,154 @@
+package media
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+	"unicode"
+	"unicode/utf8"
+)
+
+func TestRelativeVideoPath(t *testing.T) {
+	got := RelativeVideoPath("番組名", "第1話", "ep123")
+	want := filepath.Join("番組名", "番組名 第1話 [ep123].mp4")
+	if got != want {
+		t.Fatalf("path=%q want=%q", got, want)
+	}
+	other := RelativeVideoPath("番組名", "第1話", "ep456")
+	if got == other || !strings.Contains(other, "[ep456]") {
+		t.Fatalf("ID による衝突回避: %q %q", got, other)
+	}
+}
+
+func TestRelativeVideoPathSanitizesComponents(t *testing.T) {
+	got := RelativeVideoPath(" 番組:/\\*?<>|\"\x00\n\t\x7f\u0085. ", "\x00\n", "../")
+	if filepath.IsAbs(got) || strings.ContainsAny(got, `:*?<>|"`) || strings.Contains(got, "..") {
+		t.Fatalf("禁止文字が残った: %q", got)
+	}
+	for _, r := range got {
+		if unicode.IsControl(r) {
+			t.Errorf("制御文字が残った: %U in %q", r, got)
+		}
+	}
+	parts := strings.Split(filepath.ToSlash(got), "/")
+	if len(parts) != 2 || parts[0] == "" || !strings.HasSuffix(got, ".mp4") {
+		t.Fatalf("相対パスの形: %q", got)
+	}
+}
+
+func TestRelativeVideoPathHandlesEmptyAndLongNames(t *testing.T) {
+	for _, name := range []string{"", " ", ".", "..", "..."} {
+		got := RelativeVideoPath(name, name, "")
+		if !strings.Contains(got, "名称未設定") {
+			t.Errorf("空の代替名 %q: %q", name, got)
+		}
+	}
+	long := strings.Repeat("界", 200)
+	got := RelativeVideoPath(long, long, "id")
+	parts := strings.Split(filepath.ToSlash(got), "/")
+	if len(parts) != 2 || len([]byte(parts[0])) != 60 || !utf8.ValidString(parts[0]) {
+		t.Fatalf("番組名の60バイト境界: %q (%d bytes)", parts[0], len([]byte(parts[0])))
+	}
+	for _, part := range strings.Split(filepath.ToSlash(got), "/") {
+		if len([]byte(part)) > 240 {
+			t.Fatalf("長すぎる要素: %d bytes", len([]byte(part)))
+		}
+		if !utf8.ValidString(part) {
+			t.Fatalf("不正な UTF-8: %q", part)
+		}
+	}
+	if got := sanitizeComponent(strings.Repeat("a", 61)); len([]byte(got)) != 60 {
+		t.Fatalf("ASCII の60バイト境界: %d %q", len([]byte(got)), got)
+	}
+}
+
+func TestSanitizeComponentTrimsWhitespaceBeforeLengthLimit(t *testing.T) {
+	for _, tt := range []struct {
+		name, input, want string
+	}{
+		{"前後の空白", " \t　番組名\n ", "_ 番組名_"},
+		{"空白のみ", " 　 ", "名称未設定"},
+		{"制御文字のみ", "\t\n", "_"},
+		{"多数の先頭空白", strings.Repeat(" ", maxComponentRunes+10) + "番組名", "番組名"},
+		{"先頭空白と長い名前", strings.Repeat(" ", 70) + strings.Repeat("a", 70), strings.Repeat("a", 60)},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := sanitizeComponent(tt.input); got != tt.want {
+				t.Errorf("sanitizeComponent()=%q want=%q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSanitizeComponentTrimsAgainAfterLengthLimit(t *testing.T) {
+	for _, tt := range []struct {
+		name, input, want string
+	}{
+		{"60バイト目が空白", strings.Repeat("a", 59) + " " + "b", strings.Repeat("a", 59)},
+		{"60バイト目がドット", strings.Repeat("a", 59) + "." + "b", strings.Repeat("a", 59)},
+		{"切り詰め部分が空白のみ", "a" + strings.Repeat(" ", 59) + "b", "a"},
+		{"切り詰め部分がドットのみ", "a" + strings.Repeat(".", 59) + "b", "a"},
+		{"複数バイト文字の直後がドット", strings.Repeat("界", 19) + ".続", strings.Repeat("界", 19)},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			got := sanitizeComponent(tt.input)
+			if got != tt.want {
+				t.Errorf("sanitizeComponent()=%q want=%q", got, tt.want)
+			}
+			if strings.Trim(got, " .") != got || got == "" {
+				t.Errorf("切り詰め後の名前が不正: %q", got)
+			}
+		})
+	}
+}
+
+func TestSanitizeComponentSafetyProperties(t *testing.T) {
+	var controls strings.Builder
+	for r := rune(0); r <= 0x9f; r++ {
+		if unicode.IsControl(r) {
+			controls.WriteRune(r)
+		}
+	}
+	inputs := []string{
+		"", " ", ".", "..", "...", `<>:"/\|?*`, controls.String(),
+		" \t　番組名\n. ", "a/b\\c", strings.Repeat("a", 500),
+		strings.Repeat("界", 500), strings.Repeat("😀", 500),
+		strings.Repeat(".", 100) + "name" + strings.Repeat(" ", 100),
+		string([]byte{0xff, 0xfe, 'a', 0xc0, 0xaf}),
+	}
+	for i, input := range inputs {
+		got := sanitizeComponent(input)
+		if got == "" || got == "." || got == ".." {
+			t.Errorf("case %d: 空またはdot segment: %q", i, got)
+		}
+		if strings.Trim(got, " .") != got {
+			t.Errorf("case %d: 前後に空白またはdot: %q", i, got)
+		}
+		if len([]byte(got)) > maxComponentBytes || utf8.RuneCountInString(got) > maxComponentRunes {
+			t.Errorf("case %d: 上限超過: bytes=%d runes=%d %q", i, len([]byte(got)), utf8.RuneCountInString(got), got)
+		}
+		if !utf8.ValidString(got) {
+			t.Errorf("case %d: 不正なUTF-8: %q", i, got)
+		}
+		if strings.ContainsAny(got, `<>:"/\|?*`) {
+			t.Errorf("case %d: 禁止文字が残った: %q", i, got)
+		}
+		for _, r := range got {
+			if unicode.IsControl(r) {
+				t.Errorf("case %d: 制御文字が残った: %U in %q", i, r, got)
+			}
+		}
+		if again := sanitizeComponent(got); again != got {
+			t.Errorf("case %d: 再適用で変化: %q -> %q", i, got, again)
+		}
+
+		path := RelativeVideoPath(input, input, input)
+		parts := strings.Split(filepath.ToSlash(path), "/")
+		if filepath.IsAbs(path) || len(parts) != 2 || parts[0] == "" || parts[0] == "." || parts[0] == ".." || !strings.HasSuffix(parts[1], ".mp4") {
+			t.Errorf("case %d: 安全でない相対パス: %q parts=%q", i, path, parts)
+		}
+		if !utf8.ValidString(path) {
+			t.Errorf("case %d: パスが不正なUTF-8: %q", i, path)
+		}
+	}
+}

