Add Android quick streaming and logout confirmation

backend/cmd/server/main.go

@@ -10,7 +10,7 @@ import (
 
 func main() {
 	monitor.Init(2000)
-	monitor.Infof("Starting Hightube Server v1.0.0-Beta3.7")
+	monitor.Infof("Starting Hightube Server v1.0.0-Beta4.7")
 
 	// Initialize Database and run auto-migrations
 	db.InitDB()
@@ -24,6 +24,7 @@ func main() {
 	go func() {
 		r := api.SetupRouter(srv)
 		monitor.Infof("API server listening on :8080")
+		monitor.Infof("Web console listening on :8080/admin")
 		if err := r.Run(":8080"); err != nil {
 			monitor.Errorf("Failed to start API server: %v", err)
 		}

backend/internal/api/admin.go

@@ -22,6 +22,64 @@ func BindAdminDependencies(rtmpSrv *stream.RTMPServer) {
 	adminRTMP = rtmpSrv
 }
 
+func AdminLogin(c *gin.Context) {
+	var req LoginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	var user model.User
+	if err := db.DB.Where("username = ?", strings.TrimSpace(req.Username)).First(&user).Error; err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid username or password"})
+		return
+	}
+
+	if !utils.CheckPasswordHash(req.Password, user.Password) {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid username or password"})
+		return
+	}
+
+	if !user.Enabled {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Account is disabled"})
+		return
+	}
+
+	if user.Role != "admin" {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Admin access required"})
+		return
+	}
+
+	token, err := utils.GenerateToken(user.ID, user.Username, user.Role)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create admin session"})
+		return
+	}
+
+	c.SetCookie(adminSessionCookieName, token, 86400, "/", "", false, true)
+	monitor.Auditf("admin=%s signed in", user.Username)
+	c.JSON(http.StatusOK, gin.H{
+		"username": user.Username,
+		"role":     user.Role,
+	})
+}
+
+func AdminLogout(c *gin.Context) {
+	operator, _ := c.Get("username")
+	c.SetCookie(adminSessionCookieName, "", -1, "/", "", false, true)
+	monitor.Auditf("admin=%v signed out", operator)
+	c.JSON(http.StatusOK, gin.H{"message": "signed out"})
+}
+
+func GetAdminSession(c *gin.Context) {
+	username, _ := c.Get("username")
+	role, _ := c.Get("role")
+	c.JSON(http.StatusOK, gin.H{
+		"username": username,
+		"role":     role,
+	})
+}
+
 func GetAdminOverview(c *gin.Context) {
 	stats := monitor.GetSnapshot()
 	chatStats := chat.StatsSnapshot{}
@@ -83,10 +141,6 @@ func ListAdminLogs(c *gin.Context) {
 }
 
 func StreamAdminLogs(c *gin.Context) {
-	if !authorizeAdminTokenFromQuery(c) {
-		return
-	}
-
 	c.Header("Content-Type", "text/event-stream")
 	c.Header("Cache-Control", "no-cache")
 	c.Header("Connection", "keep-alive")
@@ -114,39 +168,6 @@ func StreamAdminLogs(c *gin.Context) {
 	}
 }
 
-func authorizeAdminTokenFromQuery(c *gin.Context) bool {
-	token := strings.TrimSpace(c.Query("token"))
-	if token == "" {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "token is required"})
-		return false
-	}
-
-	claims, err := utils.ParseToken(token)
-	if err != nil {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return false
-	}
-
-	userID, err := strconv.ParseUint(claims.Subject, 10, 32)
-	if err != nil {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token subject"})
-		return false
-	}
-
-	var user model.User
-	if err := db.DB.First(&user, uint(userID)).Error; err != nil {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "user not found"})
-		return false
-	}
-
-	if !user.Enabled || user.Role != "admin" {
-		c.JSON(http.StatusForbidden, gin.H{"error": "admin access required"})
-		return false
-	}
-
-	return true
-}
-
 type updateRoleRequest struct {
 	Role string `json:"role" binding:"required"`
 }

backend/internal/api/auth.go

@@ -2,6 +2,8 @@ package api
 
 import (
 	"net/http"
+	"os"
+	"strings"
 
 	"github.com/gin-gonic/gin"
 
@@ -32,6 +34,12 @@ func Register(c *gin.Context) {
 		return
 	}
 
+	req.Username = strings.TrimSpace(req.Username)
+	if strings.EqualFold(req.Username, bootstrapAdminUsername()) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "This username is reserved"})
+		return
+	}
+
 	// Check if user exists
 	var existingUser model.User
 	if err := db.DB.Where("username = ?", req.Username).First(&existingUser).Error; err == nil {
@@ -146,3 +154,11 @@ func ChangePassword(c *gin.Context) {
 
 	c.JSON(http.StatusOK, gin.H{"message": "Password updated successfully"})
 }
+
+func bootstrapAdminUsername() string {
+	adminUsername := strings.TrimSpace(os.Getenv("HIGHTUBE_ADMIN_USER"))
+	if adminUsername == "" {
+		return "admin"
+	}
+	return adminUsername
+}

backend/internal/api/middleware.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"errors"
 	"net/http"
 	"strconv"
 	"strings"
@@ -13,47 +14,30 @@ import (
 	"hightube/internal/utils"
 )
 
+const adminSessionCookieName = "hightube_admin_session"
+
 // AuthMiddleware intercepts requests, validates JWT, and injects user_id into context
 func AuthMiddleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
-		authHeader := c.GetHeader("Authorization")
+		user, err := authenticateRequest(c)
-		if authHeader == "" {
-			c.JSON(http.StatusUnauthorized, gin.H{"error": "Authorization header is required"})
-			c.Abort()
-			return
-		}
-
-		parts := strings.Split(authHeader, " ")
-		if len(parts) != 2 || parts[0] != "Bearer" {
-			c.JSON(http.StatusUnauthorized, gin.H{"error": "Authorization header format must be Bearer {token}"})
-			c.Abort()
-			return
-		}
-
-		tokenStr := parts[1]
-		claims, err := utils.ParseToken(tokenStr)
 		if err != nil {
+			switch {
+			case errors.Is(err, errMissingToken):
+				c.JSON(http.StatusUnauthorized, gin.H{"error": "Authorization is required"})
+			case errors.Is(err, errInvalidToken):
 				c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid or expired token"})
-			c.Abort()
+			case errors.Is(err, errUserNotFound):
-			return
-		}
-
-		userID, _ := strconv.ParseUint(claims.Subject, 10, 32)
-
-		var user model.User
-		if err := db.DB.First(&user, uint(userID)).Error; err != nil {
 				c.JSON(http.StatusUnauthorized, gin.H{"error": "User not found"})
-			c.Abort()
+			case errors.Is(err, errDisabledAccount):
-			return
-		}
-
-		if !user.Enabled {
 				c.JSON(http.StatusForbidden, gin.H{"error": "Account is disabled"})
+			default:
+				c.JSON(http.StatusUnauthorized, gin.H{"error": "Authentication failed"})
+			}
 			c.Abort()
 			return
 		}
 
-		c.Set("user_id", uint(userID))
+		c.Set("user_id", user.ID)
 		c.Set("username", user.Username)
 		c.Set("role", user.Role)
 		c.Next()
@@ -82,6 +66,58 @@ func RequestMetricsMiddleware() gin.HandlerFunc {
 	}
 }
 
+var (
+	errMissingToken    = errors.New("missing token")
+	errInvalidToken    = errors.New("invalid token")
+	errUserNotFound    = errors.New("user not found")
+	errDisabledAccount = errors.New("disabled account")
+)
+
+func authenticateRequest(c *gin.Context) (*model.User, error) {
+	tokenStr := extractToken(c)
+	if tokenStr == "" {
+		return nil, errMissingToken
+	}
+
+	claims, err := utils.ParseToken(tokenStr)
+	if err != nil {
+		return nil, errInvalidToken
+	}
+
+	userID, err := strconv.ParseUint(claims.Subject, 10, 32)
+	if err != nil {
+		return nil, errInvalidToken
+	}
+
+	var user model.User
+	if err := db.DB.First(&user, uint(userID)).Error; err != nil {
+		return nil, errUserNotFound
+	}
+
+	if !user.Enabled {
+		return nil, errDisabledAccount
+	}
+
+	return &user, nil
+}
+
+func extractToken(c *gin.Context) string {
+	authHeader := strings.TrimSpace(c.GetHeader("Authorization"))
+	if authHeader != "" {
+		parts := strings.Split(authHeader, " ")
+		if len(parts) == 2 && parts[0] == "Bearer" {
+			return strings.TrimSpace(parts[1])
+		}
+	}
+
+	cookieToken, err := c.Cookie(adminSessionCookieName)
+	if err == nil {
+		return strings.TrimSpace(cookieToken)
+	}
+
+	return ""
+}
+
 // CORSMiddleware handles cross-origin requests from web clients
 func CORSMiddleware() gin.HandlerFunc {
 	return func(c *gin.Context) {

backend/internal/api/room.go

@@ -48,3 +48,18 @@ func GetActiveRooms(c *gin.Context) {
 
 	c.JSON(http.StatusOK, gin.H{"active_rooms": result})
 }
+
+func GetRoomPlaybackOptions(c *gin.Context) {
+	roomID := c.Param("room_id")
+	qualities := []string{"source"}
+	if adminRTMP != nil {
+		if available := adminRTMP.AvailablePlaybackQualities(roomID); len(available) > 0 {
+			qualities = available
+		}
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"room_id":   roomID,
+		"qualities": qualities,
+	})
+}

backend/internal/api/router.go

@@ -23,27 +23,32 @@ func SetupRouter(streamServer *stream.RTMPServer) *gin.Engine {
 	// Public routes
 	r.POST("/api/register", Register)
 	r.POST("/api/login", Login)
+	r.POST("/api/admin/login", AdminLogin)
 	r.GET("/api/rooms/active", GetActiveRooms)
+	r.GET("/api/rooms/:room_id/thumbnail", streamServer.HandleThumbnail)
 	r.GET("/live/:room_id", streamServer.HandleHTTPFLV)
 
 	// WebSocket endpoint for live chat
 	r.GET("/api/ws/room/:room_id", WSHandler)
 	r.GET("/admin", AdminPage)
-	r.GET("/api/admin/logs/stream", StreamAdminLogs)
+	r.GET("/api/admin/logs/stream", AuthMiddleware(), AdminMiddleware(), StreamAdminLogs)
 
 	// Protected routes (require JWT)
 	authGroup := r.Group("/api")
 	authGroup.Use(AuthMiddleware())
 	{
 		authGroup.GET("/room/my", GetMyRoom)
+		authGroup.GET("/rooms/:room_id/playback-options", GetRoomPlaybackOptions)
 		authGroup.POST("/user/change-password", ChangePassword)
 
 		adminGroup := authGroup.Group("/admin")
 		adminGroup.Use(AdminMiddleware())
 		{
+			adminGroup.GET("/session", GetAdminSession)
 			adminGroup.GET("/overview", GetAdminOverview)
 			adminGroup.GET("/health", GetAdminHealth)
 			adminGroup.GET("/logs", ListAdminLogs)
+			adminGroup.POST("/logout", AdminLogout)
 			adminGroup.GET("/users", ListUsers)
 			adminGroup.PATCH("/users/:id/role", UpdateUserRole)
 			adminGroup.PATCH("/users/:id/enabled", UpdateUserEnabled)

