From bc59605267eb28fc892a66182f9e69adf47a6f70 Mon Sep 17 00:00:00 2001
From: junmin <coom1222@gmail.com>
Date: Wed, 16 Sep 2026 11:42:21 +0900
Subject: [PATCH] =?UTF-8?q?fix(security):=20F01=C2=B7F02=C2=B7F03=C2=B7F05?=
 =?UTF-8?q?=20=EC=84=9C=EB=B2=84=20=EC=B7=A8=EC=95=BD=EC=A0=90=20=EB=B3=B4?=
 =?UTF-8?q?=EC=99=84?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- F01: Gemini를 사용한 브리핑 생성을 서버로 이동

  - 서버 환경변수로 API 키 관리
  - 인증·소유권 확인 후 저장된 분석 결과로 프롬프트 구성
  - 호출 제한·캐시·동시 요청 제어·타임아웃 적용

- F02: 영상 및 분석 리포트 소유권 검증

  - 타인 영상·삭제된 영상·없는 영상 접근 차단
  - URL 서명과 외부 API 호출 전에 권한 확인
  - 접근 불가·분석 대기·실패 상태 구분

- F03: access와 refresh 토큰의 사용 목적 검증

  - 일반 API에서 refresh 토큰 사용 차단
  - 서명·만료·사용자 ID 검증 강화
  - 토큰 갱신 시 저장된 refresh 토큰 확인

- F05: 업로드 파일의 실제 내용 검증

  - ffprobe 기반 영상 형식·크기·해상도 검사
  - 썸네일 검사 및 JPEG 재인코딩
  - 검증 실패 시 저장과 분석 요청 차단
  - 서버에서 MIME과 객체 키 결정
---
 .dockerignore                                 |   8 +
 .github/workflows/ci-cd.yml                   |   3 +
 Dockerfile                                    |   3 +-
 .../backend/config/JwtAuthFilter.java         |  12 +-
 .../rallytrack/backend/config/JwtUtil.java    |  19 +-
 .../rallytrack/backend/config/S3Service.java  |  18 +-
 .../controller/AnalysisController.java        |   3 +-
 .../analysis/service/AnalysisService.java     |  13 +-
 .../domain/briefing/BriefingController.java   |  24 +++
 .../domain/briefing/BriefingPrompt.java       |  79 +++++++++
 .../domain/briefing/BriefingService.java      |  82 +++++++++
 .../backend/domain/briefing/GeminiClient.java | 101 +++++++++++
 .../domain/user/service/UserService.java      |   8 +-
 .../video/controller/VideoController.java     |   3 +-
 .../video/repository/VideoRepository.java     |   3 +
 .../video/service/MediaValidationService.java | 167 ++++++++++++++++++
 .../domain/video/service/ValidatedMedia.java  |  18 ++
 .../video/service/VideoAccessService.java     |  21 +++
 .../domain/video/service/VideoService.java    |  62 ++++---
 .../global/exception/ApiException.java        |  17 ++
 .../exception/GlobalExceptionHandler.java     |  19 ++
 .../backend/global/response/ApiResponse.java  |   1 +
 src/main/resources/application.yml.example    |   6 +-
 .../rallytrack/backend/SecurityHttpTest.java  | 156 ++++++++++++++++
 .../backend/config/JwtSecurityTest.java       |  54 ++++++
 .../domain/briefing/BriefingServiceTest.java  |  91 ++++++++++
 .../domain/briefing/GeminiClientTest.java     |  62 +++++++
 .../video/service/MediaValidationTest.java    |  92 ++++++++++
 src/test/resources/media/sample.mov           | Bin 0 -> 1829 bytes
 src/test/resources/media/sample.mp4           | Bin 0 -> 1882 bytes
 src/test/resources/media/sample.webm          | Bin 0 -> 972 bytes
 31 files changed, 1095 insertions(+), 50 deletions(-)
 create mode 100644 .dockerignore
 create mode 100644 src/main/java/com/rallytrack/backend/domain/briefing/BriefingController.java
 create mode 100644 src/main/java/com/rallytrack/backend/domain/briefing/BriefingPrompt.java
 create mode 100644 src/main/java/com/rallytrack/backend/domain/briefing/BriefingService.java
 create mode 100644 src/main/java/com/rallytrack/backend/domain/briefing/GeminiClient.java
 create mode 100644 src/main/java/com/rallytrack/backend/domain/video/service/MediaValidationService.java
 create mode 100644 src/main/java/com/rallytrack/backend/domain/video/service/ValidatedMedia.java
 create mode 100644 src/main/java/com/rallytrack/backend/domain/video/service/VideoAccessService.java
 create mode 100644 src/main/java/com/rallytrack/backend/global/exception/ApiException.java
 create mode 100644 src/test/java/com/rallytrack/backend/SecurityHttpTest.java
 create mode 100644 src/test/java/com/rallytrack/backend/config/JwtSecurityTest.java
 create mode 100644 src/test/java/com/rallytrack/backend/domain/briefing/BriefingServiceTest.java
 create mode 100644 src/test/java/com/rallytrack/backend/domain/briefing/GeminiClientTest.java
 create mode 100644 src/test/java/com/rallytrack/backend/domain/video/service/MediaValidationTest.java
 create mode 100644 src/test/resources/media/sample.mov
 create mode 100644 src/test/resources/media/sample.mp4
 create mode 100644 src/test/resources/media/sample.webm

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..35ccc3a
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,8 @@
+
+.git
+.gradle
+build
+.env
+.env.*
+src/main/resources/application.yml
+src/main/resources/application-secret.yml
diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index f3dcb7d..5ee6276 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -31,6 +31,9 @@ jobs:
       - name: Validate wrapper and configure Gradle cache
         uses: gradle/actions/setup-gradle@v6
 
+      - name: Install media validator
+        run: sudo apt-get update && sudo apt-get install -y ffmpeg
+
       - name: Run unit and context tests
         run: ./gradlew test --no-daemon
 
diff --git a/Dockerfile b/Dockerfile
index 1afad10..e02d402 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,13 +1,14 @@
 FROM gradle:8.5-jdk17 AS builder
 WORKDIR /app
 COPY . .
+RUN cp src/main/resources/application.yml.example src/main/resources/application.yml
 # 테스트는 건너뛰고 빌드만 빠르게 수행
 RUN ./gradlew bootJar -x test
 
 # 2. 실행 단계
 FROM eclipse-temurin:17-jdk
 # compose healthcheck용 curl
-RUN apt-get update && apt-get install -y --no-install-recommends curl \
+RUN apt-get update && apt-get install -y --no-install-recommends curl ffmpeg \
     && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 # 빌드 단계에서 만들어진 jar 파일을 가져옴
diff --git a/src/main/java/com/rallytrack/backend/config/JwtAuthFilter.java b/src/main/java/com/rallytrack/backend/config/JwtAuthFilter.java
index 982c9bc..34df4b5 100644
--- a/src/main/java/com/rallytrack/backend/config/JwtAuthFilter.java
+++ b/src/main/java/com/rallytrack/backend/config/JwtAuthFilter.java
@@ -75,12 +75,16 @@ protected void doFilterInternal(HttpServletRequest request,
 
         if (authHeader != null && authHeader.startsWith("Bearer ")) {
             String token = authHeader.substring(7);
-            if (jwtUtil.isValid(token)) {
-                Long userId = jwtUtil.getUserId(token);
-                request.setAttribute("userId", userId);
-                filterChain.doFilter(request, response);
+            Long userId;
+            try {
+                userId = jwtUtil.parseAccessToken(token).get("user_id", Long.class);
+            } catch (io.jsonwebtoken.JwtException | IllegalArgumentException e) {
+                reject(response);
                 return;
             }
+            request.setAttribute("userId", userId);
+            filterChain.doFilter(request, response);
+            return;
         }
 
         // 인증 실패
diff --git a/src/main/java/com/rallytrack/backend/config/JwtUtil.java b/src/main/java/com/rallytrack/backend/config/JwtUtil.java
index 2219cce..fc7941c 100644
--- a/src/main/java/com/rallytrack/backend/config/JwtUtil.java
+++ b/src/main/java/com/rallytrack/backend/config/JwtUtil.java
@@ -55,12 +55,25 @@ public Claims parseToken(String token) {
     }
 
     public Long getUserId(String token) {
-        return parseToken(token).get("user_id", Long.class);
+        return parseAccessToken(token).get("user_id", Long.class);
     }
 
-    public boolean isValid(String token) {
+    public Claims parseAccessToken(String token) {
+        return parseTypedToken(token, "access");
+    }
+
+    private Claims parseTypedToken(String token, String expectedType) {
+        Claims claims = parseToken(token);
+        Long userId = claims.get("user_id", Long.class);
+        if (!expectedType.equals(claims.get("token_type", String.class)) || userId == null || userId <= 0 || claims.getExpiration() == null) {
+            throw new IllegalArgumentException("Invalid token purpose or principal");
+        }
+        return claims;
+    }
+
+    public boolean isValidRefreshToken(String token) {
         try {
-            parseToken(token);
+            parseTypedToken(token, "refresh");
             return true;
         } catch (Exception e) {
             return false;
diff --git a/src/main/java/com/rallytrack/backend/config/S3Service.java b/src/main/java/com/rallytrack/backend/config/S3Service.java
index c483149..07b6adf 100644
--- a/src/main/java/com/rallytrack/backend/config/S3Service.java
+++ b/src/main/java/com/rallytrack/backend/config/S3Service.java
@@ -3,7 +3,6 @@
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
-import org.springframework.web.multipart.MultipartFile;
 import software.amazon.awssdk.core.sync.RequestBody;
 import software.amazon.awssdk.services.s3.S3Client;
 import software.amazon.awssdk.services.s3.model.DeleteObjectRequest;
@@ -13,7 +12,6 @@
 import software.amazon.awssdk.services.s3.presigner.model.GetObjectPresignRequest;
 import software.amazon.awssdk.services.s3.presigner.model.PutObjectPresignRequest;
 
-import java.io.IOException;
 import java.time.Duration;
 import java.util.UUID;
 
@@ -32,17 +30,11 @@ public class S3Service {
 
     // DB에는 전체 URL이 아닌 object key(예: videos/uuid_name.mp4)만 저장한다.
     // 스토리지 endpoint(MinIO ↔ AWS)가 바뀌어도 DB 데이터가 유효하도록 하기 위함.
-    public String upLoadFile(MultipartFile file) throws IOException {
-        String key = "videos/" + UUID.randomUUID() + "_" + file.getOriginalFilename();
-
-        PutObjectRequest request = PutObjectRequest.builder()
-                .bucket(bucket)
-                .key(key)
-                .contentType(file.getContentType())
-                .build();
-
-        s3Client.putObject(request, RequestBody.fromBytes(file.getBytes()));
-
+    public String uploadMedia(com.rallytrack.backend.domain.video.service.ValidatedMedia media) {
+        String key = "videos/" + UUID.randomUUID() + "." + media.extension();
+        PutObjectRequest request = PutObjectRequest.builder().bucket(bucket).key(key)
+                .contentType(media.contentType()).build();
+        s3Client.putObject(request, RequestBody.fromFile(media.path()));
         return key;
     }
 
diff --git a/src/main/java/com/rallytrack/backend/domain/analysis/controller/AnalysisController.java b/src/main/java/com/rallytrack/backend/domain/analysis/controller/AnalysisController.java
index 8379230..4356642 100644
--- a/src/main/java/com/rallytrack/backend/domain/analysis/controller/AnalysisController.java
+++ b/src/main/java/com/rallytrack/backend/domain/analysis/controller/AnalysisController.java
@@ -29,8 +29,9 @@ public class AnalysisController {
     @Operation(summary = "분석 리포트 조회", description = "영상 분석 리포트를 조회합니다.")
     @GetMapping("/{videoId}")
     public ResponseEntity<ApiResponse<AnalysisReportResponse>> getReport(
+            @RequestAttribute("userId") Long userId,
             @PathVariable Long videoId) {
-        AnalysisReportResponse response = analysisService.getReport(videoId);
+        AnalysisReportResponse response = analysisService.getReport(userId, videoId);
         return ResponseEntity.ok(ApiResponse.success("분석 리포트 조회 성공", response));
     }
 
diff --git a/src/main/java/com/rallytrack/backend/domain/analysis/service/AnalysisService.java b/src/main/java/com/rallytrack/backend/domain/analysis/service/AnalysisService.java
index 7b4c70f..b13d36b 100644
--- a/src/main/java/com/rallytrack/backend/domain/analysis/service/AnalysisService.java
+++ b/src/main/java/com/rallytrack/backend/domain/analysis/service/AnalysisService.java
@@ -26,6 +26,7 @@
 @RequiredArgsConstructor
 public class AnalysisService {
 
