cursedbelt-server 3.0.0 → 4.0.0

package/src/server/master-lock/lockPage.spec.ts

@@ -13,7 +13,8 @@
  */
 import { describe, expect, test } from "bun:test";
 import { MASTER_LOCK_PATHS, type MasterLockKdfParams, deriveMasterLockVerifier } from "cursedbelt-core/master-lock";
-import { LOCK_SCRIPT, LOCK_STYLE, lockPageHtml } from "./lockPage";
+import { MASTER_LOCK_ACCOUNTS_SCRIPT } from "./accountsPage";
+import { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, lockPageHtml } from "./lockPage";
 
 const KDF: MasterLockKdfParams = {
 	v: 1,
@@ -24,25 +25,17 @@ const KDF: MasterLockKdfParams = {
 const PASSWORD = "correct horse battery staple";
 
 /**
- * Pull `deriveVerifier` out of the served script.
+ * Evaluate `deriveVerifier` out of the source that is actually served.
  *
- * The script assigns it to `globalThis.__masterLockDerive` for exactly this — a seam that
- * costs one line in the browser and is the difference between a pinned copy and a hopeful
- * one. Everything after that assignment touches `document`, so the source is cut there.
+ * It assigns itself to `globalThis.__masterLockDerive` for exactly this — a seam that costs
+ * one line in the browser and is the difference between a pinned copy and a hopeful one. The
+ * constant touches nothing but `crypto`, so it evaluates as-is with no DOM stub.
  */
 function extractDerive(): (password: string, kdf: MasterLockKdfParams) => Promise<string> {
-	const marker = "globalThis.__masterLockDerive = deriveVerifier;";
-	const cut = LOCK_SCRIPT.indexOf(marker);
-	expect(cut).toBeGreaterThan(0);
-	const source = LOCK_SCRIPT.slice(0, cut + marker.length);
-	// The prelude reads `document`, which does not exist under `bun test`; the slice above
-	// stops before it, but the leading `const` declarations still run — so evaluate in a
-	// function scope with those globals stubbed.
 	const factory = new Function(
-		"document",
-		`${source}\nreturn globalThis.__masterLockDerive;`,
-	) as (doc: unknown) => (password: string, kdf: MasterLockKdfParams) => Promise<string>;
-	return factory({ getElementById: () => ({ addEventListener() {}, setAttribute() {}, removeAttribute() {} }) });
+		`${MASTER_LOCK_DERIVE_SOURCE}\nreturn globalThis.__masterLockDerive;`,
+	) as () => (password: string, kdf: MasterLockKdfParams) => Promise<string>;
+	return factory();
 }
 
 describe("the lock page's hand-copied derivation", () => {
@@ -62,6 +55,17 @@ describe("the lock page's hand-copied derivation", () => {
 			await deriveMasterLockVerifier("another password", kdf),
 		);
 	});
+
+	test("🔴 EVERY served script uses that one copy, so none can drift on its own", () => {
+		// The accounts page derives too — a rotation is two verifiers. If it ever grew its own
+		// transcription, the two tests above would keep passing while the owner's correct
+		// password was refused on exactly one of the two pages.
+		expect(LOCK_SCRIPT).toContain(MASTER_LOCK_DERIVE_SOURCE);
+		expect(MASTER_LOCK_ACCOUNTS_SCRIPT).toContain(MASTER_LOCK_DERIVE_SOURCE);
+		// And nobody has quietly pasted a second `deriveVerifier` alongside the shared one.
+		expect(LOCK_SCRIPT.split("async function deriveVerifier").length - 1).toBe(1);
+		expect(MASTER_LOCK_ACCOUNTS_SCRIPT.split("async function deriveVerifier").length - 1).toBe(1);
+	});
 });
 
