From 8c599129182be6597c79771f423380a92f44ffa0 Mon Sep 17 00:00:00 2001
From: seizeh <d57cd64frp@privaterelay.appleid.com>
Date: Fri, 24 Jul 2026 14:53:22 +0900
Subject: [PATCH] =?UTF-8?q?feat:=20=EC=98=81=EC=83=81=20=EC=B2=A8=EB=B6=80?=
 =?UTF-8?q?=20=EC=84=9C=EB=B2=84=20=E2=80=94=20=EA=B2=8C=EC=8B=9C=EA=B8=80?=
 =?UTF-8?q?(=EC=9E=90=EC=9C=A0=C2=B7=EC=86=8C=EC=8B=9D)=C2=B7=EC=8B=9C?=
 =?UTF-8?q?=EC=84=A4=20=ED=9B=84=EA=B8=B0=C2=B7=EC=B1=84=ED=8C=85?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- posts: 영상 100MB/사진 12MB 크기 CHECK 분리 + 영상은 free·news 만
  (posts_video_category_check — 사진 인증 카테고리 제외), create_post_verified/
  update_my_post 에 p_image_thumb_url(포스터) 추가(구 시그니처 drop),
  update 미디어 편집 허용 카테고리에 news 포함(비일관 정정)
- chat_messages: 영상 100MB CHECK, 미리보기·알림 본문 [동영상]
  (insert 트리거·delete_my_chat_message)
- facility_reviews: videos jsonb(최대 2, url 필수 검증) + add_facility_review
  7인자(구 6인자 drop), 조회 RPC 2종 반환 컬럼 확장(drop 재생성)
- share-view: 후기 영상 타일 poster+<video> 렌더(v11 배포)
- pgTAP t14(12단언) — 전 스위트 운영 통과, 스냅샷 갱신

마이그레이션 운영 적용·기록 완료(media_video). 신규 인자 전부 default 라
배포된 구버전 앱 호환 유지.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 supabase/functions/share-view/index.ts        |  13 +-
 .../migrations/20260724180000_media_video.sql | 511 ++++++++++++++++++
 supabase/schema/schema.sql                    | 115 ++--
 supabase/tests/t14_media_video_test.sql       | 133 +++++
 4 files changed, 731 insertions(+), 41 deletions(-)
 create mode 100644 supabase/migrations/20260724180000_media_video.sql
 create mode 100644 supabase/tests/t14_media_video_test.sql

