v3: fix the privacy and security findings of the comment pass — private dumps' broadcasts, mentions and attachments reached people who can't see them, and a few smaller holes. A dump's every write now goes through ws-service's broadcastDumpChange(before, after), which decides the audience: a private dump's creation, edits and deletion reach its owner's sockets alone (its deletion id went to everyone before), going private is dump_deleted for everyone else and dump_updated for the owner (whose other tabs dropped it), going public dump_created for everyone else. Mentions in a private dump, a comment on one, or a private playlist's description notify no one until it goes public (mentions are deduplicated per context, so going public notifies them once), and a moderator's edit of a comment, chat message or playlist mentions in the author's name. A link preview of a private playlist is refused, as one of a private dump already was: the preview is stored in the linking dump, which others may see. Attachments record the type of the resource that links them (migration 0018 backfills it); one linked by a private dump or playlist, or a comment on a private dump, is served only with its owner's media token, which Markdown now adds to attachment URLs, and one whose resource is gone answers 404 and is purged at startup. The Bandcamp provider claimed bandcamp.com.evil.example (the pattern wasn't anchored) and now reuses bandcamp-tralbum's anchored one; the YouTube provider took any site's ?list= for a YouTube playlist and missed m., music., youtube-nocookie and /live/ links, and now shares canonical-url's rules. Sign-in does the same scrypt work for an unknown username as for a wrong password, so timing no longer tells which exist. Usernames and emails are unique regardless of case (migration 0017, which refuses to run over existing clashes and names them): "Bob" and "bob" could both sign up and a mention picked one, emails had no constraint, and a reset request in another case silently sent nothing. The Open Graph tags escape the site name and build their URLs on PUBLIC_URL and FRONTEND_URL instead of the request's origin, which a proxy may rewrite.

Error statuses follow one rule: APIException takes a status and derives the code from it (BAD_REQUEST 400, UNAUTHORIZED 401, FORBIDDEN 403, NOT_FOUND 404, CONFLICT 409, RATE_LIMITED 429, SERVER_ERROR 500, BAD_GATEWAY 502), so a code can't contradict its status. That fixed real bugs: a wrong current password on change-password answered 401, on which authFetch signs the user out; editing or deleting someone else's comment or chat message answered 401 rather than 403; one invalid dump edit answered 422. A taken username is 409, like a taken email.

Along the way: the database is created from schema.sql by connection.ts when the file doesn't exist, so every task works on a fresh checkout (dev and serve never ran db/init.ts, which is gone); the startup purge compared ISO dates with SQLite's datetime() as text and kept anything from the current UTC day, and now compares ISO cutoffs; the seeded admin's hash comes from lib/password.ts (split out of jwt.ts, which needs the JWT secret) rather than a copy of its format; avatar, thumbnail and playlist-cover uploads go through replaceUploadedFile, which writes beside the old file and renames over it before the record announces it (a failed avatar write lost the old avatar; a thumbnail was announced before it existed); upload.ts derives its size message from MAX_IMAGE_SIZE_BYTES and stops re-exporting the upload folders; ALLOWED_IMAGE_MIMES, which duplicated detectImageMime, is gone; the SPA fallback no longer calls next() after answering; a reply must answer a comment on the same dump (a foreign or unknown parent was a 500 or a cross-dump thread). 211 backend and 628 frontend tests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -135,10 +135,9 @@ api/
   validators/      # Per domain: request body guards
   lib/             # Helpers with no SQL and no outbound fetch: JWT, slugs, files, …
   db/
-    connection.ts  # The database handle and transaction()
+    connection.ts  # The database handle and transaction(); creates a new database
     startup.ts     # Housekeeping run when the database opens
     schema.sql     # Database schema
-    init.ts        # First-run database initialisation
     migrate.ts     # Migration runner
     migrations/    # Versioned schema migrations
   test/            # Backend tests (Deno): test/<layer>/<module>.test.ts

api/config.ts

@@ -56,11 +56,13 @@ export const PUBLIC_URL: string =
   `http://localhost:${PORT}`;
 /**
  * The URL the frontend is served from (`GERBEUR_FRONTEND_URL`), when it isn't
- * {@link PUBLIC_URL}, as with a separate Vite server. It is an allowed origin,
+ * {@link PUBLIC_URL}, as with a separate Vite server, without a trailing slash.
- * and password reset links point to it.
+ * It is an allowed origin, and password reset links and the Open Graph tags'
+ * page URLs point to it.
  */
 export const FRONTEND_URL: string =
-  Deno.env.get("GERBEUR_FRONTEND_URL")?.trim() || PUBLIC_URL;
+  Deno.env.get("GERBEUR_FRONTEND_URL")?.trim().replace(/\/$/, "") ||
+  PUBLIC_URL;
 /**
  * The SQLite database file (`GERBEUR_DB_PATH`). api/test/setup.ts points it at
  * a throwaway file before anything opens the database.
@@ -93,17 +95,10 @@ export const ATTACHMENTS_DIR = `${UPLOADS_DIR}/attachments`;
 export const THUMBNAILS_DIR = `${UPLOADS_DIR}/thumbnails`;
 
 /**
- * The largest image upload accepted, in bytes. lib/upload.ts's error message
+ * The largest image upload accepted, in bytes, for avatars, covers, thumbnails
- * says "5 MB", so the two change together.
+ * and attachments. lib/upload.ts states it in megabytes in its error.
  */
 export const MAX_IMAGE_SIZE_BYTES = 5 * 1024 * 1024;
-/** The image types accepted for avatars, covers, thumbnails and attachments. */
-export const ALLOWED_IMAGE_MIMES: Set<string> = new Set([
-  "image/jpeg",
-  "image/png",
-  "image/gif",
-  "image/webp",
-]);
 
 /**
  * The MIME type prefixes a file dump may have. dump-service also accepts the

api/db/connection.ts

@@ -1,7 +1,8 @@
 /**
- * Opens the database at {@link DB_PATH} when first imported, applies the
+ * Opens the database at {@link DB_PATH} when first imported, creating it from
- * pending migrations and runs the startup tasks before any importer runs. Only
+ * schema.sql if the file doesn't exist, then applies the pending migrations
- * the services import it.
+ * and runs the startup tasks before any importer runs. Only the services
+ * import it.
  *
  * @module
  */
@@ -11,11 +12,20 @@ import { DB_PATH } from "../config.ts";
 import { runMigrations } from "./migrate.ts";
 import { runStartupTasks } from "./startup.ts";
 
+const isNew = await Deno.stat(DB_PATH).then(() => false, () => true);
+
 /**
  * The server's only connection. Its queries are synchronous, so each one
  * blocks the event loop while it runs.
  */
 export const db: DatabaseSync = new DatabaseSync(DB_PATH);
+// schema.sql holds every migration's change, so on a new database each
+// migration below finds its work done and is only recorded.
+if (isNew) {
+  db.exec(
+    await Deno.readTextFile(new URL("./schema.sql", import.meta.url)),
+  );
+}
 // WAL lets readers run alongside a writer, and with synchronous = NORMAL a
 // commit doesn't wait on an fsync: a power loss can lose the last commits but
 // never corrupts the file. busy_timeout makes another connection to the file

api/db/init.ts

@@ -1,23 +0,0 @@
-/**
- * Creates the database from schema.sql when {@link DB_PATH} doesn't exist yet,
- * and leaves an existing one alone. `deno task start` runs it before the
- * server, which then runs every migration on the new file: schema.sql already
- * holds their changes, so each one finds nothing to do.
- *
- * @module
- */
-
-import { DatabaseSync } from "node:sqlite";
-import { DB_PATH } from "../config.ts";
-
-try {
-  await Deno.stat(DB_PATH);
-  console.log("Database already exists, skipping initialization.");
-} catch {
-  console.log("Initializing database from schema...");
-  const schema = Deno.readTextFileSync("api/db/schema.sql");
-  const db = new DatabaseSync(DB_PATH);
-  db.exec(schema);
-  db.close();
-  console.log("Database initialized.");
-}

api/db/migrate.ts

@@ -23,6 +23,8 @@ import { up as up0013DumpUrlCanonical } from "./migrations/0013_dump_url_canonic
 import { up as up0014ChatReadState } from "./migrations/0014_chat_read_state.ts";
 import { up as up0015TokenRevocation } from "./migrations/0015_token_revocation.ts";
 import { up as up0016PerformanceIndexes } from "./migrations/0016_performance_indexes.ts";
+import { up as up0017CaseInsensitiveUsers } from "./migrations/0017_case_insensitive_users.ts";
+import { up as up0018AttachmentResourceType } from "./migrations/0018_attachment_resource_type.ts";
 
 interface Migration {
   name: string;
@@ -32,8 +34,8 @@ interface Migration {
 /**
  * Every migration, in the order they run. A new one goes at the end, along
  * with the same change to schema.sql, and a shipped one is never edited or
- * moved. A database made by init.ts records none of them, so each `up` must
+ * moved. A database connection.ts made from schema.sql records none of them,
- * find its change already made and leave it be.
+ * so each `up` must find its change already made and leave it be.
  */
 const MIGRATIONS: Migration[] = [
   { name: "0001_comment_likes", up: up0001CommentLikes },
@@ -55,6 +57,11 @@ const MIGRATIONS: Migration[] = [
   { name: "0014_chat_read_state", up: up0014ChatReadState },
   { name: "0015_token_revocation", up: up0015TokenRevocation },
   { name: "0016_performance_indexes", up: up0016PerformanceIndexes },
+  { name: "0017_case_insensitive_users", up: up0017CaseInsensitiveUsers },
+  {
+    name: "0018_attachment_resource_type",
+    up: up0018AttachmentResourceType,
+  },
 ];
 
 /**

api/db/migrations/0017_case_insensitive_users.ts

@@ -0,0 +1,36 @@
+/**
+ * Makes usernames and emails unique regardless of case. Usernames were unique
+ * only as typed, so "Bob" and "bob" could both sign up, and a mention, which
+ * looks names up in lower case, then reached one of them at random. Emails
+ * had no constraint at all: two sign-ups racing past the service's check could
+ * share an address, and password resets are looked up by address.
+ *
+ * @module
+ */
+
+import type { DatabaseSync } from "node:sqlite";
+
+/**
+ * Run once by `runMigrations`. It refuses to run, naming the clashes, when two
+ * accounts already share a name or an address in some case: which one keeps
+ * it is for whoever runs the site to decide, by editing one of them.
+ */
+export function up(db: DatabaseSync): void {
+  for (const column of ["username", "email"]) {
+    const clashes = db.prepare(
+      `SELECT lower(${column}) AS value FROM users GROUP BY lower(${column}) HAVING COUNT(*) > 1;`,
+    ).all() as { value: string }[];
+    if (clashes.length > 0) {
+      throw new Error(
+        `Several accounts share a ${column} in different cases: ${
+          clashes.map((c) => c.value).join(", ")
+        }. Change all but one of each, then restart.`,
+      );
+    }
+  }
+  db.exec(`
+    DROP INDEX IF EXISTS idx_users_username_lower;
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_users_username_lower ON users(lower(username));
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_users_email_lower    ON users(lower(email));
+  `);
+}

api/db/migrations/0018_attachment_resource_type.ts

@@ -0,0 +1,34 @@
+/**
+ * Adds `attachments.resource_type`, the kind of thing an attachment's
+ * `resource_id` names. Without it, an attachment couldn't tell whose it was:
+ * one pasted into a private dump was served to anyone with its URL, and one
+ * whose dump, comment or message was deleted was kept for good.
+ *
+ * @module
+ */
+
+import type { DatabaseSync } from "node:sqlite";
+
+/**
+ * Run once by `runMigrations`. Existing bound attachments get the type of the
+ * table that holds their resource; one whose resource is gone gets none, and
+ * the startup purge deletes it. A database made from schema.sql already has
+ * the column.
+ */
+export function up(db: DatabaseSync): void {
+  const cols = db.prepare(`PRAGMA table_info(attachments);`).all() as {
+    name: string;
+  }[];
+  if (cols.some((c) => c.name === "resource_type")) return;
+  db.exec(`
+    ALTER TABLE attachments ADD COLUMN resource_type TEXT;
+    UPDATE attachments SET resource_type = CASE
+      WHEN resource_id IN (SELECT id FROM dumps)         THEN 'dump'
+      WHEN resource_id IN (SELECT id FROM comments)      THEN 'comment'
+      WHEN resource_id IN (SELECT id FROM playlists)     THEN 'playlist'
+      WHEN resource_id IN (SELECT id FROM chat_messages) THEN 'chat'
+      WHEN resource_id IN (SELECT id FROM users)         THEN 'user'
+    END
+    WHERE resource_id IS NOT NULL;
+  `);
+}

api/db/schema.sql

@@ -175,13 +175,15 @@ CREATE TABLE invites (
 
 CREATE INDEX idx_invites_inviter ON invites(inviter_id);
 CREATE INDEX idx_users_invited_by ON users(invited_by);
-CREATE INDEX idx_users_username_lower ON users(lower(username));
+CREATE UNIQUE INDEX idx_users_username_lower ON users(lower(username));
+CREATE UNIQUE INDEX idx_users_email_lower ON users(lower(email));
 
 CREATE TABLE attachments (
   id          TEXT PRIMARY KEY,
   resource_id TEXT,
   mime        TEXT NOT NULL,
-  created_at  TEXT NOT NULL
+  created_at  TEXT NOT NULL,
+  resource_type TEXT
 );
 
 CREATE INDEX idx_attachments_resource ON attachments(resource_id);

api/db/startup.ts

@@ -5,41 +5,61 @@
  * @module
  */
 
-import { randomBytes, scryptSync } from "node:crypto";
 import type { DatabaseSync } from "node:sqlite";
 import {
   ATTACHMENTS_DIR,
   ORPHANED_ATTACHMENTS_RETENTION_HOURS,
   UNUSED_INVITES_RETENTION_DAYS,
 } from "../config.ts";
+import { hashPassword } from "../lib/password.ts";
+
+/** Returns the time `ms` ago as an ISO string, the format dates are stored in. */
+function isoAgo(ms: number): string {
+  return new Date(Date.now() - ms).toISOString();
+}
 
 /**
  * Runs after the migrations, each time the server starts. It deletes used or
- * expired reset tokens, invites past their validity and attachments nothing
+ * expired reset tokens, invites past their validity, and attachments nothing
- * links to. On an instance with no users, it creates the user `admin` with the
+ * links to or whose resource is gone. On an instance with no users, it creates the user `admin` with the
  * password `admin`, which whoever installs it must change.
  */
 export async function runStartupTasks(db: DatabaseSync): Promise<void> {
+  // Dates are stored as ISO strings and compared as text, so the cutoffs are
+  // ISO strings too. SQLite's datetime() has a space where ISO has a `T`.
   db.prepare(
-    `DELETE FROM password_reset_tokens WHERE expires_at < datetime('now') OR used_at IS NOT NULL;`,
+    `DELETE FROM password_reset_tokens WHERE expires_at < ? OR used_at IS NOT NULL;`,
-  ).run();
+  ).run(isoAgo(0));
 
   db.prepare(
-    `DELETE FROM invites WHERE used_at IS NULL AND created_at < datetime('now', '-${UNUSED_INVITES_RETENTION_DAYS} days');`,
+    `DELETE FROM invites WHERE used_at IS NULL AND created_at < ?;`,
-  ).run();
+  ).run(isoAgo(UNUSED_INVITES_RETENTION_DAYS * 86_400_000));
 
   // An image is uploaded as soon as it's pasted, and linked only when the text
-  // it's pasted into is saved, so a fresh one is left alone.
+  // it's pasted into is saved, so a fresh unlinked one is left alone. One whose
+  // dump, comment, playlist, message or user is gone goes whatever its age.
+  const attachmentCutoff = isoAgo(
+    ORPHANED_ATTACHMENTS_RETENTION_HOURS * 3_600_000,
+  );
+  const ORPHANED = `
+    (resource_id IS NULL AND created_at < ?)
+    OR (resource_id IS NOT NULL AND NOT CASE resource_type
+      WHEN 'dump'     THEN EXISTS (SELECT 1 FROM dumps WHERE id = resource_id)
+      WHEN 'comment'  THEN EXISTS (SELECT 1 FROM comments WHERE id = resource_id AND deleted = 0)
+      WHEN 'playlist' THEN EXISTS (SELECT 1 FROM playlists WHERE id = resource_id)
+      WHEN 'chat'     THEN EXISTS (SELECT 1 FROM chat_messages WHERE id = resource_id)
+      WHEN 'user'     THEN EXISTS (SELECT 1 FROM users WHERE id = resource_id)
+      ELSE 0
+    END)`;
   const orphanedAttachments = db.prepare(
-    `SELECT id FROM attachments WHERE resource_id IS NULL AND created_at < datetime('now', '-${ORPHANED_ATTACHMENTS_RETENTION_HOURS} hour');`,
+    `SELECT id FROM attachments WHERE ${ORPHANED};`,
-  ).all() as { id: string }[];
+  ).all(attachmentCutoff) as { id: string }[];
   if (orphanedAttachments.length > 0) {
     for (const { id } of orphanedAttachments) {
       await Deno.remove(`${ATTACHMENTS_DIR}/${id}`).catch(() => {});
     }
-    db.prepare(
+    db.prepare(`DELETE FROM attachments WHERE ${ORPHANED};`)
-      `DELETE FROM attachments WHERE resource_id IS NULL AND created_at < datetime('now', '-${ORPHANED_ATTACHMENTS_RETENTION_HOURS} hour');`,
+      .run(attachmentCutoff);
-    ).run();
   }
 
   // Registration needs an invite, so the first user can only come from here.
@@ -47,13 +67,9 @@ export async function runStartupTasks(db: DatabaseSync): Promise<void> {
     count: number;
   };
   if (userCount.count === 0) {
-    // The format of hashPassword in lib/jwt.ts, which verifies it.
-    const salt = randomBytes(16).toString("hex");
-    const hash = scryptSync("admin", salt, 64).toString("hex");
-    const passwordHash = `${hash}.${salt}`;
     db.prepare(
-      `INSERT INTO users (id, username, password_hash, role, created_at, email) VALUES (?, 'admin', ?, 'admin', datetime('now'), 'admin@localhost')`,
+      `INSERT INTO users (id, username, password_hash, role, created_at, email) VALUES (?, 'admin', ?, 'admin', ?, 'admin@localhost')`,
-    ).run(crypto.randomUUID(), passwordHash);
+    ).run(crypto.randomUUID(), await hashPassword("admin"), isoAgo(0));
     console.log(
       "Created default admin user (username: admin, password: admin)",
     );

api/lib/api-exception.ts

@@ -5,24 +5,36 @@
  * @module
  */
 
-import type { APIErrorCode } from "../../shared/api.ts";
+import { APIErrorCode } from "../../shared/api.ts";
+
+/** Passed to an {@link APIException}; any other status is a type error. */
+export type APIStatus = 400 | 401 | 403 | 404 | 409 | 429 | 500 | 502;
+
+const CODES: Record<APIStatus, APIErrorCode> = {
+  400: APIErrorCode.BAD_REQUEST,
+  401: APIErrorCode.UNAUTHORIZED,
+  403: APIErrorCode.FORBIDDEN,
+  404: APIErrorCode.NOT_FOUND,
+  409: APIErrorCode.CONFLICT,
+  429: APIErrorCode.RATE_LIMITED,
+  500: APIErrorCode.SERVER_ERROR,
+  502: APIErrorCode.BAD_GATEWAY,
+};
 
 /**
  * Thrown by a route, a service or a remote fetch to answer the request with an
  * error. The error middleware sends it as an `APIFailure`, message included,
- * so the message must be fit for the user.
+ * so the message must be fit for the user. Use 401 for a caller who isn't
+ * signed in, 403 for one who is but may not, and 404 rather than 403 when the
+ * caller mustn't learn that the thing exists.
  */
 export class APIException extends Error {
   readonly code: APIErrorCode;
-  readonly status: number;
+  readonly status: APIStatus;
 
