v3: comments say what the code can't — the documentation pass wanted JSDoc on every export and every field of an exported interface, which filled the code with restatements ("The dump.", "Whether it is loading.", "The props of X.", "Renders the X.") and module docs that told a reader nothing ("The hot and new feeds, and the props every main feed of the index takes."); some were wrong as well as vague. Every comment in api/, shared/ and src/ is rewritten under one rule, now stated in the README's "Comments" section: every module and export still has a JSDoc, and it gives context (who uses it and where), usage (what a caller must know: a precondition, what it leaves to the caller, a side effect) or its place in the chain (where its input comes from, where its output goes); a field, parameter, private function or local gets one only when it adds to its parent's, and context about a whole type goes on the type; a type's doc is phrased from the value's side ("Returned to Y by X when Z", "Passed to Y by X"); full sentences, as short as they can be, no label-colon-list; // goes wherever the code isn't obvious and says why, and the section banners and narration go. Every claim was checked against the code, which turned up some forty comments that were wrong: DumpCard's claimed it was only used by the hot and new feeds, the WebSocket welcome claimed to be a socket's first message (presence comes first), UpdateUserRequest said null removes a description (it keeps it), deletedDumpIds leaves out that it also holds dumps made private, THEME_COLOR claimed to mirror index.html's, and the like. The routers' JSDoc now says where they are mounted and what becomes of a thrown APIException. doc-lint.ts lets a field without a doc through; a module or export without one still fails. No code changes; 204 backend and 628 frontend tests pass, and doc:lint, deno check, deno lint and tsc are clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/middleware/auth.ts

@@ -1,6 +1,7 @@
 /**
- * Middleware gating routes on authentication, the admin role, or a
- * permission.
+ * Gates routes on a session token, and on a permission after it. The routers
+ * put these middleware before a handler; a route open to anonymous callers
+ * calls `parseOptionalAuth` (`lib/auth.ts`) instead.
  *
  * @module
  */
@@ -18,16 +19,17 @@ import type { AuthPayload } from "../model/auth.ts";
 import { can } from "../lib/permissions.ts";
 import type { Permission } from "../../shared/permissions.ts";
 
-/** The request state once {@link authMiddleware} has run. */
+/**
+ * Set on `ctx.state` by {@link authMiddleware} for the handlers after it.
+ * `user` carries the caller's live role, not the one in their token.
+ */
 export interface AuthState extends State {
-  /** The authenticated caller, with their live role. */
   user: AuthPayload;
 }
 
 /**
- * A router context whose state is guaranteed to carry the authenticated user
- * (populated by {@link authMiddleware}). Generic over the route path so
- * `ctx.params` stays typed per-route — e.g. `AuthContext<"/:userId/role">`.
+ * The context type of a handler behind {@link authMiddleware}. Pass the route
+ * path, as in `AuthContext<"/:userId/role">`, to keep `ctx.params` typed.
  */
 export type AuthContext<
   R extends string = string,
@@ -35,8 +37,8 @@ export type AuthContext<
 > = RouterContext<R, P, AuthState>;
 
 /**
- * Requires a valid session token in the `Authorization` header and puts its
- * caller in `ctx.state.user`.
+ * Requires a valid session token in the `Authorization` header, and puts its
+ * payload in `ctx.state.user` for the rest of the route.
  *
  * @throws {APIException} 401 when the token is missing or invalid.
  */
@@ -55,8 +57,6 @@ export async function authMiddleware<R extends string>(
   }
 
   const token = authHeader.substring(7);
-  // Also checks the user still exists and hasn't changed their password since
-  // the token was issued, and takes the live role from the DB.
   const payload = await authenticate(token);
 
   if (!payload) {
@@ -70,6 +70,7 @@ export async function authMiddleware<R extends string>(
 
 /**
  * Requires the caller to be an admin. Must run after {@link authMiddleware}.
+ * No route uses it: they gate on a permission with {@link requirePermission}.
  *
  * @throws {APIException} 403 when the caller isn't an admin.
  */
@@ -89,10 +90,11 @@ export async function adminOnlyMiddleware<R extends string>(
 }
 