 describe("the page itself", () => {

package/src/server/master-lock/lockPage.ts

@@ -12,13 +12,18 @@
  * keep a wall that strict. Two same-origin files cost one round trip each and let the page
  * ship under `script-src 'self'` with no nonce plumbing.
  *
- * ── 🔴 The derivation in `LOCK_SCRIPT` is a HAND COPY of `deriveMasterLockVerifier` ──────
+ * ── 🔴 The derivation in `MASTER_LOCK_DERIVE_SOURCE` is a HAND COPY of
+ *      `deriveMasterLockVerifier` ────────────────────────────────────────────
  * It cannot import it: this file is served to a browser as plain text, outside every build.
  * A copy that drifts derives a verifier that can never match, and the symptom would be "my
  * correct password is refused" — the same shape of bug that cost `apps/collections` a day.
- * So `lockPage.spec.ts` EVALUATES the script's function out of this source and asserts it
- * agrees with the TypeScript one on a fixed vector. Change one, the spec fails until you
- * change the other.
+ * So `lockPage.spec.ts` EVALUATES the function out of this source and asserts it agrees with
+ * the TypeScript one on a fixed vector. Change one, the spec fails until you change the other.
+ *
+ * 🔴 It is its OWN exported constant, and there is exactly ONE of it. `accountsPage.ts` serves
+ * a second browser script that has to derive the same way — a second hand copy would be a
+ * second thing to keep in step, and the pinning spec would only be watching one of them. Both
+ * scripts interpolate this string, and the spec asserts that they do.
  */
 import { MASTER_LOCK_PATHS } from "cursedbelt-core/master-lock";
 
@@ -159,35 +164,14 @@ button.quiet[disabled]{opacity:.5}
 `;
 
 /**
- * The page's script.
+ * 🔴 The ONE browser copy of `deriveMasterLockVerifier`, shared by every page this feature
+ * serves. Pinned by `lockPage.spec.ts`, which evaluates it and compares against the
+ * TypeScript one. Do not "tidy" it apart, and do not write a second copy — interpolate this.
  *
- * Derives in the browser and sends only the verifier — the password itself never crosses
- * the network, which is what makes "saved nowhere" true rather than aspirational.
- *
- * 600,000 PBKDF2 rounds take a beat on a phone, so the button says so; a page that looks
- * frozen gets clicked again, and every extra click is another 600k rounds.
+ * It ends by publishing the function on `globalThis`, which is the seam the spec pulls it
+ * out through and the seam the accounts page's script calls it back through.
  */
-export const LOCK_SCRIPT = `const paths = ${JSON.stringify(MASTER_LOCK_PATHS)};
-
-const form = document.getElementById("ml-form");
-const input = document.getElementById("ml-input");
-const confirmInput = document.getElementById("ml-confirm");
-const hintInput = document.getElementById("ml-hint");
-const submit = document.getElementById("ml-submit");
-const status = document.getElementById("ml-status");
-const forgot = document.getElementById("ml-forgot");
-const hints = document.getElementById("ml-hints");
-
-function say(message, tone) {
-  status.textContent = message;
-  if (tone) status.setAttribute("data-tone", tone);
-  else status.removeAttribute("data-tone");
-}
-
-// ── derivation ───────────────────────────────────────────────────────────────
-// 🔴 Byte-identical to deriveMasterLockVerifier in cursedbelt-core/master-lock. Pinned by
-// lockPage.spec.ts, which evaluates THIS function and compares. Do not "tidy" it apart.
-function unb64u(text) {
+export const MASTER_LOCK_DERIVE_SOURCE = `function unb64u(text) {
   const padded = text.replace(/-/g, "+").replace(/_/g, "/");
   const binary = atob(padded + "=".repeat((4 - (padded.length % 4)) % 4));
   const out = new Uint8Array(binary.length);
@@ -214,13 +198,38 @@ async function deriveVerifier(password, kdf) {
   joined.set(bytes, kek.length);
   return b64u(await pbkdf2(joined, salt, 1));
 }
-globalThis.__masterLockDerive = deriveVerifier;
+globalThis.__masterLockDerive = deriveVerifier;`;
+
+/**
+ * The page's script.
+ *
+ * Derives in the browser and sends only the verifier — the password itself never crosses
+ * the network, which is what makes "saved nowhere" true rather than aspirational.
+ *
+ * 600,000 PBKDF2 rounds take a beat on a phone, so the button says so; a page that looks
+ * frozen gets clicked again, and every extra click is another 600k rounds.
+ */
+export const LOCK_SCRIPT = `const paths = ${JSON.stringify(MASTER_LOCK_PATHS)};
+
+// ── derivation ───────────────────────────────────────────────────────────────
+${MASTER_LOCK_DERIVE_SOURCE}
+
+const form = document.getElementById("ml-form");
+const input = document.getElementById("ml-input");
+const confirmInput = document.getElementById("ml-confirm");
+const hintInput = document.getElementById("ml-hint");
+const submit = document.getElementById("ml-submit");
+const status = document.getElementById("ml-status");
+const forgot = document.getElementById("ml-forgot");
+const hints = document.getElementById("ml-hints");
+
+function say(message, tone) {
+  status.textContent = message;
+  if (tone) status.setAttribute("data-tone", tone);
+  else status.removeAttribute("data-tone");
+}
 