-  /**
+  constructor(status: APIStatus, message: string) {
-   * Creates the exception. A code goes with several statuses, as
-   * `UNAUTHORIZED` does with 401 and 403, so both are given.
-   */
-  constructor(code: APIErrorCode, status: number, message: string) {
     super(message);
-    this.code = code;
     this.status = status;
+    this.code = CODES[status];
   }
 }

api/lib/auth.ts

@@ -8,7 +8,6 @@
 
 import type { Context } from "@oak/oak";
 import { verifyJWT, verifyMediaToken } from "./jwt.ts";
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "./api-exception.ts";
 import type { AuthPayload } from "../model/auth.ts";
 import type { Role } from "../../shared/user.ts";
@@ -82,7 +81,7 @@ export async function parseOptionalAuth(ctx: Context): Promise<string | null> {
 
   const payload = await authenticate(token);
   if (!payload) {
-    throw new APIException(APIErrorCode.UNAUTHORIZED, 401, "Invalid token");
+    throw new APIException(401, "Invalid token");
   }
   return payload.userId;
 }

api/lib/canonical-url.ts

@@ -37,7 +37,7 @@ function isTrackingParam(key: string): boolean {
   return k.startsWith("utm_") || TRACKING_PARAMS.has(k);
 }
 
-/** YouTube's hosts, without the "www." {@link canonicalizeUrl} strips first. */
+/** YouTube's hosts, without their "www.". */
 const YOUTUBE_HOSTS = new Set([
   "youtube.com",
   "m.youtube.com",
@@ -45,13 +45,24 @@ const YOUTUBE_HOSTS = new Set([
   "youtube-nocookie.com",
 ]);
 
+/**
+ * Returns `u`'s host in lower case and without "www.", when it is one of
+ * YouTube's (youtu.be aside), and null otherwise. The YouTube preview provider
+ * uses it too, so both agree on what a YouTube link is.
+ */
+export function youtubeHost(u: URL): string | null {
+  const host = u.hostname.toLowerCase().replace(/^www\./, "");
+  return YOUTUBE_HOSTS.has(host) ? host : null;
+}
+
 /**
  * Returns the id of the video a YouTube URL points at, in any of the shapes
  * people paste (`youtu.be/ID`, `/watch?v=ID`, `/embed/ID`, `/shorts/ID`,
- * `/live/ID`). The timestamp is dropped: the same video linked at 2:30 is still
+ * `/live/ID`), and null for any other URL. `host` is lower case, without
- * a repost.
+ * "www.". The canonical key drops the timestamp, since the same video linked
+ * at 2:30 is still a repost; the YouTube provider reads it separately.
  */
-function youtubeVideoId(
+export function youtubeVideoId(
   host: string,
   pathname: string,
   params: URLSearchParams,

api/lib/jwt.ts

@@ -1,16 +1,14 @@
 /**
  * Signs and verifies the server's three kinds of token (session, media and
- * password reset), all HS256 with the one key, and hashes passwords. Only a
+ * password reset), all HS256 with the one key. Only a token's signature and
- * token's signature and expiry are checked here: `lib/auth.ts` checks a session
+ * expiry are checked here: `lib/auth.ts` checks a session or media token
- * or media token against its user.
+ * against its user.
  *
  * Importing this module throws when `GERBEUR_JWT_SECRET` is unset.
  *
  * @module
  */
 
-import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
-import { Buffer } from "node:buffer";
 import { jwtVerify, SignJWT } from "@panva/jose";
 
 import {
@@ -130,41 +128,3 @@ export async function verifyJWT(token: string): Promise<AuthPayload | null> {
     return null;
   }
 }
-
-/**
- * Hashes `password` with scrypt and a random salt, as `hash.salt` in hex, for
- * `users.password_hash`.
- */
-export function hashPassword(password: string): Promise<string> {
-  const salt = randomBytes(16).toString("hex");
-
-  return new Promise((resolve, reject) => {
-    scrypt(password, salt, 64, (err, derivedKey) => {
-      if (err) reject(err);
-      else resolve(`${derivedKey.toString("hex")}.${salt}`);
-    });
-  });
-}
-
-/** Checks `password` against a hash made by {@link hashPassword}. */
-export function verifyPassword(
-  password: string,
-  storedHash: string,
-): Promise<boolean> {
-  const [hash, salt] = storedHash.split(".");
-  // scrypt would throw on a missing salt, and a malformed hash matches nothing.
-  if (!hash || !salt) return Promise.resolve(false);
-
-  return new Promise((resolve, reject) => {
-    scrypt(password, salt, 64, (err, derivedKey) => {
-      if (err) reject(err);
-      else {
-        const expected = Buffer.from(hash ?? "", "hex");
-        resolve(
-          expected.length === derivedKey.length &&
-            timingSafeEqual(expected, derivedKey),
-        );
-      }
-    });
-  });
-}

api/lib/password.ts

@@ -0,0 +1,48 @@
+/**
+ * Hashes and checks passwords, for sign-up, sign-in, password changes and the
+ * admin that `db/startup.ts` seeds. It reads no config, so the startup tasks
+ * can use it before the server's settings are checked.
+ *
+ * @module
+ */
+
+import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+import { Buffer } from "node:buffer";
+
+/**
+ * Hashes `password` with scrypt and a random salt, as `hash.salt` in hex, for
+ * `users.password_hash`.
+ */
+export function hashPassword(password: string): Promise<string> {
+  const salt = randomBytes(16).toString("hex");
+
+  return new Promise((resolve, reject) => {
+    scrypt(password, salt, 64, (err, derivedKey) => {
+      if (err) reject(err);
+      else resolve(`${derivedKey.toString("hex")}.${salt}`);
+    });
+  });
+}
+
+/** Checks `password` against a hash made by {@link hashPassword}. */
+export function verifyPassword(
+  password: string,
+  storedHash: string,
+): Promise<boolean> {
+  const [hash, salt] = storedHash.split(".");
+  // scrypt would throw on a missing salt, and a malformed hash matches nothing.
+  if (!hash || !salt) return Promise.resolve(false);
+
+  return new Promise((resolve, reject) => {
+    scrypt(password, salt, 64, (err, derivedKey) => {
+      if (err) reject(err);
+      else {
+        const expected = Buffer.from(hash ?? "", "hex");
+        resolve(
+          expected.length === derivedKey.length &&
+            timingSafeEqual(expected, derivedKey),
+        );
+      }
+    });
+  });
+}

api/lib/static.ts

@@ -38,7 +38,8 @@ const ONE_YEAR_MS = 365 * 24 * 60 * 60 * 1000;
 export function routeStaticFilesFrom(
   staticPaths: string[],
 ): (context: Context<Record<string, object>>, next: Next) => Promise<void> {
-  return async (context: Context<Record<string, object>>, next: Next) => {
+  // The last middleware: it always answers, so it never calls `next`.
+  return async (context: Context<Record<string, object>>, _next: Next) => {
     const pathname = context.request.url.pathname;
 
     if (pathname === "/" || pathname === "/index.html") {
@@ -78,6 +79,5 @@ export function routeStaticFilesFrom(
 
     // Any other path is a client-side route, opened directly or reloaded.
     await serveIndexHtml(context, staticPaths[0]);
-    await next();
   };
 }

api/lib/upload.ts

@@ -6,31 +6,15 @@
  */
 
 import type { Context } from "@oak/oak";
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "./api-exception.ts";
 import { serveFile } from "./serve-file.ts";
-import {
+import { dirname } from "node:path";
-  ALLOWED_IMAGE_MIMES,
+import { MAX_IMAGE_SIZE_BYTES } from "../config.ts";
-  ATTACHMENTS_DIR,
-  AVATARS_DIR,
-  DUMPS_DIR,
-  MAX_IMAGE_SIZE_BYTES,
-  PLAYLIST_IMAGES_DIR,
-  UPLOADS_DIR,
-} from "../config.ts";
-
-export {
-  ALLOWED_IMAGE_MIMES,
-  ATTACHMENTS_DIR,
-  AVATARS_DIR,
-  DUMPS_DIR,
-  PLAYLIST_IMAGES_DIR,
-  UPLOADS_DIR,
-};
 
 /**
  * Returns the MIME type of a JPEG, PNG, GIF or WebP image from its magic
- * bytes, or null for anything else. The type the browser declared is never
+ * bytes, or null for anything else. These four are the only image types
+ * accepted anywhere. The type the browser declared is never
  * trusted, since the file is later served with the type found here.
  */
 export function detectImageMime(data: Uint8Array): string | null {
@@ -63,15 +47,13 @@ export function detectImageMime(data: Uint8Array): string | null {
 export function validateImageUpload(data: Uint8Array): string {
   if (data.length > MAX_IMAGE_SIZE_BYTES) {
     throw new APIException(
-      APIErrorCode.BAD_REQUEST,
       400,
-      "File too large (max 5 MB)",
+      `File too large (max ${MAX_IMAGE_SIZE_BYTES / (1024 * 1024)} MB)`,
     );
   }
   const mime = detectImageMime(data);
   if (!mime) {
     throw new APIException(
-      APIErrorCode.BAD_REQUEST,
       400,
       "File content is not a recognised image (JPEG, PNG, GIF, WebP)",
     );
@@ -104,3 +86,24 @@ export async function serveUploadedFile(
   if (!served) ctx.response.status = 404;
   return served;
 }
+
+/**
+ * Writes `data` to `filePath`, replacing whatever is there only once the whole
+ * file is written, so a failed write leaves the old file whole. The upload
+ * routes call it before recording the new file, so that clients told of it
+ * never fetch it early.
+ */
+export async function replaceUploadedFile(
+  filePath: string,
+  data: Uint8Array,
+): Promise<void> {
+  const tmpPath = `${filePath}.${crypto.randomUUID()}.tmp`;
+  await Deno.mkdir(dirname(filePath), { recursive: true });
+  try {
+    await Deno.writeFile(tmpPath, data);
+    await Deno.rename(tmpPath, filePath);
+  } catch (err) {
+    await Deno.remove(tmpPath).catch(() => {});
+    throw err;
+  }
+}

api/middleware/auth.ts

@@ -13,7 +13,6 @@ import {
   type State,
 } from "@oak/oak";
 import { authenticate } from "../lib/auth.ts";
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import type { AuthPayload } from "../model/auth.ts";
 import { can } from "../lib/permissions.ts";
@@ -49,18 +48,14 @@ export async function authMiddleware<R extends string>(
   const authHeader = ctx.request.headers.get("Authorization");
 
   if (!authHeader || !authHeader.startsWith("Bearer ")) {
-    throw new APIException(
+    throw new APIException(401, "Missing or invalid token");
-      APIErrorCode.UNAUTHORIZED,
-      401,
-      "Missing or invalid token",
-    );
   }
 
   const token = authHeader.substring(7);
   const payload = await authenticate(token);
 
   if (!payload) {
-    throw new APIException(APIErrorCode.UNAUTHORIZED, 401, "Invalid token");
+    throw new APIException(401, "Invalid token");
   }
 
   ctx.state.user = payload;
@@ -79,11 +74,7 @@ export async function adminOnlyMiddleware<R extends string>(
   next: Next,
 ): Promise<void> {
   if (ctx.state.user.role !== "admin") {
-    throw new APIException(
+    throw new APIException(403, "Admin access required");
-      APIErrorCode.UNAUTHORIZED,
-      403,
-      "Admin access required",
-    );
   }
 
   await next();
@@ -104,11 +95,7 @@ export function requirePermission(
     next: Next,
   ): Promise<void> => {
     if (!ctx.state.user || !can(ctx.state.user, permission)) {
-      throw new APIException(
+      throw new APIException(403, "Insufficient permissions");
-        APIErrorCode.UNAUTHORIZED,
-        403,
-        "Insufficient permissions",
-      );
     }
     await next();
   };

api/middleware/og.ts

@@ -11,7 +11,7 @@ import { Context, Next } from "@oak/oak";
 import { getDump } from "../services/dump-service.ts";
 import { getUserByUsername } from "../services/user-service.ts";
 import { getPlaylistById } from "../services/playlist-service.ts";
-import { OG_SITE_NAME } from "../config.ts";
+import { FRONTEND_URL, OG_SITE_NAME, PUBLIC_URL } from "../config.ts";
 import { loadIndexHtml } from "../lib/index-html.ts";
 
 interface OGMeta {
@@ -40,7 +40,7 @@ function buildTags(meta: OGMeta): string {
     : "summary";
   const tags = [
     `<title>${escapeAttr(meta.title)}</title>`,
-    `<meta property="og:site_name" content="${OG_SITE_NAME}" />`,
+    `<meta property="og:site_name" content="${escapeAttr(OG_SITE_NAME)}" />`,
     `<meta property="og:type" content="website" />`,
     `<meta property="og:url" content="${escapeAttr(meta.url)}" />`,
     `<meta property="og:title" content="${escapeAttr(meta.title)}" />`,
@@ -91,7 +91,9 @@ const PLAYLIST_RE = /^\/playlists\/([^/]+)$/;
 /**
  * Serves `index.html` with the tags of the dump, user or public playlist a
  * path names, and passes the request on when it names none that exists or
- * the visitor may see. The tags' URLs are built on the request's origin.
+ * the visitor may see. The page's URL is on `FRONTEND_URL` and the images' on
+ * `PUBLIC_URL`, not on the request's origin, which a reverse proxy may have
+ * rewritten to an internal host or plain http.
  */
 export async function ogMiddleware(
   ctx: Context,
@@ -103,8 +105,8 @@ export async function ogMiddleware(
     return await next();
   }
 
-  const origin = ctx.request.url.origin;
+  const origin = PUBLIC_URL;
-  const pageUrl = `${origin}${pathname}`;
+  const pageUrl = `${FRONTEND_URL}${pathname}`;
 
   let meta: OGMeta | null = null;
 

api/remote/bandcamp-streams.ts

@@ -8,7 +8,6 @@
  * @module
  */
 
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import { fetchWithTimeout, isValidHttpUrl, readTextCapped } from "./fetch.ts";
 import { BANDCAMP_HOST_RE, parseTralbum } from "./bandcamp-tralbum.ts";
@@ -73,25 +72,17 @@ export async function resolveBandcamp(
   { force = false }: { force?: boolean } = {},
 ): Promise<Tralbum> {
   if (!isValidHttpUrl(pageUrl)) {
-    throw new APIException(
+    throw new APIException(400, "Invalid URL");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Invalid URL",
-    );
   }
 
   let hostname: string;
   try {
     hostname = new URL(pageUrl).hostname;
   } catch {
-    throw new APIException(APIErrorCode.VALIDATION_ERROR, 400, "Invalid URL");
+    throw new APIException(400, "Invalid URL");
   }
   if (!BANDCAMP_HOST_RE.test(hostname)) {
-    throw new APIException(
+    throw new APIException(400, "Not a Bandcamp URL");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Not a Bandcamp URL",
-    );
   }
 
   const key = cacheKey(pageUrl);
@@ -104,40 +95,24 @@ export async function resolveBandcamp(
   try {
     res = await fetchWithTimeout(pageUrl, 8000);
   } catch {
-    throw new APIException(
+    throw new APIException(502, "Could not reach Bandcamp");
-      APIErrorCode.SERVER_ERROR,
-      502,
-      "Could not reach Bandcamp",
-    );
   }
   // A body left unread keeps its connection open until GC, and this endpoint
   // is public: every early return cancels it.
   if (!res.ok) {
     await res.body?.cancel();
-    throw new APIException(
+    throw new APIException(502, `Bandcamp returned ${res.status}`);
-      APIErrorCode.SERVER_ERROR,
-      502,
-      `Bandcamp returned ${res.status}`,
-    );
   }
   if (!(res.headers.get("content-type") ?? "").startsWith("text/html")) {
     await res.body?.cancel();
-    throw new APIException(
+    throw new APIException(502, "Bandcamp did not return a page");
-      APIErrorCode.SERVER_ERROR,
-      502,
-      "Bandcamp did not return a page",
-    );
   }
 
   const parsed = parseTralbum(await readTextCapped(res), pageUrl);
   if (!parsed) {
     // No data, no audio or nothing streamable yet (a preorder). The client
     // plays the embed instead.
-    throw new APIException(
+    throw new APIException(404, "No streamable tracks on this page");
-      APIErrorCode.NOT_FOUND,
-      404,
-      "No streamable tracks on this page",
-    );
   }
 
   writeCache(key, parsed);

api/remote/providers/bandcamp.ts

@@ -9,13 +9,11 @@ import type { RichContent } from "../../../shared/dump.ts";
 import type { RichContentProvider } from "./provider.ts";
 import { extractOgTag } from "../html.ts";
 import { fetchWithTimeout, readTextCapped } from "../fetch.ts";
-
+import { BANDCAMP_HOST_RE } from "../bandcamp-tralbum.ts";
-const BANDCAMP_REGEX = /(?:^|\.)bandcamp\.com/;
 
 /**
- * Claims bandcamp.com and its subdomains, and `bandcamp.com.example.org` too,
+ * Claims bandcamp.com and its subdomains, where artists have their pages. Takes
- * since the pattern isn't anchored at the end. Takes the embed player's URL
+ * the embed player's URL from the page's `og:video`. The native player fetches the page's streams
- * from the page's `og:video`. The native player fetches the page's streams
  * itself at play time, through `GET /api/bandcamp/tracks`.
  */
 export const bandcampProvider: RichContentProvider = {
@@ -23,7 +21,7 @@ export const bandcampProvider: RichContentProvider = {
 
   matches(url: string): boolean {
     try {
-      return BANDCAMP_REGEX.test(new URL(url).hostname);
+      return BANDCAMP_HOST_RE.test(new URL(url).hostname);
     } catch {
       return false;
     }

api/remote/providers/self.ts

@@ -11,6 +11,7 @@ import type { RichContentProvider } from "./provider.ts";
 import { getDump } from "../../services/dump-service.ts";
 import { getUserByUsername } from "../../services/user-service.ts";
 import { getPlaylistById } from "../../services/playlist-service.ts";
+import { APIException } from "../../lib/api-exception.ts";
 import { PUBLIC_URL, THEME_COLOR } from "../../config.ts";
 import { isSelfUrl } from "../../lib/self-url.ts";
 
@@ -30,8 +31,9 @@ const SELF_BRANDING = {
 
 /**
  * Comes before the generic provider, and claims what `isSelfUrl` accepts. Its
- * `fetch` rejects with the services' 404 `APIException` for a missing page or
+ * `fetch` rejects with a 404 `APIException` for a missing page, a private dump
- * a private dump. A private playlist is previewed all the same.
+ * or a private playlist: the preview is stored in the linking dump, which
+ * others may see.
  */
 export const selfProvider: RichContentProvider = {
   name: "self",
@@ -85,6 +87,9 @@ export const selfProvider: RichContentProvider = {
     const playlistMatch = pathname.match(PLAYLIST_RE);
     if (playlistMatch) {
       const playlist = getPlaylistById(playlistMatch[1]);
+      if (!playlist.isPublic) {
+        throw new APIException(404, "Playlist not found");
+      }
       const thumbnailUrl = playlist.imageMime
         ? `${PUBLIC_URL}/api/playlists/${playlist.id}/image`
         : undefined;

api/remote/providers/youtube.ts

@@ -10,40 +10,24 @@ import type { RichContent } from "../../../shared/dump.ts";
 import type { RichContentProvider } from "./provider.ts";
 import { extractOgTag } from "../html.ts";
 import { fetchWithTimeout, readTextCapped } from "../fetch.ts";
+import { youtubeHost, youtubeVideoId } from "../../lib/canonical-url.ts";
 
-/**
+/** Returns the id of the video `url` points at, in any shape YouTube uses. */
- * Returns the id of the video a URL points at, on youtu.be, youtube.com or
- * www.youtube.com only; `m.` and `music.` links go to the generic provider.
- */
 function extractVideoId(url: string): string | null {
   try {
     const u = new URL(url);
-    if (u.hostname === "youtu.be") {
+    const host = u.hostname.toLowerCase().replace(/^www\./, "");
-      return u.pathname.slice(1).split("/")[0] || null;
+    return youtubeVideoId(host, u.pathname, u.searchParams);
-    }
-    if (u.hostname === "youtube.com" || u.hostname === "www.youtube.com") {
-      if (u.pathname === "/watch" || u.pathname.startsWith("/watch?")) {
-        return u.searchParams.get("v");
-      }
-      if (
-        u.pathname.startsWith("/embed/") || u.pathname.startsWith("/shorts/")
-      ) {
-        return u.pathname.split("/")[2] || null;
-      }
-    }
   } catch {
-    // invalid URL
-  }
     return null;
   }
+}
 