diff --git a/supabase/functions/share-view/index.ts b/supabase/functions/share-view/index.ts
index 4fae969..eb8e916 100644
--- a/supabase/functions/share-view/index.ts
+++ b/supabase/functions/share-view/index.ts
@@ -117,7 +117,7 @@ function page(title: string, ogDesc: string, inner: string): string {
   .rgrid { display:grid; grid-template-columns:1fr 1fr; gap:8px; margin:10px 20px 0; }
   .rtile { position:relative; aspect-ratio:1/1; border-radius:14px; overflow:hidden;
            border:.5px solid var(--border); background:var(--surface); }
-  .rtile > img { position:absolute; inset:0; width:100%; height:100%; object-fit:cover; }
+  .rtile > img, .rtile > video { position:absolute; inset:0; width:100%; height:100%; object-fit:cover; }
   .rtile .tscrim { position:absolute; left:0; right:0; bottom:0; height:56px;
     background:linear-gradient(transparent, rgba(0,0,0,.4)); }
   /* 사진 없는 후기 — 앱 블롭 배경의 정적 재현(프라이머리 톤 원형 그라데이션) */
@@ -351,12 +351,23 @@ Deno.serve(async (req) => {
     content: string | null;
     has_incentive?: boolean;
     photo_urls?: string[];
+    videos?: Array<{ url?: string; thumb_url?: string }>;
   }> = data.reviews ?? [];
   const starBar = (n: number) =>
     `<span class="star">★</span>${Math.max(0, Math.min(5, Math.round(n)))}`;
   const tiles = reviews.map((r) => {
     const photo = (r.photo_urls ?? [])[0];
+    const video = (r.videos ?? [])[0];
     const badge = r.has_incentive ? `<div class="badges"><span class="badge">업체 혜택</span></div>` : "";
+    // 영상 후기 — 포스터 + 탭 재생(<video controls>, 외부 리소스 없음)
+    if (video?.url) {
+      return `<div class="rtile hasimg">
+        <video controls playsinline preload="none"
+          ${video.thumb_url ? `poster="${esc(String(video.thumb_url))}"` : ""}
+          src="${esc(String(video.url))}"></video>
+        ${badge}<div class="rate">${starBar(Number(r.rating))}</div>
+      </div>`;
+    }
     if (photo) {
       return `<div class="rtile hasimg">
         <img src="${esc(String(photo))}" alt="" loading="lazy"><div class="tscrim"></div>
diff --git a/supabase/migrations/20260724180000_media_video.sql b/supabase/migrations/20260724180000_media_video.sql
new file mode 100644
index 0000000..0da470c
--- /dev/null
+++ b/supabase/migrations/20260724180000_media_video.sql
@@ -0,0 +1,511 @@
+-- ============================================================================
+-- 영상 첨부 — 게시글(자유·소식) · 시설 후기 · 채팅
+--
+-- 표현 방식:
+--  · posts/chat_messages: 기존 단일 미디어 슬롯 재사용 — image_url 에 영상 URL,
+--    image_mime_type 'video/*', image_thumbnail_url 에 포스터(썸네일). 별도
+--    컬럼 없음(피드·버블은 포스터를 그리고 재생은 상세/탭에서).
+--  · facility_reviews: videos jsonb [{url, thumb_url, path?, ...}] 최대 2개
+--    (사진 5장과 별도). 뷰어(share-view)는 poster+<video> 로 렌더.
+--  · 크기 상한: 영상 100MB(사진 상한은 기존 유지 — posts 12MB, chat 10MB).
+--    길이 제한(60초)·압축은 클라이언트 책임. media 버킷은 제한 없음(공개).
+--  · 영상 게시글은 자유(free)·소식(news) 카테고리만 — 사진 인증 카테고리
+--    (산책·돌봄·분양)는 실존 검증 파이프라인이 사진 전제라 제외(CHECK 강제,
+--    원칙: 불변식은 DB 로).
+-- ============================================================================
+
+-- (1) posts — 영상 크기 상한 분리 + 영상 카테고리 제한
+alter table public.posts drop constraint posts_image_file_size_check;
+alter table public.posts add constraint posts_image_file_size_check
+  check (image_file_size is null or image_file_size <=
+         case when image_mime_type like 'video/%'
+              then 104857600 else 12582912 end);
+alter table public.posts add constraint posts_video_category_check
+  check (image_mime_type is null
+         or image_mime_type not like 'video/%'
+         or category in ('free', 'news'));
+
+-- (2) create_post_verified — p_image_thumb_url 추가(영상 포스터).
+--     시그니처 변경이므로 구버전 drop 필수(오버로드 섀도잉).
+drop function public.create_post_verified(
+  character varying, character varying, text, timestamptz, uuid[],
+  text, character varying, integer, uuid, double precision, double precision,
+  character varying);
+create function public.create_post_verified(
+  p_category character varying,
+  p_title character varying,
+  p_content text,
+  p_scheduled_at timestamp with time zone,
+  p_pet_ids uuid[],
+  p_image_url text,
+  p_image_mime character varying,
+  p_image_size integer,
+  p_photo_token uuid default null,
+  p_actual_lat double precision default null,
+  p_actual_lng double precision default null,
+  p_region_code character varying default null,
+  p_image_thumb_url text default null
+) returns uuid
+language plpgsql
+security definer
+set search_path to ''
+as $$
+declare
+  v_uid  uuid := app.uid();
+  v_post uuid;
+  v_pv   public.photo_verifications%rowtype;
+  v_all_trusted boolean := false;
+  v_user record;
+begin
+  if v_uid is null then
+    raise exception 'posts: 로그인이 필요합니다';
+  end if;
+
+  -- 동네 인증 게이트 — 업체 모드(소식 전용)는 사업장 주소 기준이라 생략
+  -- (승인 여부·지역 스탬프는 tg_posts_set_region 트리거가 강제).
+  select region_code, is_location_verified, last_verified_at, active_mode
+    into v_user
+    from public.users where id = v_uid;
+  if v_user.active_mode is distinct from 'business' then
+    if v_user.region_code is null
+       or not coalesce(v_user.is_location_verified, false)
+       or v_user.last_verified_at is null
+       or v_user.last_verified_at < now() - interval '30 days' then
+      raise exception 'posts: 동네 인증 후 게시글을 작성할 수 있어요';
+    end if;
+  end if;
+
+  if p_category in ('walk_together','walk_proxy','care','give_away') then
+    v_all_trusted := p_pet_ids is not null
+                 and array_length(p_pet_ids, 1) >= 1
+                 and not exists (
+                       select 1 from public.pets
+                        where id = any(p_pet_ids) and trust_score < 3);
+
+    if v_all_trusted then
+      perform set_config('app.photo_trusted', 'true', true);
+    else
+      -- 미인증 펫 포함 → 사진 검증 필수. 촬영 대상은 연결 펫 중 아무나
+      -- (한 마리 통과로 충분 — 인증된 펫을 촬영해도 된다).
+      select * into v_pv from public.photo_verifications where id = p_photo_token;
+      if not found or v_pv.pet_id is null then
+        raise exception 'posts: 사진 검증 정보가 올바르지 않습니다';
+      end if;
+      if p_pet_ids is null or not (v_pv.pet_id = any(p_pet_ids)) then
+        raise exception 'posts: 촬영한 반려동물이 게시글에 연결한 반려동물과 다릅니다';
+      end if;
+    end if;
+  end if;
+
+  perform set_config('app.photo_token', coalesce(p_photo_token::text, ''), true);
+
+  insert into public.posts (
+    user_id, category, title, content, scheduled_at,
+    image_url, image_mime_type, image_file_size, image_thumbnail_url,
+    actual_lat, actual_lng, region_code
+  ) values (
+    v_uid, p_category, p_title, p_content, p_scheduled_at,
+    p_image_url, p_image_mime, p_image_size, p_image_thumb_url,
+    p_actual_lat, p_actual_lng, p_region_code
+  ) returning id into v_post;
+
+  if p_pet_ids is not null and array_length(p_pet_ids, 1) >= 1 then
+    insert into public.post_pets (post_id, pet_id)
+      select v_post, unnest(p_pet_ids);
+  end if;
+
+  if v_pv.id is not null and v_pv.ai_matched then
+    update public.pets set pet_match_count = pet_match_count + 1
+     where id = v_pv.pet_id;
+  end if;
+
+  return v_post;
+end;
+$$;
+revoke all on function public.create_post_verified(
+  character varying, character varying, text, timestamptz, uuid[],
+  text, character varying, integer, uuid, double precision, double precision,
+  character varying, text) from public;
+grant execute on function public.create_post_verified(
+  character varying, character varying, text, timestamptz, uuid[],
+  text, character varying, integer, uuid, double precision, double precision,
+  character varying, text) to authenticated, service_role;
+
+-- (3) update_my_post — 썸네일 인자 + 미디어 편집 허용 카테고리에 news 포함
+--     (기존 free/adoption 만이던 것은 소식 이미지 편집 불가라는 비일관 — 정정).
+drop function public.update_my_post(uuid, text, text, timestamptz, text,
+  character varying, integer, boolean);
+create function public.update_my_post(