+    private final com.rallytrack.backend.domain.video.service.VideoAccessService videoAccessService;
     private final AnalysisResultRepository analysisResultRepository;
     private final HitRepository hitRepository;
     private final VideoRepository videoRepository;
@@ -34,9 +35,17 @@ public class AnalysisService {
     // ── 분석 리포트 조회 ─────────────────────────────────────
 
     @Transactional(readOnly = true)
-    public AnalysisReportResponse getReport(Long videoId) {
+    public AnalysisReportResponse getReport(Long userId, Long videoId) {
+        Video video = videoAccessService.requireOwned(userId, videoId);
+        if ("FAILED".equals(video.getVideoStatus())) {
+            throw new com.rallytrack.backend.global.exception.ApiException(409, "ANALYSIS_FAILED", "영상 분석에 실패했습니다.");
+        }
+        if (!"COMPLETED".equals(video.getVideoStatus())) {
+            throw new com.rallytrack.backend.global.exception.ApiException(404, "ANALYSIS_NOT_READY", "영상 분석을 준비하고 있습니다.");
+        }
         AnalysisResult result = analysisResultRepository.findByVideoVideoId(videoId)
-                .orElseThrow(() -> new ResourceNotFroundException("해당 영상의 분석 결과가 없습니다."));
+                .orElseThrow(() -> new com.rallytrack.backend.global.exception.ApiException(
+                        409, "ANALYSIS_RESULT_UNAVAILABLE", "분석 결과를 불러올 수 없습니다."));
 
         // HitDto에 minimap_x/y 포함 → 프론트 히트맵이 미니맵과 동일한 좌표 사용
         List<AnalysisReportResponse.HitDto> hitDtos = result.getHits().stream()
diff --git a/src/main/java/com/rallytrack/backend/domain/briefing/BriefingController.java b/src/main/java/com/rallytrack/backend/domain/briefing/BriefingController.java
new file mode 100644
index 0000000..1f43666
--- /dev/null
+++ b/src/main/java/com/rallytrack/backend/domain/briefing/BriefingController.java
@@ -0,0 +1,24 @@
+package com.rallytrack.backend.domain.briefing;
+
+import com.rallytrack.backend.global.response.ApiResponse;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Pattern;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.*;
+
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/api/v1/videos")
+public class BriefingController {
+    private final BriefingService service;
+    public record Request(@NotNull @Pattern(regexp = "top|bottom") String player) {}
+    public record Response(Long videoId, String player, String text) {}
+
+    @PostMapping("/{videoId}/briefing")
+    public ApiResponse<Response> generate(@RequestAttribute("userId") Long userId,
+            @PathVariable Long videoId, @Valid @RequestBody Request request) {
+        return ApiResponse.success("브리핑 생성 성공", new Response(videoId, request.player(),
+                service.generate(userId, videoId, request.player())));
+    }
+}
diff --git a/src/main/java/com/rallytrack/backend/domain/briefing/BriefingPrompt.java b/src/main/java/com/rallytrack/backend/domain/briefing/BriefingPrompt.java
new file mode 100644
index 0000000..fee5abd
--- /dev/null
+++ b/src/main/java/com/rallytrack/backend/domain/briefing/BriefingPrompt.java
@@ -0,0 +1,79 @@
+package com.rallytrack.backend.domain.briefing;
+
+import com.rallytrack.backend.domain.analysis.dto.*;
+
+final class BriefingPrompt {
+    static final String VERSION = "v1";
+    private BriefingPrompt() {}
+    static String grade(int n) { return n >= 85 ? "S" : n >= 70 ? "A" : n >= 50 ? "B" : n >= 30 ? "C" : "D"; }
+    private static int count(Integer n) { return n == null ? 0 : n; }
+    static String create(AnalysisReportResponse report, String player) {
+        var p = "top".equals(player) ? report.getPlayers().getTop() : report.getPlayers().getBottom();
+        var a = p.getAbilityMetrics(); var summary = report.getSummary();
+        String label = "top".equals(player) ? "Top Player" : "Bottom Player";
+        var strokes = counts(report, player);
+        boolean pro = java.util.stream.Stream.of(counts(report, "top"), counts(report, "bottom"))
+                .anyMatch(c -> c.get("lob") > 0 || c.get("drop") > 0);
+        var kinds = pro ? java.util.List.of("serve", "lob", "smash", "drop", "drive", "clear")
+                : java.util.List.of("serve", "smash", "clear", "drive");
+        int total = kinds.stream().mapToInt(strokes::get).sum();
+        String breakdown = kinds.stream().map(k -> k + ": " + strokes.get(k) + "회")
+                .collect(java.util.stream.Collectors.joining(", "));
+        return """
+                당신은 전문 배드민턴 코치입니다.
+                아래 데이터는 경기 영상에서 분석한 [%s] 개인의 데이터입니다.
+                [경기 전체 개요 — 참고용, 개인 수치 아님]
+                - 경기 결과(Bottom 기준): %s (Bottom %d : Top %d)
+                - 총 경기 시간: %s
+                - 양측 합산 총 스트로크: %d회
+                [%s 개인 스트로크]
+                - 개인 스트로크 합계: %d회
+                - 분류 체계: %s
+                - %s
+                [%s 능력치 등급 (S > A > B > C > D)]
+                - 공격성 %s등급: 전체 타격 중 스매시 비율
+                - 랠리력 %s등급: 랠리 지속력 및 지구력
+                - 수비력 %s등급: 빠른 반응 속도
+                - 기동력 %s등급: 코트 커버리지
+                - 안정성 %s등급: 실책 없이 안정적으로 플레이하는 능력
+                [기존 코치 피드백]
+                %s
+                [출력 형식]
+                - 간결하게 (모바일 친화적)
+                - 다음 H2 제목을 정확히 순서대로 사용: ## 총평, ## 핵심 지표, ## 강점, ## 보완점, ## 추천 훈련
+                - 총평은 2~3문장. 핵심 지표는 불릿 3~5개. 강점과 보완점은 각각 불릿 2개. 추천 훈련은 불릿 3개.
+                - 섹션 제목 외에는 H1/H2/H3를 쓰지 않는다.
+                """.formatted(label, summary.getMatchOutcome(), summary.getMyScore(), summary.getOpponentScore(),
+                summary.getMatchTime(), summary.getTotalStrokeCount(), label, total, pro ? "프로 6종" : "아마추어 4종",
+                breakdown, label, grade(a.getAggression()), grade(a.getRally()), grade(a.getDefense()),
+                grade(a.getMobility()), grade(a.getConsistency()),
+                p.getAiCoaching() == null ? "(없음)" : p.getAiCoaching().getFeedbackText());
+    }
+    private static java.util.Map<String, Integer> counts(AnalysisReportResponse report, String player) {
+        var p = "top".equals(player) ? report.getPlayers().getTop() : report.getPlayers().getBottom();
+        var s = p.getStrokeTypes();
+        var counts = new java.util.HashMap<String, Integer>();
+        for (String key : java.util.List.of("serve", "lob", "smash", "drop", "drive", "clear", "net", "others")) counts.put(key, 0);
+        int matched = 0;
+        if (report.getHitsData() != null) for (var hit : report.getHitsData()) {
+            String side = hit.getPlayer() == null ? "" : hit.getPlayer().toLowerCase(java.util.Locale.ROOT);
+            if (!(player.equals(side) || ("top".equals(player) ? "pink_top" : "green_bottom").equals(side))) continue;
+            String type = hit.getStrokeType() == null ? "" : hit.getStrokeType().toLowerCase(java.util.Locale.ROOT).trim();
+            if (type.isEmpty()) continue;
+            String key = type.contains("smash") || type.contains("스매시") ? "smash"
+                    : type.contains("lob") || type.contains("로브") ? "lob"
+                    : type.contains("drop") || type.contains("드롭") || type.contains("커트") ? "drop"
+                    : type.contains("drive") || type.contains("드라이브") ? "drive"
+                    : type.contains("serve") || type.contains("service") || type.contains("서브") ? "serve"
+                    : type.contains("clear") || type.contains("클리어") ? "clear"
+                    : type.contains("net") || type.contains("네트") || type.contains("헤어핀") ? "net" : "others";
+            counts.merge(key, 1, Integer::sum); matched++;
+        }
+        if (matched == 0) {
+            counts.put("serve", count(s.getServe())); counts.put("smash", count(s.getSmash()));
+            counts.put("drop", count(s.getDrop())); counts.put("drive", count(s.getDrive()));
+            counts.put("clear", count(s.getClear())); counts.put("net", count(s.getNet())); counts.put("others", count(s.getOthers()));
+        }
+        return counts;
+    }
+}
diff --git a/src/main/java/com/rallytrack/backend/domain/briefing/BriefingService.java b/src/main/java/com/rallytrack/backend/domain/briefing/BriefingService.java
new file mode 100644
index 0000000..82738fa
--- /dev/null
+++ b/src/main/java/com/rallytrack/backend/domain/briefing/BriefingService.java
@@ -0,0 +1,82 @@
+package com.rallytrack.backend.domain.briefing;
+
+import com.rallytrack.backend.domain.analysis.service.AnalysisService;
+import com.rallytrack.backend.global.exception.ApiException;
+import org.springframework.stereotype.Service;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.time.Clock;
+import java.util.*;
+import java.util.concurrent.*;
+
+@Service
+public class BriefingService {
+    private record Cached(String text, long until) {}
+    private record Usage(long window, int count) {}
+    private final AnalysisService analysis;
+    private final GeminiClient client;
+    private final Clock clock;
+    private final Map<String, Cached> cache = new LinkedHashMap<>();
+    private final Map<String, CompletableFuture<String>> inFlight = new HashMap<>();
+    private final Map<Long, Usage> users = new HashMap<>();
+    private Usage global = new Usage(0, 0);
+    private final Object lock = new Object();
+
+    @org.springframework.beans.factory.annotation.Autowired
+    public BriefingService(AnalysisService analysis, GeminiClient client) { this(analysis, client, Clock.systemUTC()); }
+    BriefingService(AnalysisService analysis, GeminiClient client, Clock clock) {
+        this.analysis = analysis; this.client = client; this.clock = clock;
+    }
+
+    public String generate(Long userId, Long videoId, String player) {
+        if (!Set.of("top", "bottom").contains(player == null ? "" : player))
+            throw new ApiException(400, "INVALID_PLAYER", "선수 위치가 올바르지 않습니다.");
+        // This MUST precede both the cache and the provider, even for an already cached video.
+        var report = analysis.getReport(userId, videoId);
+        client.requireEnabled();
+        String prompt = BriefingPrompt.create(report, player);
+        String key = userId + ":" + videoId + ":" + player + ":" + client.model() + ":" + BriefingPrompt.VERSION + ":" + digest(prompt);
+        CompletableFuture<String> future;
+        boolean leader = false;
+        synchronized (lock) {
+            long now = clock.millis();
+            cache.values().removeIf(c -> c.until <= now);
+            Cached existing = cache.get(key);
+            if (existing != null) return existing.text;
+            future = inFlight.get(key);
+            if (future == null) {
+                long window = now / 60000;
+                users.values().removeIf(u -> u.window != window);
+                Usage user = users.getOrDefault(userId, new Usage(window, 0));
+                if (global.window != window) global = new Usage(window, 0);
+                if (user.count >= 6 || global.count >= 30 || inFlight.size() >= 2 || users.size() >= 10000)
+                    throw new ApiException(429, "BRIEFING_RATE_LIMIT", "요청이 많습니다. 잠시 후 다시 시도해주세요.");
+                users.put(userId, new Usage(window, user.count + 1));
+                global = new Usage(window, global.count + 1);
+                future = new CompletableFuture<>(); inFlight.put(key, future); leader = true;
+            }
+        }
+        if (leader) {
+            try {
+                String text = client.generate(prompt);
+                synchronized (lock) {
+                    if (cache.size() >= 256) cache.remove(cache.keySet().iterator().next());
+                    cache.put(key, new Cached(text, clock.millis() + 1800000));
+                }
+                future.complete(text);
+            } catch (RuntimeException e) { future.completeExceptionally(e);
+            } finally { synchronized (lock) { inFlight.remove(key); } }
+        }
+        try { return future.get(35, TimeUnit.SECONDS);
+        } catch (ExecutionException e) {
+            if (e.getCause() instanceof ApiException a) throw a;
+            throw new ApiException(502, "BRIEFING_PROVIDER_ERROR", "브리핑을 생성하지 못했습니다.");
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt(); throw new ApiException(503, "BRIEFING_UNAVAILABLE", "브리핑이 중단되었습니다.");
+        } catch (TimeoutException e) { throw new ApiException(504, "BRIEFING_TIMEOUT", "브리핑 응답이 지연되고 있습니다."); }
+    }
+    private String digest(String text) {
+        try { return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(text.getBytes(StandardCharsets.UTF_8)));
+        } catch (java.security.NoSuchAlgorithmException e) { throw new IllegalStateException(e); }
+    }
+}
diff --git a/src/main/java/com/rallytrack/backend/domain/briefing/GeminiClient.java b/src/main/java/com/rallytrack/backend/domain/briefing/GeminiClient.java
new file mode 100644
index 0000000..b2b0147
--- /dev/null
+++ b/src/main/java/com/rallytrack/backend/domain/briefing/GeminiClient.java
@@ -0,0 +1,101 @@
+package com.rallytrack.backend.domain.briefing;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.rallytrack.backend.global.exception.ApiException;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+import java.net.URI;
+import java.net.http.*;
+import java.nio.ByteBuffer;
+import java.time.Duration;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.*;
+import java.util.concurrent.Flow;
+
+@Component
+public class GeminiClient {
+    private final ObjectMapper mapper;
+    private final String apiKey;
+    private final String model;
+    private final boolean enabled;
+    private final HttpClient http;
+    private final Duration deadline;
+
+    @org.springframework.beans.factory.annotation.Autowired
+    public GeminiClient(ObjectMapper mapper, @Value("${GEMINI_API_KEY:}") String apiKey,
+            @Value("${GEMINI_MODEL:gemini-3.6-flash}") String model,
+            @Value("${GEMINI_ENABLED:false}") boolean enabled) {
+        this(mapper, apiKey, model, enabled, HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(5))
+                .followRedirects(HttpClient.Redirect.NEVER).build(), Duration.ofSeconds(30));
+    }
+    GeminiClient(ObjectMapper mapper, String apiKey, String model, boolean enabled, HttpClient http, Duration deadline) {
+        this.mapper = mapper; this.apiKey = apiKey; this.model = model; this.enabled = enabled;
+        this.http = http; this.deadline = deadline;
+        if (!model.matches("[a-zA-Z0-9.-]{1,80}")) throw new IllegalArgumentException("Invalid Gemini model setting");
+    }
+    public String model() { return model; }
+    public void requireEnabled() {
+        if (!enabled || apiKey.isBlank()) throw new ApiException(503, "BRIEFING_UNAVAILABLE", "브리핑 기능을 사용할 수 없습니다.");
+    }
+    public String generate(String prompt) {
+        requireEnabled();
+        if (prompt.length() > 12000) throw new ApiException(400, "BRIEFING_INPUT_TOO_LARGE", "분석 데이터가 너무 큽니다.");
+        CompletableFuture<HttpResponse<byte[]>> pending = null;
+        try {
+            byte[] body = mapper.writeValueAsBytes(Map.of(
+                    "contents", List.of(Map.of("parts", List.of(Map.of("text", prompt)))),
+                    "generationConfig", Map.of("maxOutputTokens", 1500, "temperature", 0.4)));
+            HttpRequest request = HttpRequest.newBuilder(URI.create(
+                    "https://generativelanguage.googleapis.com/v1beta/models/" + model + ":generateContent"))
+                    .header("x-goog-api-key", apiKey).header("Content-Type", "application/json")
+                    .timeout(Duration.ofSeconds(25)).POST(HttpRequest.BodyPublishers.ofByteArray(body)).build();
+            pending = http.sendAsync(request, info -> new LimitedBodySubscriber(65536));
+            HttpResponse<byte[]> response = pending.get(deadline.toMillis(), TimeUnit.MILLISECONDS);
+            if (response.statusCode() != 200) throw providerError();
+            var root = mapper.readTree(response.body());
+            var candidate = root.path("candidates").path(0);
+            if (!"STOP".equals(candidate.path("finishReason").asText())) throw providerError();
+            StringBuilder text = new StringBuilder();
+            for (var part : candidate.path("content").path("parts")) {
+                if (!part.path("thought").asBoolean(false)) text.append(part.path("text").asText(""));
+            }
+            if (text.isEmpty() || text.length() > 8000) throw providerError();
+            return text.toString();
+        } catch (TimeoutException e) {
+            if (pending != null) pending.cancel(true);
+            throw new ApiException(504, "BRIEFING_TIMEOUT", "브리핑 응답이 지연되고 있습니다. 잠시 후 다시 시도해주세요.");
+        } catch (ExecutionException e) {
+            if (e.getCause() instanceof HttpTimeoutException)
+                throw new ApiException(504, "BRIEFING_TIMEOUT", "브리핑 응답이 지연되고 있습니다. 잠시 후 다시 시도해주세요.");
+            throw providerError();
+        } catch (InterruptedException e) {
+            if (pending != null) pending.cancel(true);
+            Thread.currentThread().interrupt(); throw providerError();
+        } catch (ApiException e) { throw e;
+        } catch (Exception e) { throw providerError(); }
+    }
+    private ApiException providerError() {
+        // Never propagate upstream bodies, URLs, headers or exceptions containing credentials.
+        return new ApiException(502, "BRIEFING_PROVIDER_ERROR", "브리핑 생성에 실패했습니다. 잠시 후 다시 시도해주세요.");
+    }
+
+    static final class LimitedBodySubscriber implements HttpResponse.BodySubscriber<byte[]> {
+        private final HttpResponse.BodySubscriber<byte[]> delegate = HttpResponse.BodySubscribers.ofByteArray();
+        private final int max;
+        private int received;
+        private Flow.Subscription subscription;
+        LimitedBodySubscriber(int max) { this.max = max; }
+        public CompletionStage<byte[]> getBody() { return delegate.getBody(); }
+        public void onSubscribe(Flow.Subscription s) { subscription = s; delegate.onSubscribe(s); }
+        public void onNext(List<ByteBuffer> items) {
+            long bytes = items.stream().mapToLong(ByteBuffer::remaining).sum();
+            if (bytes > max - received) {
+                subscription.cancel(); delegate.onError(new IllegalStateException("Provider response exceeds limit")); return;
+            }
+            received += (int) bytes; delegate.onNext(items);
+        }
+        public void onError(Throwable t) { delegate.onError(t); }
+        public void onComplete() { delegate.onComplete(); }
+    }
+}
diff --git a/src/main/java/com/rallytrack/backend/domain/user/service/UserService.java b/src/main/java/com/rallytrack/backend/domain/user/service/UserService.java
index 4e3f4aa..658b0ce 100644
--- a/src/main/java/com/rallytrack/backend/domain/user/service/UserService.java
+++ b/src/main/java/com/rallytrack/backend/domain/user/service/UserService.java
@@ -125,15 +125,17 @@ public LoginResponse refreshToken(String refreshTokenStr) {
         }
 
