v3: fix the privacy and security findings of the comment pass — private dumps' broadcasts, mentions and attachments reached people who can't see them, and a few smaller holes. A dump's every write now goes through ws-service's broadcastDumpChange(before, after), which decides the audience: a private dump's creation, edits and deletion reach its owner's sockets alone (its deletion id went to everyone before), going private is dump_deleted for everyone else and dump_updated for the owner (whose other tabs dropped it), going public dump_created for everyone else. Mentions in a private dump, a comment on one, or a private playlist's description notify no one until it goes public (mentions are deduplicated per context, so going public notifies them once), and a moderator's edit of a comment, chat message or playlist mentions in the author's name. A link preview of a private playlist is refused, as one of a private dump already was: the preview is stored in the linking dump, which others may see. Attachments record the type of the resource that links them (migration 0018 backfills it); one linked by a private dump or playlist, or a comment on a private dump, is served only with its owner's media token, which Markdown now adds to attachment URLs, and one whose resource is gone answers 404 and is purged at startup. The Bandcamp provider claimed bandcamp.com.evil.example (the pattern wasn't anchored) and now reuses bandcamp-tralbum's anchored one; the YouTube provider took any site's ?list= for a YouTube playlist and missed m., music., youtube-nocookie and /live/ links, and now shares canonical-url's rules. Sign-in does the same scrypt work for an unknown username as for a wrong password, so timing no longer tells which exist. Usernames and emails are unique regardless of case (migration 0017, which refuses to run over existing clashes and names them): "Bob" and "bob" could both sign up and a mention picked one, emails had no constraint, and a reset request in another case silently sent nothing. The Open Graph tags escape the site name and build their URLs on PUBLIC_URL and FRONTEND_URL instead of the request's origin, which a proxy may rewrite.

Error statuses follow one rule: APIException takes a status and derives the code from it (BAD_REQUEST 400, UNAUTHORIZED 401, FORBIDDEN 403, NOT_FOUND 404, CONFLICT 409, RATE_LIMITED 429, SERVER_ERROR 500, BAD_GATEWAY 502), so a code can't contradict its status. That fixed real bugs: a wrong current password on change-password answered 401, on which authFetch signs the user out; editing or deleting someone else's comment or chat message answered 401 rather than 403; one invalid dump edit answered 422. A taken username is 409, like a taken email.

Along the way: the database is created from schema.sql by connection.ts when the file doesn't exist, so every task works on a fresh checkout (dev and serve never ran db/init.ts, which is gone); the startup purge compared ISO dates with SQLite's datetime() as text and kept anything from the current UTC day, and now compares ISO cutoffs; the seeded admin's hash comes from lib/password.ts (split out of jwt.ts, which needs the JWT secret) rather than a copy of its format; avatar, thumbnail and playlist-cover uploads go through replaceUploadedFile, which writes beside the old file and renames over it before the record announces it (a failed avatar write lost the old avatar; a thumbnail was announced before it existed); upload.ts derives its size message from MAX_IMAGE_SIZE_BYTES and stops re-exporting the upload folders; ALLOWED_IMAGE_MIMES, which duplicated detectImageMime, is gone; the SPA fallback no longer calls next() after answering; a reply must answer a comment on the same dump (a foreign or unknown parent was a 500 or a cross-dump thread). 211 backend and 628 frontend tests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/test/db/migrate.test.ts

@@ -28,14 +28,14 @@ Deno.test("runMigrations: a fresh database is left as schema.sql made it", () =>
     .get() as {
       n: number;
     };
-  assertEquals(applied.n, 16);
+  assertEquals(applied.n, 18);
   // Running again applies nothing.
   runMigrations(db);
   assertEquals(
     (db.prepare(`SELECT COUNT(*) as n FROM schema_migrations;`).get() as {
       n: number;
     }).n,
-    16,
+    18,
   );
   db.close();
 });

api/test/helpers.ts

@@ -4,7 +4,8 @@ import { TEST_DIR } from "./setup.ts";
 import { stub } from "@std/testing/mock";
 import { app } from "../main.ts";
 import { db } from "../db/connection.ts";
-import { createJWT, createMediaToken, hashPassword } from "../lib/jwt.ts";
+import { createJWT, createMediaToken } from "../lib/jwt.ts";
+import { hashPassword } from "../lib/password.ts";
 import { makeSlug } from "../lib/slugify.ts";
 import { canonicalizeUrl } from "../lib/canonical-url.ts";
 import { clearRichContentCache } from "../services/rich-content-service.ts";