+  p_post uuid,
+  p_title text,
+  p_content text,
+  p_scheduled_at timestamp with time zone default null,
+  p_image_url text default null,
+  p_image_mime character varying default null,
+  p_image_size integer default null,
+  p_edit_image boolean default false,
+  p_image_thumb_url text default null
+) returns void
+language plpgsql
+security definer
+set search_path to ''
+as $$
+declare
+  v_uid uuid := app.uid();
+  v_owner uuid;
+  v_old_sched timestamptz;
+  v_cat text;
+begin
+  if v_uid is null then
+    raise exception 'not_authenticated';
+  end if;
+  if coalesce(btrim(p_title), '') = '' or coalesce(btrim(p_content), '') = '' then
+    raise exception 'posts: 제목과 내용을 입력해주세요';
+  end if;
+
+  select user_id, scheduled_at, category into v_owner, v_old_sched, v_cat
+  from public.posts where id = p_post for update;
+  if v_owner is null then raise exception 'post_not_found'; end if;
+  if v_owner <> v_uid then raise exception 'not_owner'; end if;
+
+  update public.posts set
+    title = btrim(p_title),
+    content = btrim(p_content),
+    scheduled_at = p_scheduled_at,
+    edited_at = now(),
+    image_url = case
+      when p_edit_image and v_cat in ('free', 'adoption', 'news') then p_image_url
+      else image_url end,
+    image_mime_type = case
+      when p_edit_image and v_cat in ('free', 'adoption', 'news') then p_image_mime
+      else image_mime_type end,
+    image_file_size = case
+      when p_edit_image and v_cat in ('free', 'adoption', 'news') then p_image_size
+      else image_file_size end,
+    image_thumbnail_url = case
+      when p_edit_image and v_cat in ('free', 'adoption', 'news') then p_image_thumb_url
+      else image_thumbnail_url end
+  where id = p_post;
+
+  if v_old_sched is distinct from p_scheduled_at and p_scheduled_at is not null then
+    insert into public.notifications(
+      user_id, actor_user_id, notification_type, title, body, resource_type, resource_id
+    )
+    select a.applicant_id, v_uid, 'schedule_changed', '약속 일정이 변경됐어요',
+           btrim(p_title) || ' — '
+             || to_char(p_scheduled_at at time zone 'Asia/Seoul', 'MM월 DD일 HH24시') || ' 로 변경',
+           'post', p_post
+    from public.applications a
+    where a.post_id = p_post and a.status in ('pending', 'accepted');
+  end if;
+end $$;
+revoke all on function public.update_my_post(uuid, text, text, timestamptz, text,
+  character varying, integer, boolean, text) from public;
+grant execute on function public.update_my_post(uuid, text, text, timestamptz, text,
+  character varying, integer, boolean, text) to authenticated, service_role;
+
+-- (4) chat_messages — 영상 크기 상한 분리
+alter table public.chat_messages drop constraint chat_messages_image_file_size_check;
+alter table public.chat_messages add constraint chat_messages_image_file_size_check
+  check (image_file_size is null or image_file_size <=
+         case when image_mime_type like 'video/%'
+              then 104857600 else 10485760 end);
+
+-- (5) 채팅 미리보기·알림 본문 — 영상은 [동영상]
+create or replace function app.tg_chat_messages_after_insert()
+returns trigger
+language plpgsql security definer
+set search_path to ''
+as $$
+declare v_preview text;
+begin
+  if new.content is not null then v_preview := left(new.content, 100);
+  elsif new.image_mime_type like 'video/%' then v_preview := '[동영상]';
+  else v_preview := '[사진]'; end if;
+
+  update public.chat_rooms
+     set last_message_id = new.id, last_message_at = new.created_at, last_message_preview = v_preview
+   where id = new.room_id;
+
+  update public.users u
+     set unread_chat_count = unread_chat_count + 1
+    from public.chat_room_members m
+   where m.room_id = new.room_id and m.user_id = u.id and m.user_id <> new.sender_id;
+
+  insert into public.notifications(
+    user_id, actor_user_id, notification_type, title, body, resource_type, resource_id
+  )
+  select m.user_id, new.sender_id, 'chat_message',
+         coalesce(su.nickname, '새 메시지'), v_preview, 'chat_room', new.room_id
+    from public.chat_room_members m
+    left join public.users su on su.id = new.sender_id
+   where m.room_id = new.room_id and m.user_id <> new.sender_id;
+
+  return new;
+end;
+$$;
+
+create or replace function public.delete_my_chat_message(p_message uuid)
+returns void
+language plpgsql security definer
+set search_path to ''
+as $$
+declare
+  v_uid uuid := app.uid();
+  v_msg public.chat_messages%rowtype;
+  v_next_id uuid;
+  v_next_at timestamptz;
+  v_next_preview text;
+begin
+  if v_uid is null then raise exception 'chat: 로그인이 필요합니다'; end if;
+
+  select * into v_msg from public.chat_messages where id = p_message;
+  if not found or v_msg.sender_id <> v_uid then
+    raise exception 'chat: 내가 보낸 메시지만 삭제할 수 있어요';
+  end if;
+  if v_msg.is_deleted then return; end if;
+
+  update public.chat_messages set is_deleted = true where id = p_message;
+
+  update public.users u
+     set unread_chat_count = greatest(u.unread_chat_count - 1, 0)
+    from public.chat_room_members m
+   where m.room_id = v_msg.room_id
+     and m.user_id = u.id
+     and m.user_id <> v_uid
+     and (m.last_read_message_id is null
+          or v_msg.created_at > (select lr.created_at
+                                   from public.chat_messages lr
+                                  where lr.id = m.last_read_message_id));
+
+  if (select last_message_id from public.chat_rooms where id = v_msg.room_id)
+     = p_message then
+    select m.id, m.created_at,
+           case when m.content is not null then left(m.content, 100)
+                when m.image_mime_type like 'video/%' then '[동영상]'
+                else '[사진]' end
+      into v_next_id, v_next_at, v_next_preview
+      from public.chat_messages m
+     where m.room_id = v_msg.room_id and m.is_deleted = false
+     order by m.created_at desc limit 1;
+    update public.chat_rooms
+       set last_message_id = v_next_id,
+           last_message_at = coalesce(v_next_at, last_message_at),
+           last_message_preview = coalesce(v_next_preview, '삭제된 메시지')
+     where id = v_msg.room_id;
+  end if;
+end;
+$$;
+
+-- (6) 시설 후기 — videos jsonb [{url, thumb_url, ...}] 최대 2개
+alter table public.facility_reviews
+  add column videos jsonb not null default '[]';
+alter table public.facility_reviews add constraint facility_reviews_videos_check
+  check (jsonb_typeof(videos) = 'array' and jsonb_array_length(videos) <= 2);
+
+-- (7) add_facility_review — p_videos 추가(시그니처 변경 — 구 6인자 drop)
+drop function public.add_facility_review(uuid, smallint, text, text[], text[], boolean);
+create function public.add_facility_review(
+  p_facility uuid,
+  p_rating smallint,
+  p_body text,
+  p_paths text[] default '{}',
+  p_urls text[] default '{}',
+  p_has_incentive boolean default false,
+  p_videos jsonb default '[]'
+) returns uuid
+language plpgsql security definer
+set search_path to ''
+as $$
+declare
+  v_uid uuid := app.uid();
+  v_id uuid;
+  v jsonb;
+begin
+  if v_uid is null then raise exception 'auth required'; end if;
+  if p_rating < 1 or p_rating > 5 then raise exception 'rating 1..5'; end if;
+  if exists (
+    select 1 from public.business_profiles bp
+     where bp.user_id = v_uid
+       and bp.status in ('pending', 'approved')
+       and bp.matched_facility_id = any(public.facility_sibling_ids(p_facility))
+  ) then
+    raise exception 'own_facility' using errcode = 'P0001';
+  end if;
+  -- 영상 검증 — 배열·개수는 CHECK 가 재검증하지만, 원소 형태는 여기서 명시 거부.
+  if jsonb_typeof(coalesce(p_videos, '[]'::jsonb)) is distinct from 'array'
+     or jsonb_array_length(coalesce(p_videos, '[]'::jsonb)) > 2 then
+    raise exception 'invalid_videos' using errcode = 'P0001';
+  end if;
+  for v in select value from jsonb_array_elements(coalesce(p_videos, '[]'::jsonb))
+  loop
+    if jsonb_typeof(v) is distinct from 'object'