internal/store/library_test.go

@@ -0,0 +1,98 @@
+package store
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/jackc/pgx/v5"
+)
+
+func completeTestJob(t *testing.T, s *Store, id string) Job {
+	t.Helper()
+	ctx := context.Background()
+	job, _, err := s.Enqueue(ctx, sampleEpisode(id), "manual")
+	if err != nil {
+		t.Fatal(err)
+	}
+	claimed, err := s.ClaimNext(ctx)
+	if err != nil || claimed.ID != job.ID {
+		t.Fatalf("claim: %+v %v", claimed, err)
+	}
+	if err := s.Complete(ctx, job.ID, "番組/video.mp4", 1234); err != nil {
+		t.Fatal(err)
+	}
+	result, err := s.GetSucceededJob(ctx, job.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return result
+}
+
+func TestLibraryStoreOperations(t *testing.T) {
+	s := New(testPool(t, true))
+	ctx := context.Background()
+	first := completeTestJob(t, s, "library-1")
+	second := completeTestJob(t, s, "library-2")
+	jobs, err := s.ListSucceededJobs(ctx, 1)
+	if err != nil || len(jobs) != 1 || jobs[0].ID != second.ID {
+		t.Fatalf("完了一覧: %+v %v", jobs, err)
+	}
+	if first.FilePath == nil || *first.FilePath != "番組/video.mp4" || first.FileSizeBytes == nil || *first.FileSizeBytes != 1234 || first.FinishedAt == nil {
+		t.Fatalf("完了情報: %+v", first)
+	}
+	queued, _, err := s.Enqueue(ctx, sampleEpisode("not-finished"), "manual")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s.GetSucceededJob(ctx, queued.ID); !errors.Is(err, pgx.ErrNoRows) {
+		t.Fatalf("未完了の取得: %v", err)
+	}
+	if err := s.DeleteSucceededJob(ctx, queued.ID); !errors.Is(err, ErrInvalidTransition) {
+		t.Fatalf("未完了の削除: %v", err)
+	}
+	if err := s.DeleteSucceededJob(ctx, first.ID); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s.GetJob(ctx, first.ID); !errors.Is(err, pgx.ErrNoRows) {
+		t.Fatalf("削除後の取得: %v", err)
+	}
+	if err := s.DeleteSucceededJob(ctx, first.ID); !errors.Is(err, ErrInvalidTransition) {
+		t.Fatalf("再削除: %v", err)
+	}
+	if _, err := s.ListSucceededJobs(ctx, 0); err == nil {
+		t.Fatal("0件の上限を許した")
+	}
+}
+
+func TestDeleteSucceededJobKeepsKnownEpisodeAndAllowsManualRequeue(t *testing.T) {
+	s := New(testPool(t, true))
+	ctx := context.Background()
+	ep := seriesEpisode("known-library", "known-series")
+	created, err := s.RegisterSubscription(ctx, "known-series", "番組", []Episode{ep}, false)
+	if err != nil || !created {
+		t.Fatalf("番組登録: %t %v", created, err)
+	}
+	job, created, err := s.Enqueue(ctx, ep, "manual")
+	if err != nil || !created {
+		t.Fatalf("手動投入: %+v %t %v", job, created, err)
+	}
+	claimed, err := s.ClaimNext(ctx)
+	if err != nil || claimed.ID != job.ID {
+		t.Fatalf("取得: %+v %v", claimed, err)
+	}
+	if err := s.Complete(ctx, job.ID, "番組/video.mp4", 10); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.DeleteSucceededJob(ctx, job.ID); err != nil {
+		t.Fatal(err)
+	}
+	unknown, err := s.UnknownEpisodeIDs(ctx, "known-series", []string{ep.ID})
+	if err != nil || len(unknown) != 0 {
+		t.Fatalf("削除後の既知記録: %v %v", unknown, err)
+	}
+	requeued, created, err := s.Enqueue(ctx, ep, "manual")
+	if err != nil || !created || requeued.Status != "queued" || requeued.Source != "manual" {
+		t.Fatalf("削除後の手動再投入: %+v %t %v", requeued, created, err)
+	}
+}