api/test/lib/jwt.test.ts

@@ -1,35 +1,17 @@
 import "../setup.ts";
-import {
-  assert,
-  assertEquals,
-  assertFalse,
-  assertNotEquals,
-} from "@std/assert";
+import { assertEquals } from "@std/assert";
 import { SignJWT } from "@panva/jose";
 import {
   createJWT,
   createMediaToken,
   createPasswordResetToken,
-  hashPassword,
   verifyJWT,
   verifyMediaToken,
-  verifyPassword,
   verifyPasswordResetToken,
 } from "../../lib/jwt.ts";
 
 const KEY = new TextEncoder().encode("test-secret-test-secret-test-secret");
 
-Deno.test("hashPassword/verifyPassword round-trip with a random salt", async () => {
-  const a = await hashPassword("hunter22");
-  const b = await hashPassword("hunter22");
-  assertNotEquals(a, b);
-  assert(await verifyPassword("hunter22", a));
-  assertFalse(await verifyPassword("hunter23", a));
-  // A malformed stored hash never verifies.
-  assertFalse(await verifyPassword("hunter22", "not-a-hash"));
-  assertFalse(await verifyPassword("hunter22", ""));
-});
-
 Deno.test("session, media and reset tokens don't stand in for each other", async () => {
   const userId = crypto.randomUUID();
   const session = await createJWT({ userId, username: "u", role: "user" });

api/test/lib/password.test.ts

@@ -0,0 +1,13 @@
+import { assert, assertFalse, assertNotEquals } from "@std/assert";
+import { hashPassword, verifyPassword } from "../../lib/password.ts";
+
+Deno.test("hashPassword/verifyPassword round-trip with a random salt", async () => {
+  const a = await hashPassword("hunter22");
+  const b = await hashPassword("hunter22");
+  assertNotEquals(a, b);
+  assert(await verifyPassword("hunter22", a));
+  assertFalse(await verifyPassword("hunter23", a));
+  // A malformed stored hash never verifies.
+  assertFalse(await verifyPassword("hunter22", "not-a-hash"));
+  assertFalse(await verifyPassword("hunter22", ""));
+});

api/test/middleware/error.test.ts

@@ -2,7 +2,6 @@ import { BASE_URL } from "../helpers.ts";
 import { assertEquals } from "@std/assert";
 import { Application } from "@oak/oak";
 import { errorMiddleware } from "../../middleware/error.ts";
-import { APIErrorCode } from "../../../shared/api.ts";
 import { APIException } from "../../lib/api-exception.ts";
 
 async function handle(
@@ -20,7 +19,7 @@ Deno.test("errorMiddleware: APIExceptions keep their status, anything else is a
   app.use(errorMiddleware);
   app.use((ctx) => {
     if (ctx.request.url.pathname === "/api-error") {
-      throw new APIException(APIErrorCode.NOT_FOUND, 404, "Nope");
+      throw new APIException(404, "Nope");
     }
     throw new Error("secret internals");
   });

api/test/remote/providers/bandcamp.test.ts

@@ -1,6 +1,7 @@
 import { html, stubNetwork } from "../../helpers.ts";
-import { assertEquals } from "@std/assert";
+import { assert, assertEquals, assertFalse } from "@std/assert";
 import { fetchRichContent } from "../../../services/rich-content-service.ts";
+import { bandcampProvider } from "../../../remote/providers/bandcamp.ts";
 
 Deno.test("bandcamp provider", async () => {
   using _ = stubNetwork(() =>
@@ -12,3 +13,10 @@ Deno.test("bandcamp provider", async () => {
   assertEquals(bc?.title, "Album");
   assertEquals(bc?.embedUrl, "https://bandcamp.com/EmbeddedPlayer/album=1");
 });
+
+Deno.test("bandcamp provider: bandcamp.com and its subdomains only", () => {
+  assert(bandcampProvider.matches("https://artist.bandcamp.com/album/x"));
+  assertFalse(
+    bandcampProvider.matches("https://bandcamp.com.evil.example/album/x"),
+  );
+});

api/test/remote/providers/self.test.ts

@@ -1,4 +1,10 @@
-import { createUser, insertDump, stubNetwork, test } from "../../helpers.ts";
+import {
+  createUser,
+  insertDump,
+  insertPlaylist,
+  stubNetwork,
+  test,
+} from "../../helpers.ts";
 import { assertEquals } from "@std/assert";
 import { fetchRichContent } from "../../../services/rich-content-service.ts";
 
