diff --git a/backend/map.json b/backend/map.json
new file mode 100755
index 0000000..0637a08
--- /dev/null
+++ b/backend/map.json
@@ -0,0 +1 @@
+[]
\ No newline at end of file
diff --git a/backend/modules/commands/discover/discover_medias.go b/backend/modules/commands/discover/discover_medias.go
index 5e9ed4b..dd56817 100644
--- a/backend/modules/commands/discover/discover_medias.go
+++ b/backend/modules/commands/discover/discover_medias.go
@@ -95,12 +95,8 @@ func (d *DiscoverMedias) processVideo(video, to, hash string) (media_store.Video
 		return info, errors.Wrapf(err, "ensure directory: %s", to)
 	}
 
-	if err := d.ensureDirectory(filepath.Join(to, "posters")); err != nil {
-		return info, errors.Wrapf(err, "ensure directory: %s", to)
-	}
-
 	// extract poster
-	posterFile := filepath.Join(to, "posters", hash+".jpg")
+	posterFile := filepath.Join(to, hash+".jpg")
 	if err := d.ffmpegVideoToPoster(video, posterFile); err != nil {
 		return info, errors.Wrapf(err, "ffmpeg video to poster: %s", posterFile)
 	}
@@ -269,6 +265,10 @@ func (d *DiscoverMedias) runCleanup(to string) {
 		if err := os.RemoveAll(filepath.Join(to, dir)); err != nil {
 			d.log.Errorf("Remove dir: %s", dir)
 		}
+
+		if err := os.RemoveAll(filepath.Join(to, dir+".jpg")); err != nil {
+			d.log.Errorf("Remove poster: %s", dir+".jpg")
+		}
 	}
 }
 
diff --git a/backend/modules/commands/store/store_medias.go b/backend/modules/commands/store/store_medias.go
index 99bfc0b..89df34d 100644
--- a/backend/modules/commands/store/store_medias.go
+++ b/backend/modules/commands/store/store_medias.go
@@ -2,6 +2,8 @@ package store
 
 import (
 	"context"
+	"fmt"
+	"path/filepath"
 
 	"backend/modules/medias"
 	"backend/pkg/media_store"
@@ -25,13 +27,16 @@ func (d *StoreMedias) Prepare() error {
 func (d *StoreMedias) RunE(targetPath string) error {
 	d.log.Infof("Store medias from: %s ", targetPath)
 
+	tenantId := int64(1)
+
+	targetPath = filepath.Join(targetPath, fmt.Sprintf("%d", tenantId))
 	store, err := media_store.NewStore(targetPath)
 	if err != nil {
-		return errors.Wrapf(err, "new store: %s", targetPath)
+		return errors.Wrapf(err, "store: %s", targetPath)
 	}
 
 	for _, item := range store {
-		err := d.mediasSvc.Upsert(context.Background(), 1, item)
+		err := d.mediasSvc.Upsert(context.Background(), tenantId, item)
 		if err != nil {
 			d.log.WithError(err).Errorf("upsert media: %s - %s", item.Hash, item.Name)
 		}
diff --git a/backend/modules/medias/service.go b/backend/modules/medias/service.go
index e02268e..1cff1f4 100644
--- a/backend/modules/medias/service.go
+++ b/backend/modules/medias/service.go
@@ -213,16 +213,17 @@ func (svc *Service) HasUserBought(ctx context.Context, tenantId, userId, mediaId
 func (svc *Service) Upsert(ctx context.Context, tenantId int64, item media_store.VideoInfo) error {
 	log := svc.log.WithField("method", "Upsert")
 
+	tenantIdStr := fmt.Sprintf("%d", tenantId)
 	resources := pg.MediaResources{}
-	if path.DirExists(filepath.Join(svc.storageConfig.Path, item.Hash, pg.MediaTypeVideo.String())) {
+	if path.DirExists(filepath.Join(svc.storageConfig.Path, tenantIdStr, item.Hash, pg.MediaTypeVideo.String())) {
 		resources = append(resources, pg.MediaTypeVideo)
 	}
 
-	if path.DirExists(filepath.Join(svc.storageConfig.Path, item.Hash, pg.MediaTypeAudio.String())) {
+	if path.DirExists(filepath.Join(svc.storageConfig.Path, tenantIdStr, item.Hash, pg.MediaTypeAudio.String())) {
 		resources = append(resources, pg.MediaTypeAudio)
 	}
 
-	if path.DirExists(filepath.Join(svc.storageConfig.Path, item.Hash, pg.MediaTypePdf.String())) {
+	if path.DirExists(filepath.Join(svc.storageConfig.Path, tenantIdStr, item.Hash, pg.MediaTypePdf.String())) {
 		resources = append(resources, pg.MediaTypePdf)
 	}
 
diff --git a/backend/modules/middlewares/m_jwt_parse.go b/backend/modules/middlewares/m_jwt_parse.go
index e889e60..bc869e4 100644
--- a/backend/modules/middlewares/m_jwt_parse.go
+++ b/backend/modules/middlewares/m_jwt_parse.go
@@ -16,7 +16,7 @@ func (f *Middlewares) ParseJWT(c fiber.Ctx) error {
 	token := tokens[0]
 	claim, err := f.jwt.Parse(token)
 	if err != nil {
-		return errors.Wrap(err, "failed to parse token")
+		return errors.Wrapf(err, "failed to parse token: %s", token)
 	}
 