 // ── the page ─────────────────────────────────────────────────────────────────
-// 🔴 Everything below this line touches \`document\` beyond \`getElementById\`, and
-// lockPage.spec.ts cuts the source at the marker above to evaluate the derivation with a
-// stub. Keep page state here, not in the prelude, or that test throws instead of running.
-//
 // Rendered by the server from THIS principal's own record. The server re-decides it on
 // every POST, so this only chooses which form to submit — it cannot grant anything.
 const enrolling = document.body.dataset.mode === "enroll";

package/src/server/media-bun/streaming.ts

@@ -166,11 +166,6 @@ export const hlsLadderArgs = (
     heights: number[];
     crf: number;
     hasAudio: boolean;
-    // When set, ffmpeg AES-128-encrypts every segment using this key-info file (line 1 = the
-    // key URI written into the playlist's #EXT-X-KEY, line 2 = the raw 16-byte key file, line 3
-    // = IV hex). Yields encrypted-at-rest, edge-cacheable segments the player decrypts. Used by
-    // the private-media pipeline; omit for public (plaintext) media.
-    keyInfoFile?: string;
   },
 ): string[] => {
   const hs = opts.heights.length ? opts.heights : [720];
@@ -218,7 +213,6 @@ export const hlsLadderArgs = (
     'vod',
     '-hls_segment_type',
     'mpegts',
-    ...(opts.keyInfoFile ? ['-hls_key_info_file', opts.keyInfoFile] : []),
     '-master_pl_name',
     'master.m3u8',
     '-hls_segment_filename',

package/src/server/storage/fileUploadClient.integration.spec.ts

@@ -1,7 +1,7 @@
 /*
  * Moved from cursedbelt's src/react/media at the 2026-09-15 split: this spec
  * drives the published react-side upload client against this package's storage
- * INTERNALS (diskStore, streamToken, private-media), which are deliberately not
+ * INTERNALS (diskStore, streamToken), which are deliberately not
  * exported — so the spec lives beside them and takes the client half from the
  * published `cursedbelt` instead. Runtime deps stay acyclic; this is dev-only.
  */
@@ -13,8 +13,6 @@ import path from 'node:path';
 import { Hono } from 'hono';
 import { MAX_SINGLE_UPLOAD_BYTES } from 'cursedbelt-core/media/upload-limits';
 import { runMigrations } from '../migration/runner';
-import { generateUserSalt } from '../private-media/crypto';
-import { createUnlockService } from '../private-media/unlock';
 import { createDiskStore } from './diskStore';
 import { createSqliteFileCatalogue } from './files/catalogue';
 import { mountFileRoutes, SINGLE_UPLOAD_TOO_LARGE } from './files/fileRoutes';
@@ -24,11 +22,9 @@ import type { MediaCtx } from './types';
 import { createFileUploadClient } from 'cursedbelt/react/media/upload-client';
 
 // Drives the REAL mountFileRoutes edge — the client and the routes share one header
-// protocol (X-Filename/X-Tags/X-Unlock-Token), so the round-trip is the contract.
+// protocol (X-Filename/X-Tags), so the round-trip is the contract.
 
 const CTX: MediaCtx = { userId: 'u1', tenantId: 't1' };
-const unlock = createUnlockService({ serverSecret: 'srv', unlockSecret: 'unl' });
-const salt = generateUserSalt();
 
 describe('createFileUploadClient ⇄ mountFileRoutes', () => {
   let db: Database;
@@ -55,10 +51,6 @@ describe('createFileUploadClient ⇄ mountFileRoutes', () => {
       token: createStreamTokenService({ secret: 's' }),
       catalogue,
       authorizeUpload: () => CTX,
-      privateUpload: {
-        unlock,
-        authorize: async () => ({ userId: CTX.userId, userSalt: salt }),
-      },
     });
   });
   afterAll(async () => {
@@ -90,17 +82,6 @@ describe('createFileUploadClient ⇄ mountFileRoutes', () => {
     expect(res.file?.size).toBe('replaced'.length);
   });
 