internal/store/store.go

@@ -111,6 +111,36 @@ func (s *Store) GetJob(ctx context.Context, id int64) (Job, error) {
 	return scanJob(s.pool.QueryRow(ctx, `SELECT `+jobColumns+` FROM download_jobs WHERE id=$1`, id))
 }
 
+func (s *Store) GetSucceededJob(ctx context.Context, id int64) (Job, error) {
+	return scanJob(s.pool.QueryRow(ctx, `SELECT `+jobColumns+` FROM download_jobs WHERE id=$1 AND status='succeeded'`, id))
+}
+
+func (s *Store) ListSucceededJobs(ctx context.Context, limit int) ([]Job, error) {
+	if limit <= 0 {
+		return nil, errors.New("limit must be positive")
+	}
+	rows, err := s.pool.Query(ctx, `SELECT `+jobColumns+` FROM download_jobs
+		WHERE status='succeeded' ORDER BY finished_at DESC NULLS LAST, id DESC LIMIT $1`, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var jobs []Job
+	for rows.Next() {
+		job, err := scanJob(rows)
+		if err != nil {
+			return nil, err
+		}
+		jobs = append(jobs, job)
+	}
+	return jobs, rows.Err()
+}
+
+func (s *Store) DeleteSucceededJob(ctx context.Context, id int64) error {
+	tag, err := s.pool.Exec(ctx, `DELETE FROM download_jobs WHERE id=$1 AND status='succeeded'`, id)
+	return transitionResult(tag.RowsAffected(), err)
+}
+
 // Retry は失敗・中断されたジョブの実行時情報を消して再投入する。
 func (s *Store) Retry(ctx context.Context, id int64) error {
 	tag, err := s.pool.Exec(ctx, `UPDATE download_jobs SET status='queued', phase=NULL,

internal/web/handler.go

@@ -21,6 +21,8 @@ type page struct {
 	Newer         *newerView
 	Queue         *queueView
 	Subscriptions *subscriptionsView
+	Library       *libraryView
+	Video         *videoView
 }
 
 type JobStore interface {
@@ -36,20 +38,24 @@ type JobStore interface {
 	ListSubscriptions(context.Context) ([]store.Subscription, error)
 	SetSubscriptionEnabled(context.Context, string, bool) error
 	DeleteSubscription(context.Context, string) (bool, error)
+	ListSucceededJobs(context.Context, int) ([]store.Job, error)
+	GetSucceededJob(context.Context, int64) (store.Job, error)
+	DeleteSucceededJob(context.Context, int64) error
 }
 
 type server struct {
-	fetcher NewerFetcher
-	jobs    JobStore
-	now     func() time.Time
-	logger  *log.Logger
-	zone    *time.Location
-	tmpl    *template.Template
-	cacheMu sync.Mutex
-	cache   map[string]cacheEntry
+	fetcher  NewerFetcher
+	jobs     JobStore
+	videoDir string
+	now      func() time.Time
+	logger   *log.Logger
+	zone     *time.Location
+	tmpl     *template.Template
+	cacheMu  sync.Mutex
+	cache    map[string]cacheEntry
 }
 
