v4: every page and API URL follows one of two rules, written down in API.md — pages are a hierarchy where @name is a user and any other root word a category or an app page, tabs and views are plain segments and a default view is the bare path; API resources are /api/<plural>/<key>, a user's key being an id or @name, the caller's things under /api/me, media a sub-resource, lookups by another key a query filter. ~ is gone: the feed is /, /hot, /new, /journal, /follow and /music/hot, a profile /@bob with its overview and the tabs dumps, upvoted, playlists (her own only), follow (users, and /follow/playlists), invitees and manage (role and name, for user:manage), which replace the separate UserDumps, UserUpvoted and UserPlaylists pages; /settings holds the account (now with the username) and /manage the category manager, both linked from the user menu and one's profile. Dumps and playlists live under their owner, /@bob/dumps/<slug> and /@bob/playlists/<slug>, named by slug alone: migration 0021 re-slugs them to the bare slugify(title), unique per owner and kind (the oldest keeps it, clashes get -2), renames the categories whose slug v4 reserves (hot, follow, settings…), and rewrites this site's v3 links in dump notes, comments, chat, and playlist and profile descriptions. A slug changes only when edited, through the edit forms' new link field, which proposes slugify(title) as the title changes; a username changes from /settings or, for user:manage, from /@name/manage. Every slug or name left behind stays an alias of its item or user for good (dump_slug_aliases, playlist_slug_aliases, user_aliases), so old links redirect without chaining and nobody else can take one; slugs change 3 times a day per item, names once in 30 days, moderators exempt. An alias, or a name in another case, answers the item with its current path: the pages put it in their URL (useCanonicalPath, without fetching again), and the OG middleware answers a 301. shared/paths.ts builds and parses every page path, for the client's links, the emails' (digest-service lost its own builders and its id fallbacks, and links /follow and /settings) and the server's matchers (OG tags, self previews, backlinks, self-url); shared/slug.ts holds slugify and the format categories share. Dumps and playlists carry ownerUsername and a required slug, and notifications join their users' current names and their items' paths each time they are sent or read, so renames reach them and a deleted item's has no link. The API was renamed per the plan's table: POST /api/users and /api/sessions, /api/password-resets, /api/me (with settings, password, avatar, media-token, playlists?contains=, follow, feed?from=, notifications), /api/users/:key/{dumps,upvoted,playlists,follow/users,follow/playlists,invitees,avatar} and by path /api/users/:key/{dumps,playlists}/:slug, /api/dumps?url= and ?category=, /api/dumps/:id/{file,thumbnail,metadata}, /api/playlists/:id/cover, /api/remote/{preview,image,bandcamp,youtube} (one router), and /api/unsubscribe, the v3 POST /api/users/unsubscribe staying for the digests already sent. A stored default feed tab "followed" reads as "follow" once. dumps.slug and playlists.slug stay nullable, since SQLite can't add NOT NULL without rebuilding tables others reference; every writer sets them and unique (user_id, slug) indexes hold them. 254 backend tests (new: migration 0021 on a v3 fixture, slug aliases, swaps and rate limits, username renames, aliases and limits, reads by path and their privacy, the OG 301s, both unsubscribe paths, v4-shaped digest links with no ids, notification joins, shared paths and slugs) and 668 frontend tests (new: the profile's tabs and follow views, Settings, Manage, the link field, canonical URLs on the dump, playlist and profile pages, bare default feed paths) pass, and tsc, eslint, deno check, deno lint, deno fmt and doc:lint are clean; the migration was also run on a copy of the development database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/services/playlist-service.ts

@@ -34,7 +34,7 @@ import {
   notifyMentions,
   notifyPlaylistFollowersNewDump,
 } from "./notification-service.ts";
-import { makeSlug, UUID_RE } from "../lib/slugify.ts";
+import { changeSlug, newSlug, resolveSlug } from "./slug-service.ts";
 import { linkAttachments } from "./attachment-service.ts";
 import {
   isMemberVisibleTo,
@@ -50,25 +50,34 @@ import { parseRows } from "../model/rows.ts";
  */
 const PLAYLIST_SELECT = `p.*, u.username as owner_username,
    (SELECT COUNT(*) FROM playlist_dumps pd WHERE pd.playlist_id = p.id) as dump_count
-   FROM playlists p LEFT JOIN users u ON u.id = p.user_id`;
+   FROM playlists p JOIN users u ON u.id = p.user_id`;
 