         // 3. JWT 자체 검증
-        if (!jwtUtil.isValid(refreshTokenStr)) {
+        if (!jwtUtil.isValidRefreshToken(refreshTokenStr)) {
             refreshTokenRepository.delete(refreshToken);
             throw new IllegalArgumentException("리프레시 토큰이 유효하지 않습니다.");
         }
 
         User user = refreshToken.getUser();
 
-        // 4. 기존 리프레시 토큰 삭제
+        // Flush deletion before insertion: JWT timestamps have second precision, so a fast
+        // refresh can produce the same token and otherwise collide with the unique index.
         refreshTokenRepository.delete(refreshToken);
+        refreshTokenRepository.flush();
 
         // 5. 새 토큰 발급
         String newAccessToken = jwtUtil.generateAccessToken(user.getId(), user.getEmail());
@@ -166,4 +168,4 @@ public void logout(String refreshTokenStr) {
         refreshTokenRepository.findByToken(refreshTokenStr)
                 .ifPresent(refreshTokenRepository::delete);
     }
-}
\ No newline at end of file
+}
diff --git a/src/main/java/com/rallytrack/backend/domain/video/controller/VideoController.java b/src/main/java/com/rallytrack/backend/domain/video/controller/VideoController.java
index 737fae0..f447cf3 100644
--- a/src/main/java/com/rallytrack/backend/domain/video/controller/VideoController.java
+++ b/src/main/java/com/rallytrack/backend/domain/video/controller/VideoController.java
@@ -65,9 +65,10 @@ public ResponseEntity<ApiResponse<VideoUploadResponse>> uploadVideo(
     @Operation(summary = "영상 상세 정보 조회", description = "영상 플레이어 정보 및 타임라인 이벤트를 조회합니다.")
     @GetMapping("/{videoId}")
     public ResponseEntity<ApiResponse<VideoDetailResponse>> getVideoDetail(
+            @RequestAttribute("userId") Long userId,
             @PathVariable("videoId") Long videoId) {
 
-        VideoDetailResponse response = videoService.getVideoDetail(videoId);
+        VideoDetailResponse response = videoService.getVideoDetail(userId, videoId);
         return ResponseEntity.ok(ApiResponse.success("성공", response));
     }
 
diff --git a/src/main/java/com/rallytrack/backend/domain/video/repository/VideoRepository.java b/src/main/java/com/rallytrack/backend/domain/video/repository/VideoRepository.java
index e4f532c..22f8d6a 100644
--- a/src/main/java/com/rallytrack/backend/domain/video/repository/VideoRepository.java
+++ b/src/main/java/com/rallytrack/backend/domain/video/repository/VideoRepository.java
@@ -6,6 +6,9 @@
 import java.util.List;
 