-/**
+/** Returns the `list` parameter of a YouTube URL, and null for any other. */
- * Returns the `list` parameter of a URL, whatever its host: a link to another
- * site with a `list` parameter is taken for a YouTube playlist.
- */
 function extractPlaylistId(url: string): string | null {
   try {
-    return new URL(url).searchParams.get("list");
+    const u = new URL(url);
+    return youtubeHost(u) ? u.searchParams.get("list") : null;
   } catch {
     return null;
   }
@@ -73,22 +57,15 @@ function extractStartSeconds(url: string): number | null {
 }
 
 /**
- * Returns the path of a youtube.com channel URL (`/channel/UC…`, `/@handle`,
+ * Returns the path of a YouTube channel URL (`/channel/UC…`, `/@handle`,
  * `/c/name` or `/user/name`); null for any other URL.
  */
 function extractChannelPath(url: string): string | null {
   try {
     const u = new URL(url);
-    if (u.hostname === "youtube.com" || u.hostname === "www.youtube.com") {
+    if (youtubeHost(u) && /^\/(channel\/|@|c\/|user\/)/.test(u.pathname)) {
-      if (
-        u.pathname.startsWith("/channel/") ||
-        u.pathname.startsWith("/@") ||
-        u.pathname.startsWith("/c/") ||
-        u.pathname.startsWith("/user/")
-      ) {
       return u.pathname;
     }
-    }
   } catch {
     // invalid URL
   }

api/remote/youtube-playlist.ts

@@ -12,7 +12,6 @@
  * @module
  */
 
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import { readTextCapped } from "./fetch.ts";
 import type {
@@ -164,11 +163,7 @@ export async function resolveYouTubePlaylist(
   listId: string,
 ): Promise<YouTubePlaylist> {
   if (!LIST_ID_RE.test(listId)) {
-    throw new APIException(
+    throw new APIException(400, "Invalid playlist ID");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Invalid playlist ID",
-    );
   }
 
   const hit = cache.get(listId);
@@ -187,20 +182,12 @@ export async function resolveYouTubePlaylist(
     );
     if (!res.ok) {
       await res.body?.cancel();
-      throw new APIException(
+      throw new APIException(502, `YouTube returned ${res.status}`);
-        APIErrorCode.SERVER_ERROR,
-        502,
-        `YouTube returned ${res.status}`,
-      );
     }
     html = await readTextCapped(res);
   } catch (err) {
     if (err instanceof APIException) throw err;
-    throw new APIException(
+    throw new APIException(502, "Could not reach YouTube");
-      APIErrorCode.SERVER_ERROR,
-      502,
-      "Could not reach YouTube",
-    );
   } finally {
     clearTimeout(timer);
   }
@@ -208,11 +195,7 @@ export async function resolveYouTubePlaylist(
   const parsed = parsePlaylistPage(html, listId);
   if (!parsed) {
     // The client then shows the embed without a tracklist.
-    throw new APIException(
+    throw new APIException(404, "No tracks on this playlist");
-      APIErrorCode.NOT_FOUND,
-      404,
-      "No tracks on this playlist",
-    );
   }
 
   if (cache.size >= MAX_ENTRIES) {

api/routes/attachments.ts

@@ -4,7 +4,9 @@
  *
  * - `POST /api/attachments` — signed in. Stores an image (multipart `file`, at
  *   most 5 MB) and answers its id.
- * - `GET /api/attachments/:attachmentId` — public. Serves the image.
+ * - `GET /api/attachments/:attachmentId?token=` — public, but an image in a
+ *   private dump or playlist, or in a comment on a private dump, needs its
+ *   owner's media `token`. Serves the image.
  *
  * @module
  */
@@ -13,16 +15,14 @@ import { Router } from "@oak/oak";
 import { authMiddleware } from "../middleware/auth.ts";
 import {
   createAttachment,
-  getAttachment,
+  getAttachmentAccess,
 } from "../services/attachment-service.ts";
-import { APIErrorCode, type APIResponse } from "../../shared/api.ts";
+import { authenticateMedia } from "../lib/auth.ts";
+import { type APIResponse } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import type { AttachmentResponse } from "../../shared/dump.ts";
-import {
+import { serveUploadedFile, validateImageUpload } from "../lib/upload.ts";
-  ATTACHMENTS_DIR,
+import { ATTACHMENTS_DIR } from "../config.ts";
-  serveUploadedFile,
-  validateImageUpload,
-} from "../lib/upload.ts";
 
 /**
  * Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware.
@@ -33,18 +33,14 @@ const router: Router = new Router();
 router.post("/api/attachments", authMiddleware, async (ctx) => {
   const contentType = ctx.request.headers.get("content-type") ?? "";
   if (!contentType.includes("multipart/form-data")) {
-    throw new APIException(
+    throw new APIException(400, "Expected multipart/form-data");
-      APIErrorCode.BAD_REQUEST,
-      400,
-      "Expected multipart/form-data",
-    );
   }
 
   const body = await ctx.request.body.formData();
   const file = body.get("file");
 
   if (!(file instanceof File)) {
-    throw new APIException(APIErrorCode.BAD_REQUEST, 400, "Missing file");
+    throw new APIException(400, "Missing file");
   }
 
   const data = new Uint8Array(await file.arrayBuffer());
@@ -71,18 +67,30 @@ router.post("/api/attachments", authMiddleware, async (ctx) => {
 router.get("/api/attachments/:attachmentId", async (ctx) => {
   const { attachmentId } = ctx.params;
 
-  let attachment;
+  let access;
   try {
-    attachment = getAttachment(attachmentId);
+    access = getAttachmentAccess(attachmentId);
   } catch {
     ctx.response.status = 404;
     return;
   }
+  if (access.ownerId) {
+    // An <img> can't send an Authorization header, so the viewer's media
+    // token comes in the query string.
+    const token = ctx.request.url.searchParams.get("token");
+    const viewerId = token ? await authenticateMedia(token) : null;
+    if (viewerId !== access.ownerId) {
+      ctx.response.status = 404;
+      return;
+    }
+  }
 
   await serveUploadedFile(
     ctx,
     `${ATTACHMENTS_DIR}/${attachmentId}`,
-    attachment.mime,
+    access.mime,
+    3600,
+    !!access.ownerId,
   );
 });
 

api/routes/avatars.ts

@@ -19,15 +19,16 @@ import {
   broadcastUserUpdated,
   updateClientAvatar,
 } from "../services/ws-service.ts";
-import { APIErrorCode, type APIResponse } from "../../shared/api.ts";
+import { type APIResponse } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import type { SelfUser } from "../../shared/user.ts";
 import { toPublicUser, toSelfUser } from "../model/user.ts";
 import {
-  AVATARS_DIR,
+  replaceUploadedFile,
   serveUploadedFile,
   validateImageUpload,
 } from "../lib/upload.ts";
+import { AVATARS_DIR } from "../config.ts";
 
 /**
  * Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware.
@@ -39,33 +40,23 @@ router.post("/api/avatars/me", authMiddleware, async (ctx) => {
   const authPayload = ctx.state.user;
   const contentType = ctx.request.headers.get("content-type") ?? "";
   if (!contentType.includes("multipart/form-data")) {
-    throw new APIException(
+    throw new APIException(400, "Expected multipart/form-data");
-      APIErrorCode.BAD_REQUEST,
-      400,
-      "Expected multipart/form-data",
-    );
   }
 
   const body = await ctx.request.body.formData();
   const file = body.get("file");
 
   if (!(file instanceof File)) {
-    throw new APIException(APIErrorCode.BAD_REQUEST, 400, "Missing file field");
+    throw new APIException(400, "Missing file field");
   }
 
   const data = new Uint8Array(await file.arrayBuffer());
   const mime = validateImageUpload(data);
 
-  const filePath = `${AVATARS_DIR}/${authPayload.userId}`;
+  // Written before the record announces it, or clients would fetch it too
-  await Deno.mkdir(AVATARS_DIR, { recursive: true });
+  // early.
-  await Deno.writeFile(filePath, data);
+  await replaceUploadedFile(`${AVATARS_DIR}/${authPayload.userId}`, data);
-  try {
   updateUserAvatar(authPayload.userId, mime);
-  } catch (err) {
-    // The row doesn't describe the new file, so don't keep it.
-    await Deno.remove(filePath).catch(() => {});
-    throw err;
-  }
   updateClientAvatar(authPayload.userId, mime);
 
   const user = getUserById(authPayload.userId);

api/routes/categories.ts

@@ -16,11 +16,7 @@
 
 import { Router } from "@oak/oak";
 
-import {
+import { type APIResponse, type PaginatedData } from "../../shared/api.ts";
-  APIErrorCode,
-  type APIResponse,
-  type PaginatedData,
-} from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import type { Category } from "../../shared/category.ts";
 import type { Dump } from "../../shared/dump.ts";
@@ -87,11 +83,7 @@ router.post(
   async (ctx) => {
     const body: unknown = await ctx.request.body.json();
     if (!isCreateCategoryRequest(body)) {
-      throw new APIException(
+      throw new APIException(400, "Invalid category data");
-        APIErrorCode.VALIDATION_ERROR,
-        400,
-        "Invalid category data",
-      );
     }
     const category = createCategory(body);
     const responseBody: APIResponse<Category> = {
@@ -110,11 +102,7 @@ router.put(
   async (ctx) => {
     const body: unknown = await ctx.request.body.json();
     if (!isUpdateCategoryRequest(body)) {
-      throw new APIException(
+      throw new APIException(400, "Invalid category data");
-        APIErrorCode.VALIDATION_ERROR,
-        400,
-        "Invalid category data",
-      );
     }
     const category = updateCategory(ctx.params.id, body);
     const responseBody: APIResponse<Category> = {

api/routes/comments.ts

@@ -18,11 +18,7 @@
  */
 
 import { Router } from "@oak/oak";
-import {
+import { type APIResponse, type PaginatedData } from "../../shared/api.ts";
-  APIErrorCode,
-  type APIResponse,
-  type PaginatedData,
-} from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import type { Comment } from "../../shared/comment.ts";
 import {
@@ -72,11 +68,7 @@ router.post("/dumps/:dumpId/comments", authMiddleware, async (ctx) => {
   const dump = getDump(ctx.params.dumpId, userId);
   const body: unknown = await ctx.request.body.json();
   if (!isCreateCommentRequest(body)) {
-    throw new APIException(
+    throw new APIException(400, "Invalid comment data");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Invalid comment data",
-    );
   }
   const comment = createComment(
     dump.id,
@@ -95,11 +87,7 @@ router.patch("/comments/:commentId", authMiddleware, async (ctx) => {
   const canModerate = can(ctx.state.user, "comment:moderate");
   const body: unknown = await ctx.request.body.json();
   if (!isUpdateCommentRequest(body)) {
-    throw new APIException(
+    throw new APIException(400, "Invalid comment data");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Invalid comment data",
-    );
   }
   const { comment, isPrivate } = updateComment(
     ctx.params.commentId,

api/routes/dumps.ts

@@ -37,11 +37,7 @@
 
 import { Router } from "@oak/oak";
 
-import {
+import { type APIResponse, type PaginatedData } from "../../shared/api.ts";
-  APIErrorCode,
-  type APIResponse,
-  type PaginatedData,
-} from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import type { Dump, DumpUrlMatch } from "../../shared/dump.ts";
 import {
@@ -56,7 +52,7 @@ import { authMiddleware } from "../middleware/auth.ts";
 import { can } from "../lib/permissions.ts";
 import { parseOptionalAuth } from "../lib/auth.ts";
 import { parsePagination } from "../lib/pagination.ts";
-import { validateImageUpload } from "../lib/upload.ts";
+import { replaceUploadedFile, validateImageUpload } from "../lib/upload.ts";
 import { THUMBNAILS_DIR } from "../config.ts";
 import {
   createFileDump,
@@ -117,11 +113,7 @@ router.post(
       const isPrivate = formData.get("isPrivate") === "true";
 
       if (!(file instanceof File)) {
-        throw new APIException(
+        throw new APIException(400, "A file is required");
-          APIErrorCode.VALIDATION_ERROR,
-          400,
-          "A file is required",
-        );
       }
 
       dump = await createFileDump(
@@ -136,11 +128,7 @@ router.post(
       const body: unknown = await ctx.request.body.json();
 
       if (!isCreateUrlDumpRequest(body)) {
-        throw new APIException(
+        throw new APIException(400, "Invalid dump data");
-          APIErrorCode.VALIDATION_ERROR,
-          400,
-          "Invalid dump data",
-        );
       }
 
       dump = await createUrlDump(body, userId);
@@ -221,11 +209,7 @@ router.put("/:dumpId/file", authMiddleware, async (ctx) => {
 
   const dump = getDump(dumpId, userId);
   if (userId !== dump.userId && !can(ctx.state.user, "dump:moderate")) {
-    throw new APIException(
+    throw new APIException(403, "Not authorized to update dump");
-      APIErrorCode.UNAUTHORIZED,
-      403,
-      "Not authorized to update dump",
-    );
   }
 
   const formData = await ctx.request.body.formData();
@@ -234,11 +218,7 @@ router.put("/:dumpId/file", authMiddleware, async (ctx) => {
   const title = formData.get("title");
 
   if (!(file instanceof File)) {
-    throw new APIException(
+    throw new APIException(400, "A file is required");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "A file is required",
-    );
   }
 
   const updatedDump = await replaceFileDump(
@@ -263,21 +243,13 @@ router.put("/:dumpId", authMiddleware, async (ctx) => {
   const body: unknown = await ctx.request.body.json();
 
   if (!isUpdateDumpRequest(body)) {
-    throw new APIException(
+    throw new APIException(400, "Erroneous user input");
-      APIErrorCode.VALIDATION_ERROR,
-      422,
-      "Erroneous user input",
-    );
   }
 
   const dump = getDump(dumpId, userId);
 
   if (userId !== dump.userId && !can(ctx.state.user, "dump:moderate")) {
-    throw new APIException(
+    throw new APIException(403, "Not authorized to update dump");
-      APIErrorCode.UNAUTHORIZED,
-      403,
-      "Not authorized to update dump",
-    );
   }
 
   const updatedDump = await updateDump(dump.id, body);
@@ -291,38 +263,23 @@ router.put("/:dumpId/thumbnail", authMiddleware, async (ctx) => {
 
   const dump = getDump(dumpId, userId);
   if (userId !== dump.userId && !can(ctx.state.user, "dump:moderate")) {
-    throw new APIException(
+    throw new APIException(403, "Not authorized to update dump");
-      APIErrorCode.UNAUTHORIZED,
-      403,
-      "Not authorized to update dump",
-    );
   }
 
   const formData = await ctx.request.body.formData();
   const file = formData.get("file");
 
   if (!(file instanceof File)) {
-    throw new APIException(
+    throw new APIException(400, "Missing file field");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Missing file field",
-    );
   }
 
   const data = new Uint8Array(await file.arrayBuffer());
   const mime = validateImageUpload(data);
 
-  // The record is written first. If the file write then fails, the thumbnail
+  // Written before setDumpThumbnail announces it, or clients would fetch it
-  // route finds no custom file and falls back to the generated thumbnail.
+  // too early.
+  await replaceUploadedFile(`${THUMBNAILS_DIR}/${dump.id}-custom`, data);
   const updatedDump = setDumpThumbnail(dump.id, mime);
-  const filePath = `${THUMBNAILS_DIR}/${dump.id}-custom`;
-  await Deno.mkdir(THUMBNAILS_DIR, { recursive: true });
-  try {
-    await Deno.writeFile(filePath, data);
-  } catch (err) {
-    await Deno.remove(filePath).catch(() => {});
-    throw err;
-  }
 
   const responseBody: APIResponse<Dump> = { success: true, data: updatedDump };
   ctx.response.body = responseBody;
@@ -334,11 +291,7 @@ router.delete("/:dumpId/thumbnail", authMiddleware, async (ctx) => {
 
   const dump = getDump(dumpId, userId);
   if (userId !== dump.userId && !can(ctx.state.user, "dump:moderate")) {
-    throw new APIException(
+    throw new APIException(403, "Not authorized to update dump");
-      APIErrorCode.UNAUTHORIZED,
-      403,
-      "Not authorized to update dump",
-    );
   }
 
   const updatedDump = await removeDumpThumbnail(dump.id);
@@ -352,11 +305,7 @@ router.post("/:dumpId/refresh-metadata", authMiddleware, async (ctx) => {
   const dump = getDump(dumpId, userId);
 
   if (userId !== dump.userId && !can(ctx.state.user, "dump:moderate")) {
-    throw new APIException(
+    throw new APIException(403, "Not authorized to update dump");
-      APIErrorCode.UNAUTHORIZED,
-      403,
-      "Not authorized to update dump",
-    );
   }
 
   const updatedDump = await refreshDumpMetadata(dump.id);
@@ -370,11 +319,7 @@ router.delete("/:dumpId", authMiddleware, async (ctx) => {
   const dump = getDump(dumpId, userId);
 
   if (userId !== dump.userId && !can(ctx.state.user, "dump:moderate")) {
-    throw new APIException(
+    throw new APIException(403, "Not authorized to delete dump");
-      APIErrorCode.UNAUTHORIZED,
-      403,
-      "Not authorized to delete dump",
-    );
   }
 
   await deleteDump(dump.id);

api/routes/files.ts

@@ -10,9 +10,8 @@
  */
 
 import { Router } from "@oak/oak";
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
-import { DUMPS_DIR } from "../lib/upload.ts";
+import { DUMPS_DIR } from "../config.ts";
 import { authenticateMedia } from "../lib/auth.ts";
 import { serveFile } from "../lib/serve-file.ts";
 import { dumpFileVersion, getDump } from "../services/dump-service.ts";
@@ -60,7 +59,7 @@ router.get("/:dumpId", async (ctx) => {
 
   // The id names a file on disk: nothing but an id's characters gets through.
   if (!/^[0-9a-f-]{36}$/.test(dumpId)) {
-    throw new APIException(APIErrorCode.BAD_REQUEST, 400, "Invalid dump ID");
+    throw new APIException(400, "Invalid dump ID");
   }
 