backend/internal/api/static/admin/index.html

@@ -1,5 +1,5 @@
 <!doctype html>
-<html lang="zh-CN">
+<html lang="en">
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width,initial-scale=1" />
@@ -9,217 +9,431 @@
   <link href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@400;500;700&family=IBM+Plex+Mono:wght@400;600&display=swap" rel="stylesheet">
   <style>
     :root {
-      --bg: #0f1c2e;
+      --bg: #eef4fb;
-      --bg2: #102944;
+      --bg-accent: #dbe9f7;
-      --card: #f7f6f3;
+      --surface: #ffffff;
-      --ink: #12263d;
+      --surface-soft: #f6f9fc;
-      --accent: #ff6b35;
+      --ink: #19324d;
-      --accent2: #0ea5a3;
+      --muted: #5a718a;
+      --line: #d7e1eb;
+      --primary: #2f6fed;
+      --primary-strong: #1d4ed8;
+      --primary-soft: #dce8ff;
       --danger: #dc2626;
-      --ok: #15803d;
+      --danger-soft: #fee2e2;
-      --line: #d9d5cc;
+      --success: #15803d;
+      --success-soft: #dcfce7;
+      --warning: #b45309;
+      --shadow: 0 18px 44px rgba(29, 78, 216, 0.10);
     }
+
     * { box-sizing: border-box; }
+
     body {
       margin: 0;
+      min-height: 100vh;
       font-family: "Space Grotesk", "Segoe UI", sans-serif;
       color: var(--ink);
       background:
-        radial-gradient(1200px 600px at -10% -10%, #2a4b70 0%, transparent 65%),
+        radial-gradient(900px 460px at -10% -20%, rgba(47,111,237,0.16) 0%, transparent 60%),
-        radial-gradient(1000px 500px at 110% 0%, #1f4f6d 0%, transparent 65%),
+        radial-gradient(800px 420px at 110% 0%, rgba(61,187,167,0.12) 0%, transparent 55%),
-        linear-gradient(140deg, var(--bg) 0%, var(--bg2) 100%);
+        linear-gradient(180deg, var(--bg) 0%, #f8fbff 100%);
-      min-height: 100vh;
+      padding: 24px;
-      padding: 20px;
     }
-    .layout {
+
+    .shell {
       max-width: 1280px;
       margin: 0 auto;
+    }
+
+    .hero {
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      gap: 20px;
+      margin-bottom: 18px;
+    }
+
+    .brand h1 {
+      margin: 0;
+      font-size: clamp(28px, 5vw, 42px);
+      letter-spacing: 0.03em;
+    }
+
+    .brand p {
+      margin: 8px 0 0;
+      color: var(--muted);
+      max-width: 620px;
+    }
+
+    .badge {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      padding: 10px 14px;
+      border-radius: 999px;
+      background: rgba(255,255,255,0.78);
+      border: 1px solid rgba(47,111,237,0.12);
+      box-shadow: var(--shadow);
+      color: var(--primary-strong);
+      font-weight: 700;
+    }
+
+    .panel-grid {
       display: grid;
-      gap: 16px;
       grid-template-columns: repeat(12, 1fr);
-      animation: appear 500ms ease-out;
+      gap: 16px;
-    }
-    @keyframes appear {
-      from { opacity: 0; transform: translateY(8px); }
-      to { opacity: 1; transform: translateY(0); }
     }
+
     .card {
-      background: var(--card);
+      background: rgba(255,255,255,0.88);
       border: 1px solid var(--line);
-      border-radius: 16px;
+      border-radius: 20px;
-      box-shadow: 0 12px 30px rgba(0,0,0,0.22);
+      padding: 18px;
-      padding: 14px;
+      box-shadow: var(--shadow);
+      backdrop-filter: blur(12px);
     }
+
+    .login-card {
+      grid-column: 4 / span 6;
+      padding: 22px;
+    }
+
     .full { grid-column: 1 / -1; }
     .col4 { grid-column: span 4; }
-    .col6 { grid-column: span 6; }
+    .col5 { grid-column: span 5; }
+    .col7 { grid-column: span 7; }
     .col8 { grid-column: span 8; }
-    h1 { margin: 0; color: #f8fafc; letter-spacing: .02em; }
+
-    h2 { margin: 0 0 10px; font-size: 18px; }
+    h2 {
-    .topbar {
+      margin: 0 0 12px;
-      grid-column: 1 / -1;
+      font-size: 19px;
+    }
+
+    .muted {
+      color: var(--muted);
+    }
+
+    .hidden {
+      display: none !important;
+    }
+
+    .stack {
+      display: grid;
+      gap: 12px;
+    }
+
+    .row {
       display: flex;
       gap: 10px;
       align-items: center;
+      flex-wrap: wrap;
+    }
+
+    .row.between {
       justify-content: space-between;
-      margin-bottom: 6px;
-    }
-    .tokenbox {
-      display: flex;
-      gap: 8px;
-      width: min(800px, 100%);
     }
+
     input, select, button {
-      border-radius: 10px;
+      border-radius: 14px;
-      border: 1px solid #c8c2b7;
+      border: 1px solid var(--line);
-      padding: 8px 10px;
+      padding: 10px 12px;
       font-size: 14px;
       font-family: inherit;
     }
-    input { width: 100%; }
+
+    input, select {
+      width: 100%;
+      background: var(--surface);
+      color: var(--ink);
+    }
+
     button {
       cursor: pointer;
-      color: #fff;
-      background: linear-gradient(120deg, var(--accent), #f97316);
       border: none;
+      color: white;
+      background: linear-gradient(120deg, var(--primary), #5994ff);
       font-weight: 700;
+      transition: transform 140ms ease, opacity 140ms ease;
     }
+
+    button:hover {
+      transform: translateY(-1px);
+    }
+
     button.secondary {
-      background: #184f77;
+      background: linear-gradient(120deg, #7ea7ff, #4b7df2);
     }
+
+    button.subtle {
+      color: var(--ink);
+      background: var(--surface-soft);
+      border: 1px solid var(--line);
+    }
+
     button.danger {
-      background: var(--danger);
+      background: linear-gradient(120deg, #ef4444, #dc2626);
     }
+
     .stats {
       display: grid;
       grid-template-columns: repeat(4, 1fr);
       gap: 10px;
     }
+
     .metric {
-      border: 1px dashed #c9c2b4;
+      background: var(--surface-soft);
-      padding: 8px;
+      border: 1px solid var(--line);
-      border-radius: 12px;
+      border-radius: 16px;
+      padding: 12px;
     }
-    .metric .k { font-size: 12px; opacity: .75; }
+
-    .metric .v { font-size: 22px; font-weight: 700; }
+    .metric .k {
-    .mono { font-family: "IBM Plex Mono", monospace; font-size: 12px; }
+      font-size: 12px;
-    #logs {
+      color: var(--muted);
-      height: 280px;
+    }
-      overflow: auto;
+
-      background: #0e1624;
+    .metric .v {
-      color: #d9f6ea;
+      margin-top: 8px;
-      border-radius: 10px;
+      font-size: 22px;
-      padding: 10px;
+      font-weight: 700;
-      white-space: pre-wrap;
+    }
+
+    .health-strip {
+      display: flex;
+      gap: 10px;
+      flex-wrap: wrap;
+    }
+
+    .health-chip {
+      min-width: 120px;
+      padding: 10px 12px;
+      border-radius: 14px;
+      background: var(--surface-soft);
+      border: 1px solid var(--line);
+    }
+
+    .health-chip .k {
+      font-size: 12px;
+      color: var(--muted);
+      margin-bottom: 8px;
+    }
+
+    .mono {
       font-family: "IBM Plex Mono", monospace;
-      border: 1px solid #1f3552;
+      font-size: 12px;
     }
+
+    #logs {
+      height: 300px;
+      overflow: auto;
+      background: #f5f9ff;
+      color: #17304d;
+      border-radius: 16px;
+      padding: 12px;
+      white-space: pre-wrap;
+      border: 1px solid var(--line);
+      font-family: "IBM Plex Mono", monospace;
+      font-size: 12px;
+    }
+
     table {
       width: 100%;
       border-collapse: collapse;
       font-size: 14px;
     }
+
     th, td {
       text-align: left;
       border-bottom: 1px solid var(--line);
-      padding: 8px 6px;
+      padding: 10px 8px;
+      vertical-align: top;
     }
-    .actions { display: flex; gap: 6px; flex-wrap: wrap; }
+
+    .actions {
+      display: flex;
+      gap: 6px;
+      flex-wrap: wrap;
+    }
+
     .pill {
       display: inline-block;
-      padding: 2px 8px;
+      padding: 4px 10px;
       border-radius: 999px;
       font-size: 12px;
       font-weight: 700;
     }
-    .pill.ok { background: #dcfce7; color: var(--ok); }
+
-    .pill.off { background: #fee2e2; color: var(--danger); }
+    .pill.ok {
-    .pill.admin { background: #dbeafe; color: #1d4ed8; }
+      background: var(--success-soft);
-    .pill.user { background: #e2e8f0; color: #334155; }
+      color: var(--success);
+    }
+
+    .pill.off {
+      background: var(--danger-soft);
+      color: var(--danger);
+    }
+
+    .pill.admin {
+      background: var(--primary-soft);
+      color: var(--primary-strong);
+    }
+
+    .pill.user {
+      background: #edf2f7;
+      color: #475569;
+    }
+
+    .notice {
+      padding: 12px 14px;
+      border-radius: 14px;
+      background: #fff7ed;
+      border: 1px solid #fed7aa;
+      color: var(--warning);
+      font-size: 13px;
+    }
+
+    .session-info {
+      color: var(--muted);
+      font-size: 13px;
+    }
+
     @media (max-width: 960px) {
-      .col4, .col6, .col8 { grid-column: 1 / -1; }
+      .login-card, .col4, .col5, .col7, .col8 {
-      .stats { grid-template-columns: repeat(2, 1fr); }
+        grid-column: 1 / -1;
-      .topbar { flex-direction: column; align-items: stretch; }
+      }
+
+      .stats {
+        grid-template-columns: repeat(2, 1fr);
+      }
+
+      .health-strip {
+        display: grid;
+        grid-template-columns: repeat(2, 1fr);
+      }
+
+      .hero {
+        flex-direction: column;
+        align-items: flex-start;
+      }
     }
   </style>
 </head>
 <body>
-  <div class="layout">
+  <div class="shell">
-    <div class="topbar">
+    <div class="hero">
-      <h1>Hightube Admin Console</h1>
+      <div class="brand">
-      <div class="tokenbox">
+        <div class="badge">Admin Panel</div>
-        <input id="token" placeholder="粘贴 admin JWT token（来自 /api/login）" />
+        <h1>Hightube Control Console</h1>
-        <button onclick="connectAll()">连接</button>
+        <p>Lightweight operations dashboard for stream status, runtime health, audit logs, and account management.</p>
+      </div>
+      <div class="session-info" id="sessionInfo">Not signed in</div>
+    </div>
+
+    <div class="panel-grid" id="loginView">
+      <div class="card login-card">
+        <h2>Admin Sign In</h2>
+        <p class="muted">Use the administrator account to access monitoring, logs, and user controls. Default bootstrap credentials are <b>admin / admin</b> unless changed by environment variables.</p>
+        <div class="stack">
+          <input id="loginUsername" placeholder="Admin username" value="admin" />
+          <input id="loginPassword" type="password" placeholder="Password" value="admin" />
+          <div class="row">
+            <button onclick="login()">Sign In</button>
+          </div>
+          <div class="notice">
+            Change the default admin password immediately after first login.
+          </div>
+        </div>
       </div>
     </div>
 
-    <div class="card col8">
+    <div class="panel-grid hidden" id="appView">
-      <h2>系统状态</h2>
+      <div class="card full">
+        <div class="row between">
+          <div>
+            <h2 style="margin-bottom:6px;">Session</h2>
+            <div class="muted">Authenticated through a server-managed admin session cookie.</div>
+          </div>
+          <div class="row">
+            <button class="subtle" onclick="refreshAll()">Refresh Now</button>
+            <button class="danger" onclick="logout()">Sign Out</button>
+          </div>
+        </div>
+      </div>
+
+      <div class="card col7">
+        <h2>System Overview</h2>
         <div class="stats" id="stats"></div>
-      <div class="mono" id="health"></div>
+      </div>
+
+      <div class="card col5">
+        <h2>Admin Password</h2>
+        <div class="stack">
+          <input id="oldPassword" type="password" placeholder="Current password" />
+          <input id="newPassword" type="password" placeholder="New password" />
+          <div class="row">
+            <button onclick="changePassword()">Update Password</button>
+          </div>
+        </div>
       </div>
 
       <div class="card col4">
-      <h2>在线状态</h2>
+        <h2>Live Status</h2>
         <div id="online"></div>
+        <div class="health-strip" id="health" style="margin-top:14px;"></div>
       </div>
 
       <div class="card col8">
-      <h2>实时日志</h2>
+        <div class="row between" style="margin-bottom:10px;">
-      <div style="display:flex; gap:8px; margin-bottom:8px;">
+          <h2 style="margin:0;">Audit and Runtime Logs</h2>
-        <button class="secondary" onclick="loadHistory()">加载历史日志</button>
+          <div class="row">
             <select id="logLevel">
-          <option value="">全部级别</option>
+              <option value="">All levels</option>
               <option value="info">info</option>
               <option value="warn">warn</option>
               <option value="error">error</option>
               <option value="audit">audit</option>
             </select>
-        <input id="logKeyword" placeholder="关键词过滤" />
+            <input id="logKeyword" placeholder="Filter keyword" style="width:220px;" />
+            <button class="secondary" onclick="loadHistory()">Load History</button>
+          </div>
         </div>
         <div id="logs"></div>
       </div>
 