 /**
- * Returns a middleware requiring the caller to hold `permission`, which throws
- * an {@link APIException} (403) when they don't. Must run after
- * {@link authMiddleware}. Generic over the route path so it composes with
- * path-typed route handlers.
+ * Returns a middleware that requires the caller to hold `permission`. It must
+ * run after {@link authMiddleware}, as in
+ * `router.patch(path, authMiddleware, requirePermission("user:manage"), …)`.
+ * The returned middleware throws an {@link APIException} (403) when the caller
+ * lacks the permission.
  */
 export function requirePermission(
   permission: Permission,

api/middleware/error.ts

@@ -1,5 +1,7 @@
 /**
- * Turns errors thrown while handling a request into `APIFailure` responses.
+ * Turns the errors a request's handling throws into `APIFailure` responses.
+ * main.ts installs it first, so it catches what every later middleware and
+ * route throws.
  *
  * @module
  */
@@ -10,8 +12,9 @@ import { APIErrorCode, APIFailure } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 
 /**
- * Answers an {@link APIException} with its status and code, and anything else
- * with a 500 `SERVER_ERROR`, logging both.
+ * Answers an {@link APIException} with its status, code and message. Anything
+ * else is logged with its stack and answered with a 500 `SERVER_ERROR` whose
+ * message gives nothing away.
  */
 export async function errorMiddleware(
   ctx: Context,

api/middleware/og.ts

@@ -1,7 +1,8 @@
 /**
- * Open Graph and Twitter card tags for shared links: a dump, user or public
- * playlist page is answered with `index.html` carrying that page's title,
- * description and image, so link unfurlers that don't run the app see them.
+ * Answers a link to a dump, a profile or a public playlist with `index.html`
+ * carrying that page's Open Graph and Twitter card tags, for the link previews
+ * of chat apps and social sites, which don't run the app. main.ts installs it
+ * before the routers.
  *
  * @module
  */
@@ -18,8 +19,8 @@ interface OGMeta {
   description?: string;
   imageUrl?: string;
   /**
-   * True only for real artwork — a square site icon must not claim a wide
-   * card.
+   * Set for a dump's artwork only. It asks for the large card, which would
+   * stretch a square icon or avatar.
    */
   imageIsWide?: boolean;
   url: string;
@@ -68,8 +69,8 @@ function inject(html: string, meta: OGMeta): string {
 }
 
 /**
- * Returns the filled `index.html` of the build, or of the working directory
- * when there is no build; null when there is neither.
+ * Returns the filled `index.html` of dist/, or else the source one, which is
+ * all there is in development. Returns null when neither can be read.
  */
 async function findIndexHtml(): Promise<string | null> {
   for (const root of [`${Deno.cwd()}/dist`, Deno.cwd()]) {
@@ -83,13 +84,14 @@ async function findIndexHtml(): Promise<string | null> {
 }
 
 const DUMP_RE = /^\/dumps\/([^/]+)$/;
-/** A profile, with an optional `/~/<tab>` suffix so its tabs keep OG meta. */
+/** Matches a profile, and its tabs under `/~/<tab>`. */
 const USER_RE = /^\/users\/([^/]+)(?:\/~\/[^/]+)?$/;
 const PLAYLIST_RE = /^\/playlists\/([^/]+)$/;
 
 /**
- * Serves `index.html` with OG tags for a dump, user or public playlist page
- * that exists, and passes every other request on.
+ * Serves `index.html` with the tags of the dump, user or public playlist a
+ * path names, and passes the request on when it names none that exists or
+ * the visitor may see. The tags' URLs are built on the request's origin.
  */
 export async function ogMiddleware(
   ctx: Context,
@@ -119,9 +121,8 @@ export async function ogMiddleware(
       } else if (dump.richContent?.thumbnailUrl) {
         imageUrl = dump.richContent.thumbnailUrl;
       }
-      // No artwork: fall back to our own site icon rather than the target's
-      // favicon, which is typically too small to survive a social card (and may
-      // be hotlink-protected).
+      // Without artwork, the site's icon: the linked site's favicon is too
+      // small for a card, and may refuse hotlinking.
       meta = {
         title: dump.title,
         description: dump.comment,
@@ -129,7 +130,7 @@ export async function ogMiddleware(
         imageIsWide: !!imageUrl,
         url: pageUrl,
       };
-    } catch { /* not found or private — serve default */ }
+    } catch { /* Unknown, or private. */ }
   } else if (userMatch) {
     try {
       const user = getUserByUsername(userMatch[1]);
@@ -142,10 +143,11 @@ export async function ogMiddleware(
         imageUrl: imageUrl ?? `${origin}/apple-touch-icon.png`,
         url: pageUrl,
       };
-    } catch { /* not found */ }
+    } catch { /* Unknown. */ }
   } else if (playlistMatch) {
     try {
       const playlist = getPlaylistById(playlistMatch[1]);
+      // getPlaylistById doesn't check visibility, unlike getDump.
       if (playlist.isPublic) {
         const imageUrl = playlist.imageMime
           ? `${origin}/api/playlists/${playlist.id}/image`
@@ -157,7 +159,7 @@ export async function ogMiddleware(
           url: pageUrl,
         };
       }
-    } catch { /* not found or private */ }
+    } catch { /* Unknown. */ }
   }
 
   if (!meta) return await next();