   // Media elements can't send an Authorization header, so the viewer's media
@@ -70,11 +69,7 @@ router.get("/:dumpId", async (ctx) => {
   const dump = getDump(dumpId, viewerId ?? undefined);
 
   if (dump.kind !== "file" || !dump.fileMime || !dump.fileName) {
-    throw new APIException(
+    throw new APIException(404, "No file for this dump");
-      APIErrorCode.NOT_FOUND,
-      404,
-      "No file for this dump",
-    );
   }
 
   const path = `${DUMPS_DIR}/${dumpId}`;
@@ -111,7 +106,7 @@ router.get("/:dumpId", async (ctx) => {
     ranges: true,
   });
   if (!served) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "File not found");
+    throw new APIException(404, "File not found");
   }
 });
 

api/routes/invites.ts

@@ -10,7 +10,7 @@
  */
 
 import { Router } from "@oak/oak";
-import { APIErrorCode, type APIResponse } from "../../shared/api.ts";
+import { type APIResponse } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import type { InviteResponse } from "../../shared/user.ts";
 import { type AuthContext, authMiddleware } from "../middleware/auth.ts";
@@ -24,7 +24,7 @@ const router: Router = new Router({ prefix: "/api/invites" });
 
 router.post("/", authMiddleware, (ctx: AuthContext) => {
   if (!ctx.state.user) {
-    throw new APIException(APIErrorCode.UNAUTHORIZED, 401, "Not authenticated");
+    throw new APIException(401, "Not authenticated");
   }
   const responseBody: APIResponse<InviteResponse> = {
     success: true,
@@ -41,11 +41,7 @@ router.get("/:token", (ctx) => {
     const responseBody: APIResponse<null> = { success: true, data: null };
     ctx.response.body = responseBody;
   } catch {
-    throw new APIException(
+    throw new APIException(404, "Invalid or expired invite");
-      APIErrorCode.NOT_FOUND,
-      404,
-      "Invalid or expired invite",
-    );
   }
 });
 

api/routes/notifications.ts

@@ -13,11 +13,7 @@
  */
 
 import { Router } from "@oak/oak";
-import {
+import { type APIResponse, type PaginatedData } from "../../shared/api.ts";
-  APIErrorCode,
-  type APIResponse,
-  type PaginatedData,
-} from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import type { Notification } from "../../shared/notification.ts";
 import { parsePagination } from "../lib/pagination.ts";
@@ -36,7 +32,7 @@ const router: Router = new Router({ prefix: "/api/notifications" });
 
 router.get("/", authMiddleware, (ctx: AuthContext) => {
   if (!ctx.state.user) {
-    throw new APIException(APIErrorCode.UNAUTHORIZED, 401, "Not authenticated");
+    throw new APIException(401, "Not authenticated");
   }
   const { page, limit } = parsePagination(ctx.request.url.searchParams);
   const { items, hasMore } = getNotificationsForUser(
@@ -53,7 +49,7 @@ router.get("/", authMiddleware, (ctx: AuthContext) => {
 
 router.post("/read-all", authMiddleware, (ctx: AuthContext) => {
   if (!ctx.state.user) {
-    throw new APIException(APIErrorCode.UNAUTHORIZED, 401, "Not authenticated");
+    throw new APIException(401, "Not authenticated");
   }
   markAllRead(ctx.state.user.userId);
   ctx.response.status = 204;
@@ -62,7 +58,7 @@ router.post("/read-all", authMiddleware, (ctx: AuthContext) => {
 router.patch("/:id/read", authMiddleware, (ctx) => {
   const user = ctx.state.user;
   if (!user) {
-    throw new APIException(APIErrorCode.UNAUTHORIZED, 401, "Not authenticated");
+    throw new APIException(401, "Not authenticated");
   }
   markOneRead(ctx.params.id, user.userId);
   ctx.response.status = 204;

api/routes/playlists.ts

@@ -29,7 +29,7 @@
 
 import { Router } from "@oak/oak";
 import { authenticateMedia, parseOptionalAuth } from "../lib/auth.ts";
-import { APIErrorCode, type APIResponse } from "../../shared/api.ts";
+import { type APIResponse } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import {
   isCreatePlaylistRequest,
@@ -57,10 +57,11 @@ import {
   updatePlaylist,
 } from "../services/playlist-service.ts";
 import {
-  PLAYLIST_IMAGES_DIR,
+  replaceUploadedFile,
   serveUploadedFile,
   validateImageUpload,
 } from "../lib/upload.ts";
+import { PLAYLIST_IMAGES_DIR } from "../config.ts";
 
 /**
  * Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware.
@@ -84,11 +85,7 @@ router.get("/by-dump/:dumpId/memberships", authMiddleware, (ctx) => {
 router.post("/", authMiddleware, async (ctx) => {
   const body: unknown = await ctx.request.body.json();
   if (!isCreatePlaylistRequest(body)) {
-    throw new APIException(
+    throw new APIException(400, "Invalid request");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Invalid request",
-    );
   }
   const responseBody: APIResponse<Playlist> = {
     success: true,
@@ -110,11 +107,7 @@ router.get("/:playlistId", async (ctx) => {
 router.put("/:playlistId", authMiddleware, async (ctx) => {
   const body: unknown = await ctx.request.body.json();
   if (!isUpdatePlaylistRequest(body)) {
-    throw new APIException(
+    throw new APIException(400, "Invalid request");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Invalid request",
-    );
   }
   const playlist = updatePlaylist(
     ctx.params.playlistId,
@@ -158,42 +151,27 @@ router.delete("/:playlistId/dumps/:dumpId", authMiddleware, (ctx) => {
 router.post("/:playlistId/image", authMiddleware, async (ctx) => {
   const contentType = ctx.request.headers.get("content-type") ?? "";
   if (!contentType.includes("multipart/form-data")) {
-    throw new APIException(
+    throw new APIException(400, "Expected multipart/form-data");
-      APIErrorCode.BAD_REQUEST,
-      400,
-      "Expected multipart/form-data",
-    );
   }
 
   const body = await ctx.request.body.formData();
   const file = body.get("file");
 
   if (!(file instanceof File)) {
-    throw new APIException(APIErrorCode.BAD_REQUEST, 400, "Missing file field");
+    throw new APIException(400, "Missing file field");
   }
 
   const data = new Uint8Array(await file.arrayBuffer());
   const mime = validateImageUpload(data);
 
-  // The file is written before setPlaylistImage announces it, or clients would
+  // Written before setPlaylistImage announces it, or clients would fetch the
-  // fetch the new `?v=` URL too early and cache the old cover under it. It is
+  // new `?v=` URL too early and cache the old cover under it.
-  // written beside the old one and renamed over it, so a failed write leaves
-  // the old cover whole.
   const { id } = getEditablePlaylist(
     ctx.params.playlistId,
     ctx.state.user.userId,
     can(ctx.state.user, "playlist:moderate"),
   );
-  const filePath = `${PLAYLIST_IMAGES_DIR}/${id}`;
+  await replaceUploadedFile(`${PLAYLIST_IMAGES_DIR}/${id}`, data);
-  const tmpPath = `${filePath}.${crypto.randomUUID()}.tmp`;
-  await Deno.mkdir(PLAYLIST_IMAGES_DIR, { recursive: true });
-  try {
-    await Deno.writeFile(tmpPath, data);
-    await Deno.rename(tmpPath, filePath);
-  } catch (err) {
-    await Deno.remove(tmpPath).catch(() => {});
-    throw err;
-  }
   const playlist = setPlaylistImage(
     id,
     mime,
@@ -228,11 +206,7 @@ router.get("/:playlistId/image", async (ctx) => {
 router.put("/:playlistId/order", authMiddleware, async (ctx) => {
   const body: unknown = await ctx.request.body.json();
   if (!isReorderPlaylistRequest(body)) {
-    throw new APIException(
+    throw new APIException(400, "Invalid request");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Invalid request",
-    );
   }
   reorderPlaylist(
     ctx.params.playlistId,

api/routes/preview.ts

@@ -34,7 +34,7 @@ previewRouter.get("/api/preview", authMiddleware, async (ctx) => {
   if (!isValidHttpUrl(url)) {
     const responseBody: APIFailure = {
       success: false,
-      error: { code: APIErrorCode.VALIDATION_ERROR, message: "Invalid URL" },
+      error: { code: APIErrorCode.BAD_REQUEST, message: "Invalid URL" },
     };
     ctx.response.status = 400;
     ctx.response.body = responseBody;

api/routes/thumbnails.ts

@@ -13,7 +13,6 @@
  */
 
 import { Router } from "@oak/oak";
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import {
   dumpFileVersion,
@@ -175,7 +174,7 @@ router.get("/:dumpId", async (ctx) => {
 
   // The id names files on disk: nothing but an id's characters gets through.
   if (!/^[0-9a-f-]{36}$/.test(dumpId)) {
-    throw new APIException(APIErrorCode.BAD_REQUEST, 400, "Invalid dump ID");
+    throw new APIException(400, "Invalid dump ID");
   }
 
   // Media elements can't send an Authorization header, so the viewer's media
@@ -217,11 +216,7 @@ router.get("/:dumpId", async (ctx) => {
     if (
       !await ensureGenerated(thumbPath, () => videoStill(srcPath, thumbPath))
     ) {
-      throw new APIException(
+      throw new APIException(404, "Could not generate thumbnail");
-        APIErrorCode.NOT_FOUND,
-        404,
-        "Could not generate thumbnail",
-      );
     }
     if (
       await serveFile(ctx, thumbPath, {
@@ -255,11 +250,7 @@ router.get("/:dumpId", async (ctx) => {
     ) return;
   }
 
-  throw new APIException(
+  throw new APIException(404, "No thumbnail for this dump");
-    APIErrorCode.NOT_FOUND,
-    404,
-    "No thumbnail for this dump",
-  );
 });
 
 export default router;

api/routes/users.ts

@@ -43,11 +43,7 @@
 
 import { Router } from "@oak/oak";
 
-import {
+import { type APIResponse, type PaginatedData } from "../../shared/api.ts";
-  APIErrorCode,
-  type APIResponse,
-  type PaginatedData,
-} from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import {
   type AuthResponse,
@@ -70,7 +66,8 @@ import {
 import type { Playlist } from "../../shared/playlist.ts";
 import { toPublicUser, toSelfUser, type User } from "../model/user.ts";
 
-import { createJWT, createMediaToken, verifyPassword } from "../lib/jwt.ts";
+import { createJWT, createMediaToken } from "../lib/jwt.ts";
+import { hashPassword, verifyPassword } from "../lib/password.ts";
 import { type RateLimit, takeToken } from "../lib/rate-limit.ts";
 import {
   type AuthContext,
@@ -107,6 +104,9 @@ import {
   getFollowedUsersByUser,
 } from "../services/follow-service.ts";
 
+// Hashed once, at startup, for the sign-ins of usernames that don't exist.
+const UNKNOWN_USER_HASH: Promise<string> = hashPassword(crypto.randomUUID());
+
 /**
  * Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware.
  * An `APIException` thrown by a handler becomes the JSON error response there.
@@ -136,7 +136,6 @@ router.post("/register", async (ctx) => {
 
   if (!isRegisterUserRequest(body)) {
     throw new APIException(
-      APIErrorCode.VALIDATION_ERROR,
       400,
       validateRegisterUserRequest(body) ?? "Invalid request",
     );
@@ -180,18 +179,13 @@ router.post("/login", async (ctx) => {
   const body: unknown = await ctx.request.body.json();
 
   if (!isLoginUserRequest(body)) {
-    throw new APIException(
+    throw new APIException(400, "Invalid request");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Invalid request",
-    );
   }
 
   // Per account, so guessing one user's password is slow however many
   // connections it comes from.
   if (!takeToken(`login:${body.username.toLowerCase()}`, LOGIN_LIMIT)) {
     throw new APIException(
-      APIErrorCode.VALIDATION_ERROR,
       429,
       "Too many login attempts — try again in a minute",
     );
@@ -201,21 +195,16 @@ router.post("/login", async (ctx) => {
   try {
     user = getUserByUsername(body.username);
   } catch {
-    // Same answer as a wrong password: don't confirm which usernames exist.
+    user = undefined;
-    throw new APIException(
-      APIErrorCode.VALIDATION_ERROR,
-      401,
-      "Invalid username or password",
-    );
   }
-
+  // An unknown username gets the same answer as a wrong password, after the
-  const valid = await verifyPassword(body.password, user.passwordHash);
+  // same work, so neither the message nor the timing tells which exist.
-  if (!valid) {
+  const valid = await verifyPassword(
-    throw new APIException(
+    body.password,
-      APIErrorCode.VALIDATION_ERROR,
+    user?.passwordHash ?? await UNKNOWN_USER_HASH,
-      401,
-      "Invalid username or password",
   );
+  if (!user || !valid) {
+    throw new APIException(401, "Invalid username or password");
   }
 
   const responseBody: APIResponse<AuthResponse> = {
@@ -228,11 +217,7 @@ router.post("/login", async (ctx) => {
 router.get("/me", authMiddleware, (ctx: AuthContext) => {
   try {
     if (!ctx.state.user) {
-      throw new APIException(
+      throw new APIException(401, "Not authenticated");
-        APIErrorCode.UNAUTHORIZED,
-        401,
-        "Not authenticated",
-      );
     }
 
     const responseBody: APIResponse<SelfUser> = {
@@ -243,11 +228,7 @@ router.get("/me", authMiddleware, (ctx: AuthContext) => {
   } catch (err) {
     console.error(err);
 
-    throw new APIException(
+    throw new APIException(500, "Failed to fetch user profile");
-      APIErrorCode.SERVER_ERROR,
-      500,
-      "Failed to fetch user profile",
-    );
   }
 });
 
@@ -279,11 +260,7 @@ router.post("/reset-password", async (ctx) => {
   const token = fieldOf(body, "token");
   const newPassword = fieldOf(body, "newPassword");
   if (typeof token !== "string" || typeof newPassword !== "string") {
-    throw new APIException(
+    throw new APIException(400, "Invalid request");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Invalid request",
-    );
   }
   await resetPassword(token, newPassword);
   const responseBody: APIResponse<null> = { success: true, data: null };
@@ -296,11 +273,7 @@ router.post("/me/change-password", authMiddleware, async (ctx: AuthContext) => {
   const newPassword = fieldOf(body, "newPassword");
 
   if (typeof currentPassword !== "string" || typeof newPassword !== "string") {
-    throw new APIException(
+    throw new APIException(400, "Invalid request");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Invalid request",
-    );
   }
 
   if (
@@ -308,7 +281,6 @@ router.post("/me/change-password", authMiddleware, async (ctx: AuthContext) => {
     newPassword.length > VALIDATION.PASSWORD_MAX
   ) {
     throw new APIException(
-      APIErrorCode.VALIDATION_ERROR,
       400,
       `Password must be ${VALIDATION.PASSWORD_MIN}–${VALIDATION.PASSWORD_MAX} characters`,
     );
@@ -317,11 +289,7 @@ router.post("/me/change-password", authMiddleware, async (ctx: AuthContext) => {
   const user = getUserById(ctx.state.user.userId);
   const valid = await verifyPassword(currentPassword, user.passwordHash);
   if (!valid) {
-    throw new APIException(
+    throw new APIException(403, "Current password is incorrect");
-      APIErrorCode.VALIDATION_ERROR,
-      401,
-      "Current password is incorrect",
-    );
   }
 
   // Changing the password revokes every token issued before it, this
@@ -339,11 +307,7 @@ router.post("/me/change-password", authMiddleware, async (ctx: AuthContext) => {
 router.patch("/me", authMiddleware, async (ctx: AuthContext) => {
   const body: unknown = await ctx.request.body.json();
   if (!isUpdateUserRequest(body)) {
-    throw new APIException(
+    throw new APIException(400, "Invalid request");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Invalid request",
-    );
   }
   // Only the profile fields: a stolen token alone must not change the role,
   // the password (which needs the current one) or the username (which is
@@ -369,19 +333,11 @@ router.patch(
     const body: unknown = await ctx.request.body.json();
     const role = fieldOf(body, "role");
     if (!isRole(role)) {
-      throw new APIException(
+      throw new APIException(400, "Invalid role");
-        APIErrorCode.VALIDATION_ERROR,
-        400,
-        "Invalid role",
-      );
     }
     // So that an admin can't demote themselves by mistake and leave no admin.
     if (ctx.params.userId === ctx.state.user.userId) {
-      throw new APIException(
+      throw new APIException(400, "Cannot change your own role");
-        APIErrorCode.VALIDATION_ERROR,
-        400,
-        "Cannot change your own role",
-      );
     }
     const updated = await updateUser(ctx.params.userId, { role });
     const publicUser = toPublicUser(updated);

api/routes/ws.ts

@@ -429,8 +429,8 @@ function canModerateChat(client: WsClient): boolean {
 }
 
 /**
- * Handles `chat_edit`. It stores the new body, broadcasts it, and notifies the
+ * Handles `chat_edit`. It stores the new body, broadcasts it, and notifies, in
- * users the edit newly @mentions.
+ * the author's name, the users the edit newly mentions.
  */
 function handleChatEdit(client: WsClient, id: unknown, body: unknown): void {
   const userId = chatWriter(client);
@@ -449,10 +449,10 @@ function handleChatEdit(client: WsClient, id: unknown, body: unknown): void {
     );
     broadcastChatMessageUpdated(message);
     // Mentions already notified for this message are deduplicated, so only
-    // the new ones notify. After a moderator's edit, they come from the
+    // the new ones notify. A moderator's edit keeps the author's words, so the
-    // moderator.
+    // author mentions.
     notifyMentions(
-      userId,
+      message.userId,
       message.body,
       "chat",
       message.id,

api/services/attachment-service.ts

@@ -7,7 +7,6 @@
  */
 
 import { db, transaction } from "../db/connection.ts";
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 
 /**
@@ -21,45 +20,112 @@ export function createAttachment(id: string, mime: string): void {
   ).run(id, mime, new Date().toISOString());
 }
 
-/**
+/** The kinds of resource whose saved text can link an attachment. */
- * Returns attachment `attachmentId`'s MIME type, for
+export type AttachmentResourceType =
- * `GET /api/attachments/:attachmentId` to serve its file with.
+  | "dump"
- *
+  | "comment"
- * @throws {APIException} 404 when there is no such attachment.
+  | "playlist"
- */
+  | "chat"
-export function getAttachment(attachmentId: string): { mime: string } {
+  | "user";
-  const row = db.prepare(
-    "SELECT mime FROM attachments WHERE id = ?",
-  ).get(attachmentId) as { mime: string } | undefined;
 
-  if (!row) {
+/**
-    throw new APIException(
+ * Returned to `GET /api/attachments/:attachmentId` by
-      APIErrorCode.NOT_FOUND,
+ * {@link getAttachmentAccess}. `ownerId` is set when only that user may see
-      404,
+ * the image, because the resource linking it is private.
-      "Attachment not found",
+ */
-    );
+export interface AttachmentAccess {
+  mime: string;
+  ownerId?: string;
 }
 
-  return { mime: row.mime };
+/**
+ * Returns attachment `attachmentId`'s type and who may see it. An attachment
+ * nothing links yet is public, so the editor can show it before the text is
+ * saved; its id is unguessable. One linked by a private dump or playlist, or
+ * by a comment on a private dump, is its owner's.
+ *
+ * @throws {APIException} 404 when there is no such attachment, or when the
+ * resource linking it has been deleted.
+ */
+export function getAttachmentAccess(attachmentId: string): AttachmentAccess {
+  const row = db.prepare(
+    "SELECT mime, resource_type, resource_id FROM attachments WHERE id = ?",
+  ).get(attachmentId) as
+    | { mime: string; resource_type: string | null; resource_id: string | null }
+    | undefined;
+  if (!row) throw new APIException(404, "Attachment not found");
+  if (!row.resource_id) return { mime: row.mime };
+
+  const owner = resourceOwner(row.resource_type, row.resource_id);
+  if (owner === undefined) {
+    throw new APIException(404, "Attachment not found");
+  }
+  return owner ? { mime: row.mime, ownerId: owner } : { mime: row.mime };
+}
+
+/**
+ * Returns the owner of a private resource, null for a public one, and
+ * undefined for one that no longer exists.
+ */
+function resourceOwner(
+  type: string | null,
+  id: string,
+): string | null | undefined {
+  switch (type) {
+    case "dump": {
+      const dump = db.prepare(
+        "SELECT user_id, is_private FROM dumps WHERE id = ?",
+      ).get(id) as { user_id: string; is_private: number } | undefined;
+      return dump && (dump.is_private ? dump.user_id : null);
+    }
+    case "comment": {
+      const comment = db.prepare(
+        `SELECT d.user_id, d.is_private FROM comments c
+         JOIN dumps d ON d.id = c.dump_id WHERE c.id = ? AND c.deleted = 0`,
+      ).get(id) as { user_id: string; is_private: number } | undefined;
+      return comment && (comment.is_private ? comment.user_id : null);
+    }
+    case "playlist": {
+      const playlist = db.prepare(
+        "SELECT user_id, is_public FROM playlists WHERE id = ?",
+      ).get(id) as { user_id: string; is_public: number } | undefined;
+      return playlist && (playlist.is_public ? null : playlist.user_id);
+    }
+    case "chat":
+      return db.prepare("SELECT 1 FROM chat_messages WHERE id = ?").get(id)
+        ? null
+        : undefined;
+    case "user":
+      return db.prepare("SELECT 1 FROM users WHERE id = ?").get(id)
+        ? null
+        : undefined;
+    default:
+      return undefined;
+  }
 }
 
 const ATTACHMENT_RE =
   /\/api\/attachments\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/g;
 