-func NewHandler(fetcher NewerFetcher, jobs JobStore, now func() time.Time, logger *log.Logger) http.Handler {
+func NewHandler(fetcher NewerFetcher, jobs JobStore, videoDir string, now func() time.Time, logger *log.Logger) http.Handler {
 	tmpl := template.Must(template.ParseFS(assets, "templates/*.html"))
 	staticFiles, err := fs.Sub(assets, "static")
 	if err != nil {
@@ -59,7 +65,10 @@ func NewHandler(fetcher NewerFetcher, jobs JobStore, now func() time.Time, logge
 	if err != nil {
 		panic(err)
 	}
-	s := &server{fetcher: fetcher, jobs: jobs, now: now, logger: logger, zone: zone, tmpl: tmpl, cache: make(map[string]cacheEntry)}
+	if videoDir == "" {
+		videoDir = "/videos"
+	}
+	s := &server{fetcher: fetcher, jobs: jobs, videoDir: videoDir, now: now, logger: logger, zone: zone, tmpl: tmpl, cache: make(map[string]cacheEntry)}
 	mux := http.NewServeMux()
 	mux.Handle("GET /static/", http.StripPrefix("/static/", http.FileServerFS(staticFiles)))
 	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, _ *http.Request) {
@@ -81,15 +90,9 @@ func NewHandler(fetcher NewerFetcher, jobs JobStore, now func() time.Time, logge
 	mux.HandleFunc("POST /subscriptions/{id}/pause", s.pauseSubscription)
 	mux.HandleFunc("POST /subscriptions/{id}/resume", s.resumeSubscription)
 	mux.HandleFunc("POST /subscriptions/{id}/delete", s.deleteSubscription)
-	for path, title := range map[string]string{
-		"GET /library": "ライブラリ",
-	} {
-		mux.HandleFunc(path, func(w http.ResponseWriter, _ *http.Request) {
-			w.Header().Set("Content-Type", "text/html; charset=utf-8")
-			if err := s.tmpl.ExecuteTemplate(w, "layout", page{Title: title}); err != nil {
-				http.Error(w, "template error", http.StatusInternalServerError)
-			}
-		})
-	}
+	mux.HandleFunc("GET /library", s.libraryPage)
+	mux.HandleFunc("GET /library/{id}", s.videoPage)
+	mux.HandleFunc("GET /videos/{id}", s.serveVideo)
+	mux.HandleFunc("POST /library/{id}/delete", s.deleteVideo)
 	return mux
 }

