Respect Clip availability during video playback

templates/clips/changelog/2026-10-23-video-playback-respects-clip-availability.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-10-23
+---
+
+Video playback respects Clip availability.

templates/clips/server/routes/api/video/[recordingId].get.test.ts

@@ -907,6 +907,70 @@ describe("/api/video/:recordingId route", () => {
       expect(fetch).not.toHaveBeenCalled();
     });
 
+    it.each([null, "viewer", "editor", "admin", "owner"])(
+      "does not serve footage from a taken-down Clip to %s",
+      async (role) => {
+        const clip = {
+          visibility: "public",
+          password: null,
+          failureCode: "taken_down",
+        };
+        mockGetDb.mockReturnValue(
+          createDbWithSelectSequence(
+            [{ recordingId: "clip-1" }],
+            ...(role ? [] : [[clip]]),
+            [footageRow],
+          ),
+        );
+        mockResolveAccess.mockResolvedValue(
+          role ? { role, resource: clip } : null,
+        );
+        vi.mocked(fetch).mockResolvedValue(
+          new Response("media", {
+            headers: { "content-type": "video/mp4" },
+          }),
+        );
+
+        const event = makeEvent();
+        const result = await handler(
+          event as unknown as Parameters<typeof handler>[0],
+        );
+
+        expect(event.status).toBe(404);
+        expect(result).toEqual({ error: "Not found" });
+        expect(mockReadAppState).not.toHaveBeenCalled();
+        expect(mockFetchS3ObjectByUrl).not.toHaveBeenCalled();
+        expect(fetch).not.toHaveBeenCalled();
+      },
+    );
+
+    it.each(["viewer", "owner"])(
+      "does not serve taken-down footage under a healthy Clip to a %s",
+      async (role) => {
+        mockGetDb.mockReturnValue(
+          createDbWithSelectSequence(
+            [{ recordingId: "clip-1" }],
+            [{ ...footageRow, failureCode: "taken_down" }],
+          ),
+        );
+        mockResolveAccess.mockResolvedValue({
+          role,
+          resource: { visibility: "public", password: null },
+        });
+
+        const event = makeEvent();
+        const result = await handler(
+          event as unknown as Parameters<typeof handler>[0],
+        );
+
+        expect(event.status).toBe(404);
+        expect(result).toEqual({ error: "Not found" });
+        expect(mockReadAppState).not.toHaveBeenCalled();
+        expect(mockFetchS3ObjectByUrl).not.toHaveBeenCalled();
+        expect(fetch).not.toHaveBeenCalled();
+      },
+    );
+
     it("requires the clip's password, not the footage's", async () => {
       mockGetDb.mockReturnValue(
         createDbWithSelectSequence([{ recordingId: "clip-1" }], [footageRow]),

templates/clips/server/routes/api/video/[recordingId].get.ts

@@ -407,7 +407,10 @@ export default defineEventHandler(async (event: H3Event) => {
         rec = footage as RecordingRow;
       }
 
-      if (rec.failureCode === "taken_down") {
+      if (
+        gate.failureCode === "taken_down" ||
+        rec.failureCode === "taken_down"
+      ) {
         setResponseStatus(event, 404);
         return { error: "Not found" };
       }