feat: Implement video version management API, enable comment tag editing, and enhance video duration display to include hours.

app/api/comments/[commentId]/route.ts

@@ -142,10 +142,10 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
         }
 
         const body = await request.json();
-        const { content, isResolved } = body;
+        const { content, isResolved, tagId } = body;
 
-        // Only author can edit content
-        if (content !== undefined && !isAuthor) {
+        // Only author can edit content or tag
+        if ((content !== undefined || tagId !== undefined) && !isAuthor) {
             return apiErrors.forbidden('Only the author can edit comment content');
         }
 
@@ -156,6 +156,7 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
 
         const updateData: Record<string, unknown> = {};
         if (content !== undefined) updateData.content = content.trim();
+        if (tagId !== undefined) updateData.tagId = tagId;
         if (isResolved !== undefined) {
             updateData.isResolved = isResolved;
             updateData.resolvedAt = isResolved ? new Date() : null;
@@ -166,9 +167,11 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
             data: updateData,
             include: {
                 author: { select: { id: true, name: true, image: true } },
+                tag: { select: { id: true, name: true, color: true } },
                 replies: {
                     include: {
                         author: { select: { id: true, name: true, image: true } },
+                        tag: { select: { id: true, name: true, color: true } },
                     },
                 },
             },
@@ -199,15 +202,6 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
             where: { id: commentId },
             include: {
                 replies: { select: { voiceUrl: true } },
-                version: {
-                    include: {
-                        video: {
-                            include: {
-                                project: true,
-                            },
-                        },
-                    },
-                },
             },
         });
 
@@ -215,30 +209,10 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
             return apiErrors.notFound('Comment');
         }
 
-        const project = comment.version.video.project;
-        const isOwner = project.ownerId === session.user.id;
         const isAuthor = comment.authorId === session.user.id;
 
-        // Check workspace membership for delete permissions
-        let isWorkspaceMember = false;
-        if (!isOwner && !isAuthor && session.user.id) {
-            const wsMember = await db.workspaceMember.findUnique({
-                where: {
-                    workspaceId_userId: {
-                        workspaceId: project.workspaceId,
-                        userId: session.user.id,
-                    },
-                },
-            });
-            const wsOwner = await db.workspace.findUnique({
-                where: { id: project.workspaceId },
-                select: { ownerId: true },
-            });
-            isWorkspaceMember = !!wsMember || wsOwner?.ownerId === session.user.id;
-        }
-
-        if (!isOwner && !isAuthor && !isWorkspaceMember) {
-            return apiErrors.forbidden('Only the author or project owner can delete this comment');
+        if (!isAuthor) {
+            return apiErrors.forbidden('You can only delete your own comments');
         }
 
         // Collect all voice URLs to delete from R2 (comment + its replies)

app/api/projects/[projectId]/videos/[videoId]/route.ts

@@ -57,6 +57,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
         const response = successResponse({
             ...video,
             isAuthenticated: !!session?.user?.id,
+            currentUserId: session?.user?.id || null,
         });
 
         return withCacheControl(response, 'private, no-cache');