 /**
- * Binds the attachments whose URLs appear in `text` to `resourceId`, so the
+ * Binds the attachments whose URLs appear in `text` to the resource that saved
- * startup purge keeps them. It is called whenever a dump, comment, chat
+ * it, so the startup purge keeps them as long as that resource exists, and
- * message, playlist or profile description is saved. An attachment already
+ * they are seen by whoever may see it. It is called whenever a dump, comment,
- * bound stays with its resource, so pasting another's URL claims nothing, and
+ * chat message, playlist or profile description is saved. An attachment
- * removing the link from a body never unbinds it.
+ * already bound stays with its resource, so pasting another's URL claims
+ * nothing, and removing the link from a body never unbinds it.
  */
-export function linkAttachments(text: string, resourceId: string): void {
+export function linkAttachments(
+  text: string,
+  resourceType: AttachmentResourceType,
+  resourceId: string,
+): void {
   const ids = [...text.matchAll(ATTACHMENT_RE)].map((m) => m[1]);
   if (ids.length === 0) return;
   const update = db.prepare(
-    "UPDATE attachments SET resource_id = ? WHERE id = ? AND resource_id IS NULL",
+    "UPDATE attachments SET resource_type = ?, resource_id = ? WHERE id = ? AND resource_id IS NULL",
   );
   transaction(() => {
-    for (const id of ids) update.run(resourceId, id);
+    for (const id of ids) update.run(resourceType, resourceId, id);
   });
 }

api/services/category-service.ts

@@ -6,7 +6,6 @@
  * @module
  */
 
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import type {
   Category,
@@ -32,35 +31,28 @@ import { VALIDATION } from "../../shared/validation.ts";
 function validateSlug(slug: string): void {
   if (!isValidSlugFormat(slug)) {
     throw new APIException(
-      APIErrorCode.BAD_REQUEST,
       400,
       "Slug must be lowercase letters, numbers and hyphens",
     );
   }
   if (slug.length > VALIDATION.CATEGORY_SLUG_MAX) {
     throw new APIException(
-      APIErrorCode.BAD_REQUEST,
       400,
       `Slug must be at most ${VALIDATION.CATEGORY_SLUG_MAX} characters`,
     );
   }
   if (isReservedSlug(slug)) {
-    throw new APIException(
+    throw new APIException(400, `Slug "${slug}" is reserved`);
-      APIErrorCode.BAD_REQUEST,
-      400,
-      `Slug "${slug}" is reserved`,
-    );
   }
 }
 
 function requireName(name: string): string {
   const trimmed = name.trim();
   if (!trimmed) {
-    throw new APIException(APIErrorCode.BAD_REQUEST, 400, "Name is required");
+    throw new APIException(400, "Name is required");
   }
   if (trimmed.length > VALIDATION.CATEGORY_NAME_MAX) {
     throw new APIException(
-      APIErrorCode.BAD_REQUEST,
       400,
       `Name must be at most ${VALIDATION.CATEGORY_NAME_MAX} characters`,
     );
@@ -76,18 +68,10 @@ function requireName(name: string): string {
 function uniqueConflict(err: unknown, slug: string, name: string): never {
   const msg = err instanceof Error ? err.message : String(err);
   if (msg.includes("categories.name")) {
-    throw new APIException(
+    throw new APIException(409, `Name "${name}" is already in use`);
-      APIErrorCode.VALIDATION_ERROR,
-      409,
-      `Name "${name}" is already in use`,
-    );
   }
   if (msg.includes("UNIQUE") || msg.includes("unique")) {
-    throw new APIException(
+    throw new APIException(409, `Slug "${slug}" is already in use`);
-      APIErrorCode.VALIDATION_ERROR,
-      409,
-      `Slug "${slug}" is already in use`,
-    );
   }
   throw err as Error;
 }
@@ -100,7 +84,7 @@ function uniqueConflict(err: unknown, slug: string, name: string): never {
 export function getCategoryById(id: string): Category {
   const row = db.prepare(`SELECT * FROM categories WHERE id = ?;`).get(id);
   if (!row || !isCategoryRow(row)) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Category not found");
+    throw new APIException(404, "Category not found");
   }
   return categoryRowToApi(row);
 }
@@ -113,7 +97,7 @@ export function getCategoryById(id: string): Category {
 export function getCategoryBySlug(slug: string): Category {
   const row = db.prepare(`SELECT * FROM categories WHERE slug = ?;`).get(slug);
   if (!row || !isCategoryRow(row)) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Category not found");
+    throw new APIException(404, "Category not found");
   }
   return categoryRowToApi(row);
 }
@@ -231,7 +215,7 @@ export function updateCategory(
 export function deleteCategory(id: string): void {
   const result = db.prepare(`DELETE FROM categories WHERE id = ?;`).run(id);
   if (result.changes === 0) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Category not found");
+    throw new APIException(404, "Category not found");
   }
 }
 
@@ -251,11 +235,7 @@ export function assertCategoriesExist(categoryIds: string[]): void {
       `SELECT COUNT(*) as count FROM categories WHERE id IN (${placeholders});`,
     ).get(...unique) as { count: number } | undefined;
     if ((found?.count ?? 0) !== unique.length) {
-      throw new APIException(
+      throw new APIException(400, "One or more categories do not exist");
-        APIErrorCode.BAD_REQUEST,
-        400,
-        "One or more categories do not exist",
-      );
     }
   }
 }

api/services/chat-service.ts

@@ -8,7 +8,6 @@
  * @module
  */
 
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import type { ChatMessage } from "../../shared/chat.ts";
 import { chatMessageRowToApi, isChatMessageRow } from "../model/chat.ts";
@@ -47,7 +46,7 @@ function fetchMessage(id: string): ChatMessage {
     `SELECT ${SELECT_COLS} ${FROM_JOINS} WHERE m.id = ?;`,
   ).get(id);
   if (!row || !isChatMessageRow(row)) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Message not found");
+    throw new APIException(404, "Message not found");
   }
   return chatMessageRowToApi(row);
 }
@@ -67,15 +66,10 @@ export function createChatMessage(
 ): ChatMessage {
   const trimmed = body.trim();
   if (!trimmed) {
-    throw new APIException(
+    throw new APIException(400, "Message cannot be empty");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Message cannot be empty",
-    );
   }
   if (trimmed.length > VALIDATION.CHAT_MESSAGE_MAX) {
     throw new APIException(
-      APIErrorCode.VALIDATION_ERROR,
       400,
       `Message exceeds ${VALIDATION.CHAT_MESSAGE_MAX} characters`,
     );
@@ -93,7 +87,7 @@ export function createChatMessage(
     `INSERT INTO chat_messages (id, user_id, body, created_at, reply_to_id) VALUES (?, ?, ?, ?, ?);`,
   ).run(id, userId, trimmed, createdAt, replyTo);
   // Unclaimed attachments are deleted as orphans at startup.
-  linkAttachments(trimmed, id);
+  linkAttachments(trimmed, "chat", id);
   return fetchMessage(id);
 }
 
@@ -103,7 +97,7 @@ function getMessageOwner(id: string): string {
     id,
   ) as { user_id: string } | undefined;
   if (!row) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Message not found");
+    throw new APIException(404, "Message not found");
   }
   return row.user_id;
 }
@@ -113,7 +107,7 @@ function getMessageOwner(id: string): string {
  * links to. `canModerate` lets a moderator edit anyone's message. The caller
  * broadcasts the result.
  *
- * @throws {APIException} 404 when there is no such message, 401 when the user
+ * @throws {APIException} 404 when there is no such message, 403 when the user
  * is neither its author nor a moderator, 400 when the body is blank or too
  * long.
  */
@@ -125,30 +119,21 @@ export function updateChatMessage(
 ): ChatMessage {
   const ownerId = getMessageOwner(id);
   if (ownerId !== requestingUserId && !canModerate) {
-    throw new APIException(
+    throw new APIException(403, "Not authorized to edit this message");
-      APIErrorCode.UNAUTHORIZED,
-      401,
-      "Not authorized to edit this message",
-    );
   }
   const trimmed = body.trim();
   if (!trimmed) {
-    throw new APIException(
+    throw new APIException(400, "Message cannot be empty");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Message cannot be empty",
-    );
   }
   if (trimmed.length > VALIDATION.CHAT_MESSAGE_MAX) {
     throw new APIException(
-      APIErrorCode.VALIDATION_ERROR,
       400,
       `Message exceeds ${VALIDATION.CHAT_MESSAGE_MAX} characters`,
     );
   }
   db.prepare(`UPDATE chat_messages SET body = ?, updated_at = ? WHERE id = ?;`)
     .run(trimmed, new Date().toISOString(), id);
-  linkAttachments(trimmed, id);
+  linkAttachments(trimmed, "chat", id);
   return fetchMessage(id);
 }
 
@@ -156,7 +141,7 @@ export function updateChatMessage(
  * Deletes a message on a `chat_delete`. `canModerate` lets a moderator delete
  * anyone's message. Replies to it keep their `replyToId`, without its preview.
  *
- * @throws {APIException} 404 when there is no such message, 401 when the user
+ * @throws {APIException} 404 when there is no such message, 403 when the user
  * is neither its author nor a moderator.
  */
 export function deleteChatMessage(
@@ -166,11 +151,7 @@ export function deleteChatMessage(
 ): void {
   const ownerId = getMessageOwner(id);
   if (ownerId !== requestingUserId && !canModerate) {
-    throw new APIException(
+    throw new APIException(403, "Not authorized to delete this message");
-      APIErrorCode.UNAUTHORIZED,
-      401,
-      "Not authorized to delete this message",
-    );
   }
   db.prepare(`DELETE FROM chat_messages WHERE id = ?;`).run(id);
 }
@@ -195,11 +176,7 @@ export interface ChatCursor {
 /** Converts query rows to messages, or throws a 500 if one doesn't parse. */
 function toMessages(rows: unknown[]): ChatMessage[] {
   if (!rows.every(isChatMessageRow)) {
-    throw new APIException(
+    throw new APIException(500, "Malformed chat message data");
-      APIErrorCode.SERVER_ERROR,
-      500,
-      "Malformed chat message data",
-    );
   }
   return rows.map(chatMessageRowToApi);
 }
@@ -284,7 +261,7 @@ export function getChatReadState(userId: string): ChatReadState {
      FROM users u WHERE u.id = ?;`,
   ).get(userId) as { read_at: string; unread: number } | undefined;
   if (!row) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "User not found");
+    throw new APIException(404, "User not found");
   }
   return { readAt: row.read_at, unread: row.unread };
 }
@@ -301,11 +278,7 @@ export function getChatReadState(userId: string): ChatReadState {
 export function markChatRead(userId: string, at: string): ChatReadState {
   const parsed = new Date(at);
   if (Number.isNaN(parsed.getTime())) {
-    throw new APIException(
+    throw new APIException(400, "Invalid read marker");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Invalid read marker",
-    );
   }
   const newest = db.prepare(
     `SELECT MAX(created_at) AS newest FROM chat_messages;`,

api/services/comment-like-service.ts

@@ -8,7 +8,6 @@
  * @module
  */
 
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import { isUserRow, type User, userRowToApi } from "../model/user.ts";
 import { db } from "../db/connection.ts";
@@ -36,7 +35,7 @@ function commentVisibility(commentId: string, userId: string): boolean {
      WHERE c.id = ?;`,
   ).get(commentId) as { is_private: number; user_id: string } | undefined;
   if (!row || (row.is_private && row.user_id !== userId)) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Comment not found");
+    throw new APIException(404, "Comment not found");
   }
   return Boolean(row.is_private);
 }
@@ -72,11 +71,7 @@ export function castCommentLike(
       db.exec("ROLLBACK;");
     } catch { /* ignore if no active transaction */ }
     if (err instanceof Error && err.message.includes("UNIQUE constraint")) {
-      throw new APIException(
+      throw new APIException(409, "Already liked");
-        APIErrorCode.VALIDATION_ERROR,
-        409,
-        "Already liked",
-      );
     }
     throw err;
   }
@@ -110,7 +105,7 @@ export function removeCommentLike(
     ).run(commentId, userId);
     if (result.changes === 0) {
       db.exec("ROLLBACK;");
-      throw new APIException(APIErrorCode.NOT_FOUND, 404, "Like not found");
+      throw new APIException(404, "Like not found");
     }
     db.prepare(
       `UPDATE comments SET like_count = like_count - 1 WHERE id = ?;`,
@@ -165,11 +160,7 @@ export function getCommentLikers(
   ).all(commentId, limit + 1, offset);
 
   if (!rawRows.every(isUserRow)) {
-    throw new APIException(
+    throw new APIException(500, "Malformed user data");
-      APIErrorCode.SERVER_ERROR,
-      500,
-      "Malformed user data",
-    );
   }
 
   return pageOf(rawRows.map(userRowToApi), limit);

api/services/comment-service.ts

@@ -6,7 +6,6 @@
  * @module
  */
 
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import type { Comment } from "../../shared/comment.ts";
 import { type SQLOutputValue } from "node:sqlite";
@@ -29,14 +28,10 @@ function fetchComment(commentId: string): Comment {
     `SELECT ${SELECT_COLS} FROM comments c JOIN users u ON c.user_id = u.id WHERE c.id = ?;`,
   ).get(commentId);
   if (!row || !isCommentRow(row as Record<string, SQLOutputValue>)) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Comment not found");
+    throw new APIException(404, "Comment not found");
   }
   if (!isCommentRow(row)) {
-    throw new APIException(
+    throw new APIException(500, "Malformed comment data");
-      APIErrorCode.SERVER_ERROR,
-      500,
-      "Malformed comment data",
-    );
   }
   return commentRowToApi(row);
 }
@@ -52,7 +47,7 @@ export function getCommentDumpId(commentId: string): string {
     commentId,
   ) as { dump_id: string } | undefined;
   if (!row) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Comment not found");
+    throw new APIException(404, "Comment not found");
   }
   return row.dump_id;
 }
@@ -70,11 +65,7 @@ export function getComments(dumpId: string): Comment[] {
      WHERE c.dump_id = ? ORDER BY c.created_at ASC;`,
   ).all(dumpId);
   if (!rows.every(isCommentRow)) {
-    throw new APIException(
+    throw new APIException(500, "Malformed comment data");
-      APIErrorCode.SERVER_ERROR,
-      500,
-      "Malformed comment data",
-    );
   }
   return rows.map(commentRowToApi);
 }
@@ -82,8 +73,11 @@ export function getComments(dumpId: string): Comment[] {
 /**
  * Posts a comment on dump `dumpId`, replying to `parentId` if given, for
  * `POST /api/dumps/:dumpId/comments`. It notifies the dump's poster and the
- * users it mentions, and links the comment's attachments and backlinks.
+ * users it mentions, unless the dump is private, and links the comment's
- * `parentId` isn't checked to be a comment on the same dump.
+ * attachments and backlinks. The route has checked that the caller may see
+ * the dump.
+ *
+ * @throws {APIException} 400 when `parentId` isn't a comment on the same dump.
  */
 export function createComment(
   dumpId: string,
@@ -91,6 +85,13 @@ export function createComment(
   body: string,
   parentId?: string,
 ): Comment {
+  if (parentId !== undefined) {
+    const parent = db.prepare(`SELECT dump_id FROM comments WHERE id = ?;`)
+      .get(parentId) as { dump_id: string } | undefined;
+    if (parent?.dump_id !== dumpId) {
+      throw new APIException(400, "The comment replied to isn't on this dump");
+    }
+  }
   const id = crypto.randomUUID();
   const createdAt = new Date();
   db.prepare(
@@ -104,24 +105,27 @@ export function createComment(
     createdAt.toISOString(),
   );
   const comment = fetchComment(id);
-  const dumpRow = db.prepare(`SELECT title FROM dumps WHERE id = ?;`).get(
+  const dumpRow = db.prepare(
-    dumpId,
+    `SELECT title, is_private FROM dumps WHERE id = ?;`,
-  ) as { title: string } | undefined;
+  ).get(dumpId) as { title: string; is_private: number } | undefined;
   notifyDumpOwnerNewComment(userId, id, dumpId);
-  notifyMentions(userId, body, "comment", id, dumpRow?.title ?? "", dumpId);
+  if (dumpRow && !dumpRow.is_private) {
-  linkAttachments(body, id);
+    notifyMentions(userId, body, "comment", id, dumpRow.title, dumpId);
+  }
+  linkAttachments(body, "comment", id);
   relinkBacklinks("comment", id, dumpId, body);
   return comment;
 }
 
 /**
  * Replaces a comment's body, for `PATCH /api/comments/:commentId`.
- * `canModerate` lets someone other than the author do it. It notifies the users
+ * `canModerate` lets someone other than the author do it. It notifies, in the
- * it mentions for the first time and relinks the attachments and backlinks. The
+ * author's name, the users it mentions for the first time, unless the dump is
- * route broadcasts the comment unless `isPrivate`.
+ * private, and relinks the attachments and backlinks. The route broadcasts the
+ * comment unless `isPrivate`.
  *
  * @throws {APIException} 404 when there is no such comment, 400 when it is
- * deleted, 401 when the user is neither its author nor a moderator.
+ * deleted, 403 when the user is neither its author nor a moderator.
  */
 export function updateComment(
   commentId: string,
@@ -133,22 +137,14 @@ export function updateComment(
     `SELECT c.dump_id, d.is_private FROM comments c JOIN dumps d ON c.dump_id = d.id WHERE c.id = ?;`,
   ).get(commentId) as { dump_id: string; is_private: number } | undefined;
   if (!row) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Comment not found");
+    throw new APIException(404, "Comment not found");
   }
   const existing = fetchComment(commentId);
   if (existing.deleted) {
-    throw new APIException(
+    throw new APIException(400, "Cannot edit a deleted comment");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Cannot edit a deleted comment",
-    );
   }
   if (existing.userId !== requestingUserId && !canModerate) {
-    throw new APIException(
+    throw new APIException(403, "Not authorized to edit this comment");
-      APIErrorCode.UNAUTHORIZED,
-      401,
-      "Not authorized to edit this comment",
-    );
   }
   const now = new Date().toISOString();
   db.prepare(`UPDATE comments SET body = ?, updated_at = ? WHERE id = ?;`).run(
@@ -156,18 +152,21 @@ export function updateComment(
     now,
     commentId,
   );
+  if (!row.is_private) {
     const dumpRow = db.prepare(`SELECT title FROM dumps WHERE id = ?;`).get(
       row.dump_id,
     ) as { title: string } | undefined;
+    // A moderator's edit keeps the author's words, so the author mentions.
     notifyMentions(
-    requestingUserId,
+      existing.userId,
       body,
       "comment",
       commentId,
       dumpRow?.title ?? "",
       row.dump_id,
     );
-  linkAttachments(body, commentId);
+  }
+  linkAttachments(body, "comment", commentId);
   relinkBacklinks("comment", commentId, row.dump_id, body);
   return {
     comment: fetchComment(commentId),
@@ -182,7 +181,7 @@ export function updateComment(
  * dropped, but the row stays so its replies keep their place. The route
  * broadcasts the deletion unless `isPrivate`.
  *
- * @throws {APIException} 404 when there is no such comment, 401 when the user
+ * @throws {APIException} 404 when there is no such comment, 403 when the user
  * is neither its author nor a moderator.
  */
 export function deleteComment(
@@ -194,15 +193,11 @@ export function deleteComment(
     `SELECT c.dump_id, d.is_private FROM comments c JOIN dumps d ON c.dump_id = d.id WHERE c.id = ?;`,
   ).get(commentId) as { dump_id: string; is_private: number } | undefined;
   if (!row) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Comment not found");
+    throw new APIException(404, "Comment not found");
   }
   const comment = fetchComment(commentId);
   if (comment.userId !== requestingUserId && !canModerate) {
-    throw new APIException(
+    throw new APIException(403, "Not authorized to delete this comment");
-      APIErrorCode.UNAUTHORIZED,
-      401,
-      "Not authorized to delete this comment",
-    );
   }
   db.prepare(`UPDATE comments SET deleted = 1, body = '' WHERE id = ?;`).run(
     commentId,

api/services/dump-service.ts

@@ -9,7 +9,6 @@
  * @module
  */
 
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import type {
   CreateUrlDumpRequest,
@@ -31,11 +30,7 @@ import {
   tryFetchRichContent,
 } from "./rich-content-service.ts";
 import { isValidHttpUrl } from "../remote/fetch.ts";
-import {
+import { broadcastDumpChange } from "./ws-service.ts";
-  broadcastDumpDeleted,
-  broadcastDumpUpdated,
-  broadcastNewDump,
-} from "./ws-service.ts";
 import {
   notifyMentions,
   notifyUserFollowersNewDump,
@@ -72,14 +67,12 @@ function isAllowedMime(mime: string): boolean {
 function assertFileDumpText(title?: string, comment?: string): void {
   if (title && title.trim().length > VALIDATION.DUMP_TITLE_MAX) {
     throw new APIException(
-      APIErrorCode.VALIDATION_ERROR,
       400,
       `Title must be at most ${VALIDATION.DUMP_TITLE_MAX} characters`,
     );
   }
   if (comment && comment.length > VALIDATION.DUMP_COMMENT_MAX) {
     throw new APIException(
-      APIErrorCode.VALIDATION_ERROR,
       400,
       `Comment must be at most ${VALIDATION.DUMP_COMMENT_MAX} characters`,
     );
@@ -109,7 +102,7 @@ export async function createUrlDump(
   userId: string,
 ): Promise<Dump> {
   if (!isValidHttpUrl(request.url)) {
-    throw new APIException(APIErrorCode.BAD_REQUEST, 400, "Invalid URL");
+    throw new APIException(400, "Invalid URL");
   }
   assertCategoriesExist(request.categoryIds ?? []);
 