+       or coalesce(v->>'url', '') = '' or length(v->>'url') > 500 then
+      raise exception 'invalid_videos' using errcode = 'P0001';
+    end if;
+  end loop;
+  insert into public.facility_reviews
+    (facility_id, user_id, rating, content, photo_paths, photo_urls,
+     has_incentive, videos)
+  values (p_facility, v_uid, p_rating, p_body,
+          coalesce(p_paths,'{}'), coalesce(p_urls,'{}'),
+          coalesce(p_has_incentive, false), coalesce(p_videos, '[]'::jsonb))
+  returning id into v_id;
+  return v_id;
+end $$;
+revoke all on function public.add_facility_review(uuid, smallint, text, text[], text[], boolean, jsonb) from public;
+grant execute on function public.add_facility_review(uuid, smallint, text, text[], text[], boolean, jsonb) to authenticated, service_role;
+
+-- (8) 후기 조회 RPC — videos 반환 컬럼 추가(반환 타입 변경 — drop 필수)
+drop function public.facility_reviews_of(uuid, integer, integer);
+create function public.facility_reviews_of(
+  p_facility uuid, p_limit integer default 20, p_offset integer default 0
+) returns table (
+  id uuid, user_id uuid, author_nickname text, rating smallint, content text,
+  photo_urls text[], created_at timestamptz, is_mine boolean, visit_no integer,
+  has_incentive boolean, videos jsonb
+)
+language sql stable security definer
+set search_path to ''
+as $$
+  select r.id, r.user_id, pr.nickname, r.rating, r.content, r.photo_urls, r.created_at,
+         (r.user_id = app.uid()) as is_mine, r.visit_no, r.has_incentive, r.videos
+    from (
+      select fr.*,
+             row_number() over (
+               partition by fr.user_id order by fr.created_at
+             )::int as visit_no
+        from public.facility_reviews fr
+       where fr.facility_id = any(public.facility_sibling_ids(p_facility))
+         and fr.visibility_status = 'visible'
+    ) r
+    left join public.public_profiles pr on pr.id = r.user_id
+   order by r.created_at desc
+   limit least(p_limit, 50) offset p_offset;
+$$;
+revoke all on function public.facility_reviews_of(uuid, integer, integer) from public;
+grant execute on function public.facility_reviews_of(uuid, integer, integer) to authenticated, service_role;
+
+drop function public.facility_review_by_id(uuid);
+create function public.facility_review_by_id(p_review uuid)
+returns table (
+  id uuid, user_id uuid, author_nickname text, rating smallint, content text,
+  photo_urls text[], created_at timestamptz, is_mine boolean, visit_no integer,
+  has_incentive boolean, videos jsonb
+)
+language sql stable security definer
+set search_path to ''
+as $$
+  select r.id, r.user_id, pr.nickname, r.rating, r.content, r.photo_urls, r.created_at,
+         (r.user_id = app.uid()) as is_mine, r.visit_no, r.has_incentive, r.videos
+    from (
+      select fr.*,
+             row_number() over (
+               partition by fr.user_id order by fr.created_at
+             )::int as visit_no
+        from public.facility_reviews fr
+       where fr.facility_id = any(public.facility_sibling_ids(
+               (select facility_id from public.facility_reviews where id = p_review)))
+         and fr.visibility_status = 'visible'
+    ) r
+    left join public.public_profiles pr on pr.id = r.user_id
+   where r.id = p_review;
+$$;
+revoke all on function public.facility_review_by_id(uuid) from public;
+grant execute on function public.facility_review_by_id(uuid) to authenticated, service_role;
+
+-- (9) 공유 뷰어 — 후기 videos 노출(뷰어는 poster+<video> 렌더)
+create or replace function public.share_view_load(p_token varchar)
+returns jsonb
+language plpgsql
+security definer
+set search_path to 'public'
+as $function$
+declare
+  v_link app.share_links%rowtype;
+  v_out  jsonb;
+begin
+  select * into v_link from app.share_links where token = p_token;
+  if not found or v_link.revoked_at is not null then
+    return jsonb_build_object('status', 'not_found');
+  end if;
+  if v_link.expires_at < now() then
+    return jsonb_build_object('status', 'expired');
+  end if;
+
+  update app.share_links set view_count = view_count + 1 where token = p_token;
+  insert into app.funnel_events (event, token) values ('share_view', p_token);
+
+  if v_link.kind = 'facility_preview' then
+    select jsonb_build_object(
+      'status', 'ok', 'kind', v_link.kind,
+      'facility', jsonb_build_object(
+        'name', f.name, 'category', f.category, 'address', f.address,
+        'phone', f.phone, 'is_open', f.is_open,
+        'avg_rating', f.avg_rating, 'review_count', f.review_count,
+        'photo_url', bp.photo_url,
+        'photo_align_y', coalesce(bp.photo_align_y, 0),
+        'business_hours', bp.business_hours,
+        'owner_verified', coalesce(bp.verified, false)),
+      'reviews', coalesce((
+        select jsonb_agg(jsonb_build_object(
+                 'rating', r.rating, 'content', r.content,
+                 'has_incentive', r.has_incentive,
+                 'photo_urls', r.photos,
+                 'videos', r.videos)
+                 order by r.has_media desc, r.created_at desc)
+        from (select rating, content, has_incentive, created_at, videos,
+                     coalesce(array_length(photo_urls, 1), 0) > 0
+                       or jsonb_array_length(videos) > 0 as has_media,
+                     (select coalesce(jsonb_agg(u), '[]'::jsonb)
+                        from unnest(photo_urls[1:2]) u) as photos
+              from public.facility_reviews
+              where facility_id = f.id and visibility_status = 'visible'
+              order by coalesce(array_length(photo_urls, 1), 0) > 0
+                         or jsonb_array_length(videos) > 0 desc,
+                       created_at desc
+              limit 3) r), '[]'::jsonb))
+    into v_out
+    from public.facilities f
+    left join lateral (
+      select true as verified, b.photo_url, b.photo_align_y, b.business_hours
+        from public.business_profiles b
+       where b.status = 'approved'
+         and b.matched_facility_id = any(public.facility_sibling_ids(f.id))
+       order by b.reviewed_at nulls last
+       limit 1
+    ) bp on true
+    where f.id = v_link.ref_id;
+    return coalesce(v_out, jsonb_build_object('status', 'not_found'));
+  end if;
+
+  if v_link.kind = 'care_report' then
+    select jsonb_build_object(
+      'status', 'ok', 'kind', v_link.kind,
+      'report', jsonb_build_object(
+        'pet_label', r.pet_label, 'photos', r.photos, 'note', r.note,
+        'kind', r.kind, 'body', r.body, 'created_at', r.created_at,
+        'business_name', coalesce(b.storefront_name, b.business_name)))
+    into v_out
+    from app.care_reports r
+    left join public.business_profiles b on b.user_id = r.business_id
+    where r.id = v_link.ref_id;
+    return coalesce(v_out, jsonb_build_object('status', 'not_found'));
+  end if;
+
+  if v_link.kind = 'starter' then
+    select jsonb_build_object(
+      'status', 'ok', 'kind', v_link.kind,
+      'starter', jsonb_build_object(
+        'business_name', coalesce(b.storefront_name, b.business_name)))
+    into v_out
+    from public.business_profiles b
+    where b.user_id = v_link.ref_id and b.status = 'approved';
+    return coalesce(v_out, jsonb_build_object(
+      'status', 'ok', 'kind', v_link.kind,
+      'starter', jsonb_build_object('business_name', null)));
+  end if;
+
+  return jsonb_build_object('status', 'ok', 'kind', v_link.kind);
+end;
+$function$;
diff --git a/supabase/schema/schema.sql b/supabase/schema/schema.sql
index f1bbea0..1c83169 100644
--- a/supabase/schema/schema.sql
+++ b/supabase/schema/schema.sql
@@ -1154,6 +1154,7 @@ CREATE FUNCTION app.tg_chat_messages_after_insert() RETURNS trigger
 declare v_preview text;
 begin
   if new.content is not null then v_preview := left(new.content, 100);
+  elsif new.image_mime_type like 'video/%' then v_preview := '[동영상]';
   else v_preview := '[사진]'; end if;
 
