v3: comments say what the code can't — the documentation pass wanted JSDoc on every export and every field of an exported interface, which filled the code with restatements ("The dump.", "Whether it is loading.", "The props of X.", "Renders the X.") and module docs that told a reader nothing ("The hot and new feeds, and the props every main feed of the index takes."); some were wrong as well as vague. Every comment in api/, shared/ and src/ is rewritten under one rule, now stated in the README's "Comments" section: every module and export still has a JSDoc, and it gives context (who uses it and where), usage (what a caller must know: a precondition, what it leaves to the caller, a side effect) or its place in the chain (where its input comes from, where its output goes); a field, parameter, private function or local gets one only when it adds to its parent's, and context about a whole type goes on the type; a type's doc is phrased from the value's side ("Returned to Y by X when Z", "Passed to Y by X"); full sentences, as short as they can be, no label-colon-list; // goes wherever the code isn't obvious and says why, and the section banners and narration go. Every claim was checked against the code, which turned up some forty comments that were wrong: DumpCard's claimed it was only used by the hot and new feeds, the WebSocket welcome claimed to be a socket's first message (presence comes first), UpdateUserRequest said null removes a description (it keeps it), deletedDumpIds leaves out that it also holds dumps made private, THEME_COLOR claimed to mirror index.html's, and the like. The routers' JSDoc now says where they are mounted and what becomes of a thrown APIException. doc-lint.ts lets a field without a doc through; a module or export without one still fails. No code changes; 204 backend and 628 frontend tests pass, and doc:lint, deno check, deno lint and tsc are clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/lib/auth.ts

@@ -1,6 +1,7 @@
 /**
- * Authenticates the tokens a request carries: session tokens in the
- * `Authorization` header and media tokens in a media URL's query string.
+ * Checks session and media tokens against the live user row, not just their
+ * signature. The auth middleware, the WebSocket route, the media routes and the
+ * routes open to anonymous callers all authenticate through it.
  *
  * @module
  */
@@ -14,13 +15,10 @@ import type { Role } from "../../shared/user.ts";
 import { getSessionState } from "../services/user-service.ts";
 
 /**
- * Checks a signature-verified token against the live user row: the user must
- * still exist, and the token must not predate their last password change
- * (`users.tokens_valid_after`). Returns the live role, or null to refuse.
- *
- * `iat` has one-second resolution, so a token issued in the same second as the
- * change survives it; one issued after it (the fresh one the change hands back)
- * always does.
+ * Returns the live role of a verified token's user, or null when the user is
+ * gone or the token predates their last password change
+ * (`users.tokens_valid_after`). `iat` counts whole seconds, so a token issued
+ * in the same second as the change survives it.
  */
 function checkTokenOwner(
   userId: string,
@@ -38,9 +36,10 @@ function checkTokenOwner(
 }
 
 /**
- * Verifies a session token end to end: signature, expiry, a user that still
- * exists and no password change since it was issued. The role comes from the
- * DB, not the token, since tokens last 7 days and roles change under them.
+ * Returns the payload of a valid session token, or null. Besides the signature
+ * and expiry, it refuses a token whose user is gone or which predates a
+ * password change. The returned role comes from the database, not the token,
+ * since a token lasts 7 days and a role can change under it.
  */
 export async function authenticate(
   token: string,
@@ -53,8 +52,9 @@ export async function authenticate(
 }
 
 /**
- * Resolves the `?token=` on a media URL to the viewer's user id. Takes a media
- * token, or a session token from a client that predates them.
+ * Returns the user id behind the `?token=` of a file, thumbnail or playlist
+ * cover URL, or null when it isn't valid. A session token is accepted too, for
+ * clients from before media tokens.
  */
 export async function authenticateMedia(token: string): Promise<string | null> {
   const media = await verifyMediaToken(token);
@@ -65,18 +65,13 @@ export async function authenticateMedia(token: string): Promise<string | null> {
 }
 
 /**
- * Returns the user id of an optional Bearer token, or null for an anonymous
- * request.
+ * Returns the caller's user id on a route open to anonymous callers, or null
+ * when the request has no token. A placeholder such as `Bearer undefined`
+ * counts as no token. An invalid token throws instead of reading as anonymous,
+ * so that a stale session gets a 401 the client signs out on, rather than a
+ * misleading 404 on a private resource.
  *
- * Distinguishes *missing* credentials from *invalid* ones:
- * - No `Authorization: Bearer …` header (or a placeholder value such as the
- *   `Bearer undefined` that the client emits when logged out) → anonymous (null).
- * - A real token that fails verification (expired / bad signature / revoked) →
- *   throws 401, so a stale client session surfaces as an auth error it can react
- *   to, instead of being silently downgraded to anonymous (which yields a
- *   misleading 404 on private resources).
- *
- * @throws {APIException} 401 when a token is present but fails verification.
+ * @throws {APIException} 401 when a token is present but invalid.
  */
 export async function parseOptionalAuth(ctx: Context): Promise<string | null> {
   const authHeader = ctx.request.headers.get("Authorization");