internal/web/library.go

@@ -0,0 +1,195 @@
+package web
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"gitea.kazu634.com/kazu634/tver/internal/store"
+	"github.com/jackc/pgx/v5"
+)
+
+const libraryLimit = 100
+
+type libraryItemView struct {
+	ID                               int64
+	ThumbnailURL, SeriesTitle, Title string
+	BroadcasterName, DurationText    string
+	FileSizeText, FinishedAtText     string
+}
+
+type libraryView struct {
+	Items []libraryItemView
+}
+
+type videoView struct {
+	libraryItemView
+	VideoURL string
+}
+
+func (s *server) libraryPage(w http.ResponseWriter, r *http.Request) {
+	jobs, err := s.jobs.ListSucceededJobs(r.Context(), libraryLimit)
+	if err != nil {
+		s.logger.Printf("ライブラリの取得に失敗: %v", err)
+		http.Error(w, "ライブラリを取得できませんでした", http.StatusInternalServerError)
+		return
+	}
+	view := libraryView{Items: make([]libraryItemView, 0, len(jobs))}
+	for _, job := range jobs {
+		view.Items = append(view.Items, s.libraryItem(job))
+	}
+	s.render(w, "layout", page{Title: "ライブラリ", Library: &view})
+}
+
+func (s *server) videoPage(w http.ResponseWriter, r *http.Request) {
+	job, ok := s.succeededJob(w, r)
+	if !ok {
+		return
+	}
+	item := s.libraryItem(job)
+	s.render(w, "layout", page{Title: job.SeriesTitle + " " + job.Title,
+		Video: &videoView{libraryItemView: item, VideoURL: "/videos/" + strconv.FormatInt(job.ID, 10)}})
+}
+
+func (s *server) libraryItem(job store.Job) libraryItemView {
+	item := libraryItemView{ID: job.ID, ThumbnailURL: "https://statics.tver.jp" + job.ThumbnailPath,
+		SeriesTitle: job.SeriesTitle, Title: job.Title, BroadcasterName: job.BroadcasterName,
+		DurationText: fmt.Sprintf("%d分", durationMinutes(int64(job.DurationSeconds)))}
+	if job.FileSizeBytes != nil {
+		item.FileSizeText = formatBytes(float64(*job.FileSizeBytes))
+	}
+	if job.FinishedAt != nil {
+		item.FinishedAtText = job.FinishedAt.In(s.zone).Format("2006-01-02 15:04 MST")
+	}
+	return item
+}
+
+func (s *server) serveVideo(w http.ResponseWriter, r *http.Request) {
+	job, ok := s.succeededJob(w, r)
+	if !ok || job.FilePath == nil {
+		if ok {
+			http.NotFound(w, r)
+		}
+		return
+	}
+	path, err := secureVideoPath(s.videoDir, *job.FilePath, true)
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+	file, err := os.Open(path)
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+	defer file.Close()
+	info, err := file.Stat()
+	if err != nil || !info.Mode().IsRegular() {
+		http.NotFound(w, r)
+		return
+	}
+	w.Header().Set("Content-Type", "video/mp4")
+	http.ServeContent(w, r, filepath.Base(path), info.ModTime(), file)
+}
+
+func (s *server) deleteVideo(w http.ResponseWriter, r *http.Request) {
+	job, ok := s.succeededJob(w, r)
+	if !ok {
+		return
+	}
+	if job.FilePath != nil {
+		path, err := secureVideoPath(s.videoDir, *job.FilePath, false)
+		if err != nil {
+			http.Error(w, "動画ファイルの場所が不正です", http.StatusConflict)
+			return
+		}
+		if err := os.Remove(path); err != nil && !errors.Is(err, os.ErrNotExist) {
+			s.logger.Printf("動画ファイルの削除に失敗: %v", err)
+			http.Error(w, "動画ファイルを削除できませんでした", http.StatusInternalServerError)
+			return
+		}
+	}
+	if err := s.jobs.DeleteSucceededJob(r.Context(), job.ID); err != nil {
+		s.logger.Printf("動画の記録削除に失敗: %v", err)
+		http.Error(w, "動画の記録を削除できませんでした", http.StatusInternalServerError)
+		return
+	}
+	http.Redirect(w, r, "/library", http.StatusSeeOther)
+}
+
+func (s *server) succeededJob(w http.ResponseWriter, r *http.Request) (store.Job, bool) {
+	id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
+	if err != nil || id <= 0 {
+		http.NotFound(w, r)
+		return store.Job{}, false
+	}
+	job, err := s.jobs.GetSucceededJob(r.Context(), id)
+	if errors.Is(err, pgx.ErrNoRows) {
+		http.NotFound(w, r)
+		return store.Job{}, false
+	}
+	if err != nil {
+		s.logger.Printf("完了ジョブの取得に失敗: %v", err)
+		http.Error(w, "動画を取得できませんでした", http.StatusInternalServerError)
+		return store.Job{}, false
+	}
+	return job, true
+}
+
+func secureVideoPath(root, relative string, mustExist bool) (string, error) {
+	if relative == "" || filepath.IsAbs(relative) {
+		return "", errors.New("video path must be relative")
+	}
+	clean := filepath.Clean(relative)
+	if clean == "." || clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)) {
+		return "", errors.New("video path leaves root")
+	}
+	rootAbs, err := filepath.Abs(root)
+	if err != nil {
+		return "", err
+	}
+	rootReal, err := filepath.EvalSymlinks(rootAbs)
+	if err != nil {
+		return "", err
+	}
+	candidate := filepath.Join(rootAbs, clean)
+	if err := insideRoot(rootAbs, candidate); err != nil {
+		return "", err
+	}
+	resolved, err := filepath.EvalSymlinks(candidate)
+	if err == nil {
+		if err := insideRoot(rootReal, resolved); err != nil {
+			return "", err
+		}
+		return candidate, nil
+	}
+	if mustExist || !errors.Is(err, os.ErrNotExist) {
+		return "", err
+	}
+	ancestor := filepath.Dir(candidate)
+	for {
+		resolvedAncestor, evalErr := filepath.EvalSymlinks(ancestor)
+		if evalErr == nil {
+			if err := insideRoot(rootReal, resolvedAncestor); err != nil {
+				return "", err
+			}
+			return candidate, nil
+		}
+		if !errors.Is(evalErr, os.ErrNotExist) || ancestor == rootAbs {
+			return "", evalErr
+		}
+		ancestor = filepath.Dir(ancestor)
+	}
+}
+
+func insideRoot(root, path string) error {
+	rel, err := filepath.Rel(root, path)
+	if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+		return errors.New("path leaves video root")
+	}
+	return nil
+}