-    <div class="card col4">
-      <h2>操作说明</h2>
-      <ul>
-        <li>先在上方输入 admin token 并点击连接。</li>
-        <li>用户管理支持搜索、角色切换、启用禁用、重置密码、删除。</li>
-        <li>日志区会持续接收后端实时事件。</li>
-      </ul>
-    </div>
-
       <div class="card full">
-      <h2>用户管理</h2>
+        <div class="row between" style="margin-bottom:10px;">
-      <div style="display:flex; gap:8px; margin-bottom:8px;">
+          <h2 style="margin:0;">User Management</h2>
-        <input id="userKeyword" placeholder="按用户名搜索" />
+          <div class="row">
-        <button class="secondary" onclick="loadUsers()">查询</button>
+            <input id="userKeyword" placeholder="Search by username" style="width:220px;" />
+            <button class="secondary" onclick="loadUsers()">Search</button>
+          </div>
         </div>
         <table>
           <thead>
             <tr>
               <th>ID</th>
-            <th>用户名</th>
+              <th>Username</th>
-            <th>角色</th>
+              <th>Role</th>
-            <th>状态</th>
+              <th>Status</th>
-            <th>创建时间</th>
+              <th>Created</th>
-            <th>操作</th>
+              <th>Actions</th>
             </tr>
           </thead>
           <tbody id="usersBody"></tbody>
         </table>
       </div>
     </div>
+  </div>
 
   <script>
     let evt = null;
+    let overviewTimer = null;
+    let healthTimer = null;
+    let currentAdmin = null;
 
-    function authHeaders() {
+    function setSessionText(text) {
-      const token = document.getElementById('token').value.trim();
+      document.getElementById('sessionInfo').textContent = text;
-      return {
-        'Authorization': 'Bearer ' + token,
-        'Content-Type': 'application/json'
-      };
     }
 
     function addLogLine(text) {
@@ -228,62 +442,144 @@
       box.scrollTop = box.scrollHeight;
     }
 
-    async function connectAll() {
+    async function api(path, options = {}) {
-      await Promise.all([loadOverview(), loadHealth(), loadUsers(), loadHistory()]);
+      const response = await fetch(path, {
+        credentials: 'same-origin',
+        headers: {
+          'Content-Type': 'application/json',
+          ...(options.headers || {}),
+        },
+        ...options,
+      });
+
+      let data = null;
+      const text = await response.text();
+      if (text) {
+        try {
+          data = JSON.parse(text);
+        } catch (_) {
+          data = { raw: text };
+        }
+      }
+
+      if (!response.ok) {
+        const message = (data && (data.error || data.message)) || `Request failed (${response.status})`;
+        throw new Error(message);
+      }
+
+      return data;
+    }
+
+    function clearPolling() {
+      if (overviewTimer) clearInterval(overviewTimer);
+      if (healthTimer) clearInterval(healthTimer);
+      overviewTimer = null;
+      healthTimer = null;
+    }
+
+    function disconnectLogs() {
+      if (evt) {
+        evt.close();
+        evt = null;
+      }
+    }
+
+    function showLogin() {
+      clearPolling();
+      disconnectLogs();
+      currentAdmin = null;
+      setSessionText('Not signed in');
+      document.getElementById('loginView').classList.remove('hidden');
+      document.getElementById('appView').classList.add('hidden');
+    }
+
+    function showApp(session) {
+      currentAdmin = session;
+      setSessionText(`Signed in as ${session.username}`);
+      document.getElementById('loginView').classList.add('hidden');
+      document.getElementById('appView').classList.remove('hidden');
+    }
+
+    async function ensureSession() {
+      try {
+        const session = await api('/api/admin/session');
+        showApp(session);
+        await refreshAll();
         connectLiveLogs();
-      setInterval(loadOverview, 1000);
+        clearPolling();
-      setInterval(loadHealth, 1000);
+        overviewTimer = setInterval(loadOverview, 1000);
+        healthTimer = setInterval(loadHealth, 1000);
+      } catch (_) {
+        showLogin();
+      }
+    }
+
+    async function login() {
+      const username = document.getElementById('loginUsername').value.trim();
+      const password = document.getElementById('loginPassword').value;
+      try {
+        await api('/api/admin/login', {
+          method: 'POST',
+          body: JSON.stringify({ username, password }),
+        });
+        document.getElementById('loginPassword').value = '';
+        await ensureSession();
+      } catch (error) {
+        alert(error.message);
+      }
+    }
+
+    async function logout() {
+      try {
+        await api('/api/admin/logout', { method: 'POST' });
+      } catch (_) {
+      } finally {
+        showLogin();
+      }
+    }
+
+    async function refreshAll() {
+      await Promise.all([loadOverview(), loadHealth(), loadUsers(), loadHistory()]);
     }
 
     async function loadOverview() {
-      const resp = await fetch('/api/admin/overview', { headers: authHeaders() });
+      const data = await api('/api/admin/overview');
-      if (!resp.ok) {
-        addLogLine('[error] 概览拉取失败，请检查 token 是否为 admin。');
-        return;
-      }
-      const data = await resp.json();
       const sys = data.system || {};
       const stream = data.stream || {};
       const chat = data.chat || {};
 
       document.getElementById('stats').innerHTML = `
-        <div class="metric"><div class="k">运行时长(秒)</div><div class="v">${sys.uptime_seconds ?? '-'}</div></div>
+        <div class="metric"><div class="k">Uptime (s)</div><div class="v">${sys.uptime_seconds ?? '-'}</div></div>
-        <div class="metric"><div class="k">请求总量</div><div class="v">${sys.requests_total ?? '-'}</div></div>
+        <div class="metric"><div class="k">Requests</div><div class="v">${sys.requests_total ?? '-'}</div></div>
-        <div class="metric"><div class="k">错误总量</div><div class="v">${sys.errors_total ?? '-'}</div></div>
+        <div class="metric"><div class="k">Errors</div><div class="v">${sys.errors_total ?? '-'}</div></div>
         <div class="metric"><div class="k">Goroutines</div><div class="v">${sys.goroutines ?? '-'}</div></div>
-        <div class="metric"><div class="k">内存Alloc(MB)</div><div class="v">${(sys.memory_alloc_mb || 0).toFixed(1)}</div></div>
+        <div class="metric"><div class="k">Alloc (MB)</div><div class="v">${(sys.memory_alloc_mb || 0).toFixed(1)}</div></div>
-        <div class="metric"><div class="k">内存Sys(MB)</div><div class="v">${(sys.memory_sys_mb || 0).toFixed(1)}</div></div>
+        <div class="metric"><div class="k">System Mem (MB)</div><div class="v">${(sys.memory_sys_mb || 0).toFixed(1)}</div></div>
-        <div class="metric"><div class="k">CPU核心数</div><div class="v">${sys.cpu_cores ?? '-'}</div></div>
+        <div class="metric"><div class="k">CPU Cores</div><div class="v">${sys.cpu_cores ?? '-'}</div></div>
-        <div class="metric"><div class="k">磁盘剩余/总量(GB)</div><div class="v">${(sys.disk_free_gb || 0).toFixed(1)} / ${(sys.disk_total_gb || 0).toFixed(1)}</div></div>
+        <div class="metric"><div class="k">Disk Free / Total (GB)</div><div class="v">${(sys.disk_free_gb || 0).toFixed(1)} / ${(sys.disk_total_gb || 0).toFixed(1)}</div></div>
       `;
 
       document.getElementById('online').innerHTML = `
-        <p>活跃流数量：<b>${stream.active_stream_count ?? 0}</b></p>
+        <p>Active streams: <b>${stream.active_stream_count ?? 0}</b></p>
-        <p>活跃聊天室：<b>${chat.room_count ?? 0}</b></p>
+        <p>Active chat rooms: <b>${chat.room_count ?? 0}</b></p>
-        <p>在线聊天连接：<b>${chat.total_connected_client ?? 0}</b></p>
+        <p>Connected chat clients: <b>${chat.total_connected_client ?? 0}</b></p>
-        <div class="mono">流路径: ${(stream.active_stream_paths || []).join(', ') || '无'}</div>
+        <div class="mono">Stream paths: ${(stream.active_stream_paths || []).join(', ') || 'none'}</div>
       `;
     }
 
     async function loadHealth() {
-      const resp = await fetch('/api/admin/health', { headers: authHeaders() });
+      const h = await api('/api/admin/health');
-      if (!resp.ok) return;
-      const h = await resp.json();
       const dbOk = h.db && h.db.ok;
       document.getElementById('health').innerHTML =
-        `API: <span class="pill ${h.api ? 'ok' : 'off'}">${h.api ? 'UP' : 'DOWN'}</span> ` +
+        `<div class="health-chip"><div class="k">API</div><span class="pill ${h.api ? 'ok' : 'off'}">${h.api ? 'UP' : 'DOWN'}</span></div>` +
-        `RTMP: <span class="pill ${h.rtmp ? 'ok' : 'off'}">${h.rtmp ? 'UP' : 'DOWN'}</span> ` +
+        `<div class="health-chip"><div class="k">RTMP</div><span class="pill ${h.rtmp ? 'ok' : 'off'}">${h.rtmp ? 'UP' : 'DOWN'}</span></div>` +
-        `DB: <span class="pill ${dbOk ? 'ok' : 'off'}">${dbOk ? 'UP' : 'DOWN'}</span>`;
+        `<div class="health-chip"><div class="k">Database</div><span class="pill ${dbOk ? 'ok' : 'off'}">${dbOk ? 'UP' : 'DOWN'}</span></div>`;
     }
 
     async function loadHistory() {
       const level = encodeURIComponent(document.getElementById('logLevel').value || '');
       const keyword = encodeURIComponent(document.getElementById('logKeyword').value || '');
-      const resp = await fetch(`/api/admin/logs?page=1&page_size=100&level=${level}&keyword=${keyword}`, {
+      const data = await api(`/api/admin/logs?page=1&page_size=100&level=${level}&keyword=${keyword}`);
-        headers: authHeaders()
-      });
-      if (!resp.ok) return;
-      const data = await resp.json();
       const items = data.items || [];
       const box = document.getElementById('logs');
       box.textContent = '';
@@ -291,32 +587,24 @@
     }
 
     function connectLiveLogs() {
-      if (evt) evt.close();
+      disconnectLogs();
-      const token = document.getElementById('token').value.trim();
+      evt = new EventSource('/api/admin/logs/stream', { withCredentials: true });
-      evt = new EventSource('/api/admin/logs/stream?token=' + encodeURIComponent(token));
       evt.onmessage = () => {};
       evt.addEventListener('log', (e) => {
         const item = JSON.parse(e.data);
         addLogLine(`[${item.time}] [${item.level}] ${item.message}`);
       });
       evt.onerror = () => {
-        addLogLine('[warn] 实时日志连接断开，稍后可重连。');
+        addLogLine('[warn] Live log stream disconnected.');
       };
     }
 
     async function loadUsers() {
       const keyword = encodeURIComponent(document.getElementById('userKeyword').value || '');
-      const resp = await fetch(`/api/admin/users?page=1&page_size=50&keyword=${keyword}`, {
+      const data = await api(`/api/admin/users?page=1&page_size=50&keyword=${keyword}`);
-        headers: authHeaders()
-      });
-      if (!resp.ok) {
-        addLogLine('[error] 用户列表拉取失败。');
-        return;
-      }
-      const data = await resp.json();
       const body = document.getElementById('usersBody');
       body.innerHTML = '';
-      (data.items || []).forEach(u => {
+      (data.items || []).forEach((u) => {
         const tr = document.createElement('tr');
         tr.innerHTML = `
           <td>${u.id}</td>
@@ -325,10 +613,10 @@
           <td><span class="pill ${u.enabled ? 'ok' : 'off'}">${u.enabled ? 'enabled' : 'disabled'}</span></td>
           <td>${new Date(u.created_at).toLocaleString()}</td>
           <td class="actions">
-            <button class="secondary" onclick="toggleRole(${u.id}, '${u.role}')">切换角色</button>
+            <button class="subtle" onclick="toggleRole(${u.id}, '${u.role}')">Toggle Role</button>
-            <button class="secondary" onclick="toggleEnabled(${u.id}, ${u.enabled})">启用/禁用</button>
+            <button class="subtle" onclick="toggleEnabled(${u.id}, ${u.enabled})">Enable / Disable</button>
-            <button class="secondary" onclick="resetPwd(${u.id})">重置密码</button>
+            <button class="secondary" onclick="resetPwd(${u.id})">Reset Password</button>
-            <button class="danger" onclick="deleteUser(${u.id})">删除</button>
+            <button class="danger" onclick="deleteUser(${u.id})">Delete</button>
           </td>
         `;
         body.appendChild(tr);
@@ -337,42 +625,53 @@
 
     async function toggleRole(id, role) {
       const next = role === 'admin' ? 'user' : 'admin';
-      await fetch(`/api/admin/users/${id}/role`, {
+      await api(`/api/admin/users/${id}/role`, {
         method: 'PATCH',
-        headers: authHeaders(),
+        body: JSON.stringify({ role: next }),
-        body: JSON.stringify({ role: next })
       });
-      loadUsers();
+      await loadUsers();
     }
 
     async function toggleEnabled(id, enabled) {
-      await fetch(`/api/admin/users/${id}/enabled`, {
+      await api(`/api/admin/users/${id}/enabled`, {
         method: 'PATCH',
-        headers: authHeaders(),
+        body: JSON.stringify({ enabled: !enabled }),
-        body: JSON.stringify({ enabled: !enabled })
       });
-      loadUsers();
+      await loadUsers();
     }
 