@@ -159,13 +152,14 @@ export async function createUrlDump(
     isPrivate,
     categoryIds,
   };
-  if (!isPrivate) {
+  broadcastDumpChange(null, dump);
-    broadcastNewDump(dump);
+  if (!isPrivate) notifyUserFollowersNewDump(userId, dumpId, title);
-    notifyUserFollowersNewDump(userId, dumpId, title);
-  }
   if (request.comment) {
+    // A private dump's mentions are notified if it goes public.
+    if (!isPrivate) {
       notifyMentions(userId, request.comment, "dump", dumpId, title);
-    linkAttachments(request.comment, dumpId);
+    }
+    linkAttachments(request.comment, "dump", dumpId);
   }
   relinkBacklinks("dump_comment", dumpId, dumpId, request.comment ?? "");
   return dump;
@@ -189,18 +183,10 @@ export async function createFileDump(
 ): Promise<Dump> {
   assertFileDumpText(title, comment);
   if (!isAllowedMime(file.type)) {
-    throw new APIException(
+    throw new APIException(400, `File type '${file.type}' is not allowed`);
-      APIErrorCode.BAD_REQUEST,
-      400,
-      `File type '${file.type}' is not allowed`,
-    );
   }
   if (file.size > DUMP_MAX_FILE_SIZE_BYTES) {
-    throw new APIException(
+    throw new APIException(400, "File too large (max 50 MB)");
-      APIErrorCode.BAD_REQUEST,
-      400,
-      "File too large (max 50 MB)",
-    );
   }
   assertCategoriesExist(categoryIds);
 
@@ -257,13 +243,14 @@ export async function createFileDump(
     isPrivate,
     categoryIds: dedupedCategoryIds,
   };
-  if (!isPrivate) {
+  broadcastDumpChange(null, dump);
-    broadcastNewDump(dump);
+  if (!isPrivate) notifyUserFollowersNewDump(userId, dumpId, finalTitle);
-    notifyUserFollowersNewDump(userId, dumpId, finalTitle);
-  }
   if (comment) {
+    // A private dump's mentions are notified if it goes public.
+    if (!isPrivate) {
       notifyMentions(userId, comment, "dump", dumpId, finalTitle);
-    linkAttachments(comment, dumpId);
+    }
+    linkAttachments(comment, "dump", dumpId);
   }
   relinkBacklinks("dump_comment", dumpId, dumpId, comment ?? "");
   return dump;
@@ -307,7 +294,7 @@ function fetchDump(idOrSlug: string): Dump {
       idOrSlug,
     );
   if (!row || !isDumpRow(row)) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Dump not found");
+    throw new APIException(404, "Dump not found");
   }
   return dumpRowToApi(row);
 }
@@ -322,7 +309,7 @@ function fetchDump(idOrSlug: string): Dump {
 export function getDump(dumpId: string, requestingUserId?: string): Dump {
   const dump = fetchDump(dumpId);
   if (dump.isPrivate && dump.userId !== requestingUserId) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Dump not found");
+    throw new APIException(404, "Dump not found");
   }
   attachCategoryIds([dump]);
   return dump;
@@ -391,11 +378,7 @@ export function listDumps(
     ).all(limit + 1, offset);
 
   if (!rows || !rows.every(isDumpRow)) {
-    throw new APIException(
+    throw new APIException(500, "Malformed dump data");
-      APIErrorCode.SERVER_ERROR,
-      500,
-      "Malformed dump data",
-    );
   }
 
   const items = rows.map(dumpRowToApi);
@@ -500,11 +483,9 @@ export async function updateDump(
     } else {
       attachCategoryIds([updatedDump]);
     }
-    if (updatedDump.isPrivate && !dump.isPrivate) broadcastDumpDeleted(dumpId);
+    broadcastDumpChange(dump, updatedDump);
-    else if (!updatedDump.isPrivate) broadcastDumpUpdated(updatedDump);
-    // Going public is an arrival for everyone who couldn't see it before.
-    if (dump.isPrivate && !updatedDump.isPrivate) broadcastNewDump(updatedDump);
     if (updatedDump.comment) {
+      if (!updatedDump.isPrivate) {
         notifyMentions(
           dump.userId,
           updatedDump.comment,
@@ -512,7 +493,8 @@ export async function updateDump(
           dumpId,
           updatedDump.title,
         );
-      linkAttachments(updatedDump.comment, dumpId);
+      }
+      linkAttachments(updatedDump.comment, "dump", dumpId);
     }
     relinkBacklinks("dump_comment", dumpId, dumpId, updatedDump.comment ?? "");
     return updatedDump;
@@ -521,7 +503,7 @@ export async function updateDump(
   const newUrl = request.url ?? dump.url!;
 
   if (!isValidHttpUrl(newUrl)) {
-    throw new APIException(APIErrorCode.BAD_REQUEST, 400, "Invalid URL");
+    throw new APIException(400, "Invalid URL");
   }
 
   let { richContent, title } = dump;
@@ -567,7 +549,7 @@ export async function updateDump(
   );
 
   if (result.changes === 0) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Dump not found");
+    throw new APIException(404, "Dump not found");
   }
 
   if (request.categoryIds !== undefined) {
@@ -578,11 +560,9 @@ export async function updateDump(
     attachCategoryIds([updatedDump]);
   }
 
-  if (updatedDump.isPrivate && !dump.isPrivate) broadcastDumpDeleted(dumpId);
+  broadcastDumpChange(dump, updatedDump);
-  else if (!updatedDump.isPrivate) broadcastDumpUpdated(updatedDump);
-  // Going public is an arrival for everyone who couldn't see it before.
-  if (dump.isPrivate && !updatedDump.isPrivate) broadcastNewDump(updatedDump);
   if (updatedDump.comment) {
+    if (!updatedDump.isPrivate) {
       notifyMentions(
         dump.userId,
         updatedDump.comment,
@@ -590,7 +570,8 @@ export async function updateDump(
         dumpId,
         updatedDump.title,
       );
-    linkAttachments(updatedDump.comment, dumpId);
+    }
+    linkAttachments(updatedDump.comment, "dump", dumpId);
   }
   relinkBacklinks("dump_comment", dumpId, dumpId, updatedDump.comment ?? "");
   return updatedDump;
@@ -617,23 +598,15 @@ export async function replaceFileDump(
 ): Promise<Dump> {
   assertFileDumpText(title, comment);
   if (!isAllowedMime(file.type)) {
-    throw new APIException(
+    throw new APIException(400, `File type '${file.type}' is not allowed`);
-      APIErrorCode.BAD_REQUEST,
-      400,
-      `File type '${file.type}' is not allowed`,
-    );
   }
   if (file.size > DUMP_MAX_FILE_SIZE_BYTES) {
-    throw new APIException(
+    throw new APIException(400, "File too large (max 50 MB)");
-      APIErrorCode.BAD_REQUEST,
-      400,
-      "File too large (max 50 MB)",
-    );
   }
 
   const dump = fetchDump(dumpId);
   if (dump.kind !== "file") {
-    throw new APIException(APIErrorCode.BAD_REQUEST, 400, "Not a file dump");
+    throw new APIException(400, "Not a file dump");
   }
   if (categoryIds !== undefined) assertCategoriesExist(categoryIds);
 
@@ -696,8 +669,10 @@ export async function replaceFileDump(
   }
 
   if (comment) {
+    if (!finalPrivate) {
       notifyMentions(dump.userId, comment, "dump", dumpId, finalTitle);
-    linkAttachments(comment, dumpId);
+    }
+    linkAttachments(comment, "dump", dumpId);
   }
   relinkBacklinks("dump_comment", dumpId, dumpId, comment ?? "");
   const updatedDump: Dump = {
@@ -711,9 +686,7 @@ export async function replaceFileDump(
     isPrivate: finalPrivate,
     updatedAt: now,
   };
-  if (updatedDump.isPrivate && !dump.isPrivate) broadcastDumpDeleted(dumpId);
+  broadcastDumpChange(dump, updatedDump);
-  else if (!updatedDump.isPrivate) broadcastDumpUpdated(updatedDump);
-  if (dump.isPrivate && !updatedDump.isPrivate) broadcastNewDump(updatedDump);
   return updatedDump;
 }
 
@@ -736,11 +709,7 @@ export function getDumpsByUser(
     `SELECT ${SELECT_COLS} FROM dumps WHERE user_id = ?${privacyFilter} ORDER BY created_at DESC LIMIT ? OFFSET ?;`,
   ).all(userId, limit + 1, offset);
   if (!rows.every(isDumpRow)) {
-    throw new APIException(
+    throw new APIException(500, "Malformed dump data");
-      APIErrorCode.SERVER_ERROR,
-      500,
-      "Malformed dump data",
-    );
   }
   const items = rows.map(dumpRowToApi);
   attachCategoryIds(items);
@@ -783,11 +752,7 @@ export function getVotedDumpsByUser(
   }
 
   if (!rows.every(isDumpRow)) {
-    throw new APIException(
+    throw new APIException(500, "Malformed dump data");
-      APIErrorCode.SERVER_ERROR,
-      500,
-      "Malformed dump data",
-    );
   }
   const items = rows.map(dumpRowToApi);
   attachCategoryIds(items);
@@ -805,11 +770,7 @@ export async function refreshDumpMetadata(dumpId: string): Promise<Dump> {
   const dump = fetchDump(dumpId);
 
   if (dump.kind !== "url" || !dump.url) {
-    throw new APIException(
+    throw new APIException(400, "Only URL dumps support metadata refresh");
-      APIErrorCode.BAD_REQUEST,
-      400,
-      "Only URL dumps support metadata refresh",
-    );
   }
 
   // A failed fetch yields a stub with no title or thumbnail. Written over the
@@ -819,7 +780,6 @@ export async function refreshDumpMetadata(dumpId: string): Promise<Dump> {
   });
   if (!ok) {
     throw new APIException(
-      APIErrorCode.SERVER_ERROR,
       502,
       "Could not reach the page to refresh its metadata",
     );
@@ -833,7 +793,7 @@ export async function refreshDumpMetadata(dumpId: string): Promise<Dump> {
     `UPDATE dumps SET title = ?, rich_content = ? WHERE id = ?;`,
   ).run(row.title, row.rich_content, row.id);
 
-  if (!updatedDump.isPrivate) broadcastDumpUpdated(updatedDump);
+  broadcastDumpChange(dump, updatedDump);
 
   return updatedDump;
 }
@@ -856,8 +816,7 @@ export function getDumpThumbnailInfo(
 
 /**
  * Records that a dump has a custom thumbnail of type `mime`, for
- * `PUT /api/dumps/:dumpId/thumbnail`. The route writes the file after this
+ * `PUT /api/dumps/:dumpId/thumbnail`, once the route has written the file.
- * call returns.
  *
  * @throws {APIException} 404 when there is no such dump.
  */
@@ -868,7 +827,7 @@ export function setDumpThumbnail(dumpId: string, mime: string): Dump {
     dump.id,
   );
   const updatedDump: Dump = { ...dump, thumbnailMime: mime };
-  if (!updatedDump.isPrivate) broadcastDumpUpdated(updatedDump);
+  broadcastDumpChange(dump, updatedDump);
   return updatedDump;
 }
 
@@ -884,7 +843,7 @@ export async function removeDumpThumbnail(dumpId: string): Promise<Dump> {
     .run(dump.id);
   await Deno.remove(`${THUMBNAILS_DIR}/${dump.id}-custom`).catch(() => {});
   const updatedDump: Dump = { ...dump, thumbnailMime: undefined };
-  if (!updatedDump.isPrivate) broadcastDumpUpdated(updatedDump);
+  broadcastDumpChange(dump, updatedDump);
   return updatedDump;
 }
 
@@ -900,7 +859,7 @@ export async function deleteDump(dumpId: string): Promise<void> {
   const result = db.prepare(`DELETE FROM dumps WHERE id = ?;`).run(dumpId);
 
   if (result.changes === 0) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Dump not found");
+    throw new APIException(404, "Dump not found");
   }
 
   if (dump.kind === "file") {
@@ -911,5 +870,5 @@ export async function deleteDump(dumpId: string): Promise<void> {
     await Deno.remove(`${THUMBNAILS_DIR}/${dump.id}-custom`).catch(() => {});
   }
 
-  broadcastDumpDeleted(dumpId);
+  broadcastDumpChange(dump, null);
 }

api/services/follow-service.ts

@@ -6,7 +6,6 @@
  * @module
  */
 
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import type { Dump } from "../../shared/dump.ts";
 import type { FollowStatus } from "../../shared/follow.ts";
@@ -35,11 +34,7 @@ import { attachCategoryIds } from "./category-service.ts";
  */
 export function followUser(followerId: string, followedUserId: string): void {
   if (followerId === followedUserId) {
-    throw new APIException(
+    throw new APIException(400, "Cannot follow yourself");
-      APIErrorCode.BAD_REQUEST,
-      400,
-      "Cannot follow yourself",
-    );
   }
   // The unique index answers "already following" without a race.
   let isNew = true;
@@ -85,14 +80,10 @@ export function followPlaylist(followerId: string, playlistId: string): void {
   ).get(playlistId) as { id: string; is_public: number } | undefined;
 
   if (!row) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Playlist not found");
+    throw new APIException(404, "Playlist not found");
   }
   if (!row.is_public) {
-    throw new APIException(
+    throw new APIException(403, "Cannot follow a private playlist");
-      APIErrorCode.UNAUTHORIZED,
-      403,
-      "Cannot follow a private playlist",
-    );
   }
 
   let isNew = true;
@@ -142,11 +133,7 @@ export function getFollowStatus(followerId: string): FollowStatus {
   ).all(followerId);
 
   if (!rawUserRows.every(isFollowRow) || !rawPlaylistRows.every(isFollowRow)) {
-    throw new APIException(
+    throw new APIException(500, "Malformed follow data");
-      APIErrorCode.SERVER_ERROR,
-      500,
-      "Malformed follow data",
-    );
   }
 
   return {
@@ -188,11 +175,7 @@ export function getFollowedUsersDumpFeed(
 
   const userFeedRows = rawRows as Parameters<typeof isDumpRow>[0][];
   if (!userFeedRows.every(isDumpRow)) {
-    throw new APIException(
+    throw new APIException(500, "Malformed dump data");
-      APIErrorCode.SERVER_ERROR,
-      500,
-      "Malformed dump data",
-    );
   }
   const items = userFeedRows.map(dumpRowToApi);
   attachCategoryIds(items);
@@ -236,11 +219,7 @@ export function getFollowedPlaylistsDumpFeed(
   ).all(...catParams, followerId, limit + 1, offset);
 
   if (!rawRows.every(isDumpRow)) {
-    throw new APIException(
+    throw new APIException(500, "Malformed dump data");
-      APIErrorCode.SERVER_ERROR,
-      500,
-      "Malformed dump data",
-    );
   }
   const items = rawRows.map(dumpRowToApi);
   attachCategoryIds(items);
@@ -273,11 +252,7 @@ export function getFollowedPlaylistsByUser(
   ).all(userId, limit + 1, offset);
 
   if (!rawRows.every(isPlaylistRow)) {
-    throw new APIException(
+    throw new APIException(500, "Malformed playlist data");
-      APIErrorCode.SERVER_ERROR,
-      500,
-      "Malformed playlist data",
-    );
   }
   return pageOf(rawRows.map(playlistRowToApi), limit);
 }
@@ -309,11 +284,7 @@ export function getFollowedUsersByUser(
   ).all(userId, limit + 1, offset);
 
   if (!rawRows.every(isUserRow)) {
-    throw new APIException(
+    throw new APIException(500, "Malformed user data");
-      APIErrorCode.SERVER_ERROR,
-      500,
-      "Malformed user data",
-    );
   }
 
   return pageOf(rawRows.map(userRowToApi), limit);

api/services/invite-service.ts

@@ -7,7 +7,6 @@
  */
 
 import { randomBytes } from "node:crypto";
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import { db } from "../db/connection.ts";
 import { isInviteRow } from "../model/invite.ts";
@@ -44,29 +43,17 @@ export function validateInvite(token: string): string {
   ).get(token);
 
   if (!row || !isInviteRow(row)) {
-    throw new APIException(
+    throw new APIException(404, "Invalid or expired invite");
-      APIErrorCode.NOT_FOUND,
-      404,
-      "Invalid or expired invite",
-    );
   }
 
   if (row.used_at !== null) {
-    throw new APIException(
+    throw new APIException(409, "Invite already used");
-      APIErrorCode.VALIDATION_ERROR,
-      409,
-      "Invite already used",
-    );
   }
 
   const expiresAt = new Date(row.created_at).getTime() +
     UNUSED_INVITES_RETENTION_DAYS * 24 * 60 * 60 * 1000;
   if (Date.now() > expiresAt) {
-    throw new APIException(
+    throw new APIException(404, "Invalid or expired invite");
-      APIErrorCode.NOT_FOUND,
-      404,
-      "Invalid or expired invite",
-    );
   }
 
   return row.inviter_id;
@@ -86,11 +73,7 @@ export function claimInvite(token: string): string {
     `UPDATE invites SET used_at = ? WHERE token = ? AND used_at IS NULL;`,
   ).run(new Date().toISOString(), token);
   if (result.changes === 0) {
-    throw new APIException(
+    throw new APIException(409, "Invite already used");
-      APIErrorCode.VALIDATION_ERROR,
-      409,
-      "Invite already used",
-    );
   }
   return inviterId;
 }

api/services/notification-service.ts

@@ -14,7 +14,6 @@ import type {
   NotificationType,
   UserDumpPostedData,
 } from "../../shared/notification.ts";
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import { db, transaction } from "../db/connection.ts";
 import {
@@ -88,11 +87,7 @@ export function getNotificationsForUser(
   ).all(userId, limit + 1, offset);
 
   if (!rawRows.every(isNotificationRow)) {
-    throw new APIException(
+    throw new APIException(500, "Malformed notification data");
-      APIErrorCode.SERVER_ERROR,
-      500,
-      "Malformed notification data",
-    );
   }
   return pageOf(rawRows.map(notificationRowToApi), limit);
 }

api/services/password-reset-service.ts

@@ -7,7 +7,6 @@
  * @module
  */
 
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import { db } from "../db/connection.ts";
 import { isPasswordResetTokenRow } from "../model/password-reset.ts";
@@ -88,7 +87,6 @@ export async function resetPassword(
     newPassword.length > VALIDATION.PASSWORD_MAX
   ) {
     throw new APIException(
-      APIErrorCode.VALIDATION_ERROR,
       400,
       `Password must be ${VALIDATION.PASSWORD_MIN}–${VALIDATION.PASSWORD_MAX} characters`,
     );
@@ -96,11 +94,7 @@ export async function resetPassword(
 
   const payload = await verifyPasswordResetToken(token);
   if (!payload) {
-    throw new APIException(
+    throw new APIException(400, "Invalid or expired reset link");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Invalid or expired reset link",
-    );
   }
 
   const row = db.prepare(
@@ -108,11 +102,7 @@ export async function resetPassword(
   ).get(token);
 
   if (!row || !isPasswordResetTokenRow(row)) {
-    throw new APIException(
+    throw new APIException(404, "Reset token not found");
-      APIErrorCode.NOT_FOUND,
-      404,
-      "Reset token not found",
-    );
   }
 