internal/web/library_test.go

@@ -0,0 +1,195 @@
+package web
+
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"gitea.kazu634.com/kazu634/tver/internal/store"
+)
+
+func libraryJob(id int64, relative string) store.Job {
+	size := int64(10)
+	finished := time.Date(2026, 10, 3, 1, 2, 3, 0, time.UTC)
+	return store.Job{ID: id, EpisodeID: "ep1", SeriesTitle: `<script>番組</script>`, Title: `<b>第1話</b>`,
+		BroadcasterName: "放送局", DurationSeconds: 61, ThumbnailPath: "/thumb.jpg", Status: "succeeded",
+		FilePath: &relative, FileSizeBytes: &size, FinishedAt: &finished}
+}
+
+func TestLibraryAndPlaybackPage(t *testing.T) {
+	dir := t.TempDir()
+	jobs := &fakeJobStore{jobs: map[string]store.Job{"ep1": libraryJob(1, "show/video.mp4")}}
+	handler := newTestHandlerWithVideoDir(&fakeFetcher{}, jobs, dir, nil)
+	page := getPage(handler, "/library")
+	if page.Code != http.StatusOK {
+		t.Fatalf("library status=%d", page.Code)
+	}
+	body := page.Body.String()
+	for _, want := range []string{"&lt;script&gt;番組&lt;/script&gt;", "&lt;b&gt;第1話&lt;/b&gt;", "放送局", "長さ: 2分", "10.0 B", "2026-10-03 10:02 JST", "https://statics.tver.jp/thumb.jpg", `/library/1`} {
+		if !strings.Contains(body, want) {
+			t.Errorf("library missing %q", want)
+		}
+	}
+	if strings.Contains(body, "<script>番組</script>") {
+		t.Fatal("library fields were not escaped")
+	}
+	video := getPage(handler, "/library/1")
+	if video.Code != http.StatusOK || !strings.Contains(video.Body.String(), `<video controls`) || !strings.Contains(video.Body.String(), `src="/videos/1"`) || !strings.Contains(video.Body.String(), `hx-confirm="動画ファイルと記録を削除しますか？"`) {
+		t.Fatalf("video page: %d %s", video.Code, video.Body.String())
+	}
+	for _, path := range []string{"/library/bad", "/library/99", "/library/1/delete"} {
+		response := getPage(handler, path)
+		want := http.StatusNotFound
+		if strings.HasSuffix(path, "/delete") {
+			want = http.StatusMethodNotAllowed
+		}
+		if response.Code != want {
+			t.Errorf("%s status=%d want=%d", path, response.Code, want)
+		}
+		if want == http.StatusMethodNotAllowed && !strings.Contains(response.Header().Get("Allow"), "POST") {
+			t.Errorf("%s Allow=%q", path, response.Header().Get("Allow"))
+		}
+	}
+}
+
+func TestLibraryRejectsInvalidJobIDs(t *testing.T) {
+	jobs := &fakeJobStore{jobs: map[string]store.Job{"ep1": libraryJob(1, "show/video.mp4")}}
+	handler := newTestHandlerWithVideoDir(&fakeFetcher{}, jobs, t.TempDir(), nil)
+	for _, id := range []string{"0", "-1", "bad", "999999999999999999999999999999999999"} {
+		for _, path := range []string{"/library/" + id, "/videos/" + id} {
+			if got := getPage(handler, path).Code; got != http.StatusNotFound {
+				t.Errorf("GET %s: %d", path, got)
+			}
+		}
+		if got := postForm(handler, "/library/"+id+"/delete", nil).Code; got != http.StatusNotFound {
+			t.Errorf("POST delete id=%q: %d", id, got)
+		}
+	}
+}
+
+func TestVideoRangeAndMissingFile(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.Mkdir(filepath.Join(dir, "show"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	content := []byte("0123456789")
+	if err := os.WriteFile(filepath.Join(dir, "show", "video.mp4"), content, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	jobs := &fakeJobStore{jobs: map[string]store.Job{"ep1": libraryJob(1, "show/video.mp4")}}
+	handler := newTestHandlerWithVideoDir(&fakeFetcher{}, jobs, dir, nil)
+	request := httptest.NewRequest(http.MethodGet, "/videos/1?file_path=../../outside.mp4", nil)
+	request.Header.Set("Range", "bytes=2-5")
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, request)
+	if response.Code != http.StatusPartialContent || response.Body.String() != "2345" || response.Header().Get("Content-Range") != "bytes 2-5/10" || response.Header().Get("Content-Type") != "video/mp4" {
+		t.Fatalf("range: status=%d range=%q type=%q body=%q", response.Code, response.Header().Get("Content-Range"), response.Header().Get("Content-Type"), response.Body.String())
+	}
+	full := getPage(handler, "/videos/1")
+	if full.Code != http.StatusOK || full.Body.String() != string(content) || full.Header().Get("Content-Type") != "video/mp4" || full.Header().Get("Accept-Ranges") != "bytes" {
+		t.Fatalf("full video: status=%d type=%q ranges=%q body=%q", full.Code, full.Header().Get("Content-Type"), full.Header().Get("Accept-Ranges"), full.Body.String())
+	}