     async function resetPwd(id) {
-      const newPwd = prompt('输入新密码（至少 6 位）');
+      const newPwd = prompt('Enter a new password for this user');
       if (!newPwd) return;
-      await fetch(`/api/admin/users/${id}/reset-password`, {
+      await api(`/api/admin/users/${id}/reset-password`, {
         method: 'POST',
-        headers: authHeaders(),
+        body: JSON.stringify({ new_password: newPwd }),
-        body: JSON.stringify({ new_password: newPwd })
       });
-      addLogLine(`[audit] user ${id} password reset requested`);
+      addLogLine(`[audit] password reset requested for user ${id}`);
     }
 
     async function deleteUser(id) {
-      if (!confirm('确认删除该用户？')) return;
+      if (!confirm('Delete this user account?')) return;
-      await fetch(`/api/admin/users/${id}`, {
+      await api(`/api/admin/users/${id}`, { method: 'DELETE' });
-        method: 'DELETE',
+      await loadUsers();
-        headers: authHeaders()
-      });
-      loadUsers();
     }
+
+    async function changePassword() {
+      const oldPassword = document.getElementById('oldPassword').value;
+      const newPassword = document.getElementById('newPassword').value;
+      await api('/api/user/change-password', {
+        method: 'POST',
+        body: JSON.stringify({
+          old_password: oldPassword,
+          new_password: newPassword,
+        }),
+      });
+      document.getElementById('oldPassword').value = '';
+      document.getElementById('newPassword').value = '';
+      alert('Password updated successfully.');
+    }
+
+    window.addEventListener('load', ensureSession);
   </script>
 </body>
 </html>

backend/internal/db/db.go

@@ -59,7 +59,7 @@ func ensureAdminUser() {
 
 	adminPassword := os.Getenv("HIGHTUBE_ADMIN_PASS")
 	if adminPassword == "" {
-		adminPassword = "admin123456"
+		adminPassword = "admin"
 	}
 
 	var user model.User
@@ -106,5 +106,5 @@ func ensureAdminUser() {
 		monitor.Warnf("Failed to create default admin room: %v", roomErr)
 	}
 
-	monitor.Warnf("Default admin created: username=%s password=%s", adminUsername, adminPassword)
+	monitor.Warnf("Default admin created for username=%s; change the password after first login", adminUsername)
 }

backend/internal/stream/server.go

@@ -1,11 +1,18 @@
 package stream
 
 import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
 	"fmt"
 	"io"
 	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
 	"strings"
 	"sync"
+	"time"
 
 	"github.com/gin-gonic/gin"
 	"github.com/nareix/joy4/av/avutil"
@@ -29,9 +36,42 @@ func init() {
 type RTMPServer struct {
 	server             *rtmp.Server
 	channels           map[string]*pubsub.Queue
+	transcoders        map[string][]*variantTranscoder
+	thumbnailJobs      map[string]context.CancelFunc
+	internalPublishKey string
+	thumbnailDir       string
 	mutex              sync.RWMutex
 }
 
+type variantTranscoder struct {
+	quality string
+	cancel  context.CancelFunc
+	cmd     *exec.Cmd
+}
+
+type qualityProfile struct {
+	scale        string
+	videoBitrate string
+	audioBitrate string
+}
+
+var qualityOrder = []string{"source", "720p", "480p"}
+
+const thumbnailCaptureInterval = 12 * time.Second
+
+var supportedQualities = map[string]qualityProfile{
+	"720p": {
+		scale:        "1280:-2",
+		videoBitrate: "2500k",
+		audioBitrate: "128k",
+	},
+	"480p": {
+		scale:        "854:-2",
+		videoBitrate: "1200k",
+		audioBitrate: "96k",
+	},
+}
+
 type writeFlusher struct {
 	httpFlusher http.Flusher
 	io.Writer
@@ -46,31 +86,30 @@ func (w writeFlusher) Flush() error {
 func NewRTMPServer() *RTMPServer {
 	s := &RTMPServer{
 		channels:           make(map[string]*pubsub.Queue),
+		transcoders:        make(map[string][]*variantTranscoder),
+		thumbnailJobs:      make(map[string]context.CancelFunc),
+		internalPublishKey: generateInternalPublishKey(),
+		thumbnailDir:       filepath.Join(os.TempDir(), "hightube-thumbnails"),
 		server:             &rtmp.Server{},
 	}
 
 	// Triggered when a broadcaster (e.g., OBS) starts publishing
 	s.server.HandlePublish = func(conn *rtmp.Conn) {
-		streamPath := conn.URL.Path // Expected format: /live/{stream_key}
+		streamPath := conn.URL.Path // Expected format: /live/{stream_key} or /variant/{room_id}/{quality}/{token}
 		monitor.Infof("OBS publish attempt: %s", streamPath)
 
-		// Extract stream key from path
 		parts := strings.Split(streamPath, "/")
-		if len(parts) < 3 || parts[1] != "live" {
+		if len(parts) < 3 {
 			monitor.Warnf("Invalid publish path format: %s", streamPath)
 			return
 		}
-		streamKey := parts[2]
 
-		// Authenticate stream key
+		roomID, channelPath, isSource, ok := s.resolvePublishPath(parts)
-		var room model.Room
+		if !ok {
-		if err := db.DB.Where("stream_key = ?", streamKey).First(&room).Error; err != nil {
+			monitor.Warnf("Invalid publish key/path: %s", streamPath)
-			monitor.Warnf("Invalid stream key: %s", streamKey)
+			return
-			return // Reject connection
 		}
 
-		monitor.Infof("Stream authenticated for room_id=%d", room.ID)
-
 		// 1. Get audio/video stream metadata
 		streams, err := conn.Streams()
 		if err != nil {
@@ -78,31 +117,42 @@ func NewRTMPServer() *RTMPServer {
 			return
 		}
 
-		// 2. Map the active stream by Room ID so viewers can use /live/{room_id}
+		monitor.Infof("Stream authenticated for room_id=%s path=%s", roomID, channelPath)
-		roomLivePath := fmt.Sprintf("/live/%d", room.ID)
 
 		s.mutex.Lock()
 		q := pubsub.NewQueue()
 		q.WriteHeader(streams)
-		s.channels[roomLivePath] = q
+		s.channels[channelPath] = q
 		s.mutex.Unlock()
 
-		// Mark room as active in DB (using map to ensure true/false is correctly updated)
+		if isSource {
-		db.DB.Model(&room).Updates(map[string]interface{}{"is_active": true})
+			roomIDUint := parseRoomID(roomID)
+			if roomIDUint != 0 {
+				db.DB.Model(&model.Room{}).Where("id = ?", roomIDUint).Updates(map[string]interface{}{"is_active": true})
+			}
+			s.startVariantTranscoders(roomID)
+			s.startThumbnailCapture(roomID)
+		}
 
 		// 3. Cleanup on end
 		defer func() {
 			s.mutex.Lock()
-			delete(s.channels, roomLivePath)
+			delete(s.channels, channelPath)
 			s.mutex.Unlock()
 			q.Close()
-			// Explicitly set is_active to false using map
-			db.DB.Model(&room).Updates(map[string]interface{}{"is_active": false})
 
-			// Clear chat history for this room
+			if isSource {
-			chat.MainHub.ClearRoomHistory(fmt.Sprintf("%d", room.ID))
+				s.stopVariantTranscoders(roomID)
-			
+				s.stopThumbnailCapture(roomID)
-			monitor.Infof("Publishing ended for room_id=%d", room.ID)
+				roomIDUint := parseRoomID(roomID)
+				if roomIDUint != 0 {
+					db.DB.Model(&model.Room{}).Where("id = ?", roomIDUint).Updates(map[string]interface{}{"is_active": false})
+				}
+				chat.MainHub.ClearRoomHistory(roomID)
+				monitor.Infof("Publishing ended for room_id=%s", roomID)
+			} else {
+				monitor.Infof("Variant publishing ended for room_id=%s path=%s", roomID, channelPath)
+			}
 		}()
 
 		// 4. Continuously copy data packets to our broadcast queue
@@ -158,6 +208,9 @@ func (s *RTMPServer) Start(addr string) error {
 // HandleHTTPFLV serves browser-compatible HTTP-FLV playback for web clients.
 func (s *RTMPServer) HandleHTTPFLV(c *gin.Context) {
 	streamPath := fmt.Sprintf("/live/%s", c.Param("room_id"))
+	if quality := normalizeQuality(c.Query("quality")); quality != "" {
+		streamPath = fmt.Sprintf("%s/%s", streamPath, quality)
+	}
 
 	s.mutex.RLock()
 	q, ok := s.channels[streamPath]
@@ -198,10 +251,249 @@ func (s *RTMPServer) HandleHTTPFLV(c *gin.Context) {
 	}
 }
 
+func (s *RTMPServer) HandleThumbnail(c *gin.Context) {
+	thumbnailPath := s.thumbnailPath(c.Param("room_id"))
+	if _, err := os.Stat(thumbnailPath); err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Thumbnail not found"})
+		return
+	}
+
+	c.Header("Cache-Control", "no-store, no-cache, must-revalidate")
+	c.File(thumbnailPath)
+}
+
+func (s *RTMPServer) resolvePublishPath(parts []string) (roomID string, channelPath string, isSource bool, ok bool) {
+	if parts[1] == "live" && len(parts) == 3 {
+		var room model.Room
+		if err := db.DB.Where("stream_key = ?", parts[2]).First(&room).Error; err != nil {
+			return "", "", false, false
+		}
+		roomID = fmt.Sprintf("%d", room.ID)
+		channelPath = fmt.Sprintf("/live/%s", roomID)
+		return roomID, channelPath, true, true
+	}
+
+	if parts[1] == "variant" && len(parts) == 5 {
+		roomID = parts[2]
+		quality := normalizeQuality(parts[3])
+		token := parts[4]
+		if quality == "" || token != s.internalPublishKey {
+			return "", "", false, false
+		}
+		return roomID, fmt.Sprintf("/live/%s/%s", roomID, quality), false, true
+	}
+
+	return "", "", false, false
+}
+
+func (s *RTMPServer) startVariantTranscoders(roomID string) {
+	s.stopVariantTranscoders(roomID)
+
+	launch := make([]*variantTranscoder, 0, len(supportedQualities))
+	for quality, profile := range supportedQualities {
+		ctx, cancel := context.WithCancel(context.Background())
+		inputURL := fmt.Sprintf("rtmp://127.0.0.1:1935/live/%s", roomID)
+		outputURL := fmt.Sprintf("rtmp://127.0.0.1:1935/variant/%s/%s/%s", roomID, quality, s.internalPublishKey)
+		cmd := exec.CommandContext(
+			ctx,
+			"ffmpeg",
+			"-nostdin",
+			"-loglevel", "error",
+			"-i", inputURL,
+			"-vf", "scale="+profile.scale+":force_original_aspect_ratio=decrease",
+			"-c:v", "libx264",
+			"-preset", "veryfast",
+			"-tune", "zerolatency",
+			"-g", "48",
+			"-keyint_min", "48",
+			"-sc_threshold", "0",
+			"-b:v", profile.videoBitrate,
+			"-maxrate", profile.videoBitrate,
+			"-bufsize", profile.videoBitrate,
+			"-c:a", "aac",
+			"-b:a", profile.audioBitrate,
+			"-ar", "44100",
+			"-ac", "2",
+			"-f", "flv",
+			outputURL,
+		)
+
+		transcoder := &variantTranscoder{
+			quality: quality,
+			cancel:  cancel,
+			cmd:     cmd,
+		}
+		launch = append(launch, transcoder)
+
+		go func(roomID string, tr *variantTranscoder) {
+			time.Sleep(2 * time.Second)
+			monitor.Infof("Starting transcoder room_id=%s quality=%s", roomID, tr.quality)
+			if err := tr.cmd.Start(); err != nil {
+				monitor.Errorf("Failed to start transcoder room_id=%s quality=%s: %v", roomID, tr.quality, err)
+				return
+			}
+			if err := tr.cmd.Wait(); err != nil && ctx.Err() == nil {
+				monitor.Warnf("Transcoder exited room_id=%s quality=%s: %v", roomID, tr.quality, err)
+			}
+		}(roomID, transcoder)
+	}
+
+	s.mutex.Lock()
+	s.transcoders[roomID] = launch
+	s.mutex.Unlock()
+}
+
+func (s *RTMPServer) stopVariantTranscoders(roomID string) {
+	s.mutex.Lock()
+	transcoders := s.transcoders[roomID]
+	delete(s.transcoders, roomID)
+	s.mutex.Unlock()
+
+	for _, transcoder := range transcoders {
+		transcoder.cancel()
+	}
+}
+
+func (s *RTMPServer) startThumbnailCapture(roomID string) {
+	s.stopThumbnailCapture(roomID)
+
+	if err := os.MkdirAll(s.thumbnailDir, 0o755); err != nil {
+		monitor.Errorf("Failed to create thumbnail directory: %v", err)
+		return
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+
+	s.mutex.Lock()
+	s.thumbnailJobs[roomID] = cancel
+	s.mutex.Unlock()
+
+	go func() {
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(3 * time.Second):
+		}
+
+		s.captureThumbnail(roomID)
+
+		ticker := time.NewTicker(thumbnailCaptureInterval)
+		defer ticker.Stop()
+
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+				s.captureThumbnail(roomID)
+			}
+		}
+	}()
+}
+
+func (s *RTMPServer) stopThumbnailCapture(roomID string) {
+	s.mutex.Lock()
+	cancel := s.thumbnailJobs[roomID]
+	delete(s.thumbnailJobs, roomID)
+	s.mutex.Unlock()
+
+	if cancel != nil {
+		cancel()
+	}
+
+	_ = os.Remove(s.thumbnailPath(roomID))
+}
+
+func (s *RTMPServer) captureThumbnail(roomID string) {
+	outputPath := s.thumbnailPath(roomID)
+	tempPath := outputPath + ".tmp.jpg"
+	defer os.Remove(tempPath)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 8*time.Second)
+	defer cancel()
+
+	cmd := exec.CommandContext(
+		ctx,
+		"ffmpeg",
+		"-y",
+		"-loglevel", "error",
+		"-rtmp_live", "live",
+		"-i", fmt.Sprintf("rtmp://127.0.0.1:1935/live/%s", roomID),
+		"-frames:v", "1",
+		"-q:v", "4",
+		tempPath,
+	)
+
+	if err := cmd.Run(); err != nil {
+		if ctx.Err() == context.DeadlineExceeded {
+			monitor.Warnf("Thumbnail capture timed out for room_id=%s", roomID)
+			return
+		}
+		monitor.Warnf("Thumbnail capture failed for room_id=%s: %v", roomID, err)
+		return
+	}
+
+	_ = os.Remove(outputPath)
+	if err := os.Rename(tempPath, outputPath); err != nil {
+		monitor.Warnf("Failed to store thumbnail for room_id=%s: %v", roomID, err)
+	}
+}
+
+func (s *RTMPServer) thumbnailPath(roomID string) string {
+	return filepath.Join(s.thumbnailDir, fmt.Sprintf("%s.jpg", roomID))
+}
+
+func normalizeQuality(value string) string {
+	value = strings.ToLower(strings.TrimSpace(value))
+	if _, ok := supportedQualities[value]; ok {
+		return value
+	}
+	return ""
+}
+
+func parseRoomID(value string) uint {
+	var roomID uint
+	_, _ = fmt.Sscanf(value, "%d", &roomID)
+	return roomID
+}
+
+func generateInternalPublishKey() string {
+	buf := make([]byte, 16)
+	if _, err := rand.Read(buf); err != nil {
+		return "internal_publish_fallback_key"
+	}
+	return hex.EncodeToString(buf)
+}
+
 func (s *RTMPServer) ActiveStreamCount() int {
 	s.mutex.RLock()
 	defer s.mutex.RUnlock()
-	return len(s.channels)
+
+	count := 0
+	for path := range s.channels {
+		if strings.Count(path, "/") == 2 {
+			count++
+		}
+	}
+	return count
+}
+
+func (s *RTMPServer) AvailablePlaybackQualities(roomID string) []string {
+	s.mutex.RLock()
+	defer s.mutex.RUnlock()
+
+	basePath := fmt.Sprintf("/live/%s", roomID)
+	available := make([]string, 0, len(qualityOrder))
+	for _, quality := range qualityOrder {
+		streamPath := basePath
+		if quality != "source" {
+			streamPath = fmt.Sprintf("%s/%s", basePath, quality)
+		}
+		if _, ok := s.channels[streamPath]; ok {
+			available = append(available, quality)
+		}
+	}
+	return available
 }
 