   update public.chat_rooms
@@ -2326,14 +2327,17 @@ $$;
 
 
 --
--- Name: add_facility_review(uuid, smallint, text, text[], text[], boolean); Type: FUNCTION; Schema: public; Owner: -
+-- Name: add_facility_review(uuid, smallint, text, text[], text[], boolean, jsonb); Type: FUNCTION; Schema: public; Owner: -
 --
 
-CREATE FUNCTION public.add_facility_review(p_facility uuid, p_rating smallint, p_body text, p_paths text[] DEFAULT '{}'::text[], p_urls text[] DEFAULT '{}'::text[], p_has_incentive boolean DEFAULT false) RETURNS uuid
+CREATE FUNCTION public.add_facility_review(p_facility uuid, p_rating smallint, p_body text, p_paths text[] DEFAULT '{}'::text[], p_urls text[] DEFAULT '{}'::text[], p_has_incentive boolean DEFAULT false, p_videos jsonb DEFAULT '[]'::jsonb) RETURNS uuid
     LANGUAGE plpgsql SECURITY DEFINER
     SET search_path TO ''
     AS $$
-declare v_uid uuid := app.uid(); v_id uuid;
+declare
+  v_uid uuid := app.uid();
+  v_id uuid;
+  v jsonb;
 begin
   if v_uid is null then raise exception 'auth required'; end if;
   if p_rating < 1 or p_rating > 5 then raise exception 'rating 1..5'; end if;
@@ -2345,10 +2349,24 @@ begin
   ) then
     raise exception 'own_facility' using errcode = 'P0001';
   end if;
+  -- 영상 검증 — 배열·개수는 CHECK 가 재검증하지만, 원소 형태는 여기서 명시 거부.
+  if jsonb_typeof(coalesce(p_videos, '[]'::jsonb)) is distinct from 'array'
+     or jsonb_array_length(coalesce(p_videos, '[]'::jsonb)) > 2 then
+    raise exception 'invalid_videos' using errcode = 'P0001';
+  end if;
+  for v in select value from jsonb_array_elements(coalesce(p_videos, '[]'::jsonb))
+  loop
+    if jsonb_typeof(v) is distinct from 'object'
+       or coalesce(v->>'url', '') = '' or length(v->>'url') > 500 then
+      raise exception 'invalid_videos' using errcode = 'P0001';
+    end if;
+  end loop;
   insert into public.facility_reviews
-    (facility_id, user_id, rating, content, photo_paths, photo_urls, has_incentive)
+    (facility_id, user_id, rating, content, photo_paths, photo_urls,
+     has_incentive, videos)
   values (p_facility, v_uid, p_rating, p_body,
-          coalesce(p_paths,'{}'), coalesce(p_urls,'{}'), coalesce(p_has_incentive, false))
+          coalesce(p_paths,'{}'), coalesce(p_urls,'{}'),
+          coalesce(p_has_incentive, false), coalesce(p_videos, '[]'::jsonb))
   returning id into v_id;
   return v_id;
 end $$;
@@ -4024,10 +4042,10 @@ $$;
 
 
 --
--- Name: create_post_verified(character varying, character varying, text, timestamp with time zone, uuid[], text, character varying, integer, uuid, double precision, double precision, character varying); Type: FUNCTION; Schema: public; Owner: -
+-- Name: create_post_verified(character varying, character varying, text, timestamp with time zone, uuid[], text, character varying, integer, uuid, double precision, double precision, character varying, text); Type: FUNCTION; Schema: public; Owner: -
 --
 
-CREATE FUNCTION public.create_post_verified(p_category character varying, p_title character varying, p_content text, p_scheduled_at timestamp with time zone, p_pet_ids uuid[], p_image_url text, p_image_mime character varying, p_image_size integer, p_photo_token uuid DEFAULT NULL::uuid, p_actual_lat double precision DEFAULT NULL::double precision, p_actual_lng double precision DEFAULT NULL::double precision, p_region_code character varying DEFAULT NULL::character varying) RETURNS uuid
+CREATE FUNCTION public.create_post_verified(p_category character varying, p_title character varying, p_content text, p_scheduled_at timestamp with time zone, p_pet_ids uuid[], p_image_url text, p_image_mime character varying, p_image_size integer, p_photo_token uuid DEFAULT NULL::uuid, p_actual_lat double precision DEFAULT NULL::double precision, p_actual_lng double precision DEFAULT NULL::double precision, p_region_code character varying DEFAULT NULL::character varying, p_image_thumb_url text DEFAULT NULL::text) RETURNS uuid
     LANGUAGE plpgsql SECURITY DEFINER
     SET search_path TO ''
     AS $$
@@ -4082,11 +4100,11 @@ begin
 
   insert into public.posts (
     user_id, category, title, content, scheduled_at,
-    image_url, image_mime_type, image_file_size,
+    image_url, image_mime_type, image_file_size, image_thumbnail_url,
     actual_lat, actual_lng, region_code
   ) values (
     v_uid, p_category, p_title, p_content, p_scheduled_at,
-    p_image_url, p_image_mime, p_image_size,
+    p_image_url, p_image_mime, p_image_size, p_image_thumb_url,
     p_actual_lat, p_actual_lng, p_region_code
   ) returning id into v_post;
 
@@ -4164,6 +4182,7 @@ begin
      = p_message then
     select m.id, m.created_at,
            case when m.content is not null then left(m.content, 100)
+                when m.image_mime_type like 'video/%' then '[동영상]'
                 else '[사진]' end
       into v_next_id, v_next_at, v_next_preview
       from public.chat_messages m
@@ -4418,12 +4437,12 @@ $$;
 -- Name: facility_review_by_id(uuid); Type: FUNCTION; Schema: public; Owner: -
 --
 
-CREATE FUNCTION public.facility_review_by_id(p_review uuid) RETURNS TABLE(id uuid, user_id uuid, author_nickname text, rating smallint, content text, photo_urls text[], created_at timestamp with time zone, is_mine boolean, visit_no integer, has_incentive boolean)
+CREATE FUNCTION public.facility_review_by_id(p_review uuid) RETURNS TABLE(id uuid, user_id uuid, author_nickname text, rating smallint, content text, photo_urls text[], created_at timestamp with time zone, is_mine boolean, visit_no integer, has_incentive boolean, videos jsonb)
     LANGUAGE sql STABLE SECURITY DEFINER
     SET search_path TO ''
     AS $$
   select r.id, r.user_id, pr.nickname, r.rating, r.content, r.photo_urls, r.created_at,
-         (r.user_id = app.uid()) as is_mine, r.visit_no, r.has_incentive
+         (r.user_id = app.uid()) as is_mine, r.visit_no, r.has_incentive, r.videos
     from (
       select fr.*,
              row_number() over (
@@ -4443,12 +4462,12 @@ $$;
 -- Name: facility_reviews_of(uuid, integer, integer); Type: FUNCTION; Schema: public; Owner: -
 --
 
