v3: fix the privacy and security findings of the comment pass — private dumps' broadcasts, mentions and attachments reached people who can't see them, and a few smaller holes. A dump's every write now goes through ws-service's broadcastDumpChange(before, after), which decides the audience: a private dump's creation, edits and deletion reach its owner's sockets alone (its deletion id went to everyone before), going private is dump_deleted for everyone else and dump_updated for the owner (whose other tabs dropped it), going public dump_created for everyone else. Mentions in a private dump, a comment on one, or a private playlist's description notify no one until it goes public (mentions are deduplicated per context, so going public notifies them once), and a moderator's edit of a comment, chat message or playlist mentions in the author's name. A link preview of a private playlist is refused, as one of a private dump already was: the preview is stored in the linking dump, which others may see. Attachments record the type of the resource that links them (migration 0018 backfills it); one linked by a private dump or playlist, or a comment on a private dump, is served only with its owner's media token, which Markdown now adds to attachment URLs, and one whose resource is gone answers 404 and is purged at startup. The Bandcamp provider claimed bandcamp.com.evil.example (the pattern wasn't anchored) and now reuses bandcamp-tralbum's anchored one; the YouTube provider took any site's ?list= for a YouTube playlist and missed m., music., youtube-nocookie and /live/ links, and now shares canonical-url's rules. Sign-in does the same scrypt work for an unknown username as for a wrong password, so timing no longer tells which exist. Usernames and emails are unique regardless of case (migration 0017, which refuses to run over existing clashes and names them): "Bob" and "bob" could both sign up and a mention picked one, emails had no constraint, and a reset request in another case silently sent nothing. The Open Graph tags escape the site name and build their URLs on PUBLIC_URL and FRONTEND_URL instead of the request's origin, which a proxy may rewrite.

Error statuses follow one rule: APIException takes a status and derives the code from it (BAD_REQUEST 400, UNAUTHORIZED 401, FORBIDDEN 403, NOT_FOUND 404, CONFLICT 409, RATE_LIMITED 429, SERVER_ERROR 500, BAD_GATEWAY 502), so a code can't contradict its status. That fixed real bugs: a wrong current password on change-password answered 401, on which authFetch signs the user out; editing or deleting someone else's comment or chat message answered 401 rather than 403; one invalid dump edit answered 422. A taken username is 409, like a taken email.

Along the way: the database is created from schema.sql by connection.ts when the file doesn't exist, so every task works on a fresh checkout (dev and serve never ran db/init.ts, which is gone); the startup purge compared ISO dates with SQLite's datetime() as text and kept anything from the current UTC day, and now compares ISO cutoffs; the seeded admin's hash comes from lib/password.ts (split out of jwt.ts, which needs the JWT secret) rather than a copy of its format; avatar, thumbnail and playlist-cover uploads go through replaceUploadedFile, which writes beside the old file and renames over it before the record announces it (a failed avatar write lost the old avatar; a thumbnail was announced before it existed); upload.ts derives its size message from MAX_IMAGE_SIZE_BYTES and stops re-exporting the upload folders; ALLOWED_IMAGE_MIMES, which duplicated detectImageMime, is gone; the SPA fallback no longer calls next() after answering; a reply must answer a comment on the same dump (a foreign or unknown parent was a 500 or a cross-dump thread). 211 backend and 628 frontend tests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/lib/api-exception.ts

@@ -5,24 +5,36 @@
  * @module
  */
 
-import type { APIErrorCode } from "../../shared/api.ts";
+import { APIErrorCode } from "../../shared/api.ts";
+
+/** Passed to an {@link APIException}; any other status is a type error. */
+export type APIStatus = 400 | 401 | 403 | 404 | 409 | 429 | 500 | 502;
+
+const CODES: Record<APIStatus, APIErrorCode> = {
+  400: APIErrorCode.BAD_REQUEST,
+  401: APIErrorCode.UNAUTHORIZED,
+  403: APIErrorCode.FORBIDDEN,
+  404: APIErrorCode.NOT_FOUND,
+  409: APIErrorCode.CONFLICT,
+  429: APIErrorCode.RATE_LIMITED,
+  500: APIErrorCode.SERVER_ERROR,
+  502: APIErrorCode.BAD_GATEWAY,
+};
 
 /**
  * Thrown by a route, a service or a remote fetch to answer the request with an
  * error. The error middleware sends it as an `APIFailure`, message included,
- * so the message must be fit for the user.
+ * so the message must be fit for the user. Use 401 for a caller who isn't
+ * signed in, 403 for one who is but may not, and 404 rather than 403 when the
+ * caller mustn't learn that the thing exists.
  */
 export class APIException extends Error {
   readonly code: APIErrorCode;
-  readonly status: number;
+  readonly status: APIStatus;
 