 public interface VideoRepository extends JpaRepository<Video, Long> {
+    java.util.Optional<Video> findByVideoIdAndUserIdAndDeletedAtIsNullAndVideoStatusNot(
+            Long videoId, Long userId, String videoStatus);
+
     List<Video> findByUserIdAndVideoStatusNotOrderByUploadDateDesc(Long userId, String videoStatus);
     int countByUserIdAndVideoStatusNot(Long userId, String videoStatus);
 }
diff --git a/src/main/java/com/rallytrack/backend/domain/video/service/MediaValidationService.java b/src/main/java/com/rallytrack/backend/domain/video/service/MediaValidationService.java
new file mode 100644
index 0000000..1988cb7
--- /dev/null
+++ b/src/main/java/com/rallytrack/backend/domain/video/service/MediaValidationService.java
@@ -0,0 +1,167 @@
+package com.rallytrack.backend.domain.video.service;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.rallytrack.backend.global.exception.ApiException;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Service;
+import org.springframework.web.multipart.MultipartFile;
+import javax.imageio.ImageIO;
+import javax.imageio.ImageReader;
+import javax.imageio.stream.MemoryCacheImageInputStream;
+import java.awt.Color;
+import java.awt.image.BufferedImage;
+import java.io.*;
+import java.nio.file.*;
+import java.util.*;
+import java.util.concurrent.*;
+
+@Service
+public class MediaValidationService {
+    public static final long MAX_VIDEO_BYTES = 500L * 1024 * 1024;
+    public static final long MAX_THUMBNAIL_BYTES = 5L * 1024 * 1024;
+    private final Semaphore probes = new Semaphore(2);
+    private final String ffprobe;
+    private final ObjectMapper mapper = new ObjectMapper();
+    public MediaValidationService(@Value("${MEDIA_FFPROBE:ffprobe}") String ffprobe) { this.ffprobe = ffprobe; }
+
+    public ValidatedMedia video(MultipartFile file) throws IOException {
+        checkSize(file, MAX_VIDEO_BYTES);
+        if (!probes.tryAcquire()) throw new ApiException(429, "MEDIA_BUSY", "영상 검사 중입니다. 잠시 후 다시 시도해주세요.");
+        Path input = null;
+        boolean keep = false;
+        try {
+            input = copyBounded(file, MAX_VIDEO_BYTES);
+            byte[] header;
+            try (InputStream in = Files.newInputStream(input)) { header = in.readNBytes(4096); }
+            String ext;
+            String mime;
+            if (header.length >= 12 && new String(header, 4, 4, java.nio.charset.StandardCharsets.US_ASCII).equals("ftyp")) {
+                boolean mov = new String(header, 8, 4, java.nio.charset.StandardCharsets.US_ASCII).equals("qt  ");
+                ext = mov ? "mov" : "mp4"; mime = mov ? "video/quicktime" : "video/mp4";
+            } else if (header.length > 8 && header[0] == 0x1a && (header[1] & 255) == 0x45
+                    && (header[2] & 255) == 0xdf && (header[3] & 255) == 0xa3
+                    && contains(header, new byte[]{0x42, (byte)0x82, (byte)0x84, 'w', 'e', 'b', 'm'})) {
+                ext = "webm"; mime = "video/webm";
+            } else { throw invalid(); }
+            String name = Optional.ofNullable(file.getOriginalFilename()).orElse("").toLowerCase(Locale.ROOT);
+            if (!name.endsWith("." + ext)) throw invalid();
+            checkMime(file, mime);
+            probe(input, ext);
+            keep = true;
+            return new ValidatedMedia(input, ext, mime);
+        } finally {
+            if (!keep && input != null) Files.deleteIfExists(input);
+            probes.release();
+        }
+    }
+
+    private void probe(Path input, String ext) throws IOException {
+        Process process;
+        try {
+            process = new ProcessBuilder(ffprobe, "-v", "error", "-max_alloc", "33554432",
+                    "-protocol_whitelist", "file", "-format_whitelist", "mov,matroska,webm",
+                    "-enable_drefs", "0", "-use_absolute_path", "0", "-max_streams", "32",
+                    "-probesize", "5242880", "-analyzeduration", "5000000",
+                    "-show_entries", "format=format_name:stream=codec_type,width,height", "-of", "json",
+                    "-i", input.toString()).redirectError(ProcessBuilder.Redirect.DISCARD).start();
+        } catch (IOException e) {
+            throw new ApiException(503, "MEDIA_VALIDATOR_UNAVAILABLE", "영상 검사기를 사용할 수 없습니다.");
+        }
+        CompletableFuture<byte[]> output = new CompletableFuture<>();
+        Thread reader = new Thread(() -> {
+            try (InputStream stream = process.getInputStream()) {
+                byte[] bytes = stream.readNBytes(65537);
+                if (bytes.length > 65536) { process.destroyForcibly(); output.completeExceptionally(invalid()); }
+                else output.complete(bytes);
+            } catch (Exception e) { output.completeExceptionally(e); }
+        }, "media-probe-output");
+        reader.setDaemon(true); reader.start();
+        try {
+            if (!process.waitFor(15, TimeUnit.SECONDS)) throw new ApiException(422, "MEDIA_VALIDATION_TIMEOUT", "영상 검사 시간이 초과되었습니다.");
+            if (process.exitValue() != 0) throw invalid();
+            var json = mapper.readTree(output.get(1, TimeUnit.SECONDS));
+            String format = json.path("format").path("format_name").asText();
+            if ("webm".equals(ext) ? !format.contains("webm") : !format.contains("mov")) throw invalid();
+            boolean video = false;
+            for (var stream : json.path("streams")) {
+                if ("video".equals(stream.path("codec_type").asText())) {
+                    int width = stream.path("width").asInt(); int height = stream.path("height").asInt();
+                    if (width <= 0 || height <= 0 || width > 7680 || height > 4320 || (long)width * height > 33177600) throw invalid();
+                    video = true;
+                }
+            }
+            if (!video) throw invalid();
+        } catch (InterruptedException e) { Thread.currentThread().interrupt(); throw invalid();
+        } catch (ExecutionException | TimeoutException e) { throw invalid();
+        } finally {
+            process.destroyForcibly();
+            try { process.getInputStream().close(); } catch (IOException ignored) {}
+        }
+    }
+
+    public ValidatedMedia thumbnail(MultipartFile file) throws IOException {
+        if (!probes.tryAcquire()) throw new ApiException(429, "MEDIA_BUSY", "파일 검사 중입니다. 잠시 후 다시 시도해주세요.");
+        try { return normalizeThumbnail(file); } finally { probes.release(); }
+    }
+
+    private ValidatedMedia normalizeThumbnail(MultipartFile file) throws IOException {
+        checkSize(file, MAX_THUMBNAIL_BYTES);
+        // Small, bounded encoded image; inspect dimensions before allocating pixels.
+        byte[] bytes;
+        try (InputStream stream = file.getInputStream()) { bytes = stream.readNBytes((int)MAX_THUMBNAIL_BYTES + 1); }
+        if (bytes.length == 0 || bytes.length > MAX_THUMBNAIL_BYTES) throw invalid();
+        try (var stream = new MemoryCacheImageInputStream(new ByteArrayInputStream(bytes))) {
+            var readers = ImageIO.getImageReaders(stream);
+            if (!readers.hasNext()) throw invalid();
+            ImageReader reader = readers.next();
+            try {
+                String format = reader.getFormatName().toLowerCase(Locale.ROOT);
+                if (!Set.of("jpeg", "png").contains(format)) throw invalid();
+                checkMime(file, format.equals("png") ? "image/png" : "image/jpeg");
+                reader.setInput(stream, true, true);
+                int w = reader.getWidth(0), h = reader.getHeight(0);
+                if (w <= 0 || h <= 0 || w > 4096 || h > 4096 || (long)w * h > 8388608) throw invalid();
+                BufferedImage decoded = reader.read(0);
+                BufferedImage rgb = new BufferedImage(w, h, BufferedImage.TYPE_INT_RGB);
+                var graphics = rgb.createGraphics();
+                try { graphics.setColor(Color.WHITE); graphics.fillRect(0, 0, w, h); graphics.drawImage(decoded, 0, 0, null); }
+                finally { graphics.dispose(); decoded.flush(); }
+                Path result = Files.createTempFile("rally-thumb-", ".jpg");
+                try {
+                    if (!ImageIO.write(rgb, "jpeg", result.toFile())) throw invalid();
+                    return new ValidatedMedia(result, "jpg", "image/jpeg");
+                } catch (Exception e) { Files.deleteIfExists(result); throw e;
+                } finally { rgb.flush(); }
+            } finally { reader.dispose(); }
+        } catch (javax.imageio.IIOException e) { throw invalid(); }
+    }
+
+    private Path copyBounded(MultipartFile file, long max) throws IOException {
+        Path path = Files.createTempFile("rally-video-", ".media");
+        try (InputStream in = file.getInputStream(); OutputStream out = Files.newOutputStream(path)) {
+            byte[] buffer = new byte[65536]; long total = 0; int n;
+            while ((n = in.read(buffer)) != -1) {
+                total += n; if (total > max) throw tooLarge(); out.write(buffer, 0, n);
+            }
+            if (total == 0) throw invalid();
+            return path;
+        } catch (Exception e) { Files.deleteIfExists(path); throw e; }
+    }
+    private void checkSize(MultipartFile file, long max) {
+        if (file == null || file.isEmpty()) throw invalid();
+        if (file.getSize() > max) throw tooLarge();
+    }
+    private void checkMime(MultipartFile file, String actual) {
+        String mime = file.getContentType();
+        if (mime != null && !mime.isBlank() && !mime.equalsIgnoreCase("application/octet-stream") && !mime.equalsIgnoreCase(actual)) throw invalid();
+    }
+    private boolean contains(byte[] bytes, byte[] needle) {
+        outer: for (int i = 0; i <= bytes.length - needle.length; i++) {
+            for (int j = 0; j < needle.length; j++) if (bytes[i+j] != needle[j]) continue outer;
+            return true;
+        }
+        return false;
+    }
+    private ApiException invalid() { return new ApiException(415, "INVALID_MEDIA", "MP4·MOV·WebM 영상과 JPEG·PNG 썸네일만 업로드할 수 있습니다."); }
+    private ApiException tooLarge() { return new ApiException(413, "UPLOAD_TOO_LARGE", "영상은 500MB, 썸네일은 5MB까지 업로드할 수 있습니다."); }
+}
diff --git a/src/main/java/com/rallytrack/backend/domain/video/service/ValidatedMedia.java b/src/main/java/com/rallytrack/backend/domain/video/service/ValidatedMedia.java
new file mode 100644
index 0000000..ed78fd3
--- /dev/null
+++ b/src/main/java/com/rallytrack/backend/domain/video/service/ValidatedMedia.java
@@ -0,0 +1,18 @@
+package com.rallytrack.backend.domain.video.service;
+
+import java.io.IOException;
+import java.nio.file.*;
+
+/** Only MediaValidationService can construct uploadable media. */
+public final class ValidatedMedia implements AutoCloseable {
+    private final Path path;
+    private final String extension;
+    private final String contentType;
+    ValidatedMedia(Path path, String extension, String contentType) {
+        this.path = path; this.extension = extension; this.contentType = contentType;
+    }
+    public Path path() { return path; }
+    public String extension() { return extension; }
+    public String contentType() { return contentType; }
+    public void close() throws IOException { Files.deleteIfExists(path); }
+}
diff --git a/src/main/java/com/rallytrack/backend/domain/video/service/VideoAccessService.java b/src/main/java/com/rallytrack/backend/domain/video/service/VideoAccessService.java
new file mode 100644
index 0000000..55fe06e
--- /dev/null
+++ b/src/main/java/com/rallytrack/backend/domain/video/service/VideoAccessService.java
@@ -0,0 +1,21 @@
+package com.rallytrack.backend.domain.video.service;
+
+import com.rallytrack.backend.domain.video.entity.Video;
+import com.rallytrack.backend.domain.video.repository.VideoRepository;
+import com.rallytrack.backend.global.exception.ApiException;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+@RequiredArgsConstructor
+public class VideoAccessService {
+    private final VideoRepository videos;
+
+    @Transactional(readOnly = true)
+    public Video requireOwned(Long userId, Long videoId) {
+        if (userId == null || userId <= 0 || videoId == null || videoId <= 0) throw ApiException.notFound();
+        return videos.findByVideoIdAndUserIdAndDeletedAtIsNullAndVideoStatusNot(videoId, userId, "DELETED")
+                .orElseThrow(ApiException::notFound);
+    }
+}
diff --git a/src/main/java/com/rallytrack/backend/domain/video/service/VideoService.java b/src/main/java/com/rallytrack/backend/domain/video/service/VideoService.java
index 8e291f0..f3224c6 100644
--- a/src/main/java/com/rallytrack/backend/domain/video/service/VideoService.java
+++ b/src/main/java/com/rallytrack/backend/domain/video/service/VideoService.java
@@ -36,6 +36,8 @@
 public class VideoService {
 
         private final VideoRepository videoRepository;
+        private final VideoAccessService videoAccessService;
+        private final MediaValidationService mediaValidationService;
         private final TimelineEventRepository timelineEventRepository;
         private final AnalysisResultRepository analysisResultRepository;
         private final UserRepository userRepository;
@@ -58,25 +60,23 @@ public VideoUploadResponse uploadVideo(Long userId, MultipartFile videoFile,
                                 .orElseThrow(() -> new IllegalArgumentException("사용자를 찾을 수 없습니다."));
                 String analysisMode = AnalysisMode.normalize(mode);
 
+                if (title == null || title.isBlank() || title.length() > 255)
+                        throw new IllegalArgumentException("영상 이름은 1~255자로 입력해주세요.");
+                if (durationSeconds != null && (durationSeconds <= 0 || durationSeconds > 86400))
+                        throw new IllegalArgumentException("영상 길이가 올바르지 않습니다.");
+                Map<String, Map<String, Integer>> corners = validateCorners(courtCorners);
                 String thumbnailS3Url = null;
-                try {
-                        thumbnailS3Url = s3Service.upLoadFile(thumbnailImage);
-                } catch (IOException e) {
-                        System.out.println("썸네일 업로드 실패: " + e.getMessage());
-                }
-
-                String s3Url;
-                try {
-                        s3Url = s3Service.upLoadFile(videoFile);
-                } catch (IOException e) {
-                        throw new RuntimeException("영상 파일 업로드에 실패했습니다.");
-                }
-
-                Map<String, Map<String, Integer>> corners;
-                try {
-                        corners = objectMapper.readValue(courtCorners, Map.class);
-                } catch (Exception e) {
-                        throw new RuntimeException("코트 코너 데이터 파싱 실패", e);
+                String s3Url = null;
+                // Validate both files before any object/DB write or AI request.
+                try (ValidatedMedia original = mediaValidationService.video(videoFile);
+                     ValidatedMedia thumbnail = mediaValidationService.thumbnail(thumbnailImage)) {
+                        s3Url = s3Service.uploadMedia(original);
+                        thumbnailS3Url = s3Service.uploadMedia(thumbnail);
+                } catch (IOException | RuntimeException e) {
+                        if (s3Url != null) { try { s3Service.deleteFile(s3Url); } catch (Exception ignored) {} }
+                        if (thumbnailS3Url != null) { try { s3Service.deleteFile(thumbnailS3Url); } catch (Exception ignored) {} }
+                        if (e instanceof com.rallytrack.backend.global.exception.ApiException a) throw a;
+                        throw new com.rallytrack.backend.global.exception.ApiException(503, "UPLOAD_UNAVAILABLE", "파일 업로드에 실패했습니다.");
                 }
 
                 Video video = Video.builder()
@@ -182,12 +182,32 @@ public VideoUploadResponse uploadVideo(Long userId, MultipartFile videoFile,
                                 .build();
         }
 