 func (s *RTMPServer) ActiveStreamPaths() []string {
@@ -210,7 +502,9 @@ func (s *RTMPServer) ActiveStreamPaths() []string {
 
 	paths := make([]string, 0, len(s.channels))
 	for path := range s.channels {
+		if strings.Count(path, "/") == 2 {
 			paths = append(paths, path)
 		}
+	}
 	return paths
 }

frontend/android/app/build.gradle.kts

@@ -11,12 +11,12 @@ android {
     ndkVersion = flutter.ndkVersion
 
     compileOptions {
-        sourceCompatibility = JavaVersion.VERSION_1_8
+        sourceCompatibility = JavaVersion.VERSION_17
-        targetCompatibility = JavaVersion.VERSION_1_8
+        targetCompatibility = JavaVersion.VERSION_17
     }
 
     kotlinOptions {
-        jvmTarget = JavaVersion.VERSION_1_8.toString()
+        jvmTarget = JavaVersion.VERSION_17.toString()
     }
 
     defaultConfig {

frontend/android/app/src/main/AndroidManifest.xml

@@ -1,5 +1,7 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
     <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.CAMERA" />
+    <uses-permission android:name="android.permission.RECORD_AUDIO" />
     <application
         android:label="Hightube"
         android:name="${applicationName}"

frontend/lib/pages/home_page.dart

@@ -10,8 +10,10 @@ import 'player_page.dart';
 import 'my_stream_page.dart';
 
 class HomePage extends StatefulWidget {
+  const HomePage({super.key});
+
   @override
-  _HomePageState createState() => _HomePageState();
+  State<HomePage> createState() => _HomePageState();
 }
 
 class _HomePageState extends State<HomePage> {
@@ -21,7 +23,7 @@ class _HomePageState extends State<HomePage> {
   Widget build(BuildContext context) {
     bool isWide = MediaQuery.of(context).size.width > 600;
 
-    final List<Widget> _pages = [
+    final List<Widget> pages = [
       _ExploreView(onGoLive: () => setState(() => _selectedIndex = 1)),
       MyStreamPage(),
       SettingsPage(),
@@ -51,7 +53,7 @@ class _HomePageState extends State<HomePage> {
                 ),
               ],
             ),
-          Expanded(child: _pages[_selectedIndex]),
+          Expanded(child: pages[_selectedIndex]),
         ],
       ),
       bottomNavigationBar: !isWide
@@ -91,6 +93,8 @@ class _ExploreViewState extends State<_ExploreView> {
   List<dynamic> _activeRooms = [];
   bool _isLoading = false;
   Timer? _refreshTimer;
+  String _thumbnailCacheBuster = DateTime.now().millisecondsSinceEpoch
+      .toString();
 
   @override
   void initState() {
@@ -117,18 +121,51 @@ class _ExploreViewState extends State<_ExploreView> {
       final response = await api.getActiveRooms();
       if (response.statusCode == 200) {
         final data = jsonDecode(response.body);
-        if (mounted) setState(() => _activeRooms = data['active_rooms'] ?? []);
+        if (mounted) {
+          setState(() {
+            _activeRooms = data['active_rooms'] ?? [];
+            _thumbnailCacheBuster = DateTime.now().millisecondsSinceEpoch
+                .toString();
+          });
+        }
       }
     } catch (e) {
-      if (!isAuto && mounted)
+      if (!isAuto && mounted) {
         ScaffoldMessenger.of(
           context,
         ).showSnackBar(SnackBar(content: Text("Failed to load rooms")));
+      }
     } finally {
       if (!isAuto && mounted) setState(() => _isLoading = false);
     }
   }
 
+  Future<void> _confirmLogout() async {
+    final confirmed = await showDialog<bool>(
+      context: context,
+      builder: (context) {
+        return AlertDialog(
+          title: const Text('Confirm Logout'),
+          content: const Text('Are you sure you want to log out now?'),
+          actions: [
+            TextButton(
+              onPressed: () => Navigator.pop(context, false),
+              child: const Text('Cancel'),
+            ),
+            FilledButton(
+              onPressed: () => Navigator.pop(context, true),
+              child: const Text('Logout'),
+            ),
+          ],
+        );
+      },
+    );
+
+    if (confirmed == true && mounted) {
+      await context.read<AuthProvider>().logout();
+    }
+  }
+
   @override
   Widget build(BuildContext context) {
     final settings = context.watch<SettingsProvider>();
@@ -141,10 +178,7 @@ class _ExploreViewState extends State<_ExploreView> {
             icon: Icon(Icons.refresh),
             onPressed: () => _refreshRooms(),
           ),
-          IconButton(
+          IconButton(icon: Icon(Icons.logout), onPressed: _confirmLogout),
-            icon: Icon(Icons.logout),
-            onPressed: () => context.read<AuthProvider>().logout(),
-          ),
         ],
       ),
       floatingActionButton: FloatingActionButton.extended(
@@ -198,20 +232,21 @@ class _ExploreViewState extends State<_ExploreView> {
   }
 
   Widget _buildRoomCard(dynamic room, SettingsProvider settings) {
+    final roomId = room['room_id'].toString();
     return Card(
       elevation: 4,
       clipBehavior: Clip.antiAlias,
       shape: RoundedRectangleBorder(borderRadius: BorderRadius.circular(16)),
       child: InkWell(
         onTap: () {
-          final playbackUrl = settings.playbackUrl(room['room_id'].toString());
+          final playbackUrl = settings.playbackUrl(roomId);
           Navigator.push(
             context,
             MaterialPageRoute(
               builder: (_) => PlayerPage(
                 title: room['title'],
                 playbackUrl: playbackUrl,
-                roomId: room['room_id'].toString(),
+                roomId: roomId,
               ),
             ),
           );
@@ -224,16 +259,37 @@ class _ExploreViewState extends State<_ExploreView> {
               child: Stack(
                 fit: StackFit.expand,
                 children: [
-                  Container(
+                  settings.livePreviewThumbnailsEnabled
-                    color: Theme.of(context).colorScheme.primaryContainer,
+                      ? Image.network(
-                    child: Center(
+                          settings.thumbnailUrl(
-                      child: Icon(
+                            roomId,
-                        Icons.live_tv,
+                            cacheBuster: _thumbnailCacheBuster,
-                        size: 50,
+                          ),
-                        color: Theme.of(context).colorScheme.primary,
+                          fit: BoxFit.cover,
+                          errorBuilder: (context, error, stackTrace) =>
+                              _buildRoomPreviewFallback(),
+                          loadingBuilder: (context, child, loadingProgress) {
+                            if (loadingProgress == null) {
+                              return child;
+                            }
+                            return Stack(
+                              fit: StackFit.expand,
+                              children: [
+                                _buildRoomPreviewFallback(),
+                                const Center(
+                                  child: SizedBox(
+                                    width: 22,
+                                    height: 22,
+                                    child: CircularProgressIndicator(
+                                      strokeWidth: 2,
                                     ),
                                   ),
                                 ),
+                              ],
+                            );
+                          },
+                        )
+                      : _buildRoomPreviewFallback(),
                   Positioned(
                     top: 8,
                     left: 8,
@@ -306,4 +362,17 @@ class _ExploreViewState extends State<_ExploreView> {
       ),
     );
   }
+
+  Widget _buildRoomPreviewFallback() {
+    return Container(
+      color: Theme.of(context).colorScheme.primaryContainer,
+      child: Center(
+        child: Icon(
+          Icons.live_tv,
+          size: 50,
+          color: Theme.of(context).colorScheme.primary,
+        ),
+      ),
+    );
+  }
 }

frontend/lib/pages/login_page.dart

@@ -17,8 +17,17 @@ class LoginPage extends StatefulWidget {
 class _LoginPageState extends State<LoginPage> {
   final _usernameController = TextEditingController();
   final _passwordController = TextEditingController();
+  final _passwordFocusNode = FocusNode();
   bool _isLoading = false;
 