 	// query user
diff --git a/backend/modules/middlewares/m_wechat_auth.go b/backend/modules/middlewares/m_wechat_auth.go
index ce46aaf..56c064c 100644
--- a/backend/modules/middlewares/m_wechat_auth.go
+++ b/backend/modules/middlewares/m_wechat_auth.go
@@ -1,7 +1,9 @@
 package middlewares
 
 import (
+	"fmt"
 	"strings"
+	"time"
 
 	"backend/providers/wechat"
 
@@ -10,11 +12,26 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
+const StatePrefix = "sns_basic_auth"
+
 func (f *Middlewares) WeChatAuth(c fiber.Ctx) error {
-	log.WithField("module", "middleware.AuthUserInfo").Debugf("%s, query: %v", c.OriginalURL(), c.Queries())
+	log := log.WithField("module", "middleware.AuthUserInfo")
+	log.Debugf("%s, query: %v", c.OriginalURL(), c.Queries())
 	state := c.Query("state")
 	code := c.Query("code")
-	log.WithField("module", "middleware.AuthUserInfo").Debugf("code: %s, state: %s", code, state)
+	log.Debugf("code: %s, state: %s", code, state)
+
+	jwtToken := c.Cookies("token")
+	if jwtToken != "" {
+		log.Debugf("jwtToken: %s", jwtToken)
+
+		if _, err := f.jwt.Parse(jwtToken); err != nil {
+			log.WithError(err).Error("failed to parse jwt token")
+
+			c.ClearCookie("token")
+			return c.Redirect().To(c.Path())
+		}
+	}
 
 	if state == "" && code == "" {
 		url := string(c.Request().URI().FullURI())
@@ -27,7 +44,7 @@ func (f *Middlewares) WeChatAuth(c fiber.Ctx) error {
 
 		to, err := f.client.ScopeAuthorizeURL(
 			wechat.ScopeAuthorizeURLWithRedirectURI(url),
-			wechat.ScopeAuthorizeURLWithState("sns_basic_auth"),
+			wechat.ScopeAuthorizeURLWithState(fmt.Sprintf("%s_%d", StatePrefix, time.Now().UnixNano())),
 		)
 		if err != nil {
 			return errors.Wrap(err, "failed to get wechat auth url")
@@ -38,7 +55,7 @@ func (f *Middlewares) WeChatAuth(c fiber.Ctx) error {
 
 	}
 
-	if state != "sns_basic_auth" || code == "" {
+	if !strings.HasPrefix(state, StatePrefix) || code == "" {
 		return errors.New("invalid request")
 	}
 
diff --git a/backend/modules/wechat/controller.go b/backend/modules/wechat/controller.go
index f20db5a..b80a9c5 100644
--- a/backend/modules/wechat/controller.go
+++ b/backend/modules/wechat/controller.go
@@ -26,6 +26,18 @@ type Controller struct {
 }
 
 func (c *Controller) Render(ctx fiber.Ctx) error {
+	jwtToken := ctx.Cookies("token")
+	ctx.Set("Content-Type", "text/html")
+	b, err := os.ReadFile(filepath.Join(c.storagePath.Asset, "index.html"))
+	if err != nil {
+		return errors.Wrap(err, "failed to read file")
+	}
+
+	if jwtToken != "" {
+		html := strings.ReplaceAll(string(b), "{{JWT}}", jwtToken)
+		return ctx.SendString(html)
+	}
+
 	code := ctx.Query("code")
 
 	// get the openid
@@ -58,18 +70,17 @@ func (c *Controller) Render(ctx fiber.Ctx) error {
 		UserID:   user.ID,
 		TenantID: tenant.ID,
 	})
-	jwtToken, err := c.jwt.CreateToken(claim)
+	jwtToken, err = c.jwt.CreateToken(claim)
 	if err != nil {
 		return errors.Wrap(err, "failed to create token")
 	}
 
-	b, err := os.ReadFile(filepath.Join(c.storagePath.Asset, "index.html"))
-	if err != nil {
-		return errors.Wrap(err, "failed to read file")
-	}
+	ctx.Cookie(&fiber.Cookie{
+		Name:     "token",
+		Value:    jwtToken,
+		HTTPOnly: true,
+	})
 
 	html := strings.ReplaceAll(string(b), "{{JWT}}", jwtToken)
-
-	ctx.Set("Content-Type", "text/html")
 	return ctx.SendString(html)
 }
diff --git a/backend/pkg/service/http/http.go b/backend/pkg/service/http/http.go
index acbe7ef..5e1f4fa 100644
--- a/backend/pkg/service/http/http.go
+++ b/backend/pkg/service/http/http.go
@@ -85,7 +85,6 @@ func Serve(cmd *cobra.Command, args []string) error {
 			return c.SendFile(filepath.Join(
 				http.Storage.Path,
 				tenant,
-				"posters",
 				hash+".jpg",
 			))
 		})
diff --git a/backend/pkg/service/tasks/tasks.go b/backend/pkg/service/tasks/tasks.go
index 61b1c3e..bb331cb 100644
--- a/backend/pkg/service/tasks/tasks.go
+++ b/backend/pkg/service/tasks/tasks.go
@@ -1,6 +1,8 @@
 package tasks
 
 import (
+	"errors"
+
 	"backend/modules/commands/discover"
 	"backend/modules/commands/store"
 	"backend/modules/medias"
@@ -56,6 +58,9 @@ func Command() atom.Option {
 			atom.RunE(func(cmd *cobra.Command, args []string) error {
 				return container.Container.Invoke(func(task *store.StoreMedias) error {
 					from := cmd.Flag("from").Value.String()
+					if from == "" {
+						return errors.New("from is empty")
+					}
 					return task.RunE(from)
 				})
 			}),