-  /**
-   * Creates the exception. A code goes with several statuses, as
-   * `UNAUTHORIZED` does with 401 and 403, so both are given.
-   */
-  constructor(code: APIErrorCode, status: number, message: string) {
+  constructor(status: APIStatus, message: string) {
     super(message);
-    this.code = code;
     this.status = status;
+    this.code = CODES[status];
   }
 }

api/lib/auth.ts

@@ -8,7 +8,6 @@
 
 import type { Context } from "@oak/oak";
 import { verifyJWT, verifyMediaToken } from "./jwt.ts";
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "./api-exception.ts";
 import type { AuthPayload } from "../model/auth.ts";
 import type { Role } from "../../shared/user.ts";
@@ -82,7 +81,7 @@ export async function parseOptionalAuth(ctx: Context): Promise<string | null> {
 
   const payload = await authenticate(token);
   if (!payload) {
-    throw new APIException(APIErrorCode.UNAUTHORIZED, 401, "Invalid token");
+    throw new APIException(401, "Invalid token");
   }
   return payload.userId;
 }

api/lib/canonical-url.ts

@@ -37,7 +37,7 @@ function isTrackingParam(key: string): boolean {
   return k.startsWith("utm_") || TRACKING_PARAMS.has(k);
 }
 
-/** YouTube's hosts, without the "www." {@link canonicalizeUrl} strips first. */
+/** YouTube's hosts, without their "www.". */
 const YOUTUBE_HOSTS = new Set([
   "youtube.com",
   "m.youtube.com",
@@ -45,13 +45,24 @@ const YOUTUBE_HOSTS = new Set([
   "youtube-nocookie.com",
 ]);
 
+/**
+ * Returns `u`'s host in lower case and without "www.", when it is one of
+ * YouTube's (youtu.be aside), and null otherwise. The YouTube preview provider
+ * uses it too, so both agree on what a YouTube link is.
+ */
+export function youtubeHost(u: URL): string | null {
+  const host = u.hostname.toLowerCase().replace(/^www\./, "");
+  return YOUTUBE_HOSTS.has(host) ? host : null;
+}
+
 /**
  * Returns the id of the video a YouTube URL points at, in any of the shapes
  * people paste (`youtu.be/ID`, `/watch?v=ID`, `/embed/ID`, `/shorts/ID`,
- * `/live/ID`). The timestamp is dropped: the same video linked at 2:30 is still
- * a repost.
+ * `/live/ID`), and null for any other URL. `host` is lower case, without
+ * "www.". The canonical key drops the timestamp, since the same video linked
+ * at 2:30 is still a repost; the YouTube provider reads it separately.
  */
-function youtubeVideoId(
+export function youtubeVideoId(
   host: string,
   pathname: string,
   params: URLSearchParams,

api/lib/jwt.ts

@@ -1,16 +1,14 @@
 /**
  * Signs and verifies the server's three kinds of token (session, media and
- * password reset), all HS256 with the one key, and hashes passwords. Only a
- * token's signature and expiry are checked here: `lib/auth.ts` checks a session
- * or media token against its user.
+ * password reset), all HS256 with the one key. Only a token's signature and
+ * expiry are checked here: `lib/auth.ts` checks a session or media token
+ * against its user.
  *
  * Importing this module throws when `GERBEUR_JWT_SECRET` is unset.
  *
  * @module
  */
 
-import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
-import { Buffer } from "node:buffer";
 import { jwtVerify, SignJWT } from "@panva/jose";
 
 import {
@@ -130,41 +128,3 @@ export async function verifyJWT(token: string): Promise<AuthPayload | null> {
     return null;
   }
 }
-
-/**
- * Hashes `password` with scrypt and a random salt, as `hash.salt` in hex, for
- * `users.password_hash`.
- */
-export function hashPassword(password: string): Promise<string> {
-  const salt = randomBytes(16).toString("hex");
-
-  return new Promise((resolve, reject) => {
-    scrypt(password, salt, 64, (err, derivedKey) => {
-      if (err) reject(err);
-      else resolve(`${derivedKey.toString("hex")}.${salt}`);
-    });
-  });
-}
-
-/** Checks `password` against a hash made by {@link hashPassword}. */
-export function verifyPassword(
-  password: string,
-  storedHash: string,
-): Promise<boolean> {
-  const [hash, salt] = storedHash.split(".");
-  // scrypt would throw on a missing salt, and a malformed hash matches nothing.
-  if (!hash || !salt) return Promise.resolve(false);
-
-  return new Promise((resolve, reject) => {
-    scrypt(password, salt, 64, (err, derivedKey) => {
-      if (err) reject(err);
-      else {
-        const expected = Buffer.from(hash ?? "", "hex");
-        resolve(
-          expected.length === derivedKey.length &&
-            timingSafeEqual(expected, derivedKey),
-        );
-      }
-    });
-  });
-}