+  @override
+  void dispose() {
+    _usernameController.dispose();
+    _passwordController.dispose();
+    _passwordFocusNode.dispose();
+    super.dispose();
+  }
+
   void _handleLogin() async {
     if (_usernameController.text.isEmpty || _passwordController.text.isEmpty) {
       ScaffoldMessenger.of(
@@ -108,6 +117,8 @@ class _LoginPageState extends State<LoginPage> {
                 // Fields
                 TextField(
                   controller: _usernameController,
+                  textInputAction: TextInputAction.next,
+                  onSubmitted: (_) => _passwordFocusNode.requestFocus(),
                   decoration: InputDecoration(
                     labelText: "Username",
                     prefixIcon: Icon(Icons.person),
@@ -119,7 +130,14 @@ class _LoginPageState extends State<LoginPage> {
                 SizedBox(height: 16),
                 TextField(
                   controller: _passwordController,
+                  focusNode: _passwordFocusNode,
                   obscureText: true,
+                  textInputAction: TextInputAction.done,
+                  onSubmitted: (_) {
+                    if (!_isLoading) {
+                      _handleLogin();
+                    }
+                  },
                   decoration: InputDecoration(
                     labelText: "Password",
                     prefixIcon: Icon(Icons.lock),

frontend/lib/pages/my_stream_page.dart

@@ -5,10 +5,13 @@ import 'package:flutter/services.dart';
 import '../providers/auth_provider.dart';
 import '../providers/settings_provider.dart';
 import '../services/api_service.dart';
+import '../widgets/android_quick_stream_panel.dart';
 
 class MyStreamPage extends StatefulWidget {
+  const MyStreamPage({super.key});
+
   @override
-  _MyStreamPageState createState() => _MyStreamPageState();
+  State<MyStreamPage> createState() => _MyStreamPageState();
 }
 
 class _MyStreamPageState extends State<MyStreamPage> {
@@ -29,15 +32,25 @@ class _MyStreamPageState extends State<MyStreamPage> {
 
     try {
       final response = await api.getMyRoom();
+      if (!mounted) {
+        return;
+      }
       if (response.statusCode == 200) {
         setState(() => _roomInfo = jsonDecode(response.body));
       }
     } catch (e) {
-      ScaffoldMessenger.of(context).showSnackBar(SnackBar(content: Text("Failed to fetch room info")));
+      if (!mounted) {
+        return;
+      }
+      ScaffoldMessenger.of(
+        context,
+      ).showSnackBar(SnackBar(content: Text("Failed to fetch room info")));
     } finally {
+      if (mounted) {
         setState(() => _isLoading = false);
       }
     }
+  }
 
   @override
   Widget build(BuildContext context) {
@@ -60,7 +73,9 @@ class _MyStreamPageState extends State<MyStreamPage> {
                     icon: Icons.edit,
                     onTap: () {
                       // TODO: Implement title update API later
-                          ScaffoldMessenger.of(context).showSnackBar(SnackBar(content: Text("Title editing coming soon!")));
+                      ScaffoldMessenger.of(context).showSnackBar(
+                        SnackBar(content: Text("Title editing coming soon!")),
+                      );
                     },
                   ),
                   SizedBox(height: 20),
@@ -70,7 +85,11 @@ class _MyStreamPageState extends State<MyStreamPage> {
                     icon: Icons.copy,
                     onTap: () {
                       Clipboard.setData(ClipboardData(text: settings.rtmpUrl));
-                          ScaffoldMessenger.of(context).showSnackBar(SnackBar(content: Text("Server URL copied to clipboard")));
+                      ScaffoldMessenger.of(context).showSnackBar(
+                        SnackBar(
+                          content: Text("Server URL copied to clipboard"),
+                        ),
+                      );
                     },
                   ),
                   SizedBox(height: 20),
@@ -80,10 +99,21 @@ class _MyStreamPageState extends State<MyStreamPage> {
                     icon: Icons.copy,
                     isSecret: true,
                     onTap: () {
-                          Clipboard.setData(ClipboardData(text: _roomInfo!['stream_key']));
+                      Clipboard.setData(
-                          ScaffoldMessenger.of(context).showSnackBar(SnackBar(content: Text("Stream Key copied to clipboard")));
+                        ClipboardData(text: _roomInfo!['stream_key']),
+                      );
+                      ScaffoldMessenger.of(context).showSnackBar(
+                        SnackBar(
+                          content: Text("Stream Key copied to clipboard"),
+                        ),
+                      );
                     },
                   ),
+                  SizedBox(height: 24),
+                  AndroidQuickStreamPanel(
+                    rtmpBaseUrl: settings.rtmpUrl,
+                    streamKey: _roomInfo!['stream_key'],
+                  ),
                   SizedBox(height: 30),
                   Center(
                     child: Column(

frontend/lib/pages/player_page.dart

@@ -1,4 +1,5 @@
 import 'dart:async';
+import 'dart:convert';
 
 import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
@@ -8,6 +9,7 @@ import 'package:video_player/video_player.dart';
 
 import '../providers/auth_provider.dart';
 import '../providers/settings_provider.dart';
+import '../services/api_service.dart';
 import '../services/chat_service.dart';
 import '../widgets/web_stream_player.dart';
 
@@ -24,7 +26,7 @@ class PlayerPage extends StatefulWidget {
   });
 
   @override
-  _PlayerPageState createState() => _PlayerPageState();
+  State<PlayerPage> createState() => _PlayerPageState();
 }
 
 class _PlayerPageState extends State<PlayerPage> {
@@ -40,13 +42,16 @@ class _PlayerPageState extends State<PlayerPage> {
   bool _isRefreshing = false;
   bool _isFullscreen = false;
   bool _controlsVisible = true;
+  double _volume = kIsWeb ? 0.0 : 1.0;
   int _playerVersion = 0;
   String _selectedResolution = 'Source';
+  List<String> _availableResolutions = const ['Source'];
   Timer? _controlsHideTimer;
 
   @override
   void initState() {
     super.initState();
+    _loadPlaybackOptions();
     if (!kIsWeb) {
       _initializePlayer();
     }
@@ -55,11 +60,11 @@ class _PlayerPageState extends State<PlayerPage> {
   }
 
   Future<void> _initializePlayer() async {
-    _controller = VideoPlayerController.networkUrl(
+    final playbackUrl = _currentPlaybackUrl();
-      Uri.parse(widget.playbackUrl),
+    _controller = VideoPlayerController.networkUrl(Uri.parse(playbackUrl));
-    );
     try {
       await _controller!.initialize();
+      await _controller!.setVolume(_volume);
       _controller!.play();
       if (mounted) setState(() {});
     } catch (e) {
@@ -81,6 +86,55 @@ class _PlayerPageState extends State<PlayerPage> {
     }
   }
 
+  String _currentPlaybackUrl() {
+    final settings = context.read<SettingsProvider>();
+    final quality = _selectedResolution == 'Source'
+        ? null
+        : _selectedResolution.toLowerCase();
+    return settings.playbackUrl(widget.roomId, quality: quality);
+  }
+
+  Future<void> _loadPlaybackOptions() async {
+    final settings = context.read<SettingsProvider>();
+    final auth = context.read<AuthProvider>();
+    final api = ApiService(settings, auth.token);
+
+    try {
+      final response = await api.getPlaybackOptions(widget.roomId);
+      if (response.statusCode != 200) {
+        return;
+      }
+
+      final data = jsonDecode(response.body) as Map<String, dynamic>;
+      final rawQualities =
+          (data['qualities'] as List<dynamic>? ?? const ['source'])
+              .map((item) => item.toString().trim().toLowerCase())
+              .where((item) => item.isNotEmpty)
+              .toList();
+
+      final normalized = <String>['Source'];
+      for (final quality in rawQualities) {
+        if (quality == 'source') {
+          continue;
+        }
+        normalized.add(quality);
+      }
+
+      if (!mounted) {
+        return;
+      }
+
+      setState(() {
+        _availableResolutions = normalized.toSet().toList();
+        if (!_availableResolutions.contains(_selectedResolution)) {
+          _selectedResolution = 'Source';
+        }
+      });
+    } catch (_) {
+      // Keep source-only playback when the capability probe fails.
+    }
+  }
+
   void _initializeChat() {
     final settings = context.read<SettingsProvider>();
     final auth = context.read<AuthProvider>();
@@ -141,6 +195,8 @@ class _PlayerPageState extends State<PlayerPage> {
       return;
     }
 
+    await _loadPlaybackOptions();
+
     setState(() {
       _isRefreshing = true;
       _isError = false;
@@ -200,6 +256,76 @@ class _PlayerPageState extends State<PlayerPage> {
     _showControls();
   }
 
+  Future<void> _setVolume(double volume) async {
+    final nextVolume = volume.clamp(0.0, 1.0);
+    if (!mounted) {
+      return;
+    }
+
+    setState(() => _volume = nextVolume);
+
+    if (!kIsWeb && _controller != null) {
+      await _controller!.setVolume(nextVolume);
+    }
+  }
+
+  Future<void> _openVolumeSheet() async {
+    _showControls();
+    await showModalBottomSheet<void>(
+      context: context,
+      builder: (context) {
+        return SafeArea(
+          child: Padding(
+            padding: const EdgeInsets.fromLTRB(20, 16, 20, 28),
+            child: StatefulBuilder(
+              builder: (context, setSheetState) {
+                return Column(
+                  mainAxisSize: MainAxisSize.min,
+                  crossAxisAlignment: CrossAxisAlignment.start,
+                  children: [
+                    Text(
+                      'Volume',
+                      style: Theme.of(context).textTheme.titleMedium,
+                    ),
+                    const SizedBox(height: 12),
+                    Row(
+                      children: [
+                        Icon(
+                          _volume == 0
+                              ? Icons.volume_off
+                              : _volume < 0.5
+                              ? Icons.volume_down
+                              : Icons.volume_up,
+                        ),
+                        Expanded(
+                          child: Slider(
+                            value: _volume,
+                            min: 0,
+                            max: 1,
+                            divisions: 20,
+                            label: '${(_volume * 100).round()}%',
+                            onChanged: (value) {
+                              setSheetState(() => _volume = value);
+                              _setVolume(value);
+                            },
+                          ),
+                        ),
+                        SizedBox(
+                          width: 48,
+                          child: Text('${(_volume * 100).round()}%'),
+                        ),
+                      ],
+                    ),
+                  ],
+                );
+              },
+            ),
+          ),
+        );
+      },
+    );
+  }
+
   void _showControls() {
     _controlsHideTimer?.cancel();
     if (mounted) {
@@ -223,22 +349,30 @@ class _PlayerPageState extends State<PlayerPage> {
 
   Future<void> _selectResolution() async {
     _showControls();
+    await _loadPlaybackOptions();
+    if (!mounted) {
+      return;
+    }
+
     final nextResolution = await showModalBottomSheet<String>(
       context: context,
       builder: (context) {
         const options = ['Source', '720p', '480p'];
+        final available = _availableResolutions.toSet();
         return SafeArea(
           child: Column(
             mainAxisSize: MainAxisSize.min,
             children: [
-              const ListTile(
+              ListTile(
                 title: Text('Playback Resolution'),
                 subtitle: Text(
-                  'Current backend only provides the source stream. Lower resolutions are reserved for future multi-bitrate output.',
+                  available.length > 1
+                      ? 'Select an available transcoded stream.'
+                      : 'Only the source stream is available right now.',
                 ),
               ),
               ...options.map((option) {
-                final enabled = option == 'Source';
+                final enabled = available.contains(option);
                 return ListTile(
                   enabled: enabled,
                   leading: Icon(
@@ -249,7 +383,7 @@ class _PlayerPageState extends State<PlayerPage> {
                   title: Text(option),
                   subtitle: enabled
                       ? const Text('Available now')
-                      : const Text('Requires backend transcoding support'),
+                      : const Text('Waiting for backend transcoding output'),
                   onTap: enabled ? () => Navigator.pop(context, option) : null,
                 );
               }),
@@ -376,7 +510,8 @@ class _PlayerPageState extends State<PlayerPage> {
                   : kIsWeb
                   ? WebStreamPlayer(
                       key: ValueKey('web-player-$_playerVersion'),
-                      streamUrl: widget.playbackUrl,
+                      streamUrl: _currentPlaybackUrl(),
+                      volume: _volume,
                     )
                   : _controller != null && _controller!.value.isInitialized
                   ? AspectRatio(
@@ -488,6 +623,15 @@ class _PlayerPageState extends State<PlayerPage> {
                     label: "Refresh",
                     onPressed: _refreshPlayer,
                   ),
+                  _buildControlButton(
+                    icon: _volume == 0
+                        ? Icons.volume_off
+                        : _volume < 0.5
+                        ? Icons.volume_down
+                        : Icons.volume_up,
+                    label: "Volume",
+                    onPressed: _openVolumeSheet,
+                  ),
                   _buildControlButton(
                     icon: _showDanmaku ? Icons.subtitles : Icons.subtitles_off,
                     label: _showDanmaku ? "Danmaku On" : "Danmaku Off",

frontend/lib/pages/settings_page.dart

@@ -11,7 +11,7 @@ class SettingsPage extends StatefulWidget {
   const SettingsPage({super.key});
 
   @override
-  _SettingsPageState createState() => _SettingsPageState();
+  State<SettingsPage> createState() => _SettingsPageState();
 }
 
 class _SettingsPageState extends State<SettingsPage> {
@@ -88,6 +88,32 @@ class _SettingsPageState extends State<SettingsPage> {
     }
   }
 
