v3: the API stops trusting what it's handed — a review of api/ turned up a server anyone could crash, uploads that ran script on the app's origin, and a server that would fetch its own network on request, and this closes them along with the smaller holes around them. A WebSocket message that wasn't an object (a bare null will do) threw inside the listener, which Deno treats as uncaught and exits on; messages are now shape-checked and the handler can't throw out. Uploaded files kept the MIME type the uploader's browser claimed, so an .html or .svg dump opened from /api/files ran with the session token in reach; only images, audio, video, PDF and plain text are served inline now, the rest download, and every file carries nosniff and a sandboxing CSP (PDFs aside, which Chrome won't render sandboxed). The image proxy passed image/svg+xml straight through the same way and now takes raster formats only. Outbound fetches for previews, the proxy and Bandcamp checked the hostname against a partial list — no 169.254.169.254, no 0.0.0.0, an IPv6 check that never matched a bracketed hostname, nothing for names that resolve inward, and redirects followed blindly; every hop now resolves and is refused if any address is private or reserved, redirects are walked by hand, the curl fallback is pinned to the checked IP, and /api/preview needs a login. PATCH /users/me accepted a new password without the current one and now takes only the description and email; a wrong password at login answered 500 because the handler caught its own 401, and now says 401. Changing or resetting a password now ends every older session through users.tokens_valid_after (migration 0015) and an iat on every token, with change-password handing back fresh tokens the modal keeps, and all token checks go through one authenticate() that also refuses deleted users. Invites and reset links are claimed atomically before the async hash rather than marked after, so one invite no longer opens several accounts, and an email address belongs to one account. File and thumbnail URLs carry a media-only token rather than the session token, so a URL in a log exposes files and not the account; older sessions fetch one on load. Private things stop leaking into broadcasts: private playlist updates go to their owner, votes and likes on someone else's private dump 404 and their counts go to the owner alone, and a private dump can't be slipped into a playlist. Smaller: selfProvider only claims this site's own host, so github.com/users/bob stops rendering our bob; the chat read marker can't be parked in the future on an empty chat; dump mutations use the resolved id so a slug works; multipart dumps get the title and comment limits; logins and reset requests are rate-limited through a shared token bucket; the password compare is constant-time; ffmpeg reads only local files in known video containers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/routes/ws.ts

@@ -1,6 +1,6 @@
 import { Router } from "@oak/oak";
 import { ALLOWED_ORIGINS } from "../config.ts";
-import { verifyJWT } from "../lib/jwt.ts";
+import { authenticate } from "../lib/auth.ts";
 import {
   broadcastChatMessage,
   broadcastChatMessageDeleted,
@@ -44,6 +44,7 @@ import { getUserById } from "../services/user-service.ts";
 import {
   APIException,
   type ClientToServerMessage,
+  type User,
 } from "../model/interfaces.ts";
 
 const router = new Router();
@@ -64,19 +65,24 @@ router.get("/ws", async (ctx) => {
     return;
   }
 
+  // authenticate() refuses a token whose user is gone or which predates a
+  // password change, and reads the live role from the DB. Such a socket is
+  // simply anonymous; the client's next API call gets the 401.
   const token = ctx.request.url.searchParams.get("token");
-  const authPayload = token ? await verifyJWT(token) : null;
+  const authPayload = token ? await authenticate(token) : null;
+  let user: User | undefined;
+  try {
+    user = authPayload ? getUserById(authPayload.userId) : undefined;
+  } catch {
+    user = undefined;
+  }
 
   const socket = ctx.upgrade();
 