   // Claim the link before the async hash: checking `used_at` first and
@@ -121,11 +111,7 @@ export async function resetPassword(
     `UPDATE password_reset_tokens SET used_at = ? WHERE token = ? AND used_at IS NULL;`,
   ).run(new Date().toISOString(), token);
   if (claimed.changes === 0) {
-    throw new APIException(
+    throw new APIException(409, "Reset link has already been used");
-      APIErrorCode.VALIDATION_ERROR,
-      409,
-      "Reset link has already been used",
-    );
   }
 
   try {

api/services/playlist-service.ts

@@ -7,7 +7,6 @@
  * @module
  */
 
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import type {
   CreatePlaylistRequest,
@@ -63,15 +62,15 @@ export function getPlaylistById(idOrSlug: string): Playlist {
     ? db.prepare(`SELECT ${PLAYLIST_SELECT} WHERE p.id = ?;`).get(idOrSlug)
     : db.prepare(`SELECT ${PLAYLIST_SELECT} WHERE p.slug = ?;`).get(idOrSlug);
   if (!row || !isPlaylistRow(row)) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Playlist not found");
+    throw new APIException(404, "Playlist not found");
   }
   return playlistRowToApi(row);
 }
 
 /**
- * Creates a playlist owned by `userId`, for `POST /api/playlists`. It notifies
+ * Creates a playlist owned by `userId`, for `POST /api/playlists`. If it is
- * the users its description mentions, links the attachments it embeds, and
+ * public, it notifies the users its description mentions. It links the
- * broadcasts `playlist_created`.
+ * attachments the description embeds and broadcasts `playlist_created`.
  */
 export function createPlaylist(
   req: CreatePlaylistRequest,
@@ -102,8 +101,11 @@ export function createPlaylist(
     createdAt,
   };
   if (req.description) {
+    // A private playlist's mentions are notified if it goes public.
+    if (req.isPublic) {
       notifyMentions(userId, req.description, "playlist", id, req.title);
-    linkAttachments(req.description, id);
+    }
+    linkAttachments(req.description, "playlist", id);
   }
   broadcastPlaylistCreated(playlist);
   return playlist;
@@ -124,7 +126,7 @@ export function getPlaylist(
   const playlist = getPlaylistById(playlistId);
 
   if (!playlist.isPublic && requestingUserId !== playlist.userId) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Playlist not found");
+    throw new APIException(404, "Playlist not found");
   }
 
   const rows = db.prepare(
@@ -195,8 +197,9 @@ export function listPlaylistsByUser(
 /**
  * Applies `req` to a playlist for `PUT /api/playlists/:playlistId`, and returns
  * it as it now is. The slug follows the title. `canModerate` lets someone
- * other than the owner edit it. It notifies the users the description
+ * other than the owner edit it. If the playlist is public, it notifies, in the
- * mentions, links its attachments and broadcasts `playlist_updated`.
+ * owner's name, the users the description mentions. It links the description's
+ * attachments and broadcasts `playlist_updated`.
  *
  * @throws {APIException} 404 when there is no such playlist, 403 when the user
  * is neither its owner nor a moderator.
@@ -210,7 +213,7 @@ export function updatePlaylist(
   const playlist = getPlaylistById(playlistId);
 
   if (playlist.userId !== requestingUserId && !canModerate) {
-    throw new APIException(APIErrorCode.UNAUTHORIZED, 403, "Forbidden");
+    throw new APIException(403, "Forbidden");
   }
 
   const newTitle = req.title ?? playlist.title;
@@ -243,14 +246,16 @@ export function updatePlaylist(
     updatedAt: now,
   };
   if (newDescription) {
+    if (newIsPublic) {
       notifyMentions(
-      requestingUserId,
+        playlist.userId,
         newDescription,
         "playlist",
         playlist.id,
         newTitle,
       );
-    linkAttachments(newDescription, playlist.id);
+    }
+    linkAttachments(newDescription, "playlist", playlist.id);
   }
   broadcastPlaylistUpdated(updated, playlist.isPublic);
   return updated;
@@ -271,7 +276,7 @@ export function deletePlaylist(
   const playlist = getPlaylistById(playlistId);
 
   if (playlist.userId !== requestingUserId && !canModerate) {
-    throw new APIException(APIErrorCode.UNAUTHORIZED, 403, "Forbidden");
+    throw new APIException(403, "Forbidden");
   }
 
   db.prepare(`DELETE FROM playlists WHERE id = ?;`).run(playlist.id);
@@ -293,7 +298,7 @@ export function getEditablePlaylist(
 ): Playlist {
   const playlist = getPlaylistById(playlistId);
   if (playlist.userId !== requestingUserId && !canModerate) {
-    throw new APIException(APIErrorCode.UNAUTHORIZED, 403, "Forbidden");
+    throw new APIException(403, "Forbidden");
   }
   return playlist;
 }
@@ -347,7 +352,7 @@ export function addDumpToPlaylist(
   const playlist = getPlaylistById(playlistId);
 
   if (playlist.userId !== requestingUserId && !canModerate) {
-    throw new APIException(APIErrorCode.UNAUTHORIZED, 403, "Forbidden");
+    throw new APIException(403, "Forbidden");
   }
 
   // Else someone else's private dump would land in the playlist, and its title
@@ -358,7 +363,7 @@ export function addDumpToPlaylist(
     | { title: string; is_private: number; user_id: string }
     | undefined;
   if (!dump || (dump.is_private && dump.user_id !== requestingUserId)) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Dump not found");
+    throw new APIException(404, "Dump not found");
   }
 
   const minRow = db.prepare(
@@ -376,11 +381,7 @@ export function addDumpToPlaylist(
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     if (msg.includes("UNIQUE") || msg.includes("unique")) {
-      throw new APIException(
+      throw new APIException(409, "Dump already in playlist");
-        APIErrorCode.VALIDATION_ERROR,
-        409,
-        "Dump already in playlist",
-      );
     }
     throw err;
   }
@@ -415,7 +416,7 @@ export function removeDumpFromPlaylist(
   const playlist = getPlaylistById(playlistId);
 
   if (playlist.userId !== requestingUserId && !canModerate) {
-    throw new APIException(APIErrorCode.UNAUTHORIZED, 403, "Forbidden");
+    throw new APIException(403, "Forbidden");
   }
 
   db.prepare(
@@ -443,7 +444,7 @@ export function reorderPlaylist(
   const playlist = getPlaylistById(playlistId);
 
   if (playlist.userId !== requestingUserId && !canModerate) {
-    throw new APIException(APIErrorCode.UNAUTHORIZED, 403, "Forbidden");
+    throw new APIException(403, "Forbidden");
   }
 
   // The requester can only name the dumps GET showed them. A hidden one
@@ -461,7 +462,6 @@ export function reorderPlaylist(
     !visibleIds.every((id) => newSet.has(id))
   ) {
     throw new APIException(
-      APIErrorCode.BAD_REQUEST,
       400,
       "dumpIds must match current playlist members exactly",
     );
@@ -504,11 +504,7 @@ export function getPlaylistMembershipsForDump(
 
   return rows.map((row) => {
     if (!isPlaylistRow(row)) {
-      throw new APIException(
+      throw new APIException(500, "Malformed playlist data");
-        APIErrorCode.SERVER_ERROR,
-        500,
-        "Malformed playlist data",
-      );
     }
     return {
       playlist: playlistRowToApi(row),
@@ -551,7 +547,7 @@ export function getPlaylistImageInfo(
 ): { id: string; imageMime: string; isPublic: boolean } | undefined {
   const playlist = getPlaylistById(idOrSlug);
   if (!playlist.isPublic && requestingUserId !== playlist.userId) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Playlist not found");
+    throw new APIException(404, "Playlist not found");
   }
   return playlist.imageMime
     ? {

api/services/user-service.ts

@@ -7,7 +7,6 @@
  * @module
  */
 
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import type {
   Invitee,
@@ -27,7 +26,7 @@ import {
 import { db } from "../db/connection.ts";
 import { closeUserSockets, disconnectUser } from "./ws-service.ts";
 
-import { hashPassword } from "../lib/jwt.ts";
+import { hashPassword } from "../lib/password.ts";
 import { linkAttachments } from "./attachment-service.ts";
 
 /** Selects full `UserRow`s from `users u`, with the inviter's name joined. */
@@ -42,8 +41,8 @@ const USER_SELECT =
  * `POST /api/users/register`. The caller has validated `request` and claimed
  * the invite.
  *
- * @throws {APIException} 400 when the username is taken, 409 when the email
+ * @throws {APIException} 409 when the username or the email is taken, in any
- * is.
+ * case.
  */
 export async function createUser(
   request: RegisterUserRequest,
@@ -53,15 +52,11 @@ export async function createUser(
   const createdAt = new Date();
 
   const existingUser = db.prepare(
-    "SELECT id FROM users WHERE username = ?;",
+    "SELECT id FROM users WHERE lower(username) = lower(?);",
   ).get(request.username);
 
   if (existingUser) {
-    throw new APIException(
+    throw new APIException(409, "Username already exists");
-      APIErrorCode.VALIDATION_ERROR,
-      400,
-      "Username already exists",
-    );
   }
 
   assertEmailAvailable(request.email);
@@ -82,16 +77,9 @@ export async function createUser(
       request.email,
     );
   } catch (err) {
-    // A parallel sign-up can take the name while the hash is computed; the
+    // A parallel sign-up can take the name or the address while the hash is
-    // UNIQUE constraint is the real guard. Emails have no such constraint.
+    // computed; the unique indexes are the real guard.
-    if (err instanceof Error && err.message.includes("UNIQUE")) {
+    throw uniqueViolationToConflict(err);
-      throw new APIException(
-        APIErrorCode.VALIDATION_ERROR,
-        400,
-        "Username already exists",
-      );
-    }
-    throw err;
   }
 
   return {
@@ -115,7 +103,7 @@ export function getUserById(userId: string): User {
   ).get(userId);
 
   if (!userRow || !isUserRow(userRow)) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "User not found");
+    throw new APIException(404, "User not found");
   }
 
   return userRowToApi(userRow);
@@ -152,7 +140,7 @@ export function getUserByUsername(username: string): User {
   ).get(username);
 
   if (!userRow || !isUserRow(userRow)) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "User not found");
+    throw new APIException(404, "User not found");
   }
 
   return userRowToApi(userRow);
@@ -168,21 +156,28 @@ function assertEmailAvailable(email: string, exceptUserId?: string): void {
     `SELECT id FROM users WHERE lower(email) = lower(?) AND id != ?;`,
   ).get(email, exceptUserId ?? "");
   if (row) {
-    throw new APIException(
+    throw new APIException(409, "Email already in use");
-      APIErrorCode.VALIDATION_ERROR,
-      409,
-      "Email already in use",
-    );
   }
 }
 
 /**
- * Returns the user whose email is exactly `email`, or null, for
+ * Returns `err` as a 409 when it is SQLite's unique violation on a username or
- * `requestPasswordReset`. Unlike the uniqueness check, it is case-sensitive.
+ * an email, and as it is otherwise.
+ */
+function uniqueViolationToConflict(err: unknown): unknown {
+  if (!(err instanceof Error) || !err.message.includes("UNIQUE")) return err;
+  return err.message.includes("email")
+    ? new APIException(409, "Email already in use")
+    : new APIException(409, "Username already exists");
+}
+
+/**
+ * Returns the user whose email is `email`, in any case, or null, for
+ * `requestPasswordReset`.
  */
 export function getUserByEmail(email: string): User | null {
   const userRow = db.prepare(
-    `${USER_SELECT} WHERE u.email = ?`,
+    `${USER_SELECT} WHERE lower(u.email) = lower(?)`,
   ).get(email);
 
   if (!userRow || !isUserRow(userRow)) return null;
@@ -236,7 +231,7 @@ export function listUsers(): User[] {
   ).all();
 
   if (!userRows || !userRows.every(isUserRow)) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "No user found");
+    throw new APIException(404, "No user found");
   }
 
   return userRows.map(userRowToApi);
@@ -275,7 +270,9 @@ export async function updateUser(
 
   const updatedUserRow = userApiToRow(updatedUser);
 
-  const userResult = db.prepare(
+  let userResult;
+  try {
+    userResult = db.prepare(
       `UPDATE users SET username = ?, password_hash = ?, role = ?, description = ?, email = ?, updated_at = ? WHERE id = ?`,
     ).run(
       updatedUserRow.username,
@@ -286,9 +283,12 @@ export async function updateUser(
       now.toISOString(),
       updatedUserRow.id,
     );
+  } catch (err) {
+    throw uniqueViolationToConflict(err);
+  }
 
   if (userResult.changes === 0) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "User not found");
+    throw new APIException(404, "User not found");
   }
 
   if (password) {
@@ -300,7 +300,7 @@ export async function updateUser(
   }
 
   if (updatedUser.description) {
-    linkAttachments(updatedUser.description, userId);
+    linkAttachments(updatedUser.description, "user", userId);
   }
 
   return updatedUser;
@@ -319,7 +319,7 @@ export function updateUserAvatar(userId: string, mime: string): void {
   ).run(mime, new Date().toISOString(), userId);
 
   if (result.changes === 0) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "User not found");
+    throw new APIException(404, "User not found");
   }
 }
 
@@ -371,6 +371,6 @@ export function deleteUser(userId: string): void {
   ).run(userId);
 
   if (result.changes === 0) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "User not found");
+    throw new APIException(404, "User not found");
   }
 }

api/services/vote-service.ts

@@ -8,7 +8,6 @@
  * @module
  */
 
-import { APIErrorCode } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
 import { isUserRow, type User, userRowToApi } from "../model/user.ts";
 import { db } from "../db/connection.ts";
@@ -34,7 +33,7 @@ function visibleDump(dumpId: string, userId: string): { isPrivate: boolean } {
     `SELECT is_private, user_id FROM dumps WHERE id = ?;`,
   ).get(dumpId) as { is_private: number; user_id: string } | undefined;
   if (!row || (row.is_private && row.user_id !== userId)) {
-    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Dump not found");
+    throw new APIException(404, "Dump not found");
   }
   return { isPrivate: Boolean(row.is_private) };
 }
@@ -67,11 +66,7 @@ export function castVote(dumpId: string, userId: string): VoteResult {
       db.exec("ROLLBACK;");
     } catch { /* ignore if no active transaction */ }
     if (err instanceof Error && err.message.includes("UNIQUE constraint")) {
-      throw new APIException(
+      throw new APIException(409, "Already voted");
-        APIErrorCode.VALIDATION_ERROR,
-        409,
-        "Already voted",
-      );
     }
     throw err;
   }
@@ -101,7 +96,7 @@ export function removeVote(dumpId: string, userId: string): VoteResult {
     ).run(dumpId, userId);
     if (result.changes === 0) {
       db.exec("ROLLBACK;");
-      throw new APIException(APIErrorCode.NOT_FOUND, 404, "Vote not found");
+      throw new APIException(404, "Vote not found");
     }
     db.prepare(
       `UPDATE dumps SET vote_count = vote_count - 1 WHERE id = ?;`,
@@ -155,11 +150,7 @@ export function getDumpVoters(
   ).all(dumpId, limit + 1, offset);
 
   if (!rawRows.every(isUserRow)) {
-    throw new APIException(
+    throw new APIException(500, "Malformed user data");
-      APIErrorCode.SERVER_ERROR,
-      500,
-      "Malformed user data",
-    );
   }
 
   return pageOf(rawRows.map(userRowToApi), limit);

api/services/ws-service.ts

@@ -169,27 +169,43 @@ export function broadcastPresence(): void {
 }
 
 /**
- * Sends everyone `dump_created`. The dump service also sends it when a private
+ * Tells the clients that may see a dump how it changed, for the dump service
- * dump goes public, since to everyone else that dump is new.
+ * after every write. `before` is null for a new dump, `after` for a deleted
+ * one. A private dump's changes reach its owner's sockets alone. When a dump
+ * goes private, everyone else gets `dump_deleted`; when it goes public, they get
+ * `dump_created`, since to them it is new.
  */
-export function broadcastNewDump(dump: Dump): void {
+export function broadcastDumpChange(
-  broadcast({ type: "dump_created", dump });
+  before: Dump | null,
-}
+  after: Dump | null,
+): void {
+  const dump = after ?? before;
+  if (!dump) return;
+  const ownerId = dump.userId;
+  const toOwner = (client: WsClient) => client.userId === ownerId;
+  const toOthers = (client: WsClient) => client.userId !== ownerId;
 
-/**
+  if (!after) {
- * Sends everyone `dump_updated`, for a public dump that changed. The dump
+    broadcast(
- * service calls it.
+      { type: "dump_deleted", dumpId: dump.id },
- */
+      dump.isPrivate ? toOwner : undefined,
-export function broadcastDumpUpdated(dump: Dump): void {
+    );
-  broadcast({ type: "dump_updated", dump });
+  } else if (!before) {
+    broadcast(
+      { type: "dump_created", dump: after },
+      after.isPrivate ? toOwner : undefined,
+    );
+  } else if (after.isPrivate) {
+    broadcast({ type: "dump_updated", dump: after }, toOwner);
+    if (!before.isPrivate) {
+      broadcast({ type: "dump_deleted", dumpId: after.id }, toOthers);
+    }
+  } else if (before.isPrivate) {
+    broadcast({ type: "dump_updated", dump: after }, toOwner);
+    broadcast({ type: "dump_created", dump: after }, toOthers);
+  } else {
+    broadcast({ type: "dump_updated", dump: after });
   }
-
-/**
- * Sends everyone `dump_deleted`. The dump service also sends it when a public
- * dump goes private, so that everyone else drops it.
- */
-export function broadcastDumpDeleted(dumpId: string): void {
-  broadcast({ type: "dump_deleted", dumpId });
 }
 
 /**

api/test/db/migrate.test.ts

@@ -28,14 +28,14 @@ Deno.test("runMigrations: a fresh database is left as schema.sql made it", () =>
     .get() as {
       n: number;
     };
-  assertEquals(applied.n, 16);
+  assertEquals(applied.n, 18);
   // Running again applies nothing.
   runMigrations(db);
   assertEquals(
     (db.prepare(`SELECT COUNT(*) as n FROM schema_migrations;`).get() as {
       n: number;
     }).n,
-    16,
+    18,
   );
   db.close();
 });

api/test/helpers.ts

@@ -4,7 +4,8 @@ import { TEST_DIR } from "./setup.ts";
 import { stub } from "@std/testing/mock";
 import { app } from "../main.ts";
 import { db } from "../db/connection.ts";
-import { createJWT, createMediaToken, hashPassword } from "../lib/jwt.ts";
+import { createJWT, createMediaToken } from "../lib/jwt.ts";
+import { hashPassword } from "../lib/password.ts";
 import { makeSlug } from "../lib/slugify.ts";
 import { canonicalizeUrl } from "../lib/canonical-url.ts";
 import { clearRichContentCache } from "../services/rich-content-service.ts";

api/test/lib/jwt.test.ts

@@ -1,35 +1,17 @@
 import "../setup.ts";
-import {
+import { assertEquals } from "@std/assert";
-  assert,
-  assertEquals,
-  assertFalse,
-  assertNotEquals,
-} from "@std/assert";
 import { SignJWT } from "@panva/jose";
 import {
   createJWT,
   createMediaToken,
   createPasswordResetToken,
-  hashPassword,
   verifyJWT,
   verifyMediaToken,
-  verifyPassword,
   verifyPasswordResetToken,
 } from "../../lib/jwt.ts";
 
 const KEY = new TextEncoder().encode("test-secret-test-secret-test-secret");
 
