Add Django backend: users, admin, OTIO + scene persistence

A Project (owner, OTIO file, fps, scene JSON) persists the timeline. Session
API: list projects, GET/PUT scene, serve OTIO. Admin manages users/projects;
seed_demo creates a project from the bundled one_two_three.otio.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scenes/admin.py

@@ -0,0 +1,11 @@
+from django.contrib import admin
+
+from .models import Project
+
+
+@admin.register(Project)
+class ProjectAdmin(admin.ModelAdmin):
+    list_display = ("name", "owner", "fps", "updated")
+    list_filter = ("owner",)
+    search_fields = ("name",)
+    readonly_fields = ("created", "updated")

scenes/apps.py

@@ -0,0 +1,5 @@
+from django.apps import AppConfig
+
+
+class ScenesConfig(AppConfig):
+    name = 'scenes'

scenes/management/commands/seed_demo.py

@@ -0,0 +1,31 @@
+"""Create a demo Project owned by `admin`, with the bundled OTIO attached."""
+from pathlib import Path
+
+from django.conf import settings
+from django.contrib.auth import get_user_model
+from django.core.files import File
+from django.core.management.base import BaseCommand
+
+from scenes.models import Project
+
+OTIO = settings.BASE_DIR / "tl" / "resources" / "public" / "one_two_three.otio"
+
+
+class Command(BaseCommand):
+    help = "Seed a demo project from the bundled OTIO file."
+
+    def handle(self, *args, **opts):
+        User = get_user_model()
+        owner = User.objects.filter(username="admin").first()
+        if owner is None:
+            self.stderr.write("no 'admin' user — run createsuperuser first")
+            return
+
+        project, created = Project.objects.get_or_create(
+            owner=owner, name="one two three", defaults={"scene": {}})
+        if OTIO.exists() and not project.otio:
+            with OTIO.open("rb") as fh:
+                project.otio.save(Path(OTIO).name, File(fh), save=True)
+
+        verb = "created" if created else "exists"
+        self.stdout.write(f"project #{project.pk} {verb}: {project.name} (otio={bool(project.otio)})")

scenes/migrations/0001_initial.py

@@ -0,0 +1,33 @@
+# Generated by Django 6.0.6 on 2026-06-29 03:38
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Project',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=200)),
+                ('otio', models.FileField(blank=True, null=True, upload_to='otio/')),
+                ('fps', models.FloatField(default=23.976023976023978)),
+                ('scene', models.JSONField(blank=True, default=dict)),
+                ('created', models.DateTimeField(auto_now_add=True)),
+                ('updated', models.DateTimeField(auto_now=True)),
+                ('owner', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='projects', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'ordering': ['-updated'],
+            },
+        ),
+    ]

scenes/models.py

@@ -0,0 +1,25 @@
+from django.conf import settings
+from django.db import models
+
+NTSC_24 = 24000 / 1001
+
+
+class Project(models.Model):
+    """One editing project: an uploaded OTIO source + the live mark-group scene
+    (tl.scene) the frontend reads and writes. The scene is just a JSON dump for
+    now — the whole {:tracks :groups} map the client keeps in app-db."""
+
+    owner = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE,
+                              related_name="projects")
+    name = models.CharField(max_length=200)
+    otio = models.FileField(upload_to="otio/", blank=True, null=True)
+    fps = models.FloatField(default=NTSC_24)
+    scene = models.JSONField(default=dict, blank=True)
+    created = models.DateTimeField(auto_now_add=True)
+    updated = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        ordering = ["-updated"]
+
+    def __str__(self):
+        return f"{self.name} (#{self.pk})"

scenes/tests.py

@@ -0,0 +1,3 @@
+from django.test import TestCase
+
+# Create your tests here.

scenes/urls.py

@@ -0,0 +1,9 @@
+from django.urls import path
+
+from . import views
+
+urlpatterns = [
+    path("projects/", views.projects),
+    path("projects/<int:pk>/scene/", views.scene),
+    path("projects/<int:pk>/otio/", views.otio),
+]

scenes/views.py

@@ -0,0 +1,56 @@
+import json
+
+from django.http import FileResponse, HttpResponseNotAllowed, JsonResponse
+from django.shortcuts import get_object_or_404
+from django.views.decorators.csrf import csrf_exempt
+
+from .models import Project
+
+
+def _auth(request):
+    """None if logged in, else a 401 JSON response (so fetch() doesn't get a
+    login redirect)."""
+    if not request.user.is_authenticated:
+        return JsonResponse({"detail": "authentication required"}, status=401)
+    return None
+
+
+def _owned(request, pk):
+    return get_object_or_404(Project, pk=pk, owner=request.user)
+
+
+def projects(request):
+    """GET /api/projects/ — the current user's projects."""
+    if (resp := _auth(request)):
+        return resp
+    rows = Project.objects.filter(owner=request.user).values("id", "name", "fps", "updated")
+    return JsonResponse(list(rows), safe=False)
+
+
+@csrf_exempt  # dev convenience: session-auth API without a CSRF token round-trip
+def scene(request, pk):
+    """GET/PUT /api/projects/<pk>/scene/ — read or replace the timeline scene."""
+    if (resp := _auth(request)):
+        return resp
+    project = _owned(request, pk)
+    if request.method == "GET":
+        return JsonResponse({"fps": project.fps, "scene": project.scene})
+    if request.method == "PUT":
+        data = json.loads(request.body or "{}")
+        if "scene" in data:
+            project.scene = data["scene"]
+        if "fps" in data:
+            project.fps = data["fps"]
+        project.save(update_fields=["scene", "fps", "updated"])
+        return JsonResponse({"ok": True, "updated": project.updated})
+    return HttpResponseNotAllowed(["GET", "PUT"])
+
+
+def otio(request, pk):
+    """GET /api/projects/<pk>/otio/ — serve the uploaded OTIO file."""
+    if (resp := _auth(request)):
+        return resp
+    project = _owned(request, pk)
+    if not project.otio:
+        return JsonResponse({"detail": "no otio uploaded"}, status=404)
+    return FileResponse(project.otio.open("rb"), content_type="application/json")