+  Future<void> _confirmLogout(AuthProvider auth) async {
+    final confirmed = await showDialog<bool>(
+      context: context,
+      builder: (context) {
+        return AlertDialog(
+          title: const Text("Confirm Logout"),
+          content: const Text("Are you sure you want to log out now?"),
+          actions: [
+            TextButton(
+              onPressed: () => Navigator.pop(context, false),
+              child: const Text("Cancel"),
+            ),
+            FilledButton(
+              onPressed: () => Navigator.pop(context, true),
+              child: const Text("Logout"),
+            ),
+          ],
+        );
+      },
+    );
+
+    if (confirmed == true && mounted) {
+      await auth.logout();
+    }
+  }
+
   @override
   Widget build(BuildContext context) {
     final auth = context.watch<AuthProvider>();
@@ -221,6 +247,18 @@ class _SettingsPageState extends State<SettingsPage> {
                 );
               }).toList(),
             ),
+            const SizedBox(height: 32),
+            _buildSectionTitle("Explore"),
+            const SizedBox(height: 8),
+            SwitchListTile.adaptive(
+              contentPadding: EdgeInsets.zero,
+              title: const Text("Live Preview Thumbnails"),
+              subtitle: const Text(
+                "Show cached snapshot covers for live rooms when available.",
+              ),
+              value: settings.livePreviewThumbnailsEnabled,
+              onChanged: settings.setLivePreviewThumbnailsEnabled,
+            ),
             if (isAuthenticated) ...[
               const SizedBox(height: 32),
               _buildSectionTitle("Security"),
@@ -266,7 +304,7 @@ class _SettingsPageState extends State<SettingsPage> {
               SizedBox(
                 width: double.infinity,
                 child: FilledButton.tonalIcon(
-                  onPressed: auth.logout,
+                  onPressed: () => _confirmLogout(auth),
                   icon: const Icon(Icons.logout),
                   label: const Text("Logout"),
                   style: FilledButton.styleFrom(
@@ -307,11 +345,11 @@ class _SettingsPageState extends State<SettingsPage> {
                     style: TextStyle(fontSize: 20, fontWeight: FontWeight.bold),
                   ),
                   Text(
-                    "Version: 1.0.0-beta3.5",
+                    "Version: 1.0.0-beta4.1",
                     style: TextStyle(color: Colors.grey),
                   ),
                   Text(
-                    "Author: Highground-Soft & Minimax",
+                    "Author: Highground-Soft",
                     style: TextStyle(color: Colors.grey),
                   ),
                   SizedBox(height: 20),

frontend/lib/providers/settings_provider.dart

@@ -12,10 +12,12 @@ class SettingsProvider with ChangeNotifier {
   String _baseUrl = _defaultUrl;
   Color _themeColor = Colors.blue;
   ThemeMode _themeMode = ThemeMode.system;
+  bool _livePreviewThumbnailsEnabled = false;
 
   String get baseUrl => _baseUrl;
   Color get themeColor => _themeColor;
   ThemeMode get themeMode => _themeMode;
+  bool get livePreviewThumbnailsEnabled => _livePreviewThumbnailsEnabled;
 
   SettingsProvider() {
     _loadSettings();
@@ -32,6 +34,8 @@ class SettingsProvider with ChangeNotifier {
     if (savedThemeMode != null) {
       _themeMode = _themeModeFromString(savedThemeMode);
     }
+    _livePreviewThumbnailsEnabled =
+        prefs.getBool('livePreviewThumbnailsEnabled') ?? false;
     notifyListeners();
   }
 
@@ -56,19 +60,50 @@ class SettingsProvider with ChangeNotifier {
     notifyListeners();
   }
 
+  void setLivePreviewThumbnailsEnabled(bool enabled) async {
+    _livePreviewThumbnailsEnabled = enabled;
+    final prefs = await SharedPreferences.getInstance();
+    await prefs.setBool('livePreviewThumbnailsEnabled', enabled);
+    notifyListeners();
+  }
+
   // Also provide the RTMP URL based on the same hostname
   String get rtmpUrl {
     final uri = Uri.parse(_baseUrl);
     return "rtmp://${uri.host}:1935/live";
   }
 
-  String playbackUrl(String roomId) {
+  String playbackUrl(String roomId, {String? quality}) {
     final uri = Uri.parse(_baseUrl);
+    final normalizedQuality = quality?.trim().toLowerCase();
+
     if (kIsWeb) {
-      return uri.replace(path: '/live/$roomId').toString();
+      return uri
+          .replace(
+            path: '/live/$roomId',
+            queryParameters:
+                normalizedQuality == null || normalizedQuality.isEmpty
+                ? null
+                : {'quality': normalizedQuality},
+          )
+          .toString();
     }
+
+    if (normalizedQuality == null || normalizedQuality.isEmpty) {
       return "$rtmpUrl/$roomId";
     }
+    return "$rtmpUrl/$roomId/$normalizedQuality";
+  }
+
+  String thumbnailUrl(String roomId, {String? cacheBuster}) {
+    final uri = Uri.parse(_baseUrl);
+    return uri
+        .replace(
+          path: '/api/rooms/$roomId/thumbnail',
+          queryParameters: cacheBuster == null ? null : {'t': cacheBuster},
+        )
+        .toString();
+  }
 
   ThemeMode _themeModeFromString(String value) {
     switch (value) {

frontend/lib/services/api_service.dart

@@ -43,11 +43,24 @@ class ApiService {
     );
   }
 
-  Future<http.Response> changePassword(String oldPassword, String newPassword) async {
+  Future<http.Response> getPlaybackOptions(String roomId) async {
+    return await http.get(
+      Uri.parse("${settings.baseUrl}/api/rooms/$roomId/playback-options"),
+      headers: _headers,
+    );
+  }
+
+  Future<http.Response> changePassword(
+    String oldPassword,
+    String newPassword,
+  ) async {
     return await http.post(
       Uri.parse("${settings.baseUrl}/api/user/change-password"),
       headers: _headers,
-      body: jsonEncode({"old_password": oldPassword, "new_password": newPassword}),
+      body: jsonEncode({
+        "old_password": oldPassword,
+        "new_password": newPassword,
+      }),
     );
   }
 }

frontend/lib/widgets/android_quick_stream_panel.dart

@@ -0,0 +1,470 @@
+import 'dart:async';
+
+import 'package:flutter/foundation.dart';
+import 'package:flutter/material.dart';
+import 'package:permission_handler/permission_handler.dart';
+import 'package:rtmp_streaming/camera.dart';
+
+class AndroidQuickStreamPanel extends StatefulWidget {
+  final String rtmpBaseUrl;
+  final String streamKey;
+
+  const AndroidQuickStreamPanel({
+    super.key,
+    required this.rtmpBaseUrl,
+    required this.streamKey,
+  });
+
+  @override
+  State<AndroidQuickStreamPanel> createState() =>
+      _AndroidQuickStreamPanelState();
+}
+
+class _AndroidQuickStreamPanelState extends State<AndroidQuickStreamPanel> {
+  final CameraController _controller = CameraController(
+    ResolutionPreset.medium,
+    enableAudio: true,
+    androidUseOpenGL: true,
+  );
+
+  List<CameraDescription> _cameras = const [];
+  CameraDescription? _currentCamera;
+  StreamStatistics? _stats;
+  Timer? _statsTimer;
+  bool _permissionsGranted = false;
+  bool _isPreparing = true;
+  bool _isBusy = false;
+  bool _audioEnabled = true;
+  String? _statusMessage;
+
+  String get _streamUrl => '${widget.rtmpBaseUrl}/${widget.streamKey}';
+
+  bool get _isInitialized => _controller.value.isInitialized ?? false;
+  bool get _isStreaming => _controller.value.isStreamingVideoRtmp ?? false;
+
+  @override
+  void initState() {
+    super.initState();
+    _controller.addListener(_onControllerChanged);
+    _initialize();
+  }
+
+  @override
+  void dispose() {
+    _statsTimer?.cancel();
+    _controller.removeListener(_onControllerChanged);
+    _controller.dispose();
+    super.dispose();
+  }
+
+  Future<void> _initialize() async {
+    if (!mounted) {
+      return;
+    }
+    setState(() {
+      _isPreparing = true;
+      _statusMessage = null;
+    });
+
+    final cameraStatus = await Permission.camera.request();
+    final micStatus = await Permission.microphone.request();
+    final granted = cameraStatus.isGranted && micStatus.isGranted;
+
+    if (!mounted) {
+      return;
+    }
+
+    if (!granted) {
+      setState(() {
+        _permissionsGranted = false;
+        _isPreparing = false;
+        _statusMessage =
+            'Camera and microphone permissions are required for quick streaming.';
+      });
+      return;
+    }
+
+    try {
+      final cameras = await availableCameras();
+      if (!mounted) {
+        return;
+      }
+      if (cameras.isEmpty) {
+        setState(() {
+          _permissionsGranted = true;
+          _isPreparing = false;
+          _statusMessage = 'No available cameras were found on this device.';
+        });
+        return;
+      }
+
+      _cameras = cameras;
+      _currentCamera = cameras.first;
+      await _controller.initialize(_currentCamera!);
+
+      if (!mounted) {
+        return;
+      }
+
+      setState(() {
+        _permissionsGranted = true;
+        _isPreparing = false;
+        _statusMessage = 'Ready to go live.';
+      });
+    } on CameraException catch (e) {
+      if (!mounted) {
+        return;
+      }
+      setState(() {
+        _permissionsGranted = true;
+        _isPreparing = false;
+        _statusMessage = e.description ?? e.code;
+      });
+    } catch (e) {
+      if (!mounted) {
+        return;
+      }
+      setState(() {
+        _permissionsGranted = true;
+        _isPreparing = false;
+        _statusMessage = 'Failed to initialize camera: $e';
+      });
+    }
+  }
+
+  void _onControllerChanged() {
+    if (!mounted) {
+      return;
+    }
+
+    final event = _controller.value.event;
+    final eventType = event is Map ? event['eventType']?.toString() : null;
+    if (eventType == 'rtmp_stopped' || eventType == 'camera_closing') {
+      _statsTimer?.cancel();
+      setState(() {
+        _statusMessage =
+            _controller.value.errorDescription ?? 'Streaming stopped.';
+      });
+      return;
+    }
+
+    if (eventType == 'error' || eventType == 'rtmp_retry') {
+      setState(() {
+        _statusMessage =
+            _controller.value.errorDescription ?? 'Streaming error occurred.';
+      });
+      return;
+    }
+
+    setState(() {});
+  }
+
+  Future<void> _startStreaming() async {
+    if (!_isInitialized || _isBusy) {
+      return;
+    }
+
+    setState(() {
+      _isBusy = true;
+      _statusMessage = 'Connecting to stream server...';
+    });
+
+    try {
+      await _controller.startVideoStreaming(_streamUrl, bitrate: 1500 * 1024);
+      if (_isStreaming && !_audioEnabled) {
+        await _controller.switchAudio(false);
+      }
+      _startStatsPolling();
+      if (!mounted) {
+        return;
+      }
+      setState(() => _statusMessage = 'Quick stream is live.');
+    } on CameraException catch (e) {
+      if (!mounted) {
+        return;
+      }
+      setState(() => _statusMessage = e.description ?? e.code);
+    } finally {
+      if (mounted) {
+        setState(() => _isBusy = false);
+      }
+    }
+  }
+
+  Future<void> _stopStreaming() async {
+    if (!_isStreaming || _isBusy) {
+      return;
+    }
+
+    setState(() => _isBusy = true);
+    try {
+      await _controller.stopVideoStreaming();
+      _statsTimer?.cancel();
+      if (!mounted) {
+        return;
+      }
+      setState(() {
+        _stats = null;
+        _statusMessage = 'Quick stream stopped.';
+      });
+    } on CameraException catch (e) {
+      if (!mounted) {
+        return;
+      }
+      setState(() => _statusMessage = e.description ?? e.code);
+    } finally {
+      if (mounted) {
+        setState(() => _isBusy = false);
+      }
+    }
+  }
+
+  Future<void> _switchCamera() async {
+    if (_cameras.length < 2 || !_isInitialized || _isBusy) {
+      return;
+    }
+
+    final currentIndex = _cameras.indexOf(_currentCamera!);
+    final nextCamera = _cameras[(currentIndex + 1) % _cameras.length];
+    final nextCameraName = nextCamera.name;
+    if (nextCameraName == null || nextCameraName.isEmpty) {
+      setState(
+        () => _statusMessage = 'Unable to switch camera on this device.',
+      );
+      return;
+    }
+
+    setState(() => _isBusy = true);
+    try {
+      await _controller.switchCamera(nextCameraName);
+      if (!mounted) {
+        return;
+      }
+      setState(() {
+        _currentCamera = nextCamera;
+        _statusMessage = 'Switched camera.';
+      });
+    } on CameraException catch (e) {
+      if (!mounted) {
+        return;
+      }
+      setState(() => _statusMessage = e.description ?? e.code);
+    } finally {
+      if (mounted) {
+        setState(() => _isBusy = false);
+      }
+    }
+  }
+
+  Future<void> _toggleAudio() async {
+    final nextAudioEnabled = !_audioEnabled;
+
+    if (!_isStreaming) {
+      setState(() {
+        _audioEnabled = nextAudioEnabled;
+        _statusMessage = nextAudioEnabled
+            ? 'Microphone will be enabled when streaming starts.'
+            : 'Microphone will be muted after streaming starts.';
+      });
+      return;
+    }
+
+    setState(() => _isBusy = true);
+    try {
+      await _controller.switchAudio(nextAudioEnabled);
+      if (!mounted) {
+        return;
+      }
+      setState(() {
+        _audioEnabled = nextAudioEnabled;
+        _statusMessage = nextAudioEnabled
+            ? 'Microphone enabled.'
+            : 'Microphone muted.';
+      });
+    } on CameraException catch (e) {
+      if (!mounted) {
+        return;
+      }
+      setState(() => _statusMessage = e.description ?? e.code);
+    } finally {
+      if (mounted) {
+        setState(() => _isBusy = false);
+      }
+    }
+  }
+
+  void _startStatsPolling() {
+    _statsTimer?.cancel();
+    _statsTimer = Timer.periodic(const Duration(seconds: 2), (_) async {
+      if (!_isStreaming) {
+        return;
+      }
+      try {
+        final stats = await _controller.getStreamStatistics();
+        if (!mounted) {
+          return;
+        }
+        setState(() => _stats = stats);
+      } catch (_) {
+        // Ignore transient stats failures while streaming starts up.
+      }
+    });
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    if (kIsWeb || defaultTargetPlatform != TargetPlatform.android) {
+      return const SizedBox.shrink();
+    }
+
+    return Card(
+      child: Padding(
+        padding: const EdgeInsets.all(16),
+        child: Column(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: [
+            Row(
+              children: [
+                Icon(
+                  Icons.rocket_launch,
+                  color: Theme.of(context).colorScheme.primary,
+                ),
+                const SizedBox(width: 10),
+                Text(
+                  'Quick Stream (Experimental)',
+                  style: Theme.of(context).textTheme.titleMedium?.copyWith(
+                    fontWeight: FontWeight.bold,
+                  ),
+                ),
+              ],
+            ),
+            const SizedBox(height: 8),
+            Text(
+              'Start streaming directly from your phone camera. For advanced scenes and overlays, continue using OBS.',
+              style: Theme.of(context).textTheme.bodySmall,
+            ),
+            const SizedBox(height: 16),
+            _buildPreview(context),
+            const SizedBox(height: 12),
+            _buildStatus(context),
+            const SizedBox(height: 12),
+            Wrap(
+              spacing: 10,
+              runSpacing: 10,
+              children: [
+                FilledButton.icon(
+                  onPressed: !_permissionsGranted || _isPreparing || _isBusy
+                      ? null
+                      : _isStreaming
+                      ? _stopStreaming
+                      : _startStreaming,
+                  icon: Icon(_isStreaming ? Icons.stop_circle : Icons.wifi),
+                  label: Text(_isStreaming ? 'Stop Stream' : 'Start Stream'),
+                ),
+                OutlinedButton.icon(
+                  onPressed: _cameras.length > 1 && !_isBusy && _isInitialized
+                      ? _switchCamera
+                      : null,
+                  icon: const Icon(Icons.cameraswitch),
+                  label: const Text('Switch Camera'),
+                ),
+                OutlinedButton.icon(
+                  onPressed: _isBusy || !_permissionsGranted
+                      ? null
+                      : _toggleAudio,
+                  icon: Icon(_audioEnabled ? Icons.mic : Icons.mic_off),
+                  label: Text(_audioEnabled ? 'Mic On' : 'Mic Off'),
+                ),
+                TextButton.icon(
+                  onPressed: _isBusy ? null : _initialize,
+                  icon: const Icon(Icons.refresh),
+                  label: const Text('Reinitialize'),
+                ),
+              ],
+            ),
+            const SizedBox(height: 12),
+            Text(
+              'Target: $_streamUrl',
+              style: Theme.of(context).textTheme.bodySmall,
+            ),
+            if (_stats != null) ...[
+              const SizedBox(height: 8),
+              Text(
+                'Stats: ${_stats!.width ?? '-'}x${_stats!.height ?? '-'}  |  ${_stats!.fps ?? '-'} fps  |  ${_formatKbps(_stats!.bitrate)}  |  dropped ${_stats!.droppedVideoFrames ?? 0} video',
+                style: Theme.of(context).textTheme.bodySmall,
+              ),
+            ],
+          ],
+        ),
+      ),
+    );
+  }
+
+  Widget _buildPreview(BuildContext context) {
+    return Container(
+      height: 220,
+      width: double.infinity,
+      decoration: BoxDecoration(
+        color: Colors.black,
+        borderRadius: BorderRadius.circular(16),
+      ),
+      clipBehavior: Clip.antiAlias,
+      child: _isPreparing
+          ? const Center(child: CircularProgressIndicator())
+          : !_permissionsGranted
+          ? _buildPreviewMessage('Grant camera and microphone permissions.')
+          : !_isInitialized
+          ? _buildPreviewMessage('Camera is not ready yet.')
+          : AspectRatio(
+              aspectRatio: _controller.value.aspectRatio,
+              child: CameraPreview(_controller),
+            ),
+    );
+  }
+
+  Widget _buildPreviewMessage(String text) {
+    return Center(
+      child: Padding(
+        padding: const EdgeInsets.all(20),
+        child: Text(
+          text,
+          style: const TextStyle(color: Colors.white70),
+          textAlign: TextAlign.center,
+        ),
+      ),
+    );
+  }
+
+  Widget _buildStatus(BuildContext context) {
+    final statusText =
+        _statusMessage ??
+        (_isStreaming ? 'Quick stream is live.' : 'Waiting for camera.');
+
+    return Container(
+      width: double.infinity,
+      padding: const EdgeInsets.all(12),
+      decoration: BoxDecoration(
+        color: Theme.of(context).colorScheme.surfaceContainerHighest,
+        borderRadius: BorderRadius.circular(12),
+      ),
+      child: Row(
+        children: [
+          Icon(
+            _isStreaming ? Icons.circle : Icons.info_outline,
+            size: _isStreaming ? 12 : 18,
+            color: _isStreaming ? Colors.red : null,
+          ),
+          const SizedBox(width: 10),
+          Expanded(child: Text(statusText)),
+        ],
+      ),
+    );
+  }
+
+  String _formatKbps(int? bitrate) {
+    if (bitrate == null || bitrate <= 0) {
+      return '- kbps';
+    }
+    return '${(bitrate / 1000).toStringAsFixed(0)} kbps';
+  }
+}