 /**
- * Returns the playlist with id or slug `idOrSlug`, private or not. A caller
- * that shows it to someone must check `isPublic` first, as the OG middleware
- * does.
+ * Returns playlist `playlistId`, private or not. A caller that shows it to
+ * someone must check `isPublic` first, as the OG middleware does.
  *
  * @throws {APIException} 404 when there is no such playlist.
  */
-export function getPlaylistById(idOrSlug: string): Playlist {
-  const row = UUID_RE.test(idOrSlug)
-    ? db.prepare(`SELECT ${PLAYLIST_SELECT} WHERE p.id = ?;`).get(idOrSlug)
-    : db.prepare(`SELECT ${PLAYLIST_SELECT} WHERE p.slug = ?;`).get(idOrSlug);
+export function getPlaylistById(playlistId: string): Playlist {
+  const row = db.prepare(`SELECT ${PLAYLIST_SELECT} WHERE p.id = ?;`)
+    .get(playlistId);
   if (!row || !isPlaylistRow(row)) {
     throw new APIException(404, "Playlist not found");
   }
   return playlistRowToApi(row);
 }
 
+/**
+ * Returns the playlist of `userId`'s whose slug is or was `slug`, private or
+ * not, or throws a 404, as {@link getPlaylistById} does. Reached by a former
+ * slug, it comes with its current one.
+ */
+export function getPlaylistByPath(userId: string, slug: string): Playlist {
+  const playlistId = resolveSlug("playlist", userId, slug);
+  if (!playlistId) throw new APIException(404, "Playlist not found");
+  return getPlaylistById(playlistId);
+}
+
 /**
  * Creates a playlist owned by `userId`, for `POST /api/playlists`. If it is
  * public, it notifies the users its description mentions. It links the
@@ -81,28 +90,21 @@ export function createPlaylist(
   const id = crypto.randomUUID();
   const createdAt = new Date();
   const title = req.title.trim();
-  const slug = makeSlug(title, id);
-  db.prepare(
-    `INSERT INTO playlists (id, user_id, title, slug, description, is_public, created_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?);`,
-  ).run(
-    id,
-    userId,
-    title,
-    slug,
-    req.description ?? null,
-    req.isPublic ? 1 : 0,
-    createdAt.toISOString(),
-  );
-  const playlist: Playlist = {
-    id,
-    userId,
-    title,
-    slug,
-    description: req.description,
-    isPublic: req.isPublic,
-    createdAt,
-  };
+  transaction(() => {
+    db.prepare(
+      `INSERT INTO playlists (id, user_id, title, slug, description, is_public, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?);`,
+    ).run(
+      id,
+      userId,
+      title,
+      newSlug("playlist", userId, title),
+      req.description ?? null,
+      req.isPublic ? 1 : 0,
+      createdAt.toISOString(),
+    );
+  });
+  const playlist = getPlaylistById(id);
   if (req.description) {
     // A private playlist's mentions are notified if it goes public.
     if (req.isPublic) {
@@ -116,17 +118,20 @@ export function createPlaylist(
 
 /**
  * Returns a playlist with the dumps `requestingUserId` may see in it, in
- * order, for `GET /api/playlists/:playlistId`. A null `requestingUserId` is a
- * signed-out viewer.
+ * order, for `GET /api/playlists/:playlistId`, and for
+ * `GET /api/users/:key/playlists/:slug` once it has found the playlist by its
+ * path. A null `requestingUserId` is a signed-out viewer.
  *
  * @throws {APIException} 404 when there is no such playlist, or it is private
  * and not theirs.
  */
 export function getPlaylist(
-  playlistId: string,
+  playlistId: string | Playlist,
   requestingUserId: string | null,
 ): PlaylistWithDumps {
-  const playlist = getPlaylistById(playlistId);
+  const playlist = typeof playlistId === "string"
+    ? getPlaylistById(playlistId)
+    : playlistId;
 
   if (!playlist.isPublic && requestingUserId !== playlist.userId) {
     throw new APIException(404, "Playlist not found");
@@ -176,7 +181,7 @@ export function searchPlaylists(
 
 /**
  * Returns a page of `userId`'s playlists, newest first, for
- * `GET /api/users/:username/playlists`. The private ones are listed only when
+ * `GET /api/users/:key/playlists`. The private ones are listed only when
  * `requestingUserId` is `userId`.
  */
 export function listPlaylistsByUser(
@@ -198,13 +203,16 @@ export function listPlaylistsByUser(
 