+	request = httptest.NewRequest(http.MethodGet, "/videos/1", nil)
+	request.Header.Set("Range", "bytes=20-30")
+	response = httptest.NewRecorder()
+	handler.ServeHTTP(response, request)
+	if response.Code != http.StatusRequestedRangeNotSatisfiable || response.Header().Get("Content-Range") != "bytes */10" {
+		t.Fatalf("range outside: status=%d range=%q", response.Code, response.Header().Get("Content-Range"))
+	}
+	if err := os.Remove(filepath.Join(dir, "show", "video.mp4")); err != nil {
+		t.Fatal(err)
+	}
+	if got := getPage(handler, "/videos/1").Code; got != http.StatusNotFound {
+		t.Fatalf("missing file status=%d", got)
+	}
+	jobs.jobs["ep1"] = store.Job{ID: 1, Status: "queued"}
+	if got := getPage(handler, "/videos/1").Code; got != http.StatusNotFound {
+		t.Fatalf("unfinished status=%d", got)
+	}
+	if got := getPage(handler, "/library/1").Code; got != http.StatusNotFound {
+		t.Fatalf("unfinished playback page status=%d", got)
+	}
+	missingPath := libraryJob(1, "show/video.mp4")
+	missingPath.FilePath = nil
+	jobs.jobs["ep1"] = missingPath
+	if got := getPage(handler, "/videos/1").Code; got != http.StatusNotFound {
+		t.Fatalf("missing DB file path status=%d", got)
+	}
+}
+
+func TestVideoPathTraversalAndSymlinkAreRejected(t *testing.T) {
+	dir := t.TempDir()
+	outside := t.TempDir()
+	outsideFile := filepath.Join(outside, "outside.mp4")
+	if err := os.WriteFile(outsideFile, []byte("secret"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outsideFile, filepath.Join(dir, "link.mp4")); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(dir, "linked-directory")); err != nil {
+		t.Fatal(err)
+	}
+	for _, relative := range []string{"../outside.mp4", "show/../../outside.mp4", outsideFile, "link.mp4", "linked-directory/outside.mp4", "linked-directory/missing.mp4"} {
+		jobs := &fakeJobStore{jobs: map[string]store.Job{"ep1": libraryJob(1, relative)}}
+		handler := newTestHandlerWithVideoDir(&fakeFetcher{}, jobs, dir, nil)
+		if got := getPage(handler, "/videos/1").Code; got != http.StatusNotFound {
+			t.Errorf("path %q status=%d", relative, got)
+		}
+		deleted := postForm(handler, "/library/1/delete", nil)
+		if deleted.Code != http.StatusConflict || len(jobs.jobs) != 1 {
+			t.Errorf("delete path %q status=%d jobs=%d", relative, deleted.Code, len(jobs.jobs))
+		}
+	}
+}
+
+func TestDeleteVideoFileThenRecord(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.Mkdir(filepath.Join(dir, "show"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(dir, "show", "video.mp4")
+	if err := os.WriteFile(path, []byte("video"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	jobs := &fakeJobStore{jobs: map[string]store.Job{"ep1": libraryJob(1, "show/video.mp4")}}
+	fileWasGoneBeforeRecordDelete := false
+	jobs.beforeDeleteSucceeded = func() {
+		_, err := os.Stat(path)
+		fileWasGoneBeforeRecordDelete = errors.Is(err, os.ErrNotExist)
+	}
+	handler := newTestHandlerWithVideoDir(&fakeFetcher{}, jobs, dir, nil)
+	response := postForm(handler, "/library/1/delete", nil)
+	if response.Code != http.StatusSeeOther || response.Header().Get("Location") != "/library" || len(jobs.jobs) != 0 || !fileWasGoneBeforeRecordDelete {
+		t.Fatalf("delete: status=%d location=%q jobs=%d", response.Code, response.Header().Get("Location"), len(jobs.jobs))
+	}
+	if _, err := os.Stat(path); !os.IsNotExist(err) {
+		t.Fatalf("file remains: %v", err)
+	}
+	jobs.jobs["ep1"] = libraryJob(1, "show/missing.mp4")
+	if got := postForm(handler, "/library/1/delete", nil).Code; got != http.StatusSeeOther || len(jobs.jobs) != 0 {
+		t.Fatalf("missing file delete: status=%d jobs=%d", got, len(jobs.jobs))
+	}
+}
+
+func TestDeleteFailureKeepsRecord(t *testing.T) {
+	dir := t.TempDir()
+	blocked := filepath.Join(dir, "blocked")
+	if err := os.Mkdir(blocked, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(blocked, "child"), []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	jobs := &fakeJobStore{jobs: map[string]store.Job{"ep1": libraryJob(1, "blocked")}}
+	handler := newTestHandlerWithVideoDir(&fakeFetcher{}, jobs, dir, nil)
+	response := postForm(handler, "/library/1/delete", nil)
+	if response.Code != http.StatusInternalServerError || len(jobs.jobs) != 1 || !strings.Contains(response.Body.String(), "動画ファイルを削除できませんでした") {
+		t.Fatalf("failure: status=%d jobs=%d body=%s", response.Code, len(jobs.jobs), response.Body.String())
+	}
+}