-  // Read the live user so the role reflects the DB, not the (possibly stale)
-  // role embedded in the 7-day JWT.
-  const user = authPayload ? getUserById(authPayload.userId) : undefined;
-
   const client: WsClient = {
     socket,
-    userId: authPayload?.userId,
-    username: authPayload?.username,
+    userId: user?.id,
+    username: user?.username,
     role: user?.role,
     avatarMime: user?.avatarMime,
   };
@@ -87,16 +93,10 @@ router.get("/ws", async (ctx) => {
     broadcastPresence();
 
     try {
-      const myVotes = authPayload ? getUserVotes(authPayload.userId) : [];
-      const myCommentLikes = authPayload
-        ? getUserCommentLikes(authPayload.userId)
-        : [];
-      const unreadNotificationCount = authPayload
-        ? getUnreadCount(authPayload.userId)
-        : 0;
-      const chatRead = authPayload
-        ? getChatReadState(authPayload.userId)
-        : undefined;
+      const myVotes = user ? getUserVotes(user.id) : [];
+      const myCommentLikes = user ? getUserCommentLikes(user.id) : [];
+      const unreadNotificationCount = user ? getUnreadCount(user.id) : 0;
+      const chatRead = user ? getChatReadState(user.id) : undefined;
       socket.send(JSON.stringify({
         type: "welcome",
         users: getOnlineUsers(),
@@ -112,56 +112,12 @@ router.get("/ws", async (ctx) => {
   });
 
   socket.addEventListener("message", (event) => {
-    let msg: ClientToServerMessage;
+    // An exception escaping a WebSocket listener is uncaught in Deno and ends
+    // the process, so nothing a client sends may throw out of here.
     try {
-      msg = JSON.parse(event.data as string);
-    } catch {
-      return;
-    }
-
-    switch (msg.type) {
-      case "ping":
-        socket.send(JSON.stringify({ type: "pong" }));
-        break;
-      case "pong":
-        handleClientPong(client);
-        break;
-      case "vote_cast":
-        handleVote(client, msg.dumpId, "cast");
-        break;
-      case "vote_remove":
-        handleVote(client, msg.dumpId, "remove");
-        break;
-      case "comment_like_cast":
-        handleCommentLike(client, msg.commentId, "cast");
-        break;
-      case "comment_like_remove":
-        handleCommentLike(client, msg.commentId, "remove");
-        break;
-      case "chat_send":
-        handleChatSend(client, msg.body, msg.replyToId, msg.nonce);
-        break;
-      case "chat_typing":
-        // Typing is cosmetic: past the limit it's just dropped.
-        if (
-          client.userId &&
-          takeToken(`typing:${client.userId}`, TYPING_LIMIT)
-        ) {
-          setClientTyping(client, msg.typing === true);
-        }
-        break;
-      case "chat_focus":
-        client.chatOpen = msg.open === true;
-        break;
-      case "chat_edit":
-        handleChatEdit(client, msg.id, msg.body);
-        break;
-      case "chat_delete":
-        handleChatDelete(client, msg.id);
-        break;
-      case "chat_read":
-        handleChatRead(client, msg.at);
-        break;
+      handleMessage(client, event.data);
+    } catch (err) {
+      console.error("[ws] message handler failed:", err);
     }
   });
 
@@ -173,70 +129,150 @@ router.get("/ws", async (ctx) => {
   });
 });
 
+function handleMessage(client: WsClient, data: unknown): void {
+  if (typeof data !== "string") return;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(data);
+  } catch {
+    return;
+  }
+  // Anything but an object with a string `type` (`null`, a number, an array)
+  // is ignored rather than read from.
+  if (
+    typeof parsed !== "object" || parsed === null ||
+    typeof (parsed as { type?: unknown }).type !== "string"
+  ) return;
+  const msg = parsed as ClientToServerMessage;
+  const { socket } = client;
+
+  switch (msg.type) {
+    case "ping":
+      send(socket, { type: "pong" });
+      break;
+    case "pong":
+      handleClientPong(client);
+      break;
+    case "vote_cast":
+      handleVote(client, msg.dumpId, "cast");
+      break;
+    case "vote_remove":
+      handleVote(client, msg.dumpId, "remove");
+      break;
+    case "comment_like_cast":
+      handleCommentLike(client, msg.commentId, "cast");
+      break;
+    case "comment_like_remove":
+      handleCommentLike(client, msg.commentId, "remove");
+      break;
+    case "chat_send":
+      handleChatSend(client, msg.body, msg.replyToId, msg.nonce);
+      break;
+    case "chat_typing":
+      // Typing is cosmetic: past the limit it's just dropped.
+      if (
+        client.userId &&
+        takeToken(`typing:${client.userId}`, TYPING_LIMIT)
+      ) {
+        setClientTyping(client, msg.typing === true);
+      }
+      break;
+    case "chat_focus":
+      client.chatOpen = msg.open === true;
+      break;
+    case "chat_edit":
+      handleChatEdit(client, msg.id, msg.body);
+      break;
+    case "chat_delete":
+      handleChatDelete(client, msg.id);
+      break;
+    case "chat_read":
+      handleChatRead(client, msg.at);
+      break;
+  }
+}
+
+// Sends only while the socket is open: `send` on a closing socket throws.
+function send(socket: WebSocket, data: Record<string, unknown>): void {
+  if (socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify(data));
+}
+
 function handleVote(
   client: WsClient,
-  dumpId: string,
+  dumpId: unknown,
   action: "cast" | "remove",
 ): void {
   const { socket } = client;
 