@@ -26,3 +32,19 @@ test("self provider: our own dump, user and playlist pages come from the DB", as
   assertEquals(profile?.title, user.username);
   assertEquals(net.calls.length, 0);
 });
+
+test("self provider: a private playlist gets no preview", async () => {
+  const user = await createUser();
+  const playlist = insertPlaylist({
+    userId: user.id,
+    title: "Secret mix",
+    isPublic: false,
+  });
+  using _net = stubNetwork(() => {
+    throw new Error("no network for self links");
+  });
+  const content = await fetchRichContent(
+    `http://gerbeur.test/playlists/${playlist.id}`,
+  );
+  assertEquals(content?.title, undefined);
+});

api/test/remote/providers/youtube.test.ts

@@ -1,6 +1,7 @@
 import { html, stubNetwork } from "../../helpers.ts";
-import { assertEquals } from "@std/assert";
+import { assert, assertEquals, assertFalse } from "@std/assert";
 import { fetchRichContent } from "../../../services/rich-content-service.ts";
+import { youtubeProvider } from "../../../remote/providers/youtube.ts";
 
 Deno.test("youtube provider: video with start time and playlist", async () => {
   using net = stubNetwork((url) =>
@@ -55,3 +56,18 @@ Deno.test("youtube provider: youtu.be, shorts, playlists and channels", async ()
   assertEquals(channel?.title, "Channel");
   assertEquals(channel?.embedUrl, undefined);
 });
+
+Deno.test("youtube provider: every YouTube host, and no other site's list", () => {
+  for (
+    const url of [
+      "https://m.youtube.com/watch?v=dQw4w9WgXcQ",
+      "https://music.youtube.com/watch?v=dQw4w9WgXcQ",
+      "https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ",
+      "https://www.youtube.com/live/dQw4w9WgXcQ",
+      "https://m.youtube.com/@someone",
+    ]
+  ) {
+    assert(youtubeProvider.matches(url), url);
+  }
+  assertFalse(youtubeProvider.matches("https://example.com/page?list=PL123"));
+});

api/test/routes/attachments.test.ts

@@ -2,6 +2,7 @@ import {
   count,
   createUser,
   db,
+  del,
   formWithFile,
   get,
   insertDump,
@@ -12,6 +13,7 @@ import {
 import type { AttachmentResponse } from "../../../shared/dump.ts";
 import type { Comment } from "../../../shared/comment.ts";
 import { assertEquals } from "@std/assert";
+import { runStartupTasks } from "../../db/startup.ts";
 
 test("attachments: upload an image, serve it back", async () => {
   const user = await createUser();
@@ -88,3 +90,48 @@ test("attachments are claimed by the first text that links them", async () => {
   });
   assertEquals(owner(), comment.data.id);
 });
+
+test("attachments in a private dump need its owner's media token", async () => {
+  const owner = await createUser();
+  const other = await createUser();
+  const up = await post<AttachmentResponse>("/api/attachments", {
+    auth: owner.auth,
+    form: formWithFile(PNG),
+  });
+  const id = up.data.id;
+  const { id: dumpId } = insertDump({ userId: owner.id, isPrivate: true });
+  await post(`/api/dumps/${dumpId}/comments`, {
+    auth: owner.auth,
+    json: { body: `![img](/api/attachments/${id})` },
+  });
+  assertEquals((await get(`/api/attachments/${id}`)).status, 404);
+  assertEquals(
+    (await get(`/api/attachments/${id}?token=${other.mediaToken}`)).status,
+    404,
+  );
+  const served = await get(`/api/attachments/${id}?token=${owner.mediaToken}`);
+  assertEquals(served.status, 200);
+  assertEquals(served.headers.get("cache-control"), "private, max-age=3600");
+});
+
+test("attachments of a deleted resource are gone, and purged at startup", async () => {
+  const user = await createUser();
+  const up = await post<AttachmentResponse>("/api/attachments", {
+    auth: user.auth,
+    form: formWithFile(PNG),
+  });
+  const id = up.data.id;
+  const { id: dumpId } = insertDump({ userId: user.id });
+  const comment = await post<Comment>(`/api/dumps/${dumpId}/comments`, {
+    auth: user.auth,
+    json: { body: `![img](/api/attachments/${id})` },
+  });
+  assertEquals((await get(`/api/attachments/${id}`)).status, 200);
+  await del(`/api/comments/${comment.data.id}`, { auth: user.auth });
+  assertEquals((await get(`/api/attachments/${id}`)).status, 404);
+  await runStartupTasks(db);
+  assertEquals(
+    count(`SELECT COUNT(*) as n FROM attachments WHERE id = ?;`, id),
+    0,
+  );
+});