-  test('uploadPrivate with an unlock token lands an encrypted item', async () => {
-    const { token } = await unlock.unlock({ userId: CTX.userId, userSalt: salt, password: 'pw' });
-    const res = await client.uploadPrivate(
-      new File(['secret-bytes'], 'secret.jpg', { type: 'image/jpeg' }),
-      { unlockToken: token, tags: ['hidden'] },
-    );
-    expect(res.ok).toBe(true);
-    if (!res.ok) return;
-    expect(res.file?.processingStatus).toBe('ready'); // image blob path — no ffmpeg
-  });
-
   test('uploadAuto falls back to the streamed PUT when chunked is unwired (404 init)', async () => {
     const big = new File([new Uint8Array(9 * 1024 * 1024)], 'big.bin', {
       type: 'application/octet-stream',

package/src/server/storage/files/adapter.photo.display.spec.ts

@@ -12,7 +12,7 @@ import { createCataloguePhotoSource } from './adapter';
 import { createSqliteFileCatalogue } from './catalogue';
 import type { FileUrls } from './fileRoutes';
 import { FILE_CATALOGUE_MIGRATIONS } from './migrations';
-import type { FileCatalogue, PrivateFileCatalogue } from './types';
+import type { FileCatalogue } from './types';
 import { bytesStream } from 'cursedbelt-core/testing';
 
 // End-to-end: an HEIC photo must gain a browser-safe full-size display derivative + advertise it as
@@ -79,7 +79,7 @@ async function heicBytes(): Promise<Uint8Array | null> {
 describe.skipIf(!haveFfmpeg)('photo display derivative (HEIC)', () => {
   let db: Database;
   let root: string;
-  let cat: FileCatalogue & PrivateFileCatalogue;
+  let cat: FileCatalogue;
 
   beforeAll(async () => {
     db = new Database(':memory:');

package/src/server/storage/files/adapter.photo.spec.ts

@@ -11,7 +11,7 @@ import { createCataloguePhotoSource } from './adapter';
 import { createSqliteFileCatalogue } from './catalogue';
 import type { FileUrls } from './fileRoutes';
 import { FILE_CATALOGUE_MIGRATIONS } from './migrations';
-import type { FileCatalogue, PrivateFileCatalogue } from './types';
+import type { FileCatalogue } from './types';
 
 // The photo source is an image-filtered VIEW over the catalogue: primary bytes via the file
 // route URL, grid thumb via the type-agnostic poster URL (only when the thumbnailer produced one).
@@ -42,7 +42,7 @@ const fakeMediaUrls: MediaUrls = {
 describe('createCataloguePhotoSource', () => {
   let db: Database;
   let root: string;
-  let cat: FileCatalogue & PrivateFileCatalogue;
+  let cat: FileCatalogue;
   let photoId: string;
   let videoId: string;
 

package/src/server/storage/files/adapter.spec.ts

@@ -39,7 +39,6 @@ const videoRecord = (over: Partial<FileRecord> = {}): FileRecord => ({
   size: 10,
   fileType: 'video',
   tags: ['fun'],
-  isPrivate: false,
   favorite: false,
   collectionIds: [],
   hasThumbnail: true,

package/src/server/storage/files/catalogue.media-host.spec.ts

@@ -4,22 +4,15 @@ import { mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { runMigrations } from '../../migration/runner';
-import {
-  cryptBlobStream,
-  derivePasswordSetKey,
-  generateUserSalt,
-  openMeta,
-  unwrapContentKey,
-} from '../../private-media/crypto';
 import { createDiskStore } from '../diskStore';
-import { fsPosterKey, type MediaCtx, type MediaStore, privateSourceKey } from '../types';
+import { fsPosterKey, type MediaCtx, type MediaStore } from '../types';
 import { createSqliteFileCatalogue, fileBinaryKey } from './catalogue';
 import { FILE_CATALOGUE_MIGRATIONS } from './migrations';
-import type { FileCatalogue, PrivateFileCatalogue } from './types';
+import type { FileCatalogue } from './types';
 import { bytesStream } from 'cursedbelt-core/testing';
 
-// New media-host capabilities: private NON-video blobs (photos), in-place byte replacement
-// (the editor's "overwrite original"), and ingest-time image thumbnails.
+// Media-host capabilities: in-place byte replacement (the editor's "overwrite original") and
+// ingest-time image thumbnails.
 
 const CTX: MediaCtx = { userId: 'u1', tenantId: 't1' };
 const OWNER = CTX.userId;
@@ -30,7 +23,7 @@ const drain = async (s: ReadableStream<Uint8Array>): Promise<Uint8Array> =>
 let db: Database;
 let root: string;
 let store: MediaStore;
-let cat: FileCatalogue & PrivateFileCatalogue;
+let cat: FileCatalogue;
 
 beforeAll(async () => {
   db = new Database(':memory:');
@@ -51,55 +44,6 @@ afterAll(async () => {
   await rm(root, { recursive: true, force: true });
 });
 