-CREATE FUNCTION public.facility_reviews_of(p_facility uuid, p_limit integer DEFAULT 20, p_offset integer DEFAULT 0) RETURNS TABLE(id uuid, user_id uuid, author_nickname text, rating smallint, content text, photo_urls text[], created_at timestamp with time zone, is_mine boolean, visit_no integer, has_incentive boolean)
+CREATE FUNCTION public.facility_reviews_of(p_facility uuid, p_limit integer DEFAULT 20, p_offset integer DEFAULT 0) RETURNS TABLE(id uuid, user_id uuid, author_nickname text, rating smallint, content text, photo_urls text[], created_at timestamp with time zone, is_mine boolean, visit_no integer, has_incentive boolean, videos jsonb)
     LANGUAGE sql STABLE SECURITY DEFINER
     SET search_path TO ''
     AS $$
   select r.id, r.user_id, pr.nickname, r.rating, r.content, r.photo_urls, r.created_at,
-         (r.user_id = app.uid()) as is_mine, r.visit_no, r.has_incentive
+         (r.user_id = app.uid()) as is_mine, r.visit_no, r.has_incentive, r.videos
     from (
       select fr.*,
              row_number() over (
@@ -5455,15 +5474,18 @@ begin
         select jsonb_agg(jsonb_build_object(
                  'rating', r.rating, 'content', r.content,
                  'has_incentive', r.has_incentive,
-                 'photo_urls', r.photos)
-                 order by r.has_photo desc, r.created_at desc)
-        from (select rating, content, has_incentive, created_at,
-                     coalesce(array_length(photo_urls, 1), 0) > 0 as has_photo,
+                 'photo_urls', r.photos,
+                 'videos', r.videos)
+                 order by r.has_media desc, r.created_at desc)
+        from (select rating, content, has_incentive, created_at, videos,
+                     coalesce(array_length(photo_urls, 1), 0) > 0
+                       or jsonb_array_length(videos) > 0 as has_media,
                      (select coalesce(jsonb_agg(u), '[]'::jsonb)
                         from unnest(photo_urls[1:2]) u) as photos
               from public.facility_reviews
               where facility_id = f.id and visibility_status = 'visible'
-              order by coalesce(array_length(photo_urls, 1), 0) > 0 desc,
+              order by coalesce(array_length(photo_urls, 1), 0) > 0
+                         or jsonb_array_length(videos) > 0 desc,
                        created_at desc
               limit 3) r), '[]'::jsonb))
     into v_out
@@ -5502,7 +5524,6 @@ begin
     into v_out
     from public.business_profiles b
     where b.user_id = v_link.ref_id and b.status = 'approved';
-    -- 업체가 인증 취소돼도 랜딩 자체는 살아있게(출처 표기만 생략)
     return coalesce(v_out, jsonb_build_object(
       'status', 'ok', 'kind', v_link.kind,
       'starter', jsonb_build_object('business_name', null)));
@@ -5721,10 +5742,10 @@ $$;
 
 
 --
--- Name: update_my_post(uuid, text, text, timestamp with time zone, text, character varying, integer, boolean); Type: FUNCTION; Schema: public; Owner: -
+-- Name: update_my_post(uuid, text, text, timestamp with time zone, text, character varying, integer, boolean, text); Type: FUNCTION; Schema: public; Owner: -
 --
 
-CREATE FUNCTION public.update_my_post(p_post uuid, p_title text, p_content text, p_scheduled_at timestamp with time zone DEFAULT NULL::timestamp with time zone, p_image_url text DEFAULT NULL::text, p_image_mime character varying DEFAULT NULL::character varying, p_image_size integer DEFAULT NULL::integer, p_edit_image boolean DEFAULT false) RETURNS void
+CREATE FUNCTION public.update_my_post(p_post uuid, p_title text, p_content text, p_scheduled_at timestamp with time zone DEFAULT NULL::timestamp with time zone, p_image_url text DEFAULT NULL::text, p_image_mime character varying DEFAULT NULL::character varying, p_image_size integer DEFAULT NULL::integer, p_edit_image boolean DEFAULT false, p_image_thumb_url text DEFAULT NULL::text) RETURNS void
     LANGUAGE plpgsql SECURITY DEFINER
     SET search_path TO ''
     AS $$
@@ -5752,14 +5773,17 @@ begin
     scheduled_at = p_scheduled_at,
     edited_at = now(),
     image_url = case
-      when p_edit_image and v_cat in ('free', 'adoption') then p_image_url
+      when p_edit_image and v_cat in ('free', 'adoption', 'news') then p_image_url
       else image_url end,
     image_mime_type = case
-      when p_edit_image and v_cat in ('free', 'adoption') then p_image_mime
+      when p_edit_image and v_cat in ('free', 'adoption', 'news') then p_image_mime
       else image_mime_type end,
     image_file_size = case
-      when p_edit_image and v_cat in ('free', 'adoption') then p_image_size
-      else image_file_size end
+      when p_edit_image and v_cat in ('free', 'adoption', 'news') then p_image_size
+      else image_file_size end,
+    image_thumbnail_url = case
+      when p_edit_image and v_cat in ('free', 'adoption', 'news') then p_image_thumb_url
+      else image_thumbnail_url end
   where id = p_post;
 
   if v_old_sched is distinct from p_scheduled_at and p_scheduled_at is not null then
@@ -6348,7 +6372,11 @@ CREATE TABLE public.chat_messages (
     created_at timestamp with time zone DEFAULT now() NOT NULL,
     updated_at timestamp with time zone,
     CONSTRAINT chat_messages_content_not_blank CHECK (((content IS NULL) OR (length(TRIM(BOTH FROM content)) > 0))),
-    CONSTRAINT chat_messages_image_file_size_check CHECK (((image_file_size IS NULL) OR (image_file_size <= 10485760))),
+    CONSTRAINT chat_messages_image_file_size_check CHECK (((image_file_size IS NULL) OR (image_file_size <=
+CASE
+    WHEN ((image_mime_type)::text ~~ 'video/%'::text) THEN 104857600
+    ELSE 10485760
+END))),
     CONSTRAINT chat_messages_not_empty CHECK (((content IS NOT NULL) OR (image_url IS NOT NULL)))
 );
 
@@ -6534,8 +6562,10 @@ CREATE TABLE public.facility_reviews (
     photo_paths text[] DEFAULT '{}'::text[] NOT NULL,
     visibility_status character varying(20) DEFAULT 'visible'::character varying NOT NULL,
     has_incentive boolean DEFAULT false NOT NULL,
+    videos jsonb DEFAULT '[]'::jsonb NOT NULL,
     CONSTRAINT facility_reviews_photos_max CHECK (((array_length(photo_paths, 1) IS NULL) OR (array_length(photo_paths, 1) <= 5))),
-    CONSTRAINT facility_reviews_rating_check CHECK (((rating >= 1) AND (rating <= 5)))
+    CONSTRAINT facility_reviews_rating_check CHECK (((rating >= 1) AND (rating <= 5))),
+    CONSTRAINT facility_reviews_videos_check CHECK (((jsonb_typeof(videos) = 'array'::text) AND (jsonb_array_length(videos) <= 2)))
 );
 