+        private Map<String, Map<String, Integer>> validateCorners(String raw) {
+                if (raw == null || raw.length() > 4096) throw new IllegalArgumentException("코트 좌표가 올바르지 않습니다.");
+                try {
+                        var root = objectMapper.readTree(raw);
+                        if (!root.isObject()) throw new IllegalArgumentException();
+                        Map<String, Map<String, Integer>> corners = new HashMap<>();
+                        for (String key : List.of("topLeft", "topRight", "bottomLeft", "bottomRight", "netTopLeft", "netTopRight")) {
+                                var point = root.get(key);
+                                if (point == null && key.startsWith("net")) continue;
+                                if (point == null || !point.isObject()) throw new IllegalArgumentException();
+                                var x = point.get("x"); var y = point.get("y");
+                                if (x == null || y == null || !x.isIntegralNumber() || !y.isIntegralNumber()
+                                        || !x.canConvertToInt() || !y.canConvertToInt()
+                                        || x.asInt() < 0 || y.asInt() < 0 || x.asInt() > 7680 || y.asInt() > 4320)
+                                        throw new IllegalArgumentException();
+                                corners.put(key, Map.of("x", x.asInt(), "y", y.asInt()));
+                        }
+                        return corners;
+                } catch (Exception e) { throw new IllegalArgumentException("코트 좌표가 올바르지 않습니다."); }
+        }
+
         // ── 영상 상세 조회 ───────────────────────────────────────
 
         @Transactional(readOnly = true)
-        public VideoDetailResponse getVideoDetail(Long videoId) {
-                Video video = videoRepository.findById(videoId)
-                                .orElseThrow(() -> new IllegalArgumentException("영상을 찾을 수 없습니다."));
+        public VideoDetailResponse getVideoDetail(Long userId, Long videoId) {
+                Video video = videoAccessService.requireOwned(userId, videoId);
 
                 List<TimelineEvent> events = timelineEventRepository
                                 .findByVideoVideoIdOrderByTimestampAsc(videoId);
diff --git a/src/main/java/com/rallytrack/backend/global/exception/ApiException.java b/src/main/java/com/rallytrack/backend/global/exception/ApiException.java
new file mode 100644
index 0000000..dd9a0e6
--- /dev/null
+++ b/src/main/java/com/rallytrack/backend/global/exception/ApiException.java
@@ -0,0 +1,17 @@
+package com.rallytrack.backend.global.exception;
+
+import lombok.Getter;
+
+@Getter
+public class ApiException extends RuntimeException {
+    private final int status;
+    private final String errorCode;
+    public ApiException(int status, String errorCode, String message) {
+        super(message);
+        this.status = status;
+        this.errorCode = errorCode;
+    }
+    public static ApiException notFound() {
+        return new ApiException(404, "RESOURCE_NOT_FOUND", "영상을 찾을 수 없습니다.");
+    }
+}
diff --git a/src/main/java/com/rallytrack/backend/global/exception/GlobalExceptionHandler.java b/src/main/java/com/rallytrack/backend/global/exception/GlobalExceptionHandler.java
index 3dc3aa3..c0d0bd1 100644
--- a/src/main/java/com/rallytrack/backend/global/exception/GlobalExceptionHandler.java
+++ b/src/main/java/com/rallytrack/backend/global/exception/GlobalExceptionHandler.java
@@ -8,6 +8,18 @@
 
 @RestControllerAdvice
 public class GlobalExceptionHandler {
+    @ExceptionHandler(ApiException.class)
+    public ResponseEntity<ApiResponse<Void>> handleApi(ApiException e) {
+        return ResponseEntity.status(e.getStatus()).body(ApiResponse.<Void>builder()
+                .code(e.getStatus()).message(e.getMessage()).errorCode(e.getErrorCode()).build());
+    }
+
+    @ExceptionHandler(org.springframework.web.multipart.MaxUploadSizeExceededException.class)
+    public ResponseEntity<ApiResponse<Void>> handleUploadLimit(Exception e) {
+        return ResponseEntity.status(413).body(ApiResponse.<Void>builder()
+                .code(413).errorCode("UPLOAD_TOO_LARGE").message("업로드 크기 제한을 초과했습니다.").build());
+    }
+
 
     @ExceptionHandler(ResourceNotFroundException.class)
     public ResponseEntity<ApiResponse<Void>> handleNotFound(ResourceNotFroundException e) {
@@ -15,6 +27,13 @@ public ResponseEntity<ApiResponse<Void>> handleNotFound(ResourceNotFroundExcepti
                 .body(ApiResponse.error(404, e.getMessage()));
     }
 
+    @ExceptionHandler({org.springframework.http.converter.HttpMessageNotReadableException.class,
+            org.springframework.web.bind.MethodArgumentNotValidException.class})
+    public ResponseEntity<ApiResponse<Void>> handleInvalidRequest(Exception e) {
+        return ResponseEntity.badRequest().body(ApiResponse.<Void>builder()
+                .code(400).errorCode("INVALID_REQUEST").message("요청 형식이 올바르지 않습니다.").build());
+    }
+
     @ExceptionHandler(IllegalArgumentException.class)
     public ResponseEntity<ApiResponse<Void>> handleIllegalArgument(IllegalArgumentException e) {
         return ResponseEntity.badRequest()
diff --git a/src/main/java/com/rallytrack/backend/global/response/ApiResponse.java b/src/main/java/com/rallytrack/backend/global/response/ApiResponse.java
index ab08393..de004b6 100644
--- a/src/main/java/com/rallytrack/backend/global/response/ApiResponse.java
+++ b/src/main/java/com/rallytrack/backend/global/response/ApiResponse.java
@@ -14,6 +14,7 @@ public class ApiResponse<T> {
     private int code;
     private String message;
     private T data;
+    private String errorCode;
 
     public static <T> ApiResponse<T> success(String message, T data) {
         return ApiResponse.<T>builder()
diff --git a/src/main/resources/application.yml.example b/src/main/resources/application.yml.example
index a50e3df..779647f 100644
--- a/src/main/resources/application.yml.example
+++ b/src/main/resources/application.yml.example
@@ -7,7 +7,7 @@ spring:
   servlet:
     multipart:
       max-file-size: 500MB
-      max-request-size: 1GB
+      max-request-size: 510MB
 