   if (!client.userId) {
-    socket.send(
-      JSON.stringify({ type: "error", message: "Authentication required" }),
-    );
+    send(socket, { type: "error", message: "Authentication required" });
     return;
   }
+  if (typeof dumpId !== "string") return;
 
   try {
-    const newCount = action === "cast"
+    const { voteCount, isPrivate } = action === "cast"
       ? castVote(dumpId, client.userId)
       : removeVote(dumpId, client.userId);
 
-    socket.send(JSON.stringify({
+    send(socket, {
       type: "vote_ack",
       dumpId,
       action,
       success: true,
-      voteCount: newCount,
-    }));
+      voteCount,
+    });
 
-    broadcastVoteUpdate(dumpId, newCount, client.userId, action);
+    // Only a private dump's owner can vote on it, so they're its whole
+    // audience.
+    broadcastVoteUpdate(
+      dumpId,
+      voteCount,
+      client.userId,
+      action,
+      isPrivate ? client.userId : undefined,
+    );
   } catch (err) {
     const message = err instanceof APIException ? err.message : "Vote failed";
-    socket.send(JSON.stringify({ type: "error", message, dumpId, action }));
+    send(socket, { type: "error", message, dumpId, action });
   }
 }
 
 function handleCommentLike(
   client: WsClient,
-  commentId: string,
+  commentId: unknown,
   action: "cast" | "remove",
 ): void {
   const { socket } = client;
 
   if (!client.userId) {
-    socket.send(
-      JSON.stringify({ type: "error", message: "Authentication required" }),
-    );
+    send(socket, { type: "error", message: "Authentication required" });
     return;
   }
+  if (typeof commentId !== "string") return;
 
   try {
-    const newCount = action === "cast"
+    const { likeCount, isPrivate } = action === "cast"
       ? castCommentLike(commentId, client.userId)
       : removeCommentLike(commentId, client.userId);
 
-    socket.send(JSON.stringify({
+    send(socket, {
       type: "comment_like_ack",
       commentId,
       action,
-      likeCount: newCount,
-    }));
+      likeCount,
+    });
 
-    broadcastCommentLikeUpdate(commentId, newCount, client.userId, action);
+    broadcastCommentLikeUpdate(
+      commentId,
+      likeCount,
+      client.userId,
+      action,
+      isPrivate ? client.userId : undefined,
+    );
   } catch (err) {
     const message = err instanceof APIException ? err.message : "Like failed";
-    socket.send(JSON.stringify({ type: "error", message, commentId, action }));
+    send(socket, { type: "error", message, commentId, action });
   }
 }
 
@@ -253,10 +289,7 @@ function sendChatError(
   message: string,
   nonce?: string,
 ): void {
-  if (client.socket.readyState !== WebSocket.OPEN) return;
-  client.socket.send(
-    JSON.stringify({ type: "error", scope: "chat", message, nonce }),
-  );
+  send(client.socket, { type: "error", scope: "chat", message, nonce });
 }
 
 // Validates the common preconditions of a chat write: signed in and under the