 
@@ -6977,9 +7007,14 @@ CREATE TABLE public.posts (
     CONSTRAINT posts_category_check CHECK (((category)::text = ANY (ARRAY['walk_together'::text, 'walk_proxy'::text, 'care'::text, 'adoption'::text, 'give_away'::text, 'free'::text, 'news'::text]))),
     CONSTRAINT posts_comment_count_check CHECK ((comment_count >= 0)),
     CONSTRAINT posts_deleted_at_consistency CHECK ((((visibility_status)::text !~~ 'deleted_%'::text) OR (deleted_at IS NOT NULL))),
-    CONSTRAINT posts_image_file_size_check CHECK (((image_file_size IS NULL) OR (image_file_size <= 12582912))),
+    CONSTRAINT posts_image_file_size_check CHECK (((image_file_size IS NULL) OR (image_file_size <=
+CASE
+    WHEN ((image_mime_type)::text ~~ 'video/%'::text) THEN 104857600
+    ELSE 12582912
+END))),
     CONSTRAINT posts_like_count_check CHECK ((heart_count >= 0)),
     CONSTRAINT posts_progress_status_check CHECK (((progress_status)::text = ANY ((ARRAY['recruiting'::character varying, 'matched'::character varying, 'completed'::character varying, 'cancelled'::character varying])::text[]))),
+    CONSTRAINT posts_video_category_check CHECK (((image_mime_type IS NULL) OR ((image_mime_type)::text !~~ 'video/%'::text) OR ((category)::text = ANY ((ARRAY['free'::character varying, 'news'::character varying])::text[])))),
     CONSTRAINT posts_view_count_check CHECK ((view_count >= 0)),
     CONSTRAINT posts_visibility_status_check CHECK (((visibility_status)::text = ANY ((ARRAY['visible'::character varying, 'hidden_by_user'::character varying, 'hidden_by_admin'::character varying, 'deleted_by_user'::character varying, 'deleted_by_admin'::character varying])::text[])))
 );
@@ -10603,12 +10638,12 @@ GRANT ALL ON FUNCTION public._push_pref_allows(p_user uuid, p_type text) TO serv
 
 
 --
--- Name: FUNCTION add_facility_review(p_facility uuid, p_rating smallint, p_body text, p_paths text[], p_urls text[], p_has_incentive boolean); Type: ACL; Schema: public; Owner: -
+-- Name: FUNCTION add_facility_review(p_facility uuid, p_rating smallint, p_body text, p_paths text[], p_urls text[], p_has_incentive boolean, p_videos jsonb); Type: ACL; Schema: public; Owner: -
 --
 
-REVOKE ALL ON FUNCTION public.add_facility_review(p_facility uuid, p_rating smallint, p_body text, p_paths text[], p_urls text[], p_has_incentive boolean) FROM PUBLIC;
-GRANT ALL ON FUNCTION public.add_facility_review(p_facility uuid, p_rating smallint, p_body text, p_paths text[], p_urls text[], p_has_incentive boolean) TO authenticated;
-GRANT ALL ON FUNCTION public.add_facility_review(p_facility uuid, p_rating smallint, p_body text, p_paths text[], p_urls text[], p_has_incentive boolean) TO service_role;
+REVOKE ALL ON FUNCTION public.add_facility_review(p_facility uuid, p_rating smallint, p_body text, p_paths text[], p_urls text[], p_has_incentive boolean, p_videos jsonb) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.add_facility_review(p_facility uuid, p_rating smallint, p_body text, p_paths text[], p_urls text[], p_has_incentive boolean, p_videos jsonb) TO authenticated;
+GRANT ALL ON FUNCTION public.add_facility_review(p_facility uuid, p_rating smallint, p_body text, p_paths text[], p_urls text[], p_has_incentive boolean, p_videos jsonb) TO service_role;
 
 
 --
@@ -10977,12 +11012,12 @@ GRANT ALL ON FUNCTION public.create_care_thread(p_pet_label text, p_recipient_ph
 
 
 --
--- Name: FUNCTION create_post_verified(p_category character varying, p_title character varying, p_content text, p_scheduled_at timestamp with time zone, p_pet_ids uuid[], p_image_url text, p_image_mime character varying, p_image_size integer, p_photo_token uuid, p_actual_lat double precision, p_actual_lng double precision, p_region_code character varying); Type: ACL; Schema: public; Owner: -
+-- Name: FUNCTION create_post_verified(p_category character varying, p_title character varying, p_content text, p_scheduled_at timestamp with time zone, p_pet_ids uuid[], p_image_url text, p_image_mime character varying, p_image_size integer, p_photo_token uuid, p_actual_lat double precision, p_actual_lng double precision, p_region_code character varying, p_image_thumb_url text); Type: ACL; Schema: public; Owner: -
 --
 
-REVOKE ALL ON FUNCTION public.create_post_verified(p_category character varying, p_title character varying, p_content text, p_scheduled_at timestamp with time zone, p_pet_ids uuid[], p_image_url text, p_image_mime character varying, p_image_size integer, p_photo_token uuid, p_actual_lat double precision, p_actual_lng double precision, p_region_code character varying) FROM PUBLIC;
-GRANT ALL ON FUNCTION public.create_post_verified(p_category character varying, p_title character varying, p_content text, p_scheduled_at timestamp with time zone, p_pet_ids uuid[], p_image_url text, p_image_mime character varying, p_image_size integer, p_photo_token uuid, p_actual_lat double precision, p_actual_lng double precision, p_region_code character varying) TO authenticated;
-GRANT ALL ON FUNCTION public.create_post_verified(p_category character varying, p_title character varying, p_content text, p_scheduled_at timestamp with time zone, p_pet_ids uuid[], p_image_url text, p_image_mime character varying, p_image_size integer, p_photo_token uuid, p_actual_lat double precision, p_actual_lng double precision, p_region_code character varying) TO service_role;
+REVOKE ALL ON FUNCTION public.create_post_verified(p_category character varying, p_title character varying, p_content text, p_scheduled_at timestamp with time zone, p_pet_ids uuid[], p_image_url text, p_image_mime character varying, p_image_size integer, p_photo_token uuid, p_actual_lat double precision, p_actual_lng double precision, p_region_code character varying, p_image_thumb_url text) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.create_post_verified(p_category character varying, p_title character varying, p_content text, p_scheduled_at timestamp with time zone, p_pet_ids uuid[], p_image_url text, p_image_mime character varying, p_image_size integer, p_photo_token uuid, p_actual_lat double precision, p_actual_lng double precision, p_region_code character varying, p_image_thumb_url text) TO authenticated;
+GRANT ALL ON FUNCTION public.create_post_verified(p_category character varying, p_title character varying, p_content text, p_scheduled_at timestamp with time zone, p_pet_ids uuid[], p_image_url text, p_image_mime character varying, p_image_size integer, p_photo_token uuid, p_actual_lat double precision, p_actual_lng double precision, p_region_code character varying, p_image_thumb_url text) TO service_role;
 
 
 --
@@ -11433,12 +11468,12 @@ GRANT ALL ON FUNCTION public.update_my_business_info(p_storefront_name text, p_p
 
 
 --
--- Name: FUNCTION update_my_post(p_post uuid, p_title text, p_content text, p_scheduled_at timestamp with time zone, p_image_url text, p_image_mime character varying, p_image_size integer, p_edit_image boolean); Type: ACL; Schema: public; Owner: -
+-- Name: FUNCTION update_my_post(p_post uuid, p_title text, p_content text, p_scheduled_at timestamp with time zone, p_image_url text, p_image_mime character varying, p_image_size integer, p_edit_image boolean, p_image_thumb_url text); Type: ACL; Schema: public; Owner: -
 --
 