   datasource:
     url: ${DB_URL:jdbc:mariadb://localhost:3307/rallytrack?useUnicode=true&characterEncoding=utf8mb4&serverTimezone=Asia/Seoul}
@@ -67,3 +67,7 @@ app:
   slack:
     # rally-track-back-log 채널 Incoming Webhook (비우면 알림 비활성)
     webhook-url: ${SLACK_BACK_WEBHOOK:}
+
+# Backend-only environment variables (read directly by dedicated clients):
+# GEMINI_API_KEY (secret), GEMINI_ENABLED=false, GEMINI_MODEL=gemini-3.6-flash
+# MEDIA_FFPROBE=ffprobe. Missing/failed validation blocks uploads.
diff --git a/src/test/java/com/rallytrack/backend/SecurityHttpTest.java b/src/test/java/com/rallytrack/backend/SecurityHttpTest.java
new file mode 100644
index 0000000..e0fc448
--- /dev/null
+++ b/src/test/java/com/rallytrack/backend/SecurityHttpTest.java
@@ -0,0 +1,156 @@
+package com.rallytrack.backend;
+
+import com.rallytrack.backend.config.*;
+import com.rallytrack.backend.domain.briefing.GeminiClient;
+import com.rallytrack.backend.domain.user.entity.*;
+import com.rallytrack.backend.domain.user.repository.*;
+import com.rallytrack.backend.domain.user.service.UserService;
+import com.rallytrack.backend.domain.video.entity.Video;
+import com.rallytrack.backend.domain.video.repository.VideoRepository;
+import com.rallytrack.backend.domain.analysis.repository.AnalysisResultRepository;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.*;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.test.context.ActiveProfiles;
+import org.springframework.test.context.bean.override.mockito.MockitoBean;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.mock.web.MockMultipartFile;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.web.client.RestTemplate;
+import java.time.LocalDateTime;
+import java.util.*;
+import static org.mockito.Mockito.*;
+import static org.assertj.core.api.Assertions.*;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
+
+@SpringBootTest @AutoConfigureMockMvc @ActiveProfiles("test") @Transactional
+class SecurityHttpTest {
+    @Autowired MockMvc mvc;
+    @Autowired JwtUtil jwt;
+    @Autowired VideoRepository videos;
+    @Autowired UserRepository users;
+    @Autowired RefreshTokenRepository tokens;
+    @Autowired AnalysisResultRepository analyses;
+    @Autowired UserService userService;
+    @Autowired ObjectMapper mapper;
+    @MockitoBean S3Service storage;
+    @MockitoBean SlackNotifier slack;
+    @MockitoBean RestTemplate ai;
+    @MockitoBean GeminiClient gemini;
+    User owner, other;
+    @BeforeEach void setup() {
+        owner = users.save(User.builder().email(UUID.randomUUID()+"@test.invalid").build());
+        other = users.save(User.builder().email(UUID.randomUUID()+"@test.invalid").build());
+        when(storage.generatePresignedUrl(anyString())).thenAnswer(i -> "https://media.test/"+i.getArgument(0));
+        when(gemini.model()).thenReturn("test-model"); when(gemini.generate(anyString())).thenReturn("합성 브리핑");
+    }
+    String auth(User u) { return "Bearer " + jwt.generateAccessToken(u.getId(), u.getEmail()); }
+    Video video(User u, String status) {
+        return videos.save(Video.builder().title("synthetic").user(u).videoStatus(status)
+                .s3Url("videos/test.mp4").thumbnailUrl("videos/test.jpg").skeletonVideoUrl("skeletons/test.mp4")
+                .minimapVideoUrl("minimaps/test.mp4").build());
+    }
+    @Test void foreignMissingDeletedAndOrphanVideosHaveIdentical404WithoutSigningOrProviderCalls() throws Exception {
+        var foreign = video(other, "COMPLETED");
+        var deletedStatus = video(owner, "DELETED");
+        var deletedAt = video(owner, "COMPLETED"); deletedAt.setDeletedAt(LocalDateTime.now()); videos.save(deletedAt);
+        var orphan = video(null, "COMPLETED");
+        for (long id : List.of(foreign.getVideoId(), deletedStatus.getVideoId(), deletedAt.getVideoId(), orphan.getVideoId(), Long.MAX_VALUE)) {
+            for (String path : List.of("/api/v1/videos/", "/api/v1/analysis/")) {
+                mvc.perform(get(path+id).header("Authorization", auth(owner))).andExpect(status().isNotFound())
+                        .andExpect(jsonPath("$.errorCode").value("RESOURCE_NOT_FOUND"));
+            }
+            mvc.perform(post("/api/v1/videos/"+id+"/briefing").header("Authorization", auth(owner))
+                    .contentType("application/json").content("{\"player\":\"top\"}"))
+                    .andExpect(status().isNotFound()).andExpect(jsonPath("$.errorCode").value("RESOURCE_NOT_FOUND"));
+        }
+        verifyNoInteractions(storage, gemini);
+    }
+    @Test void ownedDetailSignsAllFourObjects() throws Exception {
+        var v = video(owner, "COMPLETED");
+        mvc.perform(get("/api/v1/videos/"+v.getVideoId()).header("Authorization", auth(owner)))
+                .andExpect(status().isOk()).andExpect(jsonPath("$.data.videoInfo.videoUrl").value("https://media.test/videos/test.mp4"));
+        verify(storage, times(4)).generatePresignedUrl(anyString());
+    }
+    @Test void reportStateIsOnlyVisibleToOwner() throws Exception {
+        for (String state : List.of("PROCESSING", "FAILED", "COMPLETED")) {
+            var v = video(owner, state);
+            int code = state.equals("PROCESSING") ? 404 : 409;
+            String error = state.equals("PROCESSING") ? "ANALYSIS_NOT_READY" : state.equals("FAILED") ? "ANALYSIS_FAILED" : "ANALYSIS_RESULT_UNAVAILABLE";
+            mvc.perform(get("/api/v1/analysis/"+v.getVideoId()).header("Authorization", auth(owner)))
+                    .andExpect(status().is(code)).andExpect(jsonPath("$.errorCode").value(error));
+            mvc.perform(post("/api/v1/videos/"+v.getVideoId()+"/briefing").header("Authorization", auth(owner))
+                    .contentType("application/json").content("{\"player\":\"bottom\"}")).andExpect(status().is(code));
+        }
+        verifyNoInteractions(gemini);
+    }
+    @Test void refreshTokenCannotReadUploadChangeScoreDeleteOrGenerateEvenAfterLogout() throws Exception {
+        String refresh = jwt.generateRefreshToken(owner.getId(), owner.getEmail());
+        tokens.save(RefreshToken.builder().user(owner).token(refresh).expiresAt(LocalDateTime.now().plusDays(1)).build());
+        userService.logout(refresh);
+        assertThatThrownBy(() -> userService.refreshToken(refresh)).isInstanceOf(IllegalArgumentException.class);
+        for (var request : List.of(get("/api/v1/videos/1"), get("/api/v1/analysis/1"), post("/api/v1/videos"),
+                delete("/api/v1/videos/1"), patch("/api/v1/videos/1/score"), post("/api/v1/videos/1/briefing"))) {
+            mvc.perform(request.header("Authorization", "Bearer "+refresh)).andExpect(status().isUnauthorized());
+        }
+        verifyNoInteractions(storage, ai, gemini);
+    }
+    @Test void refreshEndpointRejectsAccessTokenEvenIfItIsInDatabase() throws Exception {
+        String access = jwt.generateAccessToken(owner.getId(), owner.getEmail());
+        tokens.save(RefreshToken.builder().user(owner).token(access).expiresAt(LocalDateTime.now().plusDays(1)).build());
+        assertThatThrownBy(() -> userService.refreshToken(access)).isInstanceOf(IllegalArgumentException.class);
+    }
+    @Test void validRefreshStillIssuesAccessToken() {
+        String refresh = jwt.generateRefreshToken(owner.getId(), owner.getEmail());
+        tokens.save(RefreshToken.builder().user(owner).token(refresh).expiresAt(LocalDateTime.now().plusDays(1)).build());
+        var response = userService.refreshToken(refresh);
+        assertThat(jwt.getUserId(response.getAccessToken())).isEqualTo(owner.getId());
+        assertThat(jwt.isValidRefreshToken(response.getRefreshToken())).isTrue();
+    }
+    @Test void invalidUploadCausesNoObjectDatabaseOrAiWrites() throws Exception {
+        long before = videos.count();
+        mvc.perform(multipart("/api/v1/videos")
+                .file(new MockMultipartFile("videoFile", "payload.mp4", "video/mp4", "<html>marker</html>".getBytes()))
+                .file(new MockMultipartFile("thumbnailImage", "image.png", "image/png", new byte[]{1}))
+                .param("title", "synthetic").param("courtCorners", corners()).header("Authorization", auth(owner)))
+                .andExpect(status().isUnsupportedMediaType());
+        assertThat(videos.count()).isEqualTo(before); verifyNoInteractions(storage, ai);
+    }
+    static String corners() { return "{\"topLeft\":{\"x\":0,\"y\":0},\"topRight\":{\"x\":100,\"y\":0},\"bottomLeft\":{\"x\":0,\"y\":100},\"bottomRight\":{\"x\":100,\"y\":100}}"; }
+    @Test void uploadCallbackReportAndBriefingPreserveObjectKeyContract() throws Exception {
+        byte[] clip;
+        try (var input = getClass().getResourceAsStream("/media/sample.mp4")) { clip = input.readAllBytes(); }
+        var image = new java.io.ByteArrayOutputStream();
+        javax.imageio.ImageIO.write(new java.awt.image.BufferedImage(16,16,1), "png", image);
+        when(storage.uploadMedia(any())).thenReturn("videos/original.mp4", "videos/thumbnail.jpg");
+        when(storage.generateAiPresignedUrl(any())).thenReturn("http://ai-media.test/original?signature=test");
+        when(storage.generateAiPresignedUploadUrl(any())).thenReturn("http://ai-media.test/output?signature=test");
+        var response = mvc.perform(multipart("/api/v1/videos")
+                .file(new MockMultipartFile("videoFile", "sample.mp4", "video/mp4", clip))
+                .file(new MockMultipartFile("thumbnailImage", "image.png", "image/png", image.toByteArray()))
+                .param("title", "synthetic").param("courtCorners", corners()).param("mode", "amateur")
+                .header("Authorization", auth(owner))).andExpect(status().isCreated()).andReturn();
+        long id = mapper.readTree(response.getResponse().getContentAsString()).path("data").path("videoId").asLong();
+        var stored = videos.findById(id).orElseThrow(); assertThat(stored.getS3Url()).isEqualTo("videos/original.mp4");
+        var request = org.mockito.ArgumentCaptor.forClass(Map.class);
+        verify(ai).postForEntity(anyString(), request.capture(), eq(String.class));
+        assertThat(request.getValue().get("s3Url")).isEqualTo("http://ai-media.test/original?signature=test");
+        String skeleton = request.getValue().get("skeletonVideoUrl").toString();
+        String minimap = request.getValue().get("minimapVideoUrl").toString();
+        assertThat(skeleton).startsWith("skeletons/").endsWith(".mp4");
+        mvc.perform(post("/api/v1/analysis/complete").header("X-Internal-Token", "test-callback-secret")
+                .contentType("application/json").content(mapper.writeValueAsString(Map.of("videoId", id, "videoFps", 10,
+                        "totalHits", 0, "hitsData", List.of(), "skeletonVideoUrl", skeleton, "minimapVideoUrl", minimap))))
+                .andExpect(status().isOk());
+        mvc.perform(get("/api/v1/analysis/"+id).header("Authorization", auth(owner))).andExpect(status().isOk());
+        mvc.perform(post("/api/v1/videos/"+id+"/briefing").header("Authorization", auth(owner))
+                .contentType("application/json").content("{\"player\":\"top\"}"))
+                .andExpect(status().isOk()).andExpect(jsonPath("$.data.text").value("합성 브리핑"));
+        verify(gemini).generate(contains("Top Player"));
+        assertThat(stored.getSkeletonVideoUrl()).isEqualTo(skeleton);
+        assertThat(stored.getMinimapVideoUrl()).isEqualTo(minimap);
+    }
+}
diff --git a/src/test/java/com/rallytrack/backend/config/JwtSecurityTest.java b/src/test/java/com/rallytrack/backend/config/JwtSecurityTest.java
new file mode 100644
index 0000000..5742b30
--- /dev/null
+++ b/src/test/java/com/rallytrack/backend/config/JwtSecurityTest.java
@@ -0,0 +1,54 @@
+package com.rallytrack.backend.config;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+import java.util.concurrent.atomic.AtomicBoolean;
+import static org.junit.jupiter.api.Assertions.*;
+
+class JwtSecurityTest {
+    private final JwtUtil jwt = new JwtUtil("test-only-signing-secret-long-enough-for-hs256", 60000, 3600000);
+
+    private MockHttpServletResponse request(String token, AtomicBoolean called) throws Exception {
+        var request = new MockHttpServletRequest("GET", "/api/v1/videos/1");
+        if (token != null) request.addHeader("Authorization", "Bearer " + token);
+        var response = new MockHttpServletResponse();
+        new JwtAuthFilter(jwt).doFilter(request, response, (q, s) -> called.set(true));
+        return response;
+    }
+
+    @Test void accessTokenIsAccepted() throws Exception {
+        var called = new AtomicBoolean();
+        assertEquals(200, request(jwt.generateAccessToken(1L, "test@example.invalid"), called).getStatus());
+        assertTrue(called.get());
+    }
+
+    @Test void refreshCannotAuthorizeApi() throws Exception {
+        var called = new AtomicBoolean();
+        assertEquals(401, request(jwt.generateRefreshToken(1L, "test@example.invalid"), called).getStatus());
+        assertFalse(called.get());
+    }
+
+    @Test void missingAndMalformedTokensAreRejected() throws Exception {
+        for (String token : new String[]{null, "invalid.token"}) {
+            var called = new AtomicBoolean();
+            assertEquals(401, request(token, called).getStatus());
+            assertFalse(called.get());
+        }
+    }
+
+    @Test void signedButUntypedExpiredOrInvalidPrincipalTokensAreRejected() throws Exception {
+        var key = io.jsonwebtoken.security.Keys.hmacShaKeyFor("test-only-signing-secret-long-enough-for-hs256".getBytes(java.nio.charset.StandardCharsets.UTF_8));
+        for (String type : java.util.List.of("", "unknown", "refresh", "access")) {
+            var builder = io.jsonwebtoken.Jwts.builder().claim("user_id", type.equals("access") ? -1 : 1)
+                    .expiration(new java.util.Date(System.currentTimeMillis()+60000));
+            if (!type.isEmpty()) builder.claim("token_type",type);
+            var called = new java.util.concurrent.atomic.AtomicBoolean();
+            org.assertj.core.api.Assertions.assertThat(request(builder.signWith(key).compact(),called).getStatus()).isEqualTo(401);
+            org.assertj.core.api.Assertions.assertThat(called.get()).isFalse();
+        }
+        String expired = io.jsonwebtoken.Jwts.builder().claim("user_id",1).claim("token_type","access")
+                .expiration(new java.util.Date(0)).signWith(key).compact();
+        org.assertj.core.api.Assertions.assertThat(request(expired,new java.util.concurrent.atomic.AtomicBoolean()).getStatus()).isEqualTo(401);
+    }
+}
diff --git a/src/test/java/com/rallytrack/backend/domain/briefing/BriefingServiceTest.java b/src/test/java/com/rallytrack/backend/domain/briefing/BriefingServiceTest.java
new file mode 100644
index 0000000..fe80219
--- /dev/null
+++ b/src/test/java/com/rallytrack/backend/domain/briefing/BriefingServiceTest.java
@@ -0,0 +1,91 @@
+package com.rallytrack.backend.domain.briefing;
+
+import com.rallytrack.backend.domain.analysis.dto.*;
+import com.rallytrack.backend.domain.analysis.service.AnalysisService;
+import com.rallytrack.backend.global.exception.ApiException;
+import org.junit.jupiter.api.*;
+import java.util.concurrent.*;
+import static org.mockito.Mockito.*;
+import static org.assertj.core.api.Assertions.*;
+
+class BriefingServiceTest {
+    AnalysisService analysis = mock(AnalysisService.class);
+    GeminiClient client = mock(GeminiClient.class);
+    BriefingService service = new BriefingService(analysis, client, java.time.Clock.fixed(java.time.Instant.parse("2026-09-16T00:00:00Z"),java.time.ZoneOffset.UTC));
+    AnalysisReportResponse report(int score) {
+        var player = PlayerReportDto.builder().abilityMetrics(AbilityMetricsDto.builder().aggression(85).rally(70).defense(50).mobility(30).consistency(0).build())
+                .strokeTypes(StrokeTypesDto.builder().smash(1).clear(2).build()).build();
+        return AnalysisReportResponse.builder().summary(SummaryDto.builder().myScore(score).opponentScore(2).matchOutcome("WIN").matchTime("1:00").totalStrokeCount(3).build())
+                .players(PlayersDto.builder().top(player).bottom(player).build()).build();
+    }
+    @BeforeEach void setup() {
+        when(analysis.getReport(anyLong(), anyLong())).thenReturn(report(3));
+        when(client.model()).thenReturn("test-model"); when(client.generate(anyString())).thenReturn("safe text");
+    }
+    @Test void cacheSeparatesPlayersAndChangesWhenScoreChanges() {
+        assertThat(service.generate(1L,1L,"top")).isEqualTo("safe text");
+        service.generate(1L,1L,"top"); verify(client, times(1)).generate(anyString());
+        service.generate(1L,1L,"bottom"); verify(client,times(2)).generate(anyString());
+        when(analysis.getReport(1L,1L)).thenReturn(report(4));
+        service.generate(1L,1L,"top"); verify(client,times(3)).generate(anyString());
+    }
+    @Test void authorizationIsCheckedEvenAfterCaching() {
+        service.generate(1L,1L,"top");
+        when(analysis.getReport(1L,1L)).thenThrow(ApiException.notFound());