api/test/routes/comments.test.ts

@@ -4,10 +4,13 @@ import {
   db,
   del,
   get,
+  html,
   insertComment,
   insertDump,
   patch,
   post,
+  put,
+  stubNetwork,
   test,
 } from "../helpers.ts";
 import { assertEquals, assertExists, assertFalse } from "@std/assert";
@@ -135,7 +138,7 @@ test("PATCH /api/comments/:id: author and moderator edit, others can't", async (
       json: { body: "x" },
     }))
       .status,
-    401,
+    403,
   );
   const edited = await patch<Comment>(`/api/comments/${commentId}`, {
     auth: author.auth,
@@ -180,7 +183,7 @@ test("DELETE /api/comments/:id soft-deletes, and a deleted comment can't be edit
   });
   assertEquals(
     (await del(`/api/comments/${commentId}`, { auth: other.auth })).status,
-    401,
+    403,
   );
   assertEquals(
     (await del(`/api/comments/${commentId}`, { auth: author.auth })).status,
@@ -264,3 +267,53 @@ test("comment likes on a private dump: owner only", async () => {
     200,
   );
 });
+
+test("comments: a reply must answer a comment on the same dump", async () => {
+  const user = await createUser();
+  const { id: a } = insertDump({ userId: user.id });
+  const { id: b } = insertDump({ userId: user.id });
+  const onB = insertComment({ dumpId: b, userId: user.id, body: "on b" });
+  for (const parentId of [onB, crypto.randomUUID()]) {
+    assertEquals(
+      (await post(`/api/dumps/${a}/comments`, {
+        auth: user.auth,
+        json: { body: "reply", parentId },
+      })).status,
+      400,
+    );
+  }
+  assertEquals(
+    count(`SELECT COUNT(*) as n FROM comments WHERE dump_id = ?;`, a),
+    0,
+  );
+});
+
+test("mentions in a private dump or its comments wait for it to go public", async () => {
+  using _net = stubNetwork(() => html("<title>Note</title>"));
+  const owner = await createUser();
+  const friend = await createUser();
+  const mentions = () =>
+    count(
+      `SELECT COUNT(*) as n FROM notifications WHERE type = 'user_mentioned' AND user_id = ?;`,
+      friend.id,
+    );
+  const dump = await post<Dump>("/api/dumps", {
+    auth: owner.auth,
+    json: {
+      url: "https://example.com/private-note",
+      comment: `for @${friend.username}`,
+      isPrivate: true,
+    },
+  });
+  assertEquals(dump.status, 201);
+  await post(`/api/dumps/${dump.data.id}/comments`, {
+    auth: owner.auth,
+    json: { body: `hey @${friend.username}` },
+  });
+  assertEquals(mentions(), 0);
+  await put(`/api/dumps/${dump.data.id}`, {
+    auth: owner.auth,
+    json: { isPrivate: false },
+  });
+  assertEquals(mentions(), 1);
+});

api/test/routes/dumps.test.ts

@@ -447,7 +447,7 @@ test("PUT /api/dumps/:id: owner and moderator may edit, others may not", async (
   assertEquals((await get<Dump>(`/api/dumps/${id}`)).data.title, "Moderated");
 });
 
-test("PUT /api/dumps/:id: invalid input is 422, a new URL refetches metadata", async () => {
+test("PUT /api/dumps/:id: invalid input is 400, a new URL refetches metadata", async () => {
   const owner = await createUser();
   const { id } = insertDump({
     userId: owner.id,
@@ -457,7 +457,7 @@ test("PUT /api/dumps/:id: invalid input is 422, a new URL refetches metadata", a
   assertEquals(
     (await put(`/api/dumps/${id}`, { auth: owner.auth, json: { title: " " } }))
       .status,
-    422,
+    400,
   );
   assertEquals(
     (await put(`/api/dumps/${id}`, {

api/test/routes/users.test.ts

@@ -339,13 +339,13 @@ test("POST /api/users/register: a taken name or email hands the invite back", as
   const inviteToken = invite(inviter.id);
   const byName = await post("/api/users/register", {
     json: {
-      username: taken.username,
+      username: taken.username.toUpperCase(),
       password: "longenough",
       email: "fresh@example.test",
       inviteToken,
     },
   });
-  assertEquals(byName.status, 400);
+  assertEquals(byName.status, 409);
   const byEmail = await post("/api/users/register", {
     json: {
       username: "fresh_name",
@@ -411,7 +411,7 @@ test("change-password: needs the current one, revokes old tokens, returns new on
     auth: user.auth,
     json: { currentPassword: "nope", newPassword: "brand-new-pass" },
   });
-  assertEquals(wrong.status, 401);
+  assertEquals(wrong.status, 403);
   const short = await post("/api/users/me/change-password", {
     auth: user.auth,
     json: { currentPassword: PASSWORD, newPassword: "short" },