-Deno.test("hashPassword/verifyPassword round-trip with a random salt", async () => {
-  const a = await hashPassword("hunter22");
-  const b = await hashPassword("hunter22");
-  assertNotEquals(a, b);
-  assert(await verifyPassword("hunter22", a));
-  assertFalse(await verifyPassword("hunter23", a));
-  // A malformed stored hash never verifies.
-  assertFalse(await verifyPassword("hunter22", "not-a-hash"));
-  assertFalse(await verifyPassword("hunter22", ""));
-});
-
 Deno.test("session, media and reset tokens don't stand in for each other", async () => {
   const userId = crypto.randomUUID();
   const session = await createJWT({ userId, username: "u", role: "user" });

api/test/lib/password.test.ts

@@ -0,0 +1,13 @@
+import { assert, assertFalse, assertNotEquals } from "@std/assert";
+import { hashPassword, verifyPassword } from "../../lib/password.ts";
+
+Deno.test("hashPassword/verifyPassword round-trip with a random salt", async () => {
+  const a = await hashPassword("hunter22");
+  const b = await hashPassword("hunter22");
+  assertNotEquals(a, b);
+  assert(await verifyPassword("hunter22", a));
+  assertFalse(await verifyPassword("hunter23", a));
+  // A malformed stored hash never verifies.
+  assertFalse(await verifyPassword("hunter22", "not-a-hash"));
+  assertFalse(await verifyPassword("hunter22", ""));
+});

api/test/middleware/error.test.ts

@@ -2,7 +2,6 @@ import { BASE_URL } from "../helpers.ts";
 import { assertEquals } from "@std/assert";
 import { Application } from "@oak/oak";
 import { errorMiddleware } from "../../middleware/error.ts";
-import { APIErrorCode } from "../../../shared/api.ts";
 import { APIException } from "../../lib/api-exception.ts";
 
 async function handle(
@@ -20,7 +19,7 @@ Deno.test("errorMiddleware: APIExceptions keep their status, anything else is a
   app.use(errorMiddleware);
   app.use((ctx) => {
     if (ctx.request.url.pathname === "/api-error") {
-      throw new APIException(APIErrorCode.NOT_FOUND, 404, "Nope");
+      throw new APIException(404, "Nope");
     }
     throw new Error("secret internals");
   });

api/test/remote/providers/bandcamp.test.ts

@@ -1,6 +1,7 @@
 import { html, stubNetwork } from "../../helpers.ts";
-import { assertEquals } from "@std/assert";
+import { assert, assertEquals, assertFalse } from "@std/assert";
 import { fetchRichContent } from "../../../services/rich-content-service.ts";
+import { bandcampProvider } from "../../../remote/providers/bandcamp.ts";
 
 Deno.test("bandcamp provider", async () => {
   using _ = stubNetwork(() =>
@@ -12,3 +13,10 @@ Deno.test("bandcamp provider", async () => {
   assertEquals(bc?.title, "Album");
   assertEquals(bc?.embedUrl, "https://bandcamp.com/EmbeddedPlayer/album=1");
 });
+
+Deno.test("bandcamp provider: bandcamp.com and its subdomains only", () => {
+  assert(bandcampProvider.matches("https://artist.bandcamp.com/album/x"));
+  assertFalse(
+    bandcampProvider.matches("https://bandcamp.com.evil.example/album/x"),
+  );
+});

api/test/remote/providers/self.test.ts

@@ -1,4 +1,10 @@
-import { createUser, insertDump, stubNetwork, test } from "../../helpers.ts";
+import {
+  createUser,
+  insertDump,
+  insertPlaylist,
+  stubNetwork,
+  test,
+} from "../../helpers.ts";
 import { assertEquals } from "@std/assert";
 import { fetchRichContent } from "../../../services/rich-content-service.ts";
 
@@ -26,3 +32,19 @@ test("self provider: our own dump, user and playlist pages come from the DB", as
   assertEquals(profile?.title, user.username);
   assertEquals(net.calls.length, 0);
 });
+
+test("self provider: a private playlist gets no preview", async () => {
+  const user = await createUser();
+  const playlist = insertPlaylist({
+    userId: user.id,
+    title: "Secret mix",
+    isPublic: false,
+  });
+  using _net = stubNetwork(() => {
+    throw new Error("no network for self links");
+  });
+  const content = await fetchRichContent(
+    `http://gerbeur.test/playlists/${playlist.id}`,
+  );
+  assertEquals(content?.title, undefined);
+});

api/test/remote/providers/youtube.test.ts

@@ -1,6 +1,7 @@
 import { html, stubNetwork } from "../../helpers.ts";
-import { assertEquals } from "@std/assert";
+import { assert, assertEquals, assertFalse } from "@std/assert";
 import { fetchRichContent } from "../../../services/rich-content-service.ts";
+import { youtubeProvider } from "../../../remote/providers/youtube.ts";
 
 Deno.test("youtube provider: video with start time and playlist", async () => {
   using net = stubNetwork((url) =>
@@ -55,3 +56,18 @@ Deno.test("youtube provider: youtu.be, shorts, playlists and channels", async ()
   assertEquals(channel?.title, "Channel");
   assertEquals(channel?.embedUrl, undefined);
 });
+
+Deno.test("youtube provider: every YouTube host, and no other site's list", () => {
+  for (
+    const url of [
+      "https://m.youtube.com/watch?v=dQw4w9WgXcQ",
+      "https://music.youtube.com/watch?v=dQw4w9WgXcQ",
+      "https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ",
+      "https://www.youtube.com/live/dQw4w9WgXcQ",
+      "https://m.youtube.com/@someone",
+    ]
+  ) {
+    assert(youtubeProvider.matches(url), url);
+  }
+  assertFalse(youtubeProvider.matches("https://example.com/page?list=PL123"));
+});

api/test/routes/attachments.test.ts

@@ -2,6 +2,7 @@ import {
   count,
   createUser,
   db,
+  del,
   formWithFile,
   get,
   insertDump,
@@ -12,6 +13,7 @@ import {
 import type { AttachmentResponse } from "../../../shared/dump.ts";
 import type { Comment } from "../../../shared/comment.ts";
 import { assertEquals } from "@std/assert";
+import { runStartupTasks } from "../../db/startup.ts";
 
 test("attachments: upload an image, serve it back", async () => {
   const user = await createUser();
@@ -88,3 +90,48 @@ test("attachments are claimed by the first text that links them", async () => {
   });
   assertEquals(owner(), comment.data.id);
 });
+
+test("attachments in a private dump need its owner's media token", async () => {
+  const owner = await createUser();
+  const other = await createUser();
+  const up = await post<AttachmentResponse>("/api/attachments", {
+    auth: owner.auth,
+    form: formWithFile(PNG),
+  });
+  const id = up.data.id;
+  const { id: dumpId } = insertDump({ userId: owner.id, isPrivate: true });
+  await post(`/api/dumps/${dumpId}/comments`, {
+    auth: owner.auth,
+    json: { body: `![img](/api/attachments/${id})` },
+  });
+  assertEquals((await get(`/api/attachments/${id}`)).status, 404);
+  assertEquals(
+    (await get(`/api/attachments/${id}?token=${other.mediaToken}`)).status,
+    404,
+  );
+  const served = await get(`/api/attachments/${id}?token=${owner.mediaToken}`);
+  assertEquals(served.status, 200);
+  assertEquals(served.headers.get("cache-control"), "private, max-age=3600");
+});
+
+test("attachments of a deleted resource are gone, and purged at startup", async () => {
+  const user = await createUser();
+  const up = await post<AttachmentResponse>("/api/attachments", {
+    auth: user.auth,
+    form: formWithFile(PNG),
+  });
+  const id = up.data.id;
+  const { id: dumpId } = insertDump({ userId: user.id });
+  const comment = await post<Comment>(`/api/dumps/${dumpId}/comments`, {
+    auth: user.auth,
+    json: { body: `![img](/api/attachments/${id})` },
+  });
+  assertEquals((await get(`/api/attachments/${id}`)).status, 200);
+  await del(`/api/comments/${comment.data.id}`, { auth: user.auth });
+  assertEquals((await get(`/api/attachments/${id}`)).status, 404);
+  await runStartupTasks(db);
+  assertEquals(
+    count(`SELECT COUNT(*) as n FROM attachments WHERE id = ?;`, id),
+    0,
+  );
+});

api/test/routes/comments.test.ts

@@ -4,10 +4,13 @@ import {
   db,
   del,
   get,
+  html,
   insertComment,
   insertDump,
   patch,
   post,
+  put,
+  stubNetwork,
   test,
 } from "../helpers.ts";
 import { assertEquals, assertExists, assertFalse } from "@std/assert";
@@ -135,7 +138,7 @@ test("PATCH /api/comments/:id: author and moderator edit, others can't", async (
       json: { body: "x" },
     }))
       .status,
-    401,
+    403,
   );
   const edited = await patch<Comment>(`/api/comments/${commentId}`, {
     auth: author.auth,
@@ -180,7 +183,7 @@ test("DELETE /api/comments/:id soft-deletes, and a deleted comment can't be edit
   });
   assertEquals(
     (await del(`/api/comments/${commentId}`, { auth: other.auth })).status,
-    401,
+    403,
   );
   assertEquals(
     (await del(`/api/comments/${commentId}`, { auth: author.auth })).status,
@@ -264,3 +267,53 @@ test("comment likes on a private dump: owner only", async () => {
     200,
   );
 });
+
+test("comments: a reply must answer a comment on the same dump", async () => {
+  const user = await createUser();
+  const { id: a } = insertDump({ userId: user.id });
+  const { id: b } = insertDump({ userId: user.id });
+  const onB = insertComment({ dumpId: b, userId: user.id, body: "on b" });
+  for (const parentId of [onB, crypto.randomUUID()]) {
+    assertEquals(
+      (await post(`/api/dumps/${a}/comments`, {
+        auth: user.auth,
+        json: { body: "reply", parentId },
+      })).status,
+      400,
+    );
+  }
+  assertEquals(
+    count(`SELECT COUNT(*) as n FROM comments WHERE dump_id = ?;`, a),
+    0,
+  );
+});
+
+test("mentions in a private dump or its comments wait for it to go public", async () => {
+  using _net = stubNetwork(() => html("<title>Note</title>"));
+  const owner = await createUser();
+  const friend = await createUser();
+  const mentions = () =>
+    count(
+      `SELECT COUNT(*) as n FROM notifications WHERE type = 'user_mentioned' AND user_id = ?;`,
+      friend.id,
+    );
+  const dump = await post<Dump>("/api/dumps", {
+    auth: owner.auth,
+    json: {
+      url: "https://example.com/private-note",
+      comment: `for @${friend.username}`,
+      isPrivate: true,
+    },
+  });
+  assertEquals(dump.status, 201);
+  await post(`/api/dumps/${dump.data.id}/comments`, {
+    auth: owner.auth,
+    json: { body: `hey @${friend.username}` },
+  });
+  assertEquals(mentions(), 0);
+  await put(`/api/dumps/${dump.data.id}`, {
+    auth: owner.auth,
+    json: { isPrivate: false },
+  });
+  assertEquals(mentions(), 1);
+});

api/test/routes/dumps.test.ts

@@ -447,7 +447,7 @@ test("PUT /api/dumps/:id: owner and moderator may edit, others may not", async (
   assertEquals((await get<Dump>(`/api/dumps/${id}`)).data.title, "Moderated");
 });
 
-test("PUT /api/dumps/:id: invalid input is 422, a new URL refetches metadata", async () => {
+test("PUT /api/dumps/:id: invalid input is 400, a new URL refetches metadata", async () => {
   const owner = await createUser();
   const { id } = insertDump({
     userId: owner.id,
@@ -457,7 +457,7 @@ test("PUT /api/dumps/:id: invalid input is 422, a new URL refetches metadata", a
   assertEquals(
     (await put(`/api/dumps/${id}`, { auth: owner.auth, json: { title: " " } }))
       .status,
-    422,
+    400,
   );
   assertEquals(
     (await put(`/api/dumps/${id}`, {

api/test/routes/users.test.ts

@@ -339,13 +339,13 @@ test("POST /api/users/register: a taken name or email hands the invite back", as
   const inviteToken = invite(inviter.id);
   const byName = await post("/api/users/register", {
     json: {
-      username: taken.username,
+      username: taken.username.toUpperCase(),
       password: "longenough",
       email: "fresh@example.test",
       inviteToken,
     },
   });
-  assertEquals(byName.status, 400);
+  assertEquals(byName.status, 409);
   const byEmail = await post("/api/users/register", {
     json: {
       username: "fresh_name",
@@ -411,7 +411,7 @@ test("change-password: needs the current one, revokes old tokens, returns new on
     auth: user.auth,
     json: { currentPassword: "nope", newPassword: "brand-new-pass" },
   });
-  assertEquals(wrong.status, 401);
+  assertEquals(wrong.status, 403);
   const short = await post("/api/users/me/change-password", {
     auth: user.auth,
     json: { currentPassword: PASSWORD, newPassword: "short" },

api/test/routes/ws.test.ts

@@ -3,6 +3,7 @@ import {
   count,
   createUser,
   db,
+  del,
   formWithFile,
   get,
   insertComment,
@@ -507,30 +508,48 @@ wsTest("REST writes broadcast to the right audience", async (connect) => {
   const o = await connect(owner);
   const x = await connect(other);
 
-  // A public file dump arrives for everyone; a private one for no one.
+  // A public file dump arrives for everyone; a private one for its owner's
+  // other tabs alone.
   const pub = await post<Dump>("/api/dumps", {
     auth: owner.auth,
     form: formWithFile(PNG),
   });
   assertEquals((await x.next("dump_created")).dump.id, pub.data.id);
-  await post("/api/dumps", {
+  const secret = await post<Dump>("/api/dumps", {
     auth: owner.auth,
     form: formWithFile(PNG, "p.png", "image/png", { isPrivate: "true" }),
   });
+  await o.next("dump_created", (m) => m.dump.id === secret.data.id);
   await x.sync();
   assertEquals(x.all("dump_created").length, 1);
 
-  // Going private is a deletion for everyone else; going public an arrival.
+  // A private dump's edits and deletion reach its owner alone.
+  await put(`/api/dumps/${secret.data.id}`, {
+    auth: owner.auth,
+    json: { title: "Still secret" },
+  });
+  await o.next("dump_updated", (m) => m.dump.title === "Still secret");
+  await del(`/api/dumps/${secret.data.id}`, { auth: owner.auth });
+  await o.next("dump_deleted", (m) => m.dumpId === secret.data.id);
+  await x.sync();
+  assertEquals(x.all("dump_updated"), []);
+  assertEquals(x.all("dump_deleted"), []);
+
+  // Going private is a deletion for everyone else, and an update for the
+  // owner, who still has it; going public is an arrival for everyone else.
   await put(`/api/dumps/${pub.data.id}`, {
     auth: owner.auth,
     json: { isPrivate: true },
   });
   assertEquals((await x.next("dump_deleted")).dumpId, pub.data.id);
+  assert((await o.next("dump_updated")).dump.isPrivate);
   await put(`/api/dumps/${pub.data.id}`, {
     auth: owner.auth,
     json: { isPrivate: false },
   });
   await x.next("dump_created", (m) => m.dump.id === pub.data.id);
+  await o.sync();
+  assertEquals(o.all("dump_deleted").length, 1);
 
   // Comments on a private dump stay quiet.
   const priv = insertDump({ userId: owner.id, isPrivate: true });

api/test/setup.ts

@@ -1,11 +1,10 @@
 // Points the app at a throwaway database and uploads directory before any app
 // module is evaluated. api/config.ts reads the environment and api/db/connection.ts
-// opens the database at import time, so this module must be the first import
+// opens the database at import time, creating it from schema.sql, so this
-// of every test file — directly, or as helpers.ts's first import. It imports
+// module must be the first import of every test file — directly, or as
-// nothing from the app itself, and it is synchronous on purpose: a module with
+// helpers.ts's first import. It imports nothing from the app itself, and it is
-// a top-level await doesn't hold back the sibling imports that follow it.
+// synchronous on purpose: a module with a top-level await doesn't hold back
-import { DatabaseSync } from "node:sqlite";
+// the sibling imports that follow it.
-
 export const TEST_DIR = Deno.makeTempDirSync({ prefix: "gerbeur-test-" });
 
 Deno.env.set("GERBEUR_DB_PATH", `${TEST_DIR}/gerbeur.db`);
@@ -22,10 +21,3 @@ if (!Deno.env.get("TEST_VERBOSE")) {
   console.log = () => {};
   console.error = () => {};
 }
-
-// A fresh database is built from schema.sql, exactly as api/db/init.ts does.
-const db = new DatabaseSync(`${TEST_DIR}/gerbeur.db`);
-db.exec(
-  Deno.readTextFileSync(new URL("../db/schema.sql", import.meta.url)),
-);
-db.close();

deno.json

@@ -7,7 +7,7 @@
     "serve": "deno task build && deno task icons dist && deno task server:start",
     "i18n:extract": "deno run -A npm:@lingui/cli extract --clean --overwrite --workers 1",
     "i18n:compile": "deno run -A npm:@lingui/cli compile --workers 1",
-    "start": "deno task icons dist && deno run --env-file -A api/db/init.ts && deno run --env-file -A api/main.ts",
+    "start": "deno task icons dist && deno run --env-file -A api/main.ts",
     "test": "deno test -A api/ shared/",
     "test:coverage": "deno test -A --coverage=coverage/api --clean api/ shared/",
     "test:web": "deno run -A npm:vitest run",

shared/api.ts

@@ -7,22 +7,21 @@
  */
 
 /**
- * The codes an {@link APIError} may carry. The frontend shows the message and
+ * The codes an {@link APIError} may carry, one per HTTP status, which the
- * doesn't read the code, and a code goes with several statuses.
+ * backend's `APIException` derives from the status it is given. The frontend
+ * shows the message and doesn't read the code.
  */
 export const APIErrorCode = {
   BAD_REQUEST: "BAD_REQUEST",
+  UNAUTHORIZED: "UNAUTHORIZED",
+  FORBIDDEN: "FORBIDDEN",
   /** Also answers for what exists but the caller may not see. */
   NOT_FOUND: "NOT_FOUND",
-  /** Sent by the error middleware for any error that isn't an APIException. */
+  CONFLICT: "CONFLICT",
+  RATE_LIMITED: "RATE_LIMITED",
   SERVER_ERROR: "SERVER_ERROR",
-  /** Nothing sends it. */
+  /** Answers when another site, such as Bandcamp or YouTube, failed us. */
-  TIMEOUT: "TIMEOUT",
+  BAD_GATEWAY: "BAD_GATEWAY",
-  /**
-   * Sent with 401 to a caller not signed in, and with 403 to one who may not.
-   */
-  UNAUTHORIZED: "UNAUTHORIZED",
-  VALIDATION_ERROR: "VALIDATION_ERROR",
 } as const;
 
 /** Carried by the backend's `APIException`, and sent in an {@link APIError}. */

src/components/editor/Markdown.tsx

@@ -9,6 +9,7 @@ import { memo } from "react";
 import { Link } from "react-router";
 import ReactMarkdown from "react-markdown";
 import remarkGfm from "remark-gfm";
+import { useAuth } from "../../hooks/auth/useAuth.ts";
 
 /** Passed to {@link Markdown} by any component that shows a user's text. */
 export interface MarkdownProps {
@@ -121,6 +122,24 @@ function internalPath(href: string | undefined): string | null {
 
 type Components = React.ComponentProps<typeof ReactMarkdown>["components"];
 
+const ATTACHMENT_PATH_RE = /\/api\/attachments\/[0-9a-f-]{36}$/;
+
+/**
+ * Renders an image of the text. An attachment gets the viewer's media token,
+ * which the server asks for when the text linking it is private; any other
+ * image is left as written.
+ */
+function MarkdownImage(
+  { src, alt }: { src?: string | Blob; alt?: string },
+): React.JSX.Element {
+  const { mediaToken } = useAuth();
+  let url = typeof src === "string" ? src : undefined;
+  if (url && mediaToken && ATTACHMENT_PATH_RE.test(url)) {
+    url = `${url}?token=${encodeURIComponent(mediaToken)}`;
+  }
+  return <img src={url} alt={alt ?? ""} loading="lazy" decoding="async" />;
+}
+
 /**
  * Overrides react-markdown's elements. It is built once, since a new object on
  * each render would re-render every element.
@@ -137,9 +156,7 @@ const MARKDOWN_COMPONENTS: Components = {
       </a>
     );
   },
-  img: ({ src, alt }) => (
+  img: ({ src, alt }) => <MarkdownImage src={src} alt={alt} />,
-    <img src={src} alt={alt ?? ""} loading="lazy" decoding="async" />
-  ),
   // A wide GFM table scrolls inside its own box instead of the page.
   table: ({ children: tableChildren }) => (
     <div className="md-table-wrap">