 /**
  * Applies `req` to a playlist for `PUT /api/playlists/:playlistId`, and returns
- * it as it now is. The slug follows the title. `canModerate` lets someone
- * other than the owner edit it. If the playlist is public, it notifies, in the
- * owner's name, the users the description mentions. It links the description's
- * attachments and broadcasts `playlist_updated`.
+ * it as it now is. A new `slug` goes through `changeSlug`, first, and a
+ * moderator is exempt from its rate limit; a new title leaves the slug as it
+ * is. `canModerate` lets someone other than the owner edit it. If the
+ * playlist is public, it notifies, in the owner's name, the users the
+ * description mentions. It links the description's attachments and
+ * broadcasts `playlist_updated`.
  *
  * @throws {APIException} 404 when there is no such playlist, 403 when the user
- * is neither its owner nor a moderator.
+ * is neither its owner nor a moderator, 400 when the slug isn't valid, 409
+ * when it is taken, 429 when it changed too often lately.
  */
 export function updatePlaylist(
   playlistId: string,
@@ -226,13 +234,15 @@ export function updatePlaylist(
     ? req.isPublic
     : playlist.isPublic;
 
+  if (req.slug !== undefined) {
+    changeSlug("playlist", playlist, req.slug, canModerate);
+  }
+
   const now = new Date();
-  const newSlug = makeSlug(newTitle, playlist.id);
   db.prepare(
-    `UPDATE playlists SET title = ?, slug = ?, description = ?, is_public = ?, updated_at = ? WHERE id = ?;`,
+    `UPDATE playlists SET title = ?, description = ?, is_public = ?, updated_at = ? WHERE id = ?;`,
   ).run(
     newTitle,
-    newSlug,
     newDescription,
     newIsPublic ? 1 : 0,
     now.toISOString(),
@@ -242,7 +252,7 @@ export function updatePlaylist(
   const updated: Playlist = {
     ...playlist,
     title: newTitle,
-    slug: newSlug,
+    slug: req.slug ?? playlist.slug,
     description: newDescription ?? undefined,
     isPublic: newIsPublic,
     updatedAt: now,
@@ -487,8 +497,8 @@ export function reorderPlaylist(
 
 /**
  * Returns each of `userId`'s playlists, newest first, and whether it holds
- * dump `dumpId`, for `GET /api/playlists/by-dump/:dumpId/memberships`. The
- * client's add-to-playlist modal shows it. The playlists have no dump count.
+ * dump `dumpId`, for `GET /api/me/playlists?contains=`. The client's
+ * add-to-playlist modal shows it.
  *
  * @throws {APIException} 500 when a row doesn't parse as a playlist.
  */
@@ -497,9 +507,11 @@ export function getPlaylistMembershipsForDump(
   userId: string,
 ): PlaylistMembership[] {
   const rows = db.prepare(
-    `SELECT p.*, pd.dump_id IS NOT NULL as has_dump
-     FROM playlists p
-     LEFT JOIN playlist_dumps pd ON pd.playlist_id = p.id AND pd.dump_id = ?
+    `SELECT p.*, u.username as owner_username,
+       (SELECT COUNT(*) FROM playlist_dumps x WHERE x.playlist_id = p.id) as dump_count,
+       EXISTS (SELECT 1 FROM playlist_dumps pd
+                WHERE pd.playlist_id = p.id AND pd.dump_id = ?) as has_dump
+     FROM playlists p JOIN users u ON u.id = p.user_id
      WHERE p.user_id = ?
      ORDER BY p.created_at DESC;`,
   ).all(dumpId, userId);
@@ -536,7 +548,7 @@ export function getPlaylistsForDump(
 }
 
 /**
- * Returns what `GET /api/playlists/:playlistId/image` needs to serve a
+ * Returns what `GET /api/playlists/:playlistId/cover` needs to serve a
  * playlist's cover, or undefined when it has none. The route serves a private
  * playlist's cover as private, so no shared cache keeps it.
  *
@@ -544,10 +556,10 @@ export function getPlaylistsForDump(
  * and `requestingUserId` isn't its owner.
  */
 export function getPlaylistImageInfo(
-  idOrSlug: string,
+  playlistId: string,
   requestingUserId: string | null,
 ): { id: string; imageMime: string; isPublic: boolean } | undefined {
-  const playlist = getPlaylistById(idOrSlug);
+  const playlist = getPlaylistById(playlistId);
   if (!playlist.isPublic && requestingUserId !== playlist.userId) {
     throw new APIException(404, "Playlist not found");
   }