internal/web/newer_test.go

@@ -43,10 +43,14 @@ func newTestHandler(fetcher *fakeFetcher, now func() time.Time) http.Handler {
 }
 
 func newTestHandlerWithStore(fetcher *fakeFetcher, jobs *fakeJobStore, now func() time.Time) http.Handler {
+	return newTestHandlerWithVideoDir(fetcher, jobs, "", now)
+}
+
+func newTestHandlerWithVideoDir(fetcher *fakeFetcher, jobs *fakeJobStore, videoDir string, now func() time.Time) http.Handler {
 	if now == nil {
 		now = func() time.Time { return time.Date(2026, 10, 3, 0, 0, 0, 0, time.UTC) }
 	}
-	return NewHandler(fetcher, jobs, now, log.New(io.Discard, "", 0))
+	return NewHandler(fetcher, jobs, videoDir, now, log.New(io.Discard, "", 0))
 }
 
 func getPage(handler http.Handler, path string) *httptest.ResponseRecorder {
@@ -238,7 +242,7 @@ func TestNewerPageEscapesUntrustedEpisodeFields(t *testing.T) {
 func TestNewerFailureShowsFriendlyMessageAndRedactsToken(t *testing.T) {
 	fetcher := &fakeFetcher{err: errors.New("GET https://platform-api.tver.jp/?platform_token=secret-123&x=1: upstream unavailable")}
 	var logs bytes.Buffer
-	handler := NewHandler(fetcher, &fakeJobStore{}, time.Now, log.New(&logs, "", 0))
+	handler := NewHandler(fetcher, &fakeJobStore{}, "", time.Now, log.New(&logs, "", 0))
 	response := getPage(handler, "/")
 	if response.Code != http.StatusOK || !strings.Contains(response.Body.String(), "新着を取得できませんでした") {
 		t.Errorf("error page: status=%d body=%s", response.Code, response.Body.String())

internal/web/static/app.css

@@ -24,3 +24,4 @@ main { max-width: 72rem; margin: 2rem auto; padding: 0 2rem; }
 .queue-job h3 { margin: 0 0 .4rem; }
 .queue-job p { margin: .4rem 0; }
 .queue-job pre { white-space: pre-wrap; overflow-wrap: anywhere; }
+video { display: block; width: 100%; max-height: 75vh; background: #000; }

internal/web/store_test.go

@@ -24,6 +24,7 @@ type fakeJobStore struct {
 	registerErr               error
 	subscribedCalls           int
 	subscribedIDs             []string
+	beforeDeleteSucceeded     func()
 	err                       error
 }
 
@@ -212,3 +213,48 @@ func (f *fakeJobStore) DeleteSubscription(_ context.Context, seriesID string) (b
 	delete(f.subscriptions, seriesID)
 	return true, nil
 }
+
+func (f *fakeJobStore) ListSucceededJobs(_ context.Context, limit int) ([]store.Job, error) {
+	if f.err != nil {
+		return nil, f.err
+	}
+	var result []store.Job
+	for _, job := range f.jobs {
+		if job.Status == "succeeded" {
+			result = append(result, job)
+		}
+	}
+	sort.Slice(result, func(i, j int) bool { return result[i].ID > result[j].ID })
+	if len(result) > limit {
+		result = result[:limit]
+	}
+	return result, nil
+}
+
+func (f *fakeJobStore) GetSucceededJob(_ context.Context, id int64) (store.Job, error) {
+	if f.err != nil {
+		return store.Job{}, f.err
+	}
+	for _, job := range f.jobs {
+		if job.ID == id && job.Status == "succeeded" {
+			return job, nil
+		}
+	}
+	return store.Job{}, pgx.ErrNoRows
+}
+
+func (f *fakeJobStore) DeleteSucceededJob(_ context.Context, id int64) error {
+	if f.beforeDeleteSucceeded != nil {
+		f.beforeDeleteSucceeded()
+	}
+	if f.err != nil {
+		return f.err
+	}
+	for episodeID, job := range f.jobs {
+		if job.ID == id && job.Status == "succeeded" {
+			delete(f.jobs, episodeID)
+			return nil
+		}
+	}
+	return store.ErrInvalidTransition
+}

internal/web/templates/layout.html

@@ -24,6 +24,10 @@
       {{template "queue_page" .Queue}}
     {{else if .Subscriptions}}
       {{template "subscriptions_page" .Subscriptions}}
+    {{else if .Library}}
+      {{template "library_page" .Library}}
+    {{else if .Video}}
+      {{template "video_page" .Video}}
     {{else}}
       <h1>{{.Title}}</h1>
     {{end}}

internal/web/templates/library.html

@@ -0,0 +1,34 @@
+{{define "library_page"}}
+<h1>ライブラリ</h1>
+{{if .Items}}
+  <div class="episode-grid">
+    {{range .Items}}
+      <article class="episode-card">
+        <a href="/library/{{.ID}}">
+          <img src="{{.ThumbnailURL}}" alt="" loading="lazy">
+          <div class="episode-copy">
+            <h2>{{.SeriesTitle}}</h2>
+            <p>{{.Title}}</p>
+            <p>放送局: {{.BroadcasterName}}</p>
+            <p>長さ: {{.DurationText}}</p>
+            <p>サイズ: {{.FileSizeText}}</p>
+            <p>完了日時: {{.FinishedAtText}}</p>
+          </div>
+        </a>
+      </article>
+    {{end}}
+  </div>
+{{else}}
+  <p>ダウンロード済みの動画はありません</p>
+{{end}}
+{{end}}
+
+{{define "video_page"}}
+<h1>{{.SeriesTitle}}</h1>
+<h2>{{.Title}}</h2>
+<video controls preload="metadata" src="{{.VideoURL}}"></video>
+<p>放送局: {{.BroadcasterName}}／長さ: {{.DurationText}}／サイズ: {{.FileSizeText}}／完了日時: {{.FinishedAtText}}</p>
+<form action="/library/{{.ID}}/delete" method="post" hx-confirm="動画ファイルと記録を削除しますか？">
+  <button type="submit">削除</button>
+</form>
+{{end}}