api/lib/password.ts

@@ -0,0 +1,48 @@
+/**
+ * Hashes and checks passwords, for sign-up, sign-in, password changes and the
+ * admin that `db/startup.ts` seeds. It reads no config, so the startup tasks
+ * can use it before the server's settings are checked.
+ *
+ * @module
+ */
+
+import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+import { Buffer } from "node:buffer";
+
+/**
+ * Hashes `password` with scrypt and a random salt, as `hash.salt` in hex, for
+ * `users.password_hash`.
+ */
+export function hashPassword(password: string): Promise<string> {
+  const salt = randomBytes(16).toString("hex");
+
+  return new Promise((resolve, reject) => {
+    scrypt(password, salt, 64, (err, derivedKey) => {
+      if (err) reject(err);
+      else resolve(`${derivedKey.toString("hex")}.${salt}`);
+    });
+  });
+}
+
+/** Checks `password` against a hash made by {@link hashPassword}. */
+export function verifyPassword(
+  password: string,
+  storedHash: string,
+): Promise<boolean> {
+  const [hash, salt] = storedHash.split(".");
+  // scrypt would throw on a missing salt, and a malformed hash matches nothing.
+  if (!hash || !salt) return Promise.resolve(false);
+
+  return new Promise((resolve, reject) => {
+    scrypt(password, salt, 64, (err, derivedKey) => {
+      if (err) reject(err);
+      else {
+        const expected = Buffer.from(hash ?? "", "hex");
+        resolve(
+          expected.length === derivedKey.length &&
+            timingSafeEqual(expected, derivedKey),
+        );
+      }
+    });
+  });
+}

api/lib/static.ts

@@ -38,7 +38,8 @@ const ONE_YEAR_MS = 365 * 24 * 60 * 60 * 1000;
 export function routeStaticFilesFrom(
   staticPaths: string[],
 ): (context: Context<Record<string, object>>, next: Next) => Promise<void> {
-  return async (context: Context<Record<string, object>>, next: Next) => {
+  // The last middleware: it always answers, so it never calls `next`.
+  return async (context: Context<Record<string, object>>, _next: Next) => {
     const pathname = context.request.url.pathname;
 
     if (pathname === "/" || pathname === "/index.html") {
@@ -78,6 +79,5 @@ export function routeStaticFilesFrom(
 
     // Any other path is a client-side route, opened directly or reloaded.
     await serveIndexHtml(context, staticPaths[0]);
-    await next();
   };
 }

api/lib/upload.ts

@@ -6,31 +6,15 @@
  */
 
 import type { Context } from "@oak/oak";
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "./api-exception.ts";
 import { serveFile } from "./serve-file.ts";
-import {
-  ALLOWED_IMAGE_MIMES,
-  ATTACHMENTS_DIR,
-  AVATARS_DIR,
-  DUMPS_DIR,
-  MAX_IMAGE_SIZE_BYTES,
-  PLAYLIST_IMAGES_DIR,
-  UPLOADS_DIR,
-} from "../config.ts";
-
-export {
-  ALLOWED_IMAGE_MIMES,
-  ATTACHMENTS_DIR,
-  AVATARS_DIR,
-  DUMPS_DIR,
-  PLAYLIST_IMAGES_DIR,
-  UPLOADS_DIR,
-};
+import { dirname } from "node:path";
+import { MAX_IMAGE_SIZE_BYTES } from "../config.ts";
 
 /**
  * Returns the MIME type of a JPEG, PNG, GIF or WebP image from its magic
- * bytes, or null for anything else. The type the browser declared is never
+ * bytes, or null for anything else. These four are the only image types
+ * accepted anywhere. The type the browser declared is never
  * trusted, since the file is later served with the type found here.
  */
 export function detectImageMime(data: Uint8Array): string | null {
@@ -63,15 +47,13 @@ export function detectImageMime(data: Uint8Array): string | null {
 export function validateImageUpload(data: Uint8Array): string {
   if (data.length > MAX_IMAGE_SIZE_BYTES) {
     throw new APIException(
-      APIErrorCode.BAD_REQUEST,
       400,
-      "File too large (max 5 MB)",
+      `File too large (max ${MAX_IMAGE_SIZE_BYTES / (1024 * 1024)} MB)`,
     );
   }
   const mime = detectImageMime(data);
   if (!mime) {
     throw new APIException(
-      APIErrorCode.BAD_REQUEST,
       400,
       "File content is not a recognised image (JPEG, PNG, GIF, WebP)",
     );
@@ -104,3 +86,24 @@ export async function serveUploadedFile(
   if (!served) ctx.response.status = 404;
   return served;
 }
+
+/**
+ * Writes `data` to `filePath`, replacing whatever is there only once the whole
+ * file is written, so a failed write leaves the old file whole. The upload
+ * routes call it before recording the new file, so that clients told of it
+ * never fetch it early.
+ */
+export async function replaceUploadedFile(
+  filePath: string,
+  data: Uint8Array,
+): Promise<void> {
+  const tmpPath = `${filePath}.${crypto.randomUUID()}.tmp`;
+  await Deno.mkdir(dirname(filePath), { recursive: true });
+  try {
+    await Deno.writeFile(tmpPath, data);
+    await Deno.rename(tmpPath, filePath);
+  } catch (err) {
+    await Deno.remove(tmpPath).catch(() => {});
+    throw err;
+  }
+}