+        assertThatThrownBy(() -> service.generate(1L,1L,"top")).isInstanceOf(ApiException.class).extracting("status").isEqualTo(404);
+        verify(client,times(1)).generate(anyString());
+    }
+    @Test void userRateLimitAndDisabledModeNeverCallProvider() {
+        for (long id=1; id<=6; id++) service.generate(1L,id,"top");
+        assertThatThrownBy(() -> service.generate(1L,7L,"top")).isInstanceOf(ApiException.class).extracting("status").isEqualTo(429);
+        verify(client,times(6)).generate(anyString());
+        doThrow(new ApiException(503,"BRIEFING_UNAVAILABLE","disabled")).when(client).requireEnabled();
+        assertThatThrownBy(() -> service.generate(2L,1L,"top")).isInstanceOf(ApiException.class).extracting("status").isEqualTo(503);
+        verify(client,times(6)).generate(anyString());
+    }
+    @Test void globalRateLimitAppliesAcrossUsers() {
+        for (long id=1; id<=30; id++) service.generate(id,id,"top");
+        assertThatThrownBy(() -> service.generate(31L,31L,"top")).isInstanceOf(ApiException.class).extracting("status").isEqualTo(429);
+    }
+    @Test void identicalConcurrentRequestsShareOneGeneration() throws Exception {
+        var entered = new CountDownLatch(1); var release = new CountDownLatch(1);
+        when(client.generate(anyString())).thenAnswer(i -> { entered.countDown(); release.await(5,TimeUnit.SECONDS); return "one"; });
+        ExecutorService executor = Executors.newFixedThreadPool(3);
+        try {
+            var first = executor.submit(() -> service.generate(1L,1L,"top"));
+            assertThat(entered.await(2,TimeUnit.SECONDS)).isTrue();
+            var second = executor.submit(() -> service.generate(1L,1L,"top"));
+            var different = executor.submit(() -> service.generate(2L,2L,"top"));
+            // Wait until both distinct generations entered the provider; no arbitrary sleeps.
+            verify(client, timeout(2000).times(2)).generate(anyString());
+            assertThatThrownBy(() -> service.generate(3L,3L,"top")).isInstanceOf(ApiException.class).extracting("status").isEqualTo(429);
+            release.countDown();
+            assertThat(first.get()).isEqualTo("one"); assertThat(second.get()).isEqualTo("one"); assertThat(different.get()).isEqualTo("one");
+            verify(client,times(2)).generate(anyString());
+        } finally { release.countDown(); executor.shutdownNow(); }
+    }
+    @Test void failuresAreNotCachedAndInvalidPlayerCannotTriggerRead() {
+        when(client.generate(anyString())).thenThrow(new ApiException(504,"BRIEFING_TIMEOUT","timeout")).thenReturn("recovered");
+        assertThatThrownBy(() -> service.generate(1L,1L,"top")).isInstanceOf(ApiException.class).extracting("status").isEqualTo(504);
+        assertThat(service.generate(1L,1L,"top")).isEqualTo("recovered");
+        clearInvocations(analysis,client);
+        assertThatThrownBy(() -> service.generate(1L,1L,"custom prompt")).isInstanceOf(ApiException.class);
+        verifyNoInteractions(analysis,client);
+    }
+    @Test void gradeBoundariesMatchExistingFrontendContract() {
+        assertThat(BriefingPrompt.grade(85)).isEqualTo("S"); assertThat(BriefingPrompt.grade(84)).isEqualTo("A");
+        assertThat(BriefingPrompt.grade(70)).isEqualTo("A"); assertThat(BriefingPrompt.grade(69)).isEqualTo("B");
+        assertThat(BriefingPrompt.grade(50)).isEqualTo("B"); assertThat(BriefingPrompt.grade(49)).isEqualTo("C");
+        assertThat(BriefingPrompt.grade(30)).isEqualTo("C"); assertThat(BriefingPrompt.grade(29)).isEqualTo("D");
+    }
+
+    @Test void promptUsesActualHitLabelsAndCurrentFiveSectionFormat() {
+        var hitReport = report(3);
+        // Rebuild immutable DTO with real per-hit labels, as the frontend does.
+        var withHits = AnalysisReportResponse.builder().summary(hitReport.getSummary()).players(hitReport.getPlayers())
+                .hitsData(java.util.List.of(AnalysisReportResponse.HitDto.builder().player("pink_top").strokeType("Lob").build(),
+                        AnalysisReportResponse.HitDto.builder().player("pink_top").strokeType("스매시").build())).build();
+        String prompt = BriefingPrompt.create(withHits,"top");
+        assertThat(prompt).contains("프로 6종", "lob: 1회", "smash: 1회", "개인 스트로크 합계: 2회", "## 총평", "## 추천 훈련");
+    }
+}
diff --git a/src/test/java/com/rallytrack/backend/domain/briefing/GeminiClientTest.java b/src/test/java/com/rallytrack/backend/domain/briefing/GeminiClientTest.java
new file mode 100644
index 0000000..b5a2161
--- /dev/null
+++ b/src/test/java/com/rallytrack/backend/domain/briefing/GeminiClientTest.java
@@ -0,0 +1,62 @@
+package com.rallytrack.backend.domain.briefing;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.rallytrack.backend.global.exception.ApiException;
+import org.junit.jupiter.api.Test;
+import java.net.http.*;
+import java.nio.ByteBuffer;
+import java.time.Duration;
+import java.util.List;
+import java.util.concurrent.*;
+import static org.mockito.Mockito.*;
+import static org.assertj.core.api.Assertions.*;
+
+class GeminiClientTest {
+    HttpClient http = mock(HttpClient.class);
+    GeminiClient client = new GeminiClient(new ObjectMapper(), "synthetic-provider-secret", "gemini-test", true, http, Duration.ofMillis(100));
+    @SuppressWarnings("unchecked")
+    HttpResponse<byte[]> response(int status, String body) {
+        HttpResponse<byte[]> response = mock(HttpResponse.class);
+        when(response.statusCode()).thenReturn(status); when(response.body()).thenReturn(body.getBytes()); return response;
+    }
+    @Test void sendsCredentialOnlyAsHeaderToFixedProviderAndExtractsText() throws Exception {
+        doReturn(CompletableFuture.completedFuture(response(200,"{\"candidates\":[{\"finishReason\":\"STOP\",\"content\":{\"parts\":[{\"text\":\"safe coaching\"}]}}]}")))
+                .when(http).sendAsync(any(HttpRequest.class),any(HttpResponse.BodyHandler.class));
+        assertThat(client.generate("synthetic stats")).isEqualTo("safe coaching");
+        var request=org.mockito.ArgumentCaptor.forClass(HttpRequest.class);
+        verify(http).sendAsync(request.capture(),any(HttpResponse.BodyHandler.class));
+        assertThat(request.getValue().uri().toString()).isEqualTo("https://generativelanguage.googleapis.com/v1beta/models/gemini-test:generateContent");
+        assertThat(request.getValue().headers().firstValue("x-goog-api-key")).contains("synthetic-provider-secret");
+    }
+    @Test void disabledMissingKeyAndOversizedPromptDoNotReachProvider() {
+        for (var instance : List.of(new GeminiClient(new ObjectMapper(),"","test",true,http,Duration.ofSeconds(1)),
+                new GeminiClient(new ObjectMapper(),"secret","test",false,http,Duration.ofSeconds(1)))) {
+            assertThatThrownBy(()->instance.generate("test")).isInstanceOf(ApiException.class).extracting("status").isEqualTo(503);
+        }
+        assertThatThrownBy(()->client.generate("x".repeat(12001))).isInstanceOf(ApiException.class).extracting("status").isEqualTo(400);
+        verifyNoInteractions(http);
+    }
+    @Test void providerErrorsAndInvalidBodiesNeverLeakProviderContent() {
+        for (var response : List.of(response(403,"synthetic-provider-secret"),response(200,"not json"),
+                response(200,"{\"candidates\":[{\"finishReason\":\"MAX_TOKENS\"}]}"))) {
+            doReturn(CompletableFuture.completedFuture(response)).when(http).sendAsync(any(HttpRequest.class),any(HttpResponse.BodyHandler.class));
+            assertThatThrownBy(()->client.generate("stats")).isInstanceOf(ApiException.class).hasMessageNotContaining("synthetic-provider-secret")
+                    .extracting("status").isEqualTo(502);
+        }
+    }
+    @Test void totalTimeoutCancelsRequestAndTransportTimeoutHasSameStatus() {
+        CompletableFuture<HttpResponse<byte[]>> stuck = new CompletableFuture<>();
+        doReturn(stuck).when(http).sendAsync(any(HttpRequest.class),any(HttpResponse.BodyHandler.class));
+        assertThatThrownBy(()->client.generate("stats")).isInstanceOf(ApiException.class).extracting("status").isEqualTo(504);
+        assertThat(stuck.isCancelled()).isTrue();
+        doReturn(CompletableFuture.failedFuture(new HttpTimeoutException("secret upstream error")))
+                .when(http).sendAsync(any(HttpRequest.class),any(HttpResponse.BodyHandler.class));
+        assertThatThrownBy(()->client.generate("stats")).isInstanceOf(ApiException.class).extracting("status").isEqualTo(504);
+    }
+    @Test void responseReaderCancelsAtByteLimit() {
+        var body=new GeminiClient.LimitedBodySubscriber(8);
+        var subscription=mock(java.util.concurrent.Flow.Subscription.class);
+        body.onSubscribe(subscription);body.onNext(List.of(ByteBuffer.wrap(new byte[9])));
+        verify(subscription).cancel();assertThat(body.getBody().toCompletableFuture()).isCompletedExceptionally();
+    }
+}
diff --git a/src/test/java/com/rallytrack/backend/domain/video/service/MediaValidationTest.java b/src/test/java/com/rallytrack/backend/domain/video/service/MediaValidationTest.java
new file mode 100644
index 0000000..e32dfa8
--- /dev/null
+++ b/src/test/java/com/rallytrack/backend/domain/video/service/MediaValidationTest.java
@@ -0,0 +1,92 @@
+package com.rallytrack.backend.domain.video.service;
+
+import com.rallytrack.backend.global.exception.ApiException;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+import org.springframework.mock.web.MockMultipartFile;
+import javax.imageio.ImageIO;
+import java.awt.image.BufferedImage;
+import java.io.*;
+import java.nio.file.*;
+import static org.assertj.core.api.Assertions.*;
+
+class MediaValidationTest {
+    private final MediaValidationService media = new MediaValidationService("ffprobe");
+    static byte[] fixture(String ext) throws IOException {
+        try (var input = MediaValidationTest.class.getResourceAsStream("/media/sample." + ext)) { return input.readAllBytes(); }
+    }
+    static byte[] png(int w, int h) throws IOException {
+        var out = new ByteArrayOutputStream(); ImageIO.write(new BufferedImage(w, h, BufferedImage.TYPE_INT_RGB), "png", out); return out.toByteArray();
+    }
+    @ParameterizedTest @CsvSource({"mp4,video/mp4", "mov,video/quicktime", "webm,video/webm"})
+    void validVideoIsProbedAndTemporaryFileRemoved(String ext, String mime) throws Exception {
+        Path path;
+        try (var result = media.video(new MockMultipartFile("video", "sample."+ext, mime, fixture(ext)))) {
+            assertThat(result.contentType()).isEqualTo(mime); assertThat(result.extension()).isEqualTo(ext);
+            path = result.path(); assertThat(path).exists();
+        }
+        assertThat(path).doesNotExist();
+    }
+    @Test void acceptsActualVideoWithMissingMimeAndUntrustedNameNeverBecomesObjectKey() throws Exception {
+        try (var result = media.video(new MockMultipartFile("video", "../../payload.html.mp4", null, fixture("mp4")))) {
+            assertThat(result.path().getFileName().toString()).startsWith("rally-video-");
+        }
+    }
+    @Test void rejectsHtmlSvgEmptyAndTruncatedFiles() throws Exception {
+        for (byte[] bytes : new byte[][] {new byte[0], "<html>test</html>".getBytes(), "<svg/>".getBytes(), java.util.Arrays.copyOf(fixture("mp4"), 20)}) {
+            assertThatThrownBy(() -> media.video(new MockMultipartFile("video", "test.mp4", "video/mp4", bytes))).isInstanceOf(ApiException.class);
+        }
+        assertThatThrownBy(() -> media.thumbnail(new MockMultipartFile("thumb", "test.png", "image/png", "<svg/>".getBytes())))
+                .isInstanceOf(ApiException.class);
+    }
+    @Test void rejectsMimeOrExtensionMismatchAndOversize() throws Exception {
+        assertThatThrownBy(() -> media.video(new MockMultipartFile("video", "test.mp4", "text/html", fixture("mp4")))).isInstanceOf(ApiException.class);
+        assertThatThrownBy(() -> media.video(new MockMultipartFile("video", "test.html", "video/mp4", fixture("mp4")))).isInstanceOf(ApiException.class);
+        var oversized = new MockMultipartFile("video", "test.mp4", "video/mp4", new byte[]{1}) {
+            @Override public long getSize() { return MediaValidationService.MAX_VIDEO_BYTES + 1; }
+        };
+        assertThatThrownBy(() -> media.video(oversized)).isInstanceOf(ApiException.class).extracting("status").isEqualTo(413);
+    }
+    @Test void pngAndJpegAreReencodedWithoutAppendedHtml() throws Exception {
+        byte[] png = png(32, 24);
+        var bytes = new ByteArrayOutputStream(); bytes.write(png); bytes.write("<script>marker</script>".getBytes());
+        try (var first = media.thumbnail(new MockMultipartFile("thumb", "image.png", "image/png", bytes.toByteArray()))) {
+            assertThat(first.contentType()).isEqualTo("image/jpeg");
+            byte[] jpeg = Files.readAllBytes(first.path());
+            assertThat(new String(jpeg, java.nio.charset.StandardCharsets.ISO_8859_1)).doesNotContain("marker");
+            try (var second = media.thumbnail(new MockMultipartFile("thumb", "image.jpg", "image/jpeg", jpeg))) {
+                assertThat(ImageIO.read(second.path().toFile()).getWidth()).isEqualTo(32);
+            }
+        }
+    }
+    @Test void excessiveDimensionsAndWrongImageMimeAreRejected() throws Exception {
+        assertThatThrownBy(() -> media.thumbnail(new MockMultipartFile("thumb", "image.png", "image/png", png(4097, 1)))).isInstanceOf(ApiException.class);
+        assertThatThrownBy(() -> media.thumbnail(new MockMultipartFile("thumb", "image.png", "text/html", png(1, 1)))).isInstanceOf(ApiException.class);
+    }
+    @Test void missingValidatorFailsClosed() throws Exception {
+        var unavailable = new MediaValidationService("/no/such/ffprobe");
+        assertThatThrownBy(() -> unavailable.video(new MockMultipartFile("video", "test.mp4", "video/mp4", fixture("mp4"))))
+                .isInstanceOf(ApiException.class).extracting("status").isEqualTo(503);
+    }
+    @Test void playlistsCannotMakeTheValidatorFetchExternalResources() {
+        assertThatThrownBy(() -> media.video(new MockMultipartFile("video", "list.mp4", "video/mp4",
+                "#EXTM3U\nhttp://127.0.0.1:1/never-fetch".getBytes()))).isInstanceOf(ApiException.class);
+    }
+
+    @Test void probeOutputLimitAndTimeoutFailClosed(@org.junit.jupiter.api.io.TempDir Path directory) throws Exception {
+        Path huge = directory.resolve("huge-probe");
+        Files.writeString(huge, "#!/bin/sh\nexec head -c 70000 /dev/zero\n");
+        assertThat(huge.toFile().setExecutable(true)).isTrue();
+        assertThatThrownBy(() -> new MediaValidationService(huge.toString()).video(
+                new MockMultipartFile("video", "test.mp4", "video/mp4", fixture("mp4")))).isInstanceOf(ApiException.class);
+        Path slow = directory.resolve("slow-probe");
+        Files.writeString(slow, "#!/bin/sh\nexec sleep 30\n");
+        assertThat(slow.toFile().setExecutable(true)).isTrue();
+        long start = System.nanoTime();
+        assertThatThrownBy(() -> new MediaValidationService(slow.toString()).video(
+                new MockMultipartFile("video", "test.mp4", "video/mp4", fixture("mp4"))))
+                .isInstanceOf(ApiException.class).extracting("errorCode").isEqualTo("MEDIA_VALIDATION_TIMEOUT");
+        assertThat(java.time.Duration.ofNanos(System.nanoTime()-start).toSeconds()).isLessThan(20);
+    }
+}
diff --git a/src/test/resources/media/sample.mov b/src/test/resources/media/sample.mov
new file mode 100644
index 0000000000000000000000000000000000000000..57a1f193390fe83dd568c4743c77bf34b4b025b8
GIT binary patch
literal 1829
zcmah}U1%It6uz6E64OY3SY(wzFPaA*lFiI+vevZ&*~ZieEfk~`p)%f?xtkexW@q-!
z&He;2QKGRgJ{BwziXd%D@lAXZ6!PY~H6Vx-{A<+*5sPTn@6PTf+bDS1d(ZE8&OPVc
z9YRRDEL%}cQcB1G=}<D#@ElIa;9B4?3H?WhhTH9%UoZUl>32JepIn*zitaq|%dgE`
zVTMjoI~1Jig;^@{xm=D~`PqUt%V1c{!eRQ{`Gx1EW@zc+JUkt4!!RF4EuWVq&1qVG
zDyQXUp>(B;iqq4LMk8BC_Rwe5Y$%qdRhFzP10OzNB)za27pcuGW*a&cylmvD!!19w
zD~4XwiW+5A=C@*QXw7_4YwCKQ2HbFYlg7&yxTk0ow*bXy3dhj18bCN`;5E5ps)#xe
zreM`2Zs-MSyCMvj38+q`;J)w0;7&GAI<^F3*8)Ss6_~RUR=JVWCv}~cSuD*cu6U91
z=me-mW>_xATpCk3DqR6YY|KzU3@glqVD@x6jeXC?U3v<QRz;G-_5vo=J-n*q!e?-T
z-tw0PYngT!L`*`q(IP3BS49Xo3Z{I@f(1NAvn(@ef%hB(voe{(B2|TDS{{p45>N1?
zt_Js(Txr1;M!ae+g%PYBWdvx2w-DRN&1zlN47{qLYc#fbmD|hGn9<ZV1yd~*Jaz#W
zwz*fXvJ2a=MVST``l`x;VC3>yjn-5#hL$aWja1--vZhgZ8j4u*2%YmH3<(bcGej&_
z!~E4W$r>S~z~5OX$J)E!-}!4acx}5@tY`lG<ICIPgCA~hyqJ0G)SEy3{O*l!HX36e
zpG=>4`Hkab_}*i8hh6}3taNq4FCE#vd4ZgWAU{;vJl)(_B?ePMYLm(NRr1nYN3dU2
zLJ7k0(pC5Q8zuL>vm=f6?$#Bu@;S7JOPg;m9GiTmy$Am=fhz=JT~FY19rzaDKHy<{
z_xd{dZ4Ljw%Rv~{VfBN$>wxyHC&6Q<lHa}_@&oIDJokX{U%~+X>%U`U6<99GN|JN1
z&#N0v<vy?u<WcwPUvo;hhTT*Qnc$9$LC3it<NJ~<AXMCuZb1V<;CKuQ8aV%5`)WJE
zO}UOQ6c@O@P+yKj+dalEs!z!xt2#c1(?AAqsSI1X9wb5guQ}NZ<RH+p@M(Xb!_P9w
z_TrEUrxRz~!Q<}wsaRuO9Qf3&SXw@GpmA?_%IAGnxAi^@IdkURdG+y4_BFI<5v<y3
zrP62NU&v?mtgh+Q_bl~6?ASVIrmY%LfY*G=A*1bY$)ii4w{}jizkX?G4$p|-7#`fd
z%-2%nkbC#e7mt7T_x<|{eKcaRdgSU}YG-1Z3<hi>j}kJZ_%v!z15>N#`-;8q3qPgD
z@DiHt(w?kDWlv&({+~U;jU%U>Aop{2^N>@pt#oaQKtFH~^eFbjeftscM-IrS#SWoU
bOVu)gO_v?XKr>r$Ly)lx+h}^Z*Ytk?@D!gv