-describe('private blob ingest (non-video)', () => {
-  const salt = generateUserSalt();
-  const setKey = derivePasswordSetKey('photo-pass', salt);
-  const plaintext = new TextEncoder().encode('these are secret photo bytes — not for the feed');
-  let id: string;
-
-  test('ingests an image as a ready, encrypted blob (no ffmpeg involved)', async () => {
-    const item = await cat.ingestPrivate(
-      CTX,
-      { name: 'secret.jpg', mime: 'image/jpeg', body: stream(plaintext), tags: ['hidden'] },
-      { setKey, keyMode: 'deniable' },
-    );
-    id = item.id;
-    expect(item.processingStatus).toBe('ready');
-    expect(item.size).toBe(plaintext.byteLength);
-    expect(item.hasHls).toBe(false);
-  });
-
-  test('stored bytes are ciphertext; the wrapped content key decrypts them', async () => {
-    const stored = await store.get(privateSourceKey(OWNER, id));
-    expect(stored).not.toBeNull();
-    expect(stored?.byteLength).toBe(plaintext.byteLength); // CTR is length-preserving
-    expect(Buffer.from(stored as Uint8Array).equals(Buffer.from(plaintext))).toBe(false);
-
-    const item = await cat.asPrivateIndex().get(OWNER, id);
-    const content = unwrapContentKey(setKey, item?.wrappedContentKey ?? '');
-    expect(content).not.toBeNull();
-    const decrypted = await drain(
-      cryptBlobStream(content as NonNullable<typeof content>, stream(stored as Uint8Array)),
-    );
-    expect(Buffer.from(decrypted).equals(Buffer.from(plaintext))).toBe(true);
-  });
-
-  test('the sealed descriptor reveals name/mime/tags to its set key only', async () => {
-    const item = await cat.asPrivateIndex().get(OWNER, id);
-    const meta = openMeta<{ name: string; mime: string; tags: string[] }>(
-      setKey,
-      item?.sealedMeta ?? '',
-    );
-    expect(meta).toEqual({ name: 'secret.jpg', mime: 'image/jpeg', tags: ['hidden'] });
-    expect(openMeta(derivePasswordSetKey('wrong', salt), item?.sealedMeta ?? '')).toBeNull();
-  });
-
-  test('index.remove wipes the ciphertext blob too', async () => {
-    await cat.asPrivateIndex().remove(OWNER, id);
-    expect(await store.get(privateSourceKey(OWNER, id))).toBeNull();
-  });
-});
-
 describe('replaceContent — overwrite bytes, keep identity', () => {
   let id: string;
   let collectionId: string;
@@ -137,19 +81,10 @@ describe('replaceContent — overwrite bytes, keep identity', () => {
     expect(new TextDecoder().decode(bytes as Uint8Array)).toBe('v2 much longer replacement bytes');
   });
 
-  test('unknown id → null; private rows refuse replacement', async () => {
+  test('unknown id → null', async () => {
     expect(await cat.replaceContent(CTX, 'nope', { mime: 'text/plain', body: stream('x') })).toBe(
       null,
     );
-    const salt = generateUserSalt();
-    const priv = await cat.ingestPrivate(
-      CTX,
-      { name: 'p.jpg', mime: 'image/jpeg', body: stream('p') },
-      { setKey: derivePasswordSetKey('pw', salt), keyMode: 'deniable' },
-    );
-    expect(
-      cat.replaceContent(CTX, priv.id, { mime: 'image/jpeg', body: stream('q') }),
-    ).rejects.toThrow(/private/);
   });
 });
 

package/src/server/storage/files/catalogue.recover.spec.ts

@@ -10,7 +10,8 @@ import { FILE_CATALOGUE_MIGRATIONS } from './migrations';
 import type { FileCatalogue } from './types';
 