frontend/lib/widgets/web_stream_player_stub.dart

@@ -2,11 +2,13 @@ import 'package:flutter/material.dart';
 
 class WebStreamPlayer extends StatelessWidget {
   final String streamUrl;
+  final double volume;
   final int? refreshToken;
 
   const WebStreamPlayer({
     super.key,
     required this.streamUrl,
+    required this.volume,
     this.refreshToken,
   });
 

frontend/lib/widgets/web_stream_player_web.dart

@@ -1,3 +1,5 @@
+// ignore_for_file: avoid_web_libraries_in_flutter, deprecated_member_use
+
 import 'dart:html' as html;
 import 'dart:ui_web' as ui_web;
 
@@ -5,11 +7,13 @@ import 'package:flutter/material.dart';
 
 class WebStreamPlayer extends StatefulWidget {
   final String streamUrl;
+  final double volume;
   final int? refreshToken;
 
   const WebStreamPlayer({
     super.key,
     required this.streamUrl,
+    required this.volume,
     this.refreshToken,
   });
 
@@ -19,6 +23,7 @@ class WebStreamPlayer extends StatefulWidget {
 
 class _WebStreamPlayerState extends State<WebStreamPlayer> {
   late final String _viewType;
+  html.IFrameElement? _iframe;
 
   @override
   void initState() {
@@ -29,15 +34,30 @@ class _WebStreamPlayerState extends State<WebStreamPlayer> {
     ui_web.platformViewRegistry.registerViewFactory(_viewType, (int viewId) {
       final iframe = html.IFrameElement()
         ..src =
-            'flv_player.html?v=$cacheBuster&src=${Uri.encodeComponent(widget.streamUrl)}'
+            'flv_player.html?v=$cacheBuster'
+            '&src=${Uri.encodeComponent(widget.streamUrl)}'
+            '&volume=${widget.volume}'
         ..style.border = '0'
         ..style.width = '100%'
         ..style.height = '100%'
+        ..style.pointerEvents = 'none'
         ..allow = 'autoplay; fullscreen';
+      _iframe = iframe;
       return iframe;
     });
   }
 
+  @override
+  void didUpdateWidget(covariant WebStreamPlayer oldWidget) {
+    super.didUpdateWidget(oldWidget);
+    if (oldWidget.volume != widget.volume) {
+      _iframe?.contentWindow?.postMessage({
+        'type': 'setVolume',
+        'value': widget.volume,
+      }, '*');
+    }
+  }
+
   @override
   Widget build(BuildContext context) {
     return HtmlElementView(viewType: _viewType);

frontend/pubspec.lock

@@ -368,6 +368,54 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "2.3.0"
+  permission_handler:
+    dependency: "direct main"
+    description:
+      name: permission_handler
+      sha256: bc917da36261b00137bbc8896bf1482169cd76f866282368948f032c8c1caae1
+      url: "https://pub.dev"
+    source: hosted
+    version: "12.0.1"
+  permission_handler_android:
+    dependency: transitive
+    description:
+      name: permission_handler_android
+      sha256: "1e3bc410ca1bf84662104b100eb126e066cb55791b7451307f9708d4007350e6"
+      url: "https://pub.dev"
+    source: hosted
+    version: "13.0.1"
+  permission_handler_apple:
+    dependency: transitive
+    description:
+      name: permission_handler_apple
+      sha256: f000131e755c54cf4d84a5d8bd6e4149e262cc31c5a8b1d698de1ac85fa41023
+      url: "https://pub.dev"
+    source: hosted
+    version: "9.4.7"
+  permission_handler_html:
+    dependency: transitive
+    description:
+      name: permission_handler_html
+      sha256: "38f000e83355abb3392140f6bc3030660cfaef189e1f87824facb76300b4ff24"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.3+5"
+  permission_handler_platform_interface:
+    dependency: transitive
+    description:
+      name: permission_handler_platform_interface
+      sha256: eb99b295153abce5d683cac8c02e22faab63e50679b937fa1bf67d58bb282878
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.3.0"
+  permission_handler_windows:
+    dependency: transitive
+    description:
+      name: permission_handler_windows
+      sha256: "1a790728016f79a41216d88672dbc5df30e686e811ad4e698bfc51f76ad91f1e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.2.1"
   petitparser:
     dependency: transitive
     description:
@@ -416,6 +464,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "2.2.0"
+  rtmp_streaming:
+    dependency: "direct main"
+    description:
+      name: rtmp_streaming
+      sha256: f54c0c0443df65086d2936b0f3432fbb351fc35bffba69aa2b004ee7ecf45d40
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.5"
   shared_preferences:
     dependency: "direct main"
     description:

frontend/pubspec.yaml

@@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 1.0.0-beta4.1
+version: 1.0.0-beta4.7
 
 environment:
   sdk: ^3.11.1
@@ -40,6 +40,8 @@ dependencies:
   video_player: ^2.11.1
   fvp: ^0.35.2
   web_socket_channel: ^3.0.3
+  permission_handler: ^12.0.1
+  rtmp_streaming: ^1.0.5
 
 dev_dependencies:
   flutter_test:

frontend/web/flv_player.html

@@ -45,14 +45,21 @@
   <script src="flv.min.js"></script>
 </head>
 <body>
-  <video id="player" controls autoplay muted playsinline></video>
+  <video id="player" autoplay muted playsinline></video>
   <div id="message">Loading live stream...</div>
   <script>
     const params = new URLSearchParams(window.location.search);
     const streamUrl = params.get('src');
+    const initialVolume = Number.parseFloat(params.get('volume') || '1');
     const video = document.getElementById('player');
     const message = document.getElementById('message');
 
+    function applyVolume(value) {
+      const normalized = Number.isFinite(value) ? Math.max(0, Math.min(1, value)) : 1;
+      video.volume = normalized;
+      video.muted = normalized === 0;
+    }
+
     function showMessage(text) {
       video.style.display = 'none';
       message.style.display = 'flex';
@@ -66,6 +73,8 @@
     } else if (!flvjs.isSupported()) {
       showMessage('This browser does not support FLV playback.');
     } else {
+      applyVolume(initialVolume);
+
       const player = flvjs.createPlayer({
         type: 'flv',
         url: streamUrl,
@@ -90,6 +99,13 @@
       video.style.display = 'block';
       message.style.display = 'none';
 
+      window.addEventListener('message', function(event) {
+        const data = event.data || {};
+        if (data.type === 'setVolume') {
+          applyVolume(Number(data.value));
+        }
+      });
+
       window.addEventListener('beforeunload', function() {
         player.destroy();
       });