literal 0
HcmV?d00001

diff --git a/src/test/resources/media/sample.mp4 b/src/test/resources/media/sample.mp4
new file mode 100644
index 0000000000000000000000000000000000000000..93502d2f4ea7af548b9c50438e764d46df9ebd8a
GIT binary patch
literal 1882
zcmah}U1%It6u$W@X^ixTAW;LoY99KKY-V<oHO3BP8-fuk2$D*nGTxoJn;CazXL9Ez
z*$rZ&M58Z07VJYPg0v|jB8X2yg}nK04Je`ojkfB84;Im^-<jP_)===U_nzPHoOAEF
zJB%@2(zV!6qL8spMjR_EmK`&U$4$n%J_(~}nK2fG%bp9~MqRt`@3Ia?zXSS@0`nn#
z`XKUtQYZTORx444^P(=NHM`mZo7t%LAv#p&zICqxQ%!Nh($xv1AsHk(wWOU=-ri=<
zo%5mV3;1~G9zOeNm`}6$?G!ocxq)itV9UNMTQc$U(4#p~aRW&)oh<Y#B?tq{VVbnP
z?P0g!8*-JT7$WlbFR6ex<c^z(E(Vanlh!~e=3^QfI8l4fhUF@bJqM8%QOCeJ#OHGv
zGh-Si5By>^n;&oZ8v9_q4k3@InGTor)xT#CFMxlzb9Vi;i`~;0J;T=1wf&A<>tIK`
zJGZ}l{N_LR?h*QUERq<U`k*yX)T(*OkKTk%G??gg03=gPA7kAl58zxh7@`*bW#=Fk
zab(AkQa;e+EuB>Ir@6rY&!6IkP}50~2Q`~@*ctd%n?7Q&cisg*j`d*MdI<8dLpsjl
zM6eN|m#!bc#geN9_=QlWoP3Y9KOj6hCE}Q7yiX&3<CP9?>4*{zxgrH4DPx#qsWnNc
zy(J~_0=w2i1fkiFj`Y;)H@=zu`STxl=03YT@-^Ri;<w*v+<cTfk&@iZPjHpXX0yDQ
zo5&jz0*<*10>++ue)gHsab7q-gGg68aLhz;Es!P6vxboy%^KMW7(K1ysj;z@m6Z&=
z|0ocZOr#dZs7l7uVStz@)_zn;rnn=D!m&(_H*V#)D~mzolr3}0m@>Gih@h58%c$n2
zjH+qocqlDTR(Y~ig!CkjlNzAdZRJ{K#sCN#5B;iiZOUi@VJlHtkd~R}j;Eqf*npZ`
zD;WfS0%@{3={g#Mvlv<iS`hAPRFPKJ95GE^5{b6sr0mBO(MYfu+fk{MNNtT~x%Lzg
zi8aoHC@KpNiruoAJPCXUy|fGluc)+!<A*|1AAUtk6$k{uUJRC$sM$^w#zI4Pa7Fn1
z`4yx<pb`{QQX-TIE~{wAHORheVOF+qMNFqC+C^U^RK!;@J=co#7d%~rFN$TwUWj6N
z8^##WvaBJum7Oq}qK%J|Wg0wjWJNkl+8Q^gO(p0`l}tRqm1FN8m;B1H997~W{@ap{
z1;xtdG6r9y!&pWp4>6|1DHl~M{}c>~mN9P5k1-@X2+R<<#3JTT(`0LS!Fl=iIy+I{
z`|0-Iec`Lyi&M*kfBpH@E%pBHt&JB4-#qiiFTcKf{kx5o{!b?dPQCQ{N!D}skvrWl
z0NG!-G8`0+?cJDXr|1K8w6J-$x^anF^p88*u_^S-C3a!Dp*XLQQh;)@aK(G}dck||
yT<=PKZ|gE!{Q}kp3Y%}uo)~$$z7PK(g%bj~uBGtl27C+f0Pv{3cWs^hvGy+yW2l1w

literal 0
HcmV?d00001

diff --git a/src/test/resources/media/sample.webm b/src/test/resources/media/sample.webm
new file mode 100644
index 0000000000000000000000000000000000000000..0aaae5e79af7fc3d96511fe7374196f45e7e6809
GIT binary patch
literal 972
zcmb1gy}x+AQ(GgW({~{L)X3uWxsk)EsiizMDc7mJk;$pGkx3%BA)S!{1eoUt`pz!d
z<-5B(cy)`Y=gPF;HH`})Jh6~<*+AYk-`zbxIiZll>A`E77|kJEnc&?($tLEuHxP3e
zBEiPdf&jT{gVyzp&HPRdz70J-iDhYK#(IW&h6aY=jwoE0&JKru2e2DJj=!@G>bBtP
zjf}-dJDUCW1@dPzUYOI!ptN;Pb7@{mTWeT+Sb#-yBct-;<`&kk4;dcJ*wDCOS7XJj
zMyAjWJ)t`r8AG=N@eUyOT_Xd`vrG&Opzv_`R$Tlm`9MSZiK(uOyL}zK{Db11f*k!^
zT-sYQi}Q2SPfT-N-0SP<2NVx;4GQ-3_j74)HZ?R#Ke60(@kD2T-vGxDPbVK&h^}Cl
z_6Z<uKx~v)mTZ_?U}BhlVy5fjc2_@Ve;3yvmv$8I78id@KG2<v@L2kZ1;~mg1A{6V
z7E}s3nMq{@73nADxi0SU0J_n~H7MTC(bpAdXjo=SYQ9HeUP?}CQTmC6u8TWdLW6)V
z137oHfq@kW8R{9p0E4{qwo*sm=Zy@D?=><oG<;xVn9HcOfT4nc!JVVEwWGDAgNcc$
zbQSXtCbr4_tO9d_E-kcJy40!A+pFc#w5gm&b+v@MqC(U~wyf~e%nX>#@bAB`(EmRX
z;U5#@kG9qW$v=P2y*>Kp8N=ckjSMLaf=mpI0s;&Y3=$FgUl=$V8hJK=WlrFdVbsAX
zGXbZ}7hEz-5jbV`KxIS{7!niqUtmyTVlg@ZavQS(E<MaGSY<%@Y2xnw&5aD(yMX!j
LV-u6{hel=qZfh>w

literal 0
HcmV?d00001