 // recoverProcessing (ported from ca's recoverOnBoot): a restart mid-transcode leaves video rows
-// stuck in processing/pending; public rows get re-kicked (source persists), private rows are failed.
+// stuck in processing/pending; they get re-kicked (the source persists) unless the row has already
+// burned its kick budget, in which case it lands on `failed` — see the attempt-cap describe below.
 describe('FileCatalogue.recoverProcessing', () => {
   let db: Database;
   let root: string;
@@ -25,13 +26,11 @@ describe('FileCatalogue.recoverProcessing', () => {
       store: createDiskStore(root),
       workDir: path.join(root, 'w'),
     });
-    // Simulate two rows a crash left mid-transcode: one public, one private.
-    const insert = db.query(
-      `INSERT INTO files (id, owner, name, mime, size, file_type, is_private, processing_status, processing_progress, storage_backend, created_at, updated_at)
-       VALUES ($id, 'u1', $name, 'video/mp4', 10, 'video', $priv, 'processing', 40, 'disk', 1, 1)`,
-    );
-    insert.run({ $id: 'pub1', $name: 'a.mp4', $priv: 0 });
-    insert.run({ $id: 'prv1', $name: '', $priv: 1 });
+    // Simulate a row a crash left mid-transcode.
+    db.query(
+      `INSERT INTO files (id, owner, name, mime, size, file_type, processing_status, processing_progress, storage_backend, created_at, updated_at)
+       VALUES ($id, 'u1', $name, 'video/mp4', 10, 'video', 'processing', 40, 'disk', 1, 1)`,
+    ).run({ $id: 'pub1', $name: 'a.mp4' });
   });
   afterAll(async () => {
     await Bun.sleep(150); // let the re-kicked public job settle before closing the db
@@ -39,18 +38,10 @@ describe('FileCatalogue.recoverProcessing', () => {
     await rm(root, { recursive: true, force: true });
   });
 
-  test('re-queues stuck public videos and fails stuck private ones', () => {
+  test('re-queues stuck videos', () => {
     const res = cat.recoverProcessing();
     expect(res.requeued).toBe(1); // pub1 re-kicked
-    expect(res.failed).toBe(1); // prv1 can't be re-kicked at boot → failed
-
-    const status = (id: string) =>
-      db
-        .query<{ processing_status: string }, { $id: string }>(
-          'SELECT processing_status FROM files WHERE id = $id',
-        )
-        .get({ $id: id })?.processing_status;
-    expect(status('prv1')).toBe('failed');
+    expect(res.failed).toBe(0);
     // pub1 was re-kicked (its final status is settled by the async pipeline; here we just assert it
     // left the recover call counted as requeued, not failed).
   });
@@ -68,7 +59,7 @@ describe('FileCatalogue.recoverProcessing', () => {
 // The boot-loop guard: when the transcode itself keeps killing the process (ffmpeg OOM →
 // restart → re-kick), the attempt cap must land the row on `failed` instead of re-kicking forever.
 describe('FileCatalogue.recoverProcessing attempt cap', () => {
-  test('marks a public video failed once processing_attempts reaches the cap', async () => {
+  test('marks a video failed once processing_attempts reaches the cap', async () => {
     const db = new Database(':memory:');
     runMigrations(db, FILE_CATALOGUE_MIGRATIONS);
     const root = await mkdtemp(path.join(tmpdir(), 'fc-recover-cap-'));
@@ -79,8 +70,8 @@ describe('FileCatalogue.recoverProcessing attempt cap', () => {
       maxProcessingAttempts: 2,
     });
     db.query(
-      `INSERT INTO files (id, owner, name, mime, size, file_type, is_private, processing_status, processing_progress, storage_backend, processing_attempts, created_at, updated_at)
-       VALUES ('loop1', 'u1', 'l.mp4', 'video/mp4', 10, 'video', 0, 'processing', 40, 'disk', 2, 1, 1)`,
+      `INSERT INTO files (id, owner, name, mime, size, file_type, processing_status, processing_progress, storage_backend, processing_attempts, created_at, updated_at)
+       VALUES ('loop1', 'u1', 'l.mp4', 'video/mp4', 10, 'video', 'processing', 40, 'disk', 2, 1, 1)`,
     ).run();
 
     const res = cat.recoverProcessing();
@@ -111,8 +102,8 @@ describe('FileCatalogue transcodeVideos: false', () => {
       transcodeVideos: false,
     });
     db.query(
-      `INSERT INTO files (id, owner, name, mime, size, file_type, is_private, processing_status, processing_progress, storage_backend, created_at, updated_at)
-       VALUES ('raw1', 'u1', 'r.mp4', 'video/mp4', 10, 'video', 0, 'processing', 40, 'disk', 1, 1)`,
+      `INSERT INTO files (id, owner, name, mime, size, file_type, processing_status, processing_progress, storage_backend, created_at, updated_at)
+       VALUES ('raw1', 'u1', 'r.mp4', 'video/mp4', 10, 'video', 'processing', 40, 'disk', 1, 1)`,
     ).run();
 
     const res = cat.recoverProcessing();