api/test/routes/ws.test.ts

@@ -3,6 +3,7 @@ import {
   count,
   createUser,
   db,
+  del,
   formWithFile,
   get,
   insertComment,
@@ -507,30 +508,48 @@ wsTest("REST writes broadcast to the right audience", async (connect) => {
   const o = await connect(owner);
   const x = await connect(other);
 
-  // A public file dump arrives for everyone; a private one for no one.
+  // A public file dump arrives for everyone; a private one for its owner's
+  // other tabs alone.
   const pub = await post<Dump>("/api/dumps", {
     auth: owner.auth,
     form: formWithFile(PNG),
   });
   assertEquals((await x.next("dump_created")).dump.id, pub.data.id);
-  await post("/api/dumps", {
+  const secret = await post<Dump>("/api/dumps", {
     auth: owner.auth,
     form: formWithFile(PNG, "p.png", "image/png", { isPrivate: "true" }),
   });
+  await o.next("dump_created", (m) => m.dump.id === secret.data.id);
   await x.sync();
   assertEquals(x.all("dump_created").length, 1);
 
-  // Going private is a deletion for everyone else; going public an arrival.
+  // A private dump's edits and deletion reach its owner alone.
+  await put(`/api/dumps/${secret.data.id}`, {
+    auth: owner.auth,
+    json: { title: "Still secret" },
+  });
+  await o.next("dump_updated", (m) => m.dump.title === "Still secret");
+  await del(`/api/dumps/${secret.data.id}`, { auth: owner.auth });
+  await o.next("dump_deleted", (m) => m.dumpId === secret.data.id);
+  await x.sync();
+  assertEquals(x.all("dump_updated"), []);
+  assertEquals(x.all("dump_deleted"), []);
+
+  // Going private is a deletion for everyone else, and an update for the
+  // owner, who still has it; going public is an arrival for everyone else.
   await put(`/api/dumps/${pub.data.id}`, {
     auth: owner.auth,
     json: { isPrivate: true },
   });
   assertEquals((await x.next("dump_deleted")).dumpId, pub.data.id);
+  assert((await o.next("dump_updated")).dump.isPrivate);
   await put(`/api/dumps/${pub.data.id}`, {
     auth: owner.auth,
     json: { isPrivate: false },
   });
   await x.next("dump_created", (m) => m.dump.id === pub.data.id);
+  await o.sync();
+  assertEquals(o.all("dump_deleted").length, 1);
 
   // Comments on a private dump stay quiet.
   const priv = insertDump({ userId: owner.id, isPrivate: true });

api/test/setup.ts

@@ -1,11 +1,10 @@
 // Points the app at a throwaway database and uploads directory before any app
 // module is evaluated. api/config.ts reads the environment and api/db/connection.ts
-// opens the database at import time, so this module must be the first import
-// of every test file — directly, or as helpers.ts's first import. It imports
-// nothing from the app itself, and it is synchronous on purpose: a module with
-// a top-level await doesn't hold back the sibling imports that follow it.
-import { DatabaseSync } from "node:sqlite";
-
+// opens the database at import time, creating it from schema.sql, so this
+// module must be the first import of every test file — directly, or as
+// helpers.ts's first import. It imports nothing from the app itself, and it is
+// synchronous on purpose: a module with a top-level await doesn't hold back
+// the sibling imports that follow it.
 export const TEST_DIR = Deno.makeTempDirSync({ prefix: "gerbeur-test-" });
 
 Deno.env.set("GERBEUR_DB_PATH", `${TEST_DIR}/gerbeur.db`);
@@ -22,10 +21,3 @@ if (!Deno.env.get("TEST_VERBOSE")) {
   console.log = () => {};
   console.error = () => {};
 }
-
-// A fresh database is built from schema.sql, exactly as api/db/init.ts does.
-const db = new DatabaseSync(`${TEST_DIR}/gerbeur.db`);
-db.exec(
-  Deno.readTextFileSync(new URL("../db/schema.sql", import.meta.url)),
-);
-db.close();