app/api/projects/[projectId]/videos/[videoId]/versions/[versionId]/route.ts

@@ -0,0 +1,151 @@
+import { NextRequest } from 'next/server';
+import { db } from '@/lib/db';
+import { auth } from '@/lib/auth';
+import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
+import { rateLimit } from '@/lib/rate-limit';
+import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
+
+type RouteParams = { params: Promise<{ projectId: string; videoId: string; versionId: string }> };
+
+async function getVersionWithAccess(projectId: string, videoId: string, versionId: string, userId: string) {
+    const version = await db.videoVersion.findFirst({
+        where: { id: versionId, videoParentId: videoId },
+        include: {
+            video: {
+                include: {
+                    project: {
+                        include: {
+                            members: { where: { userId } },
+                            workspace: {
+                                include: {
+                                    members: { where: { userId } },
+                                },
+                            },
+                        },
+                    },
+                },
+            },
+        },
+    });
+
+    if (!version || version.video.projectId !== projectId) {
+        return null;
+    }
+
+    const project = version.video.project;
+    const isOwner = project.ownerId === userId;
+    const membership = project.members[0];
+    const workspaceMembership = project.workspace.members[0];
+    const canEdit = isOwner ||
+        membership?.role === ProjectMemberRole.ADMIN ||
+        workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
+
+    return { version, canEdit, isOwner };
+}
+
+// PATCH /api/projects/[projectId]/videos/[videoId]/versions/[versionId]
+export async function PATCH(request: NextRequest, { params }: RouteParams) {
+    try {
+        const limited = await rateLimit(request, 'mutate');
+        if (limited) return limited;
+
+        const session = await auth();
+        const { projectId, videoId, versionId } = await params;
+
+        if (!session?.user?.id) {
+            return apiErrors.unauthorized();
+        }
+
+        const result = await getVersionWithAccess(projectId, videoId, versionId, session.user.id);
+        if (!result) {
+            return apiErrors.notFound('Version');
+        }
+        if (!result.canEdit) {
+            return apiErrors.forbidden('Access denied');
+        }
+
+        const body = await request.json();
+        const { duration, versionLabel, isActive } = body;
+
+        const updateData: Record<string, unknown> = {};
+        if (duration !== undefined) updateData.duration = duration;
+        if (versionLabel !== undefined) updateData.versionLabel = versionLabel?.trim() || null;
+
+        if (isActive === true) {
+            // Deactivate all other versions, then activate this one
+            await db.videoVersion.updateMany({
+                where: { videoParentId: videoId },
+                data: { isActive: false },
+            });
+            updateData.isActive = true;
+        }
+
+        const updated = await db.videoVersion.update({
+            where: { id: versionId },
+            data: updateData,
+        });
+
+        const response = successResponse(updated);
+        return withCacheControl(response, 'private, no-store');
+    } catch (error) {
+        console.error('Error updating version:', error);
+        return apiErrors.internalError('Failed to update version');
+    }
+}
+
+// DELETE /api/projects/[projectId]/videos/[videoId]/versions/[versionId]
+export async function DELETE(request: NextRequest, { params }: RouteParams) {
+    try {
+        const limited = await rateLimit(request, 'mutate');
+        if (limited) return limited;
+
+        const session = await auth();
+        const { projectId, videoId, versionId } = await params;
+
+        if (!session?.user?.id) {
+            return apiErrors.unauthorized();
+        }
+
+        const result = await getVersionWithAccess(projectId, videoId, versionId, session.user.id);
+        if (!result) {
+            return apiErrors.notFound('Version');
+        }
+        if (!result.canEdit) {
+            return apiErrors.forbidden('Access denied');
+        }
+
+        // Check there's more than one version — can't delete the last one
+        const versionCount = await db.videoVersion.count({
+            where: { videoParentId: videoId },
+        });
+
+        if (versionCount <= 1) {
+            return apiErrors.badRequest('Cannot delete the only version. Delete the video instead.');
+        }
+
+        const wasActive = result.version.isActive;
+
+        // Delete the version (cascades to comments)
+        await db.videoVersion.delete({ where: { id: versionId } });
+
+        // If the deleted version was active, activate the latest remaining one
+        if (wasActive) {
+            const latestVersion = await db.videoVersion.findFirst({
+                where: { videoParentId: videoId },
+                orderBy: { versionNumber: 'desc' },
+            });
+            if (latestVersion) {
+                await db.videoVersion.update({
+                    where: { id: latestVersion.id },
+                    data: { isActive: true },
+                });
+            }
+        }
+
+        const response = successResponse({ message: 'Version deleted' });
+        return withCacheControl(response, 'private, no-store');
+    } catch (error) {
+        console.error('Error deleting version:', error);
+        return apiErrors.internalError('Failed to delete version');
+    }
+}

app/api/watch/[videoId]/route.ts

@@ -61,6 +61,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
                 visibility: project.visibility,
             },
             isAuthenticated: !!session?.user?.id,
+            currentUserId: session?.user?.id || null,
             canComment: access.hasAccess,
         });