-REVOKE ALL ON FUNCTION public.update_my_post(p_post uuid, p_title text, p_content text, p_scheduled_at timestamp with time zone, p_image_url text, p_image_mime character varying, p_image_size integer, p_edit_image boolean) FROM PUBLIC;
-GRANT ALL ON FUNCTION public.update_my_post(p_post uuid, p_title text, p_content text, p_scheduled_at timestamp with time zone, p_image_url text, p_image_mime character varying, p_image_size integer, p_edit_image boolean) TO authenticated;
-GRANT ALL ON FUNCTION public.update_my_post(p_post uuid, p_title text, p_content text, p_scheduled_at timestamp with time zone, p_image_url text, p_image_mime character varying, p_image_size integer, p_edit_image boolean) TO service_role;
+REVOKE ALL ON FUNCTION public.update_my_post(p_post uuid, p_title text, p_content text, p_scheduled_at timestamp with time zone, p_image_url text, p_image_mime character varying, p_image_size integer, p_edit_image boolean, p_image_thumb_url text) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.update_my_post(p_post uuid, p_title text, p_content text, p_scheduled_at timestamp with time zone, p_image_url text, p_image_mime character varying, p_image_size integer, p_edit_image boolean, p_image_thumb_url text) TO authenticated;
+GRANT ALL ON FUNCTION public.update_my_post(p_post uuid, p_title text, p_content text, p_scheduled_at timestamp with time zone, p_image_url text, p_image_mime character varying, p_image_size integer, p_edit_image boolean, p_image_thumb_url text) TO service_role;
 
 
 --
diff --git a/supabase/tests/t14_media_video_test.sql b/supabase/tests/t14_media_video_test.sql
new file mode 100644
index 0000000..d818a02
--- /dev/null
+++ b/supabase/tests/t14_media_video_test.sql
@@ -0,0 +1,133 @@
+-- 영상 첨부 불변식 — 게시글 카테고리 게이트·크기 상한, 채팅 미리보기,
+-- 시설 후기 videos 검증·조회 노출.
+begin;
+set local search_path = public, app, extensions;
+\ir helpers/seed.sql
+select plan(12);
+
+create temp table t14 (k text primary key, id uuid not null);
+
+select set_config('request.jwt.claims',
+  json_build_object('sub', (select id from seed where k='owner'), 'tv', 0)::text, true);
+
+-- ① 영상은 자유·소식만 — adoption 에 video mime 직접 INSERT 는 CHECK 거부.
+select throws_like(
+  $$insert into public.posts (user_id, category, title, content,
+      image_url, image_mime_type, image_file_size)
+    values ((select id from seed where k='owner'), 'adoption', 't', 'c',
+      'v.mp4', 'video/mp4', 1000)$$,
+  '%posts_video_category_check%',
+  '분양·입양 계열 영상 게시 거부'
+);
+
+-- ② 자유 게시글 영상 발행(RPC, 썸네일 포함) 성공 + 썸네일 저장.
+with p as (
+  select public.create_post_verified(
+    'free', '영상글', '본문', null, null,
+    'https://x/video.mp4', 'video/mp4', 52428800,
+    p_image_thumb_url => 'https://x/thumb.jpg') as id
+)
+insert into t14 select 'post', id from p;
+select is(
+  (select image_thumbnail_url from public.posts
+    where id = (select id from t14 where k='post')),
+  'https://x/thumb.jpg',
+  '영상 게시글 발행 + 포스터 저장'
+);
+
+-- ③ 영상 100MB 초과는 거부, 사진 12MB 상한은 유지.
+select throws_like(
+  $$insert into public.posts (user_id, category, title, content,
+      image_url, image_mime_type, image_file_size)
+    values ((select id from seed where k='owner'), 'free', 't', 'c',
+      'v.mp4', 'video/mp4', 104857601)$$,
+  '%posts_image_file_size_check%',
+  '영상 100MB 초과 거부'
+);
+select throws_like(
+  $$insert into public.posts (user_id, category, title, content,
+      image_url, image_mime_type, image_file_size)
+    values ((select id from seed where k='owner'), 'free', 't', 'c',
+      'p.jpg', 'image/jpeg', 20971520)$$,
+  '%posts_image_file_size_check%',
+  '사진 12MB 상한 유지'
+);
+
+-- ④ 수정 RPC 로 영상 교체(free) — 썸네일 반영.
+select lives_ok(
+  $$select public.update_my_post(
+      (select id from t14 where k='post'), '영상글2', '본문2',
+      p_image_url => 'https://x/video2.mp4', p_image_mime => 'video/mp4',
+      p_image_size => 1000, p_edit_image => true,
+      p_image_thumb_url => 'https://x/thumb2.jpg')$$,
+  '영상 게시글 수정'
+);
+select is(
+  (select image_thumbnail_url from public.posts
+    where id = (select id from t14 where k='post')),
+  'https://x/thumb2.jpg',
+  '수정 시 포스터 교체'
+);
+
+-- ⑤ 채팅 영상 메시지 — 방 미리보기 [동영상].
+with r as (
+  insert into public.chat_rooms (room_type, canonical_key)
+  values ('direct', 'direct:t14-room') returning id
+)
+insert into t14 select 'room', id from r;
+insert into public.chat_room_members (room_id, user_id)
+select (select id from t14 where k='room'), id
+  from seed where k in ('owner', 'friend');
+insert into public.chat_messages (room_id, sender_id, image_url, image_mime_type, image_file_size)
+values ((select id from t14 where k='room'), (select id from seed where k='owner'),
+        'https://x/c.mp4', 'video/mp4', 1000);
+select is(
+  (select last_message_preview from public.chat_rooms
+    where id = (select id from t14 where k='room')),
+  '[동영상]',
+  '채팅 영상 미리보기'
+);
+
+-- ⑥ 시설 후기 videos — 검증·저장·조회 노출.
+with f as (
+  insert into public.facilities (category, source, ext_id, name)
+  values ('grooming', 'test', 't14-f1', '영상후기미용실') returning id
+)
+insert into t14 select 'fac', id from f;
+
+select throws_like(
+  $$select public.add_facility_review(
+      (select id from t14 where k='fac'), 5::smallint, '후기',
+      p_videos => '[{"thumb_url":"t.jpg"}]'::jsonb)$$,
+  '%invalid_videos%',
+  'url 없는 영상 원소 거부'
+);
+select throws_like(
+  $$select public.add_facility_review(
+      (select id from t14 where k='fac'), 5::smallint, '후기',
+      p_videos => '[{"url":"a.mp4"},{"url":"b.mp4"},{"url":"c.mp4"}]'::jsonb)$$,
+  '%invalid_videos%',
+  '영상 2개 초과 거부'
+);
+select lives_ok(
+  $$select public.add_facility_review(
+      (select id from t14 where k='fac'), 5::smallint, '영상 후기예요',
+      p_videos => '[{"url":"https://x/r.mp4","thumb_url":"https://x/r.jpg"}]'::jsonb)$$,
+  '영상 후기 작성'
+);
+select is(
+  (select videos->0->>'url' from public.facility_reviews
+    where facility_id = (select id from t14 where k='fac')),
+  'https://x/r.mp4',
+  '영상 저장'
+);
+select is(
+  (select v.videos->0->>'thumb_url'
+     from public.facility_reviews_of((select id from t14 where k='fac')) v
+    limit 1),
+  'https://x/r.jpg',
+  '조회 RPC 에 videos 노출'
+);
+
+select * from finish();
+rollback;